Medicare: Improvements Needed to Address Improper Payments for Medical Equipment and Supplies

Medicare: Improvements Needed to Address Improper Payments for
Medical Equipment and Supplies (31-JAN-07, GAO-07-59).

The Centers for Medicare & Medicaid Services (CMS)--the agency
that administers Medicare--estimated that the program made about
$700 million in improper payments for durable medical equipment,
prosthetics, orthotics, and supplies (DMEPOS) from April 1, 2005,
through March 31, 2006. To protect Medicare from improper DMEPOS
payments, CMS relies on three Program Safeguard Contractors
(PSC), and four contractors that process Medicare claims, to
conduct critical program integrity activities. GAO was requested
to examine CMS's and CMS's contractors' activities to prevent and
minimize improper payments for DMEPOS, and describe CMS's
oversight of PSC program integrity activities. To do this, GAO
analyzed DMEPOS claims data by supplier and item to identify
atypical, or large, increases in billing; reviewed CMS documents;
and conducted interviews with CMS and contractor officials. GAO
focused its work on contractors' automated prepayment controls
and described related claims analysis functions.
-------------------------Indexing Terms-------------------------
REPORTNUM: GAO-07-59
ACCNO: A65429
TITLE: Medicare: Improvements Needed to Address Improper
Payments for Medical Equipment and Supplies
DATE: 01/31/2007
SUBJECT: Claims
Claims processing
Contract oversight
Data integrity
Erroneous payments
Fraud
Health care programs
Internal controls
Medical equipment
Medicare
Program evaluation
Prosthetic devices
Systems integrity
Program goals or objectives

******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Product. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
GAO-07-59

* [1]Results in Brief
* [2]Background

* [3]DMEPOS Claims Processing
* [4]DMEPOS Program Integrity

* [5]Medical Review
* [6]Benefit Integrity

* [7]CMS's Program Integrity Activities Could Be Enhanced

* [8]PSCs Identify Atypical Billing Patterns and Use Edits to Add
* [9]Gaps with Medical Review Edits Can Lead to Improper Payments
* [10]PSC Case Referrals to Law Enforcement Are a Key Aspect of Be

* [11]CMS Oversees PSCs through Various Means, and Is Implementing
* [12]Conclusions
* [13]Recommendations for Executive Action
* [14]Agency Comments
* [15]Appendix I: DMEPOS Regions and Associated DME MACs and PSCs
* [16]Appendix II: Scope and Methodology
* [17]Appendix III: Agency Comments
* [18]Appendix IV: GAO Contact and Staff Acknowledgments

* [19]GAO Contact
* [20]Acknowledgments

* [21]Related GAO Products

* [22]Order by Mail or Phone

Report to the Ranking Minority Member, Committee on Finance, U.S. Senate

United States Government Accountability Office

GAO

January 2007

MEDICARE

Improvements Needed to Address Improper Payments for Medical Equipment and
Supplies

GAO-07-59

Contents

Letter 1

Results in Brief 4
Background 6
CMS's Program Integrity Activities Could Be Enhanced 10
CMS Oversees PSCs through Various Means, and Is Implementing Annual
Evaluations of Program Integrity Activities 17
Conclusions 19
Recommendations for Executive Action 19
Agency Comments 20
Appendix I DMEPOS Regions and Associated DME MACs and PSCs 22
Appendix II Scope and Methodology 23
Appendix III Agency Comments 26
Appendix IV GAO Contact and Staff Acknowledgments 28
Related GAO Products 29

Tables

Table 1: DMEPOS Claims Processing and Program Integrity Activities and
Associated Regional Contractor Type, as of January 2007 9
Table 2: Examples of Medically Improbable Claims and Possible Edits to
Address Them 13

Abbreviations

CMS Centers for Medicare & Medicaid Services
DME durable medical equipment
DME MAC Durable Medical Equipment Medicare Administrative Contractor
DMEPOS durable medical equipment, prosthetics, orthotics, and supplies
DMERC Durable Medical Equipment Regional Carrier
DOJ Department of Justice
FBI Federal Bureau of Investigation
HHS Department of Health and Human Services
JOA Joint Operating Agreement
NSC National Supplier Clearinghouse
OIG Office of Inspector General
PIM Medicare Program Integrity Manual
PSC Program Safeguard Contractor
SADMERC Statistical Analysis Durable Medical Equipment Regional
Carrier

This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.

