Medicare: Post-Hearing Questions Related to Financial and Information
Technology Management (Correspondence, 12/21/2000, GAO/GAO-01-275R).

This correspondence answers congressional questions about financial and
information technology management of the Medicare Program. Among the
topics discussed are claims processing, management of statistical data,
and computer viruses. For example, in reference to claims processing,
GAO found that, as of December 2000, Medicare carriers and fiscal
intermediaries use six standard claims processing systems to process
Medicare part A and B claims. Each contractor relies on one of these
standard systems to process its claims, and adds its own front-end and
back-end processing systems. These claims processing systems date back
as far as 1982. In reference to the management of statistical data, GAO
found that the Health Care Financing Administration's (HCFA) common
working file provides individual beneficiary claims data to HCFA's
National Claims History File, which is used as the source of statistical
information on Medicare and medical data. HCFA officials were unaware of
any system outside HCFA from which this type of data could be obtained.
Finally, regarding computer viruses, a HCFA information technology
security official told GAO that the "I LOVE YOU" virus did not
contaminate its systems. The official said the virus did not harm any of
the workstations because HCFA's electronic mail application was not
capable of executing the Visual Basic Script file, which is how the "I
LOVE YOU" virus was executed. The official also said that the Melissa
virus was detected and there were no incidents.

--------------------------- Indexing Terms -----------------------------

 REPORTNUM:  GAO-01-275R
     TITLE:  Medicare: Post-Hearing Questions Related to Financial and
	     Information Technology Management
      DATE:  12/21/2000
   SUBJECT:  Health insurance
	     Data collection
	     Information technology
	     Internal controls
	     Reporting requirements
	     Computer security
	     Claims processing
	     Information resources management
	     Medical information systems
	     Computer viruses
IDENTIFIER:  Medicare Program
	     Federal Employees Health Benefits Program
	     Medicare Hospital Insurance Trust Fund
	     Supplementary Medical Insurance Trust Fund
	     Social Security Trust Fund
	     ILOVEYOU Computer Virus
	     Melissa Computer Virus

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Testimony.                                               **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-01-275R

Medicare Post- Hearing Questions

United States General Accounting Office Washington, DC 20548

December 21, 2000 The Honorable Stephen Horn Chairman, Subcommittee on
Government Management,

Information and Technology Committee on Government Reform House of
Representatives

Subject: Medicare: Post- Hearing Questions Related to Financial and
Information Technology Management

Dear Mr. Chairman: On July 11, 2000, we testified before your Subcommittee
on H. R. 4401, the Health Care Infrastructure Investment Act of 2000, which
calls for the establishment of an advanced informational infrastructure to
immediately process certain health benefits claims. 1 In that testimony, we
provided our perspectives on (1) the current Medicare part B claims process,
(2) the development of an immediate claim, administration, payment
resolution, and data collection system and its applications for processing
these claims, (3) the application of this system to the Federal Employees
Health Benefits Program, (4) the role and composition of a proposed Health
Care Infrastructure Commission, and (5) lessons drawn from a failed Health
Care Financing Administration (HCFA) information technology (IT) project in
the mid1990s.

This letter responds to your October 10, 2000 request that we provide
answers to posthearing questions related to our July 11 testimony. In
performing our work, we provided a draft of this letter to HCFA for
technical review. HCFA officials, including those from the Office of
Information Services and the Office of Financial Management, orally provided
technical clarifications, which we incorporated in this letter, as
appropriate. Your questions, along with our responses, follow.

1. Have Medicare trustees considered improvements in information technology
infrastructure that relate to providing accurate epidemiological data and
timely payment to providers? 2. What specific information technology
infrastructure improvements have the

trustees considered? 3. Aside from the MTS [Medicare Transaction System]
failure, what are the trustees

doing to ensure that the IT infrastructure meets the needs of Medicare
beneficiaries and health care providers?

1 Federal Health Care: Comments on H. R. 4401, the Health Care
Infrastructure Investment Act of 2000

(GAO/ T- AIMD- 00- 240, July 11, 2000).

GAO- 01- 275R Medicare Post- Hearing Questions Page 2 The Social Security
Act 2 created the Boards of Trustees for the Medicare Hospital Insurance

and Supplementary Medical Insurance Trust Funds (collectively, the Trustees)
to carry out fiduciary responsibilities for the funds. Thus, the act
requires the Trustees to (1) report to the Congress not later than the first
day of April of each year on the operation and status of the Trust Funds
during the preceding fiscal year and on their expected operation and status
during the current fiscal year and the next 2 fiscal years, (2) report
immediately to the Congress whenever the Trustees are of the opinion that
the amounts of the Trust Funds are unduly small, and (3) review the general
policies for managing the Trust Funds and recommend changes in such
policies, including necessary changes in the provisions of law that govern
the way in which the Trust Funds are to be managed. The act does not assign
the Trustees responsibilities with regard to the operations of the Medicare
program, or specifically to the Medicare IT operations or related
improvement efforts. According to HCFA officials, the Trustees met 10 times
during the 5- year period from 1995 to 1999. The minutes for these meetings
indicate that operational issues, such as the development, design, and
implementation of Medicare IT systems, were not discussed.

