This is the accessible text file for GAO report number GAO-13-102 entitled 'Medicare Program Integrity: Greater Prepayment Control Efforts Could Increase Savings and Better Ensure Proper Payment' which was released on December 10, 2012. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. United States Government Accountability Office: GAO: Report to Congressional Requesters: November 2012: Medicare Program Integrity: Greater Prepayment Control Efforts Could Increase Savings and Better Ensure Proper Payment: GAO-13-102: GAO Highlights: Highlights of GAO-13-102, a report to congressional requesters. Why GAO Did This Study: CMS reported an improper payment rate of 8.6 percent ($28.8 billion) in the Medicare fee-for-service program for fiscal year 2011. To help ensure that payments are made properly, CMS uses controls called edits that are programmed into claims processing systems to compare claims data to Medicare requirements in order to approve or deny claims or flag them for further review. GAO was asked to assess the use of prepayment edits in the Medicare program and CMS’s oversight of MACs, which process claims and implement some edits. This report examines the extent to which (1) CMS and its contractors employed prepayment edits, (2) CMS has designed adequate processes to determine the need for and to implement edits based on national policies, and (3) CMS provides information, oversight, and incentives to MACs to promote use of effective edits. GAO analyzed Medicare claims for consistency with selected coverage policies, reviewed CMS and contractor documents, and interviewed officials from CMS and selected contractors. What GAO Found: Use of prepayment edits saved Medicare at least $1.76 billion in fiscal year 2010, but GAO found that savings could have been greater had prepayment edits been more widely used. GAO illustrated this point using analysis of a limited number of national policies and local coverage determinations (LCD), which are established by each Medicare administrative contractor (MAC) to specify coverage rules in its jurisdiction. GAO identified $14.7 million in payments in fiscal year 2010 that appeared to be inconsistent with four national policies and therefore improper. These payments could have been prevented through automated prepayment edits. GAO also found more than $100 million in payments that were inconsistent with three selected LCDs and that could have been identified using automated edits. The Centers for Medicare & Medicaid Services (CMS) has three processes with some appropriately designed steps to identify the need for, and to implement, edits based on national policies, but each of these processes has at least one weakness. The weaknesses include incomplete analysis of vulnerabilities to improper payment that could be addressed by edits; lack of specific time frames for implementing edits and other corrective actions; flaws in the structure of some edits; lack of centralization in the implementation of some edits, which leads to inconsistencies; incomplete assessment of whether edits are working as intended; and lack of full documentation of the processes. For example, GAO found that Medicare paid $8.6 million in fiscal year 2010 for claims that exceeded CMS’s limits on the quantity of certain services that can be provided to a beneficiary by the same provider on a single date of service. Although edits had been implemented to limit service quantities, a weakness in their structure caused them to miss instances in which quantity limits were exceeded. CMS informs MACs about vulnerabilities that could be addressed through prepayment edits, but the agency does not systematically compile and disseminate information about effective local edits to address such vulnerabilities. CMS oversees MACs’ use of edits partly through its review of certain MAC reports, but these reports are not intended to provide a comprehensive overview of their edits. In January 2011, CMS expanded its oversight activities and began requiring MACs to report on how they had addressed certain vulnerabilities to improper payment, some of which could be addressed through edits. While CMS increased the funding in fiscal year 2011 for contractors’ medical review activities, including edit development, the agency provided relatively small incentives—-3 percent or less of all contract award fees—-to promote use of effective prepayment edits by MACs. What GAO Recommends: GAO recommends that CMS take seven actions to strengthen its use of prepayment edits, such as restructuring some edits, centralizing implementation of others, fully documenting processes, encouraging more information sharing about effective edits, and assessing the feasibility of increasing incentives for edit use. The Department of Health and Human Services generally agreed with GAO’s recommendations and noted CMS’s plans to address them. View [hyperlink, http://www.gao.gov/products/GAO-13-102]. For more information, contact Kathleen King at (202) 512-7114 or kingk@gao.gov. [End of section] Contents: Letter: Background: Prepayment Edits Saved Medicare at Least $1.76 Billion in 2010 but Were Not Used to Full Extent Possible: CMS's Processes for Identifying Needs for, and Implementing, Prepayment Edits Based on National Policies Have Weaknesses: CMS Informs MACs about Some Vulnerabilities That Could Be Addressed through Local Edits but Provides Relatively Small Financial Incentives to Promote Their Use: Conclusions: Recommendations for Executive Action: Agency Comments, Third-Party Views, and Our Evaluation: Appendix I: Scope and Methodology: Appendix II: Hypothetical Example of How Medicare Claims Can Avoid Triggering Medically Unlikely Edits (MUE): Appendix III: Comments from the Department of Health and Human Services: Appendix IV: GAO Contact and Staff Acknowledgments: Tables: Table 1: Scope, Mode, and Description of Selected Types of Prepayment Coverage, Payment, and Coding Edits: Table 2: Internal Control Standards or Activities That Apply to CMS's Determination of the Need for, and Implementation of, Prepayment Edits Based on National Policies: Table 3: Payments for Claims That Appeared to Be Inconsistent with Selected National Policies and Therefore Improper and That Could Have Been Identified through Automated Edits, Fiscal Year 2010: Table 4: Payments for Claims That Were Inconsistent with Selected Local Coverage Determinations (LCD) Issued by Medicare Administrative Contractors (MAC), Fiscal Year 2010: Table 5: Percentage of A/B Medicare Administrative Contractor (MAC) Award Fees Allocated to Specified Performance Areas, Fiscal Year 2011: Table 6: Internal Control Standards or Activities That Apply to CMS's Determination of the Need for, and Implementation of, Prepayment Edits Based on National Policies: Figure: Figure 1: Average Number of Quality Assurance Surveillance Plan (QASP) Standards Used by CMS to Evaluate A/B and DME Medicare Administrative Contractors' (MAC) Performance in Most Recent Reviews: Abbreviations: ARTS: Automated Reporting and Tracking System: CERT: Comprehensive Error Rate Testing: CMS: Centers for Medicare & Medicaid Services: CUE: Clinically Unlikely Edit: CWF: Common Working File: DME: durable medical equipment: FAR: Federal Acquisition Regulation: HCPCS: Healthcare Common Procedure Coding System: HHS: Department of Health and Human Services: ICD: International Classification of Diseases: LCD: local coverage determination: MAC: Medicare administrative contractor: MIP: Medicare Integrity Program: MMA: Medicare Prescription Drug, Improvement, and Modernization Act of 2003: MUE: Medically Unlikely Edit: NCCI: National Correct Coding Initiative: NCD: national coverage determination: OIG: Office of Inspector General: OPT: ocular photodynamic therapy: PIMR: Program Integrity Management Reports: QASP: Quality Assurance Surveillance Plan: RAC: recovery audit contractor: SAF: Standard Analytic File: [End of section] United States Government Accountability Office: Washington, DC 20548: November 13, 2012: The Honorable Thomas R. Carper: Chairman: The Honorable Scott P. Brown: Ranking Member: Subcommittee on Federal Financial Management, Government Information, Federal Services, and International Security: Committee on Homeland Security and Governmental Affairs: United States Senate: The Honorable John S. McCain: United States Senate: Since 1990, we have designated Medicare a high-risk program, due in part to its size and its susceptibility to improper payments.[Footnote 1] In fiscal year 2011, the Medicare program covered about 48 million elderly or disabled beneficiaries and paid about $550 billion in claims for health care services provided. The Centers for Medicare & Medicaid Services (CMS), which administers the program, has stated that one of its key goals is to pay claims properly the first time-- that is, to ensure that payments go to legitimate providers in the right amount for reasonable and necessary services covered by the program for eligible beneficiaries. If claims are paid properly the first time, the agency does not need to spend additional resources to recover improper payments. CMS has estimated that 8.6 percent--or about $28.8 billion--of the $336 billion in Medicare fee-for-service payments in fiscal year 2011 were improper.[Footnote 2] CMS has strategies in place to prevent, or identify and recoup, improper payments. One internal control strategy that CMS uses in an effort to pay claims properly and to administer the Medicare program effectively is the application of "prepayment edits"--instructions that CMS's contractors program into claims processing systems that serve as internal controls by comparing claim information to Medicare requirements in order to approve or deny claims or to flag them for additional review.[Footnote 3] CMS contracts with private firms to process and pay approximately 4.8 million Medicare claims per business day. In 2006, CMS began transitioning responsibility for claims administration for Medicare Parts A and B and durable medical equipment (DME) from the contractors known as fiscal intermediaries and carriers to Medicare administrative contractors (MAC), which are referred to, respectively, as A/B MACs and DME MACs.[Footnote 4] CMS also has other types of contractors to help identify and recover improper payments, address fraud and abuse, or develop specific types of edits. MACs and these other contractors also share responsibility with CMS for identifying vulnerabilities to improper payments--billing practices or patterns that are or may be associated with significant amounts of improper payments, which we refer to hereafter as "vulnerabilities"--and for taking action to address them.[Footnote 5] Most of the prepayment edits implemented by CMS and its contractors are automated, meaning that if a claim does not meet the criteria of the edit, it is automatically denied. Other prepayment edits are manual, meaning that they flag individual claims for review by trained contractor staff to determine whether the claim should be paid. Whereas automated edits are applied to all claims, manual edits are applied to very few. Less than 0.25 percent of claims received manual review that involved clinician review of the medical record. The Medicare program has defined categories of items and services eligible for coverage and excludes from coverage items or services that are determined not to be "reasonable and necessary" for the diagnosis and treatment of an illness or injury or to improve functioning of a malformed body part.[Footnote 6] CMS determines what services are covered under what conditions within the broad categories defined in law. CMS sets some national Medicare coverage and payment policies that apply to all beneficiaries. These include national coverage determinations (NCD), which describe the circumstances under which Medicare will cover particular items or services nationwide. CMS works with several contractors to implement prepayment edits for certain national coverage and payment policies. In addition to prepayment edits related to service coverage and payment, prepayment edits may be implemented to verify that the claim is properly filled out, that providers are enrolled in Medicare, or that patients are eligible Medicare beneficiaries.[Footnote 7] Each MAC has the authority to develop local coverage determinations (LCD) that delineate the circumstances under which services are considered reasonable and necessary and are therefore covered in the geographic area where that MAC processes claims. These local policies cannot conflict with national coverage and payment policies established by CMS or by law. MACs' authority to develop LCDs leads to differences in Medicare coverage policy in different areas of the country.[Footnote 8] MACs may create prepayment edits either to enforce their LCDs or to enforce national Medicare policies set by CMS, although not every LCD or national policy is structured in a way that makes edit development feasible. CMS has responsibility for providing information and oversight to MACs with respect to their use of prepayment edits to promote effective stewardship of Medicare funds. Given your interest in ensuring sound fiscal oversight of the Medicare program, you asked us to examine the use of prepayment edits that implement coverage and payment policies to achieve savings, as well as CMS's oversight of MACs, which develop and implement some edits. For this report, we assessed the extent to which (1) CMS and its contractors employed prepayment edits; (2) CMS has designed adequate processes to determine the need for prepayment edits and to implement edits based on national policies; and (3) CMS provides information, oversight, and incentives to MACs to promote use of effective prepayment edits. To address all three objectives, we reviewed the Medicare Program Integrity Manual, which provides guidance for Medicare contractors, and interviewed CMS officials and representatives of selected contractors responsible for developing prepayment edits. We focused on edits that implement coverage and payment policies, and did not include edits based on beneficiary or provider enrollment data or edits designed to verify that a claim has been properly filled out. To assess the extent to which CMS and its contractors employed prepayment edits, we reviewed data from two CMS data systems--the Automated Reporting and Tracking System (ARTS), which tracks MACs' claims administration costs, and the Program Integrity Management Reports (PIMR) system, which collects savings and usage data about prepayment edits. We conducted an analysis of paid Medicare claims from fiscal year 2010. Through a few selected examples, we assessed whether there were paid claims (1) that appeared to be inconsistent with certain national policies, which would provide examples of potentially improper payments, and (2) that were inconsistent with local coverage determinations (LCD), which would provide examples of the potential for increased savings associated with more widespread use of local edits. The national policies we chose for our analysis were among those that CMS had developed into NCDs or that had been identified with improper payments in excess of $500,000 by Medicare contractors responsible for identifying improper payments. The LCDs we chose were those for which MACs had implemented automated edits that led to relatively large savings for the Medicare program in their jurisdictions.[Footnote 9] We reviewed only examples where payments could have been prevented with automated edits because, unlike manual edits, automated edits can be used without an additional cost for claim reviewers' time for each additional claim analyzed. To assess the extent to which CMS has designed adequate processes to determine the need for prepayment edits and to implement edits based on national policies, we reviewed relevant documentation, including documents from CMS describing its processes, and reports that CMS uses to track vulnerabilities and corrective actions. We evaluated CMS's processes using criteria outlined in our internal control documents, Standards for Internal Control in the Federal Government and Internal Control Management and Evaluation Tool.[Footnote 10] The specific standards used were risk assessment, control activities (documentation), and monitoring. To assess the extent to which CMS provides information, oversight, and incentives to MACs to promote use of effective prepayment edits, we reviewed relevant documentation, including MACs' statements of work [Footnote 11] and various reports MACs are required to submit to CMS, and analyzed data from CMS's performance reviews of MACs. We performed appropriate electronic data checks for the data used in our analyses and interviewed agency officials who were knowledgeable about the data from PIMR, ARTS, and the Medicare claims database to ensure that the data were reliable enough for our purpose. We found the data were sufficiently reliable for the purpose of our analyses. We conducted this performance audit from July 2011 through November 2012 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Background: About three-quarters of all Medicare beneficiaries receive their care on a fee-for-service basis, with providers submitting claims for payment for each service provided.