After selecting beneficiaries for  review, CMS requests supporting medical record documentation for  all diagnoses submitted to adjust risk in the payment year. Beginning with the  contract-level RADV audits of 2011 payments, CMS will collect  extrapolated overpayments from MA organizations once all appeals  are final. Recovery Audit Contractors

Recovery auditors have been used in various industries, including health  care, to identify and collect overpayments. CMS Does Not Focus MA RADV Audits on Contracts with the Highest Potential for Improper Payments

		CMS’s Estimate of MA Improper Payment Risk Has Shortcomings

While coding intensity scores can be helpful in assessing the likelihood of  improper payments for MA contracts, results from the CMS contract-level  RADV audits of 2007 payments indicate that the coding intensity scores  CMS calculated were not strongly correlated with the percentage of  unsupported diagnoses within a contract. The fact that this correlation is  not strong reduces the likelihood that contracts selected for audit would  be those most likely to yield large amounts of improper payments and  hampers CMS’s goal of using the audits to recover improper payments. MA organizations may receive  diagnoses from providers that are related to services rendered to MA  beneficiaries. For future years,  CMS has an available method to distinguish between diagnoses likely  submitted by providers to MA organizations and diagnoses that were  likely later added by MA organizations. These shortcomings are  impediments to CMS’s goal of recovering improper payments and are  counter to federal internal control standards, which require that agencies  use quality information to achieve their program goals. For that audit, CMS officials stated that 20 of  the 30 contracts were chosen because they were among the top third of  all contracts in coding intensity, but we found that many of the 20  contracts were not at the highest risk for improper payments according to  CMS’s estimate of coding intensity. 2). CMS’s RADV Process Has Experienced Substantial Delays in Completing Contract- Level RADV Audits and Appeals Prior Contract-Level RADV Audits Have Been Ongoing for Years, and CMS Lacks a Timetable to Annually Conduct and Complete Audits

CMS officials reported that current contract-level RADV audits have been  ongoing for several years, including the appeals associated with the 2007  contract-level RADV audits. 3.) CMS has not followed established project management  principles in this regard, which call for developing an overall plan to meet  strategic goals and to complete projects in a timely manner. Both the  selection of contracts and beneficiaries currently require risk score and  beneficiary enrollment data. CMS Has Made Little Progress toward Incorporating a Recovery Audit Contractor in MA

CMS has not expanded the RAC program to MA, as it was required to do  by the end of 2010 by the Patient Protection and Affordable Care Act. In December 2015, CMS issued a  request for information seeking industry comment regarding how an MA  RAC could be incorporated into CMS’s existing contract-level RADV audit  framework. Despite its recent request for information, CMS does not have specific  plans or a timetable for including RACs in the contract-level RADV audit  process. Once  the requirement is implemented, CMS could leverage the MA RAC in  order to increase the number of MA organization contracts audited. CMS’s recovery of improper payments has been restricted because it has  not established an MA RAC. For example, CMS currently plans to include  30 MA contracts in contract-level RADV audits for each payment year,  about 5 percent of all contracts. Conclusions

Limitations in CMS’s processes for selecting contracts for audit, in the  timeliness of CMS’s audit and appeal processes, and in the agency’s  plans for using MA RACs to assist in identifying improper payments  hinder the accomplishment of its contract-level RADV audit goals: to  conduct annual contract-level audits and recover improper payments. Third, the Administrator should enhance the timeliness of CMS’s contract- level RADV process by taking actions such as the following:  closely aligning the time frames in CMS’s contract-level RADV audits  with those of the national RADV audits the agency uses to estimate  the MA improper payment rate;  reducing the time between notifying MA organizations of contract  audit selection and notifying them about the beneficiaries and  diagnoses that will be audited;  improving the reliability and performance of the agency’s process for  transferring medical records from MA organizations, including  assessing the feasibility of updating ESMD for use in transferring  medical records in contract-level RADV audits; and  requiring that CMS contract-level RADV auditors complete their  medical record reviews within a specific number of days comparable  to other medical record review time frames in the Medicare program. In its comment letter, HHS also reaffirmed its  commitment to identifying and correcting improper payments in the MA  program.
Why GAO Did This Study