United States Government Accountability Office

Washington, DC 20548

January 31, 2007 January 31, 2007

The Honorable Charles E. Grassley
Ranking Minority Member
Committee on Finance
United States Senate
The Honorable Charles E. Grassley
Ranking Minority Member
Committee on Finance
United States Senate

Dear Senator Grassley:

According to the most recent estimate from the Centers for Medicare &
Medicaid Services (CMS), from April 1, 2005, through March 31, 2006,
Medicare made about $700 million in improper payments for durable medical
equipment, prosthetics, orthotics, and supplies (DMEPOS).^1 This
represents about 7.5 percent of its payments for these items. Improper
payments result from mistakes on the part of those who bill Medicare,
fraudulent activities, and abuse. Mistakes are often due to clerical
errors or a misunderstanding of program rules, while fraud involves an
intentional act or representation to deceive with knowledge that the
action or representation could result in gain. Abuse typically involves
actions that are inconsistent with acceptable business and medical
practices and result in unnecessary cost.^2 Improper Medicare payments
drain vital program dollars, to the detriment of beneficiaries and
taxpayers. Due in part to Medicare's vulnerability to making improper
payments, we have designated it as a high-risk program since
1990.^3123According to the most recent estimate from the Centers for
Medicare & Medicaid Services (CMS), from April 1, 2005, through March 31,
2006, Medicare made about $700 million in improper payments for durable
medical equipment, prosthetics, orthotics, and supplies (DMEPOS). This
represents about 7.5 percent of its payments for these items. Improper
payments result from mistakes on the part of those who bill Medicare,
fraudulent activities, and abuse. Mistakes are often due to clerical
errors or a misunderstanding of program rules, while fraud involves an
intentional act or representation to deceive with knowledge that the
action or representation could result in gain. Abuse typically involves
actions that are inconsistent with acceptable business and medical
practices and result in unnecessary cost. Improper Medicare payments drain
vital program dollars, to the detriment of beneficiaries and taxpayers.
Due in part to Medicare's vulnerability to making improper payments, we
have designated it as a high-risk program since 1990.

^1Medicare defines durable medical equipment (DME) as equipment that
serves a medical purpose, can withstand repeated use, is generally not
useful in the absence of an illness or injury, and is appropriate for use
in the home. DME includes items such as wheelchairs, hospital beds, and
walkers. Medicare defines prosthetic devices (other than dental) as
devices that are needed to replace a body part or function. Prosthetic
devices include artificial limbs and eyes and cardiac pacemakers. Medicare
defines orthotic devices to include leg, arm, back, and neck braces that
provide rigid or semirigid support to weak or deformed body parts or
restrict or eliminate motion in a diseased or injured part of the body.
Medicare-reimbursed supplies are items that are used in conjunction with
DME and are consumed during the use of the equipment--such as drugs used
for inhalation therapy--or items that need to be replaced on a frequent,
usually daily, basis--such as surgical dressings.

^242 C.F.R. S 433.304 (2005).

^3GAO, High-Risk Series: An Update, [23]GAO-05-207 (Washington, D.C.: Jan.
2005).

To prevent or minimize improper payments for DMEPOS, CMS relies on
contractors to conduct program integrity activities in four DMEPOS
regions. CMS has entered into new contracts with three Program Safeguard
Contractors (PSC) to conduct these activities, as of March 1, 2006.^4 The
PSCs' program integrity activities include analyzing data on submitted and
paid claims to identify patterns of improper or atypical billing;
establishing automated prepayment controls to deny claims that should not
be paid or route them for further review; conducting medical reviews^5 of
specific claims to determine if they should be, or should have been, paid;
and carrying out benefit integrity activities--such as identifying,
investigating, and referring to law enforcement any DMEPOS supplier
suspected of submitting fraudulent claims for Medicare payment.^6 CMS also
relies on the efforts of a Durable Medical Equipment Regional Carrier
(DMERC) and Durable Medical Equipment Medicare Administrative Contractors
(DME MAC)^7 to ensure that all needed information is included on a claim
and to collect overpayments.

You asked us to review CMS and its contractors' activities to address
improper DMEPOS payments. In this report, we (1) discuss CMS's and its
contractors' program integrity activities intended to prevent and minimize
improper payments for DMEPOS and (2) describe CMS's oversight of PSC
program integrity efforts.

