Medicare: More Effective Screening and Stronger Enrollment	 
Standards Needed for Medical Equipment Suppliers (22-SEP-05,	 
GAO-05-656).							 
                                                                 
In fiscal year 2004, the Centers for Medicare & Medicaid Services
(CMS) estimated that Medicare improperly paid $900 million for	 
durable medical equipment, prosthetics, orthotics, and		 
supplies--in part due to fraud by suppliers. To deter such fraud,
CMS contracts with the National Supplier Clearinghouse (NSC) to  
verify that suppliers meet 21 standards before they can bill	 
Medicare. NSC verifies adherence to the standards through on-site
inspections and document reviews. Recent prosecutions of	 
fraudulent suppliers suggest that there may be weaknesses in	 
NSC's efforts to screen suppliers or in the standards. In this	 
report, GAO evaluated: 1) NSC's efforts to verify suppliers'	 
compliance with the 21 standards, 2) the adequacy of the	 
standards to screen suppliers, and 3) CMS's oversight of NSC's	 
efforts.							 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-05-656 					        
    ACCNO:   A37738						        
  TITLE:     Medicare: More Effective Screening and Stronger	      
Enrollment Standards Needed for Medical Equipment Suppliers	 
     DATE:   09/22/2005 
  SUBJECT:   Fraud						 
	     Inspection 					 
	     Licenses						 
	     Medical equipment					 
	     Medical supplies					 
	     Medicare						 
	     Overpayments					 
	     Standards						 
	     Strategic planning 				 
	     Florida						 
	     Illinois						 
	     Louisiana						 
	     Texas						 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-05-656

     

     * Results in Brief
     * Background
     * Medicare's Supplier Standards
     * Verifying Compliance with Supplier Standards
     * On-site Inspection Procedures
     * Enrollment, Disenrollment, and Appeals
     * Other NSC Efforts to Verify Suppliers' Compliance with Medic
          * NSC's Efforts Are Insufficient to Verify Suppliers' Complian
     * NSC's Procedures to Verify State Licenses Have Gaps
     * NSC Has Not Conducted All of the Routine On-site Inspections
     * NSC's Procedures for Conducting On-site Inspections May Limi
     * NSC Is Not Required by Contract to Conduct a Minimum Number
          * Medicare's Standards Are Too Weak to be Used Effectively to
     * Medicare's Standards Lack Assessment of Integrity and Capabi
     * Medicare Suppliers Do Not Face the Same Penalties for Not Me
     * CMS's Efforts to Strengthen the Supplier Standards and Other
          * CMS's Oversight Is Insufficient to Determine Whether NSC Scr
          * Conclusions
          * Matter for Congressional Consideration
          * Recommendations
          * Agency Comments
     * Appendix I: Objectives, Scope, and Methodology
     * Appendix II: Medicare's 21 Standards for Suppliers and NSC's
     * Appendix III: Agency Comments
     * Appendix IV: GAO Contact and Staff Acknowledgments
          * GAO Contact
          * Acknowledgments
     * Related GAO Products
     * Order by Mail or Phone

Report to the Chairman, Committee on Finance, U.S. Senate

United States Government Accountability Office

GAO

September 2005

MEDICARE

More Effective Screening and Stronger Enrollment Standards Needed for
Medical Equipment Suppliers

National Supplier Clearinghouse National Supplier Clearinghouse National
Supplier Clearinghouse National Supplier Clearinghouse National Supplier
Clearinghouse National Supplier Clearinghouse National Supplier
Clearinghouse National Supplier Clearinghouse National Supplier
Clearinghouse National Supplier Clearinghouse National Supplier
Clearinghouse National Supplier Clearinghouse National Supplier
Clearinghouse National Supplier Clearinghouse National Supplier
Clearinghouse National Supplier Clearinghouse National Supplier
Clearinghouse National Supplier Clearinghouse National Supplier
Clearinghouse National Supplier Clearinghouse National Supplier
Clearinghouse National Supplier Clearinghouse National Supplier
Clearinghouse National Supplier Clearinghouse National Supplier
Clearinghouse National Supplier Clearinghouse National Supplier
Clearinghouse National Supplier Clearinghouse National Supplier
Clearinghouse National Supplier Clearinghouse National Supplier
Clearinghouse National Supplier Clearinghouse National Supplier
Clearinghouse National Supplier Clearinghouse National Supplier
Clearinghouse National Supplier Clearinghouse National Supplier
Clearinghouse National Supplier Clearinghouse National Supplier
Clearinghouse National Supplier Clearinghouse National Supplier
Clearinghouse National Supplier Clearinghouse National Supplier
Clearinghouse National Supplier Clearinghouse National Supplier
Clearinghouse National Supplier Clearinghouse National Supplier
Clearinghouse National Supplier Clearinghouse National Supplier
Clearinghouse National Supplier Clearinghouse

GAO-05-656

Contents

Letter 1

Results in Brief 4
Background 7
NSC's Efforts Are Insufficient to Verify Suppliers' Compliance with the 21
Standards 12
Medicare's Standards Are Too Weak to be Used Effectively to Screen DMEPOS
Suppliers 23
CMS's Oversight Is Insufficient to Determine Whether NSC Screens and
Monitors Suppliers Effectively 30
Conclusions 32
Matter for Congressional Consideration 33
Recommendations 33
Agency Comments 34
Appendix I Objectives, Scope, and Methodology 37
Appendix II Medicare's 21 Standards for Suppliers and NSC's Procedures to
Verify Their Compliance 39
Appendix III Agency Comments 43
Appendix IV GAO Contact and Staff Acknowledgments 47
Related GAO Products 48

Tables

Table 1: Suppliers That Should Not Have Billed for Oxygen Services, but
Were Paid at Least $1,000 for Them in 2004 14
Table 2: Examples of Suppliers That Had Billing Privileges Revoked, Were
Reinstated, and Billed Improperly After Readmission into Medicare 28
Table 3: Medicare's 21 Standards for Medicare Suppliers of DME,
Prosthetics, Orthotics, and Supplies and NSC's Procedures at Enrollment
and Reenrollment to Verify Compliance with the Standards 39

Figure

Figure 1: Medicare Payments for Prosthetics and Custom-Fabricated
Orthotics to Florida Suppliers That Did and Did Not Disclose Intention to
Bill for These Items, 2003 and 2004 16

Abbreviations

CMS Centers for Medicare & Medicaid Services DME durable medical equipment
DMEPOS durable medical equipment, prosthetics, orthotics, and supplies FBI
Federal Bureau of Investigation MMA Medicare Prescription Drug,
Improvement, and Modernization Act of 2003 NSC National Supplier
Clearinghouse OIG Office of Inspector General OSI Overland Solutions, Inc.
SACU Supplier Audit and Compliance Unit

This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.

United States Government Accountability Office

Washington, DC 20548

September 22, 2005

The Honorable Charles E. Grassley Chairman Committee on Finance United
States Senate

Dear Mr. Chairman:

Medicare is the federal program that helps pay for a variety of health
care services and items on behalf of almost 42 million elderly and certain
disabled beneficiaries. One of the responsibilities of the Centers for
Medicare & Medicaid Services (CMS), the agency that administers Medicare,
is to minimize improper payments made on behalf of its beneficiaries.
Improper payments result from mistakes on the part of those who bill
Medicare; abusive activities; or fraud, which is intentional
misrepresentation. According to CMS estimates, in fiscal year 2004,
Medicare paid about $8.8 billion in claims for durable medical equipment,
prosthetics, orthotics, and supplies (DMEPOS), of which $900 million were
improper payments.1 As we previously reported in November 2004, some
improper payments were made to DMEPOS suppliers that were committing
fraud.2 For example, in one 2003 criminal case, 20 individuals in Arizona
pleaded guilty to charges of defrauding Medicare of more than $25 million
by creating about 30 sham companies that billed for DMEPOS items that they
did not deliver or that had not been ordered by the beneficiaries'
physicians.3 Similarly, in 2004, the government won a civil suit against
24 DMEPOS suppliers for $366 million as treble damages to settle charges
of falsely billing Medicare for items not needed or delivered as claimed.

1Medicare law defines durable medical equipment (DME) as equipment that
serves a medical purpose, can withstand repeated use, is generally not
useful in the absence of an illness or injury, and is appropriate for use
in the home. DME includes items such as wheelchairs, hospital beds, and
walkers. Medicare law defines prosthetic devices (other than dental) as
devices that are needed to replace a body part or function. Prosthetic
devices include artificial limbs and eyes and cardiac pacemakers. Medicare
law defines orthotic devices to include leg, arm, back, and neck braces
that provide rigid or semirigid support to weak or deformed body parts or
restrict or eliminate motion in a diseased or injured part of the body.
Medicare-reimbursed DME supplies are items that are used in conjunction
with DME and are consumed during the use of the equipment-such as drugs
used for inhalation therapy-or items that need to be replaced on a
frequent, usually daily, basis-such as surgical dressings.

2GAO, Medicare: CMS's Program Safeguards Did Not Deter Growth in Spending
for Power Wheelchairs, GAO-05-43 (Washington, D.C.: Nov. 17, 2004).

Because identifying and prosecuting suppliers4 engaged in fraudulent
activity is time consuming, resource intensive, and costly, CMS tries to
prevent potentially fraudulent entities from entering the Medicare
program. To do so, using its statutory authority, CMS developed
regulations that define the 21 standards that DMEPOS suppliers must meet
to be authorized to bill Medicare for items and services that they provide
to beneficiaries.5 The 21 standards are intended to help ensure that
suppliers are legitimate businesses as well as properly licensed by the
states in which they operate-and therefore qualified-to provide DMEPOS
items and services. CMS contracts with the National Supplier Clearinghouse
(NSC) to screen potential suppliers and enroll those that comply with the
21 standards into the Medicare program. NSC verifies DMEPOS suppliers'
compliance with most of the standards through on-site inspections6 and
conducts other verification procedures using information from the
applications or gathered during the on-site inspections. Enrolled
suppliers are authorized to bill Medicare, and to retain their billing
privileges must apply for reenrollment and be rescreened every 3 years.
NSC may also verify compliance with the standards at other times-usually
when it receives information about possible noncompliance or fraud.

Despite these safeguards, recent prosecutions of fraudulent suppliers that
successfully billed Medicare suggest that there may be weaknesses in NSC's
efforts to verify compliance with the standards or in the standards
themselves. Due to concerns that such weaknesses may leave the Medicare
program vulnerable to improper billing practices or allow unqualified
suppliers to serve beneficiaries, you asked us to examine the procedures
used by NSC to ensure that DMEPOS suppliers are legitimate businesses and
are qualified to bill Medicare. In this report, we evaluated: 1) NSC's
efforts to verify suppliers' compliance with the 21 standards, 2) the
adequacy of the standards used to screen suppliers, and 3) CMS's oversight
of NSC's efforts.

3According to the Department of Health and Human Services Office of
Inspector General that investigates alleged DMEPOS and other fraud, from
2003-2004, nine criminal cases involving DMEPOS supplier fraud have gone
to trial. As of February 4, 2005, 21 individuals involved in such cases
have been convicted of fraud, and over $70 million in improper payments
has been recovered.

4In this report, the term supplier is used only for DMEPOS suppliers.

5Three of the 21 standards were created by statute (42 U.S.C. S:
1395m(j)(1)(B) (2000)) and the other 18 standards were established by
regulation. The 21 standards are found at 42 C.F.R. S: 424.57(c) (2004).

6The supplier standards require suppliers to permit on-site inspections,
while the statement of work governing NSC's activities generally refers to
these as site visits. The two terms refer to the same activity and we use
the term on-site inspection throughout this report.

To evaluate NSC's efforts to verify suppliers' compliance with the
standards, we examined NSC's contract statement of work and its written
procedures. Through this analysis, we determined that checking DMEPOS
suppliers' state licenses7 and conducting on-site inspections were two of
the most important verification procedures and we focused our review on
them.8 We analyzed Medicare DMEPOS claims data for 2003 and 2004 in four
states-Florida, Illinois, Louisiana, and Texas-and information from NSC's
supplier database.9 This helped us determine whether suppliers had the
state licenses necessary for the items they billed and whether NSC had
conducted all required on-site inspections. We chose these states because
they have licensure requirements for certain DMEPOS items and have
suppliers with fraudulent Medicare DMEPOS billings. We assessed the
reliability of the 2003 and 2004 claims data from CMS and the NSC supplier
data files by performing electronic testing of required data elements,
reviewing existing information about the data and the systems that
produced them, and interviewing CMS and NSC officials knowledgeable about
the data. We determined that these data were sufficiently reliable to
address the issues in this report. We also accompanied NSC staff on
supplier on-site inspections and had our Forensic Audits and Special
Investigations staff investigate selected suppliers and companies
associated with them in Florida and Texas.

7In order to sell certain DMEPOS items or services, including oxygen,
orthotics, and prosthetics, certain states require licensure. The types of
licensure vary by state. For example, according to CMS, nine states
require licensure or certifications to provide prosthetics and orthotics.
Holding a valid state license, in states that require them, indicates that
the state has determined that the supplier has met the state's minimum
requirements to supply the item.

8We did not review NSC's procedures to verify that suppliers have
comprehensive liability insurance, because these procedures have recently
been strengthened and we believe that they should be adequate as a result.
We also did not review NSC's procedure to check supplier companies and
their owners to ensure that they are not excluded from participating in
federal health care programs or debarred from federal contracting, because
this is done through a routine data procedure matching the names against
federal files that list the names of excluded and debarred companies and
individuals.

