FFS payments are based on claims  data received directly from providers. Under the Improper Payments  Information Act of 2002 (IPIA), as amended, CMS reported that the FFS  improper payment rate was 11 percent for fiscal year 2016. Also in FFS, CMS uses different types of contractors to conduct  prepayment and postpayment reviews of Medicare claims at high risk for  improper payments. Whereas Medicare pays FFS providers for services provided, Medicare  pays MAOs a fixed monthly amount per enrollee regardless of the  services enrollees use. To identify and recover MA improper payments  resulting from unsupported data submitted by MAOs for risk adjustment  purposes, CMS conducts two types of RADV audits: national RADV  activities and contract-level RADV audits. Both types determine whether  the diagnosis codes submitted by MAOs are supported by a beneficiary’s  medical record. CMS has RADV audits underway for three payment years—2011, 2012,  and 2013. CMS calculates a beneficiary’s risk score—a relative measure of  projected Medicare spending—based on both demographic  characteristics and health status (diagnoses). Several Factors Hinder CMS’s Efforts to Recover MA Improper Payments

In our 2016 report, we found several factors that hamper CMS’s recovery  activities, including its failure to select contracts for audit that have the  greatest potential for payment recovery, delays in conducting CMS’s first  two RADV payment audits, and its lack of specific plans or a timetable for  incorporating Recovery Audit Contractors (RACs) into the MA program to  identify improper payments and help with their recovery. CMS Did Not Focus RADV Audits on Contracts with Highest Potential for Improper Payments

Our 2016 report found that the results from the RADV audits of 2007  payments indicated that the scores CMS calculates to identify contracts  that are candidates for audit, called coding intensity scores, were not  strongly correlated with the percentage of unsupported diagnoses. The second reason audits are not targeted to the contracts with the  greatest potential for recovery is that CMS does not always use the  information available to it to select audit contracts with the highest  potential for improper payments. Also, CMS’s 2011 contract selection methodology  did not consider results from the agency’s prior RADV audits, potentially  overlooking information indicating contracts with known improper  payment risk. We made two recommendations to address these issues:
We recommended that (1) CMS improve the accuracy of coding  intensity calculations, and (2) modify its processes for selecting  contracts for RADV audit to focus on those most likely to have  improper payments. We recommended that CMS develop specific plans for incorporating a  RAC into the RADV program. In July 2017, CMS officials told us that  the agency is evaluating its strategy for the MA RAC with CMS  leadership. CMS Has Made Limited Progress Validating Encounter Data Used to Ensure Proper Payments

In July 2014, we recommended that CMS complete all the steps  necessary to validate encounter data, including performing statistical  analyses, reviewing medical records, and providing MAOs with summary  reports on CMS’s findings, before using the data to risk adjust payments  or for other intended purposes. In our 2017 report, we found that CMS  had made limited progress toward validating encounter data. As of January 2017, CMS had begun compiling basic statistics on the  volume and consistency of data submissions and preparing automated  summary reports for MAOs indicating the diagnosis information used for  risk adjustment; however CMS had not yet taken other important steps  identified in its Medicaid protocol, which we used for comparison. This  step would provide recommendations to MAOs for improving the  completeness and accuracy of encounter data. We found in our 2017 report that CMS  had made progress in defining its objectives for using MA encounter data  for risk adjustment and in communicating its plans and time frames to  MAOs. CMS reported it plans to fully transition to using MA encounter  data for risk adjustment purposes by 2020. Given CMS’s limited progress in  planning and time frames for all authorized uses of the data, we continue  to believe CMS should implement our July 2014 recommendations that  CMS should establish specific plans for using MA encounter data and  thoroughly assess data completeness and accuracy before using the data  to risk adjust payments or for other purposes. In response to our 2014  recommendations, the Department of Health and Human Services did not  specify a date by which CMS would develop plans for all authorized uses  of the data and did not commit to completing data validation before using  the data for risk adjustment in 2015. In conclusion, Medicare remains inherently complex and susceptible to  improper payments. Therefore, actions CMS takes to ensure the integrity  of the MA program by identifying, reducing, and recovering improper  payments would be critical to safeguarding federal funds.
Why GAO Did This Study