[Footnote 12] CMS contracts with claims administration contractors--primarily MACs--to process claims from over 1 million hospitals, physicians, and other health care providers. In fiscal year 2011, MACs and other claims administration contractors processed about 1.2 billion claims. Medicare claims administration contractors have had a role in determining coverage since 1965, when the Medicare program was enacted. At that time, Congress arranged for many Medicare functions to be contracted out to private insurers to allow the program to be implemented rapidly by organizations already processing claims for hospitals and physicians. Medicare Coverage Policies: Medicare law defines the categories of services covered by the program and provides the Secretary of the Department of Health and Human Services (HHS) with the authority to specify which services within these categories are covered and under what conditions.[Footnote 13] The Secretary delegates this responsibility to CMS, which, in turn, carries out some of these responsibilities through MACs. Consistent with Medicare law, CMS sets national coverage, payment, and coding policies regarding when and how services will be covered by Medicare, as well as coding and billing requirements for claims. CMS develops or implements the following types of national policies: * NCDs, which CMS typically develops for services that have the potential to affect a large number of beneficiaries and that have the greatest effect on the Medicare program.[Footnote 14] For example, this can include new technologies introduced into health care practice, such as use of Positron Emission Tomography scans for diagnostic purposes.[Footnote 15] Development of NCDs is a lengthy process, which requires review of clinical evidence and allows for public comment. According to CMS, the agency has the resources to develop approximately 12 NCDs per year. As of February 2012, there were 328 NCDs. * National payment policies that specify how payment will be made for covered services in certain situations--such as how physicians who collaborate on providing the same service to a beneficiary will be paid. * National Correct Coding Initiative (NCCI) coding policies, which aim to reduce inappropriate payments through the use of automated edits that deny improperly coded claims. NCCI edits include code-pair edits, which deny payment for services that should not be billed together. NCCI edits also include Medically Unlikely Edits (MUE), which deny payment for services where the quantity billed is at a level not likely to be provided under normal medical practice, such as daily doses of drugs higher than the maximum amounts in the prescribing information or services that are anatomically impossible, such as more than one appendectomy on the same beneficiary. CMS allows exceptions to MUEs and some code-pair edits when providers believe the services provided are clinically appropriate. In such cases, special codes called modifiers are included on the claim to indicate why the services were clinically appropriate. MACs may develop local coverage policies as long as these policies are consistent with national policy. MACs develop the following types of local coverage policies: * LCDs, which specify the circumstances under which services will be covered in a MAC's jurisdiction.[Footnote 16] According to CMS, allowing MACs to develop LCDs allows for timely local reaction to changes in the practice of medicine. MACs also use LCDs to place limits on services that may be overused or abused in their jurisdictions.[Footnote 17] Before implementing or revising an LCD, a MAC must review clinical evidence and incorporate the information reviewed into the proposed LCD, provide notice of proposed changes on its website, and, in some cases, seek public input from potentially affected individuals or organizations, such as physicians whose billing could be affected by the policy. There are currently thousands of LCDs. * Limits on quantities of services that will be covered in a MAC's jurisdiction. A quantity limit may be included within an LCD or developed separately as a Clinically Unlikely Edit (CUE). CMS and its contractors have developed and implemented various types of prepayment edits based on national and local coverage policies. (See table 1.) Table 1: Scope, Mode, and Description of Selected Types of Prepayment Coverage, Payment, and Coding Edits: Type: Edits based on national coverage determinations (NCD); Scope: National or local; Mode: Automated or manual; Description: These edits compare information from claims with Medicare requirements in NCDs, which specify the circumstances under which a service is covered, to identify claims that should not be paid. Type: Edits based on national payment policies; Scope: National or local; Mode: Automated or manual; Description: These edits compare information from claims with policies regarding payments to providers and coverage limitations contained in the Medicare Claims Processing Manual and other CMS documents, to identify claims that should not be paid. Type: Code-pair edits developed through the National Correct Coding Initiative (NCCI); Scope: National; Mode: Automated; Description: These edits deny payment for services that should not be billed together in order to prevent improper payment of these services. Type: Medically Unlikely Edits (MUE) developed through the NCCI; Scope: National; Mode: Automated; Description: These edits deny payment for services where the number of units billed on the claim line exceeds the maximum number a provider would bill under most circumstances for a beneficiary on a single date of service in order to prevent improper payment of these services. Type: Edits based on local coverage determinations (LCD); Scope: Local; Mode: Automated or manual; Description: These edits compare information on claims to LCDs, to determine whether the claim should be paid. In the absence of a national coverage policy, local contractors may determine the circumstances under which a service is covered. LCDs also can articulate additional detail about how a national coverage policy will be applied. Type: Clinically Unlikely Edits (CUE); Scope: Local; Mode: Automated; Description: These edits are similar to MUEs but are developed and implemented at the local level. Source: GAO analysis of CMS documents and interviews with CMS officials. Note: The prepayment edits listed here focus on clinical criteria, including procedure and diagnosis codes. Other prepayment edits include edits that identify improper provider and beneficiary data. [End of table] Medicare Claims Processing and Review: MACs are responsible for processing and paying claims, generally in specific geographic jurisdictions, in compliance with coverage and payment policies. Health care providers generally submit claims to the MAC responsible for the geographic area where the services were delivered or the beneficiary resides.[Footnote 18] Providers submit claims using a standardized coding system, known as the Healthcare Common Procedure Coding System (HCPCS), to identify the medical services, equipment, and other goods provided.[Footnote 19] Claims also identify relevant patient diagnoses, using a different coding system called the International Classification of Diseases (ICD). Medicare fee-for-service claims processing includes several basic steps that involve three types of systems: MAC front-end systems, shared systems, and the Common Working File (CWF). * MAC front-end systems. Claims are submitted to MACs, whose front-end computer systems perform automated checks to determine whether claims meet certain requirements, such as that the data are complete. * Shared systems. Claims that meet the initial requirements in the front-end systems are sent to one of three shared systems--depending on the type of claim--where they are subjected to prepayment edits based on coverage and payment policy criteria.[Footnote 20] Claims that do not meet these criteria are either automatically denied or flagged for review by trained staff. These systems also verify that providers are enrolled in Medicare. Claims that are not denied by automated edits or suspended for manual review by manual edits in the shared systems are then sent to the CWF, the central CMS system that authorizes payment. * Common Working File. The CWF verifies beneficiary eligibility, coordinates Part A and Part B benefits, and determines the extent of Medicare's responsibility for payment, based on such factors as whether beneficiaries' deductibles have been met or utilization limits have been reached. From there, claims are returned to the relevant shared system for final processing and then payments are sent to providers. The process of determining whether claims are consistent with Medicare coverage, payment, and medical coding policies--which includes the application of edits based on these policies, as well as manual review of flagged claims--is known as the medical review process. Of the two categories of prepayment edits used by MACs in this process--automated and manual--automated are less resource intensive. CMS policy requires that automated edits be used whenever possible. However, many improper claims can be identified only through more costly manual review, because staff may have to review associated medical records and claims history or exercise clinical judgment to determine whether a service is reasonable and necessary and therefore should be approved for payment. CMS officials indicated that there are about 17,000 prepayment edits related to medical coverage issues in PIMR.[Footnote 21] However, some edits--in particular, those that require manual review--may not be in use at any given time for various reasons, such as the staff costs associated with manual review, or because changes in provider behavior make the edit unnecessary. In addition, edits can vary in complexity and the policy issues covered, since some automated edits address only a portion of one coverage policy, while other automated edits address multiple policies.[Footnote 22] There are limitations to the use of prepayment edits and associated manual review as medical review strategies because some claims can be identified as improper only after a payment is made.[Footnote 23] CMS employs recovery audit contractors (RAC) to find and correct overpayments and underpayments after claims have been processed. Although some of the improper payments identified by RACs could have been prevented by prepayment edits, others can be identified only after payment through review of medical records. CMS requires RACs to provide information, based on their analyses, about vulnerabilities, including those that could be addressed through prepayment edits. CMS Oversight of MACs: CMS's oversight of MACs is governed by the terms of the MACs' contracts, which in turn reflect provisions of the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA). The MMA includes a requirement for CMS to use competitive procedures to select contractors to process claims; to develop performance standards for these contractors, including standards for customer satisfaction; and to provide incentives for these contractors to provide high-quality service.[Footnote 24] CMS established the MAC contracts as cost-plus-award-fee contracts, a type of cost- reimbursement contract designed to provide sufficient motivation to encourage excellence in contract performance.[Footnote 25] Specifically, a MAC may earn an incentive, known as an award fee, based on performance, in addition to reimbursement for allowable costs and a base fee for the contract, which is fixed at the inception of the contract. Under the terms of these contracts, CMS sets requirements for MACs with respect to prepayment edits and other aspects of the medical review process. In general, CMS requires MACs to target medical review to areas that pose the greatest financial risk to the Medicare program and where their efforts are likely to produce the best return on investment, and also to implement automated prepayment edits whenever appropriate. CMS also requires MACs to assess the effectiveness of their edits and to submit their medical review strategies to CMS for review and approval. However, MACs have considerable discretion in developing local coverage policies and in deciding how to implement edits to address both local and national coverage policies. CMS assesses MACs' performance in part through its Quality Assurance Surveillance Plan (QASP) review and its Award Fee Plan review. [Footnote 26] For the QASP review, which is generally conducted annually, CMS evaluates each MAC's performance against a MAC-specific subset of performance standards in accordance with the statement of work and other requirements specified in related CMS policy documents. The Award Fee Plan identifies the criteria upon which the MAC will be evaluated and provides an explanation of when the MAC can potentially earn an incentive based on its performance. On an annual basis, CMS creates an award fee plan for each MAC that contains metrics that are generally more challenging to achieve than the requirements outlined in the statement of work. The pool of award fees available to each MAC is established during contract negotiations and depends in part on the negotiated division of fees between award fees and base fees. CMS monitors the accuracy of the MACs' claims payment determinations through its Comprehensive Error Rate Testing (CERT) Program, which measures improper payments. Each year, CMS establishes a national error rate goal under the Government Performance and Results Act of 1993. To calculate error rates, CMS's CERT Program contractor randomly samples Medicare fee-for-service claims and reviews them after payment. Currently, CMS publishes error rates by type of error, type of claim--for example, DME--and clinical setting, as well as nationally.[Footnote 27] Prior to 2009, CMS also published contractor- specific error rates. However, in that year, CMS implemented a new methodology for CERT claim reviews, and as a result, the error rates computed for 2009 were not comparable to those computed for previous years.[Footnote 28] CMS used contractor-specific error rates in award fee plan reviews in fiscal year 2011. Internal Control: CMS, like other agencies, is responsible for maintaining internal control--the component of an organization's management that provides reasonable assurance that the organization achieves effective and efficient operations, reliable financial reporting, and compliance with applicable laws and regulations. Internal control standards provide a framework for identifying and addressing major performance challenges and areas at greatest risk for mismanagement. As noted above, GAO has published guidelines for internal controls, and we used these guidelines to assess some of CMS's processes. (See table 2 for the specific internal control standards and activities we used.) Table 2: Internal Control Standards or Activities That Apply to CMS's Determination of the Need for, and Implementation of, Prepayment Edits Based on National Policies: Standard or activity: Risk assessment; Description of elements applicable to our assessment: Management comprehensively identifies risk using various methodologies as appropriate. A determination is made on how best to manage or mitigate the risk and what specific actions should be taken. Standard or activity: Documentation[A]; Description of elements applicable to our assessment: Internal control and all transactions and other significant events are clearly documented, and the documentation is readily available for examination; The documentation appears in management directives, administrative policies, or operating manuals in either paper or electronic form. All documentation and records are properly managed and maintained. Standard or activity: Monitoring; Description of elements applicable to our assessment: Corrective action is taken or improvements made within established time frames to resolve the matters brought to management's attention. Agency personnel obtain information about whether their internal control is functioning properly. Source: GAO. Notes: Information is from GAO, Standards for Internal Control in the Federal Government, [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1] (Washington, D.C.: November 1999), and GAO, Internal Control Management and Evaluation Tool, [hyperlink, http://www.gao.gov/products/GAOGAO-01-1008G] (Washington, D.C.: August 2001). [A] Documentation is an activity under the standard called Control Activities. [End of table] Prepayment Edits Saved Medicare at Least $1.76 Billion in 2010 but Were Not Used to Full Extent Possible: CMS reported that the use of prepayment edits saved Medicare $1.76 billion in fiscal year 2010, but the reported total is likely to be an underestimate because CMS does not collect information on savings from all of its current edits. Moreover, the savings could have been greater had prepayment edits been more widely used. Our analysis of Medicare data using only a limited number of national policies identified payments that appeared to be improper and that might have been prevented through wider use of automated edits. We also found that wider use of edits based on LCDs could have led to increased savings. Using just three MAC-issued LCDs as examples, we found that MACs in other geographic areas processed Medicare payments totaling more than $100 million for services that were not covered under the three policies we selected. Use of Prepayment Edits Led to Reported Savings of $1.76 Billion, but That Total Is Probably an Underestimate: Although CMS's PIMR data indicate that Medicare savings from prepayment edits were $1.76 billion in fiscal year 2010, that total is probably an underestimate because CMS does not collect information on savings from all of its current edits.