9NSC maintains a database with information on Medicare DMEPOS suppliers.
From this database NSC sent us three files with information on active,
inactive, and revoked suppliers as of May 31, 2004. The files included
information such as the supplier's legal business name, billing number,
address, date of the most recent on-site inspection, the DMEPOS items and
services the supplier provides, and information on whether the supplier
had its billing number revoked.

To determine the adequacy of the 21 standards to screen suppliers, we
compared them to certain standards applicable to government contracting
and for participating as Medicaid10 DMEPOS suppliers in California and
Florida. Further, we analyzed appeals from suppliers that had their
supplier numbers denied or revoked to better understand their infractions
and obtained documentation on criminal cases of suppliers that had
defrauded Medicare or were under active investigation. We interviewed
fraud inspectors at NSC and in the Department of Health and Human Services
Office of Inspector General (OIG), as well as DMEPOS suppliers and their
representatives. To assess CMS's oversight of NSC, we reviewed the
agency's written evaluation procedures, evaluation reports, and other
documents related to the agency's oversight. In addition, we interviewed
NSC and CMS officials about NSC's efforts to verify compliance, the
adequacy of the standards, and CMS's oversight of NSC. Appendix I includes
a more detailed discussion of our scope and methodology. Our work was
conducted from June 2004 to September 2005 in accordance with generally
accepted government auditing standards.

                                Results in Brief

NSC's efforts to verify compliance with the supplier standards in order to
enroll only legitimate and qualified suppliers in Medicare are
insufficient because of weaknesses in procedures for checking state
licensure and conducting on-site inspections and gaps in NSC's performance
of the procedures. NSC lacks an effective method for identifying the state
licenses suppliers are required to maintain to meet the standard for
adhering to all federal and state requirements. This is primarily because
NSC relies on self-reported information from suppliers' enrollment
applications about the items they intend to provide to beneficiaries and
does not match this later against suppliers' actual billing. During our
work, we found 121 suppliers in Florida, Louisiana, and Texas that had
each been paid at least $1,000 by Medicare in 2004 for providing oxygen
services but had not both disclosed that they would be doing so and
provided a license for NSC to review. Twenty-two of these suppliers were
not licensed to provide oxygen services in 2004. Further, CMS requires NSC
to check state licensure only during initial enrollment, although
suppliers may change the items supplied or allow licenses to lapse after
enrollment. We identified 7 other suppliers in Florida, Louisiana, and
Texas that lacked the needed state license to provide oxygen in 2004,
although they had disclosed their intention to provide this service to NSC
and were reimbursed at least $1,000 each by Medicare for providing it. We
also identified 73 suppliers in Florida that billed for custom-fabricated
orthotics and prosthetics without informing NSC of their intention to
provide these items. Routinely identifying the suppliers that were billing
without the required state license might have avoided some of the more
than $56.3 million in improper payments made in Florida for
custom-fabricated orthotics and prosthetics. In regard to on-site
inspections, NSC's performance in conducting them exhibited weaknesses
that limited their effectiveness. We estimate that NSC did not perform
on-site inspections of 605 suppliers to verify those suppliers' compliance
with Medicare's standards. Further, some of the procedures for conducting
on-site inspections do not fully verify compliance with the standards
because CMS has not required NSC to adopt a rigorous inspection process.
For example, when conducting on-site inspections, NSC does not require its
inspectors to examine beneficiary files to ensure that suppliers are
meeting the standard for maintaining proof of delivery. Another standard
requires suppliers to have inventory to fill orders, or a contract to
purchase the items needed. However, if a supplier indicates that its
inventory is stored off-site or is provided by another company, NSC does
not require site inspectors to verify the inventory's existence or confirm
that the company serving as its source is a legitimate business.

10Medicaid is a state-administered health care program, jointly funded by
the federal and state governments, that covers approximately 54.9 million
eligible low-income individuals. Each state administers its own program
and determines, under broad federal guidelines, eligibility for, coverage
of, and reimbursement for specific items and services, such as DME. Each
state is also responsible for its own enrollment process for suppliers and
other providers.

Medicare's standards are currently too weak to be used effectively to
screen DMEPOS suppliers. Although Medicare pays millions of dollars to
suppliers, the program's 21 standards do not include measures related to
supplier integrity and capability analogous to those that federal agencies
generally apply to prospective contractors or those used by at least two
state Medicaid programs for their suppliers. Federal agencies-including
CMS-determine whether companies seeking federal contracts are
"responsible"-that is, whether they have a satisfactory record of
performance, integrity, and business ethics, as well as the financial,
technical, and managerial ability to provide the specified products and
services. According to federal requirements, agencies are not to award
government contracts to companies that are not responsible. After
receiving a federal government contract, a business that performs poorly
on that contract can lose it and may have difficulty securing federal
contracts in the future because of previous poor performance. In addition,
in the case of certain serious offenses, a company can be debarred from
federal contracting, generally for up to 3 years. The Florida and
California Medicaid agencies also have barriers to reentry of problematic
Medicaid suppliers that have violated program rules-a 3-year exclusion in
some cases. In contrast, because Medicare suppliers are not CMS
contractors, they are not subject to federal procurement standards.
Instead, they are subject to Medicare's standards, which generally do not
require suppliers to demonstrate that they are responsible and do not
limit the reentry of suppliers that have remedied past noncompliance with
Medicare's standards. Having weak standards for suppliers helps
individuals intent on defrauding Medicare to obtain billing privileges and
be paid for fraudulent claims. For example, in sworn testimony before the
Senate Committee on Finance in April 2004, an individual who pleaded
guilty to Medicare fraud described how she was able to obtain a billing
number by opening a sham business with $3,000-despite lacking the
experience and the financial, technical, and managerial resources to
operate a legitimate DMEPOS company. Even when CMS revokes suppliers'
billing privileges, suppliers that have violated multiple standards have
been able to reenroll within an average of 3 months.

CMS's oversight has not been sufficient to determine whether NSC is
meeting its responsibilities in screening, enrolling, and monitoring
DMEPOS suppliers. For example, CMS has not effectively overseen NSC's
verification of suppliers' state licenses. In addition, CMS was
unaware-until we informed the agency-that NSC had not conducted required
on-site inspections for suppliers and that-in contrast to CMS
requirements-NSC's procedures allow its staff to use discretion in
selecting suppliers for on-site inspections. These lapses may be
attributed in part to limitations in the means through which CMS oversees
its contractor-an annual inspection and monthly reports. During its annual
inspection, CMS analyzes a small random sample of supplier files to
determine, for instance, whether NSC is conducting on-site inspections,
verifying licenses, and denying or revoking billing privileges in
accordance with CMS requirements. However, we determined that CMS's sample
sizes are too small to identify systematic problems. Further, the monthly
report CMS receives from NSC provides useful information on the
contractor's workload, but does not provide information on the
thoroughness of NSC's screening and enrollment efforts. Similarly, while
CMS has established performance goals in NSC's contract related primarily
to processing applications and handling supplier inquiries, it has not
established performance goals connected to effective screening or fraud
prevention efforts, such as examining whether the on-site inspections are
conducted thoroughly enough to uncover noncompliance.

To strengthen the supplier standards, we are suggesting that the Congress
consider whether suppliers that violate the standards should have to wait
a specified period of time from the date of their revocation to have a
billing number reissued. We are also making several recommendations to the
CMS Administrator to improve NSC's licensure verification and on-site
inspections, the supplier standards, and CMS's oversight of NSC's
screening efforts. CMS generally concurred with all of our recommendations
and provided information on the actions it was taking to implement each of
them.

                                   Background

Most Medicare beneficiaries elect to enroll in Part B insurance,11 which
helps pay for certain physician, outpatient hospital, laboratory, and
other services; DME, such as oxygen, wheelchairs, hospital beds, and
walkers; prosthetics and orthotics; and certain supplies. Medicare, under
Part B, pays for most DMEPOS based on a series of state-specific or
regional-specific fee schedules. Under the schedules, Medicare pays 80
percent, and the beneficiary pays the balance, of either the actual charge
submitted by the supplier or the fee schedule amount, whichever is less.
To review and process DMEPOS claims, CMS contracts with four insurance
companies, known as DME regional carriers. The DME regional carriers
review and pay DMEPOS claims submitted by outpatient providers and
suppliers on behalf of beneficiaries residing in specific regions of the
country.12

11Unlike Part A, Part B requires enrollees to pay a monthly premium for
their Part B coverage. Part A of Medicare covers inpatient hospital,
skilled nursing facility, hospice, and certain home health services.

12The four DME regional carriers are HealthNow New York, Inc. (Region A,
which includes 10 states in the northeast from Maine to Delaware);
AdminaStar Federal (Region B, which includes 9 states in the midwest, from
Maryland to Minnesota, and the District of Columbia); Palmetto Government
Benefits Administrators (Region C, which includes 14 states in the south,
from North Carolina to New Mexico, and Puerto Rico and the Virgin
Islands); and CIGNA Government Services, LLC (Region D, which includes 17
states in the west, from Missouri to Washington, and Guam, Mariana
Islands, and American Samoa).

CMS contracts with Palmetto Government Benefits Administrators to serve as
the National Supplier Clearinghouse. In fiscal year 2004, NSC received
$11.4 million for these activities, and for fiscal year 2005, its approved
budget was $11.5 million. Palmetto also serves as the DME regional carrier
for Region C. In addition, Palmetto serves as the Statistical Analysis
Durable Medical Equipment Regional Carrier, which analyzes claims and
reports to the DME regional carriers and CMS on trends in DMEPOS payment
and areas of potential fraud.

Medicare's Supplier Standards

Medicare's 21 supplier standards were introduced primarily to deter
individuals intent on committing fraud from entering the program and to
safeguard Medicare beneficiaries by ensuring that suppliers were
qualified. The 21 standards apply to a variety of business practices and
establish certain requirements. (See app. II for a list of the 21
standards.) For example, the standards require suppliers to have a
physical facility on an appropriate site that is accessible to
beneficiaries and to CMS, with stated business hours clearly posted. CMS
established the requirement for having an appropriate physical facility in
December 2000 after investigators discovered fraudulent suppliers without
fixed locations claiming vans or station wagons as their place of business
or using mail drop boxes to receive Medicare payments for items they
billed but never delivered. Among other things, the standards also require
suppliers to:

           o  comply with applicable federal and state regulatory
           requirements, including state licensure, when providing DMEPOS
           items or services;
           o  maintain inventory on site or off site, or available through
           valid contracts with other companies not excluded from doing
           business with the federal government or its health care programs;
           and
           o  obtain comprehensive liability insurance.

           The 21 supplier standards also prohibit certain practices. For
           example, one standard generally prohibits suppliers from using
           telephone calls to solicit new business, because the Social
           Security Act prohibits this type of marketing to Medicare
           beneficiaries.13

           NSC verifies compliance with the supplier standards primarily
           during enrollment and reenrollment, through on-site inspections14
           and desk reviews conducted by NSC analysts. (App. II lists the
           standards and how NSC verifies them during enrollment and
           reenrollment.) For example, the on-site inspections are used to
           check the compliance with the standards for whether the supplier:

           o  has a physical facility on an appropriate site that is
           accessible to beneficiaries and to CMS, with a clearly visible
           sign with hours posted;
           o  has its own inventory in stock on site, off site at another
           location, or has a contract with another company for the purchase
           of inventory;
           o  maintains records that document delivery of items to
           beneficiaries and information provided to beneficiaries on
           warranties, including how repairs and exchanges will be handled,
           and how to contact the supplier in case of questions or problems;
           and
           o  has a written beneficiary complaint resolution policy and
           maintains records on beneficiary complaints and their resolution.

           NSC's analysts are expected to follow procedures to review
           information provided by the on-site inspection and take other
           steps to verify suppliers' compliance with the standards. For
           example, when on site the inspectors are expected to check that
           the supplier has all the valid occupation and business licenses
           required by its state and has a comprehensive liability insurance
           policy. The NSC analyst is expected to check that the supplier has
           all the state licenses that it would need to provide the items it
           disclosed in its application. The NSC analyst also is expected to
           contact the insurance underwriter to ensure that the supplier's
           policy is valid,15 and the post office to make sure the supplier's
           address is listed. NSC also has a procedure to match data from its
           supplier database with computerized lists maintained by the
           federal government to ensure that supply company owners are not
           prohibited from participating in federal health care programs or
           debarred from federal contracting.

           NSC does not specifically verify adherence to 4 of the 21
           standards at enrollment and reenrollment, because violations would
           generally be apparent through its verification of other standards.
           For example, the standard that requires suppliers to furnish NSC
           with complete and accurate information on the application and
           notify NSC of any changes within 30 days is verified through
           checking the accuracy of the suppliers' disclosures of information
           for other standards-such as ownership and the appropriateness of
           the physical facility.

           The majority of on-site inspections are conducted by more than 380
           field representatives of Overland Solutions, Inc. (OSI), a company
           that performs this work as a subcontractor to NSC. In addition,
           NSC uses its own personnel, who are located in six cities, to
           conduct on-site inspections. NSC and OSI conducted over 20,000
           on-site inspections in fiscal year 2004.