GAO has designated Medicare as a high-risk program because of its size, complexity, and susceptibility to mismanagement and improper payments, which reached an estimated $60 billion in fiscal year 2016.
CMS contracts with MAOs to provide services to about one-third of all Medicare beneficiaries, and paid MAOs about $200 billion for their care in 2016. CMS's payments to the MAOs vary based on the health status of beneficiaries. For example, an MAO receives a higher risk-adjusted payment for an enrollee with a diagnosis of diabetes than for an otherwise identical enrollee without this diagnosis. Improper payments in MA arise primarily from diagnosis information unsupported by medical records that leads CMS to increase its payments.
This testimony is based on GAO's 2016 and 2017 reports addressing MA improper payments and highlights (1) factors that have hindered CMS's efforts to identify and recover improper payments through payment audits and (2) CMS's progress in validating encounter data for use in risk adjusting payments to MAOs. For these reports, GAO reviewed research and agency documents, analyzed data from ongoing RADV audits, and compared CMS's activities with the agency's protocol for validating Medicaid encounter data and federal internal control standards. GAO interviewed CMS officials for both reports, and also asked for updates on the status of GAO's prior recommendations for this statement.

What GAO Found

The Centers for Medicare & Medicaid Services (CMS) estimated that about $16 billion—nearly 10 percent—of Medicare Advantage (MA) payments in fiscal year 2016 were improper. To identify and recover MA improper payments, CMS conducts risk adjustment data validation (RADV) audits of prior payments. These audits determine whether the diagnosis data submitted by Medicare Advantage organizations (MAOs), which offer private plan alternatives to fee-for-service (FFS) Medicare, are supported by a beneficiary's medical record. CMS pays MAOs a predetermined monthly amount for each enrollee. CMS uses a process called risk adjustment to project each enrollee's health care costs using diagnosis data from MAOs and demographic data from Medicare. In its 2016 report, GAO found several factors impeded CMS's efforts to identify and recover improper payments, including:
RADV audits were not targeted to contracts with the highest potential for improper payments. The agency's method of calculating improper payment risk for each contract, based on the diagnoses reported for the contract's beneficiaries, had shortcomings, and CMS did not use other available data to select the contracts with the greatest potential for improper payment recovery.
Substantial delays in RADV audits in progress jeopardize CMS's goal of eventually conducting annual RADV audits. CMS had RADV audits underway for payment years 2011, 2012, and 2013.
CMS had not expanded the use of Recovery Audit Contractors (RAC) to the MA program as required by law in 2010. RACs have been used in other Medicare programs to recover improper payments for a contingency fee.
GAO recommended that CMS improve the accuracy of its methodology for identifying contracts with the greatest potential for improper payment recovery, modify the processes for selecting contracts to focus on those most likely to have improper payments, and improve the timeliness of the RADV audit process. CMS reported in July 2017 that it had taken initial actions to address these recommendations, but none had been fully implemented. GAO also recommended that CMS develop specific plans for incorporating a RAC into the RADV program. In July 2017, CMS reported that the agency is evaluating its strategy for the MA RAC with CMS leadership.
CMS has begun to use encounter data, which are similar to FFS claims data, along with diagnosis data from MAOs to help ensure the proper use of federal funds by improving risk adjustment in the MA program. Encounter data include more information about the care and health status of MA beneficiaries than the data CMS uses now to risk adjust payments. In its January 2017 report, GAO found CMS had made progress in developing plans to use encounter data for risk adjustment. However, CMS had made limited progress in validating the completeness and accuracy of MA encounter data, as GAO recommended in 2014. GAO continues to believe that CMS should establish plans for using encounter data and thoroughly assess the data for completeness and accuracy before using it to risk adjust payments.