To discuss the program integrity activities of CMS and its contractors^8
to prevent and minimize improper payments for DMEPOS, we reviewed the
automated prepayment controls--also referred to as edits--which
contractors introduce into their payment systems to deny claims or flag
them for medical review, and contractors' benefit integrity activities. At
the beginning of our review, three DMERCs and a PSC performed these
functions and after March 1, 2006, three PSCs performed them. We included
automated prepayment controls because they are generally the contractors'
first line of defense for avoiding payment of improper claims, and we
included benefit integrity activities because they allow contractors to
enlist federal law enforcement agencies to act against suppliers who have
defrauded Medicare. We did not evaluate other aspects of medical review,
which can include analysis or examination of claims after payment, but we
discuss these functions in relation to automated prepayment controls and
benefit integrity activities. To review the adequacy of automated
prepayment controls, we analyzed national Medicare DMEPOS claims data on
atypical billing trends--particularly large increases in billing--by
supplier and by item for the first quarter of 2003 through the first
quarter of 2005. These data were provided to us by CMS's Statistical
Analysis Durable Medical Equipment Regional Carrier (SADMERC)--which is
responsible for performing statistical analyses on DMEPOS billing data to
identify potential fraud. We further analyzed Medicare DMEPOS claims data
from five states--California, Florida, Illinois, New York, and
Texas^9--and examined national claims data for suppliers and items with
atypical billing trends. We assessed the reliability of the data sets used
for these analyses and determined that each one was sufficiently reliable
for the purposes of this report. Further, we interviewed CMS officials
responsible for safeguarding the program, and contractor staff responsible
for conducting program integrity activities in Regions A, C, and D,^10
including the outgoing DMERCs for Regions C and D,^11 and the PSCs for
Regions A, C, and D. To learn more about the contractor transitions, we
interviewed staff at the DME MAC for Region A, whose contract was the only
DME MAC contract awarded within our chosen regions at the time of our
interviews. We also interviewed officials from SADMERC, and law
enforcement officials--from the Department of Health and Human Services
(HHS) Office of Inspector General (OIG), the Federal Bureau of
Investigation (FBI), and U.S. Attorney's Offices--that are responsible for
investigating and prosecuting Medicare fraud and abuse cases.^12 We
reviewed relevant CMS documents, such as CMS's Medicare Program Integrity
Manual (PIM), which provides guidance for Medicare contractors.

^4The same PSC was awarded contracts for Regions A and B, which means that
a total of three PSCs hold contracts for the four regions. Appendix I
depicts the boundaries of each region.

^5Medical reviews of submitted claims are conducted to determine if
beneficiaries' medical conditions meet Medicare coverage criteria. If
medical reviews identify a claim that should not have been paid, the
contractor that paid the claim is responsible for collecting the
overpayment.

^6Prior to March 1, 2006, three Durable Medical Equipment Regional
Carriers (DMERC) and one PSC were under contract to conduct program
integrity activities for DMEPOS benefits.

^7In 2006, CMS began implementing a plan to replace DMERCs with DME MACs
to process DMEPOS claims. As of January 2007, three DME MACs and a DMERC
were performing this activity. Each DMERC or DME MAC is responsible for
coordinating with the PSC that conducts program integrity activities in
its region.

^8In this report, unless otherwise specified, the term contractors refers
to PSCs, DMERCs, and DME MACs.

^9We obtained data from these states because they are each recognized by
CMS or law enforcement as having experienced Medicare fraud and abuse.

^10While DMERCs and DME MACs process claims in the four DMEPOS regions, we
chose to focus our work in Regions A, C, and D. We selected Region A
because it was the only DMEPOS region in which a PSC had previously been
contracted to conduct program integrity functions. We selected Regions C
and D because they each have one state--Florida and California,
respectively--which CMS and its contractors have identified as
experiencing a higher level of DMEPOS fraud and abuse than other states.

^11We did not interview DMERC staff for Region A because the
responsibility for program integrity activities in that region had already
been transferred to a PSC in 2001.

To describe CMS's oversight of PSC program integrity efforts, we reviewed
the PSCs' statement of work and task orders outlining their duties,^13 the
PIM, and the evaluation tools that CMS will use to assess PSC performance.
We also interviewed CMS officials about their oversight activities and
efforts to minimize DMEPOS improper payments. Appendix II includes a more
detailed discussion of our scope and methodology. We performed our work
from June 2005 through January 2007 in accordance with generally accepted
government auditing standards.