           In performing their reviews, the site inspectors follow certain
           procedures. NSC requires that site inspectors arrive unannounced
           for any inspection. Before the inspection, NSC provides the
           inspectors with briefing information on the supplier, including
           information on whether the supplier is enrolling or reenrolling
           and the type of state licenses to verify. While on site,
           inspectors are expected to take photographs of the supplier's sign
           with its business name, posted hours of operation, complete
           inventory in stock, and facility.16 NSC also expects site
           inspectors to obtain copies of relevant documents, such as state
           licenses, comprehensive liability insurance, contracts with
           companies for inventory, and contracts for the service and
           maintenance of DME.

           As long as suppliers can demonstrate that they comply with the
           standards and have not been excluded from participating in any
           federal health care program, NSC must enroll or reenroll them in
           Medicare.17 Enrolled suppliers are issued a Medicare billing
           number. If NSC discovers that a new applicant or enrolled supplier
           is not in compliance with any of the 21 supplier standards, NSC
           can deny the application or, with CMS's approval, revoke the
           supplier's billing number.18

           Suppliers whose applications have been denied or whose numbers
           have been revoked can submit a plan to NSC to correct the
           noncompliance or appeal the denial or revocation by requesting a
           hearing or both. If a supplier requests a hearing, the first level
           of appeal is conducted by a carrier hearing officer who was not
           involved in the original determination. The supplier can submit
           new information to address the compliance problems identified by
           NSC. If dissatisfied with the carrier hearing officer's ruling,
           either NSC or the supplier can request a review by an
           administrative law judge, which became the second level of appeal
           as of December 8, 2004.19 Prior to that date, second level appeal
           hearings were conducted by a CMS review official. At both levels
           of the hearing process, if the supplier can demonstrate that it is
           currently in compliance with the standards, the supplier will be
           given a billing number.

           NSC's Supplier Audit and Compliance Unit (SACU) also has
           responsibility to help verify suppliers' compliance with the 21
           standards and identify fraudulent activity. The SACU supervises
           NSC's site inspectors and oversees the OSI on-site inspections. It
           also analyzes supplier billing and enrollment patterns. Based on
           billing or other irregularities, the SACU can help NSC identify
           suppliers for additional on-site inspections. For example, the
           SACU might discover that several new suppliers are owned by the
           same individuals as other companies that are under investigation
           for fraudulent billing. Based on this information, the SACU could
           target the new suppliers for additional on-site inspections or
           refer the suppliers for investigation by federal law enforcement,
           such as the OIG and the Federal Bureau of Investigation (FBI).

           NSC's verification procedures have weaknesses that leave the
           Medicare program without assurance that suppliers billing the
           program are meeting the 21 standards, and thus, are qualified and
           legitimate. NSC's procedures to verify state licenses have gaps
           that have allowed suppliers to be paid for DMEPOS items they are
           not licensed to supply in their states. In part, this is because
           CMS has not set requirements for a stronger licensure verification
           effort. Further, although on-site inspections play a key role in
           verifying suppliers' compliance with the 21 standards, we estimate
           that NSC did not conduct more than 600 required on-site
           inspections and its inspection procedures have limitations.

           NSC does not have an effective means of identifying suppliers that
           violate the standard to have appropriate state licensure for the
           items they provide to beneficiaries. This is partly because CMS's
           requirements are inadequate to assure an effective process and
           partly because NSC does not have effective procedures that are
           consistently followed. To determine whether it needs to verify a
           supplier's license, NSC relies on the information the supplier
           provides-in enrollment or reenrollment applications-regarding the
           items or services the supplier intends to provide to Medicare
           beneficiaries. Suppliers are required to certify on their
           applications that they will notify CMS of any changes to the
           information they provided on the form. However, if the supplier
           fills out the application incorrectly or dishonestly and does not
           provide a license during an on-site inspection, NSC would not
           verify whether the supplier has all the licenses needed in its
           state. We also found that NSC did not consistently resolve
           discrepancies or omissions in the information provided by
           suppliers-such as not forwarding a copy of a needed state
           license--before issuing suppliers billing numbers. Further, even
           though suppliers may change the items they supply, CMS's contract
           requires NSC to verify licensure only during enrollment and does
           not require verification at any later time, such as during
           reenrollment. Thus, even if a supplier begins to bill for items
           that require a state license and discloses this information during
           reenrollment, CMS does not require NSC to check the supplier's
           state licenses. Further, CMS does not require NSC to recheck
           suppliers prior to reenrollment to ensure that the supplier's
           license has not lapsed. Finally, CMS has not required NSC to
           verify licensure after enrollment by routinely comparing a
           supplier's actual billing history against the DMEPOS items and
           services originally disclosed on the supplier's application.
           Without such a check, CMS lacks assurance that suppliers are
           billing only for items they disclosed to NSC and for which NSC has
           verified a license.

           As a result of these gaps, Medicare paid suppliers when NSC had
           not verified their licenses, including some suppliers that lacked
           the appropriate license. As table 1 shows, by analyzing 2004
           DMEPOS claims data, we found 121 suppliers in Florida, Louisiana,
           and Texas that were each paid at least $1,000 by Medicare for
           oxygen services, even though they should not have billed for them.
           These suppliers either had not informed NSC that they would be
           billing for oxygen, did not provide NSC with the appropriate state
           license to verify, or both. Therefore, these suppliers were not in
           compliance with the 21 standards. In total, these suppliers were
           paid almost $6 million by Medicare. When we checked with the three
           states, we found that 22 of these suppliers did not have a license
           to provide oxygen in their states in 2004. These unlicensed
           suppliers were paid $231,730 in 2004 by Medicare for oxygen on
           behalf of beneficiaries. In addition, we verified licensure with
           the respective states for a sample of the suppliers that had
           disclosed to NSC their intention to bill for oxygen and had been
           paid at least $1,000 by Medicare for this service. Through this
           process, we identified 7 more suppliers that did not have the
           required state license to provide oxygen services in 2004.

           Table 1: Suppliers That Should Not Have Billed for Oxygen
           Services, but Were Paid at Least $1,000 for Them in 2004

           Source: GAO.

           Note: Table is based on analysis of NSC's active supplier data
           file as of May 31, 2004, verified by NSC; analysis of Medicare
           claims data for each state; and information on whether the
           suppliers had a license provided by the states of Florida,
           Louisiana, and Texas. Suppliers should not have billed for oxygen
           if they did not disclose to NSC the intention to do so, did not
           provide a license for verification, or both.

           aSuppliers that had a state license for any part of 2004 were not
           included.

           Similarly, in 2003 and 2004, Medicare paid prosthetics and
           custom-fabricated orthotics20 claims submitted by suppliers that
           did not both disclose to NSC that they would supply these items
           and provide a copy of their licenses.21 Thus, they should not have
           been allowed to bill Medicare for these items. We found 28
           suppliers in Illinois and Texas that were paid a total of about
           $197,000 in 2004 for prosthetics and custom-fabricated orthotics
           even though they should not have been billing for these items.

           Routinely comparing suppliers' billing to the information they
           report on the enrollment or reenrollment application regarding the
           items and services they intend to provide might have avoided some
           of the improper prosthetics and orthotics payments that occurred
           in Florida. In this state, Medicare payments for prosthetics and
           custom-fabricated orthotics inexplicably tripled in 1 year-from
           about $32.5 million in 2003 to almost $107.0 million in 2004. As
           figure 1 shows, most of the increase was in payments to suppliers
           that did not disclose to NSC that they intended to provide these
           items. In 2004, the 73 suppliers that did not disclose the
           intention to provide prosthetics or orthotics were paid more than
           $56.3 million. These 73 suppliers were paid more than the amount
           paid to the 262 suppliers that had informed NSC that they would
           provide these items. The DME regional carrier has established
           about $16.3 million as overpaid to 70 of the 73 suppliers, but has
           collected less than $2.3 million plus interest payments of
           $60,820, as of April 21, 2005.22 Investigative staff at the Region
           C DME regional carrier informed us that at least 46 of the 73
           suppliers are currently under active investigation for health care
           fraud.23

           Figure 1: Medicare Payments for Prosthetics and Custom-Fabricated
           Orthotics to Florida Suppliers That Did and Did Not Disclose
           Intention to Bill for These Items, 2003 and 2004

           Note: Figure is based on analysis of NSC's active supplier data
           file as of May 31, 2004, verified by NSC, and analysis of Medicare
           claims data.

           When NSC reviewed each case we identified of suppliers that billed
           for oxygen or prosthetics and custom-fabricated orthotics without
           disclosing the intention to do so, its analysis revealed several
           types of problems with its processing of suppliers' applications.
           For example, in Florida, for one case that we identified, the
           supplier had not correctly filled out the application to disclose
           the intention of providing prosthetics and custom-fabricated
           orthotics but had given NSC a copy of its state license. In two
           cases, the supplier disclosed the intention of providing
           prosthetics and custom-fabricated orthotics, but did not give NSC
           a copy of its state license to review. Despite the discrepancies
           in the information provided by suppliers, NSC enrolled or
           reenrolled these suppliers. In three cases, the supplier disclosed
           the intention to provide prosthetics and custom-fabricated
           orthotics and gave NSC a copy of its license, but NSC staff did
           not update their information appropriately in the supplier
           database.

           During this engagement, we discussed with CMS NSC's weaknesses in
           verifying suppliers' licenses. CMS officials acknowledged that the
           law requires CMS to restrict Medicare payment of prosthetics and
           certain custom-fabricated orthotics to those supplied by a
           qualified practitioner and fabricated by a qualified practitioner
           or supplier.24 The law defines qualified practitioners as a
           physician; an orthotist or a prosthetist who is licensed,
           certified, or has credentials and qualifications approved by the
           Secretary of Health and Human Services; or a qualified physical
           therapist or occupational therapist. The law defines qualified
           suppliers as entities accredited by the American Board of
           Certification in Orthotics and Prosthetics, Inc., the Board for
           Orthotist/Prosthetist Certification, or a program approved by the
           Secretary of Health and Human Services. CMS is in the process of
           developing proposed regulations that would further define
           qualified practitioners and suppliers of prosthetics and certain
           custom-fabricated orthotics on a national level. As an interim
           step, as of October 3, 2005, CMS will be requiring its DME
           regional carriers to put edits in their payment systems to deny
           claims for prosthetics and certain custom-fabricated orthotics
           submitted by any suppliers that are not qualified, or do not have
           qualified practitioners on staff, in the states that currently
           require licensure or certification. CMS indicated that these two
           actions should help address the problem of unlicensed suppliers
           billing for prosthetics and custom-fabricated orthotics. However,
           if NSC does not resolve discrepancies in the information provided
           by suppliers to have an accurate supplier database, the DME
           regional carriers will not have accurate information for approving
           or denying prosthetics and certain custom-fabricated orthotics
           claims. Further, the agency has not restricted payments for any
           other items that require state licensure-such as oxygen. Nor has
           it taken action to prevent payments to suppliers that have
           violated the standard for accurate disclosure of application
           information by billing for items they have not disclosed to
           NSC-whether or not a license is required in their states to
           provide these items.

           CMS has recently added another requirement for verifying licensure
           and other certifications. During this evaluation, we pointed out
           to CMS staff that the agency's contract with NSC was not specific
           about whether a license close to its expiration date when
           submitted to NSC should be rechecked to ensure the supplier had
           renewed it. CMS was developing a new statement of work for NSC and
           as a result of our discussion, the new statement of work requires
           NSC to follow up to ensure renewal of licenses, insurance
           policies, and certifications submitted within 60 days of
           expiration.

           NSC has not conducted the routine on-site inspections to verify
           supplier standards for all the DMEPOS suppliers that CMS requires
           it to inspect. We estimate that 605 enrolled suppliers that NSC
           was required to inspect never received an on-site inspection.25 We
           also estimate that NSC conducted on-site inspections for another
           3,079 suppliers, but did not properly record the date of these
           inspections in its supplier database.26 As a result, the
           database--with inaccurate or missing information-is not a reliable
           management tool for CMS to use in overseeing NSC's activities.

           NSC may not have conducted all of the required on-site inspections
           because of its procedures for determining which suppliers to
           inspect. According to NSC's written procedures, NSC staff use
           discretion to decide if an on-site inspection should be conducted
           prior to the enrollment or reenrollment of a supplier. In
           contrast, while CMS's contract with NSC exempts certain types of
           suppliers from routine on-site inspection, it does not state that
           NSC should use its discretion to choose whether to inspect the
           nonexempt suppliers. CMS staff informed us that NSC is required to
           inspect suppliers on initial enrollment and reenrollment, with
           some exceptions, and they were unaware that NSC was not conducting
           all of the required on-site inspections.

           Furthermore, because CMS's statements of work in its fiscal year
           2004 and 2005 contracts with NSC were not clear about what
           constitutes a supplier chain, NSC was not inspecting other
           suppliers that could be eligible for on-site inspections. NSC did
           not have to inspect supplier chains with 25 or more locations.
           However, the contract did not clearly state whether all 25
           locations in the chain have to have active billing numbers. As a
           result, NSC was exempting some suppliers in chains that currently
           have fewer than 25 locations with active billing numbers.27 We
           found 484 active suppliers included in chains with 24 or fewer
           locations with active billing numbers as of May 31, 2004. Of these
           484 active suppliers, 257 did not have any on-site inspections
           recorded. For example, NSC indicated to us that no on-site
           inspection was needed for Responsive Home Health Care, because it
           was included in a chain with 50 locations. However, it was part of
           a chain with 24 active locations, one location whose billing
           number had been revoked, and 25 inactive locations. We recently
           informed CMS that its contract language on chain suppliers was not
           clear, because CMS was developing a new statement of work for the
           next NSC contract. As a result, CMS revised its contract language
           for fiscal year 2006 to clarify that a chain consisted of 25 or
           more active supplier locations.