[Footnote 29] For example, although the savings total included $497 million in savings from some NCCI code-pair edits, it did not include savings from other NCCI code- pair edits or from MUEs. In addition to lacking complete information about total savings from edits, CMS also lacked reliable information about savings associated with particular types of edits. For example, PIMR did not contain reliable data about fiscal year 2010 savings attributable to automated edits versus manual edits or to edits based on national policy versus those based on local policy. Although PIMR captured both kinds of information, CMS officials said these data were unreliable because not all MACs defined and reported information about edits in the same way. However, in 2011, CMS issued new reporting instructions for contractors to standardize definitions for various types of edits. CMS also does not centrally track all of its costs related to developing and implementing edits. Our analysis of ARTS data showed that MACs incurred about $59 million in costs for tasks directly related to prepayment edits and medical review in their most recent contract year.[Footnote 30] However, ARTS data do not capture all costs related to prepayment edits and medical review. For example, CMS does not track its staff costs to develop national edits or to oversee MACs' edit development and implementation, which include tasks such as conducting medical review of claims, developing LCDs, and analyzing the effectiveness of edits. In addition, ARTS data do not include approximately $1.1 million in costs incurred for another contractor to develop NCCI edits. Wider Use of Automated Edits Based on National Policies Could Have Prevented Some Improper Payments: Our analysis of Medicare claims data, for which we selected five national Medicare policies, found cases in which Medicare paid for services that appeared to be inconsistent with its national coverage and coding policies. Specifically, we found $14.7 million in payments from fiscal year 2010 that appeared to be inconsistent with four of the selected policies and therefore improper.[Footnote 31] At least some of these payments that were improper could have been prevented by prepayment edits. (See table 3.) For each of the four policies, the steps we followed for our analysis also could have been followed on a prepayment basis using automated edits because the steps consisted of a review of only the procedure codes, diagnosis codes, and quantities provided, all of which could be determined prior to claim payment. (See appendix I for a description of the analytic approach.) For the remaining policy, we found no payments that appeared to be inconsistent. Table 3: Payments for Claims That Appeared to Be Inconsistent with Selected National Policies and Therefore Improper and That Could Have Been Identified through Automated Edits, Fiscal Year 2010: Policy: Medically Unlikely Edits (MUE)[A]; Medicare payment amount identified: $8.6 million; Description: Medicare limits service quantities that can be billed for the same beneficiary, on the same day, by the same provider. We identified payments where the quantity of services was greater than those limits and the claims did not include modifiers to explain why the limit was exceeded. Policy: National coverage determination (NCD) on vagus nerve stimulation; Medicare payment amount identified: $5.0 million; Description: Medicare does not cover vagus nerve stimulation, which involves delivering an electrical pulse to the brain, for treatment of resistant depression. We identified paid claims for vagus nerve stimulation where depression was a diagnosis on the claim. Policy: NCD on ocular photodynamic therapy (OPT) and NCD on verteporfin[B]; Medicare payment amount identified: $1.1 million; Description: Medicare requires that OPT and verteporfin be delivered together as a treatment for vision problems. Also, a diagnostic test is required prior to treatment. We identified paid claims where OPT and verteporfin were not delivered on the same day or the diagnostic test was not performed. Total Medicare payment amount identified: $14.7 million. Source: GAO analysis of Medicare data. [A] We analyzed only claims from noninstitutional providers of outpatient services, such as physician services. In addition, we analyzed only MUEs for which CMS had published the service or item limits. CMS does not publish the service or item limits for some MUEs designed to identify services or items commonly billed fraudulently. [B] CMS issued separate NCDs for OPT and verteporfin. [End of table] We found that Medicare paid $8.6 million for claims that exceeded the MUE quantity limits for a single beneficiary under most circumstances on a single date of service.[Footnote 32] By the beginning of fiscal year 2012, CMS had established quantity limits for about 10,800 HCPCS codes for services provided by physicians and other noninstitutional outpatient service providers.[Footnote 33] Claims can have multiple lines, with a single service claimed on each line. MUEs look for excess quantities of services provided to a single beneficiary by a single provider on each individual claim line. (See app. II for an example of how excess quantities of services could be billed in a way that avoids triggering an MUE.) Therefore providers still could be paid for more than the maximum quantity specified under the policy if quantities were divided among multiple lines on the same claim or among multiple claims for the same beneficiary. When we analyzed claims using the method actually applied by MUEs--in which each claim line was analyzed independently--we found only about $400,000 in paid claims that exceeded the MUE quantity limits. However, when we analyzed claims using the quantity limits to identify payments for the same beneficiary, same provider, and same date of service--whether on the same claim line or multiple claim lines--we found $8.6 million in paid claims that exceeded quantity limits. [Footnote 34] We also found $6.1 million in payments that appeared to be inconsistent with three selected NCDs and therefore improper. For a fourth NCD, we did not find any payments that appeared to be inconsistent. Using one of the three NCDs, which prohibits use of vagus nerve stimulation to treat resistant depression, we found that Medicare paid about $5.0 million in fiscal year 2010 for vagus nerve stimulation for claims with diagnoses for depression.[Footnote 35] In addition, using two NCDs that address a treatment for age-related macular degeneration, we found $1.1 million in payments that appeared to be improper.[Footnote 36] These two related NCDs stipulate that this macular degeneration treatment must use both ocular photodynamic therapy (OPT) and the drug verteporfin together and that beneficiaries must receive a diagnostic test prior to treatment.[Footnote 37] The $1.1 million we found was for claims for the therapy without the diagnostic test, the therapy without the drug, or the drug without the therapy. We did not find any payments that appeared to be inconsistent with the remaining NCD, which establishes that Medicare does not cover lumbar artificial disc replacement for beneficiaries older than age 60.[Footnote 38] Wider Use of Edits Based on MACs' LCDs Could Have Led to Increased Savings: Our analysis of Medicare claims using three selected LCDs demonstrated the potential for increased savings. Variation in Medicare coverage and in the prepayment edits used to enforce coverage policy in different geographic areas results in Medicare paying for services that are covered in some parts of the country but not others. We found that MACs other than those whose LCDs we used as the basis for our analysis paid more than $100 million for claims that were inconsistent with these three LCDs.[Footnote 39] (See table 4.) These payments cannot necessarily be classified as improper because other MACs may not have had a similar LCD in place.[Footnote 40] However, variation in coverage among MACs can result in greater or lesser use of services in some jurisdictions than in others. Although greater use of services does not necessarily reflect overuse, leading health care experts have noted that overuse of services is a significant problem that has led to increased health care spending, including in the Medicare program. More widespread use of automated edits that some MACs found to be among their most effective at identifying claims for services that they do not consider reasonable and necessary could have led to more consistent coverage throughout the country and therefore to savings for the Medicare program as a whole. Table 4: Payments for Claims That Were Inconsistent with Selected Local Coverage Determinations (LCD) Issued by Medicare Administrative Contractors (MAC), Fiscal Year 2010: Policy: LCD on monitored anesthesia care; Amount identified[A]: $68.7 million; Description: Monitored anesthesia care, which involves monitoring patients' vital physiological functions while they are under anesthesia, was covered by a MAC only for specified diagnoses. We identified claims in other MAC jurisdictions that did not contain any of the diagnoses required by the MAC with the policy. Policy: LCD on parathormone; Amount identified[A]: $30.9 million; Description: A parathyroid hormone test was covered by a MAC only for specified diagnoses, such as chronic renal disease, vitamin deficiencies, or osteoporosis. The policy limited coverage to one test per day, under most circumstances. We identified claims in other MAC jurisdictions that did not contain any of the diagnoses required by the MAC with the policy and claims that exceeded limits on daily quantities. Policy: LCD on noninvasive cerebrovascular studies; Amount identified[A]: $4.5 million[B]; Description: These services, which involve identifying potential problems in the structure of, or flow of blood in, the carotid artery, were covered by a MAC only for certain specified diagnoses. We identified claims in other MAC jurisdictions that did not contain any of the diagnoses required by the MAC with the policy. Total Amount identified[A]: $104.1 million. Source: GAO analysis of CMS and MAC data. Notes: Data are from Medicare claims, CMS Medicare Coverage Database, and MAC-supplied data about automated edits. These LCDs do not conflict with national coverage policy. [A] For each LCD analyzed, we excluded results from the MAC that issued the policy. [B] We analyzed only claims from noninstitutional providers of outpatient services, such as physician services, because the MAC whose policy we used applies an automated edit only to those claims for this policy. [End of table] In our analysis, we found about $68.7 million in payments for monitored anesthesia care that were made by MACs other than the MAC whose LCD we used as the basis for this analysis.[Footnote 41] The LCD specified the diagnoses for which monitored anesthesia care would be covered by Medicare in the MAC's jurisdiction. The MAC whose LCD we used for this analysis had implemented an automated edit to identify claims that lacked one of the required diagnoses. In addition, we found about $30.9 million in payments for claims for a test of parathyroid hormone levels that was performed more than once per day or lacked one of the diagnoses required by the MAC whose LCD we used. The LCD identified a set of diagnoses for which a parathormone test would be covered as medically necessary and generally prohibited coverage for more than one service per day.[Footnote 42] Medicare payments in 2 of the 15 MAC jurisdictions made up about half--$17.1 million--of the payments we identified as inconsistent with the parathormone LCD. Finally, we found about $4.5 million in payments in fiscal year 2010 that were inconsistent with an LCD covering tests to measure blood flow to the brain. The claims we found did not contain any of the diagnoses required by that LCD. CMS's Processes for Identifying Needs for, and Implementing, Prepayment Edits Based on National Policies Have Weaknesses: CMS has three processes for identifying the need for, and implementing, prepayment edits based on national policies: (1) the NCCI process; (2) the Vulnerability Tracking Corrective Action Process; and (3) the NCD process. The designs of these processes have steps consistent with our internal control standards. However, they also have weaknesses that hinder their effectiveness in preventing improper payments. CMS's NCCI Process to Develop Code-Pair Edits and MUEs Adheres to Some Internal Control Standards but Has Weaknesses: The NCCI process, which CMS initiated in 1996, aims to reduce inappropriate payments through the development and implementation of automated edits that deny certain types of improperly coded claims. The NCCI process develops two types of edits. Code-pair edits are designed to result in denial of claims for services to a beneficiary with pairs of codes that should not be billed together. MUEs are designed to result in denial of claims with units of service that exceed the maximum number a provider would bill under most circumstances. The first step outlined in the NCCI process--in which CMS identifies risks that can be addressed with NCCI edits--is consistent with our risk assessment internal control standard that calls for agencies to identify risks comprehensively using various methods. To identify the need for an NCCI edit, CMS's NCCI contractor reviews information from a variety of sources, including MAC medical directors, publications of national health care organizations, new laws and regulations, and annual changes in procedure codes. In general, the NCCI contractor staff told us that they propose a code-pair edit whenever they identify a procedure or item where proper payment could be enhanced, irrespective of the size of the potential vulnerability. However, CMS guidance indicates that the magnitude of potential program vulnerability is one possible rationale for setting an MUE at a particular level. CMS has procedures for deciding whether to implement an NCCI edit, consistent with our risk assessment standard that calls for deciding on appropriate corrective actions. To help CMS determine whether an NCCI edit might be appropriate, the NCCI contractor reviews CMS policy, standards of medical and surgical practice, current coding practice, and provider billing patterns. The contractor then presents information on proposed edits in regular meetings with senior-level CMS staff assigned to NCCI workgroups, who then decide whether to implement proposed edits.[Footnote 43] CMS generally provides a review and comment period before implementing edits to allow for input from representative national organizations that may be affected by the edits. CMS considers the comments when it makes its final decision about implementing an edit, but does not necessarily decide against an edit because of adverse comments. CMS implements NCCI edits on a regular timeline, consistent with our monitoring standard that calls for taking action within established time frames. The NCCI contractor provides a file of new and revised edits to CMS on a quarterly basis. The contractors then download this file from CMS's Data Mover to integrate it into the claims payment systems.[Footnote 44] Representatives of MACs we contacted said they receive the edit files in a timely manner. CMS has procedures in place to determine whether NCCI edits are operating as intended before applying the edits in processing claims. Prior to submitting the edit files to CMS, the NCCI contractor performs a series of quality control checks to ensure that the edits are operating correctly. Representatives of the MACs we contacted said they also test these edits to ensure they are operating correctly within the shared systems. However, the MUE edits are not working to enforce the MUE limits because of how they are structured. Thus, this monitoring step does not meet our standard that calls for agencies to assess whether internal controls are functioning properly. As noted above, MUEs are structured to identify each claim line in which units of service exceed the MUE limit, and do not identify excess units billed across multiple claim lines.[Footnote 45] As a result, we identified about $8.2 million in Medicare payments in fiscal year 2010 for quantities of services that exceeded published MUE limits but were not identified by MUEs because the excess amounts were billed across multiple claim lines.