For more than a decade,  CMS and its contractors have applied such tools to access data from  various sources to analyze patterns of unusual activities or financial  transactions that may indicate fraudulent charges or other types of  improper payments. According to program officials, these data, called “shared systems”  data, are needed to support the agency’s plans to incorporate tools to  conduct predictive analysis of claims as they are being processed, helping  to prevent improper payments. While CMS has developed and  begun using IDR, the repository does not include all the planned data,  such as Medicaid and shared systems data. In addition, the agency has  developed and deployed One PI, but the system is being used by less than  7 percent of the intended user community and does not yet provide as  many tools as planned. IDR Has Been Developed and Is in Use, but Does Not Yet Include All Data Needed to Enhance Program Integrity Efforts

IDR has been in use by CMS and contractor program integrity analysts  since September 2006 and currently incorporates data related to claims for  reimbursement of services under Medicare Parts A, B, and D. Specifically,  CMS incorporated Part D data into IDR in September 2006, as planned,  and incorporated Parts A and B data by the end of fiscal year 2008. Specifically, the shared systems  data that are needed to allow predictive analyses of claims are not  incorporated. Table 3 shows the original planned dates for incorporating the various  types of data and the data that were incorporated into IDR as of the end of  fiscal year 2010. Program planning documentation  from August 2009 indicated that One PI program officials planned for 639  program integrity staff and analysts to be trained and using the system by  the end of fiscal year 2010; however, CMS confirmed that by the end of  October 2010 only 42 of those intended users were trained to use One PI,  and 41 were actively using the portal and tools. Of these, 31 were contractors  and 10 were CMS staff who performed analyses of claims to detect  potential cases of fraud, waste, and abuse. Until officials measure and  track financial benefits related to program goals, CMS officials cannot be  assured that the use of the system is helping the agency prevent or recover  funds lost as a result of improper payments of Medicare and Medicaid  claims. Additionally, while program officials defined and reported to OMB  performance targets for IDR related to some of the program’s goals, they  do not reflect its goal to provide a single source of Medicare and Medicaid  data for program integrity efforts. CMS Is Not Yet Positioned to Demonstrate Improvements in Its Ability to Meet Goals and Objectives for Detecting Fraud, Waste, and Abuse through the Use of One PI

The Center for Program Integrity’s overall goal for One PI was to provide  robust tools for accessing a single source of information to enable  consistent, reliable, and timely analyses to improve the agency’s ability to  detect fraud, waste, and abuse. They subsequently revised this estimate to  approximately $21 billion. However, of the analysts in the discussion groups, most did not use  One PI as their only source of information and analysis for detecting  improper payments. Additionally, the limited use of the system has not  generated enough data to quantify the amount of funds recovered from  improper payments. Until it does so, CMS officials will lack the means to determine whether  the use of the systems contributes to the agency’s goal of reducing the  number and amounts of improper payments made as a result of fraudulent,  wasteful, or abusive claims for Medicare and Medicaid services. Recommendations for Executive Action

To help ensure that the development and implementation of IDR and One  PI are successful in helping the agency meet the goals and objectives of its  program integrity initiatives, we are recommending that the Administrator  of CMS take the following seven actions:  finalize plans and develop schedules for incorporating additional data into  IDR that identify all resources and activities needed to complete tasks and  that consider risks and obstacles to the IDR program; implement and manage plans for incorporating data in IDR to meet  schedule milestones;    establish plans and reliable schedules for training all program integrity  analysts intended to use One PI;   establish and communicate deadlines for program integrity contractors to  complete training and use One PI in their work;   conduct training in accordance with plans and established deadlines to  ensure schedules are met and program integrity contractors are trained  and able to meet requirements for using One PI;   define any measurable financial benefits expected from the  implementation of IDR and One PI; and    with stakeholder input, establish measurable, outcome-based performance  measures for IDR and One PI that gauge progress toward meeting program  goals. Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to (1) assess the extent to which the  Centers for Medicare and Medicaid Services (CMS) has developed and  implemented the Integrated Data Repository (IDR) and One Program  Integrity (One PI) systems and (2) determine the agency’s progress toward  achieving defined goals and objectives for using the systems to help detect  fraud, waste, and abuse in the Medicare and Medicaid programs.
Why GAO Did This Study

GAO has designated Medicare and Medicaid as high-risk programs, in part due to their susceptibility to improper payments--estimated to be about $70 billion in fiscal year 2010. Improper payments have many causes, such as submissions of duplicate claims or fraud, waste, and abuse. As the administrator of these programs, the Centers for Medicare and Medicaid Services (CMS) is responsible for safeguarding them from loss. To integrate claims information and improve its ability to detect fraud, waste, and abuse in these programs, CMS initiated two information technology system programs: the Integrated Data Repository (IDR) and One Program Integrity (One PI). GAO was asked to (1) assess the extent to which IDR and One PI have been developed and implemented and (2) determine CMS's progress toward achieving its goals and objectives for using these systems to help detect fraud, waste, and abuse. To do so, GAO reviewed system and program management plans and other documents and compared them to key practices. GAO also interviewed program officials, analyzed system data, and reviewed reported costs and benefits.

What GAO Found

CMS has developed and begun using both IDR and One PI, but has not incorporated into IDR all data as planned and has not taken steps to ensure widespread use of One PI to enhance efforts to detect fraud, waste, and abuse. IDR is intended to be the central repository of Medicare and Medicaid data needed to help CMS program integrity staff and contractors prevent and detect improper payments of Medicare and Medicaid claims. Program integrity analysts use these data to identify patterns of unusual activities or transactions that may indicate fraudulent charges or other types of improper payments. IDR has been operational and in use since September 2006. However, it does not include all the data that were planned to be incorporated by fiscal year 2010. For example, IDR includes most types of Medicare claims data, but not the Medicaid data needed to help analysts detect improper payments of Medicaid claims. IDR also does not include data from other CMS systems that are needed to help analysts prevent improper payments, such as information about claims at the time they are filed and being processed. According to program officials, these data were not incorporated because of obstacles introduced by technical issues and delays in funding. Further, the agency has not finalized plans or developed reliable schedules for efforts to incorporate these data. Until it does so, CMS may face additional delays in making available all the data that are needed to support enhanced program integrity efforts. One PI is a Web-based portal that is to provide CMS staff and contractors with a single source of access to data contained in IDR, as well as tools for analyzing those data. While One PI has been developed and deployed to users, few program integrity analysts were trained and using the system. Specifically, One PI program officials planned for 639 program integrity analysts to be using the system by the end of fiscal year 2010; however, as of October 2010, only 41--less than 7 percent--were actively using the portal and tools. According to program officials, the agency's initial training plans were insufficient and, as a result, they were not able to train the intended community of users. Until program officials finalize plans and develop reliable schedules for training users and expanding the use of One PI, the agency may continue to experience delays in reaching widespread use and determining additional needs for full implementation of the system. While CMS has made progress toward its goals to provide a single repository of data and enhanced analytical capabilities for program integrity efforts, the agency is not yet positioned to identify, measure, and track benefits realized from its efforts. As a result, it is unknown whether IDR and One PI as currently implemented have provided financial benefits. According to IDR officials, they do not measure benefits realized from increases in the detection rate for improper payments because they rely on business owners to do so, and One PI officials stated that, because of the limited use of the system, there are not enough data to measure and gauge the program's success toward achieving the $21 billion in financial benefits that the agency projected.

What GAO Recommends

GAO is recommending that CMS take steps to finalize plans and reliable schedules for fully implementing and expanding the use of the systems and to define measurable benefits. In its comments, CMS concurred with GAO's recommendations.