           Even if NSC had conducted all of its on-site inspections, the
           contractor's procedures for conducting them limit their
           effectiveness as a means of verifying compliance with the supplier
           standards in several ways. Thus, the procedures cannot assure
           suppliers' legitimacy and qualifications to serve beneficiaries.
           First, NSC does not explicitly require its site inspectors to
           review a specific number of suppliers' beneficiary files during
           their inspections. NSC told us that inspectors reviewed
           beneficiary files, but OSI told us that its inspectors were not
           required to review the contents of any beneficiary files.

           Without reviewing beneficiary files, it is unclear how inspectors
           can verify suppliers' compliance with the standard that requires
           suppliers to maintain several forms of documentation-including
           proof of delivery and evidence of their efforts to educate
           beneficiaries on how to use the equipment. Further, reviewing
           beneficiary files is also helpful to provide support beyond a
           written supplier policy that other standards are being met. For
           example, a record of equipment maintenance is better proof that
           the supplier repairs equipment than a written policy alone.
           Reviewing beneficiary files can also enable an inspector to
           identify potentially fraudulent patterns of behavior and
           fabrications designed to cover up lack of compliance with the 21
           standards. For example, NSC investigators told us that when many
           beneficiaries using one supplier have the same physician's
           signature on certificates that are required by Medicare to affirm
           the medical necessity of certain DMEPOS items, this can be a sign
           of fraudulent certifications designed to falsify compliance with
           Medicare's rules.28 The Region C DME regional carrier is currently
           investigating a group of suppliers using the same set of
           physicians on their certificates.

           Second, NSC does not routinely provide its site inspectors with
           the dollar amounts and specific DMEPOS items a supplier billed to
           Medicare. Knowing a supplier's billing history would enable
           inspectors to determine whether the supplier's submitted claims
           coincide with its inventory, invoices, delivery tickets, and other
           documentation in beneficiary files. When we accompanied NSC
           inspectors to the physical facilities of several suppliers about
           which NSC had suspicions-based on the suppliers' billing patterns
           or their association with other companies under investigation-the
           site inspectors did not have data on the billing histories for the
           suppliers being inspected. As a result, the inspectors did not
           know what types and amounts of inventory, delivery tickets, or
           invoices they should expect to find.29

           Third, neither CMS nor NSC explicitly requires the site inspectors
           to verify a supplier's inventory when it is stored at, or
           purchased from, another location. The inventory standard does not
           preclude a supplier from storing inventory off site or relying on
           another supplier-even a competitor-to provide its inventory.
           However, when this occurs, without taking additional verification
           steps, NSC would not know whether the off-site inventory exists or
           whether the source of inventory is legitimate. According to the
           inventory standard, suppliers cannot contract with companies that
           are currently excluded from the Medicare program, any state health
           programs, or from any other federal procurement or nonprocurement
           programs. However, without investigating the companies that are
           cited as sources of inventory, NSC would not know if this standard
           was being met. NSC's procedures suggest, but do not require, its
           site inspectors to verify off-site inventory locations. Because
           CMS does not require NSC to conduct verification of off-site
           inventory or an assessment of the company cited as the source of
           inventory, the current procedures do not fully verify the
           inventory standard.

           Inspecting off-site inventory or assessing the validity of
           inventory contracts can help pinpoint violations of the standard
           for inventory and can also identify potentially fraudulent
           activities. For instance, when NSC inspected an address of a
           company that a supplier gave as its source for inventory, it
           discovered an auto body shop at that address. In another instance,
           NSC found a vacant building at the address given as a supplier's
           inventory source. These suppliers violated the standards for
           disclosing accurate information to NSC and for having inventory or
           a contract to procure it. Further, citing a nonexistent source of
           inventory suggests the possibility that these suppliers were
           engaging in fraud. Similarly, groups of suppliers under
           investigation for fraud in Houston in 2003 and 2004 were using the
           same company as their fictitious source of inventory. SACU
           investigators were able to identify other suppliers participating
           in the same fraud scheme because the suppliers claimed they were
           obtaining inventory from a source that was under investigation.

           Through examining sources of inventory, our investigators
           identified companies with questionable financial transactions or
           owners involved with suppliers engaged in potentially fraudulent
           billing. For example, we identified and investigated one
           distribution company in Florida that six suppliers had cited as
           one of their main sources of inventory.30 CMS had denied or
           revoked the billing numbers for the six suppliers, in part because
           they did not appear to have inventory, but five of them were able
           to obtain or regain their billing numbers after providing
           contracts for inventory from this distribution company. Our
           investigators found that the distribution company's bank had filed
           27 separate reports identifying cash withdrawals from company
           accounts in amounts ranging from $10,000 to more than $98,000 over
           a period of 20 months-almost $1 million in total.31 Such cash
           withdrawals are suspicious because they can indicate attempts to
           disguise illicit funds and make them more difficult to track. Even
           more suspicious, our investigators found that this distribution
           company did not appear to be an active business. Through on-site
           inspections conducted in March 2005, we found that two of the
           addresses given for it were vacant office/storage units and one
           was a custom woodworking shop. In June 2005, we investigated a
           fourth possible address for the company. This address had been
           leased by an individual who identified himself in leasing
           paperwork as being associated with a "Medical Equipment" business
           and was found to be a storage unit littered with debris and a pile
           of boxes, many of which were crushed and broken. The investigators
           saw no posted signs or activities that would indicate an active
           business. In addition, of the five suppliers currently reenrolled
           in Medicare that cited this source of inventory, three were under
           investigation in March 2005 by the Region C DME regional carrier's
           fraud control unit.

           Out-of-cycle on-site inspections have been effective in
           identifying suppliers that are not complying with Medicare's
           standards. For example, during the April 2004 hearing before the
           Senate Committee on Finance on the Medicare power wheelchair
           benefit, the attendees watched a video of law enforcement
           surveillance that showed individuals bringing office equipment and
           DMEPOS items into an office suite in order to appear to meet the
           standards for having an appropriate physical facility and
           inventory to pass an on-site inspection. Because the timing of
           enrollment and reenrollment inspections are predictable, a
           supplier intent on committing fraud can anticipate an enrollment
           on-site inspection and create the illusion of legitimacy, fully
           understanding that an inspector is not likely to return for 3
           years. Out-of-cycle on-site inspections can be so valuable that we
           previously recommended that CMS direct NSC to routinely conduct
           them for suppliers suspected of billing improperly.32 CMS agreed
           with the recommendation and pointed out the number of out-of-cycle
           inspections that were being completed. In 2003, NSC conducted over
           600 out-of-cycle inspections and found 306 DMEPOS suppliers not
           complying with Medicare's standards. NSC continued this practice
           in fiscal year 2004, conducting over 400 out-of-cycle on-site
           inspections targeted specifically at high-volume suppliers that
           were not part of chains.33 CMS has also requested NSC to conduct
           out-of-cycle on-site inspections in fiscal year 2005.
           Nevertheless, NSC's contract does not explicitly require it to
           conduct out-of-cycle on-site inspections.

           Although NSC has conducted out-of-cycle on-site inspections in the
           last several years, without becoming an explicit part of its
           contract, this activity could be curtailed at any time. We
           discussed our concerns about this with CMS staff writing the
           revised statement of work for a new contract that is scheduled to
           be awarded in December 2005. As a result, CMS included language in
           the revised statement of work that will explicitly require the
           contractor for NSC to conduct random, out-of-cycle on-site
           inspections as resources permit. However, the change in the
           statement of work does not require NSC to conduct a minimum number
           of out-of-cycle on-site inspections as a routine part of its
           activities.

           Medicare's standards are currently too weak to be used effectively
           for screening DMEPOS suppliers that want to enroll in the program.
           The 21 standards focus on certain operational characteristics.
           However, they do not include standards related to supplier
           integrity and capability analogous to those that federal agencies
           generally apply to prospective contractors or those used by at
           least two state Medicaid programs for their suppliers. For
           example, federal agencies do not have to contract with companies
           that have demonstrated poor performance in the past. In contrast,
           CMS has reenrolled suppliers whose billing numbers have been
           revoked, after they have demonstrated compliance with the
           standards-no matter how many standards they had previously
           violated. We found cases of suppliers that had billed improperly
           and violated standards, reentered the program, and then began to
           bill improperly for other items. CMS is currently developing more
           specific guidance for applying some of its 21 standards. In
           addition, to implement provisions in the Medicare Prescription
           Drug, Improvement, and Modernization Act of 2003 (MMA),34 CMS is
           introducing a competitive bidding process for DME, off-the-shelf
           orthotics, and supplies, and is developing quality standards that
           would supplement the existing ones. When implemented, these steps
           could help ensure that DMEPOS suppliers are legitimate businesses
           and qualified to bill Medicare.

           Although a federal agency primarily pays for items provided by
           DMEPOS suppliers, these businesses are not held to standards
           analogous to those that apply to companies that seek to contract
           with the federal government. Under federal procurement
           regulations, agencies are generally required to determine whether
           a potential contractor is "responsible"-that is, whether it has a
           satisfactory record of performance, integrity, and business
           ethics, as well as the financial, technical, and managerial
           ability to provide the specified products and services.35 Federal
           agencies can consider a contractor's past performance as an
           indicator of future performance and require a disclosure of
           financial and management information to make their assessment. In
           addition, after a contract is awarded, federal agencies can
           terminate the contract for default or convenience.36 Further, for
           committing certain crimes or not meeting certain federal
           requirements, a company may be debarred from receiving federal
           contracts, generally for up to 3 years.37

           Some state governments have requirements to ensure that Medicaid
           suppliers are responsible. For example, California's Medicaid
           program requires DME suppliers to have the administrative and
           fiscal foundation to survive as a business, demonstrated by
           financial records, such as a business plan, bank statements, and
           contractual agreements. California state officials told us that a
           DME supplier in their state could not meet the definition of being
           an established business for the Medicaid program if it sold power
           wheelchairs out of a residence, as some Medicare DME suppliers
           have done.38 Similarly, Florida's Medicaid program requires
           suppliers to provide evidence of being a viable, ongoing business.
           Florida also requires anyone with 5 percent or greater ownership,
           and the manager of the supplier, to be fingerprinted and undergo a
           criminal background investigation, because the state will not
           enroll suppliers with owners convicted of several types of crimes,
           such as health care fraud or patient abuse.

           In contrast, suppliers are not CMS contractors, and CMS's
           standards do not require suppliers to demonstrate that they are
           responsible based on their financial, technical, and managerial
           ability, their integrity, and their past performance. As a result,
           suppliers that are not legitimate DMEPOS businesses have enrolled
           in Medicare and have been paid millions of dollars in improper
           payments without having to demonstrate that they have the ability
           and integrity to serve beneficiaries, as the following examples
           show.

           For example, in sworn testimony before the Senate Committee on
           Finance in April 2004, a witness who pleaded guilty to fraud
           explained her part in a $25 million fraud scheme that she and a
           group of 19 others committed against the Medicare program. She
           explained how she was able to set up a sham company-Mercury
           Medical Supplies-with $3,000 and obtain a Medicare billing number,
           even though she had no prior experience, expertise, or discernable
           resources for providing DMEPOS items or services. From September
           2000 to December 2001, when its billing number was revoked,
           Medicare paid Mercury Medical Supplies $1,158,482 for providing
           DMEPOS items that were falsely billed based on forged physicians'
           prescriptions and were generally not supplied to beneficiaries.
           While the Medicare program paid Mercury Medical Supplies over $1
           million but did not inquire into its financial ability to supply
           DMEPOS items, one federal agency refused to award a $230,000
           contract to a company with $32,500 in working capital, in part
           because the agency's contracting officer did not think that the
           company was financially strong enough to fulfill the contractual
           obligations.39

           Like Mercury Medical Supplies, All-Divine Health Services in
           Lufkin, Texas was not a legitimate DMEPOS business, but managed to
           enroll in Medicare in December 2002. NSC's inspector noted on an
           initial site inspection report that the owner explained that she
           was awaiting inventory, which was why she had none in her storage
           area prior to enrollment in the Medicare program. Once enrolled,
           All-Divine Health Services began to bill for power wheelchairs, an
           item for which Medicare pays over $5,000. However, because of
           concerns about inappropriate power wheelchair billing, NSC
           conducted out-of-cycle on-site inspections of All-Divine and other
           power wheelchair suppliers in the area. The site inspector found
           evidence of potential fraud, such as altered certificates from
           physicians attesting to the beneficiaries' medical need for the
           items to be supplied, as well as violations of Medicare's
           standards. Following the out-of-cycle inspection, CMS found that
           All-Divine was in violation of four standards, because it lacked
           comprehensive liability insurance, lacked a state license to
           provide bedding, did not have adequate contracts for inventory,
           and did not have adequate provision to repair and service DME.
           All-Divine's billing number was revoked effective August 6, 2003.
           After the owner pleaded guilty to conspiracy to commit health care
           fraud on June 25, 2004, her lawyer testified that All-Divine's
           owner had not understood the intricacies of proper Medicare
           billing and had no experience managing a DMEPOS company. The owner
           told her lawyer that she did not think she was committing a crime,
           although she admitted purchasing paperwork certifying
           beneficiaries as needing power wheelchairs and then submitting
           claims on their behalf. Her lawyer also testified that the owner
           stated that her firm lacked the operational controls to ensure
           that beneficiaries actually received the power wheelchairs for
           which the company billed and was paid by Medicare. Before its
           billing number was revoked, All-Divine was paid over $1.8 million
           by the program, predominantly for power wheelchairs not provided
           as billed.