Results in Brief

The contractors' activities to prevent and minimize improper DMEPOS
payments fell short in three ways. First, the DMERCs and PSCs did not have
edits with predesignated thresholds in place to identify claims for
medical review that were part of an atypical increase in billing. This
resulted in losses to Medicare. For example, we found that from the first
quarter of 2003 through the first quarter of 2005, due to an absence of
threshold edits, 225 suppliers increased their billing to Medicare by
$500,000 and 50 percent from at least one 3-month period to the next. In
November 2004, the U.S. government won a default civil judgment against 16
of these suppliers for filing false claims against Medicare for services
not rendered--after being paid almost $40 million from January 2003
through September 2004. Establishing edits for when such claims meet
thresholds for atypical billing would have allowed contractors to examine
the claims before paying them and decrease improper payments. Second, we
identified three instances where contractors did not have edits in place
to identify items, and paid claims for items, that are not likely to be
prescribed in the course of routine quality medical care. For example, a
Medicare beneficiary who has a prosthetic foot due to an amputation should
not need a brace for the limb that no longer exists. However, Medicare
paid over $2 million from October 2002 through March 2005 for
beneficiaries' braces after the program had paid for prosthetics for the
same beneficiaries' legs, feet, or ankles. Third, contractors are not
required by CMS to share information on their effective edits with
contractors in other regions. They also do not have to adopt edits that
have been effective in these other regions and that could be effective in
their own. For instance, we found that one effective edit restricted
payment for home-use hospital beds to only one per beneficiary per month.
However, this edit was used in only one region. If it had been used in the
other three regions, it could have saved Medicare almost $71 million from
January 2003 through June 2005. Not all regions would benefit equally from
introducing new edits into their systems. In this example, the edit would
be most effective in two of the four regions because they received more
claims from suppliers that billed for multiple hospital beds per
beneficiary in a given month. In addition to using medical review edits,
contractors also conduct benefit integrity activities to support law
enforcement's investigation of suppliers who are suspected of fraudulent
billing. Although CMS officials expressed satisfaction with contractors'
benefit integrity performance, law enforcement officials in Miami and
Southern California with whom we spoke told us that the contractors could
be more effective if their supplier case referrals were based on more
recent data.

^12We interviewed headquarters officials from these organizations, in
addition to representatives from their local offices in Los Angeles,
California; Miami, Florida; and New York City, New York. The HHS OIG is
responsible for investigating Medicare fraud; the FBI may assist in the
investigation of Medicare fraud cases or open an independent investigation
on cases for which the HHS OIG has decided not to open an investigation;
and U.S. Attorney's Offices are responsible for prosecuting Medicare fraud
cases.

^13A statement of work is the portion of a contract that describes the
actual work to be carried out by the contractor by means of
specifications, performance dates, and quality requirements.

CMS oversees the PSCs' program integrity efforts by providing each PSC
with a statement of work, a specific task order, the PIM, and through its
monitoring and evaluation of the PSCs' activities. The agency has
completed an initial abbreviated evaluation for the three PSCs and is
implementing a comprehensive, annual evaluation of each PSC. CMS's plans
are to assess each PSC's general, medical review, and benefit integrity
performance. CMS will use the results of the annual evaluations to
determine whether to renew the PSC contracts and whether each PSC is
eligible to earn incentive rewards--called award fees--for good
performance, in addition to the regular payments it receives under its
contract.

To help prevent improper payments for DMEPOS, we recommend that the
Administrator of CMS take two actions. First, CMS should require the PSCs
to establish thresholds for, and develop automated prepayment controls to
address, unexplained increases in claims volume. Second, we recommend that
CMS require contractors to exchange information about, and consider
adopting, automated prepayment controls used by other DMEPOS contractors
that could reduce improper payments within their own regions. CMS
concurred with our recommendations and provided information on a related
initiative that it has begun. CMS also suggested another activity that it
plans to take as part of implementing our recommendations. The Department
of Justice (DOJ) provided technical comments, which we incorporated as
appropriate.

Background

Medicare, which is administered by CMS--an agency within HHS--is the
federal program that helps pay for a variety of health care services and
items on behalf of about 42 million elderly and certain disabled
beneficiaries. Most Medicare beneficiaries participate in Part B,^14 which
helps pay for certain physician, outpatient hospital, laboratory, and
other services; DMEPOS (such as oxygen, wheelchairs, hospital beds,
walkers, orthotics, prosthetics, and surgical dressings); and certain
outpatient drugs.^15 Medicare pays 80 percent of the cost of services and
items covered under Part B, and the beneficiary pays the balance.
Beneficiaries typically obtain DMEPOS items from suppliers, who submit
claims to Medicare on the beneficiaries' behalf. Suppliers include medical
equipment retail establishments, and also can include outpatient
providers, such as physicians and physical therapists.