As the HCFA Chief Information Officer (CIO) described in testimony before
your Subcommittee, oversight responsibility of HCFA's IT investment and
planning processes rests with the HCFA CIO, working in close conjunction
with the Department of Health and Human Services' (HHS) CIO and other HCFA
senior managers. In his testimony, HCFA's CIO also outlined the agency's
efforts toward developing a comprehensive plan for modernizing its systems
architecture to meet these needs, such as developing innovative ways to
manage data and supporting efforts to improve health outcomes for
beneficiaries.

4. The Board of Trustees has the responsibility of overseeing the successful
operation of Medicare in its entirety; why would it be beneficial to create
a commission specifically to oversee the successful operation of Medicare's
IT processing systems?

As discussed above, the duties of the Trustees do not extend to the
oversight of Medicare's IT processing systems. Nonetheless, the complex,
technical nature of Medicare's IT processing systems warrants continuous,
effective planning and evaluation to ensure their ongoing successful
operation. Determining the most appropriate methods and persons for carrying
out these efforts requires careful consideration. In this regard, as
discussed in our testimony, it is important to consider whether adding
another organization to the already complicated Medicare process would add
to the complexity or confuse accountability for essential planning,
monitoring, and evaluation efforts. Nevertheless, if a separate commission
were to be created to perform these functions, one possible advantage would
be that, unlike the Trustees whose responsibilities focus primarily on long-
term funding issues, the commission could focus solely on this extremely
critical aspect of administering the Medicare program. In addition, although
HCFA devotes significant resources to its IT operations, assigning specific
oversight and monitoring responsibilities to a commission of IT, health
care, and financial management experts could provide for a more robust,
independent evaluation of existing and planned Medicare IT efforts. If such
a commission is created, however, care should be taken in determining its
specific role to avoid unintended

2 Sections 1817( b) and 1841( b) of the Social Security Act, 42 U. S. C. sect.
1395i and sect. 1395t.

GAO- 01- 275R Medicare Post- Hearing Questions Page 3 consequences, such as
confusion over its authority and responsibilities or duplication of

effort.

5. How many claims processing systems exist, and how old are these systems?

As of December 2000, Medicare carriers and fiscal intermediaries use six
standard claims processing systems to process Medicare part A and B claims.
3 Each contractor relies on one of these standard systems to process its
claims, and adds its own front- end and back- end processing systems. Table
1 provides the name of each standard system, the type of Medicare claims it
processes, and the date the system was implemented.

Table 1: HCFA Claims Standard Processing Systems Name of system Type of
Medicare claim

processed Date of implementation

Arkansas Part A Standard System part A

1982 – major upgrade in 1994 Fiscal Intermediary Standard System part
A 1990 Multi- Carrier System part B 1987 Verizon Medicare System part B 1988
HCFA Part B Standard System part B 1987

VIPS Medicare System part B (including durable

medical equipment) 1985 Source: HCFA.

6. Are there processing systems in the health care industry or other
industries that are analogous in design and purpose to the melded processing
systems used by Medicare and its contractors and carriers? If yes, please
specify; if no, please explain how HMOs [health maintenance organizations]
handle the processing issue for multiple contracts. In particular, please
explain how the Federal Employee Health Benefits Program (FEHBP)
successfully offers a wide array of health insurance plans without the
apparent difficulties that exist within the Medicare claims processing
system.

According to the Association For Electronic Health Care Transactions
(AFEHCT), 4 the general structure of claims processing systems in the health
care industry is similar to the claims processing systems used by Medicare
contractors. Namely, in both cases, providers submit claims either directly
or through third- party billing systems to the insurance carrier's system,
which adjudicates the claims and makes payments through other systems, such
as bank systems. According to AFEHCT, processing claims in the private
sector health care industry is complex because a provider has to deal with
many different benefits contracts and

3 HCFA is planning to reduce the number of standard processing systems so
that there will be only one standard processing system for Medicare part A
claims, one for Medicare part B claims, and one for Medicare part B durable
medical equipment claims.

4 AFEHCT is a trade association that addresses technical and policy issues.
Its membership includes health claims clearinghouses, health insurers,
value- added networks, software vendors, health care data processing
companies, practice management companies, data communications systems
operators, and credit card issuers.

GAO- 01- 275R Medicare Post- Hearing Questions Page 4 many different
insurance carriers. In the case of Medicare, a provider deals with only a

limited number of contractors, and traditional Medicare covers the same
standard package of services and requires the same deductibles, coinsurance,
and copayment requirements for all beneficiaries.

In the case of FEHBP, the government does not process claims, instead the
government contracts with private health care organizations that offer
several hundred fee- for- service and health maintenance organization
benefit plans to nearly 9 million federal employees, retirees, spouses, and
dependents. FEHBP administrators negotiate premiums and benefits with
participating health plans, but reimbursing claims is the responsibility of
the health care plan organization.

7. Mr. Sparks testified that in some cases one Medicare carrier covers a
given procedure while another carrier might not cover the identical
procedure at all. How extensive is this problem? Do you have any examples?
If so, what should be done to correct it?