In 2014, Medicare paid about $160 billion to MA organizations to provide health care services for approximately 16 million beneficiaries. CMS, which administers Medicare, estimates that about 9.5 percent of its payments to MA organizations were improper, according to the most recent data—primarily stemming from unsupported diagnoses submitted by MA organizations. CMS currently uses RADV audits to recover improper payments in the MA program.
GAO was asked to review the extent to which CMS is addressing improper payments in the MA program. This report examines the extent to which (1) CMS's contract selection methodology for RADV audits facilitates the recovery of improper payments, (2) CMS has completed RADV audits and appeals in a timely manner, and (3) CMS has made progress toward incorporating RACs into the MA program to identify and assist with improper payment recovery. In addition to reviewing research literature and agency documents, GAO analyzed data from ongoing RADV audits of 2007 and 2011 payments—CMS's two initial contract-level RADV audits. GAO also interviewed CMS officials.

What GAO Found

Medicare Advantage (MA) organizations contract with the Centers for Medicare & Medicaid Services (CMS) to offer beneficiaries a private plan alternative to the original program and are paid a predetermined monthly amount by Medicare for each enrolled beneficiary. These payments are risk adjusted to reflect each enrolled beneficiary's health status and projected spending for Medicare-covered services. CMS conducts risk adjustment data validation (RADV) audits of MA contracts which facilitate the recovery of improper payments from MA organizations that submitted beneficiary diagnoses for payment adjustment purposes that were unsupported by medical records. With a separate national audit, CMS estimated that it improperly paid $14.1 billion in 2013 to MA organizations, primarily because of these unsupported diagnoses.
GAO found that CMS's methodology does not result in the selection of contracts for audit that have the greatest potential for recovery of improper payments. First, CMS's estimate of improper payment risk for each contract, which is based on the diagnoses reported for the beneficiaries in that contract, is not strongly correlated with unsupported diagnoses. Second, CMS does not use other available information to select the contracts at the highest risk of improper payments. As a result, 4 of the 30 contracts CMS selected for its RADV audit of 2011 payments were among the 10 percent of contracts estimated by CMS to be at the highest risk for improper payments. These limitations are impediments to CMS's goal of recovering improper payments and do not align with federal internal control standards, which require that agencies use quality information to achieve their program goals.
CMS's goal of eventually conducting annual RADV audits is in jeopardy because its two RADV audits to date have experienced substantial delays in identifying and recovering improper payments. RADV audits of 2007 and 2011 payments have taken multiple years and are still ongoing for several reasons. First, CMS's RADV audits rely on a system for transferring medical records from MA organizations that has often been inoperable. Second, CMS audit procedures have lacked specified time requirements for completing medical record reviews and for other steps in the RADV audit process. In addition, CMS has not established timeframes for appeal decisions at the first-level of the MA appeal process, as it has done in other contexts.
CMS has not expanded the recovery audit program to MA by the end of 2010, as it was required to do by the Patient Protection and Affordable Care Act. RACs have been used in other Medicare programs to recover improper payments for a contingency fee. In December 2015, CMS issued a request for information seeking industry comment on how an MA RAC could be incorporated into the RADV audit framework. CMS noted in its request that incorporating a RAC into the RADV framework would increase the number of MA contracts audited each year. CMS currently includes 30 MA contracts in each RADV audit, about 5 percent of all MA contracts. Despite the importance of increasing the number of contracts audited, CMS does not have specific plans or a timetable for incorporating RACs into the RADV audit framework, contrary to established project management principles, which stress the importance of developing an overall plan to meet strategic goals.

What GAO Recommends

GAO is making five recommendations to CMS to improve its processes for selecting contracts to include in the RADV audits, enhance the timeliness of the audits, and incorporate RACs into the RADV audits. HHS concurred with the recommendations.