Medicare: HCFA to Strengthen Medicare Provider Enrollment Significantly,
but Implementation Behind Schedule (Correspondence, 11/02/2000,
GAO/GAO-01-114R).
One of the first defenses against improper Medicare billings is the
screening of applications from providers seeking to participate in the
program. The Health Care Financing Administration (HCFA) operates and
manages the Medicare program and, with help from insurance companies,
reviews provider applications to determine whether providers meet
Medicare requirements and if there is a reason to suspect that
providers' future Medicare billings would be improper. GAO found that
HCFA's current provider enrollment process does not completely ensure
that dishonest and unqualified providers are prevented from obtaining
Medicare billing privileges. GAO suggests consolidating provider
enrollment tasks with fewer contractors to strengthen HCFA's ability to
oversee these contractors and enhance the efficiency of the enrollment
process. HCFA is implementing several changes to its provider enrollment
processes that may make it more difficult for dishonest providers to
enroll in Medicare; however, delays in implementing these initiatives
will also postpone their benefits.
--------------------------- Indexing Terms -----------------------------
REPORTNUM: GAO-01-114R
TITLE: Medicare: HCFA to Strengthen Medicare Provider Enrollment
Significantly, but Implementation Behind Schedule
DATE: 11/02/2000
SUBJECT: Fraud
Program abuses
Health care programs
Health insurance
Internal controls
Contract oversight
IDENTIFIER: Medicare Program
HCFA Provider Enrollment Chain and Ownership System
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Testimony. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
GAO-01-114R
Provider Enrollment Process United States General Accounting
Office
Washington, DC 20548
November 2, 2000 The Honorable Pete Stark Ranking Minority Member
Subcommittee on Health Committee on Ways and Means House of Representatives
Subject: Medicare: HCFA to Strengthen Medicare Provider Enrollment
Significantly, but Implementation Behind Schedule
Dear Mr. Stark: Medicare has long been the target of fraud and abuse. One of
the first defenses against improper Medicare billings is the screening of
applications from providers to participate in the program. All providers 1
�including physicians, hospitals, suppliers, and others who wish to provide
goods or services to Medicare beneficiaries�must first enroll in the
Medicare program. Denying enrollment to providers who are not qualified, or
who might be suspected to bill the program improperly in the future, can
reduce the risk of fraud and abuse.
The Health Care Financing Administration (HCFA), with the assistance of
approximately 60 insurance companies, operates and manages the Medicare
program. These insurance companies- or contractors- process claims and
assist HCFA in ensuring the program's financial integrity. Their
responsibilities include reviewing provider applications to determine
whether providers meet Medicare requirements and if there is reason to
suspect that providers' future Medicare billings would be improper.
Concerned that HCFA and its contractors should be doing more to identify
dishonest providers before they are enrolled in Medicare, you asked that we
(1) identify weaknesses in HCFA‘ s current enrollment process, (2)
assess HCFA's plans to strengthen this process, and (3) determine whether
HCFA's enrollment of Medicare providers could be better performed by a
smaller number of contractors.
To do this work, we interviewed HCFA officials and reviewed documentation
related to provider enrollment requirements and practices. We interviewed
representatives
1 The Medicare program distinguishes between “providers,”
including hospitals, nursing facilities, and other institutions or agencies,
and “suppliers,” which include physicians, laboratories, and
other sources of medical supplies and services. For simplicity, we will use
the term “providers” to refer to both providers and suppliers of
medical services and supplies.
GAO- 01- 114R Provider Enrollment Process 2 from two of the largest Medicare
contractors responsible for processing provider
enrollment applications to discuss their processing methods. We also
conducted telephone surveys with 10 additional Medicare contractors to
determine the procedures and resources they used to verify provider
enrollment data. Our work was performed between February and September 2000
in accordance with generally accepted government auditing standards.
