MAOs can initiate  contracts with providers at any point during the year and can also  terminate contracts with network providers at any point. For MA Network Adequacy, CMS Uses Robust Travel Time and Distance Criteria; Other Programs Include Provider Availability Standards

Through its network adequacy criteria, CMS requires that MAOs have  enough providers in their networks to ensure that enrollees can access  care within specific travel time and distance maximums. However,  contracting with a certain number and type of providers may not be the  same as true provider availability—measured by appointment wait times,  providers accepting new patients, or how often a provider practices at a  particular location. CMS Established County- Based Time and Distance Criteria for Determining Minimum Number of Providers Constituting an Adequate MA Network

Since 2011, CMS has defined an adequate MAO network as meeting two  criteria: a minimum number of providers and maximum travel time and  distance to those providers. One beneficiary advocacy group we interviewed  described the MA network adequacy criteria as acceptable and  appropriate parameters for the program. In addition, recent health care research we examined  and representatives of medical associations we spoke with have  suggested that provider availability is a key element for measuring access  to care, which most network-based programs have broadly incorporated  into federal standards, state standards, or both. CMS Applies Its Network Adequacy Criteria to Very Few MAO Provider Networks Each Year and Grants Permanent Exceptions to Its Criteria

One of CMS’s key MA oversight responsibilities is to ensure that MAOs  maintain a network of providers sufficient to meet the needs of all their  enrollees. However, CMS limits its annual application of its network  adequacy criteria to only those provider networks in counties that MAOs  propose to enter in the upcoming year—less than 1 percent of all  networks. To facilitate its review of these networks, CMS has established  standardized data collection via an automated system. CMS’s Reviews of MAO Network Adequacy Reach Less than 1 Percent of County-Based Provider Networks Each Year

While CMS has established criteria defining network adequacy, the  agency does not ensure that every network is meeting its current  requirements. For contract years 2013 through 2015, the agency  reviewed over 9,000 proposed networks. Beyond these system- generated reports, CMS does little else to assess the accuracy of the  HSD data that MAOs submit. However, CMS does not check the HSD data against other data sources  to identify inconsistencies and other indications of error. Because a plan’s network providers and enrollees change  from year to year, the lack of regular review means CMS cannot be  assured that MAO networks continue to be adequate, providing sufficient  access for enrollees. CMS Relies on Complaints Reported to the Agency to Identify Network Adequacy Issues Not Disclosed by MAOs

CMS relies on complaints it receives to identify any problems related to  network changes that are not identified through MAO self-disclosure, but  does not routinely review complaints made to MAOs directly or data on  out-of-network service utilization. CMS Has Not Set Information Requirements for Notices MAOs Send to Enrollees Regarding Provider Terminations and Options for Care

CMS requires that MAOs make a good faith effort to give enrollees  advance written notice when a provider contract is terminated, but has not  established information requirements for those notices. Yet, the rules and processes the agency has put in place— which lack certain elements used in other managed care programs and  outlined in federal internal controls—cannot reasonably ensure that MAO  networks continue to meet the needs of MA enrollees. As a result, provider networks may  appear to regulators and beneficiaries as more robust than they actually  are if not all providers are open for business. Unless CMS verifies provider information submitted  by MAOs and periodically requires evidence of compliance, for example  every 3 years, the agency cannot be confident that MAOs are meeting  network adequacy criteria. Also, unlike some beneficiary communication  and plan marketing materials, MAO notification letters are not subject to  any minimum information requirements. Without greater standardization,  the agency cannot ensure that MAO communications are clear, accurate,  and complete, and MA enrollees remain at risk of receiving potentially  confusing information. Recommendations for Executive Action

To improve its oversight of network adequacy in MA, we recommend that  the Administrator of CMS augment MA network adequacy criteria to address provider  verify provider information submitted by MAOs to ensure validity of the  Health Services Delivery data; expand network adequacy reviews by requiring that all MAOs  periodically submit their networks for assessment against current  Medicare requirements; and  set minimum requirements for MAO letters notifying enrollees of  provider terminations and require MAOs to submit sample letters to  CMS for review. HHS concurred with our recommendations.
Why GAO Did This Study