Medicare's coverage decisions are based on broad statutory authority given
to the Secretary of HHS, which requires that payment be made for items or
services that are “reasonable and necessary” for the diagnosis
and treatment provided to Medicare beneficiaries. National coverage
decisions are issued by HCFA after a thorough assessment of the clinical
issues and available data. These decisions are binding on Medicare
contractors. In the absence of national decisions for particular services,
contractors have the discretion to issue local coverage policies.
Specifically, these contractors develop a set of criteria to determine which
claims to pay, guided by laws, regulations, Medicare policy manuals, and
periodic agency directives. This has resulted in different interpretations
of medical necessity in different parts of the country for some services. 5

We have not performed sufficient work to assess the extent to which
variations in local coverage policies among contractors are problematic or
simply reflect the complex nature of administering a nationwide program
across multiple regions, states, and localities. However, our work has
identified specific instances in which different carriers treated similar
claims differently. Specifically, in July 2000 we reported that similar
claims submitted by ambulance providers could receive different treatment
across carriers. 6 To illustrate, in 1998 in New Jersey and Pennsylvania,
where local ordinances mandated advanced life support services as the
minimum standard of care for all transports regardless of the patient's
condition, the carrier reimbursed ambulance providers at that level for all
transports. In contrast, in Fargo, North Dakota, which had a similar local
ordinance, the carrier paid only

5 According to HCFA, there are legitimate regional differences in the
practice of medicine that can make a national rule inappropriate. 6 Rural
Ambulances: Medicare Fee Schedule Payments Could Be Better Targeted (GAO/
HEHS- 00- 115, July 17, 2000).

GAO- 01- 275R Medicare Post- Hearing Questions Page 5 for basic life support
when the patient's condition did not require advanced life support. 7

In late 1998, HCFA established a new mechanism, the Medicare Coverage
Advisory Committee, to provide for public participation in the process of
establishing national coverage decisions. HCFA has issued a number of new
medical policy decisions, based upon this new mechanism, and posts these
policies on its web site. In the absence of national decisions for
particular services, however, Medicare contractors continue to have the
discretion to issue local coverage policies.

8. Why does Medicare still use more than one format for submitting
electronic claims?

According to a HCFA official, HCFA implemented a standard electronic format
for part A claims in 1983 and 1984 and for Medicare part B claims in 1991.
The American National Standards Institute (ANSI) 8 subsequently published an
electronic national health care standard, and HCFA directed its carriers and
fiscal intermediaries to accept claims in this format as well as in the HCFA
format. However, according to a HCFA official, most providers continued to
use the HCFA format only, because they were more familiar with it and/ or
they did not want to incur the cost of upgrading their claims submission
software.

By October 2002, providers will be required to use a single electronic
format to submit health care claims. The Health Insurance Portability and
Accountability Act of 1996 requires the Secretary of HHS to adopt standards
for financial and administrative transactions, and data elements for those
transactions, to enable health information to be exchanged electronically.
In August 2000, HHS promulgated the electronic health care claims standard
called for by this law. The health care industry, including HCFA, is
required to implement this standard, which largely follows the current ANSI
health care claim standard, by the October 2002 deadline.

9. In the case of a rejected claim, at what point does the waste, fraud, and
abuse statute come into effect?

The False Claims Act 9 is the federal government's primary civil remedy for
improper or fraudulent claims. It applies to all federal programs, from
military procurement contracts to health care and welfare benefits. People
who “knowingly” submit false claims to the federal government
may be found liable under the act for penalties of between $5,000 and
$10,000 for each false claim, plus up to three times the amount of the
damages caused to the federal program. The act defines
“knowingly” to mean that a person (1) has actual knowledge of
the

7 On June 17, 1997, HCFA published a notice of proposed rule- making that
would, among other issues, define as national policy that ambulance payment
be linked to the level of services to treat the beneficiary's condition.
Because a new ambulance fee schedule was to be negotiated that would define
future ambulance payment amounts, HCFA delayed implementation of that
policy, but intends to issue a final rule on it shortly.

8 ANSI serves as administrator and coordinator of the United States private
sector voluntary standardization system. ANSI does not develop American
National Standards; instead it facilitates their development by establishing
a consensus among qualified groups. The Institute represents the interests
of about 1, 000 company, organization, government agency, institutional, and
international members.

9 31 U. S. C. sec 3729( a) to 3733.

GAO- 01- 275R Medicare Post- Hearing Questions Page 6 false claim, (2) acts
in deliberate ignorance of the truth or falsity of the information, or

(3) acts in reckless disregard of the truth or falsity of the information.
Even if the government rejected a claim, a violation of the act may have
occurred at the point that the false claim was presented. As with most other
civil actions, the government can establish its case by presenting a
preponderance of the evidence rather than by meeting the higher burden of
proof that applies in criminal cases. The act has been applied to cases of
improper billing practices, claims for services not rendered, billing of
medically unnecessary services, misrepresenting eligibility or credentials,
and substandard quality of care.

Although less commonly used in this context, the Civil Monetary Penalties
Law and the Program Fraud Civil Remedies Act also provide civil and
administrative sanctions against the submission of false claims under
Medicare, as well as other programs. Both of these laws prohibit the
presentation of false claims and do not require payment by the government
for sanctions to be imposed.

10. Does the complexity of the processing system contribute to the
difficulty providers experience in getting claims paid? Does the complexity
of the system contribute to the difficulty providers have in submitting
clean claims?

