However, CMS has not completed other actions that could help  prevent individuals intent on fraud from enrolling, including  implementation of some relevant PPACA provisions. Past CMS Efforts to Strengthen Provider Enrollment

Our previous work found persistent weaknesses in Medicare’s enrollment  standards and procedures that increased the risk of enrolling entities  intent on defrauding the Medicare program. CMS  designated three levels of risk—high, moderate, and limited—with  different screening procedures for categories of Medicare providers at  each level. CMS Has Not Completely Implemented Some PPACA Enrollment Provisions

Implementation of other enrollment screening actions authorized by  PPACA that could help CMS reduce the enrollment of providers and  suppliers intent on defrauding the Medicare program remains incomplete,  including:
Surety bond—PPACA authorizes CMS to require a surety bond for  certain types of at-risk providers, which can be helpful in recouping  erroneous payments. On April 13,  2012, CMS issued a request for information regarding the potential  solicitation of a single contract for Medicare provider and supplier  fingerprint-based background checks. Providers and suppliers disclosure—CMS officials said the agency  is reviewing options to include in regulations for increased disclosures  of prior actions taken against providers and suppliers enrolling or  revalidating enrollment in Medicare, such as whether the provider or  supplier has been subject to a payment suspension from a federal  health care program. Additional Action May Help Better Identify Potential Fraud through Pre- and Post- Payment Claims Review

Increased efforts to review claims on a prepayment basis can better  prevent payments that should not be made, while improving systems  used to review claims on a post-payment basis could better identify  patterns of fraudulent billing for further investigation. The Medicare program has  defined categories of items and services eligible for coverage and  excludes from coverage items or services that are determined not to be  “reasonable and necessary for the diagnosis and treatment of an illness  or injury or to improve functioning of a malformed body part.” its contractors set policies regarding when and how items and services  will be covered by Medicare, as well as coding and billing requirements  for payment, which also can be implemented in the payment systems  through edits. While the PSCs were responsible for program integrity for specific parts of Medicare, such  as Part A, the ZPICs are responsible for Medicare’s fee-for-service program integrity in  their geographic zones. In our prior work on  DMEPOS, we recommended that CMS require its contractors to develop  thresholds for unexplained increases in billing and use them to develop  pre-payment controls that could suspend these claims for further review  before payment. Actions Needed to Improve Use of Systems Intended for Post-payment Claims Review

Further actions are needed to improve use of two CMS information  technology systems that could help CMS and program integrity  contractors identify fraud after claims have been paid. GAO recommended that CMS take steps to finalize plans and reliable  schedules for fully implementing and expanding the use of both IDR and  One PI. A Robust Process to Address Identified Vulnerabilities Could Help Reduce Fraud

Having mechanisms in place to resolve vulnerabilities that lead to  improper payments is critical to effective program management and could  help address fraud. However, our work and the work of OIG have shown weaknesses  in CMS’s processes to address vulnerabilities identified by these  contractors. CMS’s Recovery Audit Contractors (RAC) are specifically charged with  identifying improper payments and vulnerabilities that could lead to such  payment errors. recommended that CMS develop and implement a corrective action  process that includes policies and procedures to ensure the agency  promptly (1) evaluates findings of RAC audits, (2) decides on the  appropriate response and a time frame for taking action based on  established criteria, and (3) acts to correct the vulnerabilities identified. We are currently examining aspects of CMS’s  vulnerability tracking process and will be reporting on it soon. In particular, we have found  CMS could do more to strengthen provider enrollment screening to avoid  enrolling those intent on committing fraud, improve pre- and post- payment claims review to identify and respond to patterns of suspicious  billing activity more effectively, and identify and address vulnerabilities to  reduce the ease with which fraudulent entities can obtain improper  payments. Medicare: Program Remains at High Risk Because of Continuing  Management Challenges. High-Risk Series: An Update. Washington, D.C.:   February 2011.
Why GAO Did This Study

GAO has designated Medicare as a high-risk program. Since 1990, every two years GAO has provided Congress with an update on this program, which highlights government operations that are at high risk for waste, fraud, abuse mismanagement or in need of broad reform. Medicare has been included in this program in part because its complexity makes it particularly vulnerable to fraud. Fraud involves an intentional act or representation to deceive with the knowledge that the action or representation could result in gain. The deceptive nature of fraud makes its extent in the Medicare program difficult to measure in a reliable way, but it is clear that fraud contributes to Medicares fiscal problems. Reducing fraud could help rein in the escalating costs of the program.
This statement focuses on the progress made and important steps to be taken by CMS and its program integrity contractors to reduce fraud in Medicare. These contractors perform functions such as screening and enrolling providers, detecting and investigating potential fraud, and identifying improper payments and vulnerabilities that could lead to payment errors. This statement is based on relevant GAO products and recommendations issued from 2004 through 2012 using a variety of methodologies, such as analyses of Medicare claims, review of relevant policies and procedures, and interviews with officials.

What GAO Found

The Centers for Medicare & Medicaid Services (CMS)the agency that administers Medicarehas made progress in implementing several key strategies GAO identified in prior work as helpful in protecting Medicare from fraud; however, important actions that could help CMS and its program integrity contractors combat fraud remain incomplete.
Provider Enrollment : GAOs previous work found persistent weaknesses in Medicares enrollment standards and procedures that increased the risk of enrolling entities intent on defrauding the program. CMS has strengthened provider enrollmentfor example, in February 2011, CMS designated three levels of riskhigh, moderate, and limitedwith different screening procedures for categories of providers at each level. However, CMS has not completed other actions, including implementation of some relevant provisions of the Patient Protection and Affordable Care Act (PPACA). Specifically, CMS has not (1) determined which providers will be required to post surety bonds to help ensure that payments made for fraudulent billing can be recovered, (2) contracted for fingerprint-based criminal background checks, (3) issued a final regulation to require additional provider disclosures of information, and (4) established core elements for provider compliance programs.
Pre- and Post-payment Claims Review : GAO had previously found that increased efforts to review claims on a prepayment basis can prevent payments from being made for potentially fraudulent claims, while improving systems used by CMS and its contractors to review claims on a post-payment basis could better identify patterns of potentially fraudulent billing for further investigation. CMS has controls in Medicares claims-processing systems to determine if claims should be paid, denied, or reviewed further. These controls require timely and accurate information about providers that GAO has previously recommended that CMS strengthen. GAO is currently examining CMSs new Fraud Prevention System, which uses analytic methods to examine claims before payment to develop investigative leads for Zone Program Integrity Contractors (ZPIC), the contractors responsible for detecting and investigating potential fraud. Additionally, CMS could improve its post-payment claims review to identify patterns of fraud by incorporating prior GAO recommendations to develop plans and timelines for fully implementing and expanding two information technology systems it developed.
Robust Process to Address Identified Vulnerabilities : Having mechanisms in place to resolve vulnerabilities that lead to erroneous payments is critical to effective program management and could help address fraud. Such vulnerabilities are service- or system-specific weaknesses that can lead to payment errorsfor example, providers receiving multiple payments as a result of incorrect coding. GAO has previously identified weaknesses in CMSs process for addressing identified vulnerabilities and the Department of Health and Human Services Office of Inspector General recently reported on CMSs inaction in addressing vulnerabilities identified by its contractors, including ZPICs. GAO is evaluating the current status of the process for assessing and developing corrective actions to address vulnerabilities.