A provider’s Medicare billing privileges are terminated. While the program integrity contractors have been using these systems to  support CMS’s efforts to identify improper and potentially fraudulent  payments of Medicare claims, they have not previously had access to  information technology systems and tools from CMS that were designed  specifically to identify potentially fraudulent claims before they were paid. In defining requirements for the system to address the  mandate of the Small Business Jobs Act, these program officials planned  to implement by July 1, 2011, system software for analyzing fee-for- service claims data, along with predictive analytic models that use historic  Medicare claims and other data to identify high-risk claims and providers. In addition, the system was integrated  with existing data sources and systems that process claims, but it was not  yet integrated with CMS’s claims payment systems. As required by the act, CMS integrated FPS with existing data sources  and systems that process claims. However, FPS program  officials had not yet developed such schedules and did not indicate when  they intend to do so. Until it develops reliable schedules for completing  associated tasks, the agency will be at risk of experiencing additional  delays in further integrating FPS with the payment processing system,  and CMS and its program integrity analysts may lack the capability  needed to prevent payment of potentially fraudulent claims identified by  FPS until they are determined by program integrity analysts to be valid. By prioritizing these investigations, these officials told  us that they intend for ZPICs to target suspect providers for investigation  as soon as aberrant billing patterns that are consistent with fraud are  identified, rather than targeting providers that have already received large  amounts of potentially fraudulent payments. CMS’s Use of FPS Has Generally Been Consistent with Practices Identified by Private Insurers and Medicaid Programs

CMS’s use of FPS has generally been consistent with key practices for  using predictive analytics technologies identified by private insurers and  state Medicaid programs we interviewed. CMS has taken steps to publicize FPS  among providers. CMS Has Not Defined and Measured Quantifiable Benefits and Performance Goals for FPS

The Clinger-Cohen Act of 1996 and OMB guidance emphasize the need  for agencies to forecast expected financial benefits of major investments  in information technology and measure actual benefits accrued through  implementation. With regard to FPS, CMS had not yet defined an approach for quantifying  the financial benefits expected from the use of the system. According to program officials, FPS stakeholders, such as CPI program  managers, provided input into the development of these measures. In this regard, quantifiable financial benefits and  measureable performance targets and goals provide information needed  to conduct post-implementation reviews of systems. Until the agency conducts its post-implementation review of  FPS, CMS will be unable to determine whether the use of the system is  beneficial and effective in supporting program integrity analysts’ ability to  prevent payment of fraudulent claims, a key component of the agency’s  broader strategy for preventing fraud in the Medicare program. Recommendations for Executive Action

To help ensure that the implementation of FPS is successful in helping  the agency meet the goals and objectives of its fraud prevention strategy,  we are recommending that the Secretary of HHS direct the Administrator  of CMS to define quantifiable benefits expected as a result of using the system,  along with mechanisms for measuring them, and describe outcome-based performance targets and milestones that can  be measured to gauge improvements to the agency’s fraud prevention  initiatives attributable to the implementation of FPS. We are also recommending that the Secretary direct the Administrator of  CMS to develop schedules for completing plans to further integrate FPS with  the claims payment processing systems that identify all resources and  activities needed to complete tasks and that consider risks and  obstacles to the program, and  conduct a post-implementation review of the system to determine  whether it is effective in providing the expected financial benefits and  supporting CMS’s efforts to accomplish the goals of its fraud  prevention program. HHS also  provided technical comments on the draft report, which we incorporated  as appropriate. Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to (1) determine the status of  implementation and use of the Centers for Medicare and Medicaid  Services’ (CMS) Fraud Prevention System (FPS) within the agency’s  existing information technology infrastructure, (2) describe how the  agency uses FPS to identify and investigate potentially fraudulent  payments, (3) assess how the agency’s use of FPS compares to private  insurers’ and Medicaid programs’ practices, and (4) determine the extent  to which CMS defined and measured benefits and performance goals for  the system and has identified and met milestones for achieving those  goals. We focused our  analysis on the extent to which CMS implemented and used the  predictive analytics system within the existing IT infrastructure.
Why GAO Did This Study