According to HCFA data on claims processed during fiscal year 1999, about 81
percent of Medicare part A and part B claims processed were paid and, of
those paid, over 99 percent were processed as “clean” claims. 10
Clean claims were paid on average within 17 days. Much of this time is due
to the mandatory claim payment delay provisions contained in the Social
Security Act, which prohibits the payment of Medicare claims until after 13
calendar days from the date received if electronically submitted or until
after 26 calendar days if manually submitted. 11 A HCFA official estimated
that, on average, clean part A and part B claims could be processed and paid
or rejected within 3 to 5 business days after the receipt date without this
mandatory payment delay.

We could not determine the extent to which the complexity of Medicare's
claims processing systems contributes to claims being denied. However,
HCFA's analysis of part B denied claims indicates that other problems can
cause such claims to be denied. For example, according to HCFA data, over 70
percent of denied part B claims in fiscal year 1999 were attributed to
duplicate claims, claims for services that are not medically necessary or
covered by Medicare, and incomplete claims. Furthermore, based on our review
of claims data for ambulance services provided in calendar year 1998, rates
of payment denial varied widely among carriers. 12 We concluded that
different practices among carriers, including increased attention to
potential fraud, differences in local coverage policies, contractors'
inappropriate

10 In obtaining performance information from its contractors, HCFA defines a
clean claim as one that did not require the contractor to investigate or
develop outside the contractor's Medicare operation (e. g., requesting
additional information from providers) on a prepayment basis.

11 Sections 1816( c)( 3) and 1842( c)( 3) of the Social Security Act (42 U.
S. C. 1395h( c)( 3) and 1395u( c)( 3)). 12 GAO/ HEHS- 00- 115, July 17,
2000.

GAO- 01- 275R Medicare Post- Hearing Questions Page 7 application of
Medicare criteria, and providers' lack of information about how to fill out

claims, contribute to variations among their rates of denied claims.

11. Is the coding system difficult to use? Please rate the complexity of
Level I codes versus Level II codes versus Level III codes. Does the
“carrier discretion” allowed for Level II codes cause unequal
treatment of claims by different carriers? How often do the code systems for
medical procedures change? Why do the codes change on this schedule? Who
makes the final decision to change or not change the codes?

As described in our July 11, 2000, testimony, HCFA's Common Procedure Coding
System uses three levels of codes:

ï¿½ Level I codes are the American Medical Association's Physician's Current
Procedural Terminology, which consists of a list of 5- digit codes for most
of the services performed by physicians. These codes are used to bill for
most procedures and services but have limited selections for describing
supplies, materials, and injections.

ï¿½ Level II are HCFA national codes that supplement the level I codes and are
used to bill for a range of services and supplies, such as vision services
and surgical supplies. These codes have a uniform description nationwide,
but due to what is known as “carrier discretion,” their
processing and reimbursement are not necessarily uniform.

ï¿½ Level III are local codes developed by individual Medicare carriers. The
codes are often used to describe new services, supplies, and materials
(which may be included as level I or II codes in future years), as well as
to report procedures and services that have been deleted from Current
Procedural Terminology codes but are still recognized and reimbursed by the
carrier.

Reflecting the complexities of, and variations in, providing the multitude
of health care services to Medicare beneficiaries, the coding system is
inherently difficult to use because it (1) attempts to identify codes for
all accepted medical procedures, including codes to describe minor
procedures that are components of more comprehensive procedures, and (2)
changes every year to reflect refinements or advances in technologies and
practices.

Regarding the comparative complexity of the different code levels and the
extent of the use of “carrier discretion,” we have not performed
work to address these questions. However, conducting such reviews could
provide insights into the fundamental characteristics associated with how
medical treatment codes and coding systems are established, revised,
implemented, and monitored.

12. What is the status of HCFA's effort to reduce its four standard Medicare
part B systems to two? Will HCFA meet its 2003 deadline?

As previously discussed, carriers currently use one of four standard systems
to process Medicare part B claims. Of the four systems, HCFA selected the
Multi- Carrier System to serve as the standard part B claims processing
system for nondurable medical equipment claims. HCFA had placed a moratorium
on this transition effort because of the Year 2000

GAO- 01- 275R Medicare Post- Hearing Questions Page 8 problem. Since this
problem has been addressed, HCFA's transition of carriers using the

Verizon standard system to the Multi- Carrier System has begun and is due to
be completed by February 2002. The carriers that use the other two standard
part B systems are currently due to transition to the Multi- Carrier System
by August 2003 and March 2004, respectively. However, according to HCFA,
funding issues may cause delays in transitioning these two systems. With
respect to part B claims for durable medical equipment, in 1998, HCFA
transitioned all durable medical equipment regional carriers systems to a
single standard system (VIPS Medicare System). 13

13. Was the MTS system mandated by Congress? Who received the $80 million
for the work that was done? Who had direct oversight responsibility for the
work?

MTS was not specifically mandated by law, although HCFA provided
Congressional staff with information on the status of the initiative. MTS
was HCFA's vision for a single, unified system to replace its existing
standard systems. This single system would have integrated data from
Medicare part A and part B and managed care and provided a comprehensive
view of billing practices. The goals of MTS were to protect program funds
from waste, fraud, and abuse; allow better oversight of Medicare contractor
operations; improve service to beneficiaries and providers; and reduce
administrative expenses. Primary oversight for MTS rested with the Director
of HCFA's Bureau of Program Operations. In HCFA's last reorganization, this
position was abolished.