[Footnote 46] The NCCI contractor recognized this weakness in the MUEs and recently recommended to CMS that MUEs be restructured so that they are applied against all claims reported for a single date of service rather than against each line of a claim. Finally, the process for developing NCCI edits is adequately documented, consistent with our control activities standard that calls for agencies to develop written policies and procedures for their activities. CMS has documented its processes for NCCI edits in a policy manual that explains the rationale for these edits and how edit decisions are made. The document is updated annually and is available to the public on the CMS website. CMS's Vulnerability Tracking Process Lacks Time Frames for, and Assessment of, Corrective Actions: CMS's Vulnerability Tracking Corrective Action Process (Vulnerability Tracking) began in November 2008 and is still evolving, according to agency officials. It was originally developed to track vulnerabilities identified by the RACs and corrective actions taken, but it has expanded to include vulnerabilities identified through other means. CMS can decide to address these vulnerabilities with prepayment edits or with other types of corrective actions. To identify risks associated with vulnerabilities to improper payments, CMS has designed a process that calls for analyzing several sources of information, an approach consistent with our risk assessment standard that calls for comprehensively identifying risks. CMS staff analyze available data--such as CERT data and data on improper payments identified by RACs and other CMS contractors--in order to identify potential vulnerabilities and determine whether they are actual vulnerabilities. CMS staff then assess the risks posed by these vulnerabilities and prioritize them for corrective action based on five criteria: (1) the associated CERT error rate; (2) whether the vulnerability has been identified by RACs as a "major finding," meaning a vulnerability for which more than $500,000 was identified for recoupment; (3) overall financial effect; (4) geographic effect and scope; and (5) political and media sensitivity.[Footnote 47] Although the application of criteria to prioritize vulnerabilities is a strength of CMS's process, we found a weakness in how CMS analyzes RAC data to identify vulnerabilities to prioritize for correction through edits or other actions. When setting the threshold to determine whether a RAC-identified vulnerability should be considered a major finding, CMS considers only the amount identified by each RAC and does not aggregate the amounts across all RACs that have identified similar vulnerabilities and may not consider thoroughly the potential national scope of vulnerabilities that one or two RACs are pursuing. CMS officials told us they do not routinely review information on RAC-identified vulnerabilities under the $500,000 threshold. As a result, CMS can leave vulnerabilities unaddressed, some of which could be addressed with prepayment edits. For example, as of December 2011, the four RACs had identified a total of about $503,000 in improper payments for claims for the services of clinical social workers provided during inpatient stays. Because this amount was not identified by a single RAC, this would not meet the definition of a major finding. CMS also does not take into account the period over which the RACs identified the improper payments. CMS has designed procedures for determining what actions will be taken to address vulnerabilities, including prepayment edits, which is consistent with our risk assessment standard that calls for deciding on appropriate corrective actions to address risks. The agency has assembled a Corrective Action Development Team, which meets weekly to review analyses on prioritized vulnerabilities and to propose corrective actions to leadership in the CMS Provider Compliance Group, which is responsible for vulnerability tracking. The Provider Compliance Group can develop edits or take other corrective actions such as publishing provider education articles, referring vulnerabilities to other CMS components, or referring vulnerabilities to the MACs to be addressed at the local level.[Footnote 48] CMS officials in the Provider Compliance Group told us they had developed at least three edits as part of the Vulnerability Tracking process to address identified vulnerabilities, and were in the process of developing edits to address at least 10 other vulnerabilities identified by the RACs. CMS has not specified time frames for implementing all corrective actions, contrary to our monitoring standard that calls for taking corrective action within established time frames. CMS officials explained that they have not done so because the time involved can vary from a few days to several months, depending on the work involved in determining and implementing the appropriate action. For example, CMS officials told us that staff may conduct research to determine whether local and national edits have already been implemented to address the vulnerability in question. But CMS has not established planned time frames for addressing each vulnerability once the agency has determined the type of corrective action needed.[Footnote 49] Also, as recently reported by the HHS Office of Inspector General (OIG), the Provider Compliance Group has not established procedures or time frames for following up with other CMS components to which it has referred vulnerabilities, to ensure that vulnerabilities have been resolved.[Footnote 50] CMS has not obtained information to assess whether all of its edits and other corrective actions taken through its Vulnerability Tracking Process are functioning properly, contrary to our monitoring standard. However, CMS does test edits before implementation and has assessed the effects of some edits and other corrective actions. According to CMS officials, all edits CMS develops centrally are implemented through the change management process, which includes testing prior to implementation to ensure they are working as intended. With respect to other types of corrective actions, CMS officials told us they gathered and analyzed data to assess two corrective actions to see if the actions were having the intended effects and have plans to conduct similar data analyses to assess others 18 to 24 months after implementation, when their effects will be more evident. However, CMS officials said they do not have the resources to monitor the results of all edits or other corrective actions themselves and that, depending on the risk to the program, the agency may rely on information from other entities, such as reports from RACs, the CERT contractor, or the HHS OIG. While information from these entities can be useful, our standard on monitoring calls for routine monitoring that assesses the effectiveness of control activities, which CMS managers told us they are not doing. CMS officials indicated that better data on the effects of edits will be available when the agency replaces its PIMR database. CMS has developed preliminary documentation of the Vulnerability Tracking Process, but the documentation is incomplete and therefore inconsistent with our control activities standard with respect to documentation, which calls for agencies to develop written policies and procedures for their activities. CMS's documentation specifies roles and responsibilities for CMS teams, identifies sources of information about potential vulnerabilities, specifies criteria for prioritizing vulnerabilities for corrective action,[Footnote 51] and lists possible corrective actions. The document also lists monitoring of corrective action plans as a responsibility of CMS staff and mentions assessing billing and payment trends as a monitoring strategy. However, this documentation does not establish time frames for monitoring corrective actions, as the HHS OIG also reported. In addition, it does not outline required steps to take if the corrective action is not working as intended. CMS's Process for Implementing Edits Based on NCDs May Have Led to the Inconsistent Application of National Policies and Lacks Assessment and Documentation: According to CMS officials, there are procedures in place for agency staff to decide whether to implement an edit based on an NCD. As described by CMS officials, this process for determining whether to implement an edit based on an NCD is consistent with our risk assessment standard that calls for deciding on appropriate corrective actions. CMS develops NCDs to describe the circumstances under which Medicare covers certain services. CMS officials told us that, when feasible, CMS develops and implements edits to enforce the policy behind the NCD to ensure that claims that do not follow the policy are not paid. According to CMS officials, when the agency develops an NCD, staff in the CMS component responsible for policy development consult with staff in the component responsible for provider billing to determine whether an automated edit can be developed. However, CMS officials could not confirm that such consideration was consistently given in the past. Although agency officials told us they had separate documentation on each of the edits implemented based on an NCD, the agency has not assembled that information. Therefore, CMS could not readily provide information about all of its edits based on NCDs, or all of the NCDs for which there are associated edits. If CMS determines that an automated edit based on the NCD is not possible-- for example, because certain aspects of the NCD are not specific or because the necessary procedure and diagnosis codes do not exit [Footnote 52]--CMS assigns MACs the responsibility of ensuring that they process claims in conformance with the policy.[Footnote 53] Some aspects of the agency's approach to implementing edits based on NCDs are consistent with our standard that calls for taking action within established time frames, but other aspects have weaknesses. If CMS determines that an automated edit based on the NCD is possible, the edit is generally implemented through a change request, which calls for central implementation and follows documented procedures and specific time frames. However, for some edits, CMS has assigned responsibility to MACs to independently program and integrate the edits into the shared systems. CMS officials told us that they have sometimes assigned responsibility to MACs because there is a queue for implementing system changes at the national level, and in some cases MACs can implement edits more quickly. CMS officials acknowledged that having multiple MACs program some edits based on NCDs may have led to inconsistent implementation of national coverage policy. CMS officials also noted that this approach creates more work than necessary for MACs, particularly because each MAC must update the edits regularly to reflect coding changes, which can lead to additional inconsistencies. Our claims analysis found instances where inconsistent implementation of NCDs may have led to improper payments. As we reported earlier, we found about $6.1 million in payments in fiscal year 2010 that appeared to be inconsistent with three NCDs we selected for analysis. CMS officials told us that the agency is considering steps to address inconsistent implementation of NCD-based edits by assessing whether the agency can implement centrally all automated prepayment edits based on NCDs. CMS is working with a contractor to update coding for NCDs as part of the transition to the International Classification of Diseases 10th Edition (ICD-10).[Footnote 54] As part of this transition, the contractor has begun to inventory the edits based on NCDs. The contractor will also consider whether automated prepayment edits could be developed and implemented centrally for NCDs that do not currently have them. CMS officials also told us that centrally coding edits based on NCDs will help ease MAC workloads. CMS tests edits based on NCDs before implementation to ensure they are working as intended, but the agency does not assess the effects of these edits thereafter, contrary to our monitoring standard that calls for agencies to assess whether internal controls are functioning properly. CMS officials told us the shared systems maintainers test edits prior to implementation, and the MACs subsequently test the edits as well. However, according to CMS officials in both components responsible for NCD-based edits, neither component monitors the effects of these edits nor tracks savings information. CMS officials did not provide any written guidance outlining the decision-making process they described to us, contrary to our control activities standard that calls for agencies to develop written policies and procedures for their activities. They also did not provide documentation that the process has been followed for each NCD developed recently. CMS Informs MACs about Some Vulnerabilities That Could Be Addressed through Local Edits but Provides Relatively Small Financial Incentives to Promote Their Use: CMS informs MACs about program vulnerabilities that could be addressed through local prepayment edits and about the varying coverage policies MACs have implemented in their jurisdictions, but the agency does not systematically compile and disseminate information about effective local edits. To oversee MACs' efforts to address vulnerabilities, which include implementation of edits, CMS requires MACs to report on plans to address specific vulnerabilities and examines some of these reports as part of performance reviews. In fiscal year 2011, CMS increased the funding allocated to MACs for medical review activities by 12 percent.[Footnote 55] However, the agency provided relatively small financial incentives in the form of award fees to motivate MACs to make more effective use of prepayment edits. CMS Provides Information about Some Vulnerabilities but Does Not Systematically Disseminate Information about Effective Local Edits: CMS provides information to MACs about some program vulnerabilities that could be addressed through prepayment edits. The agency also provides some information about local coverage policies, but little about effective prepayment edits and the policies on which they are based. Vulnerabilities. CMS disseminates information to MACs about program vulnerabilities through several channels. One key channel is the agency's regular reports identifying vulnerabilities. For example, CMS publishes midyear and annual reports on improper payments identified by CERT and also makes CERT data available to MACs to conduct their own analyses. Other data CMS makes available include the Part B National Summary Data file, which MACs can use to compare the utilization rates of providers in their jurisdiction to national rates, to detect potentially aberrant billing patterns. In addition, CMS facilitates regular conference calls and meetings with MACs at which vulnerabilities are discussed. For example, CMS leads three conference calls per month, each focusing on a different type of claim, in which MACs can obtain information from RACs about vulnerabilities these other contractors have identified in their analyses of paid claims. CMS also sponsors two annual meetings for A/B MAC staff--one for medical directors and another for medical review managers--and similar meetings for DME MAC staff, at which vulnerabilities may be discussed. Local coverage policies. CMS facilitates information sharing about local coverage policies through regular conference calls and national meetings two to three times per year. CMS also maintains a public web- based Medicare Coverage Database that contains detailed information about both NCDs and LCDs. MACs considering changes to local coverage policy can search the database for information about related NCDs or LCDs. Some of the LCD descriptions contain enough information, including diagnosis and procedure codes, to give an idea of the edits that may have been implemented to enforce them. However, the LCD descriptions do not indicate whether those edits have actually been implemented or provide any measure of the effectiveness of those that have. Prepayment edits. Although CMS facilitates limited and generally informal information sharing among MACs about their prepayment edits, the agency does not systematically compile and disseminate information about effective edits. Such information would include information about the national or local coverage policies on which the edits are based and the savings they have generated. CMS requires MACs to analyze the effectiveness of each of their edits--quarterly for manual edits and annually for automated edits--but does not require MACs to report this information to the agency.[Footnote 56] Although CMS may examine MACs' documentation of these analyses as part of broader reviews, it does not compile or analyze the data across MACs. Representatives of one of the MACs we contacted said that if a vulnerability were widespread, CMS might ask a MAC that had successfully addressed it to present information about its edit and associated savings to other MACs during a regularly scheduled conference call or national meeting. However, representatives of another MAC noted that sharing of information about edits typically occurred in informal exchanges among MACs at national meetings and did not include information about savings. CMS lacks a complete and centralized source of information on the most effective local edits that could facilitate information sharing. The PIMR database was established by CMS specifically to compile information about the edits implemented by claims administration contractors and to collect savings and cost data to assess the edits' effectiveness. However, CMS officials reported that the database has not served that purpose since MACs began processing claims, in part because MACs' cost data are collected in a system that does not link to PIMR. In addition, PIMR lacks descriptions of many edits, which MACs must enter manually, and, according to CMS officials, it has other flaws that significantly limit its usefulness as a tool for identifying effective edits.