In 2011, A/B MACs managed more than 1.5 million  Medicare providers and suppliers. Additionally, CMS contracts with the NSC to centralize the  enrollment process and site visits for DMEPOS suppliers. While prepayment edits are in  place to prevent improper payments, factors such as frequency of  information updates and the limitations of the data used to update  information in PECOS may affect the timeliness and accuracy of provider  and supplier information. Enrollment-Related Prepayment Edits Are Designed to Prevent Payments to Ineligible Providers and Suppliers

Enrollment-related prepayment edits are designed to prevent payments to  ineligible providers and suppliers—such as those that are no longer active  in the Medicare program or that are not properly credentialed or licensed  to provide the services for which they have submitted claims. For example, such edits verify the validity of the  entity’s NPI, which indicates whether the claim was submitted by an  active provider or supplier. In turn, the timeliness and  accuracy of information in PECOS—which is downloaded as provider files  into the shared systems each night—is affected by factors such as the  frequency with which contractors update this information and limitations of  the sources of the information used. These sources vary  in the ease with which A/B MACs and the NSC have been able to access  their data and the frequency with which they are updated. However, A/B MACs and the  We have previously reported concerns about the accuracy of the provider  and supplier enrollment information in PECOS and CMS’s oversight of  A/B MACs’ provider and supplier enrollment activities. CMS has  acknowledged these concerns and indicated that the agency is working to  address these issues. CMS Has Implemented Some New Enrollment Screening Procedures Since PPACA, While Others Remain in Progress

Since the enactment of PPACA, CMS has implemented new provider and  supplier enrollment screening procedures and has also implemented  other measures intended to strengthen existing procedures. However, the  implementation of some additional enrollment screening procedures by  CMS is still in progress. New  screening procedures that define conditions for provider and supplier  enrollment in Medicare include CMS’s determination of different levels of  screening according to the risk of fraud, waste, and abuse with respect to  categories of providers or suppliers, and a new application fee for some  types of providers. CMS also published a regulation consistent with its  existing practice, requiring providers and suppliers to include their NPI on  all enrollment applications and claims, and added two new Medicare  contractors—an automated screening contractor and a site visit  contractor—that are intended to conduct enhanced enrollment screening  and site visits. Based on these new risk levels, providers and suppliers are subject to  different screening procedures, with those in the high-risk level subject to  the most rigorous screening. In addition, CMS officials said that the agency has taken a  centralized approach to automated screening of enrollment data because  of weaknesses observed in enrollment screening efforts, which were due  generally to the large number of providers and suppliers for which the A/B  MACs and the NSC had to manually screen applications and the lack of  efficient access to data sources containing enrollment information. For example, CMS has directed the automated screening  contractor to identify additional data sources for screening checks, such  as financial, tax and business, and geospatial data sources. Several New Screening Procedures Remain in Progress

CMS’s implementation of some enrollment screening procedures  authorized by PPACA remains in progress, including efforts to (1) extend  surety bond requirements to additional providers and suppliers,   (2) conduct fingerprint-based criminal background checks of high-risk  providers and suppliers, (3) require enrolling providers and suppliers to  disclose additional types of information, and (4) require compliance and  ethics programs for providers and suppliers. The surety bond would be in an  amount commensurate with the provider’s or supplier’s billing volume, but  not less than $50,000. CMS officials said the agency was working with the Federal Bureau of  Investigation (FBI) to gain access to its criminal background information  for use in conducting fingerprint-based criminal background checks of  high-risk providers and suppliers. Our previous work has found, and  we recommended, that contractor monitoring is needed to ensure that  CMS and its contractors identify and address the causes of improper  payments. Agency Comments

HHS reviewed a draft of this report and in its written comments  highlighted continuing steps that CMS is taking to improve the accuracy  and timeliness of data used to screen providers and suppliers and to  further strengthen contractor oversight and PECOS data integrity. HHS’s comments are printed in appendix I. HHS  also provided technical comments, which we incorporated as appropriate. At that time, we will send copies to the Secretary of Health  and Human Services, the Administrator of CMS and other interested  parties.
Why GAO Did This Study