In summary, we found that HCFA's current provider enrollment process does
not completely ensure that dishonest and unqualified providers are prevented
from obtaining Medicare billing privileges. In some instances, contractors
do not independently verify critical information contained on enrollment
applications or do not perform key verification tasks. Recognizing these
weaknesses, HCFA has initiated improvements. It plans to revalidate provider
enrollment information periodically and expand the criteria used to reject
enrollment applications. It has also developed a new data system that will
help ensure that only qualified providers enroll in Medicare. However, plans
for the data system are behind schedule, and additional delays may slow
implementation further. Finally, HCFA is considering reducing the number of
contractors responsible for enrolling providers in Medicare. We believe that
consolidating provider enrollment tasks with fewer contractors could
strengthen HCFA's ability to oversee these contractors and enhance the
efficiency of the enrollment process. HCFA is in general agreement with our
assessment that more needs to be done to establish standards and improve the
process for provider enrollment.
BACKGROUND Medicare provides health insurance coverage to about 39 million
elderly and disabled Americans. Before 1996, Medicare's provider enrollment
process consisted of contractors' obtaining the names and billing addresses
of applicant providers. In 1996, HCFA introduced its first standard provider
enrollment applications and began collecting more detailed information such
as medical education and practice location on its newly enrolled providers.
However, with the exception of suppliers of durable medical equipment,
prostheses, orthotics, and supplies (DMEPOS), HCFA did not solicit updated
information from providers who had enrolled in the program before 1996.
Consequently, HCFA and its contractors have only limited information for the
estimated 85 percent of Medicare providers who enrolled in the program
before the introduction of the standardized enrollment forms.
HCFA provides general guidance on processing provider enrollments to its
contractors and requires them to review applications for completeness. To
help assess whether applicants are qualified, HCFA requires applicants to
submit certain documentation- such as copies of medical licenses- to its
contractors, who also verify the accuracy of information presented on
providers' applications. In addition, contractors must determine whether
providers are ineligible to receive Medicare reimbursements. Providers may
be excluded from participation in Medicare or other federal programs because
of prior unethical or illegal activities. For example, contractors are
required to compare provider names to those on the Department of Health and
Human Services Office of Inspector General (OIG) list of excluded
GAO- 01- 114R Provider Enrollment Process 3 providers 2 and the General
Services Administration (GSA) debarment list. 3 Excluded
providers cannot enroll in Medicare. Contractors are also expected to
perform additional verification tasks if providers indicate on their
applications that they were previously enrolled in Medicare. In these
instances, HCFA requires that the new contractor processing the enrollment
application contact a provider's prior Medicare contractor to learn more
about the provider's previous billing patterns. This gives HCFA the
opportunity to have overpayments identified and recovered. If a provider has
a history of questionable claims, the provider's enrollment application
might not be denied. However, the provider's new claims may be subjected to
intense scrutiny.
Medicare claims processing contractors, however, do not process the
enrollment of DMEPOS suppliers. Instead, the National Supplier Clearinghouse
(NSC) manages this process and maintains a national database of DMEPOS
provider information. HCFA requires the NSC to contact these providers
periodically to revalidate their enrollment information.
HCFA's CURRENT PROVIDER ENROLLMENT PROCESS DOES NOT ADEQUATELY SCREEN
POTENTIAL PROVIDERS
HCFA and its contractors do not consistently and rigorously verify
information on provider applications. HCFA cannot, therefore, completely
ensure that the integrity of the Medicare program is adequately protected. A
lack of clear guidance has weakened the enrollment process. For example,
HCFA has instructed contractors to validate information on provider
applications, such as practice locations and social security numbers, by
using the “most reliable, readily available, and cost- effective
means.” We found that some contractors contact applicants by telephone
and ask them to confirm verbally the information contained on their
applications. While not costly, this approach does not provide an
independent means of verification.
In addition, contractors do not always complete critical verification tasks.