[Footnote 57] CMS contracted with a consultant to evaluate the system and make recommendations for an upgrade or replacement. CMS received these recommendations in January 2012, but agency officials we interviewed could not say if or when HHS would approve the funding for a new system. CMS officials said the agency will stop using the PIMR database in July 2012. Until a new database is in place, the agency will continue using a manual data collection process initiated in September 2011, in which staff compile in a spreadsheet information from MACs about the number of claims denied and dollars saved each month by different types of edits, including automated and manual prepayment edits. CMS's Oversight of Edit Use Relies Partly on MACs' Reports on Their Efforts to Address Specific Vulnerabilities: CMS provides oversight of MACs' use of prepayment edits primarily through its review of certain MAC reports, through annual QASP reviews, and, most recently, through directives requiring the MACs to explain whether and how they have addressed certain vulnerabilities specified by CMS. CMS review of MAC reports. CMS requires MACs to submit several types of reports that include partial information about their use of prepayment edits. These reports include annual medical review strategies and monthly status reports:[Footnote 58] * Medical review strategies. As directed by CMS, the central element of each MAC's annual medical review strategy is a prioritized list of the specific vulnerabilities the MAC has deemed most critical to address and a description of plans to address them, which may include implementation of prepayments edits or other efforts, such as provider education. The strategy must also indicate the data analyses the MAC conducted, describe methods for assessing the effectiveness of planned interventions, and explain how the work will be managed, staffed, and budgeted. CMS assigns two staff members--one with expertise in medical review and another, generally from a CMS regional office, with broader responsibility for monitoring a MAC's performance--to review each MAC's medical review strategy.[Footnote 59] In addition, according to CMS officials, the CMS group responsible for medical review began in 2011 to conduct what they intend to be annual conference calls with each MAC to discuss its medical review strategy. Representatives of two MACs we contacted said that CMS has sometimes requested revisions to their medical review strategies--for example, to provide more detail about certain aspects of their plans. * Monthly status reports. CMS requires MACs to submit monthly status reports to inform the agency of problems and risks encountered during the review period and actions taken to address them, which may include implementation of new local coverage policies or prepayment edits. [Footnote 60] These reports are reviewed by multiple CMS staff members with expertise in the different functional areas covered by the reports and discussed in monthly conference calls with each MAC. These reports are designed to provide CMS with information about prepayment edits MACs have implemented to address or explore specific vulnerabilities or potential vulnerabilities, but not to provide a comprehensive overview of MACs' use of prepayment edits. For example, in their medical review strategies, MACs commonly described plans to conduct probe reviews--reviews of a representative sample of claims that have been flagged by manual edits--which are designed to determine the nature and extent of vulnerabilities in order to develop appropriate interventions. Although the protocols for some of these reports call for MACs to describe their active manual edits, they do not call for MACs to describe or document the effectiveness of all the edits they have implemented or to identify their most effective edits. QASP reviews. CMS also oversees MACs' use of prepayment edits through QASP reviews, but these reviews include a greater number of standards related to other aspects of MACs' performance, such as financial management. CMS selects the standards to include in each MAC's review based in part on areas of concern in each MAC's performance. The number of QASP standards focused on a particular performance area is significant because MACs' eligibility for award fees depends partly on the percentage of QASP metrics passed. Specifically, for a MAC to be eligible for award fees, it must have a rating of satisfactory or better in all categories in which it was rated that year in the Contractor Performance Assessment Reporting System.[Footnote 61] Recent QASP reviews have included relatively few performance standards related to medical review--the one performance area that focuses on prepayment edits and associated review of claims--compared with the number related to other aspects of MACs' performance. (See fig. 1.) QASP reviews of A/B MACs typically included two standards related to medical review--one focused on MACs' strategies for this review and the other on their handling of skilled nursing facility demand bills.[Footnote 62] QASP reviews of DME MACs typically included only one standard focused on medical review strategies. Although the agency developed a third medical review QASP standard, focused on CERT rates, CMS officials told us the agency has rarely used it because of recent revisions to the CERT methodology. Figure 1: Average Number of Quality Assurance Surveillance Plan (QASP) Standards Used by CMS to Evaluate A/B and DME Medicare Administrative Contractors' (MAC) Performance in Most Recent Reviews: [Refer to PDF for image: horizontal bar graph] Performance area: Audit and reimbursement[A]; A/B MACs: 13; DME MACs: 0. Performance area: Provider customer service; A/B MACs: 8; DME MACs: 6. Performance area: Financial management; A/B MACs: 8; DME MACs: 9. Performance area: Management of Medicare secondary payer claims; A/B MACs: 8; DME MACs: 6. Performance area: Appeals; A/B MACs: 7; DME MACs: 9. Performance area: Claims processing; A/B MACs: 5; DME MACs: 4. Performance area: Provider enrollment[A]; A/B MACs: 4; DME MACs: 0. Performance area: Medical review; A/B MACs: 2; DME MACs: 1. Source: GAO analysis of CMS data. Notes: We defined the fiscal year of the QASP reviews based on the end date of the period under review. Depending on the MAC, the most recent review conducted at the time we obtained data from CMS was in fiscal year 2010 or 2011. [A] The DME MACs do not conduct activities in this performance area. [End of figure] The QASP review of MACs' medical review strategy is extensive, but is not designed to evaluate the extent to which MACs are employing effective edits. The protocol for this standard calls for reviewers to evaluate the medical review strategy and related documentation, including sample manual reviews, on more than a dozen dimensions, including whether the MAC used the corrective action process specified by CMS. However, because the medical review strategy is not intended to provide a comprehensive overview of a MAC's use of prepayment edits, this standard cannot be used to evaluate the extent to which a MAC has implemented effective prepayment edits. In addition, while reviewers are expected to assess whether the MAC used a variety of data sources, including CERT, to support its medical review activities, they are not expected to assess whether the MAC's data analyses were adequate to identify the greatest program vulnerabilities. Review of MACs' responses to CMS directives regarding specific vulnerabilities. In January 2011, CMS began requiring MACs to report quarterly on how they had addressed or planned to address certain vulnerabilities identified by the agency based on information from RACs, CERT, audits by the HHS OIG, and other sources. For at least one vulnerability, CMS directed MACs to consider implementing an edit, such as an edit to address high rates of outpatient therapy services, but did not require them to do so. In other cases, MACs reported that they had implemented an edit based on the analysis they had conducted at CMS's direction.[Footnote 63] This new oversight represents a positive effort by CMS to direct MACs' attention to vulnerabilities identified as high priority by the agency through its synthesis of information from multiple data sources, and to gather information from MACs both about the extent of each vulnerability in their jurisdictions and about the corrective actions they have taken. As of December 2011, CMS had issued four quarterly directives, each of which listed one to nine vulnerabilities. The agency had not yet established a process to analyze MACs' responses or to disseminate information about corrective actions that appear promising, but agency officials indicated that they intend to track MACs' responses. MAC representatives we interviewed in September 2011 said they had not yet received any feedback from CMS about the quarterly reports they submitted in April and June. CMS Provides Relatively Small Financial Incentives to Promote Use of Effective Prepayment Edits: In fiscal year 2011, CMS increased the funding allocated to MACs for medical review activities by 12 percent, to $147 million.[Footnote 64] Overall funding for the Medicare Integrity Program (MIP), which supports these activities, increased by less (9.3 percent) over this period. CMS officials stated that the agency had made a concerted effort to target some of the additional MIP funding to contractors' medical review activities. However, CMS provided relatively small financial incentives for MACs to exceed contract requirements related to medical review activities, including prepayment edits. In the most recent contract periods for which we had data, award fees represented 1 to 5 percent of the total value of MACs' contracts.[Footnote 65] In fiscal year 2011, award fees allocated to the one performance area most directly related to MACs' use of prepayment edits and medical review--the CERT area, which included one performance metric focused on payment error rates-- accounted for 3 percent or less of the award fee pool for any MAC. [Footnote 66] (See table 5.) The CERT metric is designed to motivate MACs to meet CMS's national error rate goal and to reduce their error rate from the prior year. One way that MACs can make progress toward these goals is through use of effective prepayment edits and medical review, although the error rate is also influenced by other factors. [Footnote 67] Table 5: Percentage of A/B Medicare Administrative Contractor (MAC) Award Fees Allocated to Specified Performance Areas, Fiscal Year 2011: Performance area: Contract administration; Minimum: 30%; Maximum: 41%. Performance area: Appeals; Minimum: 14%; Maximum: 18%. Performance area: Provider customer service; Minimum: 14%; Maximum: 18%. Performance area: Program integrity support; Minimum: 3%; Maximum: 17%. Performance area: Systems security; Minimum: 4%; Maximum: 12%. Performance area: Workload processing; Minimum: 0%; Maximum: 8%. Performance area: Beneficiary inquiries; Minimum: 4%; Maximum: 5%. Performance area: Comprehensive Error Rate Testing (CERT); Minimum: 0%; Maximum: 3%. Performance area: Audit quality; Minimum: 0%; Maximum: 1%. Source: GAO analysis of CMS data. Notes: We defined the fiscal year of the award fee plans based on the end date of the contract year under review. The A/B MAC award fee plans for this year included no more than one metric in some performance areas--contract administration, systems security, CERT, and audit quality--but multiple metrics in other areas, in some cases because there were separate metrics for Medicare Part A and Part B. Specifically, the appeals area included up to five metrics, program integrity support included up to three, and provider customer service, workload processing, and beneficiary inquiries each included up to two. None of the DME MAC award fee plans included metrics for audit quality, CERT, or workload processing, so the minimum and maximum percentages allocated to the other performance areas were generally higher than those for A/B MACs. [End of table] CMS officials said that the agency chooses the metrics to include in an award fee plan and the amount to allocate to each metric based in part on the areas in which the agency particularly wants to see improvement in a MAC's performance. Metrics are removed or made more difficult in subsequent years once met. CMS included the CERT metric in award fee plans for six of the nine A/B MACs but none of the DME MACs in fiscal year 2011, even though the error rate for DME claims has been much higher than for other claims.[Footnote 68] CMS officials said the agency had intended to include this metric in award fee plans earlier, but the agency had revised the CERT methodology for measuring payment errors in 2009. As a result, the agency needed to establish a new baseline for each MAC's payment error rate using the new methodology before measuring MAC performance with this metric. CMS intends to provide different financial incentives to RACs to conduct prepayment reviews in a 3-year demonstration that is scheduled to begin in summer 2012. In the demonstration, RACs, which previously conducted only postpayment review of claims, will begin to conduct prepayment reviews of certain types of claims that historically have resulted in high rates of improper payments.[Footnote 69] Unlike the MACs, RACs have been compensated by contingency fees for overpayments collected and underpayments refunded and will also be compensated on a contingency basis for improper payments prevented through prepayment reviews. CMS officials told us that based on the results of that demonstration they may adjust which contractors conduct prepayment work and the incentives provided to do so. Conclusions: The application of prepayment edits is an important strategy to help ensure that Medicare claims are paid properly the first time. As CMS data show, this strategy prevented at least $1.76 billion in improper payments in fiscal year 2010 alone. But CMS has opportunities to further reduce improper payments by promoting more widespread use of effective prepayment edits. CMS has processes in place to identify the need for and to develop edits based on national policies--such as NCDs and MUEs--but these processes could be improved. CMS could do more to ensure that edits based on NCDs are implemented consistently, such as centralizing the process within the agency rather than leaving it up to MACs. Greater attention to developing centralized NCD edits whenever possible could reduce improper payments. CMS could also do more to ensure that its edits are structured to enforce the national policies on which they are based. Our findings show that CMS has paid for quantities of service in excess of its policies for what would ordinarily be provided to a beneficiary on a single day, because MUEs allow payment for excessive quantities of services if those quantities are spread over multiple claim lines or multiple claims, even if explanatory modifiers are not included. Although CMS has made progress in cataloging and assessing vulnerabilities in a structured way, it could do more to improve some of its analysis and documentation. Specifically, the agency could improve how it prioritizes vulnerabilities identified by RACs in their postpayment reviews by compiling the information on these vulnerabilities differently--for example, by aggregating the overpayments identified by all the RACs for a given vulnerability, rather than considering each RAC's findings in isolation. CMS could further strengthen its Vulnerability Tracking process and edits based on NCDs by developing written procedures for steps where such documentation is currently lacking. This would include specifying time frames for taking corrective actions, methods for assessing the effects of corrective actions, and procedures to ensure that CMS considers and ultimately implements edits for all applicable NCDs, including older NCDs that were not previously considered for automated edits. CMS could take several actions to encourage MACs to implement effective prepayment edits at the local level by collecting and providing information about the underlying coverage policies and savings associated with edits that have proved particularly effective in some jurisdictions, and, if feasible, by increasing the incentives for edit implementation. Currently, CMS lacks the information needed to assess how effectively MACs are employing prepayment edits, even in comparison with other MACs. The agency has taken steps to improve the information it collects about edits by setting new reporting standards and pursuing a possible replacement for the PIMR database. Until a new database is in place, CMS could facilitate an information exchange about edits among MACs through some of its usual channels. Each MAC would need to consider local circumstances in deciding whether to implement LCDs and related edits similar to those used by another MAC. Nevertheless, systematic exchanges of information about policies and edits that have proved particularly effective in some jurisdictions would highlight for MACs additional ways to help ensure that Medicare pays only for reasonable and necessary services. CMS has recently begun encouraging MACs to address certain vulnerabilities by requiring them to report on what actions, if any, they have taken. This has led to MACs reporting on or implementing edits. CMS could also consider encouraging MACs to implement prepayment edits by increasing the financial incentives for them to do so. Award fees offer a mechanism to provide such an incentive, but the share of award fees CMS allocated to the one metric most directly related to prepayment edits and medical review in 2011 was relatively small. Recommendations for Executive Action: In order to promote greater use of effective prepayment edits and better ensure proper payment, we recommend that the CMS Administrator