In fiscal year 2015, Medicare paid $568.9 billion for health care and health care-related services. According to the Centers for Medicare & Medicaid Services (CMS)—the agency within the Department of Health and Human Services (HHS) that administers the Medicare program—an estimated $59.6 billion (10.5 percent) of that total was paid improperly. Due to the large dollar amount involved in improper payments, the Office of Management and Budget has placed Medicare on its list of high-error programs. Further, because of its size, complexity, and susceptibility to mismanagement and improper payments, GAO has designated Medicare as a high-risk program.
CMS requires prospective Medicare providers and suppliers to be listed in the Provider Enrollment, Chain and Ownership System (PECOS) to enroll in Medicare and to bill for services provided to Medicare beneficiaries. PECOS is a centralized database that contains enrollment information for providers and suppliers. According to CMS, about 1.9 million providers and suppliers were listed in PECOS as of December 2015. CMS is responsible for developing provider and supplier enrollment procedures to help safeguard the program from fraud, waste, and abuse. CMS requires providers and suppliers to resubmit and recertify the accuracy of their enrollment information every 5 years and durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) suppliers every 3 years in order to maintain billing privileges.
This amount represents the Medicare Fee-for-Service, Medicare Advantage (Part C), and Medicare prescription Drug Benefit (Part D) programs. An improper payment is defined as any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements. It includes any payment to an ineligible recipient, any payment for an ineligible good or service, any duplicate payment, and any payment that does not account for credit for applicable discounts.
The term “provider” refers collectively to institutional providers such as hospitals and health-care facilities, as well as physicians and nonphysician practitioners who provide health-care services to Medicare beneficiaries. Providers also include organ-procurement organizations, skilled-nursing facilities, hospice, and end-stage renal disease centers. The term “supplier” refers to certain Part B entities such as ambulance-service providers, mammography centers, and portable X-ray facilities. Suppliers also include entities that supply Medicare beneficiaries with Medicare-durable medical equipment, prosthetics, orthotics, and supplies, such as walkers and wheelchairs.
In June 2015, GAO reported weaknesses in two key screening procedures CMS implemented to prevent and detect ineligible or potentially fraudulent providers and suppliers from enrolling in PECOS: (1) verification of practice location and (2) verification of licensure status.
Federal regulations stipulate the type of physical practice required for applicants enrolling into the Medicare program. Providers and suppliers must be “operational” to furnish Medicare-covered items or services. Federal regulations define “operational” as having a qualified physical practice location, being open to the public for the purpose of providing health care-related services, being prepared to submit valid Medicare claims, and being properly staffed, equipped, and stocked to furnish these items or services. Medicare providers are required to submit the address of the actual practice location from which they offer services.
GAO examined practice location addresses of providers and suppliers listed in PECOS as of March 2013 and DMEPOS as of April 2013 and found that an estimated 23,400 (22 percent) of 105,234 addresses were potentially ineligible. Of the 23,400 potentially ineligible addresses, GAO estimated that, from 2005 to 2013, about 2,600 were associated with providers that had Medicare claims that were $500,000 or more per address.
GAO utilized a software package that provides more detailed information on the PECOS practice location addresses than that used by CMS. GAO checked PECOS practice location addresses using the United States Postal Service (USPS) Address Matching System Application Program Interface. This is a commercially available software package that standardizes addresses and provides specific flags, such as whether the location is a Commercial Mail Receiving Agency (CMRA) or whether it is vacant or invalid. This software is not currently being used by CMS. Instead, CMS uses Finalist computer software to standardize applicants’ practice location addresses. However, the Finalist software does not provide data on whether the address is a CMRA, vacant, or invalid—in other words, whether the location is potentially ineligible to qualify as a legitimate practice location. CMS does not have these flags in Finalist because the agency added coding in PECOS that prevents post office box addresses from being entered, and incorrectly assumed that this step would prevent these types of ineligible practice locations from being accepted. CMS officials agreed, however, that adding flags to the Finalist software to identify attributes that might make the practice location address ineligible, such as a CMRA, would be of value.
In June 2015, GAO found that 46 out of the 496 generalizable sample addresses examined during the review were allowed to enroll in Medicare with a practice location that was inside a mailing store, such as a UPS store. These providers’ addresses did not appear in PECOS as a post office box, but instead were listed as a suite or other number, along with the street address of the store. Businesses can purchase a post office box that is listed to the public as a suite number in a business district from some commercial mailing businesses, allowing the businesses to mask the identity of the address as a post office box. For example, GAO identified a particular provider that used a mailbox-rental store as its practice location and where services are not actually rendered. As of January 2015, this provider was listed in PECOS under a suite number. According to GAO analysis of CMS records, this provider was paid approximately $592,000 by Medicare from the date it enrolled in PECOS with this address to December 2013, the latest date for which CMS had claims data. GAO referred this provider to CMS for further review and action.