HCFA terminated the primary MTS contract in August l997. In September l997,
we reported that, at that time, HCFA had spent about $80 million--$ 50
million for software development and $30 million for internal HCFA costs.
Table 2 provides the most recent reported information on what HFCA has paid
thus far to MTS contractors.

Table 2: HCFA Payments to MTS Contractors as of Early November 2000
Contractor Type of work performed Amount paid

Verizon (formerly GTE) Design, develop, and implement system $48,611,360
Coopers & Lybrand

Plan, track, monitor, control and report progress 795,433 SETA Corporation
Independent testing support 1, 141,049 Averstar (formerly Intermetrics)
Independent validation and verification 3,866,140

Total $54,413,982

Source: Health Care Financing Administration, Office of Internal Customer
Support, Acquisition and Grants Group. These amounts were not verified by
GAO.

The SETA Corporation contract amount is final. The other contracts are still
open, so these amounts may change. For example, in May 1998 Verizon
submitted to HCFA a proposal to close out the contract, which stated its
final cost as $51,216,433. As of mid- December 2000, HCFA had not agreed on
the final cost included in this proposal. According to a HCFA

13 The part of the VIPS Medicare System used to process part B claims other
than durable medical equipment claims will not be used once the transition
to the Multi- Carrier System is completed. When the standard system
transitions are completed, HCFA expects to have one standard processing
system for Medicare part A claims, one for Medicare part B claims, and one
for Medicare part B durable medical equipment claims.

GAO- 01- 275R Medicare Post- Hearing Questions Page 9 contracting official,
HCFA recently received requested documentation supporting the

proposal amounts from Verizon and plans to begin final negotiations shortly.

14. Is HCFA able to divine medical data from the Common Working File (CWF)?
Does a system exist outside of HCFA that allows the divining of statistical
data?

Medicare carriers and fiscal intermediaries systems' interface with HCFA's
CWF- a set of nine databases containing beneficiary information for specific
geographic regions- to authorize claims payments and determine beneficiary
eligibility. CWF maintains beneficiary information, such as entitlement and
utilization data and specific claims history that includes medical data. 14
The medical data maintained in CWF are used in editing claims, for example,
to determine whether a claim is a duplicate. According to HCFA, CWF data are
not organized to support statistical analysis.

CWF provides individual beneficiary claims data to HCFA's National Claims
History file, which is used as the source of statistical information on
Medicare medical data. HCFA officials were not aware of any system outside
HCFA where this type of data could be obtained.

15. Are the options available to FEHBP subscribers more or less complex than
the beneficiary options in the Medicare program?

Traditional Medicare covers the same standard package of services and has
the same deductibles, coinsurance, and copayment requirements for all
beneficiaries although it has two distinct parts (part A and part B) that
cover complementary sets of benefits. Medicare managed care providers must
cover at least the same services as traditional Medicare. Many Medicare
managed care providers offer additional benefits, such as prescription
drugs. In contrast, FEHBP does not require uniform benefits. Although all
plans offer inpatient hospital and outpatient medical coverage as well as
certain services required by the Office of Personnel Management, specific
benefits vary. As a result, coverage can vary substantially depending on the
plan.

16. Would it be feasible to replace the existing Medicare program with a
FEHBP- style of insurance program?

The two defining elements of an FEHBP- type premium support system are the
establishment of premium levels for plans through negotiations between the
program and plans and the linking of beneficiaries' contributions to the
premiums of the plans they join. In May l999, we testified on a report by
the National Bipartisan Commission on the Future of Medicare that discussed
incorporating Medicare as another plan under the FEHBP- type premium support
system. 15 Under this scenario, traditional Medicare would propose and
negotiate

14 Certain claims data are periodically purged from CWF. Requirements to
purge CWF data vary by type of claim. For example, outpatient, durable
medical equipment, prosthetics, and physician claims are normally purged
every six months. Inpatient, hospice, and home health claims are not purged.
According to HCFA, it approves all purge requests.

15 Medicare: Options for Reform (GAO/ T- HEHS- 99- 130, May 26, 1999).

GAO- 01- 275R Medicare Post- Hearing Questions Page 10 premiums like any
other plan and would be expected to be self- financing and self- sustaining.

Recognizing the challenge the latter requirement creates, the commission
would also provide traditional Medicare more flexibility to manage costs
using tools similar to those proposed for fee- for- service modernization.
16

Incorporating traditional Medicare as another plan in an FEHPB- type premium
support system would put all plans on an equal footing and maximize
beneficiary awareness of costs. However, the sheer size of the traditional
Medicare program would create questions, including those concerning plan
flexibility and fund solvency. Moreover, it would be necessary to address
the dilemma of how to guarantee traditional Medicare's solvency in the
context of an FEHBP- type premium support system.

An FEHBP- type premium support system increases the importance of effective
program management and design. In particular, the ability to adjust premiums
based on risk to reflect variation in the health status of beneficiaries
joining different plans becomes paramount. Participating plans that attract
a disproportionate number of more seriously ill and costly beneficiaries
would be at a competitive disadvantage if their premium revenues were not
adjusted adequately. In turn, enrollees in those plans may find services
compromised by the plans' financial situation. Inadequate risk adjustment
may be a particular problem for the traditional Medicare plan, which may
function as a refuge for many chronically ill persons who find selecting
among plans challenging and opt for something familiar.