take the following seven actions. To promote implementation of effective edits based on national policies, we recommend that the CMS Administrator: * centralize within CMS the development and implementation of automated edits based on NCDs to ensure greater consistency; * implement MUEs that assess all quantities provided to the same beneficiary by the same provider on the same day, so providers cannot avoid claim denials by billing for services on multiple claim lines or multiple claims without including modifiers that reflect a declaration that quantities above the normal limit are reasonable and necessary; * revise the method for compiling information about RAC-identified vulnerabilities to identify their full extent and prioritize them accordingly; and: * develop written procedures to provide guidance to agency staff on all steps in the processes for developing and implementing edits based on national policies, including (1) time frames for taking corrective actions, (2) methods for assessing the effects of corrective actions, and (3) procedures for ensuring consideration of automated edits whenever possible, including for all existing NCDs and other national policies. To encourage more widespread use of effective local edits by MACs, we recommend that the CMS Administrator: * improve the data collected about local prepayment edits to enable CMS to identify the most effective edits and the local coverage policies on which they are based and disseminate this information to MACs for their consideration; * until CMS has a new database in place to collect information about edits, require MACs to share information about the underlying policies and savings related to their most effective edits; and: * assess the feasibility of providing increased incentives to MACs to implement effective prepayment edits. Agency Comments, Third-Party Views, and Our Evaluation: We provided a draft of this report to HHS for comment and received written comments, which are reprinted in appendix III. In its written comments, HHS generally concurred with our seven recommendations and cited actions that CMS plans to take to address them. In addition, we had obtained the views of third parties--CMS's contractors--on specific sections of an earlier draft. Both HHS and the contractors provided technical comments, which we addressed as appropriate. HHS generally agreed with our four recommendations to promote implementation of effective edits based on national policies. HHS agreed with our recommendation to centralize the development and implementation of automated edits. In response to our recommendation to implement MUEs that assess all quantities provided to the same beneficiary by the same provider on the same date of service, HHS agreed to further investigate how to address this recommendation but noted that there are numerous clinical situations in which MUEs can reasonably be exceeded. The agency commented that our report did not identify which services would benefit from improved MUEs without causing unreasonable claim denials. However, we believe all claims payments we identified could reasonably have been denied because we identified only payments for claims without modifier codes, and--as HHS noted in its comments--providers should include modifier codes when billing above the MUE limits. If CMS implemented MUEs as we recommended, it could continue to allow providers to use modifiers as indicators of medical necessity for exceeding the MUE limits. HHS also agreed with our recommendation to revise the method for compiling information about vulnerabilities identified by Recovery Audit Contractors. Finally, the agency agreed with our recommendation to create written procedures for developing and implementing edits based on national policies and said CMS would take steps to address this recommendation by December 31, 2012. HHS also agreed with our three recommendations to encourage more widespread use of effective local edits by MACs. In response to our recommendation that CMS improve the data collected about local edits, the agency acknowledged that the data-collection process needed improvement and said that CMS would explore ways to collect data about local edits from MACs. In addition, to address our recommendation that CMS require MACs to share information about the local policies and savings related to their most effective local edits, the agency said CMS would issue a Technical Direction Letter to MACs about collaborating on the most effective edits. Finally, HHS agreed with our recommendation to assess the feasibility of providing increased incentives to MACs to implement effective prepayment edits and said the units within CMS that are responsible for overseeing MAC contracts--which CMS calls "business owners"--would assess the feasibility and benefits of increasing performance incentives. However, the agency noted that any changes to a MAC's award fee plan proposed by CMS during an existing evaluation period would need to be agreed to by the MAC. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Administrator of CMS, and other interested parties. In addition, the report will be available at no charge on the GAO website at [hyperlink, http://www.gao.gov]. If you or your staffs have any questions about this report, please contact me at (202) 512-7114 or kingk@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV. Signed by: Kathleen M. King: Director, Health Care: [End of section] Appendix I: Scope and Methodology: We used several methods to assess the extent to which (1) the Centers for Medicare & Medicaid Services (CMS) and its contractors employed prepayment edits, (2) CMS has designed adequate processes to determine the need for prepayment edits and to implement edits based on national policies, and (3) CMS provides information, oversight, and incentives to Medicare administrative contractors (MAC) to promote use of effective prepayment edits. To address these objectives, we reviewed data from CMS databases, interviewed CMS officials and MAC representatives, conducted an analysis of Medicare claims data, reviewed CMS documentation on processes to develop and implement edits to assess consistency with our internal control standards, and reviewed relevant CMS and MAC documents, such as those that described MAC's medical review activities and CMS's oversight of those activities. Review of Data from CMS Databases: To assess the extent to which CMS and its contractors employed prepayment edits, we reviewed data from two CMS data systems--the Program Integrity Management Reports (PIMR) system and the Automated Reporting and Tracking System (ARTS)--that contain information about the savings and costs associated with prepayment edits. We obtained PIMR data reports from CMS for fiscal year 2010 that contained information about the savings associated with prepayment edits for each claims administration contractor. We also obtained ARTS data reports from CMS showing MACs' task budgets and costs. In the ARTS reports, we identified the specific tasks most closely associated with prepayment edits and related medical review, including the development of underlying local coverage determinations (LCD), and confirmed our identification of these tasks with CMS officials. We then calculated MACs' prepayment-edit-related costs for the most recently completed contract period--in almost all cases, one year--as of August 4, 2011, the date on which CMS provided the data to us. Depending on the MAC, these data represented a contract period ending in fiscal year 2010 or fiscal year 2011. Analysis of Medicare Claims Data: To assess whether CMS and its contractors applied prepayment edits to the extent possible, we selected a sample of five national and three local policies that could be implemented using automated edits and analyzed paid Part B claims from fiscal year 2010 to identify payments that appeared to be inconsistent with those policies. We selected components of policies that could be implemented using automated edits because automated edits are less costly for MACs to use than manual edits. For national policies, we identified paid claims that appeared to be inconsistent with the policy in all MAC jurisdictions. For local policies, we identified paid claims that were inconsistent with the policy in all MAC jurisdictions except the jurisdiction that implemented the coverage policy and associated edit that we selected for analysis. Selection of National and Local Policies on Which Our Analysis Was Based: We selected national policies for which Recovery Audit Contractors (RAC) had identified improper payments in excess of $500,000 through fully automated postpayment reviews or national coverage determinations (NCD) for which CMS had not initiated a corrective action using a quarterly Technical Direction Letter to MACs at the time of our review.[Footnote 70] We also restricted our selection to those policies for which automated prepayment edits could be implemented and which could be analyzed using data elements in the Carrier Standard Analytic File (SAF), which contains claims data about noninstitutional providers of outpatient services such as physicians, and the Outpatient SAF, which contains claims data about services from institutional outpatient providers such as hospital outpatient departments and rural health clinics. (For some analyses, we used only the Carrier SAF because the edits on which those analyses were based applied only to claims that would appear in this file.) We selected LCDs from three MACs that process Part A and Part B claims[Footnote 71] whose contracts were in effect at the start of fiscal year 2010 and were not scheduled to be recompeted in 2011.[Footnote 72] We selected the three MACs to include some that served a high-fraud area, had a high medical review savings per beneficiary relative to other MACs, were identified by CMS as having an effective medical review strategy, and were geographically dispersed.[Footnote 73] We asked these three MACs to identify the 10 automated edits they had in place for Part B services in fiscal years 2009 and 2010 that generated the most savings to the Medicare program, and to provide information about the savings generated by each of those edits and about the LCDs or other local policies on which these edits were based. We chose to analyze LCDs for monitored anesthesia care, parathormone, and noninvasive cerebrovascular studies because (1) they were feasible to analyze using data elements in the Carrier and Outpatient SAFs, (2) fewer than half of the other A/B MACs operating at the start of fiscal year 2010 had implemented a similar LCD,[Footnote 74] and (3) the edits based on these LCDs had generated a relatively high amount of overall savings. Our analysis of this selected sample of policies and associated edits was intended to allow us to illustrate whether greater savings to the Medicare program could be achieved if effective prepayment edits--and, in some cases, the underlying LCDs--were implemented more widely. Our sample is not an exhaustive list of every policy that could be implemented more fully through additional edits. Analytic Approach: We took steps to confirm that we understood the policies and that our analytic approach was appropriate. To confirm our understanding of Medically Unlikely Edits (MUE), we discussed our analytic approach with the contractor that creates MUEs and reviewed CMS documentation about MUEs. To confirm our understanding of other national policies, we discussed them with CMS. We discussed the selected LCDs with the MACs that issued them to ensure that our interpretation of the LCDs was accurate. To further test the validity of our analyses based on LCDs, we compared the payments in the jurisdiction of the MAC that had implemented the LCD to payments in other MAC jurisdictions. For each of our analyses based on LCDs, we found the lowest amount of payments in the jurisdiction of the MAC whose LCD we used as the basis for analysis, which was consistent with our expectation.[Footnote 75] We analyzed a representative 5 percent sample of Medicare claims from the Carrier SAF and Outpatient SAF for fiscal year 2010 to calculate payments for services that appeared to be inconsistent with the national policies and LCDs we selected. We aggregated these data by state, by MAC jurisdiction, and at the national level. We extrapolated our results from the 5 percent sample of claims from the Carrier SAF and Outpatient SAF to estimate results for the entire fee-for-service Medicare population. For our analysis of MUEs, we excluded claims that contained modifiers, which are used by providers to indicate potentially legitimate reasons why certain procedures were performed. For the MUE analysis, we also excluded claims data that appeared multiple times in the SAF. We identified these multiple entries by identifying claim lines that matched on certain key variables-- including the same beneficiary identification number, procedure, date of service, and provider. For each set of matching entries, we kept the claim line with the latest processing date and excluded all matching claim lines.[Footnote 76] Assessment of Extent to Which CMS's Edit Development Processes Comply with Internal Control Standards: We reviewed several CMS documents that describe processes used to determine the need for prepayment edits and to implement edits based on national policies. We also interviewed CMS officials to obtain additional detail where needed about these processes. In some cases, the processes were not documented or not fully documented, and in those cases we relied on the officials' oral descriptions of the processes. We compared these process descriptions to our internal control standards to assess whether CMS has designed adequate processes. We focused our assessment primarily on the design of these processes and did not attempt to fully assess whether the processes were operating as intended. We identified three internal control standards as relevant to our assessment of the design of CMS's processes: (1) risk assessment, (2) monitoring, and (3) appropriate documentation of transactions and internal control. Table 6 describes the specific elements of these standards that were applicable to our assessment. Table 6: Internal Control Standards or Activities That Apply to CMS's Determination of the Need for, and Implementation of, Prepayment Edits Based on National Policies: Standard or activity: Risk assessment; Description of elements applicable to our assessment: Management comprehensively identifies risk using various methodologies as appropriate. A determination is made on how best to manage or mitigate the risk and what specific actions should be taken. Standard or activity: Documentation[A]; Description of elements applicable to our assessment: Internal control and all transactions and other significant events are clearly documented, and the documentation is readily available for examination. The documentation appears in management directives, administrative policies, or operating manuals, in either paper or electronic form. All documentation and records are properly managed and maintained. Standard or activity: Monitoring; Description of elements applicable to our assessment: Corrective action is taken or improvements made within established time frames to resolve the matters brought to management's attention. Agency personnel obtain information about whether their internal control is functioning properly. Source: GAO. Notes: Information is from GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999), and Internal Control Management and Evaluation Tool, GAO-01- 1008G (Washington, D.C.: August 2001). [A] Documentation is an activity under the standard called Control Activities. [End of table] Information and Oversight Provided by CMS: To assess the information CMS provides to MACs to promote use of effective local prepayment edits, including information about program vulnerabilities and local coverage policies on which effective prepayment edits have been based, we examined the web-based Medicare Coverage Database and reviewed relevant documents, including documentation for the PIMR database. We also interviewed CMS officials and representatives of the MACs in our sample to understand how CMS facilitates information sharing. To assess CMS's oversight of MACs' use of prepayment edits, we reviewed agency documents that specify relevant requirements for MACs, including the MAC statement of work, the Program Integrity Manual, the Quality Assurance Surveillance Program (QASP) review protocols, and the quarterly Technical Direction Letters that required MACs to report how they had addressed or planned to address certain vulnerabilities. We also examined samples of reports submitted by MACs, including medical review strategies and responses to the quarterly Technical Direction Letters. In addition, we analyzed data on the most recent QASP reviews conducted as of August 3, 2011, the date on which CMS provided the data to us. Depending on the MAC, these data represented a review period ending in fiscal year 2010 or fiscal year 2011. We also interviewed CMS officials and representatives of MACs in our sample about CMS's oversight. MAC Contract Incentives: To assess the financial incentives CMS provides to MACs to promote use of effective local prepayment edits, we examined relevant documents, including descriptions of award fee metrics and review protocols. We also analyzed CMS data on the distribution of award fees for review periods ending in fiscal year 