The fact that providers can submit an address that is not an actual practice location is a potential indicator of fraud. Without having flags in Finalist to better indicate the validity of the providers’ or suppliers’ practice locations, CMS is missing an opportunity to identify an address that could potentially be an illegitimate practice location. Further, CMS is missing an opportunity to better ensure that payment is limited to legitimate providers.
Another screening weakness GAO identified was verification of physician licenses. Physicians applying to participate in the Medicare program must hold an active license in the state in which they plan to practice and also must self-report any final adverse actions, such as a suspension or revocation by a state licensing authority. In June 2015, GAO reported the following:
CMS requires its contractors to verify any self-reported final adverse action directly with the state medical board website. In March 2014, CMS began providing the License Continuous Monitoring (LCM) report to its Medicare contractors to improve their oversight of physician license reviews. However, the LCM report only includes the medical license number that the providers use to enroll into the Medicare program; it does not list any other medical licenses or adverse-action history that a provider may have in another state, which leaves open the possibility that a provider could enroll into Medicare despite having another license with an adverse-action history.
GAO used data with more detailed licensure history for all medical licenses than that used by CMS. GAO obtained data from the Federation of State Medical Boards (FSMB). Unlike the database used by CMS, the FSMB database includes a provider’s entire history of license revocations and suspensions for all medical licenses, while the LCM report only includes the current license status of the licenses reported by providers in PECOS. By focusing on the license numbers used to enroll in PECOS and relying on applicants to self-report final adverse actions on the application, CMS and its contractors are missing an opportunity to develop a more complete picture of individual providers. CMS could prevent potentially ineligible physicians from enrolling into the Medicare program if it obtains all license numbers associated with the individual providers, including licenses outside of the state for which a provider seeks Medicare privileges. Further, CMS is missing an opportunity to better ensure that payment is limited to eligible physicians.
42 C.F.R. § 424.510.
42 C.F.R. § 424.502.
Once enrolled in PECOS, providers and suppliers have the responsibility to self-report changes to their practice locations. CMS requires providers, suppliers, and DMEPOS suppliers to report a change in practice location within 30 days.
Potentially ineligible addresses include those that are associated with a certain type of Commercial Mail Receiving Agency (CMRA), or vacant or invalid addresses. PECOS provider and supplier data were current as of March 2013 and DMEPOS as of April 2013. As part of the initial analysis using the USPS software, GAO identified 105,234 of the 980,974 addresses that were listed in PECOS that appeared in the USPS software as a CMRA, a vacant address, or an invalid address. GAO selected a generalizable stratified sample of 496 addresses from the population of the 105,234 that appeared in the USPS software as a CMRA, a vacant address, or an invalid address. For each selected address, GAO conducted further analysis to confirm whether the address was an ineligible practice location. On the basis of GAO’s additional analysis of the generalizable sample, GAO estimated that 23,400 of 105,234 addresses were potentially ineligible. This estimate represents about 22 percent of the 105,234 questionable addresses and is about 2.3 percent of the entire population of 980,974 addresses. These estimates have a margin of error at the 95 percent confidence level of plus or minus 10 percentage points or fewer.
The claims amount was calculated based on all claims associated with the National Provider Identifier that was listed on the matched address. Because some providers are associated with more than one address, it is possible that some of the claim amounts reported may be associated with a different, valid practice location. Due to how GAO obtained compiled claims by the National Provider Identifier, GAO was unable to determine how much, if any, of the claim amount may be associated with a different, valid address.
USPS standardizes an address by converting it to a standard format through correcting the address, including adding missing information such as directional or zip code information, to provide a complete address. Addresses that generally would not be considered a valid practice location include post office boxes, and those associated with a certain type of CMRA, such as a United Parcel Service (UPS) store. Based on USPS guidance, a CMRA is a third-party agency that receives and handles mail for a client. USPS would flag a location as vacant if it used to deliver mail there and has not delivered mail there in more than 90 days. An invalid address is an address that is not recognized by USPS, was incorrectly entered in PECOS, or was missing a street number. Not all addresses flagged by the USPS software are ineligible addresses. However, the software provides an initial indicator that an address warrants a closer review.
According to CMS, Finalist is integrated into PECOS to standardize addresses and does so by comparing the address listed on the application to USPS records. It then corrects any misspellings in street and city names, standardizing directional markers (NE, West, etc.) and suffixes (Ave, Lane, etc.), and correcting errors in the zip code.
GAO selected a generalizable stratified random sample of 496 addresses from the population of 105,234 that appeared in the USPS Address Matching System Application Program Interface as a CMRA, a vacant address, or an invalid address.
42 C.F.R § 424.535 (a)(3)(i).
The time period for potential debarment from the Medicare program was between March 29, 2003, and March 29, 2013.