Another serious management and design issue for a premium support system
would be how to adjust for differences in local medical prices and
geographic differences in the use of services. Without such adjustments,
beneficiary premiums in high- price areas will tend to be above the national
average. Adjusting the government contributions for input price differences
can help ensure fair price compensation between local and national plans and
avoid having beneficiaries pay a higher premium or higher share of a premium
simply because they live in a high- price area. Similarly, because use of
medical services varies dramatically among communities due to local medical
practices, under a premium support approach plan, premiums in high- use
areas will likely exceed the national average. Whether, or to what extent,
to adjust the government contribution for this outcome is a matter of policy
choice. Without an adjustment, beneficiaries living in high- use areas who
join local private plans could face substantial out- of- pocket costs.
Consequently, private plans in such areas might have difficulty competing
with a traditional Medicare plan that charged a fixed national premium.

17. Mr. Willemssen's testimony states that the Medicare Trust Fund earns 7
percent interest on Medicare funds that are held in the Treasury. How does
that rate compare to the rate of interest earned by the Social Security
Trust Fund?

16 Proposals to modernize fee- for- service Medicare aim at providing HCFA
flexibility to take advantage of market prices and introduce some management
of service utilization. This concept was tested under HCFA's Centers for
Excellence demonstrations, in which hospitals and physicians agreed to
provide certain procedures for negotiated all- inclusive fees.

GAO- 01- 275R Medicare Post- Hearing Questions Page 11 As the Managing
Trustee of each fund, the Secretary of the Treasury sets the interest rate
on

investments held in the Social Security trust funds (the Federal Old- Age
and Survivors Insurance and Federal Disability Insurance Trust Funds) and
the Hospital Insurance and Supplementary Medical Insurance Trust Funds.
Generally, the Secretary is required by law to set the interest rate at a
rate equal to the average market yield for the preceding month on all
marketable interest- bearing obligations of the United States then
outstanding that are not due or callable within 4 years. The maturities of
the obligations are determined by the Secretary with due regard for the
needs of each fund. Accordingly, although interest rates are established
consistently for these trust funds, the Secretary's discretion as to
determining the needs of each fund as well as the amounts available to
invest may result in variations in the amount of investments held at various
interest rates.

The interest rate on investments held in the Federal Old- Age and Survivors
Insurance and Hospital Insurance Trust Funds, as of September 30, 1999,
ranged from 5.875 to 10.375 percent per annum. The interest rate on
investments held in the Federal Disability Insurance and Supplementary
Medical Insurance Trust Funds, as of September 30, 1999, ranged from 5.875
to 8.75 percent per annum. The combined weighted average annual interest
rates for the Social Security and Medicare trust fund investments held, as
of September 30, 1999, were 6.78 and 7.17 percent, respectively. Differences
in these weighted average annual interest rates reflect the variation in the
relative proportions of investments held in each trust fund as of September
30, 1999, at the various rates of interest within the ranges indicated
above.

18. Did the recent I LOVE YOU, Melissa, etc., viruses get into HCFA's
computers?

In May 2000, we testified on the impact of the “ILOVEYOU” virus
on federal agencies. 17 This virus was the latest in a series of Internet-
based episodes that had caused serious disruptions to computer- based
operations at both private businesses and government agencies. We testified
that HHS was inundated with about 3 million malicious messages. The
departmental components experienced disruptions in e- mail service ranging
from a few hours to as many as 6 days, and departmentwide e- mail
communication capability was not fully restored until after May 9.

With respect to HCFA, an IT security official told us that the
“ILOVEYOU” virus did not contaminate its systems. The official
said the virus had no adverse effects on any of the workstations, because
the e- mail application used at HCFA was not capable of executing the Visual
Basic Script file, which is how the “ILOVEYOU” virus was
executed. 18 The official also said that the Melissa virus was detected and
there were no incidents.

17 Information Security: “ILOVEYOU” Computer Virus Emphasizes
Critical Need for Agency and Governmentwide Improvements (GAO/ AIMD- 00-
171, May 10, 2000) and Critical Infrastructure Protection:
“ILOVEYOU” Computer Virus Highlights Need for Improved Alert and
Coordination Capabilities (GAO/ TAIMD- 00- 181, May 18, 2000).

18 Visual Basic Script is a subset of Microsoft's Visual Basic program
language intended for use in World Wide Web browsers and certain other
applications.

GAO- 01- 275R Medicare Post- Hearing Questions Page 12

19. Have there been many unauthorized releases of personal medical
information from HCFA's computers? Are such releases against the law? Were
any such releases prosecuted?

Unauthorized releases of personal medical data are normally identified as a
result of complaints or other activities that raise questions leading to an
investigation of whether an improper release of information has occurred.
Since some unauthorized releases may have occurred that have not led to
complaints or raised such questions, the extent of this problem is unknown.

Unauthorized releases of personally identifiable health information by
federal agencies or their employees are a violation of the Privacy Act of
1974. HCFA officials clarified, however, that secondary releases 19 are not
punishable under the Privacy Act unless such acts are committed under false
pretenses. State laws also protect the privacy of certain personally
identifiable medical information, but these laws vary significantly in their
scope and the specific protections they afford.