           While federal agencies, including CMS, may choose not to conduct
           business with companies that lack integrity or perform poorly, and
           may disqualify companies from competing for federal contracts,
           suppliers that have failed to comply with Medicare's standards
           have not lost their billing privileges for any substantial length
           of time. Federal agencies can terminate contracts at their
           convenience or for default-which is when a contractor fails to
           perform the contract. For certain serious violations, contractors
           can be debarred from receiving any federal contract, generally for
           up to 3 years.40 Willful failure to perform the terms of a
           government contract is a basis for debarment. In addition, apart
           from debarment, agencies can refuse to offer new contracts to
           companies exhibiting previous performance problems or a lack of
           integrity in the past.41 This may occur after conviction for
           criminal charges, but sometimes the refusals follow allegations of
           wrongdoing. For example, one agency refused to offer a new
           contract to a company that had allegedly provided false
           certifications in the past.42 Another agency used the results of
           criminal investigative reports as a basis for refusing to offer
           contracts to companies.43

           Compared with Medicare, the Medicaid programs of California and
           Florida put more barriers to reenrollment of problematic suppliers
           into Medicaid. For example, California provisionally enrolls new
           Medicaid providers for 12 to 18 months.44 During this period, if
           the provider fails to meet state requirements, the state agency
           disenrolls the provider from Medicaid.45 In addition, if a
           provider fails to accurately disclose information, such as the
           ownership of the company, California can disenroll the provider
           from Medicaid and keep it from reenrolling for 3 years.46 The
           California Medicaid program denies applications from providers
           under investigation for criminal offenses. Florida will not
           reenroll suppliers that have been excluded from the program. When
           NSC identifies suppliers that violate Medicare's standards, CMS
           may revoke their billing privileges. However, in contrast to
           California and Florida Medicaid, if a supplier can demonstrate
           compliance with the 21 standards, CMS readmits it into Medicare
           unless it has been otherwise excluded from participating in the
           program.

           DMEPOS suppliers that have their billing privileges revoked and
           then later reenter Medicare are not uncommon. We identified 1,038
           DMEPOS suppliers that lost their billing privileges in 2003,
           generally for violating multiple standards. Of these suppliers,
           192 were reenrolled in Medicare as of May 31, 2004, with the
           average period of suspension lasting about 3 months. None of these
           suppliers encountered any barrier to enrollment for violating the
           standards. Further, when some suppliers that had billed improperly
           because they were unlicensed reentered the program, they resumed
           improper billing for different types of items. See table 2 for two
           examples.

1342 U.S.C. S: 1395m(a)(17) (2000).

Verifying Compliance with Supplier Standards

14CMS requires NSC to conduct on-site inspections of DMEPOS suppliers-with
certain exceptions. Specifically, the statement of work under which NSC
operates states that NSC shall apply certain procedures to verify
information provided by new applicants, including conducting inspections
for those suppliers requiring them, and will perform inspections on
reenrolling suppliers as required to verify information. It further states
that all suppliers are subject to on-site inspections upon initial
enrollment and reenrollment, except physicians, certified Medicare
suppliers, and supplier chains with 25 or more locations. Certified
Medicare suppliers include hospitals; skilled nursing facilities; home
health agencies; clinics, rehabilitation agencies, and public health
agencies; comprehensive outpatient rehabilitation facilities; hospices;
critical access hospitals; and community mental health centers. The
statement of work also provides that NSC, at reenrollment, does not have
to conduct on-site inspections of suppliers with $34,000 or less in
allowed charges in the previous year. According to CMS, NSC is responsible
for conducting enrollment and reenrollment on-site inspections for all
suppliers listed as not exempt.

15NSC also requires suppliers to name NSC as a certificate holder for
their liability insurance, which means that an insurer must notify NSC
when a supplier's policy is cancelled.

On-site Inspection Procedures

16NSC began requiring photographic evidence as part of the on-site
inspection in December 2003.

Enrollment, Disenrollment, and Appeals

Other NSC Efforts to Verify Suppliers' Compliance with Medicare's Standards

17Federal health care programs include Medicare, Medicaid, and all other
plans and programs that provide health benefits funded directly or
indirectly by the United States (other than the Federal Employees Health
Benefits Program).

18First-time applicants for enrollment can be denied, while DMEPOS
suppliers currently enrolled in the program that are renewing their
applications for billing privileges may have their current billing numbers
revoked. DMEPOS suppliers must renew their Medicare enrollment application
every 3 years.

19The Medicare Prescription Drug, Improvement, and Modernization Act of
2003 gave suppliers the right, after December 8, 2004, to take their
second level of appeal to an administrative law judge. Suppliers
dissatisfied with the decision of the administrative law judge can pursue
additional judicial appeals. Pub. L. No. 108-173, S: 936(a)(2), 117 Stat.
2066, 2411-2412 (to be codified at 42 U.S.C. S: 1395cc(j)).

NSC's Efforts Are Insufficient to Verify Suppliers' Compliance with the 21
                                   Standards

NSC's Procedures to Verify State Licenses Have Gaps

                                                 Florida Louisiana      Texas 
Number of suppliers that should not have                                   
billed for oxygen                                  62        14         45
As a percentage of all suppliers paid at                                   
least $1,000 for oxygen services in the                         
state                                             6.4      10.9        6.4
Oxygen payments to suppliers that should                                   
not have billed for oxygen                 $3,299,445  $855,659 $1,831,868
As a percentage of payments to all                                         
suppliers paid at least $1,000 for oxygen                       
services in the state                             2.4       4.6        1.5
Number of suppliers that should not have                                   
billed for oxygen and also lacked the                           
appropriate state license in 2004a                  7         3         12
Payments to suppliers that should not have                                 
billed for oxygen and lacked the                                
appropriate state license in 2004a            $41,382   $25,322   $165,026

20Custom-fabricated orthotic devices are braces that are individually
fabricated for a specific patient. For our analysis, we used a list of
codes developed by CMS to identify prosthetic devices and
custom-fabricated orthotic devices.

21We restricted our analysis to suppliers with at least $1,000 in
prosthetics or custom-fabricated orthotics payments.

22A Region C DME regional carrier official told us that it was not
routinely identifying and assessing overpayments against suppliers that
have been identified as billing without the proper state licenses and CMS
has not directed it to do so. The DME regional carrier assessed
overpayments for prosthetics and custom-fabricated orthotics claims
against the suppliers in Florida cited above after receiving permission to
do so by the CMS satellite field office in Miami. The overpayment
assessments were established based on information from investigations and
medical review of claims that suggested many of these payments were not
proper. In its comments on a draft of this report, CMS informed us that
NSC has begun providing specific information to the DME regional carriers
regarding when a DMEPOS supplier's license on file has expired, with
instructions to develop and collect an overpayment for any items or
services furnished after licensure has lapsed.

23In response to the rise in suspicious prosthetics and custom-fabricated
orthotics billing, Region C DME regional carrier staff began several
special projects, such as requiring suppliers to provide documentation to
back up their claims before paying for 148 prosthetic and orthotic items
and investigating and referring 74 cases to law enforcement.

2442 U.S.C. S: 1395m(h)(1)(F) (2000).

NSC Has Not Conducted All of the Routine On-site Inspections Required to Verify
Standards

25After excluding all of the types of suppliers NSC is not required to
inspect at enrollment and reenrollment, we analyzed NSC's active supplier
data file to determine whether all of the suppliers for which an on-site
inspection was required had one listed. We found that 14 percent-3,684-of
the enrolled suppliers that should have received an on-site inspection did
not have an inspection date recorded. NSC reviewed our random sample of 67
of these 3,684 suppliers. In most cases, the suppliers without an on-site
inspection date recorded had received one, but NSC had not updated its
supplier database. However, 11 of the 67 suppliers did not receive the
required on-site inspection. Based on this sample, we estimated that
between 545 and 667 of the 3,684 suppliers had not received an on-site
inspection, based on a confidence interval of + or - 10 percent.

26On April 1, 2005, NSC informed us that it had implemented edits in its
supplier data system to ensure that on-site inspections conducted after
August 20, 2004, were recorded.

NSC's Procedures for Conducting On-site Inspections May Limit Their
Effectiveness in Verifying Compliance with Standards

27In these cases, the chains also include other locations with supplier
billing numbers that are either inactive or revoked.

28Falsely certifying beneficiaries' medical need for DMEPOS items is a
violation of the standard that requires suppliers to comply with all
applicable federal regulatory requirements, and may constitute a civil or
criminal offense.

29In addition, the inspectors were not told exactly why NSC was suspicious
of these suppliers-for example, whether it was due to their billing
patterns or to their connection to an ongoing investigation of other
suppliers. Understanding why the inspection was taking place could help
focus the inspector's review.

30We analyzed fiscal year 2004 appeals to CMS by suppliers that had their
billing numbers denied or revoked, in part because they did not have
inventory to fill orders, to identify suppliers that provided contracts
with the same companies as their sources of inventory in order to contest
the revocations.

31Banks and other financial institutions are required to file reports on
currency transactions of $10,000 or more. 31 C.F.R. S: 103.22 (2004).
These reports assist law enforcement in identifying financial transactions
that may be associated with criminal activities.

NSC Is Not Required by Contract to Conduct a Minimum Number of Out-of-cycle
On-site Inspections

32See GAO-05-43 .

33NSC has focused its review on nonchain suppliers, based on its previous
experience with the suppliers found most likely to have problematic
billing.

Medicare's Standards Are Too Weak to be Used Effectively to Screen DMEPOS
                                   Suppliers

34Pub. L. No. 108-173, S: 302(b), 117 Stat. 2066, 2224-2228.

Medicare's Standards Lack Assessment of Integrity and Capability Like Those for
Federal Contractors and Some State Medicaid Suppliers

3548 C.F.R. S: 9.104-1 (2004). A federal officer awarding a contract has
broad discretion to use any current facts indicating financial weakness in
making responsibility determinations, such as the firm's profitability,
ratio of assets to liabilities, liquidity of assets, and credit ratings.
In addition, a prospective contractor must have the "necessary
organization, experience, accounting and operational controls, and
technical skills or the ability to obtain them." This is often determined
by examining the prior experience of the prospective contractor, its past
performance, the past performance of a predecessor firm, and the
experience of the principal officers.

36Termination for convenience means the federal government completely or
partially terminates a contractor's performance of work under the contract
when it is in the government's interest. Termination for default means the
federal government completely or partially terminates a contract because
of the contractor's actual or anticipated failure to perform its
contractual obligations. 48 C.F.R. S: 2.101 (2004).

3748 C.F.R. S:S: 9.406-2 and 9.406-4 (2004).

38The Medicare standard for a physical location does not forbid suppliers
from operating out of their homes.

39Costec Assocs., B-215827, Dec. 5, 1984, 84-2 CPD P: 626.

Medicare Suppliers Do Not Face the Same Penalties for Not Meeting Federal
Requirements as Contractors and Medicaid Suppliers

40HHS also has authority to debar entities that engage in nonprocurement
transactions with the department. See 45 C.F.R. pt. 76 (2004). HHS
officials that we contacted were not aware of this authority ever being
used to debar Medicare suppliers. A CMS official indicated that the
supplier-specific regulations are used to address noncompliant DMEPOS
suppliers.

41In practice, federal agencies do not always use their authority and
sometimes continue to contract with companies that have failed to perform
adequately or have shown a lack of integrity in performing their
contracts.

42Mayfair Constr. Co., B-192023, Sept. 11, 1978, 78-2 CPD P: 187.

43See Garten-und Landschaftsbau GmbH Frank Mohr, B-237276, Feb. 13, 1990,
90-1 CPD P: 186; see also Becker and Schwindenhammer, GmbH, B-225396, Mar.
2, 1987, 87-1 CPD P: 235.

44This requirement applies to all providers, not just suppliers.

45The state can also disenroll providers after the first year, but the
process to do so is more complex.

46After discovering significant fraud among DME suppliers, California
Medicaid required all DME suppliers to reapply in 2000. Less than half
reenrolled. California Medicaid has not enrolled any DME suppliers since
that time. Any supplier disenrolled after 2000 cannot be reenrolled until
the state begins a new reenrollment cycle for DME suppliers, which the
state does not plan to do in the near term.