In 1999, HCFA identified deficiencies in the enrollment activities of 6 of
the 15 contractors evaluated during its routine assessments of contractors'
performance. Specifically, HCFA found that some contractors did not compare
applicant names to the OIG exclusion list. Others had not obtained necessary
documentation to verify that providers had fulfilled mandatory licensing and
education requirements. HCFA also found that one contractor neglected to
investigate the billing histories of providers whose applications indicated
that they had previously enrolled in Medicare.
2 The Office of Inspector General's List of Excluded Individuals/ Entities
provides information on health care providers that are excluded from
participation in Medicare, Medicaid, and other federal health care programs.
These exclusions are based on criminal convictions related to Medicare or
state health programs, patient abuse or neglect, felony convictions related
to controlled substances, or other health care fraud. More than 15,000
individuals and entities are currently excluded from program participation.
3 The U. S. General Services Administration provides information on those
firms and individuals that have been suspended, debarred, or otherwise
excluded from federal procurement and nonprocurement programs because of
illegal or unethical behavior.
GAO- 01- 114R Provider Enrollment Process 4 PROVIDER ENROLLMENT IMPROVEMENTS
FACE SLOW IMPLEMENTATION HCFA officials recognize the existence of
shortcomings in the provider enrollment process and are taking steps to
strengthen the process. However, HCFA's progress in implementing
improvements has been slow, and its plans are not finalized. Given the
uncertainty of these plans, additional delays are likely.
Delays Hinder Enrollment Revalidation and Data Systems Enhancements
To improve the enrollment process, on October 18, 2000, HCFA submitted to
the Office of Management and Budget draft proposed regulations that would
initiate several changes. The cornerstone of these improvements is the
requirement that all Medicare providers periodically review and certify the
accuracy of their enrollment information. This would enable HCFA to ensure
that providers are still eligible to participate in Medicare and to collect
important information on the 85 percent of providers who enrolled before
1996. At present, only DMEPOS suppliers go through periodic revalidation of
their enrollment information. Enclosure I contains the problems and results
of DMEPOS revalidation.
HCFA's revalidation of provider enrollment is behind schedule.
Implementation was originally planned to have begun in 2001, but this will
depend upon the issuance of the provider enrollment regulation and other
actions. In addition, many decisions regarding implementation must be made.
Although HCFA officials recently told us that they have made some
preliminary decisions about conducting the revalidation, additional issues
need to be addressed. For example, in late October 2000, HCFA advised us
that it would use a specialized revalidation contractor to conduct the
initial revalidation cycle, rather than having this work performed by
current contractors. During this process, all currently enrolled providers
that have not completed an enrollment form will be required to do so.
However, the time frame for selecting this specialized contractor and
beginning the revalidation process has not been determined.
HCFA officials told us they would not make final decisions about how to
conduct the revalidation process until they have had an opportunity to
consider anticipated comments on the draft proposed regulations, which may
take until next year. HCFA officials anticipate that the initial
revalidation cycle will be the most challenging because they will be
collecting, reviewing, and verifying data on providers for whom they have
little information on file. Subsequent revalidations will focus on verifying
changes submitted by providers. Given the decisions to be made once the
comments are received, the awarding of the initial revalidation contract,
and the considerable work that will be involved in establishing the process,
it is likely to be some time before the revalidation process is underway.
In addition to revalidating provider enrollments, HCFA's draft proposed
regulations would also expand the criteria for rejecting enrollments. This
provision would give
GAO- 01- 114R Provider Enrollment Process 5 HCFA and its contractors
expanded authority to deny enrollment to applicants with
criminal records and to those who have submitted false information on their
applications. It would impose penalties on providers, such as deactivation
or revocation of Medicare billing privileges, if they do not advise HCFA of
changes to their enrollment information within 30 days of such a change. The
draft proposed regulations would also change the agency's policy regarding
inactive providers and would require contractors to deactivate providers'
billing numbers if they do not bill Medicare within 6 months. This should
help prevent the billing numbers of inactive providers from being obtained
and used by fraudulent entities. Moreover, the draft proposed regulation
gives contractors the authority to deny or revoke enrollment if there are
payment suspensions or overpayments that have not been recouped and no
repayment plan is in place.
