What GAO Found
GAO examined the implementation of four enrollment screening procedures that the Centers for Medicare & Medicaid Services (CMS) uses to prevent and detect ineligible or potentially fraudulent providers and suppliers from enrolling into its Provider Enrollment, Chain and Ownership System (PECOS). Two of CMS's procedures appear to be working to screen for providers and suppliers listed as deceased or excluded from participating in federal programs or health care–related programs. However, GAO identified the following weaknesses in the other two procedures: CMS's verification of provider practice location and physician licensure status.
First, Medicare providers are required to submit the address of the actual practice location from which they offer services. GAO's examination of 2013 data found that about 23,400 of 105,234 (22 percent) of practice location addresses are potentially ineligible. The computer software CMS uses as a method to validate applicants' addresses does not flag potentially ineligible addresses, such as those that are of a Commercial Mail Receiving Agency (such as a UPS store mailbox), vacant, or invalid addresses. In addition, CMS's March 2014 guidance has reduced the amount of independent verification conducted by contractors, thereby increasing the program's vulnerability to potential fraud. For example, the figure below shows a mailbox located within a UPS store that an applicant reported as a practice location, which CMS contractors inaccurately verified as an authentic practice location under CMS's new guidance, which allows contractors to use phone calls as the primary means for verifying provider addresses.
Reported Practice Location Verified Using New CMS Guidance
Second, physicians applying to participate in the Medicare program must hold an active license in the state they plan to practice and self-report final adverse actions, such as a suspension or revocation by any state licensing authority. CMS requires its contractors to verify final adverse actions that the applicant self-reported on the application directly with state medical board websites. In March 2014, CMS began providing a report to its Medicare contractors to improve their oversight of physician license reviews. However, the report only includes the medical license numbers providers use to enroll into the Medicare program, but not adverse-action history or other medical licenses a provider may have in other states that were not used to enroll into Medicare. GAO found 147 out of about 1.3 million physicians listed as eligible to bill Medicare who, as of March 2013, had received a final adverse action from a state medical board for crimes against persons, financial crimes, and other types of felonies but were either not revoked from the Medicare program until months after the adverse action or never removed.
Why GAO Did This Study
In fiscal year 2014, Medicare paid $554 billion for health care and related services. CMS estimates that $60 billion (about 10 percent) of that total was paid improperly. To establish and maintain Medicare billing privileges, providers and suppliers must be enrolled in a CMS database known as PECOS. About 1.8 million providers and suppliers were in PECOS as of December 2014, according to CMS.
GAO was asked to assess Medicare's provider and supplier enrollment-screening procedures to determine whether PECOS was vulnerable to fraud. This report examines the extent to which CMS's enrollment-screening procedures are designed and implemented to prevent enrollment of ineligible or potentially fraudulent Medicare providers. GAO reviewed relevant documentation, interviewed CMS officials, and contacted the 12 CMS contractors that evaluate provider applications. GAO matched providers and suppliers in PECOS, as of March 2013, to several databases to identify potentially ineligible providers and suppliers, and used 2005–2013 Medicare claims data to verify whether they were paid during this period.
GAO recommends that CMS incorporate flags into its software to help identify potentially questionable addresses, revise its 2014 guidance for verifying practice locations, and collect additional license information. The Department of Health and Human Services concurred with two of the three recommendations, but did not agree with the recommendation to revise its guidance. GAO continues to believe the recommendation is valid, as discussed in the report.
Recommendations for Executive Action
|Centers for Medicare and Medicaid Services||To help improve the Medicare provider and supplier enrollment-screening procedures, the Acting Administrator of CMS should modify the CMS software integrated into PECOS to include specific flags to help identify potentially questionable practice location addresses, such as Commercial Mail Receiving Agency (CMRA), vacant and invalid addresses.|
|Centers for Medicare and Medicaid Services||To help improve the Medicare provider and supplier enrollment-screening procedures, the Acting Administrator of CMS should revise CMS guidance for verifying practice locations to include, at a minimum, the requirements contained in CMS's guidance in place prior to March 2014 so that MACs conduct additional research, beyond phone calls to applicants, on the practice location addresses that are flagged as a CMRA, vacant, or invalid to better ensure that the address meets CMS's practice location criteria.|
|Centers for Medicare and Medicaid Services||To help improve the Medicare provider and supplier enrollment-screening procedures, the Acting Administrator of CMS should collect information on all licenses held by providers that enroll in PECOS by using data sources that contain this information, including licenses obtained from other states, and expand the License Continuous Monitoring (LCM) report to include all licenses, and at least annually review databases, such as that of the Federation of State Medical Boards (FSMB), to check for disciplinary actions.|