MAOs contract with a network of providers to manage health care delivery to their enrollees. MAOs can initiate or terminate contracts with providers at any time for any reason. Recently, some MAOs have been narrowing their provider networks, prompting concerns about ensuring enrollee access to care and CMS's oversight of MAO compliance with network adequacy criteria.
GAO was asked to review how CMS ensures adequate access to care for MA enrollees. This report examines (1) how CMS defines network adequacy and how its criteria compares with other programs, (2) how and when CMS applies its criteria, (3) the extent to which CMS conducts ongoing monitoring of MAO networks, and (4) how CMS ensures that MAOs inform beneficiaries about terminations. GAO reviewed CMS and other guidance on network adequacy, federal regulations, and standards for internal control. GAO also interviewed CMS officials and representatives of medical associations and beneficiary advocacy groups, and analyzed CMS data on oversight of MAO provider networks for contract years 2013 through 2015.

What GAO Found

The Centers for Medicare & Medicaid Services (CMS) is the agency within the Department of Health and Human Services (HHS) responsible for overseeing the Medicare Advantage (MA) program—Medicare's private plan alternative. Since 2011, CMS has defined an adequate MA provider network as meeting two criteria: a minimum number of providers and maximum travel time and distance to those providers. To reflect local conditions, the requirements are specific to different county types and a range of provider types. However, the MA criteria do not reflect aspects of provider availability, such as how often a provider practices at a given location. In contrast, other network-based health programs use provider availability measures to assess network adequacy. For example, federal Medicaid managed care rules address providers' ability to accept new patients and TRICARE criteria address appointment wait times for active duty servicemembers. Without taking availability into account, as is done in some other programs, MA provider networks may appear to CMS and beneficiaries as more robust than they actually are.
CMS applies its network adequacy criteria narrowly. Rather than assessing all county-based provider networks against its criteria, CMS limits its annual application of the criteria to provider networks in counties that MA organizations (MAO)—private organizations that offer one or more health benefit plans—propose to enter in the upcoming year. From 2013 through 2015, CMS's reviews accounted for less than 1 percent of all networks. To facilitate its review of these networks, CMS has established standardized data collection via an automated system. However, CMS does little to assess the accuracy of the network data in applications MAOs submit, even though the submissions contain the same data elements as in provider directories, which have been shown to be inaccurate in a number of government and private studies. Until CMS takes steps to verify MAO provider information, as outlined in federal internal control standards, the agency cannot be confident that MAOs meet network adequacy criteria.
For established provider networks, CMS does not require MAOs to routinely submit updated network information for review, but may learn of any adequacy issues through its broader oversight of MAOs. CMS recently required that MAOs disclose efforts to significantly narrow provider networks, allowing MAOs to determine when such disclosure is necessary. CMS also relies on complaints it receives to identify any problems related to network changes that are not otherwise identified. However, contrary to internal control standards, CMS does not measure ongoing MAO networks against its current MA criteria. Because a plan's providers may change at any time, CMS cannot be assured that networks continue to be adequate and provide sufficient access for enrollees until the agency collects evidence of compliance on a regular basis.
While CMS requires that MAOs give enrollees advance notice when a provider contract is terminated, the agency has not established information requirements for those notices and does not review sample notices sent to enrollees. This lack of scrutiny appears inconsistent with the agency's oversight of other Medicare beneficiary communications and with internal controls. Without a minimum set of required information elements and a check on adherence to them, the agency cannot ensure that MAO communications are clear, accurate, and consistent.

What GAO Recommends

The Administrator of CMS should augment oversight of MA networks to address provider availability, verify provider information submitted by MAOs, conduct more periodic reviews of MAO network information, and set minimum information requirements for MAO enrollee notification letters. HHS concurred with the recommendations.