Table 2: Examples of Suppliers That Had Billing Privileges Revoked, Were
Reinstated, and Billed Improperly After Readmission into Medicare

                        Revocation                                            
                        period (in  Improper billing closely following        
Revocation basis        months)  readmission
Noncompliance with            5  After reenrollment in early 2004,         
five standards,                  Wonderful Medical Supply Company          
including providing              submitted claims totaling about $2.6      
oxygen and orthotics             million and was paid about $1.27 million, 
without a state                  predominantly for one type of layered     
license and not                  bandage. Because Wonderful Medical        
having an active                 Supply's billing was suspicious, the DME  
liability insurance              regional carrier began to review claims   
policy, business                 from this supplier. Most of the claims it 
telephone number, or             submitted in the fall of 2004 were denied 
inventory.                       and the DME regional carrier collected    
                                    overpayments of almost $500,000 for       
                                    claims that had previously been paid      
                                    improperly. The supplier's enrollment in  
                                    Medicare was terminated in late 2004. The 
                                    supplier was also under criminal          
                                    investigation by federal and local law    
                                    enforcement for health care fraud in      
                                    2005.                                     
Noncompliance with            3  After being reenrolled in Medicare,       
six standards,                   Fabulous Medical Supply in Miami, Florida 
including billing                was investigated by the Region C DME      
for orthotics                    regional carrier because of suspicions    
without the proper               that it was not providing items as        
state license, not               billed. In 2004, it was paid almost $1.4  
having inventory,                million by Medicare for one colostomy     
not offering                     supply item that was being abusively      
beneficiaries the                billed by a number of suppliers during    
required option of               this period. Because of the abusive       
renting equipment,               billing, payments for this item increased 
and not having the               over 14,000 percent in a year in the      
ability, or a                    region. To combat the abusive billing,    
contract, to repair              starting in May 2004, the DME regional    
broken equipment.                carrier requested additional              
                                    documentation-such as physicians'         
                                    orders-from all of the suppliers billing  
                                    this item to support their claims.        
                                    Fabulous Medical Supply did not provide   
                                    any documentation to support its billing, 
                                    and its subsequent claims for this item   
                                    were denied. The DME regional carrier     
                                    suspended payments to Fabulous Medical    
                                    Supply during the summer of 2004 and      
                                    revoked its billing number in 2005 after  
                                    the supplier's liability insurance        
                                    lapsed. In 2004, Fabulous Medical Supply  
                                    was paid almost $2.7 million by Medicare, 
                                    but $1.6 million is currently being held  
                                    by the DME regional carrier, pending      
                                    determination of overpayments, and almost 
                                    $200,000 has been established as an       
                                    overpayment owed to Medicare. This        
                                    supplier was under criminal investigation 
                                    by federal and local law enforcement for  
                                    health care fraud as of July 2005.        

Source: GAO.

Note: We are using aliases for these suppliers, because they are currently
or have been under active investigation by federal and local law
enforcement. This table is based on information provided by the Region C
DME regional contractor's benefit integrity unit.

CMS's Efforts to Strengthen the Supplier Standards and Other Recent Steps May
Partially Address Identified Weaknesses

According to NSC and CMS officials, strengthening the supplier standards
by increasing their specificity is an important step in preventing
enrollment of suppliers that are intent on committing fraud. NSC and CMS
officials agreed that the inventory and physical facility standards are
not specific enough. These standards do not specify the characteristics of
an inventory, or the amount, type, or source of inventory that should be
required for the items or services the supplier intends to provide to
Medicare beneficiaries. According to these officials, the lack of
specificity in the standards has allowed suppliers that were not
legitimate companies to acquire Medicare billing numbers and then defraud
the program. NSC and OIG officials investigating enrolled suppliers with
potentially fraudulent billing reported that many had physical facilities
not conducive to conducting a legitimate DMEPOS business. For example,
these investigators have found multiple suppliers located in close
proximity in small suites in the same building. In addition, they found
suppliers in buildings that were not located where beneficiaries were
likely to come and purchase DMEPOS items. The investigators also reported
finding DMEPOS suppliers operating out of their houses and garages.47
These suppliers had few DMEPOS items in stock, but claimed that they had
contracts for acquiring inventory. These documents sometimes lacked the
usual elements of a contract, such as the clear signature of authorized
individuals from both companies and the time period for the contract.
Nevertheless, these suppliers met the current standards.

In early 2004, based on NSC proposals, CMS drafted new guidance on the
current supplier standards to make them more specific. For example, CMS
added more details to describe what constituted a reasonable amount of
inventory, the elements of an acceptable contract for inventory, and an
appropriate physical facility from which to provide items and services to
Medicare beneficiaries. As of June 2005, CMS had not issued the new
guidance. According to an agency official, some of the revisions have been
incorporated into a proposed regulation under review within the agency.
The official told us that CMS plans to issue other changes through
revisions of Medicare guidance manuals, once the proposed regulation had
been issued.

In addition to the new guidance, provisions of the MMA that require CMS to
develop quality standards for DMEPOS suppliers and competitive bidding,
when implemented, could enhance the agency's ability to screen suppliers.
The MMA requires CMS to develop quality standards for all DMEPOS suppliers
and to select one or more independent accreditation organizations that
will apply these standards to determine if suppliers are meeting them.48
CMS has not finished its development of the quality standards, so it is
not clear whether the standards will incorporate requirements for
suppliers to demonstrate that they have the integrity and capability to
perform their functions analogous to the standards for federal
contractors. In addition, the MMA requires CMS to establish competitive
bidding among suppliers for DME, supplies, off-the-shelf orthotics, and
enteral nutrients and related equipment and supplies in at least 10 of the
largest metropolitan areas by 2007 and in 80 of these areas by 2009. The
MMA will require suppliers chosen by competitive bidding to comply with
the quality standards that are being developed for all DMEPOS suppliers as
well as new financial standards to be specified by the Secretary. However,
competitive bidding will be limited to certain DMEPOS items and
localities, so not all Medicare DMEPOS suppliers will be held to the new
financial standards. CMS anticipates issuing a proposed rule in the fall
of 2005 on DME competitive bidding and on quality standards and
accreditation and a final rule in 2006.

47One supplier recently investigated by the FBI and the OIG was located in
a gym and fitness center.

 CMS's Oversight Is Insufficient to Determine Whether NSC Screens and Monitors
                             Suppliers Effectively

CMS's oversight has not been sufficient to determine whether NSC is
meeting its responsibilities in screening, enrolling, and monitoring
DMEPOS suppliers. CMS was unaware-until we informed the agency-that NSC
had not conducted all required on-site inspections of suppliers.
Furthermore, CMS did not know that, in contrast to its requirements, NSC's
procedures allow its staff to use discretion in selecting which suppliers
received on-site inspections. In addition, CMS did not recognize gaps in
NSC's verification of suppliers' state licenses and as a result, Medicare
paid suppliers whose licenses the contractor did not verify.

During our review, we found weaknesses in the methods CMS uses to oversee
its contractor that could lead to the agency not recognizing problems in
the verification process. CMS evaluates NSC's performance primarily
through an annual inspection. During this inspection, CMS analyzes a small
random sample of supplier files to determine, for instance, whether NSC is
conducting on-site inspections, processing enrollment applications, and
handling appeals of denied or revoked billing privileges in accordance
with its requirements. The analysis of NSC's supplier files is CMS's most
direct means of assessing NSC's efforts to screen and enroll suppliers;
however, we determined that CMS's past practice of basing NSC's
performance on a sample selected from a single quarter of the year may not
be adequate. NSC's performance might differ during the quarters in which
it was not reviewed. CMS also recognized problems with basing its review
on a single quarter, and in October 2004 began to institute quarterly
reviews of a sample of supplier files. However, if any problems are
uncovered, the sample sizes examined by CMS are too small to be used as a
means of oversight, relative to the number of application files processed
and other type of files reviewed. During fiscal year 2004, NSC processed
more than 58,000 supplier applications for enrollment or reenrollment. To
evaluate NSC's efforts to enroll suppliers during its fiscal year 2004
inspection, CMS examined a sample of 10 approved supplier applications, as
well as 10 denied and 10 returned applications. To evaluate NSC's efforts
to reenroll suppliers, CMS examined a sample of 20 approved reenrollments.
If CMS uncovered any problems, it would need to select a much larger
sample to determine if the problems were systemic, a step that is not
indicated in the evaluation protocol.

48Pub. L. No. 108-173, S: 302(a), 117 Stat. 2066, 2223-2224.

CMS's evaluation of NSC's performance is focused primarily on whether the
suppliers' applications are filled out and processed correctly-not whether
NSC has conducted the required verification tasks thoroughly. For example,
while NSC may have a supplier site inspection form with the boxes checked
to indicate that a supplier is complying with various standards-such as
the one to maintain documentation of delivery of items to
beneficiaries-CMS cannot know from reviewing the form if the inspector
checking that supplier actually examined any beneficiary files.

CMS also oversees NSC through reviewing monthly reports from NSC, but this
does not provide information on the thoroughness of NSC's screening and
enrollment efforts. Instead, CMS reviews the monthly reports to monitor
NSC's workload-including the number of enrollment and reenrollment
applications received, pending, approved, and returned; the timeliness in
processing applications; the number of denials and revocations; and the
timeliness with which NSC handles inquiries from suppliers. This
monitoring is important to ensure that NSC is managing its workload, but
does not inform CMS as to how well NSC performs these activities.

Finally, while CMS has established performance goals in NSC's contract
related primarily to processing supplier applications and managing other
aspects of NSC's workload-such as handling inquiries-it has not
established performance goals connected to effectiveness of the screening
or fraud prevention efforts. CMS uses both the annual inspection and the
monthly reports to measure NSC's performance against goals established in
its contract. These goals are linked to timeliness in processing
suppliers' applications, appeals, and inquiries. For example, according to
its contract, NSC must

           o  process 90 percent of all applications and reenrollments
           accurately within 60 calendar days of receipt and 99 percent of
           applications within 120 calendar days of receipt,
           o  process 90 percent of appeals accurately within 60 calendar
           days of receipt, and
           o  answer 85 percent of supplier telephone calls within the first
           60 seconds.

           These performance measures do not indicate the success of NSC or
           its SACU in identifying noncompliant and fraudulent suppliers.
           Further, CMS's contract requires NSC to maintain a SACU,49 but the
           contract does not establish outcomes expected from this unit.
           Similarly, in its annual inspection, CMS does not evaluate the
           SACU's efforts-whether, for instance, the SACU has adequately
           educated suppliers, adequately supervised the quality of on-site
           inspections, or analyzed supplier enrollment and billing data so
           that NSC can identify suppliers for additional inspections.

           CMS is responsible for assuring that Medicare beneficiaries have
           access to the equipment, supplies, and services they need, and at
           the same time, for protecting the program from abusive billing and
           fraud. The supplier standards and NSC's gatekeeping activities
           were intended to provide assurance that potential suppliers are
           qualified and would comply with Medicare's rules. However, there
           is overwhelming evidence-in the form of criminal convictions,
           revocations, and recoveries-that the supplier enrollment processes
           and the standards are not strong enough to thoroughly protect the
           program from fraudulent entities.

           We believe that CMS must focus on strengthening the standards and
           overseeing the supplier enrollment process. It needs to better
           focus on ways to scrutinize suppliers to ensure that they are
           responsible businesses, analogous to federal standards for
           evaluating potential contractors. CMS's current effort to develop
           additional guidance on the standards and the development of
           quality standards for DMEPOS suppliers provide an opportunity for
           the agency to establish stronger requirements for potential and
           enrolled suppliers. Developing more rigorous quality standards
           that include an assessment of suppliers' performance, integrity,
           and financial, managerial, and technical ability would help ensure
           that only qualified companies became suppliers. Suppliers whose
           previous performance was poor or that demonstrated a lack of
           integrity should not be allowed to quickly reenter the program.
           CMS also needs to provide more specific requirements in NSC's
           contract so that the program's policies will be consistently
           carried out. Finally, we believe that CMS has not adequately
           evaluated NSC's activities to ensure that it is meeting all of its
           responsibilities and using all of the tools available to identify,
           and address, problem suppliers.

           The Congress should consider whether suppliers that have violated
           standards should have to wait a specified period of time from the
           date of revocation to have a billing number reissued.

           To improve the supplier enrollment process and oversight of NSC,
           we recommend that the Administrator of CMS take eight actions-five
           related to NSC's efforts to verify DMEPOS suppliers' compliance
           with the 21 standards, one related to the supplier standards, and
           two related to the agency's oversight of NSC. We recommend that
           CMS:

           o  Starting in states where licensure is mandatory, require NSC to
           routinely check suppliers' billing for oxygen, prosthetics,
           orthotics, and any other items requiring licensure, against the
           items the suppliers declared they are providing on applications.
           Where suppliers are billing for services not declared, take
           appropriate action to revoke the billing numbers of suppliers not
           complying with program requirements.
           o  Require NSC to provide information from suppliers' billing
           histories to inspectors before they conduct on-site inspections to
           help them collect information to assess whether suppliers'
           inventory or contracts to obtain inventory are congruent with the
           suppliers' Medicare payments.
           o  When suppliers report having inventory that is primarily
           maintained off site or supplied through another company, require
           NSC to evaluate the legitimacy of the supply location or source
           and any related contracts.
           o  As part of the on-site inspections, require inspectors to
           review, and provide information to NSC analysts on the contents
           of, a minimum number of patient files to determine supplier
           adherence to standards for maintaining documentation of services
           and information provided to beneficiaries.
           o  Oversee NSC's activities to ensure that it conducts on-site
           inspections of suppliers as required by CMS and maintains accurate
           data on the on-site inspections it conducts.
           o  Establish a minimum number of out-of-cycle on-site inspections
           in its contract that NSC must perform each year.
           o  Develop standards that incorporate requirements for suppliers
           to demonstrate that they have the integrity and capability to
           perform their functions analogous to the standards for federal
           contractors.
           o  Revise current evaluation procedures to fully assess the
           outcomes expected from the SACU's activities and NSC's adherence
           to contract requirements.

           In its written comments on a draft of this report, CMS generally
           concurred with our eight recommendations and cited actions it is
           taking to implement each recommendation. It also affirmed its
           commitment to protect beneficiaries and Medicare from fraud,
           waste, and abuse by ensuring that NSC only enrolled qualified
           suppliers and enforced the supplier standards.

