Medicare Program: Additional Actions Needed to Improve Eligibility Verification of Providers and Suppliers

Highlights

What GAO Found

GAO examined the implementation of four enrollment screening procedures that the Centers for Medicare & Medicaid Services (CMS) uses to prevent and detect ineligible or potentially fraudulent providers and suppliers from enrolling into its Provider Enrollment, Chain and Ownership System (PECOS). Two of CMS's procedures appear to be working to screen for providers and suppliers listed as deceased or excluded from participating in federal programs or health care–related programs. However, GAO identified the following weaknesses in the other two procedures: CMS's verification of provider practice location and physician licensure status.

First, Medicare providers are required to submit the address of the actual practice location from which they offer services. GAO's examination of 2013 data found that about 23,400 of 105,234 (22 percent) of practice location addresses are potentially ineligible. The computer software CMS uses as a method to validate applicants' addresses does not flag potentially ineligible addresses, such as those that are of a Commercial Mail Receiving Agency (such as a UPS store mailbox), vacant, or invalid addresses. In addition, CMS's March 2014 guidance has reduced the amount of independent verification conducted by contractors, thereby increasing the program's vulnerability to potential fraud. For example, the figure below shows a mailbox located within a UPS store that an applicant reported as a practice location, which CMS contractors inaccurately verified as an authentic practice location under CMS's new guidance, which allows contractors to use phone calls as the primary means for verifying provider addresses.

Reported Practice Location Verified Using New CMS Guidance

Second, physicians applying to participate in the Medicare program must hold an active license in the state they plan to practice and self-report final adverse actions, such as a suspension or revocation by any state licensing authority. CMS requires its contractors to verify final adverse actions that the applicant self-reported on the application directly with state medical board websites. In March 2014, CMS began providing a report to its Medicare contractors to improve their oversight of physician license reviews. However, the report only includes the medical license numbers providers use to enroll into the Medicare program, but not adverse-action history or other medical licenses a provider may have in other states that were not used to enroll into Medicare. GAO found 147 out of about 1.3 million physicians listed as eligible to bill Medicare who, as of March 2013, had received a final adverse action from a state medical board for crimes against persons, financial crimes, and other types of felonies but were either not revoked from the Medicare program until months after the adverse action or never removed.

Why GAO Did This Study

In fiscal year 2014, Medicare paid $554 billion for health care and related services. CMS estimates that $60 billion (about 10 percent) of that total was paid improperly. To establish and maintain Medicare billing privileges, providers and suppliers must be enrolled in a CMS database known as PECOS. About 1.8 million providers and suppliers were in PECOS as of December 2014, according to CMS.

GAO was asked to assess Medicare's provider and supplier enrollment-screening procedures to determine whether PECOS was vulnerable to fraud. This report examines the extent to which CMS's enrollment-screening procedures are designed and implemented to prevent enrollment of ineligible or potentially fraudulent Medicare providers. GAO reviewed relevant documentation, interviewed CMS officials, and contacted the 12 CMS contractors that evaluate provider applications. GAO matched providers and suppliers in PECOS, as of March 2013, to several databases to identify potentially ineligible providers and suppliers, and used 2005–2013 Medicare claims data to verify whether they were paid during this period.

Recommendations

GAO recommends that CMS incorporate flags into its software to help identify potentially questionable addresses, revise its 2014 guidance for verifying practice locations, and collect additional license information. The Department of Health and Human Services concurred with two of the three recommendations, but did not agree with the recommendation to revise its guidance. GAO continues to believe the recommendation is valid, as discussed in the report.

Recommendations for Executive Action

Agency Affected	Recommendation	Status
Centers for Medicare & Medicaid Services	To help improve the Medicare provider and supplier enrollment-screening procedures, the Acting Administrator of CMS should modify the CMS software integrated into PECOS to include specific flags to help identify potentially questionable practice location addresses, such as Commercial Mail Receiving Agency (CMRA), vacant and invalid addresses.	Closed – Implemented On May 17, 2016, CMS provided a copy of the PECOS release package dated January 2016 which includes the new enhancements made in PECOS. Specifically, the enhancements include replacing the Finalist address validation software with improved software which includes Deliver Point Verification (DPV), which incorporates the types of flags that we recommended in our June 2015 report. By updating the address verification software, CMS can ensure that providers with ineligible practice location are not listed in PECOS.
Centers for Medicare & Medicaid Services	To help improve the Medicare provider and supplier enrollment-screening procedures, the Acting Administrator of CMS should revise CMS guidance for verifying practice locations to include, at a minimum, the requirements contained in CMS's guidance in place prior to March 2014 so that MACs conduct additional research, beyond phone calls to applicants, on the practice location addresses that are flagged as a CMRA, vacant, or invalid to better ensure that the address meets CMS's practice location criteria.	Closed – Implemented On January 4, 2017, CMS provided a copy of its procedures dated December 22, 2016 to clarify the MACs actions if an address in PECOS is flagged as invalid, vacant, CMRA, among other flags. Specifically, if a practice location address is flagged as invalid, vacant, CMRA, among other flags, the MACs should order a 15 or 30 day site visit, unless a site visit of that location was conducted within the last 90 days and found to be operational. If the site visit fails, the MAC should proceed with denying the enrollment application and issue a denial letter. By developing procedures to direct MACs to conduct site visits on flagged practice locations, CMS can help ensure that potential ineligible practice locations are not listed in PECOS.
Centers for Medicare & Medicaid Services	To help improve the Medicare provider and supplier enrollment-screening procedures, the Acting Administrator of CMS should collect information on all licenses held by providers that enroll in PECOS by using data sources that contain this information, including licenses obtained from other states, and expand the License Continuous Monitoring (LCM) report to include all licenses, and at least annually review databases, such as that of the Federation of State Medical Boards (FSMB), to check for disciplinary actions.	Closed – Implemented On May 19, 2016, CMS officials provided us with supporting documentation that shows that the FSMB database was incorporated into its automatic screening process. Even though CMS did not expand the LCM report to include all licenses, CMS incorporated FSMB into their automatic screening process, which they will be able to regularly check for licensure updates and disciplinary actions against enrolled provider and suppliers, as well as to collect all license information held by providers that apply to enroll in PECOS. By incorporating the FSMB database in its automatic screening process, CMS has enhanced their review of medical license information.