GAO has designated Medicare as a high-risk program, in part because its complexity makes it particularly vulnerable to fraud. CMS, as the agency within the Department of Health and Human Services (HHS) responsible for administering Medicare and reducing fraud, uses a variety of systems that are intended to identity fraudulent payments. To enhance these efforts, the Small Business Jobs Act of 2010 provided funds for and required CMS to implement predictive analytics technologies--automated systems and tools that can help identify fraudulent claims before they are paid. In turn, CMS developed FPS.
GAO was asked to (1) determine the status of the implementation and use of FPS, (2) describe how the agency uses FPS to identify and investigate potentially fraudulent payments, (3) assess how the agency's use of FPS compares to private insurers' and Medicaid programs' practices, and (4) determine the extent to which CMS has defined and measured benefits and performance goals for the system. To do this, GAO reviewed program documentation, held discussions with state Medicaid officials and private insurers, and interviewed CMS officials and contractors.

What GAO Found

The Centers for Medicare and Medicaid Services (CMS) implemented its Fraud Prevention System (FPS) in July 2011, as required by the Small Business Jobs Act, and the system is being used by CMS and its program integrity contractors who conduct investigations of potentially fraudulent claims. Specifically, FPS analyzes Medicare claims data using models of fraudulent behavior, which results in automatic alerts on specific claims and providers, which are then prioritized for program integrity analysts to review and investigate as appropriate. However, while the system draws on a host of existing Medicare data sources and has been integrated with existing systems that process claims, it has not yet been integrated with the agency's payment-processing system to allow for the prevention of payments until suspect claims can be determined to be valid. Program officials stated that this functionality has been delayed due to the time required to develop system requirements; they estimated that it will be implemented by January 2013 but had not yet developed reliable schedules for completing this activity.
FPS is intended by program integrity officials to help facilitate the agency's shift from focusing on recovering large amounts of fraudulent payments after they have been made, to taking actions to prevent payments as soon as aberrant billing patterns are identified. Specifically, CMS has directed its program integrity contractors to prioritize alerts generated by the system and to focus on administrative actions--such as revocations of suspect providers' Medicare billing privileges--that can stop payment of fraudulent claims. To this end, the system has been incorporated into the contractors' existing investigative processes. CMS has also taken steps to address challenges contractors initially faced in using FPS, such as shifting priorities, workload challenges, and issues with system functionality.
Program integrity analysts' use of FPS has generally been consistent with key practices for using predictive analytics identified by private insurers and state Medicaid programs. These include using a variety of data sources; collaborating among system developers, investigative staff, and external stakeholders; and publicizing the use of predictive analytics to deter fraud.
CMS has not yet defined or measured quantifiable benefits, or established appropriate performance goals. To ensure that investments in information technology deliver value, agencies should forecast expected financial benefits and measure benefits accrued. In addition, the Office of Management and Budget requires agencies to define performance measures for systems that reflect program goals and to conduct post-implementation reviews to determine whether objectives are being met. However, CMS had not defined an approach for quantifying benefits or measuring the performance of FPS. Further, agency officials had not conducted a post-implementation review to determine whether FPS is effective in supporting efforts to prevent payment of fraudulent claims. Until program officials review the effectiveness of the system based on quantifiable benefits and measurable performance targets, they will not be able to determine the extent to which FPS is enhancing CMS's ability to accomplish the goals of its fraud prevention program.

What GAO Recommends

GAO recommends that CMS develop schedules for completing integration with existing systems, define and report to Congress quantifiable benefits and measurable performance targets and milestones, and conduct a post-implementation review of FPS. In its comments, HHS agreed with and described actions CMS was taking to address the recommendations.