           CMS agreed with our five recommendations related to improving
           NSC's efforts to verify DMEPOS suppliers' compliance with the 21
           standards. In response to four of these recommendations, CMS
           stated that it has revised the statement of work for fiscal year
           2006 to require NSC to:

           o  check suppliers' licenses and liability insurance each year,
           rather than every 3 years at reenrollment, and compare suppliers'
           billing histories to the licenses they provide at that time;
           o  provide on-site inspectors with the billing histories of DMEPOS
           suppliers they are reviewing;
           o  conduct site inspections of suppliers' off-site inventory
           storage locations and of businesses that provide them with
           inventory through contracts; and
           o  conduct out-of-cycle inspections, the number of which CMS will
           manage based on NSC's workload and budgetary constraints.

           In addition to the completed revisions, to address the other
           recommendation related to NSC's efforts to verify suppliers'
           compliance with the 21 standards, CMS indicated that it intends to
           further revise the statement of work to require site inspectors to
           review a minimum number of beneficiary files maintained by
           suppliers.

           CMS also agreed with our recommendation to develop standards for
           suppliers to ensure they have the integrity and capability to
           perform their functions analogous to the standards for federal
           contractors. In its response to that recommendation, CMS indicated
           that the quality standards the agency is developing for suppliers
           will improve its ability to deter health care fraud and abuse. The
           agency stated that it will publish a proposed rule to implement
           the standards in the fall of 2005 and expects to issue a final
           rule in 2006.

           Finally, to address the two recommendations on improving its
           oversight, CMS stated that it intends to more closely review NSC's
           activities to ensure that the contractor conducts on-site
           inspections as required and maintains accurate data on these
           inspections. CMS also noted that it had expanded its oversight and
           evaluation procedures during fiscal year 2005 to include quarterly
           reviews of NSC and SACU enrollment functions. CMS's written
           comments on a draft of this report are included in appendix III.
           CMS also provided technical comments, which we included as
           appropriate.

           As agreed with your office, unless you publicly announce its
           contents earlier, we plan no further distribution of this report
           until 30 days after its issue date. At that time, we will send
           copies of this report to the Administrator of CMS, appropriate
           congressional committees, and other interested parties. We will
           also make copies available to others upon request. This report is
           also available at no charge on GAO's Web site at
           http://www.gao.gov .

           If you or your staff have any questions about this report, please
           contact me at (312) 220-7600 or [email protected]. Contact points
           for our Offices of Congressional Relations and Public Affairs may
           be found on the last page of this report. GAO staff who made major
           contributions to this report are listed in appendix IV.

           Sincerely yours,

           Leslie G. Aronovitz Director, Health Care

           To evaluate the National Supplier Clearinghouse's (NSC) efforts to
           verify suppliers' compliance with the 21 standards, we conducted
           interviews, document reviews, field inspections, investigations,
           and data analysis. We interviewed the Centers for Medicare &
           Medicaid Services (CMS) officials that oversee NSC and NSC staff,
           assessed CMS's contract statement of work for enrollment
           screening, and reviewed NSC's written procedures to gain a better
           understanding of the procedures used. Through that assessment, we
           determined that its procedures to check licensure and conduct
           on-site inspections of suppliers were critical to verifying
           compliance with the standards and we focused our evaluation on
           these procedures. To better understand the on-site inspection
           process, we accompanied NSC officials as they conducted on-site
           inspections of 12 suppliers in Maryland during August 9 and 10,
           2004. In addition, to test the effectiveness of the licensure
           verification, we analyzed Medicare durable medical equipment,
           orthotics, prosthetics, and supplies (DMEPOS) claims data for 2003
           and 2004 from Florida, Illinois, Louisiana, and Texas 1 and NSC's
           active supplier data file to determine whether suppliers had the
           licenses necessary for items billed. We also tested whether all
           required on-site inspections had been conducted through an
           analysis of NSC's active supplier data file and inspection
           procedures. To assess the reliability of the 2003 and 2004 claims
           from CMS and NSC's supplier data files, we performed electronic
           testing of required data elements, reviewed existing information
           about the data and the systems that produced them, and interviewed
           CMS and NSC officials knowledgeable about the data. We determined
           that these data were sufficiently reliable for the purposes of
           this report. We also contacted Florida, Texas, and Louisiana to
           determine which of the suppliers that had not disclosed to NSC
           that they would be providing oxygen and were paid at least $1,000
           for oxygen claims in 2004 actually had the needed state licenses.
           In addition, we also checked with these states to determine
           whether a small sample of suppliers that had disclosed the
           intention to bill for oxygen, and were paid at least $1,000 for
           oxygen claims in 2004, had the needed state licenses. For
           custom-fabricated orthotics and prosthetics, we were not able to
           confirm whether the suppliers that had not disclosed to NSC that
           they would be providing these items and were paid at least $1,000
           for such claims in 2004 in Florida, Illinois, and Texas had the
           proper state licenses, because those states license individuals to
           be allowed to supply these items, not companies. To evaluate
           procedures for on-site inspections, we analyzed on-site inspection
           instructions and the standards and interviewed on-site inspectors
           and officials in NSC and Overland Solutions, Inc. We investigated
           two companies cited as sources of inventory by two groups of
           Florida and Texas suppliers that had their billing privileges
           denied or revoked, in part because of inventory issues, and also
           investigated those suppliers.

           To evaluate the adequacy of the 21 supplier standards, we compared
           them to the requirements for government contractors and those
           imposed by the California and Florida Medicaid program on
           suppliers. In addition, we analyzed cases of revocations that had
           been appealed to CMS in 2004 to determine if weaknesses in the
           standards were leading to suppliers with questionable billing
           practices being reinstated in the program. We also obtained
           documentation on cases of suppliers that had defrauded Medicare
           and interviewed fraud inspectors at NSC and in the Department of
           Health and Human Services Office of Inspector General to develop
           insight into the problems that they saw with the 21 standards. We
           also interviewed NSC and CMS officials and individuals from the
           following organizations: the American Association for Homecare,
           the American Orthotic and Prosthetic Association, Hoveround,
           National Association for Home Care and Hospice, Power Mobility
           Coalition, and a representative from the National Supplier
           Clearinghouse's Advisory Council.

           To evaluate CMS's oversight of NSC, we considered the information
           we had gathered to answer the previous questions. We reviewed
           CMS's written procedures used to evaluate NSC and other documents
           related to CMS's oversight. We also discussed CMS's oversight with
           CMS and NSC officials.

           Our work was conducted from June 2004 to September 2005 in
           accordance with generally accepted government auditing standards.

           Suppliers of durable medical equipment (DME), prosthetics,
           orthotics, and supplies must meet 21 standards in order to obtain
           and retain their Medicare billing privileges. The NSC is
           responsible for screening suppliers to ensure that they meet the
           standards. An abbreviated summary of the most recent version of
           these standards, which became effective December 11, 2000, is
           presented in table 3. The Medicare Prescription Drug, Improvement,
           and Modernization Act of 2003 requires CMS to develop quality
           standards that must be at least as stringent as current standards
           for all Medicare suppliers of DME, prosthetics, orthotics, and
           supplies. Supplier compliance with the quality standards will be
           determined by one or more designated independent accreditation
           organizations.

                                  Conclusions

49According to NSC's contract, the SACU must educate suppliers about the
Medicare application process; participate in Medicare and DME
regional-carrier-sponsored fraud conferences, meetings, and discussions;
serve as a point of contact with GAO, the OIG, and the FBI on NSC-related
Medicare fraud issues; establish contacts among governmental fraud
prevention agencies; support the on-site inspection process; and take
whatever steps it deems necessary, including appropriate travel, in
compliance with existing laws and regulations to prevent fraudulent
suppliers from gaining and keeping access to the Medicare program.

                     Matter for Congressional Consideration

                                Recommendations

                                Agency Comments

Appendix I: Objectives, Scope, and Methodology Appendix I: Objectives,
Scope, and Methodology

1These states were chosen because they have licensure requirements for
certain DMEPOS items and are known to have suppliers with fraudulent
Medicare DMEPOS billings.

Appendix II: Medicare's 21 Standards for Suppliers and NSC's Procedures to
Verify Their Compliance Appendix II: Medicare's 21 Standards for Suppliers
and NSC's Procedures to Verify Their Compliance

Table 3: Medicare's 21 Standards for Medicare Suppliers of DME,
Prosthetics, Orthotics, and Supplies and NSC's Procedures at Enrollment
and Reenrollment to Verify Compliance with the Standards

Standard Standard's description of                                         
number   what supplier must do       NSC's verification procedures
1        Comply with all applicable  Desk review - The NSC enrollment      
            federal and state           analyst matches the supplier's legal  
            licensure and regulatory    business name in the application to   
            requirements.               the legal business name listed in     
                                        Internal Revenue Service forms and on 
                                        licenses. Through a computerized      
                                        edit, the analyst checks the listed   
                                        organizations and owners against the  
                                        General Services Administration       
                                        debarment list and the Office of      
                                        Inspector General's sanction list to  
                                        determine eligibility to receive      
                                        income from the Medicare Trust Funds. 
                                        The analyst also checks all names     
                                        listed in the supplier's application  
                                        against the CMS's Fraud Investigative 
                                        Database. The analyst matches         
                                        information in the application on the 
                                        type of supplier and products and     
                                        services to be furnished with state   
                                        licenses attached to the application. 
                                        If the license appears to be altered, 
                                        the analyst checks with the state to  
                                        determine if the state license is     
                                        valid.                                
                                                                              
                                        On-site inspection - The site         
                                        inspector is expected to collect      
                                        copies of applicable state, business, 
                                        and occupational licenses and a       
                                        listing of the names of owners and    
                                        records the information on the site   
                                        inspection form, if applicable.       
2        Provide complete and        NSC verifies compliance with this     
            accurate information on     standard through verification of the  
            the application and report  other standards.                      
            any changes to NSC within   
            30 days.                    
3        Have an authorized          NSC relies on supplier self-report    
            individual-whose signature  that an authorized individual, as     
            is binding-sign the         defined in the application, has       
            application.                signed.                               
4        Fill orders from its own    On-site inspection - The site         
            inventory or contracts      inspector takes photographs of        
            with other companies for    inventory and requests copies of the  
            the purchase of items       supplier's contracts with other       
            necessary to fill the       companies for the purchase of items.  
            order. A supplier may not   The site inspector may inspect or     
            contract with any entity    telephone the supplier listed in the  
            excluded from the Medicare  contract, if it is in the local area. 
            program or state health                                           
            care programs or from any   Desk review - The analyst reviews any 
            other federal procurement   contracts for inventory to determine  
            or nonprocurement program   whether the terms and conditions of   
            or activity.                the contracts are acceptable. The     
                                        analyst also contacts the vendor to   
                                        verify that the contract is           
                                        authentic.                            
5        Advise beneficiaries that   On-site inspection - The site         
            they may rent or purchase   inspector interviews the owner,       
            inexpensive or routinely    manager, or another responsible       
            purchased DME and of the    employee about the supplier's policy, 
            purchase option for capped  records the responses on the site     
            rental DME.                 inspection form, and collects a copy  
                                        of supplier's policy, if any.         
6        Honor all warranties under  On-site inspection - The site         
            applicable state law and    inspector interviews the owner,       
            repair or replace free of   manager, or another responsible       
            charge Medicare-covered     employee and records the responses on 
            items that are under        the site inspection form. The site    
            warranty.                   inspector collects a copy of          
                                        supplier's documentation, if any,     
                                        such as a written policy that the     
                                        supplier provides warranty            
                                        information to beneficiaries and      
                                        replaces items under warranty free of 
                                        charge. If the supplier does not have 
                                        the required policy or forms, the     
                                        site inspector educates the supplier  
                                        about what is needed to comply with   
                                        this standard and advises the         
                                        supplier of where a model warranty    
                                        information form can be obtained. The 
                                        supplier then has 48 hours from the   
                                        time of the inspection to provide any 
                                        needed documentation to the site      
                                        inspector.                            
7        Maintain a physical         On-site inspection - The site         
            facility on an appropriate  inspector interviews the owner,       
            site.                       manager, or another responsible       
                                        employee and records responses on the 
                                        site inspection form. The site        
                                        inspector takes photographs of the    
                                        physical facility to document the     
                                        site and its accessibility for        
                                        handicapped beneficiaries and records 
                                        the approximate size of the facility  
                                        on the site inspection form.          
                                                                              
                                        Desk review - The analyst reviews the 
                                        site inspection documents and         
                                        photographs to ensure that the        
                                        facility complies with the standard.  
8        Permit on-site inspections  On-site inspection - The site         
            to determine compliance     inspector inspects the physical       
            with the standards and      facility, records the posted hours on 
            maintain an appropriate     the site inspection form, and         
            physical facility           determines if the location is open    
            accessible to               during that time period. The site     
            beneficiaries and to CMS    inspector also records on the site    
            during reasonable business  inspection form whether customers are 
            hours, with a visible sign  in the facility during the inspection 
            and posted hours of         and whether the supplier shares space 
            operation.                  with another DMEPOS supplier or other 
                                        business. The site inspector also     
                                        photographs the signage, posted hours 
                                        of operation, and the physical        
                                        facility to document the site and its 
                                        accessibility for handicapped         
                                        beneficiaries.                        
                                                                              