FSMB is a nonprofit organization that serves state medical boards in all U.S. states, Puerto Rico, Guam, and the Northern Mariana Islands; and 14 state boards of osteopathic medicine. According to CMS, it does not use the FSMB data because FSMB only updates the total number of licenses included in its master license file every 2 years. According to FSMB, it compiles this list of licensed physicians every 2 years and receives an update on these specific medical licenses on a weekly, monthly, or quarterly basis from 65 state and territorial medical boards in the United States. The vendor that CMS currently uses updates the total number of licenses included in its master list of licenses continuously. However, GAO found the LCM report provided by this vendor only provides the current license status and not the history of the license, while FSMB provides the license history as well as disciplinary actions.
To help improve the Medicare provider and supplier enrollment-screening procedures, GAO recommended in June 2015 that the Acting Administrator of CMS take the following two actions:
Estimating the total amount of improper payments is not possible without CMS conducting a detailed review of each potential ineligible provider. However, modifying CMS’s software and collecting all license information would allow CMS to better prevent ineligible providers from enrolling into the Medicare program and obtaining Medicare funds, thus potentially reducing the amount of improper payments.
The information contained in this analysis is based on findings from the product listed in the related GAO products section. To assess the extent to which two enrollment screening procedures—CMS’s verification of medical providers’ and suppliers’ practice locations and verification of physicians’ licensure status—are designed to prevent and detect the enrollment of ineligible or potentially fraudulent Medicare providers and suppliers into PECOS, GAO reviewed CMS procedural manuals and directives, interviewed CMS officials, and conducted interviews with five Medicare Administrative Contractors (MAC).
To assess the extent to which CMS’s enrollment-screening procedure for verifying medical providers’ and suppliers’ practice locations was implemented to prevent and detect the enrollment of ineligible or potentially fraudulent Medicare providers and suppliers into PECOS, GAO matched the list of 980,974 providers and suppliers present in PECOS on March 29, 2013, and DMEPOS suppliers on April 6, 2013, to the USPS Address Matching System Application Program Interface. Of the 980,974 addresses, 105,234 (about 11 percent) appeared in the USPS software as a CMRA, a vacant address, or an invalid address. For those addresses, GAO selected a generalizable stratified random sample of 496 addresses and confirmed the eligibility of each of the 496 sampled practice location addresses using Google Maps, Internet searches, or physical site visits. To calculate and report on the amount of Medicare claims paid to these potentially ineligible providers and suppliers, GAO matched their provider and supplier National Provider Identifier number with claims paid from 2005 to 2013, the period for which CMS had claims data available.
To assess the extent to which CMS’s verification of physicians’ licensure status was implemented to prevent and detect the enrollment of ineligible or potentially fraudulent Medicare providers into PECOS, GAO matched the list of physicians (who are categorized as providers) present in PECOS to the FSMB licensure data from March 31, 2014. GAO calculated Medicare claims paid from 2005 to 2013 for those physicians that received a suspension or revocation of their medical license while enrolled in PECOS. This analysis included the time the physician was actively suspended or revoked and in some cases the time when the provider could have been barred from the Medicare program for not reporting an adverse action.
Table 15 in appendix V lists the programs GAO identified that might have opportunities for cost savings.
The five MACs were selected to include some with larger numbers of physicians serviced, some that met and some that did not meet the accuracy threshold in CMS’s provider enrollment performance evaluation, some that participated in the automated screening process, and some that did not (to capture additional possible checks that some MACs performed on providers’ enrollment information through this process), and some that served more than one jurisdiction to maximize the number of states included in the review.
In their comments to the June 2015 report on which this analysis is based, HHS agreed with the two recommendations and noted that it plans to take steps to address them. For example, HHS plans to configure the provider and supplier address-verification system in PECOS to flag CMRAs, vacancies, invalid addresses, and other potentially questionable practice locations. Because HHS has not yet initiated specific actions to implement GAO’s recommendations, it is too early for GAO to determine whether the actions the agency outlined in its official comments on a draft of this report would fully address the intent of the recommendations. However, if effectively implemented, the actions could prevent ineligible providers from enrolling into the Medicare program and obtaining Medicare funds, thus potentially reducing the amount of improper payments. GAO plans to continue to monitor the agency’s efforts in this area.
GAO provided a draft of this report section to HHS for review and comment. The department did not provide comments on the report section.
For additional information about this area, contact Seto J. Bagdoyan at (202) 512-6722 or firstname.lastname@example.org.
GAO examined the implementation of four enrollment screening procedures that the Centers for Medicare & Medicaid Services (CMS) uses to prevent and detect ineligible or potentially fraudulent providers and suppliers from enrolling into its Provider Enrollment, Chain and Ownership System (PECOS). Two of CMS's procedures appear to be working to screen for providers and suppliers listed as deceased o...