Medicare is the largest CMS program, at $702 billion in fiscal year 2017. 1). There are no reliable estimates of the extent of fraud  in the Medicare program, or in the health-care industry as a whole. The Fraud Reduction and Data Analytics Act of 2015, enacted in June  2016, requires OMB to establish guidelines for federal agencies to create  controls to identify and assess fraud risks and design and implement  antifraud control activities. CMS’s Efforts Managing Fraud Risks in Medicare Were Partially Aligned with the Fraud Risk Framework

CMS’s antifraud efforts partially aligned with the Fraud Risk Framework. Consistent with the framework, CMS has demonstrated commitment to  combating fraud by creating a dedicated entity to lead antifraud efforts. CMS has taken some steps to identify fraud risks in  Medicare; however, it has not conducted a fraud risk assessment or  developed a risk-based antifraud strategy for Medicare as defined in the  Fraud Risk Framework. CMS has established monitoring and evaluation  mechanisms for its program-integrity control activities that, if aligned with  a risk-based antifraud strategy, could enhance the effectiveness of fraud  risk management in Medicare. Within CMS, the Center for Program Integrity (CPI) serves as the  dedicated entity for fraud, waste, and abuse issues in Medicare, which is  consistent with the Fraud Risk Framework. Consistent with the Fraud Risk Framework, CMS has promoted  an antifraud culture by, for example, coordinating with internal and  external stakeholders. For example:
Center for Medicare and Medicaid Innovation (CMMI). Center for Medicare (CM). To increase awareness of fraud risks in Medicare, CMS offers and  requires training for stakeholder groups such as providers, beneficiaries,  and health-insurance plans. However, CMS does not offer or require similar fraud-awareness training  for the majority of its workforce. In our December 2017 report, we discussed several examples of steps  CMS has taken to identify fraud risks as well as control activities that  target areas the agency has designated as higher risk within Medicare,  including specific provider types and specific geographic locations. 3). Such a risk assessment would provide  the detailed information and insights needed to create a fraud risk profile,  which, in turn, is the basis for creating an antifraud strategy. In its March 2018 letter to GAO, HHS stated  that it is currently evaluating its options with regards to implementing this  recommendation. As of July 2018, the recommendation remains open. Without  developing  and  documenting  an  antifraud  strategy  based  on  a  fraud  risk  assessment,  as  called  for  in  the  design  and  implement  component of the Fraud Risk Framework, CMS cannot ensure that it has  a  coordinated  approach  to  address  the  range  of  fraud  risks  and  to  appropriately target and allocate resources for the most-significant risks. CMS uses return-on-investment and savings estimates to measure the  effectiveness of its Medicare program-integrity activities and FPS. As CMS takes steps to develop an antifraud strategy, it could include  plans for refining and building on existing methods such as return-on- investment or savings measures, and setting appropriate targets to  evaluate the effectiveness of all of CMS’s antifraud efforts. This  strategy should include an approach for monitoring and evaluation. A Framework for Managing Fraud Risks in Federal Programs.
Why GAO Did This Study

Medicare covered over 58 million people in 2017 and has wide-ranging impact on the health-care sector and the overall U.S. economy. However, the billions of dollars in Medicare outlays as well as program complexity make it susceptible to improper payments, including fraud. Although there are no reliable estimates of fraud in Medicare, in fiscal year 2017 improper payments for Medicare were estimated at about $52 billion. Further, about $1.4 billion was returned to Medicare Trust Funds in fiscal year 2017 as a result of recoveries, fines, and asset forfeitures.
In December 2017, GAO issued a report examining how CMS managed its fraud risks overall and particularly the extent to which its efforts in the Medicare and Medicaid programs aligned with GAO's Framework. This testimony, based on that report, discusses the extent to which CMS's management of fraud risks in Medicare aligns with the Framework. For the report, GAO reviewed CMS policies and interviewed officials and external stakeholders.

What GAO Found

In its December 2017 report, GAO found that the Centers for Medicare & Medicaid Services' (CMS) antifraud efforts for Medicare partially align with GAO's 2015 A Framework for Managing Fraud Risks in Federal Programs (Framework). The Fraud Reduction and Data Analytics Act of 2015 required OMB to incorporate leading practices identified in this Framework in its guidance to agencies on addressing fraud risks.
Consistent with the Framework, GAO determined that CMS had demonstrated commitment to combating fraud by creating a dedicated entity to lead antifraud efforts; the Center for Program Integrity (CPI) serves as this entity for fraud, waste, and abuse issues in Medicare. CMS also promoted an antifraud culture by, for example, coordinating with internal stakeholders to incorporate antifraud features into new program design. To increase awareness of fraud risks in Medicare, CMS offered and required training for stakeholder groups such as providers of medical services, but it did not offer or require similar fraud-awareness training for most of its workforce.
CMS took some steps to identify fraud risks in Medicare; however, it had not conducted a fraud risk assessment or designed and implemented a risk-based antifraud strategy for Medicare as defined in the Framework. CMS identified fraud risks through control activities that target areas the agency designated as higher risk within Medicare, including specific provider types, such as home health agencies. Building on earlier steps and conducting a fraud risk assessment, consistent with the Framework, would provide the detailed information and insights needed to create a fraud risk profile, which, in turn, is the basis for creating an antifraud strategy.
CMS established monitoring and evaluation mechanisms for its program-integrity control activities that, if aligned with an antifraud strategy, could enhance the effectiveness of fraud risk management in Medicare. For example, CMS used return-on-investment and savings estimates to measure the effectiveness of its Medicare program-integrity activities. In developing an antifraud strategy, consistent with the Framework, CMS could include plans for refining and building on existing methods such as return-on-investment, to evaluate the effectiveness of all of its antifraud efforts.

What GAO Recommends

In its December 2017 report, GAO made three recommendations, namely that CMS (1) require and provide fraud-awareness training to its employees; (2) conduct fraud risk assessments; and (3) create an antifraud strategy for Medicare, including an approach for evaluation. The Department of Health and Human Services agreed with these recommendations and reportedly is evaluating options to implement them. Accordingly, the recommendations remain open.