Recognizing the need to prevent unauthorized releases of medical
information, the Congress passed the Health Insurance Portability and
Accountability Act of 1996, which called for the establishment of a uniform
set of protections that all users of confidential medical information must
abide by and for substantial fines and up to 10 years in prison for the
misuse or improper disclosure of identifiable health information. On
December 20, HHS issued the final privacy regulation called for by this act,
which will become fully effective in 2 years. The regulation (1) limits the
non- consensual release and use of identifiable private health information,
(2) gives patients new rights to access their medical records and to know
who has accessed them, (3) restricts disclosures of health information, (4)
establishes criminal and civil sanctions for improper use or disclosure, and
(5) establishes new requirements for access to records by researchers and
others.

HCFA officials recently told us that there have been no prosecutions for
unauthorized releases of personal medical information from HCFA's computers.
Further, HCFA officials told us that their investigations of known cases
have found no secondary releases involving false pretenses. Rather, HCFA
found that secondary releases of data had resulted from misunderstandings of
permissible disclosures.

In July 1999, we reported 20 that HCFA's policies and practices regarding
disclosure of personally identifiable health information were generally
consistent with the provisions of the Privacy Act and that there had been
few complaints about Privacy Act violations concerning personal medical
information. However, we concluded that weaknesses in the implementation of
HCFA's policies could potentially compromise the confidentiality of health
information on Medicare beneficiaries. Further, because HCFA did not
routinely monitor contractors and others, such as researchers, who use
personally identifiable Medicare

19 Secondary releases refer to instances in which persons not employed by
the federal government who are authorized to have data under a HCFA
agreement misuse or re- release such data. 20 Medicare: Improvements Needed
to Enhance Protection of Confidential Health Information (GAO/ HEHS- 99-
140, July 20, 1999).

GAO- 01- 275R Medicare Post- Hearing Questions Page 13 information, its
ability to prevent unauthorized disclosures or uses and to provide timely

corrective action for those that might occur was not assured. HHS' Office of
the Inspector General continues to report vulnerabilities in HCFA's and its
contractors' management of electronic information that could lead to
unauthorized individuals reading, disclosing, or tampering with confidential
information. Further, HHS acknowledged Medicare electronic data processing
control weaknesses in its fiscal year 1999 Accountability and Federal
Managers' Financial Integrity Act Reports and outlined plans to correct
these weaknesses during fiscal year 2000. Results from reviews of Medicare
systems performed in conjunction with the audit of HCFA's fiscal year 2000
financial statements currently under way will provide insights regarding the
extent to which these weaknesses have been addressed.

20. In your testimony, you mentioned that removing the 14- day mandatory
delay in Medicare reimbursements would result in an ongoing cost to the U.
S. Treasury. Dr. Christoph, however, contended that removing the mandatory
delay in payments would create a substantial "one- time" charge to the
Treasury. Please explain the basis for your conclusion.

Eliminating the mandatory payment delays would lead to a reduction in trust
fund balances resulting from (1) the one- time liquidation of trust fund
investments to facilitate the transition to a new “no payment
delay” environment and (2) an ongoing reduction in interest earnings
due to the reduced level of funds available for investment that would result
from this transition. Because the balance of trust fund investments would
remain at this reduced level, future earnings would be correspondingly
reduced. The ongoing nature of this cost represents the amount of interest
lost on those investments that continue to be no longer available to earn
interest. This cost would continue in perpetuity as long as payments were
not being retained to meet a mandatory delay.

21. The "payment floor" or "payment legs" were established by OBRA [Omnibus
Budget Reconciliation Act] 1987, and amended by OBRA of 1993. Looking back
through Senate Finance Committee hearing testimony, committee discussions
and the committee reports regarding the purpose of the legs, at no point was
"fraud prevention" or "prepayment medical review" or any such concept
discussed as motivation for implementation. While there was some discussion
between Dr. Desmarais and Senator Proxmire of moving to standards
established by the Prompt Payments Act, in the end, the legs were
implemented as a budgetary consideration to "save" the government money. The
savings amounted to approximately $323 million in FY 1988. So, if we
repealed the payment legs, how fast could HCFA pay clean claims (assuming
time for edits, batch processing, etc.)? How about all claims? In other
words, what would be the self- imposed payment floors? If we were to amend
the payment legs gradually over the course of the legislation as the
infrastructure was gradually improved/ put into place, what recommendations
would you make? Would [it] be helpful to use the 5-, 7- and 10- year
timetable that the bill lays out already for claims processing.

GAO- 01- 275R Medicare Post- Hearing Questions Page 14 A HCFA official
estimates that, given current operational processes, on average, clean part
A

and part B claims would be processed and paid or rejected within 3 to 5
business days of the receipt date if the mandatory payment delays were
eliminated. Further, this official estimates that, on average, all claims
(which include clean and other paid claims and denied claims) would be
processed within 10 business days if the mandatory payment delays were
eliminated.

Because of the significant volume and dollar value of Medicare claim
payments, a decision to change the current provisions establishing a
mandatory delay of claim payments should involve a careful evaluation of the
potential costs associated with such a change. Two significant factors to
consider, as described in our testimony, are (1) direct costs (such as lost
interest earnings) and (2) possibly more importantly the risk of losses in
the form of improper payments that may occur due to a reduction in time for
performing program safeguard activities. 21 In addition, further evaluation
should be performed to consider other possible costs and risks of amending
current claim payment delay provisions; if such amendments are made, various
implementation and monitoring alternatives should be carefully considered.
For example, since risks of improper payments may vary among various types
of claims and providers, efforts to pay claims more quickly may need to be
coordinated with efforts to strengthen program safeguards. In addition,
conducting pilot tests at selected contractors or for selected types of
claims could provide useful insights and a basis for more effective
evaluation and implementation, including the most appropriate timetable for
implementing changes.

