Recommendation: The Director of the Federal Insurance Office should communicate to insurers in writing how it would utilize policyholder retention amounts in calculating "insurance losses" and "insured losses" in determining the program certification threshold, trigger, and cap, as applicable. (Recommendation 1)

Agency: Department of the Treasury: Office of the Under Secretary for Domestic Finance: Office of the Assistant Secretary for Financial Institutions: Office of Financial Institutions Policy: Federal Insurance Office
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: As CMS continues to implement and refine the contract-level RADV audit process to improve the efficiency and effectiveness of reducing and recovering improper payments and to improve the accuracy of CMS's calculation of coding intensity, the Administrator should modify that calculation by taking actions such as the following: (1) including only the three most recent pair-years of risk score data for all contracts; (2) standardizing the changes in disease risk scores to account for the expected increase in risk scores for all MA contracts; (3) developing a method of accounting for diagnostic errors not coded by providers, such as requiring that diagnoses added by MA organizations be flagged as supplemental diagnoses in the agency's Encounter Data System to separately calculate coding intensity scores related only to diagnoses that were added through MA organizations' supplemental record review (that is, were not coded by providers); and (4) including MA beneficiaries enrolled in contracts that were renewed from a different contract under the same MA organization during the pair-year period.

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: CMS is working to improve the accuracy of its calculation of coding intensity, as GAO recommended in April 2016. In October 2017, CMS officials told GAO that the agency is reevaluating the design of the risk adjustment data validation audits to ensure their rigor in the context of all the payment error data acquired since the original design of the audits. As part of this work, CMS officials told GAO that the agency will examine whether coding intensity is the best criterion to use to select contracts for audit. As a result, in October 2018, CMS told GAO that rather than coding intensity, it plans to implement a new methodology using payment error as the key sampling driver beginning with audits for payment year 2014. Additionally, CMS was taking steps to modernize its audit system to improve reliability. For example, it initiated a project to explore how to directly receive electronic medical record documentation. As of January 2020, the agency is continuing to reevaluate the design of these audits. Unless CMS takes this and other actions to improve the risk adjustment data validation contract-level audit process, it will fail to recover improper payments of hundreds of millions of dollars annually.

Recommendation: As CMS continues to implement and refine the contract-level RADV audit process to improve the efficiency and effectiveness of reducing and recovering improper payments. The Administrator should modify CMS's selection of contracts for contract-level RADV audits to focus on those contracts most likely to have high rates of improper payments by taking actions such as the following: (1) selecting more contracts with the highest coding intensity scores; (2) excluding contracts with low coding intensity scores; (3) selecting contracts with high rates of unsupported diagnoses in prior contract-level RADV audits; (4) if a contract with a high rate of unsupported diagnoses is no longer in operation, selecting a contract under the same MA organization that includes the service area of the prior contract; and (5) selecting some contracts with high enrollment that also have either high rates of unsupported diagnoses in prior contract-level RADV audits or high coding intensity scores.

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: CMS is working to modify the selection of MA contracts for audit, as GAO recommended in April 2016. In October 2017, CMS officials told GAO that the initial RADV audit design was based on a limited set of payment error data available at the time. As part of efforts to improve the audits, CMS officials told GAO that the agency will examine whether coding intensity is the best criterion to select contracts for audit. In October 2018, CMS told GAO that it plans to implement a new methodology using payment error as the key sampling driver-rather than coding intensity-beginning with audits for payment year 2014. As of January 2020, the agency is using the revised methodology on the 2014 and 2015 payment year audits. They expect to conclude this process in late fiscal year 2020 and 2021, respectively. Unless CMS completes actions to improve the RADV contract-level audit process, it will fail to recover improper payments of hundreds of millions of dollars annually.

Recommendation: As CMS continues to implement and refine the contract-level RADV audit process to improve the efficiency and effectiveness of reducing and recovering improper payments. The Administrator should enhance the timeliness of CMS's contract-level RADV process by taking actions such as the following: (1) closely aligning the time frames in CMS's contract-level RADV audits with those of the national RADV audits the agency uses to estimate the MA improper payment rate; (2) reducing the time between notifying MA organizations of contract audit selection and notifying them about the beneficiaries and diagnoses that will be audited; (3) improving the reliability and performance of the agency's process for transferring medical records from MA organizations, including assessing the feasibility of updating Electronic Submission of Medical Documentation for use in transferring medical records in contract-level RADV audits; and (4) requiring that CMS contract-level RADV auditors complete their medical record reviews within a specific number of days comparable to other medical record review time frames in the Medicare program.

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open
Priority recommendation

Comments: HHS concurred with this recommendation in its fiscal year 2021 budget justification. HHS reaffirmed its commitment to identifying and correcting improper payments in the MA program. It has begun taking steps to improve the timeliness of the contract-level RADV audit process, such as aligning the time frames in CMS's contract-level RADV audits with those of the national RADV audits. Once completed, CMS needs to provide evidence that the actions taken by the agency have enhanced the timeliness of CMS's contract-level RADV process.

