For example, the  on-site inspections are used to check the compliance with the standards  for whether the supplier:    has a physical facility on an appropriate site that is accessible to  beneficiaries and to CMS, with a clearly visible sign with hours posted;    has its own inventory in stock on site, off site at another location, or has a  contract with another company for the purchase of inventory;    maintains records that document delivery of items to beneficiaries and  information provided to beneficiaries on warranties, including how repairs  and exchanges will be handled, and how to contact the supplier in case of  questions or problems; and    has a written beneficiary complaint resolution policy and maintains  records on beneficiary complaints and their resolution. NSC’s Efforts Are Insufficient to Verify Suppliers’ Compliance with the 21 Standards

NSC’s verification procedures have weaknesses that leave the Medicare  program without assurance that suppliers billing the program are meeting  the 21 standards, and thus, are qualified and legitimate. Further, although on-site inspections play a key role in  verifying suppliers’ compliance with the 21 standards, we estimate that  NSC did not conduct more than 600 required on-site inspections and its  inspection procedures have limitations. In total, these  suppliers were paid almost $6 million by Medicare. In  addition, we verified licensure with the respective states for a sample of  the suppliers that had disclosed to NSC their intention to bill for oxygen  and had been paid at least $1,000 by Medicare for this service. Through  this process, we identified 7 more suppliers that did not have the required  state license to provide oxygen services in 2004. NSC’s procedures suggest, but do not require, its  site inspectors to verify off-site inventory locations. Medicare’s Standards Are Too Weak to be Used Effectively to Screen DMEPOS Suppliers

Medicare’s standards are currently too weak to be used effectively for  screening DMEPOS suppliers that want to enroll in the program. However, they do  not include standards related to supplier integrity and capability analogous  to those that federal agencies generally apply to prospective contractors or  those used by at least two state Medicaid programs for their suppliers. In addition, after a contract is  awarded, federal agencies can terminate the contract for default or  convenience. For example, in sworn testimony before the Senate Committee on Finance  in April 2004, a witness who pleaded guilty to fraud explained her part in a  $25 million fraud scheme that she and a group of 19 others committed  against the Medicare program. During this period, if the provider fails to meet state  requirements, the state agency disenrolls the provider from Medicaid. However, in  contrast to California and Florida Medicaid, if a supplier can demonstrate  compliance with the 21 standards, CMS readmits it into Medicare unless it  has been otherwise excluded from participating in the program. CMS’s Oversight Is Insufficient to Determine Whether NSC Screens and Monitors Suppliers Effectively

CMS’s oversight has not been sufficient to determine whether NSC is  meeting its responsibilities in screening, enrolling, and monitoring  DMEPOS suppliers. CMS was unaware—until we informed the agency— that NSC had not conducted all required on-site inspections of suppliers. Finally, while CMS has established performance goals in NSC’s contract  related primarily to processing supplier applications and managing other  aspects of NSC’s workload—such as handling inquiries—it has not  established performance goals connected to effectiveness of the screening  or fraud prevention efforts. In  response to four of these recommendations, CMS stated that it has revised  the statement of work for fiscal year 2006 to require NSC to:    check suppliers’ licenses and liability insurance each year, rather than  every 3 years at reenrollment, and compare suppliers’ billing histories to  the licenses they provide at that time;    provide on-site inspectors with the billing histories of DMEPOS suppliers    conduct site inspections of suppliers’ off-site inventory storage locations  and of businesses that provide them with inventory through contracts; and    conduct out-of-cycle inspections, the number of which CMS will manage  based on NSC’s workload and budgetary constraints. For custom- fabricated orthotics and prosthetics, we were not able to confirm whether  the suppliers that had not disclosed to NSC that they would be providing  these items and were paid at least $1,000 for such claims in 2004 in  Florida, Illinois, and Texas had the proper state licenses, because those  states license individuals to be allowed to supply these items, not  companies. Appendix II: Medicare’s 21 Standards for Suppliers and NSC’s Procedures to Verify Their Compliance

Suppliers of durable medical equipment (DME), prosthetics, orthotics, and  supplies must meet 21 standards in order to obtain and retain their  Medicare billing privileges.
Why GAO Did This Study

In fiscal year 2004, the Centers for Medicare & Medicaid Services (CMS) estimated that Medicare improperly paid $900 million for durable medical equipment, prosthetics, orthotics, and supplies--in part due to fraud by suppliers. To deter such fraud, CMS contracts with the National Supplier Clearinghouse (NSC) to verify that suppliers meet 21 standards before they can bill Medicare. NSC verifies adherence to the standards through on-site inspections and document reviews. Recent prosecutions of fraudulent suppliers suggest that there may be weaknesses in NSC's efforts to screen suppliers or in the standards. In this report, GAO evaluated: 1) NSC's efforts to verify suppliers' compliance with the 21 standards, 2) the adequacy of the standards to screen suppliers, and 3) CMS's oversight of NSC's efforts.

What GAO Found

NSC's efforts to verify compliance with the 21 standards are insufficient because of weaknesses in two key screening procedures--checking state licensure and conducting on-site inspections. NSC's licensure check is ineffective because it relies on self-reported information about the items suppliers intend to provide to beneficiaries and does not match this against actual billing later. We found a total of 22 suppliers in Florida, Louisiana, and Texas that had each been paid at least $1,000 by Medicare in 2004 for providing oxygen services, but did not have the required state license. Further, more than half of the almost $107 million paid by Medicare for custom-fabricated orthotics and prosthetics in Florida in 2004 went to suppliers that had not had their licenses checked. At least 46 of these suppliers were under investigation for fraud as of April 2005. NSC's on-site inspections also have weaknesses that limit their effectiveness. We estimate that NSC did not conduct required on-site inspections of 605 suppliers. Further, when conducting on-site inspections, NSC does not require its inspectors to examine beneficiary files to assess whether suppliers are meeting the standard to maintain proof of delivery or check whether suppliers have a real source of inventory, as required by Medicare. Medicare's 21 standards are currently too weak to be used effectively to screen medical equipment suppliers. Although Medicare paid suppliers about $8.8 billion in fiscal year 2004, the program's 21 standards do not include measures related to supplier integrity and capability analogous to those that federal agencies generally apply to prospective contractors or those used by at least two state Medicaid programs for their suppliers. For example, in sworn testimony before the Committee on Finance in April 2004, an individual who pleaded guilty to Medicare fraud described how she was able to open a sham business with $3,000--despite lacking the experience and the financial, technical, and managerial resources to operate a legitimate supply company. If an agency finds a company does not meet federal contracting standards for integrity and capability, the agency may decline to award it a contract. If a contractor performs inadequately, the agency can terminate the contract. Further, agencies may disqualify a contractor from competing for other federal contracts. In addition, a California supplier that is disenrolled from Medicaid for failing to meet state requirements cannot reenroll for 3 years. In contrast, if a Medicare supplier can later demonstrate compliance with the 21 standards, CMS readmits it into the program. CMS's oversight has not been sufficient to determine whether NSC is meeting its responsibilities in screening and enrolling DMEPOS suppliers. For example, CMS was unaware--until we informed the agency--that NSC had not conducted all required on-site inspections for suppliers. Moreover, while CMS has established performance goals for NSC related primarily to processing applications, it has not established a method to evaluate NSC's success in identifying noncompliant and fraudulent suppliers and recommending that they be removed from the program.