22. Senator Lugar spoke in his testimony about "spurring private sector
investment" and "creating a system of systems" similar to ATM networks. Can
you comment on that briefly from your perspective? I am interested also to
hear what you think about the role of private companies, such as RealMed or
SpiderMed. Com.

As we noted in July 2000, 22 the Automated Teller Machine (ATM) network is
indeed a “system of systems” in which multiple computer systems
owned by card- issuing banks, ATM owners, ATM networks, and third- party
processors work together over a network to allow customers to withdraw cash
from their accounts. Most cardholders conduct transactions at terminals
owned by their card- issuing bank (referred to as on- us transactions).

When the cardholder requests the transaction, the terminal driving processor
transmits the message through the bank's network to the authorization
processor. The authorization processor checks the cardholder's account and
concurrently provides authorization and settlement of the transaction. The
authorization message is then transmitted to the ATM.

The transaction flow is a bit more complicated when a cardholder performs an
electronic fund transfer at an ATM that is not owned by the card- issuing
bank (referred to as a foreign ATM transaction). The cardholder requests the
transaction, and the terminal driving

21 Our recent report, Financial Management: Billions in Improper Payments
Continue to Require Attention

(GAO- 01- 44, October 27, 2000), highlights the risks associated with
expediting payments and the importance of strengthening controls and
implementing state- of- the- art information management systems.

22 Automated Teller Machines: Issues Related to Real- time Fee Disclosure
(GAO/ GGD/ AIMD- 00- 224, July 11, 2000).

GAO- 01- 275R Medicare Post- Hearing Questions Page 15 processor routes the
message through the ATM owner's network to a regional or national

network. The message is then routed through the internal network of the
cardholder's bank to the authorization processor. The authorization
processor checks the cardholder's account, authorizes the transaction, and
provides settlement of the account. The authorization message is then
transmitted to the ATM via the bank's network, a regional or national
network, the owner's network, and the terminal driving processor.

The kind of processing that an ATM network performs is simpler than medical
claims processing. ATM processing involves relatively simple business rules
such as checking account balances and authorizing payment. In contrast,
medical claims processing requires addressing, for example, a claimant's
eligibility, benefits, deductibles, and copayments, and the consistency of
the claim with the patient's past history, age, or gender.

As we testified in July, although it might be feasible to develop an
immediate claim, administration, payment resolution, and data collection
system to be used by the Medicare part B program, such a system would
significantly change the government's current processes, because it would
require the real- time processing of certain elements of the claims process
that are currently performed in batch mode or manually. 23 In the abstract,
a real- time Medicare part B claims process could be achievable if
appropriate systems development policies and techniques are used. Although
more beneficiaries might have to pay their copayments immediately, such a
process could provide health care providers and beneficiaries with several
benefits- primarily the immediate notification of approved or denied claims.
However, without appropriate safeguards, a real- time claims processing
system could involve serious risks, because it opens the process to a
possible rise in the number of improper Medicare payments. 24 Accordingly,
any real- time processing system would have to ensure that current program
safeguards are not compromised, which could be problematic since some of
these safeguards hinge on manual reviews performed by claims examiners. In
addition, the technical and cost risks associated with developing a real-
time claims processing system could be considerable.

With respect to the question related to the private sector, private
companies play a large role in various aspects of medical practice. For
example, private companies provide systems that physicians use to manage
their day- to- day activities by doing paperless transactions, such as
checking eligibility and referral authorizations, referring patients to
specialists, and sending secure electronic prescriptions. The private sector
also plays a major role in the Medicare program. For example, title XVIII of
the Social Security Act required HCFA to contract with the private sector
for claims processing and payment functions. This requirement has led to a
large contractor network comprised of insurance companies responsible for
processing Medicare claims in given states.

---- 23 Real- time mode relates to processing that responds to an external
event within a short and predictable time frame. Batch mode relates to
processing application programs and their data individually, with one being
completed before the next is started.

24 HHS' Office of the Inspector General estimated improper Medicare fee-
for- service payments at $13.5 billion for fiscal year 1999.

GAO- 01- 275R Medicare Post- Hearing Questions Page 16 We are sending copies
of this letter to Senator Richard Lugar and to Representatives Jim

Turner and Douglas Ose, Ranking Minority Member and Member, respectively, of
the Subcommittee on Government Management, Information, and Technology,
Committee on Government Reform. This letter is also available on GAO's home
page at

http:// www. gao. gov.

If you or your staff have any questions regarding this letter, you can
contact Joel Willemssen at (202) 512- 6253 or by e- mail at willemssenj@
gao. govor Gloria Jarmon at (202) 512- 4476 or by e- mail at jarmong@ gao.
gov. Staff who assisted in gathering this information include Aditi Archer,
Nabajyoti Barkakati, Johnny Clark, Kay Daly, James Douglas, James Kernen,
Linda Lambert, and Cynthia Scott.

Sincerely yours, Joel C. Willemssen Managing Director, Information
Technology Issues

Gloria L. Jarmon Managing Director, External Liaison

(310401)
*** End of document ***