Recommendation: As CMS continues to implement and refine the contract-level RADV audit process to improve the efficiency and effectiveness of reducing and recovering improper payments. The Administrator should improve the timeliness of CMS's contract-level RADV appeal process by requiring that reconsideration decisions be rendered within a specified number of days comparable to other medical record review and first-level appeal time frames in the Medicare program.

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: CMS is working to improve the timeliness of the agency's contract-level risk adjustment data validation appeals process, as GAO recommended in April 2016. In October 2017, CMS officials told GAO that the agency is actively considering options for expediting the appeals process. For example, CMS is considering the appropriate number of days for rendering reconsideration decisions while allowing for a complete and thorough adjudication. In December 2019, CMS officials told GAO they expect to issue a final rule in January 2021 that will establish uniform timelines to expedite the appeals process. Specifically, they plan to require that a findings determination be made within 60-90 days of an arbiter's receipt of each party's arguments at each stage of an appeal. Unless CMS takes such actions to improve the risk adjustment data validation contract-level audit process, it will fail to recover improper payments of hundreds of millions of dollars annually.

Recommendation: As CMS continues to implement and refine the contract-level RADV audit process to improve the efficiency and effectiveness of reducing and recovering improper payments. The Administrator should ensure that CMS develops specific plans and a timetable for incorporating a RAC in the MA program as mandated by the Patient Protection and Affordable Care Act.

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: CMS has attempted to incorporate a recovery audit contractor in the Medicare Advantage program, as GAO recommended in April 2016. After failing to receive any proposals when CMS first issued a request for proposals (RFP) in 2014, CMS issued a request for information to industry in December 2015, which included a draft Statement of Work to solicit feedback, gauge interest, and conduct market research regarding CMS entering into a contract with a recovery audit contractor to identify underpayments and overpayments associated with diagnosis data submitted to CMS by Medicare Advantage Organizations. CMS reported that it subsequently issued another RFP in 2016 and did not receive any proposals for a second time. In December 2019, CMS officials told GAO that the functions of the Part C recovery Audit programs are being performed through other program integrity mechanisms. CMS subsequently reported in its fiscal year 2021 budget justification that CMS believes the proposed scope of the Part C RAC has been subsumed by RADV and CMS will demonstrate that the RADV program satisfies this recommendation. Until CMS completes efforts to improve the risk adjustment data validation contract-level audit process and demonstrates that it has satisfied the requirement to incorporate a recovery audit contractor in the MA program, CMS will fail to recover improper payments of hundreds of millions of dollars annually.

Recommendation: To ensure that MA encounter data are of sufficient quality for their intended purposes, the Administrator of CMS should establish specific plans and time frames for using the data for all intended purposes in addition to risk adjusting payments to MAOs.

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open
Priority recommendation

Comments: HHS generally agreed with this recommendation. Although CMS reports using MA encounter data for purposes other than risk adjustment, as of February 2020, it has not fully developed specific plans and time frames with dates for all uses. CMS reports that it has begun testing the use of MA encounter data for public health purposes, such as identifying beneficiaries with a history of opioid-related overdose and with other conditions, such as cancer and sickle cell. Further, CMS uses MA encounter data to help identify beneficiaries at risk in areas affected by public health emergencies. CMS reports that its Office of the Actuary (OACT) has used MA encounter data to analyze MA beneficiary utilization of certain Part B drugs. Further, OACT reports that it intends to assess other areas where it could use MA encounter data, such as analyses comparing Medicare fee-for-service and MA. As of February 2020, the agency has not developed specific plans and time frames for this and other intended purposes. For example, although CMS intends to use MA encounter data for program integrity purposes, it has not yet developed specific plans and time frames to do so. We will continue to monitor CMS's progress in developing specific plans and time frames with dates for all intended purposes of MA encounter data.

Recommendation: To ensure that MA encounter data are of sufficient quality for their intended purposes, the Administrator of CMS should complete all the steps necessary to validate the data, including performing statistical analyses, reviewing medical records, and providing MAOs with summary reports on CMS's findings, before using the data to risk adjust payments or for other intended purposes.

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open
Priority recommendation

Comments: HHS generally agreed with this recommendation, however, HHS did not commit to completing data validation before using MA encounter data for risk adjustment. As of February 2020, CMS has continued to make progress in examining the completeness and accuracy of MA encounter data, but more work remains to fully validate these data. CMS has developed and is implementing an MA Encounter Data Integrity and Monitoring plan, which includes data analysis, guidance, and monitoring. As part of this plan, CMS has established preliminary performance metrics for MA encounter data completeness and accuracy. CMS is also conducting analyses related to accuracy and completeness, but has not established performance benchmarks for these analyses. While the agency plans to communicate findings from the analyses to Medicare Advantage organizations, it has not yet done so. Finally, CMS has not verified MA Encounter data by reviewing medical records. While these steps are encouraging, without fully validating the completeness and accuracy of MA encounter data, CMS would be unable to confidently use these data for risk adjustment or other program management or policy purposes.