We identified weaknesses in two of the four screening procedures CMS  implemented to prevent and detect ineligible or potentially fraudulent  providers and suppliers from enrolling in PECOS: the verification of  practice location and of licensure status. CMS’s procedures to screen for  providers and suppliers listed as deceased or excluded from participating  in federal programs or health care–related programs appear to be  working, but we identified a few instances of ineligible or potentially  fraudulent providers and suppliers that we referred to CMS for further  review. On the basis of our additional analysis of the generalizable sample of 496  addresses, we estimate the following:
About 23,400 (22 percent) of the 105,234 addresses that we initially  identified as a CMRA, vacant, or invalid address are potentially  ineligible for Medicare providers and suppliers. This provider was not paid by Medicare from  September 2013 through December 2013 data. However, by being enrolled in PECOS, this provider may be eligible to bill  Medicare in the future. Limitations Exist in Verifying Applicants’ Licensure Information

All physicians applying to enroll in the Medicare program must hold an  active license in the state in which they plan to practice. Further, CMS only requires MACs to verify final  adverse actions that the applicant self-reported on the application. To improve oversight of the provider-license review process, in March  2014 CMS began providing the License Continuous Monitoring (LCM)  report to MACs. Further, the LCM report is limited to only those license numbers used to  enroll into the Medicare program. Some licenses of providers with  multiple medical licenses would not appear in the LCM report because  they were not used to enroll into Medicare. We found that 321 out of about  1.3 million physicians with active PECOS profiles as of March 29, 2013  (the most-current data available at the time of our review) had received  an adverse action from a state medical board related to conduct such as  crimes against persons (e.g., battery, rape, or assault), financial or related  crimes (e.g., extortion, embezzlement, income-tax evasion, or insurance  fraud), and felony crimes outlined in section 1128 of the Social Security  Act (e.g., substance abuse, health-care fraud, or patient abuse) that  resulted in a revocation or suspension of their licenses sometime  between March 29, 2003, and March 29, 2013. Recommendations for Executive Action

To help improve the Medicare provider and supplier enrollment-screening  procedures, we recommend that the Acting Administrator of CMS take the  following three actions:  1.  modify the CMS software integrated into PECOS to include specific  flags to help identify potentially questionable practice location  addresses, such as Commercial Mail Receiving Agency (CMRA),  vacant, and invalid addresses;  2.  revise CMS guidance for verifying practice locations to include, at a  minimum, the requirements contained in CMS’s guidance in place  prior to March 2014 so that MACs conduct additional research,  beyond phone calls to applicants, on the practice location addresses  that are flagged as a CMRA, vacant, or invalid to better ensure that  the address meets CMS’s practice location criteria; and  3.  collect information on all licenses held by providers that enroll in  PECOS by using data sources that contain this information, including  licenses obtained from other states, and expand the License  Continuous Monitoring (LCM) report to include all licenses, and at  least annually review databases, such as that of the Federation of  State Medical Boards (FSMB), to check for disciplinary actions. In its comments, HHS concurred with two of our three recommendations,  but disagreed with the recommendation to revise its guidance. We  continue to believe this action is needed, as discussed below. HHS did not agree with the recommendation to revise its guidance for  verifying practice locations to include, at a minimum, the requirement  contained in CMS’s guidance in place prior to March 2014 so that MACs  conduct additional research, beyond phone calls to applicants, on the  practice location addresses that are flagged as a CMRA, vacant, or  invalid. Without obtaining all licenses from a provider, as we did, CMS  does not have the ability to verify whether all final adverse actions were  reported. Appendix I: Objectives, Scope, and Methodology

GAO was asked to assess Medicare’s provider and supplier enrollment- screening procedures to determine whether the Provider Enrollment,  Chain and Ownership System (PECOS) was vulnerable to fraud. To assess the extent to which CMS’s enrollment-screening procedures  are designed to prevent and detect the enrollment of ineligible or  potentially fraudulent Medicare providers, suppliers, and DMEPOS  suppliers into PECOS, we reviewed CMS procedural manuals and  directives including the Program Integrity Manual that outlines the  procedures that Medicare Administrative Contractors (MAC) and the  National Supplier Clearinghouse (NSC) should use to determine provider  and supplier enrollment eligibility. Of the 321 physicians, 147 were either not revoked from the  Medicare program until months after the adverse action or never  removed.
Why GAO Did This Study

In fiscal year 2014, Medicare paid $554 billion for health care and related services. CMS estimates that $60 billion (about 10 percent) of that total was paid improperly. To establish and maintain Medicare billing privileges, providers and suppliers must be enrolled in a CMS database known as PECOS. About 1.8 million providers and suppliers were in PECOS as of December 2014, according to CMS.
GAO was asked to assess Medicare's provider and supplier enrollment-screening procedures to determine whether PECOS was vulnerable to fraud. This report examines the extent to which CMS's enrollment-screening procedures are designed and implemented to prevent enrollment of ineligible or potentially fraudulent Medicare providers. GAO reviewed relevant documentation, interviewed CMS officials, and contacted the 12 CMS contractors that evaluate provider applications. GAO matched providers and suppliers in PECOS, as of March 2013, to several databases to identify potentially ineligible providers and suppliers, and used 2005–2013 Medicare claims data to verify whether they were paid during this period.

What GAO Found

GAO examined the implementation of four enrollment screening procedures that the Centers for Medicare & Medicaid Services (CMS) uses to prevent and detect ineligible or potentially fraudulent providers and suppliers from enrolling into its Provider Enrollment, Chain and Ownership System (PECOS). Two of CMS's procedures appear to be working to screen for providers and suppliers listed as deceased or excluded from participating in federal programs or health care–related programs. However, GAO identified the following weaknesses in the other two procedures: CMS's verification of provider practice location and physician licensure status.
First, Medicare providers are required to submit the address of the actual practice location from which they offer services. GAO's examination of 2013 data found that about 23,400 of 105,234 (22 percent) of practice location addresses are potentially ineligible. The computer software CMS uses as a method to validate applicants' addresses does not flag potentially ineligible addresses, such as those that are of a Commercial Mail Receiving Agency (such as a UPS store mailbox), vacant, or invalid addresses. In addition, CMS's March 2014 guidance has reduced the amount of independent verification conducted by contractors, thereby increasing the program's vulnerability to potential fraud. For example, the figure below shows a mailbox located within a UPS store that an applicant reported as a practice location, which CMS contractors inaccurately verified as an authentic practice location under CMS's new guidance, which allows contractors to use phone calls as the primary means for verifying provider addresses.
Second, physicians applying to participate in the Medicare program must hold an active license in the state they plan to practice and self-report final adverse actions, such as a suspension or revocation by any state licensing authority. CMS requires its contractors to verify final adverse actions that the applicant self-reported on the application directly with state medical board websites. In March 2014, CMS began providing a report to its Medicare contractors to improve their oversight of physician license reviews. However, the report only includes the medical license numbers providers use to enroll into the Medicare program, but not adverse-action history or other medical licenses a provider may have in other states that were not used to enroll into Medicare. GAO found 147 out of about 1.3 million physicians listed as eligible to bill Medicare who, as of March 2013, had received a final adverse action from a state medical board for crimes against persons, financial crimes, and other types of felonies but were either not revoked from the Medicare program until months after the adverse action or never removed.

What GAO Recommends

GAO recommends that CMS incorporate flags into its software to help identify potentially questionable addresses, revise its 2014 guidance for verifying practice locations, and collect additional license information. The Department of Health and Human Services concurred with two of the three recommendations, but did not agree with the recommendation to revise its guidance. GAO continues to believe the recommendation is valid, as discussed in the report.