DMEPOS suppliers are required by CMS to meet certain standards before they
are authorized to bill Medicare. These standards are intended to ensure
that suppliers engage in legitimate business practices and are licensed
and qualified to provide DMEPOS items and services in the states in which
they operate. CMS contracts with the National Supplier Clearinghouse (NSC)
to screen potential suppliers and enroll those that comply with CMS
standards into the Medicare program. In a previous report, we found that
NSC's efforts to verify compliance with the standards were insufficient to
ensure that only legitimate and qualified suppliers could bill
Medicare.^16

14Part B requires enrollees to pay a monthly premium for their Part B
coverage.

^15Outpatient drugs covered under Part B include self-administered drugs,
such as certain immunosuppressive and oral anticancer drugs, and drugs
administered in conjunction with DME.

DMEPOS Claims Processing

DMEPOS claims are handled by CMS contractors who are responsible for
processing and paying claims submitted to Medicare. To do this, they
ensure that all necessary information is included on a claim. Claims
processing contractors are responsible for paying DMEPOS claims and
recouping any payments that have been made in error. Prior to January
2006, CMS contracted with four DMERCs to handle DMEPOS claims processing
activities. Each DMERC was assigned to one of four geographic
regions--Region A, B, C, or D--and was responsible for processing the
DMEPOS claims of Medicare beneficiaries residing within its region.^17 The
Medicare Prescription Drug, Improvement, and Modernization Act of 2003
included provisions that required CMS to implement competitive procedures
to replace DMERCs with DME MACs.^18 In January 2006, CMS competitively
selected four DME MACs from a pool of applicants^19 and began to
transition DMEPOS claims administration activities from the DMERCs to DME
MACs. In Regions A and B, the transition of these claims processing
activities was completed by July 1, 2006,^20 but bid protests against the
selection of the Region C and D DME MACs delayed transitions in these
regions. As a result, claims processing activities did not transition in
Region D until September 30, 2006, and, as of January 2007, the DMERC in
Region C was continuing to process claims.^21

16For more information on NSC and DMEPOS supplier standards, see GAO,
Medicare: More Effective Screening and Stronger Enrollment Standards
Needed for Medical Equipment Suppliers, [24]GAO-05-656 (Washington, D.C.:
Sept. 22, 2005). See also Related GAO Products at the end of this report.

^17The four DMERCs were HealthNow New York, Inc. (Region A), AdminaStar
Federal, Inc. (Region B), Palmetto Government Benefits Administrators, LLC
(Region C), and CIGNA Government Services, LLC (Region D). DMERCs only
processed DMEPOS claims.

^18Pub. L. No. 108-173, sec. 302(b), S 1847, 117 Stat. 2066, 2224-30 (to
be codified at 42 U.S.C. S 1395w-3). For further information on this
contracting change, see GAO, Medicare Contracting Reform: CMS's Plan Has
Gaps and Its Anticipated Savings Are Uncertain, [25]GAO-05-873
(Washington, D.C.: Aug. 17, 2005).

^19This pool included DMERCs and other companies with experience
processing Medicare claims.

^20The Region A DME MAC contract was awarded to National Heritage
Insurance Company and the Region B contract was awarded to AdminaStar
Federal, Inc.

DMEPOS Program Integrity

DMEPOS program integrity activities are designed to protect the Medicare
program from improper payments. These program integrity activities include
medical reviews of claims and benefit integrity efforts.

Medical Review

Medical review is the examination of information on a DMEPOS claim, as
well as the examination of any supporting documentation associated with
the claim, to determine if a beneficiary's medical condition meets
Medicare's coverage criteria. Medical review can also include data
analyses of submitted and paid DMEPOS claims to identify billing patterns
that may be associated with improper Medicare payments. If medical review
reveals that an overpayment was made to a supplier, the claims processing
contractor that paid the claim is responsible for collecting the
overpayment from the supplier. Medical review findings also help CMS
contractors determine what instruction they may need to provide to DMEPOS
suppliers to inform them about Medicare program rules and proper DMEPOS
billing. Medical review often results from contractors' use of edits to
identify claims that require scrutiny, and it can be performed before or
after payment.

Benefit Integrity

Benefit integrity is the investigation of suspected fraud and the referral
of suppliers to law enforcement for further investigation and prosecution.
In addition, benefit integrity activities include data analysis of DMEPOS
claims to identify improper billing that may indicate fraud.

