Testing the Medicare Enrollment Process

After establishing two fictitious DMEPOS storefronts with no inventory  and no clients, our undercover investigators were able to successfully  complete the Medicare enrollment process. After  submitting corrective action plans addressing the standards we failed,  both companies were approved for Medicare billing privileges and  provided with billing numbers. Creating Fictitious DMEPOS Companies

Prior to submitting applications to CMS to become approved DMEPOS  suppliers, investigators easily set up two fictitious durable medical  equipment companies during April and May 2007 using undercover names  and bank accounts. We created phony contracts with two fictitious DMEPOS wholesale  suppliers to demonstrate that we had the capacity to supply equipment  and supplies to clients. In reality, these phone numbers were  unmanned extensions in the GAO building. Posing as a representative for this  wholesale supplier, an undercover investigator left a vague message in  response but did not confirm the existence of a contract or a credit line. Completing Electronic Test Billing

After requesting an electronic billing enrollment package and obtaining  passwords from CMS, we were able to successfully complete Medicare’s  often confusing test billing process for our Virginia office; we did not  complete test billing for our Maryland office because we did not receive  the necessary passwords from CMS by the close of our investigation in  June 2008. Had we been real fraudsters, we could have fraudulently billed  Medicare for substantial sums, potentially reaching millions of dollars. We did not receive any further information  related to the Maryland DMEPOS company. On March 13, 2008, we  received, among other things, an electronic billing submitter identification  number and password for the Virginia office. Case Studies Provide Real Examples of Fraudulent DMEPOS Suppliers

As shown by four closed cases from South Florida that we obtained from  the HHS IG, criminals use similar techniques to establish fictitious  DMEPOS suppliers and then employ billing schemes to obtain millions of  dollars in Medicare funds from the government. Specifically, once  criminals have created fraudulent DMEPOS companies, they typically steal  or buy Medicare beneficiary numbers and physician identification  numbers in order to repeatedly submit claims. In October 2006, the owner bought a DMEPOS company that  had been incorporated in August 2006 and used the original owner’s  identity, billing number, and beneficiaries to submit claims in an attempt  to avoid detection by CMS. This company used a utility closet as its address—HHS  investigators found buckets of sand mix, road tar, and a large wrench in  the room, but no medical files, office equipment, or telephone. In total, from October 2006 through March  2007, the owner submitted claims from these three companies in excess of  $5.5 million and ultimately received about $77,000 from Medicare. Case Study 3: This company billed Medicare for $4.4 million dollars  worth of supplies and services that were never delivered. These claims  were submitted between March and July 2006 using real beneficiary  numbers that the DMEPOS company owner had purchased illegally. Ultimately, Medicare paid approximately half of these claims ($2.2  million). According to HHS IG records, the only employee not involved in  the scheme was a secretary who told investigators that there was never  any business activity in the office and that the owner rarely visited. Corrective Action Briefing

On June 18, 2008, we informed representatives from CMS about the results  of our investigation. They also acknowledged that our covert testing illustrates gaps in  oversight that still require improvement and stated that they would  continue to work to strengthen the entire DMEPOS enrollment process. (ii) The supplier has furnished a Medicare-covered item to the individual and the supplier is contacting the  individual to coordinate the delivery of the item.
Why GAO Did This Study

According to the Department of Health and Human Services (HHS), schemes to defraud the Medicare program have grown more elaborate in recent years. In particular, HHS has acknowledged Centers for Medicare & Medicaid Service's (CMS) oversight of suppliers of durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) is inadequate to prevent fraud and abuse. Specifically, weaknesses in the DMEPOS enrollment and inspection process have allowed sham companies to fraudulently bill Medicare for unnecessary or nonexistent supplies. From April 2006 through March 2007, CMS estimated that Medicare improperly paid $1 billion for DMEPOS supplies--in part due to fraud by suppliers. Due to the committee's concern about vulnerabilities in the enrollment process, GAO used publicly available guidance to attempt to create DMEPOS suppliers, obtain Medicare billing numbers, and complete electronic test billing. GAO also reported on closed cases provided by the HHS Inspector General (IG) to illustrate the techniques used by criminals to fraudulently bill Medicare. On June 18, 2008, we briefed CMS representatives on the results of our investigation. In response, they acknowledged that our covert tests illustrate gaps in oversight that still require improvement and stated that they would continue to work to strengthen the entire DMEPOS enrollment process.

What GAO Found

Investigators easily set up two fictitious DMEPOS companies using undercover names and bank accounts. GAO's fictitious companies were approved for Medicare billing privileges despite having no clients and no inventory. CMS initially denied GAO's applications in part because of this lack of inventory, but undercover GAO investigators fabricated contracts with nonexistent wholesale suppliers to convince CMS and its contractor, the National Supplier Clearinghouse (NSC), that the companies had access to DMEPOS items. The contact number GAO gave for these phony contracts rang on an unmanned undercover telephone in the GAO building. When NSC left a message looking for further information related to the contracts, a GAO investigator left a vague message in return pretending to be the wholesale supplier. As a result of such simple methods of deception, both fictitious DMEPOS companies obtained Medicare billing numbers. After requesting an electronic billing enrollment package and obtaining passwords from CMS, GAO investigators were then able to successfully complete Medicare's test billing process for the Virginia office. GAO could not complete test billing for the Maryland office because CMS has not sent the necessary passwords. However, if real fraudsters had been in charge of the fictitious companies, they would have been clear to bill Medicare from the Virginia office for potentially millions of dollars worth of nonexistent supplies. Once criminals have similarly created fictitious DMEPOS companies, they typically steal or illegally buy Medicare beneficiary numbers and physician identification numbers and use them to repeatedly submit claims. In one case from HHS IG, a company received $2.2 million in payments from Medicare for supplies and services that were never delivered. The owner submitted these fraudulent claims from March 2006 through July 2006 using real beneficiary numbers and physician identification numbers that he had purchased illegally. The only employee not involved in the scheme was a secretary, who told HHS IG that there was no business activity in the office and that the owner was rarely there. Another case related to an individual who stole beneficiary numbers and physician identification numbers and submitted $5.5 million in claims for three fraudulent offices from October 2006 through March 2007. He operated one of these offices out of a utility closet containing buckets of sand mix, road tar, and a large wrench, but no medical files, office equipment, or telephone.