2. 3. CMS also requires ZPICs to support HHS OIG, the Department of Justice  (DOJ), and other law enforcement entities with their Medicare fraud  investigations. ZPICs reported spending most of their fee-for-service funding in 2012 on  fraud case development, primarily for investigative staff. In 2012, ZPICs reported that their  investigations included 3,600 beneficiary interviews, 777 onsite  inspections, prepayment reviews of 190,000 suspended claims and  postpayment reviews of 32,000 paid claims. ZPICs Reported More than $250 Million in Savings and Other Actions, Primarily from Reactive Sources, but CMS Lacks Information on Whether More Could Be Saved

In calendar year 2012, ZPICs reported more than $250 million in savings  to Medicare by stopping payment on suspect claims and recouping  money from overpayments. For  example, in 2012 ZPICs reported implementing more than 160  revocations and deactivations. According to CMS, ZPICs are to take immediate action to protect  Medicare funds, but CMS may be missing opportunities for additional  savings to Medicare because the agency lacks information on the  timeliness of certain ZPIC actions. However, CMS does not track information on the  swiftness of these actions, such as the length of time between a ZPIC’s  receipt of a complaint about a suspect provider and the ZPIC’s visit to that  provider, or between identifying a potentially fraudulent provider and  initiating an administrative action. CMS Generally Gave ZPICs Good Reviews, but Does Not Link ZPIC Performance to Agency Program Integrity Measures

Based on CMS’s annual reviews, five of the six operating ZPICs were  eligible for some portion of their contracts’ available award fees, and  ZPICs received almost 70 percent of all fees for their most recent periods  of performance.the annual reviews—elements that measure aspects of quality of service,  cost control, business relations, and timeliness of certain activities— ranged from satisfactory to exceptional, meeting the award fee eligibility  requirement of at least a satisfactory rating in all four of these elements. CMS follows some best practices for its oversight of ZPICs, but does not  clearly link ZPIC performance to agency performance measures and  goals. Moreover, these performance measures do not  connect ZPIC work to agency performance measures that are linked to its  goals, which is another best practice. Federal standards state that entities should link performance  measurements to goals and objectives, and previous GAO work found  that leading organizations try to link the goals and performance measures  for each organizational level to successive levels and ultimately to the  organization’s strategic goals.none of the ZPICs’ performance measures link to the agency’s measures  of increasing the percentage of administrative actions taken against high- risk providers, or to the other Medicare fee-for-service program integrity  performance measure of reducing improper payments. ZPICs, which are central to that strategy, reported that  their efforts have yielded positive results, such as savings greater than  their contract costs and multiple other actions that helped protect  Medicare from potentially fraudulent providers, such as referring suspect  providers to law enforcement. In addition, as CMS attempts  to achieve its agencywide program integrity goal of fighting fraud and  eliminating improper payments in the Medicare program, it would benefit  from knowing how ZPICs are contributing to efforts to achieve this goal. Recommendations

To help ensure that CMS’s fraud prevention activities are effective and  that CMS is comprehensively assessing ZPIC performance, the  Administrator of CMS should take the following two actions:
Collect and evaluate information on the timeliness of ZPICs’  investigative and administrative actions, such as how soon  investigations are initiated after ZPICs identify potential fraud and how  swiftly ZPICs initiate administrative actions after identifying potentially  fraudulent providers. Agency Comments

We requested comments from HHS, but none were provided. Appendix I: Scope and Methodology

To determine Zone Program Integrity Contractors’ (ZPIC) contract costs  and how ZPICs use those funds, we examined data from CMS’s Analysis,  Reporting, and Tracking System (ARTS), an online system ZPICs use to  submit invoices and report workload statistics and which CMS uses to  track and analyze ZPIC workload, performance, and production.
Why GAO Did This Study

GAO has designated Medicare as a high-risk program, in part because its size and complexity make it particularly vulnerable to fraud. To help detect and prevent potential Medicare fraud, CMS--the agency within the Department of Health and Human Services (HHS) that administers the Medicare program--contracts with ZPICs. These contractors are to identify potential fraud, investigate it thoroughly and in a timely manner, and take swift action, such as working to revoke suspect providers' Medicare billing privileges and referring potentially fraudulent providers to law enforcement.
GAO examined (1) ZPIC contract costs and how ZPICs use those funds, (2) the results of ZPICs' work, and (3) the results of CMS's evaluations of ZPICs' performance and aspects of CMS's evaluation practices. To do this, GAO examined ZPIC funding, contracts, and related documents; data on ZPICs' workloads, investigations, and results; and CMS evaluations of ZPICs as well as federal standards for performance measurement. GAO also interviewed CMS and ZPIC officials.

What GAO Found

The Centers for Medicare and Medicaid Services (CMS) paid its Zone Program Integrity Contractors (ZPIC) about $108 million in 2012. ZPICs reported spending most of this funding on fraud case development, primarily for investigative staff, who in 2012 reported conducting about 3,600 beneficiary interviews, almost 780 onsite inspections, and reviews of more than 200,000 Medicare claims.
ZPICs reported that their actions resulted in more than $250 million in savings to Medicare in calendar year 2012 from actions such as stopping payment on suspect claims. ZPICs also reported taking other actions to protect Medicare funds, including having more than 130 of their investigations accepted by law enforcement for potential prosecution, and working to stop more than 160 providers from receiving additional Medicare payments in 2012. However, CMS lacks information on the timeliness of ZPICs' actions--such as the time it takes between identifying a suspect provider and taking actions to stop that provider from receiving potentially fraudulent Medicare payments--and would benefit from knowing if ZPICs could save more money by acting more quickly.
ZPICs generally received good ratings in annual reviews, with five of six eligible for incentive awards. CMS follows some best practices for ZPICs' oversight, but the agency does not clearly link ZPIC performance to agency program integrity goals. The majority of the measures CMS uses to evaluate ZPICs relate to the quality of their work because, according to CMS officials, quality is the most important element. However, evaluation of such measures, while a best practice, does not connect ZPIC work to agency performance measures. For example, CMS aims to increase the percentage of actions taken against certain high risk Medicare providers--work central to ZPICs--but does not explicitly link ZPICs' work to the agency's progress toward that goal, another best practice that would allow the agency to better assess the ZPICs' support of CMS's fraud prevention efforts.

What GAO Recommends

GAO recommends that CMS collect and evaluate information on the timeliness of ZPICs' investigative and administrative actions, and develop ZPIC performance measures that explicitly link ZPICs' work to Medicare program integrity performance measures and goals. GAO requested comments from HHS on the draft report, but none were provided.