Skip to Highlights
Highlights

What GAO Found

Medicare Advantage (MA) organizations contract with the Centers for Medicare & Medicaid Services (CMS) to offer beneficiaries a private plan alternative to the original program and are paid a predetermined monthly amount by Medicare for each enrolled beneficiary. These payments are risk adjusted to reflect each enrolled beneficiary's health status and projected spending for Medicare-covered services. CMS conducts risk adjustment data validation (RADV) audits of MA contracts which facilitate the recovery of improper payments from MA organizations that submitted beneficiary diagnoses for payment adjustment purposes that were unsupported by medical records. With a separate national audit, CMS estimated that it improperly paid $14.1 billion in 2013 to MA organizations, primarily because of these unsupported diagnoses.

GAO found that CMS's methodology does not result in the selection of contracts for audit that have the greatest potential for recovery of improper payments. First, CMS's estimate of improper payment risk for each contract, which is based on the diagnoses reported for the beneficiaries in that contract, is not strongly correlated with unsupported diagnoses. Second, CMS does not use other available information to select the contracts at the highest risk of improper payments. As a result, 4 of the 30 contracts CMS selected for its RADV audit of 2011 payments were among the 10 percent of contracts estimated by CMS to be at the highest risk for improper payments. These limitations are impediments to CMS's goal of recovering improper payments and do not align with federal internal control standards, which require that agencies use quality information to achieve their program goals.

CMS's goal of eventually conducting annual RADV audits is in jeopardy because its two RADV audits to date have experienced substantial delays in identifying and recovering improper payments. RADV audits of 2007 and 2011 payments have taken multiple years and are still ongoing for several reasons. First, CMS's RADV audits rely on a system for transferring medical records from MA organizations that has often been inoperable. Second, CMS audit procedures have lacked specified time requirements for completing medical record reviews and for other steps in the RADV audit process. In addition, CMS has not established timeframes for appeal decisions at the first-level of the MA appeal process, as it has done in other contexts.

CMS has not expanded the recovery audit program to MA by the end of 2010, as it was required to do by the Patient Protection and Affordable Care Act. RACs have been used in other Medicare programs to recover improper payments for a contingency fee. In December 2015, CMS issued a request for information seeking industry comment on how an MA RAC could be incorporated into the RADV audit framework. CMS noted in its request that incorporating a RAC into the RADV framework would increase the number of MA contracts audited each year. CMS currently includes 30 MA contracts in each RADV audit, about 5 percent of all MA contracts. Despite the importance of increasing the number of contracts audited, CMS does not have specific plans or a timetable for incorporating RACs into the RADV audit framework, contrary to established project management principles, which stress the importance of developing an overall plan to meet strategic goals.

Why GAO Did This Study

In 2014, Medicare paid about $160 billion to MA organizations to provide health care services for approximately 16 million beneficiaries. CMS, which administers Medicare, estimates that about 9.5 percent of its payments to MA organizations were improper, according to the most recent data—primarily stemming from unsupported diagnoses submitted by MA organizations. CMS currently uses RADV audits to recover improper payments in the MA program.

GAO was asked to review the extent to which CMS is addressing improper payments in the MA program. This report examines the extent to which (1) CMS's contract selection methodology for RADV audits facilitates the recovery of improper payments, (2) CMS has completed RADV audits and appeals in a timely manner, and (3) CMS has made progress toward incorporating RACs into the MA program to identify and assist with improper payment recovery. In addition to reviewing research literature and agency documents, GAO analyzed data from ongoing RADV audits of 2007 and 2011 payments—CMS's two initial contract-level RADV audits. GAO also interviewed CMS officials.

Skip to Recommendations

Recommendations

GAO is making five recommendations to CMS to improve its processes for selecting contracts to include in the RADV audits, enhance the timeliness of the audits, and incorporate RACs into the RADV audits. HHS concurred with the recommendations.