2011, as well as ARTS data on the award fees and base fees budgeted for MACs in the most recent contract year for which we had data--which, as noted above, was either fiscal year 2010 or fiscal year 2011, depending on the MAC. In addition, we examined data on Medicare Integrity Program funding from fiscal year 2008 through fiscal year 2011. We also interviewed CMS officials about how metrics are selected for inclusion in award fee plans, how MACs' fees are divided between award fees and base fees, and the RAC prepayment review demonstration. Data Reliability and Audit Standards: To ensure that the data from PIMR, ARTS, and the Medicare claims database used in this report were reliable enough for the purposes used, we performed appropriate electronic data checks, examined relevant documentation, and interviewed agency officials who were knowledgeable about the data. We found the data were sufficiently reliable for the purpose of our analyses. We conducted this performance audit from July 2011 through November 2012 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. [End of section] Appendix II: Hypothetical Example of How Medicare Claims Can Avoid Triggering Medically Unlikely Edits (MUE): [Figure: Health Insurance Claim Form] Dates of Service[1]: 1/04/10 to 1/04/12; HCPCS Code: 95810; Diagnosis Pointer: 1; Charges: $578.50; Days or Units: 1. Dates of Service: 1/04/10 to 1/04/12; HCPCS Code: 31231; Diagnosis Pointer: 2; Charges: $165.94; Days or Units: 1. Dates of Service[2]: 1/04/10 to 1/04/12; HCPCS Code: 95820; Diagnosis Pointer: 1; Charges: $578.50; Days or Units: 1. [1] This claim line bills HCPCS code 95810, a procedure code for sleep studies that involve a technologist, for a quantity of one. CMS has a limit of one of these services per day and enforces this limit using an MUE. [2] This claim line reflects a second service for HCPCS code 95810 on the same day as the first service. Because the quantity of services is split across two claim lines, the existing MUE process would not Identify this claim line as exceeding the MUE limit. Source: GAO analysis of Medicare claims. [End of section] Appendix III: Comments from the Department of Health and Human Services: Department of Health & Human Services: Office of The Secretary: Assistant Secretary for Legislation: Washington, DC 20201: July 23, 2012: Kathleen M. King: Director, Health Care: U.S. Government Accountability Office: 441 G Street NW: Washington, DC 20548: Dear Ms. King: Attached are comments on the U.S. Government Accountability Office's (GAO) correspondence entitled: "Medicare Program Integrity: Greater Prepayment Control Efforts Could Increase Savings and Better Ensure Proper Payment" (GAO-12-586). The Department appreciates the opportunity to review this report prior to publication. Sincerely, Signed by: Jim R. Esquea: Assistant Secretary for Legislation: Attachment: General Comments Of The Department Of Health And Human Services (HHS) On The Government Accountability Office's (GAO) Draft Report Entitled, "Medicare Program Integrity: Greater Prepayment Control Efforts Could Increase Savings And Better Ensure Proper Payments" (GAO-12-586): The Department appreciates the opportunity to comment on this draft report. This report examines the extent to which—-(1) CMS and its contractors employed prepayment edits; (2) CMS has designed adequate processes to determine the need for and to implement edits based on national policies; and (3) CMS provides information, oversight, and incentives to Medicare Administrative Contractors (MACS) to promote the use of effective edits. GAO's recommendations and HHS's response to those recommendations are discussed below. To promote greater use of effective prepayment edits and better ensure proper payment, GAO recommends that the CMS Administrator take the following seven actions: GAO Recommendation 1: To promote implementation of effective edits based on national policies, GAO recommends that the CMS Administrator centralize within CMS the development and implementation of automated edits based on national coverage determinations (NCDs) to ensure greater consistency. HHS Response: HHS concurs with this recommendation. CMS is reviewing opportunities for centralizing the development and implementation of NCD automated edits and is considering contracting options. GAO Recommendation 2: To promote implementation of effective edits based on national policies, GAO recommends that the CMS Administrator implement medically unlikely edits (MUEs) that assess all quantities provided to the same beneficiary by the same provider on the same day, so providers cannot avoid claim denials by billing for services on multiple claim lines or multiple claims without including modifiers that reflect a declaration that quantities above the normal limit are reasonable and necessary. HHS Response: HHS concurs with further investigation of this recommendation. This issue is complicated as there are numerous types of clinical situations in which MUEs can be reasonably exceeded. This report did not identify specific codes of abuse or specific codes which could adopt date of service edits without causing unreasonable claim denials with subsequent appeals and provider burden. CMS will continue to evaluate which codes could be subject to a date-of-service MUE approach through on-going data and coding analysis. In addition, providers need to include appropriate Healthcare Common Procedure Coding System modifiers to indicate that units of service billed in excess of a MUE are reasonable and necessary. This is correct coding policy and CMS will continue to reinforce this with providers. GAO Recommendation 3: To promote implementation of effective edits based on national policies, GAO recommends that the CMS Administrator revise the method for compiling information about Recovery Audit Contractor-identified vulnerabilities to identify their full extent and prioritize them accordingly. HHS Response: NHS concurs with this recommendation. CMS already collects data on all findings regardless of dollar impact on the program and when possible, CMS aggregates major findings across all Recovery Audit regions. CMS completes corrective actions based on the impact of the major finding, the dollar amount of the major finding, and the type of corrective action needed. CMS will consider ways to aggregate all major findings in the future to allow for more accurate prioritization on a national basis. GAO Recommendation 4: To promote implementation of effective edits based on national policies, GAO recommends that the CMS Administrator develop written procedures to provide guidance to agency staff on all steps in the processes for developing and implementing edits based on national policies, including (1) time frames for taking corrective actions, (2) methods for assessing the effects of corrective actions, and (3) procedures for ensuring consideration of automated edits whenever possible, including for all existing NCDs and other national policies. HHS Response: HHS concurs with this recommendation. CMS will clarify its written procedures no later than December 31, 2012, as they relate to national payment policies and edits. CMS has processes and standard operating procedures in place for all existing NCDs and other national policies. GAO Recommendation 5: To encourage more widespread use of effective local edits by MACs, GAO recommends that the CMS Administrator improve the data collected about local prepayment edits to enable CMS to identify the most effective edits and the local coverage policies on which they are based and disseminate this information to MACs for their consideration. HHS Response: HHS concurs with this recommendation. CMS acknowledges that the process for collecting data about local prepayment edits needs to be improved. Implementing this recommendation will require additional reporting and data collection. CMS will explore the best means to collect local prepayment edit data from the MACs, including local coverage determination (LCD) based edits and will disseminate the information about the most effective edits to the MACs within contractually allowed limits. GAO Recommendation 6: To encourage more widespread use of effective local edits by MACs, GAO recommends that the CMS Administrator, until CMS has a new database in place to collect information about edits, require MACs to share information about the underlying policies and savings related to their most effective edits. HHS Response: HHS concurs with this recommendation. CMS has asked the MACs to collaborate on LCD evidentiary development to the extent permitted by their contracts. Additionally, CMS will continue to ensure appropriate NCD edits are developed when clinically appropriate. CMS will issue a Technical Direction Letter regarding collaboration on the most effective edits. GAO Recommendation 7: To encourage more widespread use of effective local edits by MACs, GAO recommends that the CMS Administrator to assess the feasibility of providing increased incentives to MACs to implement effective prepayment edits. HHS Response: HHS concurs with this recommendation. CMS has a process in place that engages components throughout the agency for their input in developing award fee (i.e., incentives) metrics. This process provides for incentives to be awarded to MACs under our cost-plus-award-fee contracts. The award fee development process begins by notifying business owners throughout CMS approximately 90 days prior to the renewal of a MAC contract to discuss what award fee metrics should be included in the plan for the upcoming contract year. The business owners would assess the feasibility and value of providing increased incentives to MACs, and CMS is committed to increasing its consideration of incentives for effective prepayment edits. The business owner would determine the metric by which performance would be evaluated, and the level of award fee would be determined in relation to other performance metrics by which MACs are evaluated. Please note: Prior to the beginning of an evaluation period for a MAC, CMS can implement a unilateral change to the contract for award fee incentives. However, any changes proposed during the award fee period will need to be agreed upon by both CMS and the Contractor. [End of section] Appendix IV: GAO Contact and Staff Acknowledgments: GAO Contact: Kathleen M. King, (202) 512-7114 or kingk@gao.gov: Staff Acknowledgments: In addition to the contact named above, Sheila K. Avruch, Assistant Director; Zhi Boon; Elizabeth Conklin; Nancy Fasciano; Matthew Gever; Richard Lipinski; Roseanne Price; and Steve Robblee made key contributions to this report. [End of section] Footnotes: [1] An improper payment is any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements. Improper Payments Elimination and Recovery Act of 2010, Pub. L. No. 111-204, § 2(e), 124 Stat. 2224, 2227 (codified at 31 U.S.C. § 3321 note). The Medicare program generally makes fee-for-service payments directly to health care providers, based on their submitted claims for services provided to beneficiaries. [2] Medicare fee-for-service consists of Medicare Part A, which covers inpatient hospital care, skilled nursing facility care, some home health services, and hospice care, and Medicare Part B, which covers physician and hospital outpatient services, diagnostic tests, mental health services, outpatient physical and occupational therapy, ambulance services, some home health services, durable medical equipment, prosthetics, orthotics, and supplies, among other things. [3] Internal controls are components of an organization's management that provide reasonable assurance that the organization achieves effective and efficient operations, reliable financial reporting, and compliance with applicable laws and regulations. Internal control standards provide a framework for identifying and addressing major performance challenges and areas at greatest risk for mismanagement. [4] As of May 2012, CMS had implemented 5-year contracts in all 4 of the DME MAC jurisdictions and 11 of the 14 existing A/B MAC jurisdictions. Three A/B MAC jurisdictions are being served by legacy contractors--fiscal intermediaries and carriers. CMS anticipates replacing the remaining fiscal intermediaries and carriers with MACs and consolidating A/B MAC jurisdictions from 14 to 10. For simplicity- -and because CMS intends to convert all claims administration contractors to MACs--we use the term MAC to refer to all claims administration contractors in this report, except where specifically noted. [5] Examples of vulnerabilities are providers billing Medicare for ambulance services that should be billed to the hospital that provided the beneficiary's inpatient care, and high utilization of diabetic test strips. [6] 42 U.S.C. § 1395y(a)(1)(A). [7] For more information on edits related to provider enrollment information, see GAO, Medicare Program Integrity: CMS Continues Efforts to Strengthen the Screening of Providers and Suppliers, [hyperlink, http://www.gao.gov/products/GAO-12-351] (Washington, D.C.: Apr. 10, 2012). [8] For example, we reported in 2003 that two of four carriers--which predated MACs as the claims administration contractors responsible for processing Part B claims--had local coverage policies for magnetic resonance angiography and two did not. See GAO, Medicare: Divided Authority for Policies on Coverage of Procedures and Devices Results in Inequities, [hyperlink, http://www.gao.gov/products/GAO-03-175] (Washington, D.C.: Apr. 11, 2003). [9] We also used other criteria to select these local policies, which included feasibility of analysis and implementation of similar policies by fewer than half of all MACs at the start of fiscal year 2010. [10] See GAO, Standards for Internal Control in the Federal Government, [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1] (Washington, D.C.: November 1999), and GAO, Internal Control Management and Evaluation Tool, [hyperlink, http://www.gao.gov/products/GAO-01-1008G] (Washington, D.C.: August 2001). [11] Statements of work are those documents generally incorporated in contract solicitations and, subsequently, contracts, that specify, either directly or with reference to other documents, the work the government expects the contractors to perform. [12] The remaining beneficiaries are enrolled in a Medicare Advantage plan, in which private insurance plans offer health care coverage to Medicare beneficiaries. [13] 42 U.S.C. § 1395y(a). [14] CMS officials also noted that outside groups or individuals can request an NCD and the agency must consider the request. [15] Positron Emission Tomography is a diagnostic imaging procedure used to evaluate metabolism in normal tissue as well as in diseased tissues in conditions such as cancer, ischemic heart disease, and some neurologic disorders. [16] The four DME MACs are required to use one set of LCDs. In contrast, the A/B MACs may have similar policies, but are not required to do so. [17] For example, a DME MAC has set maximum allowable amounts for certain drugs that are inhaled using a nebulizer. [18] This description of Medicare claims processing also applies to claims administration contractors known as fiscal intermediaries and carriers, which CMS expects to replace with MACs by early 2013. Ambulance services are billed based on where the ambulance is garaged. Laboratory services are billed based on either where the specimen is taken or where it is analyzed. [19] Many HCPCS codes are based on the Current Procedural Terminology codes, which are maintained by the American Medical Association and which many private insurers use for processing claims. HCPCS also includes codes for other items, such as ambulance services and durable medical equipment used in a beneficiary's home. [20] The three systems are called the Fiscal Intermediary Standard System (FISS), the Multi-Carrier System (MCS), and the ViPS Medicare System (VMS). FISS processes Part A and certain types of Part B claims from institutional providers. MCS processes other Part B claims. VMS processes DME claims. [21] Edits developed through the National Correct Coding Initiative (NCCI) are not in PIMR, and therefore are not included in this total. [22] CMS also recently launched the Fraud Prevention System, a predictive modeling system that screens all Medicare fee-for-service claims on a prepayment basis in order to identify potentially fraudulent claims. The Fraud Prevention System analyzes claims to identify unusual billing patterns and assigns risk scores to claims to prioritize them for investigation. [23] For example, some Medicare payments are so-called "bundled payments" for a group of related services that should be billed together for specified treatments. However, services that should be billed as part of a bundle under some circumstances also can be billed separately under other circumstances. When a claim is submitted for an individual service that could be part of a bundled payment, MACs may pay the claim not knowing that a claim for the bundled set of services will be submitted in the future. In such cases, overpayments must be addressed after claims have been processed. An example of a service that could be billed either as part of a bundle or separately is an ambulance trip that transfers a patient from a hospital to a skilled- nursing facility. If the ambulance trip is associated with a patient's Part A hospital stay, then the ambulance transfer is covered as part of a bundled payment for the patient's Part A stay. A separate payment for this type of ambulance trip when a patient is in a Part A stay would be an overpayment. However, if the patient's stay in the hospital is not being covered by Medicare Part A, then the ambulance provider may bill Medicare for the ambulance trip, if the trip meets other Medicare coverage rules. [24] Pub. L. No. 108-173, § 911, 117 Stat. 2066, 2378 (Dec. 8, 2003) (codified at 42 U.S.C. § 1395kk). MMA also established the application of the Federal Acquisition Regulation (FAR) to MAC contracts, except where inconsistent with specific MMA provisions. The FAR establishes uniform policies for acquisition of supplies and services by executive agencies. 