                                        Desk review - The analyst reviews the 
                                        site inspection documents and         
                                        photographs to ensure that the        
                                        facility complies with the standard.  
                                        If the facility does not appear to be 
                                        accessible to handicapped             
                                        beneficiaries, the analyst contacts   
                                        the supplier to determine how it      
                                        accommodates the needs of these       
                                        individuals.                          
9        Maintain a primary          Desk review - The analyst verifies    
            business telephone listed   the telephone number and whether it   
            under the name of the       is listed at the supplier's facility  
            business in a local         by calling the supplier, contacting   
            directory or a toll-free    telephone directory assistance, and   
            number available through    using the Internet to check telephone 
            directory assistance. The   directories.                          
            exclusive use of a beeper,                                        
            answering service,          On-site inspection - The site         
            answering machine, pager,   inspector interviews the owner,       
            facsimile machine, or car   manager, or another responsible       
            phone as the primary        employee to determine where the       
            business telephone number   majority of the supplier's calls are  
            is prohibited.              received and records the responses on 
                                        the site inspection form. The site    
                                        inspector confirms the telephone      
                                        number by viewing the telephone       
                                        directory, telephone bills, or        
                                        contacting directory assistance.      
10       Have comprehensive          Desk review - The analyst verifies    
            liability insurance in the  the supplier's legal name and address 
            amount of at least          on the policy, the insurance policy   
            $300,000 that covers both   number, issue and expiration dates,   
            the supplier's place of     scope of insurance, and amount of     
            business and all customers  coverage. Effective August 1, 2004, a 
            and employees of the        supplier's underwriter is requested   
            supplier. If the supplier   to notify NSC of any changes in the   
            manufactures its own        supplier's comprehensive liability    
            items, this insurance must  insurance policy.                     
            also cover product                                                
            liability and completed     On-site inspection - The site         
            operations.                 inspector obtains a copy of the       
                                        insurance policy, if necessary, and   
                                        records the information on the site   
                                        inspection form.                      
11       Agree not to initiate       On-site inspection - The site         
            telephone contact with      inspector interviews the owner,       
            beneficiaries, with a few   manager, or another responsible       
            exceptions allowed, and is  employee and records the response on  
            prohibited from using       the site inspection form.             
            telephone contact to        
            solicit new business.       
12       Be responsible for          On-site inspection - The site         
            delivery, document that     inspector interviews the owner,       
            beneficiaries were          manager, or another responsible       
            instructed on the use of    employee, requests a copy of the      
            Medicare-covered items,     written delivery policy, and records  
            and maintain proof of       information on the site inspection    
            delivery.                   form. The site inspector may review   
                                        beneficiary files to check for proof  
                                        of delivery.                          
13       Answer questions and        On-site inspection - The site         
            respond to complaints of    inspector interviews the owner,       
            beneficiaries, and          manager, or another responsible       
            maintain documentation of   employee, requests a copy of the      
            such contacts.              written complaint policy, views the   
                                        complaint log, and records            
                                        information on the site inspection    
                                        form. The site inspector may review   
                                        beneficiary files to check for        
                                        communications about complaints.      
14       Must maintain and replace   On-site inspection - The site         
            at no charge or repair      inspector interviews the owner,       
            directly, or through a      manager, or another responsible       
            service contract with       employee, requests a copy of any      
            another company,            written repair policy, if it exists,  
            Medicare-covered items it   and records the information on the    
            has rented to               site inspection form. The site        
            beneficiaries.              inspector may also check beneficiary  
                                        files to review maintenance records   
                                        of equipment that has been supplied.  
15       Accept returns of           On-site inspection - The site         
            substandard (less than      inspector interviews the owner,       
            full quality) or            manager, or another responsible       
            unsuitable (inappropriate   employee, collects the written return 
            for the beneficiary at the  policy, if any, and records           
            time it was fitted and      information on the site inspection    
            sold) items from            form.                                 
            beneficiaries.              
16       Disclose the supplier       On-site inspection - The site         
            standards to each of the    inspector interviews the owner,       
            beneficiaries served.       manager, or another responsible       
                                        employee about how the supplier       
                                        discloses the standards to            
                                        beneficiaries and records the         
                                        information on the site inspection    
                                        form. The site inspector determines   
                                        if the supplier is using the current  
                                        standards and, if not, advises the    
                                        supplier of the regulatory            
                                        requirement and provides the supplier 
                                        with a copy of the current standards. 
17       Disclose to the government  Desk review - The analyst reviews     
            any person having           information provided in the           
            ownership, financial, or    application and uses the information  
            controlling interest in     as part of verification of standard 1 
            the DMEPOS supplier.        by determining if any listed owners   
                                        have been previously sanctioned or    
                                        disbarred.                            
                                                                              
                                        On-site inspection - The site         
                                        inspector interviews the owner,       
                                        manager, or other responsible         
                                        employee to elicit names of the       
                                        supplier's owners and managers, as    
                                        well as any other companies owned or  
                                        managed by these individuals, and     
                                        records the information on the site   
                                        inspection form.                      
18       Not sell, or allow another  NSC verifies through the same process 
            entity to use, its          as standard 17.                       
            Medicare billing number.    
19       Have a complaint            On-site inspection - The site         
            resolution protocol         inspector interviews the owner,       
            established to address      manager, or other responsible         
            beneficiary complaints      employee, obtains a copy of the       
            that relate to these        complaint resolution protocol and     
            standards and maintain a    complaint log, observes where         
            record of the complaints    complaint records are stored, and     
            at the physical facility.   records the information on the site   
                                        inspection form. If the supplier does 
                                        not have the required complaint       
                                        resolution protocol or log, the       
                                        inspector educates the supplier and   
                                        advises the supplier of where model   
                                        forms can be obtained. The supplier   
                                        has 48 hours from the time of the     
                                        inspection to provide the needed      
                                        documents to the site inspector.      
20       Include in its beneficiary  On-site inspection - The site         
            complaint records the       inspector obtains a copy of the       
            name, address, telephone    complaint log and records             
            number, and beneficiary     observations on the site inspection   
            insurance number; a         form. If the supplier does not have   
            summary of the complaint,   complaint records, the site inspector 
            including its resolution;   educates the supplier about the need  
            and any actions taken to    for them and advises the supplier     
            resolve it.                 about where model forms can be        
                                        obtained. The supplier has 48 hours   
                                        from the time of the inspection to    
                                        provide the needed documents to the   
                                        site inspector.                       
                                                                              
                                        Desk review - The analyst reviews the 
                                        complaint log obtained by the site    
                                        inspector to ensure that each         
                                        complaint record includes the         
                                        required information.                 
21       Agree to furnish CMS with   NSC verifies compliance with this     
            any information required    standard through verifying compliance 
            by the Medicare statute     with the other standards.             
            and implementing            
            regulations.                

Source: GAO analysis of 42 C.F.R. S: 424.57(c) (2004) and 42 C.F.R S:
420.206 (2004), CMS's Medicare Program Integrity Manual, NSC's contract
statement of work, NSC's procedures, the site inspection form, and
information from NSC officials.

Appendix III: Agency Comments Appendix III: Agency Comments

AAc Appendix IV: GAO Contact and Staff Acknowledgments

                                  GAO Contact

Leslie G. Aronovitz, (312) 220-7600 or [email protected]

                                Acknowledgments

In addition to the contact named above, Sheila K. Avruch, Assistant
Director; Kevin Dietz; Cynthia Forbes; Krister Friday; Christine
Hodakievic; Daniel Lee; Lisa Rogers; John Ryan; and Craig Winslow made key
contributions to this report.

Related GAO Products Related GAO Products

Medicare: CMS's Program Safeguards Did Not Deter Growth in Spending for
Power Wheelchairs. GAO-05-43 . Washington, D.C.: November 17, 2004.

Medicare: Past Experience Can Guide Future Competitive Bidding for Medical
Equipment and Supplies. GAO-04-765 . Washington, D.C.: September 7, 2004.

Medicare: CMS Did Not Control Rising Power Wheelchair Spending.
GAO-04-716T . Washington, D.C.: April 28, 2004.

Medicare: HCFA to Strengthen Medicare Provider Enrollment Significantly,
but Implementation Behind Schedule. GAO-01-114R . Washington, D.C.:
November 2, 2000.

(290389)

GAO's Mission

The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting its
constitutional responsibilities and to help improve the performance and
accountability of the federal government for the American people. GAO
examines the use of public funds; evaluates federal programs and policies;
and provides analyses, recommendations, and other assistance to help
Congress make informed oversight, policy, and funding decisions. GAO's
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost
is through GAO's Web site ( www.gao.gov ). Each weekday, GAO posts newly
released reports, testimony, and correspondence on its Web site. To have
GAO e-mail you a list of newly posted products every afternoon, go to
www.gao.gov and select "Subscribe to Updates."

Order by Mail or Phone

The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent of
Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more
copies mailed to a single address are discounted 25 percent. Orders should
be sent to:

U.S. Government Accountability Office 441 G Street NW, Room LM Washington,
D.C. 20548

To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061

To Report Fraud, Waste, and Abuse in Federal Programs

Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: [email protected]
Automated answering system: (800) 424-5454 or (202) 512-7470

Congressional Relations

Gloria Jarmon, Managing Director, [email protected] (202) 512-4400 U.S.
Government Accountability Office, 441 G Street NW, Room 7125 Washington,
D.C. 20548

Public Affairs

Paul Anderson, Managing Director, [email protected] (202) 512-4800 U.S.
Government Accountability Office, 441 G Street NW, Room 7149 Washington,
D.C. 20548

www.gao.gov/cgi-bin/getrpt? GAO-05-656 .

To view the full product, including the scope

and methodology, click on the link above.

For more information, contact Leslie G. Aronovitz at (312) 220-7600 or
[email protected].

Highlights of GAO-05-656 , a report to the Chairman, Committee on Finance,
U.S. Senate

September 2005

MEDICARE

More Effective Screening and Stronger Enrollment Standards Needed for
Medical Equipment Suppliers

In fiscal year 2004, the Centers for Medicare & Medicaid Services (CMS)
estimated that Medicare improperly paid $900 million for durable medical
equipment, prosthetics, orthotics, and supplies-in part due to fraud by
suppliers. To deter such fraud, CMS contracts with the National Supplier
Clearinghouse (NSC) to verify that suppliers meet 21 standards before they
can bill Medicare. NSC verifies adherence to the standards through on-site
inspections and document reviews. Recent prosecutions of fraudulent
suppliers suggest that there may be weaknesses in NSC's efforts to screen
suppliers or in the standards. In this report, GAO evaluated: 1) NSC's
efforts to verify suppliers' compliance with the 21 standards, 2) the
adequacy of the standards to screen suppliers, and 3) CMS's oversight of
NSC's efforts.

What GAO Recommends

GAO suggests that the Congress consider whether suppliers found to be
noncompliant should wait a specified period of time before having their
billing numbers reissued. GAO is also making several recommendations to
the CMS Administrator to improve NSC's licensure verification and on-site
inspections, the supplier standards, and CMS's oversight of NSC. CMS
generally concurred with all of the recommendations and provided
information on the actions it was taking to implement each of them.

NSC's efforts to verify compliance with the 21 standards are insufficient
because of weaknesses in two key screening procedures-checking state
licensure and conducting on-site inspections. NSC's licensure check is
ineffective because it relies on self-reported information about the items
suppliers intend to provide to beneficiaries and does not match this
against actual billing later. We found a total of 22 suppliers in Florida,
Louisiana, and Texas that had each been paid at least $1,000 by Medicare
in 2004 for providing oxygen services, but did not have the required state
license. Further, more than half of the almost $107 million paid by
Medicare for custom-fabricated orthotics and prosthetics in Florida in
2004 went to suppliers that had not had their licenses checked. At least
46 of these suppliers were under investigation for fraud as of April 2005.
NSC's on-site inspections also have weaknesses that limit their
effectiveness. We estimate that NSC did not conduct required on-site
inspections of 605 suppliers. Further, when conducting on-site
inspections, NSC does not require its inspectors to examine beneficiary
files to assess whether suppliers are meeting the standard to maintain
proof of delivery or check whether suppliers have a real source of
inventory, as required by Medicare.

Medicare's 21 standards are currently too weak to be used effectively to
screen medical equipment suppliers. Although Medicare paid suppliers about
$8.8 billion in fiscal year 2004, the program's 21 standards do not
include measures related to supplier integrity and capability analogous to
those that federal agencies generally apply to prospective contractors or
those used by at least two state Medicaid programs for their suppliers.
For example, in sworn testimony before the Committee on Finance in April
2004, an individual who pleaded guilty to Medicare fraud described how she
was able to open a sham business with $3,000-despite lacking the
experience and the financial, technical, and managerial resources to
operate a legitimate supply company. If an agency finds a company does not
meet federal contracting standards for integrity and capability, the
agency may decline to award it a contract. If a contractor performs
inadequately, the agency can terminate the contract. Further, agencies may
disqualify a contractor from competing for other federal contracts. In
addition, a California supplier that is disenrolled from Medicaid for
failing to meet state requirements cannot reenroll for 3 years. In
contrast, if a Medicare supplier can later demonstrate compliance with the
21 standards, CMS readmits it into the program.

CMS's oversight has not been sufficient to determine whether NSC is
meeting its responsibilities in screening and enrolling DMEPOS suppliers.
For example, CMS was unaware-until we informed the agency-that NSC had not
conducted all required on-site inspections for suppliers. Moreover, while
CMS has established performance goals for NSC related primarily to
processing applications, it has not established a method to evaluate NSC's
success in identifying noncompliant and fraudulent suppliers and
recommending that they be removed from the program.
*** End of document. ***