Although not part of HCFA's draft proposed regulations, another key
component of its strategy includes development of a new centralized data
storage and retrieval system to help ensure that only qualified providers
enroll in Medicare. The Provider Enrollment, Chain and Ownership System
(PECOS) will contain most of the information collected from provider
enrollment forms 4 and will also facilitate HCFA's planned revalidation
process. PECOS will enable contractors reviewing enrollment applications to
determine if an applicant was previously enrolled in Medicare through
another contractor and to identify all of the applicant's affiliations with
other Medicare enrolled providers. The system will also aid contractor
verification procedures by interfacing with the Social Security
Administration's computer system to confirm the accuracy of numbers
supplied. In addition, HCFA is working toward establishing an interface with
the Internal Revenue Service's computer system as early as January 2002,
which would enable Medicare contractors to verify providers' tax
identification numbers.
Like provider revalidation, HCFA's introduction of PECOS is behind schedule.
Originally, implementation of PECOS was planned to begin February 2000. HCFA
now intends to phase in PECOS gradually between November 2000 and 2003. This
delay may set back HCFA's revalidation plans even further because the
revalidation of providers is dependent upon the implementation of PECOS.
Costly Background Checks Provide Limited Information
Given the threat that fraud and abuse poses to the Medicare program, one
option would be to conduct criminal background checks on providers before
their enrollment in Medicare. HCFA officials told us that these checks have
not been required in the past because they are expensive and provide limited
results. HCFA and contractor officials estimate that these checks could
range from $10 to $100 per individual listed in the application. Because
provider applications may include the names of numerous owners and managing
directors, routinely requiring background checks could become prohibitively
expensive.
4 The National Supplier Clearinghouse has a similar database devoted solely
to the enrollment data submitted by suppliers of durable medical equipment.
GAO- 01- 114R Provider Enrollment Process 6 Despite their expense,
background checks often generate information from public
databases that may be inaccurate or incomplete. Although more extensive
information is available to the law enforcement community, it is typically
not accessible to the contractors who perform these checks for HCFA. Private
companies may also perform background checks, and some may be able to obtain
some criminal conviction records. However, these records must often be
obtained at the county level and require a manual search of courthouse
records.
The contractors we spoke with told us that they rarely, if ever, conduct
background checks. Contractors told us that they could only deny enrollment
if a provider's name appears on the OIG exclusion or GSA debarment lists.
Until recently, HCFA has had limited authority to take action if a criminal
history exists for an applicant. 5 However, the draft proposed regulations
would give HCFA contractors expanded authority to deny enrollment to
providers with criminal histories. HCFA is reconsidering the priority that
Medicare contractors should give to performing background checks if they
suspect a provider is not qualified or eligible to participate in the
program.
CONSOLIDATING PROVIDER ENROLLMENT WITH FEWER CONTRACTORS COULD HOLD PROMISE
HCFA officials told us they are considering concentrating the provider
enrollment function by using fewer contractors. We believe that this
approach holds promise. Consolidation could result in more consistent
application of HCFA's provider enrollment guidance and in more efficient
enrollment processing.
HCFA officials also told us that contractors currently processing a
relatively small number of applications may have only one or two staff who
devote only part of their time to enrollment activities. Staff thus do not
process enough applications to develop expertise in enrollment processing.
They said that consolidation could result in provider enrollment contractors
developing greater expertise in application review and data verification, as
the process would be carried out at fewer sites by more specialized staff.
It could also strengthen HCFA's oversight and simplify program
administration because HCFA would be working with fewer contractors doing
provider enrollment.