Recommendations for Executive Action

Agency Affected Recommendation Status
Centers for Medicare and Medicaid Services As CMS continues to implement and refine the contract-level RADV audit process to improve the efficiency and effectiveness of reducing and recovering improper payments and to improve the accuracy of CMS's calculation of coding intensity, the Administrator should modify that calculation by taking actions such as the following: (1) including only the three most recent pair-years of risk score data for all contracts; (2) standardizing the changes in disease risk scores to account for the expected increase in risk scores for all MA contracts; (3) developing a method of accounting for diagnostic errors not coded by providers, such as requiring that diagnoses added by MA organizations be flagged as supplemental diagnoses in the agency's Encounter Data System to separately calculate coding intensity scores related only to diagnoses that were added through MA organizations' supplemental record review (that is, were not coded by providers); and (4) including MA beneficiaries enrolled in contracts that were renewed from a different contract under the same MA organization during the pair-year period.
Open
CMS is working to improve the accuracy of its calculation of coding intensity, as GAO recommended in April 2016. In October 2017, CMS officials told GAO that the agency is reevaluating the design of the risk adjustment data validation audits to ensure their rigor in the context of all the payment error data acquired since the original design of the audits. As part of this work, CMS officials told GAO that the agency will examine whether coding intensity is the best criterion to use to select contracts for audit. As a result, in October 2018, CMS told GAO that rather than coding intensity, it plans to implement a new methodology using payment error as the key sampling driver beginning with audits for payment year 2014. Additionally, CMS is taking steps to modernize its audit system to improve reliability. For example, it initiated a project to explore how to directly receive electronic medical record documentation. As of May 2021, the agency is continuing to reevaluate the design of these audits. Until CMS takes this and other actions to improve the risk adjustment data validation contract-level audit process, it will fail to recover improper payments of hundreds of millions of dollars annually.
Centers for Medicare and Medicaid Services As CMS continues to implement and refine the contract-level RADV audit process to improve the efficiency and effectiveness of reducing and recovering improper payments. The Administrator should modify CMS's selection of contracts for contract-level RADV audits to focus on those contracts most likely to have high rates of improper payments by taking actions such as the following: (1) selecting more contracts with the highest coding intensity scores; (2) excluding contracts with low coding intensity scores; (3) selecting contracts with high rates of unsupported diagnoses in prior contract-level RADV audits; (4) if a contract with a high rate of unsupported diagnoses is no longer in operation, selecting a contract under the same MA organization that includes the service area of the prior contract; and (5) selecting some contracts with high enrollment that also have either high rates of unsupported diagnoses in prior contract-level RADV audits or high coding intensity scores.
Closed - Implemented
CMS modified the methodology used to select Medicare Advantage contracts, as GAO recommended in April 2016. In May 2021, CMS officials reported that they implemented a new methodology using payment error as the key sampling driver for their ongoing 2014 and 2015 audits. As documented in their audit methodology paper, the revised methodology uses a more targeted model-the Enrollee-Level Model-to determine contracts that have high improper payment rates. This model uses historical national sample and contract sample data to predict overpayment estimates per enrollee as well as other variables to inform selection, such as plan type and demographic variables. CMS officials told GAO that they continue to update this model in their audits to help target overpayment and inform sampling strategy. This new methodology will help CMS focus their RADV audits on those contracts most likely to have high rates of improper payments.
Centers for Medicare and Medicaid Services
Priority Rec.
This is a priority recommendation.
As CMS continues to implement and refine the contract-level RADV audit process to improve the efficiency and effectiveness of reducing and recovering improper payments. The Administrator should enhance the timeliness of CMS's contract-level RADV process by taking actions such as the following: (1) closely aligning the time frames in CMS's contract-level RADV audits with those of the national RADV audits the agency uses to estimate the MA improper payment rate; (2) reducing the time between notifying MA organizations of contract audit selection and notifying them about the beneficiaries and diagnoses that will be audited; (3) improving the reliability and performance of the agency's process for transferring medical records from MA organizations, including assessing the feasibility of updating Electronic Submission of Medical Documentation for use in transferring medical records in contract-level RADV audits; and (4) requiring that CMS contract-level RADV auditors complete their medical record reviews within a specific number of days comparable to other medical record review time frames in the Medicare program.
Open
CMS is working to enhance the timeliness of the agency's contract-level RADV process, as GAO recommended in April 2016. In October 2017, CMS officials told GAO that, as part of the agency's efforts to consolidate program integrity initiatives into one center, the decision was made to transition RADV contract-level audits to the CMS Center for Program Integrity at the end of 2016. As part of this transition, CMS officials told GAO that the agency is beginning to implement a formal project management structure to facilitate the timeliness of the audit process. As of May 2021, CMS had begun several steps to improve the timeliness of the contract-level RADV process. For example, CMS officials told GAO that it has initiated automated reviews that will reduce the amount of time required for medical record review to enhance the timeliness of the RADV process and provided training to Medicare Advantage organizations for selected audits. CMS reported in its fiscal year 2021 budget justification that it has taken additional steps to improve the timeliness of the RADV process, such as modernizing the audit system to improve system performance and reliability. In May 2021, CMS officials told GAO that it is the agency's intent to explore ways of aligning more closely the time frames of contract-level and national-level RADV audits. Officials noted in December 2020 that resource constraints limit the number of contract level audits that can be completed in a calendar year to two payment years but that they expect to have the audits aligned by calendar year 2023. Until CMS completes these steps to improve the RADV contract-level audit process, it will fail to recover improper payments of hundreds of millions of dollars annually.
Centers for Medicare and Medicaid Services As CMS continues to implement and refine the contract-level RADV audit process to improve the efficiency and effectiveness of reducing and recovering improper payments. The Administrator should improve the timeliness of CMS's contract-level RADV appeal process by requiring that reconsideration decisions be rendered within a specified number of days comparable to other medical record review and first-level appeal time frames in the Medicare program.
Open
CMS is working to improve the timeliness of the agency's contract-level risk adjustment data validation appeals process, as GAO recommended in April 2016. In May 2021, CMS officials told GAO that the agency is exploring policy options to standardize the timelines for RADV appeals at the reconsideration level. For example, in December 2019, CMS officials told GAO they expect to issue a final rule in January 2021 that will establish uniform timelines to expedite the appeals process. Specifically, they plan to require that a findings determination be made within 60-90 days of an arbiter's receipt of each party's arguments at each stage of an appeal. As of May 18, 2021, the final rule had not been published. Until CMS takes such actions to improve the risk adjustment data validation contract-level audit process, it will fail to recover improper payments of hundreds of millions of dollars annually.
Centers for Medicare and Medicaid Services As CMS continues to implement and refine the contract-level RADV audit process to improve the efficiency and effectiveness of reducing and recovering improper payments. The Administrator should ensure that CMS develops specific plans and a timetable for incorporating a RAC in the MA program as mandated by the Patient Protection and Affordable Care Act.
Open
CMS has attempted to incorporate a recovery audit contractor in the Medicare Advantage program, as GAO recommended in April 2016. CMS reported in its fiscal year 2021 budget justification that it believes the proposed scope of the contract-level risk adjustment data validation audits satisfies GAO's recommendation. In May 2021, CMS officials told GAO that the proposed audits will create programmatic and administrative efficiencies while strengthening fraud and abuse reporting. Until CMS completes efforts to improve the risk adjustment data validation contract-level audit process and demonstrates that it has satisfied the requirement to incorporate a recovery audit contractor in the Medicare Advantage program that includes specific plans and a timetable, CMS will fail to recover improper payments of hundreds of millions of dollars annually.

Full Report

GAO Contacts