Table 1 summarizes several key  congressional actions. Addressing payment vulnerabilities already identified could further help  prevent or reduce fraud. CMS Has Strengthened Certain Enrollment Screening Procedures since PPACA

PPACA authorized and CMS has implemented new provider and supplier  enrollment procedures that address past weaknesses identified by GAO  and HHS’s Office of Inspector General (OIG) that allowed entities intent  on committing fraud to enroll in Medicare. Specifically, we are assessing the process used to enroll and verify the  eligibility of Medicare providers and suppliers in Medicare’s Provider  Enrollment, Chain, and Ownership System (PECOS) and the extent to  which CMS’s controls are designed to prevent and detect the continued  enrollment of potentially ineligible or fraudulent providers and suppliers in  PECOS. These actions include issuing  a rule to implement surety bonds for certain providers and suppliers,  issuing a rule on provider and supplier disclosure requirements, and  establishing the core elements for provider and supplier compliance  programs. suspension from a federal health care program.indicated that developing the additional disclosure requirements has been  complicated by provider and supplier concerns about what types of  information will be collected, what CMS will do with it, and how the  privacy and security of this information will be maintained. Further Improvements to Prepayment and Postpayment Claims Review May Better Identify or Recover Improper Payments

Medicare uses prepayment review to deny claims that should not be paid  and postpayment review to recover improperly paid claims. Increased use of prepayment edits could help prevent improper Medicare  payments. Based on  an analysis of a limited number of national policies and local coverage  determinations (LCD), we identified $14.7 million in payments in fiscal  year 2010 that appeared to be inconsistent with four national policies and  therefore improper. Our prior work found that postpayment reviews are critical to identifying  and recouping overpayments. CMS  began the program in March 2009 for Medicare FFS. Our work is reviewing,  among other things, whether CMS has a strategy for coordinating these  contractors’ postpayment claims review activities. However, as of  March 2014, CMS had not established deadlines for program integrity  contractors to begin using One PI, as we recommended in 2011. Addressing Identified Vulnerabilities Could Help Reduce Fraud

Having mechanisms in place to resolve vulnerabilities that could lead to  improper payments, some of which are potentially fraudulent, is critical to  effective program management, but our work has shown weaknesses in  CMS’s processes to address such vulnerabilities. We also made recommendations to CMS to address the millions of  Medicare cards that display beneficiaries’ Social Security numbers, which   In August 2012, we  increases beneficiaries’ vulnerability to identity theft.recommended that CMS (1) select an approach for removing Social  Security numbers from Medicare cards that best protects beneficiaries  from identity theft and minimizes burdens for providers, beneficiaries, and  CMS; and (2) develop an accurate, well-documented cost estimate for  such an option. Thus, CMS has not yet taken action to address  these recommendations. In conclusion, although CMS has taken some important steps to identify  and prevent fraud through increased provider and supplier screening and  other actions, the agency must continue to improve its efforts to reduce  fraud, waste, and abuse in the Medicare program. Notably, we are currently assessing potential use of  electronic-card technologies, which can help reduce Medicare fraud. Additionally,  we have a study under way examining CMS’s oversight of fraud, waste,  and abuse in Medicare Part D to determine whether the agency has  adopted certain practices for ensuring the integrity of that program. We  are also examining CMS’s oversight of some of the contractors that  conduct reviews of claims after payment. These studies are focused on  additional actions for CMS that could help the agency more systematically  reduce potential fraud in the Medicare program. Medicare Program Integrity: Contractors Reported Generating Savings,  but CMS Could Improve Its Oversight. High-Risk Series: An Update. Health Care Fraud: Types of Providers Involved in Medicare, Medicaid,  and the Children’s Health Insurance Program Cases.
Why GAO Did This Study

GAO has designated Medicare as a high-risk program, in part because the program's size and complexity make it vulnerable to fraud, waste, and abuse. In 2013, Medicare financed health care services for approximately 51 million individuals at a cost of about $604 billion. The deceptive nature of fraud makes its extent in the Medicare program difficult to measure in a reliable way, but it is clear that fraud contributes to Medicare's fiscal problems. More broadly, in fiscal year 2013, CMS estimated that improper payments—some of which may be fraudulent—were almost $50 billion.
This statement focuses on the progress made and important steps to be taken by CMS and its program integrity contractors to reduce fraud in Medicare. This statement is based on relevant GAO products and recommendations issued from 2004 through 2014 using a variety of methodologies. Additionally, in June 2014, GAO updated information based on new regulations regarding enrollment of certain providers in Medicare by examining public documents.

What GAO Found

The Centers for Medicare & Medicaid Services (CMS)—the agency within the Department of Health and Human Services (HHS) that oversees Medicare—has made progress in implementing several key strategies GAO identified or recommended in prior work as helpful in protecting Medicare from fraud; however, implementing other important actions that GAO recommended could help CMS and its program integrity contractors combat fraud. These strategies are:
Provider and Supplier Enrollment : The Patient Protection and Affordable Care Act (PPACA) authorized, and CMS has implemented, actions to strengthen provider and supplier enrollment that address past weaknesses identified by GAO and HHS's Office of Inspector General. For example, CMS has hired contractors to determine whether providers and suppliers have valid licenses and are at legitimate locations. CMS could further strengthen enrollment screening by issuing a rule to require additional provider and supplier disclosures of information, such as any suspension of payments from a federal health care program, and establishing core elements for provider and supplier compliance programs, as authorized by PPACA.
Prepayment and Postpayment Claims Review : Medicare uses prepayment review to deny claims that should not be paid and postpayment review to recover improperly paid claims. GAO has found that increased use of prepayment edits could help prevent improper Medicare payments. For example, prior GAO work identified millions of dollars of payments that appeared to be inconsistent with selected coverage and payment policies and therefore improper. Postpayment reviews are also critical to identifying and recouping overpayments. GAO recommended better oversight of both (1) the information systems analysts use to identify claims for postpayment review, in a 2011 report, and (2) the contractors responsible for these reviews, in a 2013 report. CMS has taken action or has actions under way to address these recommendations.
Addressing Identified Vulnerabilities : Having mechanisms in place to resolve vulnerabilities that could lead to improper payments is critical to effective program management and could help address fraud. However, prior GAO work has shown weaknesses in CMS's processes to address such vulnerabilities. For example, GAO has made multiple recommendations to CMS to remove Social Security numbers from beneficiaries' Medicare cards to help prevent identity theft. HHS agreed with these recommendations, but reported that CMS could not proceed with the changes for a variety of reasons, including funding limitations, and therefore has not taken action.
GAO work under way addressing these key strategies includes examining: (1) how well CMS's information system can prevent and detect the continued enrollment of ineligible or potentially fraudulent providers and suppliers in Medicare, (2) the potential use of electronic-card technologies to help reduce Medicare fraud, (3) CMS's oversight of program integrity efforts for prescription drugs, and (4) CMS's oversight of some of the contractors that conduct reviews of claims after payment. These studies could help CMS more systematically reduce potential fraud in the Medicare program.