HCFA and contractor officials also cited potential drawbacks to
consolidating provider enrollment activities from 60 contractors to a
smaller number. Some noted that, under consolidation, provider enrollment
staff serving a large multistate area might not have as clear an
understanding of varying state education or licensing requirements for
different provider types as current contractors typically serving only one
or a small number of states. Other contractor officials told us that
consolidation would require the few contractors processing enrollments to
coordinate closely with the Medicare contractors that will continue to
process claims.
5 The Balanced Budget Act of 1997 (P. L. 105- 33), amended the Social
Security Act, extended HCFA the authority to deny enrollment to providers
convicted of felonies under federal or state law for offenses which the
Secretary of HHS determines are detrimental to the best interests of the
program or its beneficiaries.
GAO- 01- 114R Provider Enrollment Process 7 If HCFA decides to move forward
with consolidating provider enrollment activities
with a smaller number of contractors, we believe that these problems can be
managed. Provider enrollment staff could be trained in state requirements
for an expanded geographic area. Additionally, the need for Medicare
contractors to coordinate with other contractors is not new. HCFA already
requires Medicare contractors to coordinate with its new program safeguard
contractors, who perform various tasks supporting program integrity,
including fraud detection and conducting site visits to certain types of
providers. 6 Finally, the eventual implementation of PECOS should give both
enrollment contractors and claims processing contractors access to national
enrollment data, reducing the need for these contractors to coordinate data
sharing.
CONCLUSIONS Weaknesses in HCFA's current enrollment provider process have
made Medicare more vulnerable to dishonest providers. To protect the
integrity of Medicare, HCFA and its contractors must have effective
practices for reviewing applicants to verify that they are eligible for
enrollment in the program, as well as the authority to deny enrollment to
those that are not.
HCFA is implementing a number of promising changes to its provider
enrollment processes that may make it more difficult for dishonest providers
to enroll in Medicare. However, delays in implementing these initiatives
will also postpone their benefits. HCFA's draft proposed regulations should
strengthen its guidance to contractors, while giving contractors more
authority to deny enrollment to applicants with criminal histories. Periodic
revalidation of provider enrollment data should be a valuable means of
ensuring that HCFA has current, useful data on active providers and that
providers no longer eligible to participate in Medicare are dropped from the
program. Also, HCFA's plan for a new centralized database of provider
enrollment information could considerably improve Medicare contractors'
ability to screen out questionable applicants. The enrollment process may be
further enhanced if HCFA decides to concentrate responsibility for this
function with fewer contractors.
AGENCY COMMENTS AND OUR EVALUATION We provided HCFA a draft of this letter.
In written comments, HCFA emphasized that it is committed to preventing
unscrupulous providers from participating in Medicare (see enclosure II).
HCFA also agreed with our assessment that more needs to be done to improve
the provider enrollment process. In addition, HCFA's comments addressed two
other issues. First, HCFA highlighted its recent initiatives to improve the
provider enrollment process. Second, HCFA pointed out that our evaluation
did not show or measure the extent that unqualified or illegitimate
providers were denied enrollment in Medicare.
6 The Health Insurance Portability and Accountability Act of 1996 authorized
HCFA to contract with entities other than Medicare carriers and fiscal
intermediaries to perform specific program safeguard functions. Under this
authority, HCFA has awarded contracts to 12 prime contractors to perform
this functions.
GAO- 01- 114R Provider Enrollment Process 8 Concerning its recent
initiatives, HCFA described a number of actions it has taken to
enhance the provider enrollment process. HCFA noted that an important part
of its strategy is the issuance of a rule to institute a process to
revalidate provider enrollment. HCFA stated that the draft proposed rule was
transmitted to OMB on October 18, 2000. HCFA said it is taking steps to
ensure that, once its rule is promulgated, it will be able to implement the
revalidation process immediately. However, HCFA officials have also told us
that many decisions regarding this implementation have not yet been made
because it wants to consider issues raised during the public comment period.
In addition, ongoing delays in implementing PECOS, HCFA's new centralized
data storage and retrieval system, may further hinder implementation of the
revalidation process.
