Skip to main content

Medicare Program: Additional Actions Needed to Improve Eligibility Verification of Providers and Suppliers

GAO-15-762T Published: Jul 22, 2015. Publicly Released: Jul 22, 2015.
Jump To:
Skip to Highlights


What GAO Found

GAO examined the implementation of four enrollment screening procedures that the Centers for Medicare & Medicaid Services (CMS) uses to prevent and detect ineligible or potentially fraudulent providers and suppliers from enrolling into its Provider Enrollment, Chain and Ownership System (PECOS). Two of CMS's procedures appear to be working to screen for providers and suppliers listed as deceased or excluded from participating in federal programs or health care–related programs. However, GAO identified the following weaknesses in the other two procedures: CMS's verification of provider practice location and physician licensure status.

First, Medicare providers are required to submit the address of the actual practice location from which they offer services. GAO's examination of 2013 data found that about 23,400 of 105,234 (22 percent) of practice location addresses are potentially ineligible. The computer software CMS uses as a method to validate applicants' addresses does not flag potentially ineligible addresses, such as those that are of a Commercial Mail Receiving Agency (such as a UPS store mailbox), vacant, or invalid addresses. In addition, CMS's March 2014 guidance has reduced the amount of independent verification conducted by contractors, thereby increasing the program's vulnerability to potential fraud. For example, the figure below shows a mailbox located within a UPS store that an applicant reported as a practice location, which CMS contractors inaccurately verified as an authentic practice location under CMS's new guidance, which allows contractors to use phone calls as the primary means for verifying provider addresses.

Reported Practice Location Verified Using New CMS Guidance

Reported Practice Location Verified Using New CMS Guidance

Second, physicians applying to participate in the Medicare program must hold an active license in the state they plan to practice and self-report final adverse actions, such as a suspension or revocation by any state licensing authority. CMS requires its contractors to verify final adverse actions that the applicant self-reported on the application directly with state medical board websites. In March 2014, CMS began providing a report to its Medicare contractors to improve their oversight of physician license reviews. However, the report only includes the medical license numbers providers use to enroll into the Medicare program, but not adverse-action history or other medical licenses a provider may have in other states that were not used to enroll into Medicare. GAO found 147 out of about 1.3 million physicians listed as eligible to bill Medicare who, as of March 2013, had received a final adverse action from a state medical board for crimes against persons, financial crimes, and other types of felonies but were either not revoked from the Medicare program until months after the adverse action or never removed.

Why GAO Did This Study

This testimony summarizes the information contained in GAO's June 2015 report, entitled Medicare Program: Additional Actions Needed to Improve Eligibility Verification of Providers and Suppliers (GAO-15-448).

Full Report

Office of Public Affairs


MedicarePhysiciansHealth careSoftwareDurable medical equipmentImproper paymentsDeath dataCrimesSocial mediaOrthopedic devices