According to the Centers for Medicare & Medicaid Services (CMS)the agency within the Department of Health and Human Services (HHS) that administers the Medicare programmore than 1.5 million health providers and suppliers of medical equipment were enrolled in the Medicare program in 2011, and 30,000 more enroll each month. CMS has established Medicare enrollment standards and procedures intended to ensure that only qualified providers and suppliers can enroll. While most providers and suppliers pose a limited risk to the Medicare program, our previous work found persistent weaknesses in CMSs Medicare enrollment standards and procedures that increased the risk of enrolling entities intent on defrauding the program. In 2010, the Patient Protection and Affordable Care Act (PPACA) authorized CMS to implement procedures to strengthen the Medicare enrollment process.
GAO was asked to review CMSs Medicare provider enrollment procedures. In this report, GAO describes (1) how CMS and its contractors use provider and supplier enrollment information to prevent improper payments and factors that may affect the usefulness of this information, and (2) the extent to which CMS has implemented new provider and supplier enrollment screening procedures since the enactment of PPACA. To do so, GAO reviewed relevant regulations and documents, and interviewed officials from CMS and a sample of four of the agencys contractors based on the volume of claims they processed and the status of their contracts with CMS.

What GAO Found

Medicare claims are screened against enrollment information, using automated enrollment-related prepayment edits, in an effort to prevent improper payments to ineligible providers and supplierssuch as those that are no longer active in the Medicare program or are not properly licensed to provide the services for which they have submitted claims. Officials with the contractors we interviewed described the use of several types of prepayment edits to ensure that claims data are valid. For example, verification edits are intended to check the providers National Provider Identifier (NPI), which indicates whether the claim was submitted by an active provider or supplier. However, factors such as the frequency with which contractors have updated provider and supplier enrollment information and limitations of the data used may affect the timeliness and accuracy of data used to screen claimsin turn limiting the ability of the edits to prevent improper payments from occurring. For example, to update information maintained in the Provider Enrollment, Chain and Ownership System (PECOS)CMSs centralized database for Medicare enrollment informationthe contractors have relied on a variety of data sources that vary in the frequency with which they are updated and the ease with which the data can be accessed. We have previously reported concerns about the accuracy of the enrollment information in PECOS and recommended CMS increase its oversight of its contractors provider and supplier enrollment activities. CMS acknowledged these concerns and indicated that the agency is working to address these issues.
Since the enactment of PPACA, CMS has implemented some new provider and supplier enrollment screening procedures and other measures intended to strengthen the existing Medicare enrollment process. New screening procedures include the designation of three different levels of risk of fraud, waste, and abuse, with categories of providers and suppliers assigned to limited, moderate, and high-risk levelsand those in the highest level subject to the most rigorous screening. For example, providers and suppliers in all three risk levels must undergo licensure checks, while those in moderate- and high-risk levels are subject to unannounced site visits. In addition, CMS implemented new application fees for some providers and suppliers. CMS also added two new Medicare contractors, an automated screening contractor and a site visit contractor, to conduct enhanced enrollment screening and site visits. CMS officials said that they expect the new automated screening contractor to identify additional data sources against which to screen, such as financial, tax, and business data sources. CMSs implementation of some additional enrollment screening procedures is still in progress. For example, by the end of 2012, CMS plans to contract with two Federal Bureau of Investigation-approved contractors to conduct fingerprint-based criminal background checks of high-risk providers and suppliers. In addition, the agency plans to extend the requirement for surety bonds to high-risk providers and suppliers beyond those already required of suppliers of durable medical equipment, orthotics and supplies. A surety bond guarantees that if a provider or supplier does not fulfill its obligation to Medicare, CMS can recover its losses via the surety bond.
HHS reviewed a draft of this report and in its written comments noted CMSs ongoing efforts to improve provider and supplier enrollment procedures. HHS also provided technical comments, which were incorporated as appropriate.