48 C.F.R. ch.1. [25] 48 C.F.R. § 16.305. [26] CMS's performance assessment program also includes the Quality Control Plan Review, which is CMS's review of the MAC's quality control plan, which describes the plans, methods, and procedures--or internal controls--that a contractor will use to meet performance standards in the statement of work, such as those related to quality, quantity, time frames, responsiveness, and customer satisfaction. [27] In 2011, 85 percent of the improper payments identified by CERT were for claims in which the medical documentation submitted either was inadequate to support payment for the services billed or indicated that the services billed were not medically necessary based upon Medicare coverage policies. [28] CMS's revisions included a strict adherence to policy documentation requirements, the removal of claims history as a valid source for review information, and the determination that medical record documentation created by a supplier is insufficient to substantiate a claim. [29] PIMR's calculation of savings accounts for $239 million in claims denials that were subsequently reversed. Medicare requires that a denied claim be adjusted, rather than resubmitted as a new claim, and PIMR captures data about payment amounts for adjusted claims. [30] We analyzed MACs' costs for specific tasks related to prepayment edits and medical review, based on the most recent contract periods for which we had data at the time of our analysis. These contract periods, which were almost always 1 year, ranged from a period ending July 30, 2010, to one ending March 31, 2011, depending on the time frame for each contract. Medicare Integrity Program (MIP) funds were used to pay the costs for the tasks we included in our review. MIP was established to enhance efforts to address Medicare's vulnerabilities to fraud, waste, and abuse. Costs of various tasks in the MIP category--which also includes provider outreach and education and coordination of benefits--are paid with MIP funds. MACs are permitted to direct the MIP funds they receive among these tasks but are not permitted to use MIP funds for tasks in other categories. On average, the MIP category accounted for 30 percent of A/B MACs' total costs and 19 percent of DME MACs' total costs in the most recent contract period. [31] Our analysis used Medicare data on final action claims, which include detail about disputes resolved and adjustments made up until the point when CMS finalized these data in June 2011. However, CMS officials indicated that in fiscal year 2010 some claims might have been adjusted after CMS finalized its data on these claims. According to CMS officials, this was because the Affordable Care Act of 2010 mandated retroactive changes to the physician fee schedule that required CMS to reprocess some adjudicated claims. CMS officials said this reprocessing was not completed until December 2011. [32] CMS allows providers to use modifiers on claims in order to report units of service in excess of an MUE limit to indicate that the provider deems it to be medically reasonable and necessary. Our analysis does not include claims with modifiers. [33] We analyzed claims using MUEs for approximately 8,900 HCPCS codes for claims from noninstitutional providers of outpatient services for which CMS publishes quantity limits to inform providers about correct coding practices. However, quantity limits are not published for some MUEs that are intended to deter potential fraud or abuse. The contractor responsible for creating MUEs reported that the proportion of unpublished MUEs has been increasing and was about 15 percent of the MUEs in effect as of July 2012. [34] The $8.6 million we identified represented payments for all quantities where the total quantity for a single day exceeded the limits established by MUEs because MACs are instructed to deny payment for the entire quantity when they identify it as exceeding the MUE limit. [35] The vagus nerve stimulation NCD covers a set of procedures in which an implanted device delivers an electrical signal that travels through the vagus nerve to the brain. CMS determined in 2007 that vagus nerve stimulation was not reasonable and necessary for resistant depression. Our analysis was designed to mimic an automated edit used by at least one MAC, which denies claims for vagus nerve stimulation procedures when a diagnosis for depression is included on the claim. [36] Age-related macular degeneration is a condition in which vision is impaired as a result of damage to the retina. [37] Claims data from Medicare Part B would not have information about diagnostic tests that beneficiaries received prior to enrolling in Medicare or while enrolled in a Medicare managed care plan. Treatment with OPT and verteporfin should begin within 1 week of the fluorescein angiogram on which the clinical decision to treat is based, according to an expert panel convened by the distributors of verteporfin with input from representatives of relevant medical organizations. [38] In addition to providing health care insurance for individuals 65 and older, Medicare also covers health care services for individuals with certain types of disabilities regardless of age. [39] This does not mean that Medicare would have saved the entire amount we identified if automated edits based on these policies had been in place nationwide. One reason is that if all MACs had used automated edits to prevent payment for the issues we reviewed, medical providers might have substituted different treatments that would have been covered by Medicare or might have been able to appropriately code their claims in ways that conformed with the policies. [40] For each LCD analyzed, we excluded results from the MAC that issued the policy. [41] Monitored anesthesia care involves active monitoring of patients under the influence of a local anesthetic. [42] Parathyroid hormone is produced by the parathyroid gland, and its benefits include facilitating the absorption of calcium. The MAC policy we used excluded one diagnosis from the one-per-day limit, and our analysis also applied this exception. [43] CMS staff can also decide separately from the workgroup to take other corrective actions, such as educating specialty societies or individual providers about coding policy. [44] CMS also publishes on its website the codes with service limits used for most of the edits, although some MUE thresholds are confidential. The agency provides public information so that providers can bill properly. [45] The specific weakness we found for MUEs does not apply to code- pair edits because code-pair edits do not address quantity limits. [46] In addition, we found about $400,000 in payments where the published MUE limits were exceeded on a single claim line. [47] CMS officials told us that they prioritize vulnerabilities in order to reduce to a manageable number the vulnerabilities to be addressed. [48] CMS officials told us that MACs can develop and input local edits more quickly than CMS can national edits, so they sometimes prefer to have MACs input edits. [49] The agency has established time frames for some phases in the implementation of corrective actions. For example, once CMS decides that a national edit is the appropriate corrective action, it develops a change request, which establishes a timeline for its contractors to implement the edit and identifies the entities responsible for key tasks. CMS officials told us that developing and implementing an edit through change requests can take at least 9 months. [50] In its comments on the OIG report, CMS stated that the agency can establish time frames for resolution on a case-by-case basis, but that establishing standard time frames is difficult. In response, the OIG indicated that the agency could establish standard intervals for follow-up with other components. See HHS, Office of Inspector General, Addressing Vulnerabilities Reported by Medicare Benefit Integrity Contractors, OEI-03-10-00500 (Washington, D.C.: 2011). [51] Two of the criteria have specific dollar amounts to determine whether a vulnerability should be categorized as high, medium, or low risk. [52] For example, one CMS official told us that CMS had developed an NCD for a certain drug but could not develop an edit because the specific diagnosis codes needed to describe some of the conditions that the drug was designed to treat did not exist. [53] If CMS cannot develop an automated edit, MACs have the authority to ensure compliance by manually reviewing selected claims. In other instances, MACs may build on the NCD with a more specific LCD on which an automated edit can be based. [54] ICD-10 is a set of codes used for reporting diagnoses in treatment settings and procedures in inpatient hospital settings. HHS originally intended to implement ICD-10 codes in October 2013 to replace ICD-9, which is the current edition. However, the agency recently announced it would delay implementation until October 2014 to respond to provider concerns about the administrative burden related to the change. According to CMS, ICD-10 codes will allow for greater clinical detail and specificity in describing diagnoses and procedures. [55] The funding increase was for fiscal intermediaries and carriers as well as MACs. As noted earlier, we use the term MAC to refer to all claims administration contractors, except where specifically noted. [56] Depending on the type of edit, CMS instructs MACs to evaluate the effectiveness of their edits based on such factors as denial rates; time and staff needed for review, including appeals reviews; changes in provider behavior; and the presence of potentially more costly vulnerabilities than those addressed by the edit. [57] CMS officials reported that some data were duplicated and that codes distinguishing the different types of edits and their status, as active or inactive, were unreliable. [58] MACs are also required to submit midyear updates to their medical review strategies describing progress made and any changes in strategy. In addition, MACs are required to submit error rate reduction plans and midyear updates, discussing the reasons for the errors identified in their jurisdictions in the most recent CERT report and identifying processes that could be improved to reduce these errors. [59] These reviewers advise the CMS contracting officer as to any clarifications needed and ultimately whether to accept a report or request revisions. In general, according to CMS's MAC Contract Administration Guide, a report is acceptable if it is submitted in the proper format and contains the required information as identified in the MAC statement of work and any relevant CMS policy documents. [60] LCDs and medical review are 2 of the 14 functional areas that must be addressed in the A/B MACs' monthly status reports and may be discussed in DME MACs' reports. [61] This system is designed to collect information about contractors' past performance. CMS assesses a MAC's performance in the Quality of Product or Service category based in part on the percentage of QASP standards passed. [62] Skilled nursing facility demand bills are bills submitted by a skilled nursing facility at a beneficiary's request because the beneficiary disputes the provider's opinion that the bill will not be paid by Medicare and requests that the bill be submitted for a payment determination. MACs are required to review all skilled nursing facility demand bills from beneficiaries eligible for these services. [63] In some cases, MACs reported that they already had a prepayment edit in place to address a vulnerability. [64] For fiscal years 2008 through 2010, the funding provided by CMS to support medical review activities by MACs and other claims administration contractors was fairly flat, at about $132 million per year. All funding amounts are in inflation-adjusted 2012 dollars. [65] These contract periods, which were almost always 1 year, ranged from a period ending July 30, 2010, to one ending March 31, 2011, depending on the time frame for each contract. The award fee percentage varied in part because the MAC contracts included different allocations between award fees and base fees as a result of contract negotiations with different MACs. For the same contract years, tasks directly related to prepayment edits and medical review, including development of LCDs, accounted for about 10 percent of MACs' costs. [66] Award fee dollars allocated to the CERT metric ranged from about $20,000 to about $82,000--out of total award fees ranging from $1 million to $3.2 million--for those MACs whose award fee plans included the metric in fiscal year 2011. [67] Among these other factors are how responsive providers are to the CERT contractor's request for medical records supporting the claims selected for review. When medical records are not submitted by the provider, the CERT contractor classifies the selected claim as a "no documentation claim" and counts it as an error. [68] Of the three A/B MACs whose award fee plans did not include the CERT metric in fiscal year 2011, two were contracted by CMS as MACs only 2 years earlier and evaluated for award fees for the first time in fiscal year 2010. Prior to fiscal year 2011, CMS included the CERT metric in just one award fee plan, as a pilot in fiscal year 2008. [69] These reviews will focus on 7 states with high populations of fraud-and error-prone providers (California, Florida, Illinois, Louisiana, Michigan, New York, and Texas) and 4 states with high claims volumes of short inpatient hospital stays (Missouri, North Carolina, Ohio, and Pennsylvania), for a total of 11 states. Short inpatient stays that should have been billed as outpatient services have been a vulnerability leading to improper payments. [70] Issues that are identified by any single RAC as having more than $500,000 in improper payments are considered "major findings" by CMS. [71] MACs that process Part A and Part B claims are referred to as "A/B MACs." CMS also contracts with MACs to process durable medical equipment claims. [72] We excluded MACs in jurisdictions where the contract was up for recompetition to avoid including in our sample MACs that might lose their contracts before we completed data collection. [73] We identified high-fraud areas based on the location of the operations for the Medicare Fraud Strike Force--a joint effort of the U.S. Department of Health and Human Services and the U.S. Department of Justice--as of March 11, 2011. The operations were located in seven states: California (Los Angeles), Florida (South Florida and Tampa), Illinois (Chicago), Louisiana (Baton Rouge), Michigan (Detroit), New York (Brooklyn), and Texas (Dallas and Houston). [74] To identify MACs with similar policies, we used CMS's web-based Medicare Coverage Database. In addition to the MAC from which we obtained the policy, there were eight other MACs whose contracts had been implemented by the start of fiscal year 2010. Therefore, we selected policies for which four or fewer other MACs had similar policies. [75] Because providers may appeal claims denials based on an LCD, some payments inconsistent with the LCD could occur. [76] CMS and its contractors explained that data about some claims payments appeared multiple times in the SAF because of reprocessing needed to implement new payment rates mandated by the Affordable Care Act and for other reasons. Because our MUE analysis was designed to identify the quantity of services provided to the same beneficiary on the same day, it was necessary to exclude these multiple entries to avoid overstating payment for services that exceeded CMS's quantity limits for certain services. [End of section] GAO’s Mission: The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO’s website [hyperlink, http://www.gao.gov]. Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. To have GAO e-mail you a list of newly posted products, go to [hyperlink, http://www.gao.gov] and select “E-mail Updates.” Order by Phone: The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, [hyperlink, http://www.gao.gov/ordering.htm]. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. Connect with GAO: Connect with GAO on facebook, flickr, twitter, and YouTube. Subscribe to our RSS Feeds or E mail Updates. Listen to our Podcasts. Visit GAO on the web at [hyperlink, http://www.gao.gov]. To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Website: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]; E-mail: fraudnet@gao.gov; Automated answering system: (800) 424-5454 or (202) 512-7470. Congressional Relations: Katherine Siggerud, Managing Director, siggerudk@gao.gov: (202) 512-4400: U.S. Government Accountability Office: 441 G Street NW, Room 7125: Washington, DC 20548. Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov: (202) 512-4800: U.S. Government Accountability Office: 441 G Street NW, Room 7149: Washington, DC 20548. [End of document]