	Limitations Exist in Certain CMS Screening Procedures for Preventing and Detecting Enrollment of Ineligible or Potentially Fraudulent Medicare Providers and Suppliers

In our June 2015 and April 2016 reports examining CMS screening  procedures, we found weaknesses in CMS’s verification of provider  practice location, physician licensure status, providers listed as deceased  or excluded from participating in federal programs or health care–related  programs, and criminal-background histories. These weaknesses may  have resulted in CMS improperly paying thousands of potentially ineligible  providers and suppliers. We made recommendations to address these  weaknesses, which CMS has indicated it has implemented or is taking  steps to address. According to CMS officials, they  have taken some actions to remove or recover overpayments from the  potentially ineligible providers and suppliers we referred to them in April  2015 and April 2016, but CMS’s review and response to the referrals are  ongoing. First, we recommended that CMS modify the CMS  software integrated into PECOS to include specific flags to help identify  potentially questionable practice location addresses, such as CMRA,  vacant, and invalid addresses. The agency concurred with this  recommendation. According to CMS officials, this new DPV functionality flags addresses  that may be CMRA, vacant, or invalid. By updating the address  verification software, CMS can ensure that providers with ineligible  practice location are not listed in PECOS. CMS has taken some actions to remove or recover overpayments from  potentially ineligible providers and suppliers that we referred to it, based  on our June 2015 report. Applicants’ Licensure Information Verification

In our June 2015 report, we found 147 out of about 1.3 million physicians  with active PECOS profiles had received a final adverse action from a  state medical board, as of March 2013. These individuals were either not revoked from the Medicare  program until months after the adverse action or never removed (see fig. However, the report only  provides MACs with the current status of the license that the provider  used to enroll in the Medicare program. Without collecting license  information on all medical licenses, regardless of the state the provider  enrolled in, we concluded that CMS may be missing an opportunity to  identify potentially ineligible providers who have license revocations or  suspensions in other states, which can put Medicare beneficiaries at risk. In May 2016,  CMS officials stated that CMS has established a process to annually  review databases and has incorporated the FSMB database into its  screening process. On the basis of our analysis of CMS’s updates as of May 2016,  CMS has taken the following actions:  taken administrative action to remove the provider or collect funds for  21 providers, determined that the provider had already been removed from the determined that the adverse actions were disclosed or partially  disclosed for 71, and has ongoing reviews of 6. Deceased and Exclusion Verification Procedures

In our June 2015 report, we found that about 460 (0.03 percent) out of the  1.7 million unique providers and suppliers in PECOS as of March 2013  and DMEPOS suppliers as of April 2013 were identified as deceased at  the time of the data we reviewed. Criminal-Background Screening Procedures

As part of CMS’s enrollment-screening process, CMS has controls in  place to verify criminal-background information for providers and  suppliers in PECOS. In our April 2016 report, we found  that 16 out of 66 potentially ineligible providers we identified with criminal  backgrounds received $1.3 million in potential overpayments. Before CMS revised procedures for reviewing the criminal backgrounds of  existing and prospective Medicare providers and suppliers in April 2014,  the agency relied on verifying applicants’ self-reported adverse legal  actions by checking whether providers and suppliers had previously lost  their licenses because of a conviction such as a crime against a person. Additionally, in April 2016, we reported that in April 2014 CMS  implemented steps that provide more information on the criminal  backgrounds of existing and prospective Medicare providers and  suppliers than it obtained previously. In addition, CMS receives  information from ZPICs, which provide a conviction history on providers  and suppliers they investigate. As a result, CMS and its contractors obtain greater  access to data about federal and state offenses and the ability to conduct  a more-comprehensive review of provider and supplier criminal  backgrounds than in the past.
Why GAO Did This Study

In fiscal year 2015, Medicare paid $568.9 billion for health care and related services. CMS estimates that $59.6 billion (about 10.5 percent) of that total was paid improperly. To establish and maintain Medicare billing privileges, providers and suppliers must be enrolled in a CMS database known as PECOS. About 1.9 million providers and suppliers were in PECOS as of December 2015, according to CMS.
GAO published reports in June 2015 and April 2016 that examined Medicare's provider and supplier enrollment-screening procedures to determine whether PECOS was vulnerable to fraud. This testimony discusses the extent to which selected enrollment-screening procedures are designed and implemented to prevent and detect the enrollment of ineligible or potentially fraudulent Medicare providers and suppliers into PECOS.
In its reports, GAO matched providers and suppliers in PECOS, as of March 2013, to several databases to identify potentially ineligible providers and suppliers, and used Medicare claims data to verify whether they were paid during this period. GAO also examined relevant documentation, interviewed CMS officials, and obtained information from the CMS contractors that evaluate provider applications. From August 2015 through May 2016, GAO obtained updated information from CMS staff and reviewed documents related to actions.
CMS has taken or has plans to take some actions to address all of GAO's recommendations and referrals of potentially ineligible providers and suppliers.

What GAO Found

In June 2015 and April 2016, GAO reported on CMS's implementation of enrollment-screening procedures that the Centers for Medicare & Medicaid Services (CMS) uses to prevent and detect ineligible or potentially fraudulent providers and suppliers from enrolling into its Provider Enrollment, Chain and Ownership System (PECOS). GAO identified weaknesses in CMS's verification of provider practice location, physician licensure status, and criminal-background histories. These weaknesses may have resulted in CMS improperly paying thousands of potentially ineligible providers and suppliers.
Specifically, in June 2015, GAO's examination of 2013 data found that about 23,400 (22 percent) of 105,234 of practice location addresses were potentially ineligible. The computer software CMS used as a method to validate applicants' addresses did not flag potentially ineligible addresses, such as those that are of a Commercial Mail Receiving Agency (such as a UPS store mailbox), vacant, or invalid. GAO recommended that CMS incorporate flags into its software to help identify potentially questionable addresses, among other things. CMS concurred with this recommendation and has replaced the PECOS address verification software.
Also, in June 2015, GAO found that, as of March 2013, 147 out of about 1.3 million physicians listed in PECOS had received a final adverse action against their medical license from a state medical board for various felonies that may have made them ineligible to bill Medicare. However, they were either not revoked from the Medicare program until months after the adverse action or never removed because CMS only collected information on the medical license numbers providers used to enroll into the Medicare program. CMS also did not collect adverse-action history or other medical licenses a provider may have in other states that were not used to enroll into Medicare. GAO recommended that CMS collect and review additional license information. CMS has incorporated a new database to obtain additional license history.
In April 2016, GAO reported on CMS's process to conduct criminal-background checks on Medicare providers and suppliers and found that opportunities exist for CMS to recover about $1.3 million in potential overpayments made to 16 out of 66 potentially ineligible providers with criminal backgrounds. In April 2014, CMS implemented procedures to obtain greater access to data to verify criminal backgrounds of existing and prospective Medicare providers and suppliers than it obtained previously; however, the results of GAO's review of the 2013 data identified an opportunity for CMS to recover potential overpayments that were made prior to putting the revised procedures in place.
In addition to its actions in response to GAO's recommendations, CMS has taken some actions to remove or recover overpayments from potentially ineligible providers and suppliers that GAO referred to it in April 2015 and April 2016, but its review and response to the referrals are ongoing.