HCFA also noted several other steps it has taken to improve the provider
enrollment process. For example, HCFA said it has strengthened its process
for evaluating contractor performance, revised its provider enrollment
manual, improved its communications with HCFA regional staff, contractors,
and the provider community, designed a new set of provider enrollment forms,
and intensified enrollment procedures for certain types of providers. We
recognize that HCFA has been taking such steps and agree that they have the
potential to strengthen the enrollment process. However, to date, these
efforts have not been fully implemented. While HCFA has designed a new set
of provider enrollment forms, these are not in use and are dependent upon
implementation of the new provider enrollment regulation.
Concerning the issue that we did not measure the number of unqualified or
unscrupulous providers that were denied enrollment, HCFA stated that its
goal is to ensure that providers do not apply because they know they will be
rejected. HCFA indicated that there have been few instances of providers
that should have been denied enrollment in Medicare. We agree that we did
not measure the percentage of providers who were denied enrollment in
Medicare. Instead, we focused on identifying weaknesses in the current
enrollment process, assessing HCFA's plans for improving this process, and
evaluating whether the process could be successfully conducted by a smaller
number of contractors.
HCFA also offered technical comments on the contents of this correspondence,
which we have incorporated as appropriate.
-----
GAO- 01- 114R Provider Enrollment Process 9 Please contact me at (312) 220-
7600 if you or your staff have questions about this
correspondence. Shaunessye D. Curry and Donald Kittler prepared this report
under the direction of Geraldine Redican- Bigott.
Sincerely yours, Leslie G. Aronovitz Director, Health Care�
Program Administration and Integrity Issues Enclosures - 2
GAO- 01- 114R Provider Enrollment Process 10 ENCLOSURE I ENCLOSURE I
REVALIDATION OF DMEPOS PROVIDER ENROLLMENT Suppliers of durable medical
equipment, prosthetics, orthotics, and supplies (DMEPOS) are enrolled in
Medicare by the National Supplier Clearinghouse (NSC), which is administered
by a single Medicare contractor. NSC also conducts a revalidation of DMEPOS
suppliers' enrollment information. Every 3 years, these suppliers are
required to review the information submitted on their original Medicare
application and certify that it is still correct or submit updated
information to NSC.
Revoking billing numbers of unqualified providers prevents them and others
from potentially misusing the numbers to submit fraudulent claims. HCFA's
recent revalidation of DMEPOS suppliers�the only group of providers
currently required to review periodically and certify their Medicare
enrollment information�showed that revalidation helps ensure that only
active and viable providers participate in Medicare. NSC reported revoking
the billing numbers of 1,300 DMEPOS suppliers, out of 21,700 suppliers
subject to the revalidation process between October 1998 and March 2000.
These billing numbers were revoked because the suppliers no longer met one
or more of the requirements necessary to participate in Medicare as a DMEPOS
supplier, such as maintaining a physical facility, complying with regulatory
or local licensing requirements, or having proof of liability insurance.
In the first years that DMEPOS supplier revalidation was performed, NSC
intended to randomly select one- third of the approximately 100,000
suppliers for revalidation in each year. However, NSC's initial selection
process was flawed. Some suppliers that should have been included in the
first year's revalidation process were inadvertently omitted. For fiscal
year 1999, HCFA directed NSC to begin revalidating suppliers based on the
year they originally enrolled in Medicare. However, for many suppliers, NSC
did not possess accurate information and relied on the year 1993 as an
artificial enrollment date, the year that the NSC's database was
established. The result was the selection of more than 60,000 suppliers in 1
year, a number that overwhelmed NSC and created a backlog that is expected
to be eliminated by the end of this year.
GAO- 01- 114R Provider Enrollment Process 11 ENCLOSURE II ENCLOSURE II
COMMENTS FROM THE HEALTH CARE FINANCING ADMINISTRATION
GAO- 01- 114R Provider Enrollment Process 12 ENCLOSURE II ENCLOSURE II
(201028)
*** End of document ***