Prior to March 1, 2006, all medical review and benefit integrity
activities within Regions B, C, and D were conducted by each region's
DMERC. In Region A, these activities were conducted by a PSC. As of March
1, 2006, the PSC in Region A also became responsible for conducting the
medical review and benefit integrity activities for Region B. In Regions C
and D, CMS selected two other PSCs--one for each region--to conduct the
medical review and benefit integrity activities in each respective region.
The PSC for each region is responsible for partnering with its region's
claims processing contractor when conducting medical review and benefit
integrity activities. By March 1, 2006, the transition of medical review
and benefit integrity activities from the DMERCs to the PSCs was
completed.

^21In Region D, CMS's award of the DME MAC contract to Noridian
Administrative Services, LLC, was upheld. CIGNA Gov't Servs., LLC,
B-297915, May 4, 2006. Transition of the Region D workload to the DME MAC
was completed by September 30, 2006. In Region C, a bid protest was upheld
and, as a result, CMS reopened discussions with parties under
consideration for award of the DME MAC contract. CIGNA Gov't Servs., LLC,
B-297915.2, May 4, 2006. On September 28, 2006, CMS once again awarded the
contract, but this award was protested by the company that had not
received the contract. The bid protest was decided on January 16, 2007.
The company that did not receive the contract has options for further
action, such as challenging the decision in the U.S. Court of Federal
Claims. CMS has not yet finalized its transition schedule for Region C, as
of January 2007.

Table 1 provides a summary of DMEPOS claims processing and program
integrity activities and the associated contractor types for these
activities, as of January 2007.

Table 1: DMEPOS Claims Processing and Program Integrity Activities and
Associated Regional Contractor Type, as of January 2007

Program
integrity
Benefit
Type of contractor Claims processing Medical review integrity
Durable Medical Electronically Not applicable Not applicable
Equipment Medicare processes claims
Administrative
Contractor (DME MAC) Pays suppliers and
recoups any
Regions A, B, and D overpayments
Durable Medical
Equipment Regional
Carrier (DMERC)

Region C
Program Safeguard Not applicable Reviews Identifies and
Contractor (PSC) submitted investigates
claims suspected fraud
Regions A, B, C, D
Analyzes Refers suspected
regional claims fraud to law
data enforcement

Informs DME MAC Analyzes
or DMERC of regional claims
overpayments data

Source: GAO analysis of CMS Medicare Program Integrity Manual,
contractors' statements of work, and information from CMS contractors.

In addition to the contractors mentioned above, the SADMERC performs
analyses of national data on paid Medicare DMEPOS claims. The SADMERC
develops reports for CMS, CMS contractors, and law enforcement to identify
trends in payment and potential fraud. It often focuses its analyses by
examining a particular DMEPOS item, supplier, or referring physician, or
by analyzing claims in a specific region or other geographic area.

CMS's Program Integrity Activities Could Be Enhanced

Under CMS's direction, its contractors conduct program integrity
activities, such as developing the automated prepayment controls known as
edits that check claims before payment, and performing benefit integrity
tasks. However, the contractors' edits fell short in preventing improper
payments from being made. Specifically, the contractors did not have edits
that flagged atypical billing or consistently identified claims that were
medically improbable, and the contractors also did not routinely share
their successful edits with the other contractors. Further, as a key
aspect of the benefit integrity activities, contractors provided case
referrals about suppliers to help law enforcement agencies investigate and
prosecute Medicare fraud. However, law enforcement officials stated that
case referrals would be more useful if they were based on more recent
information.

PSCs Identify Atypical Billing Patterns and Use Edits to Address Improper
Payments

PSCs in each region analyze data on claims that have been paid in order to
identify potentially improper ones, which can be evidenced by atypical
billing patterns--such as a rapid growth in payments for a particular
DMEPOS item or provider. They also use results from CMS's annual study of
improperly paid claims^22 to identify items at risk of improper payment in
their respective regions. The PSCs decide on their approach to addressing
potentially improper claims based on the level of their resources and the
scope of the identified problems in their regions. Each PSC's approach is
detailed in its annual "medical review strategy," submitted to CMS for
approval. Due to the specific problems identified in each region, the
PSCs' medical review strategies can differ. As part of its strategy, each
PSC is required to design a comprehensive plan detailing how it will
address each problem it identifies, and reduce the rate of errors in
claims payment. PSCs continuously update their strategy as improper
payment problems are resolved and new ones are discovered.

To prevent and minimize improper payments for DMEPOS, PSCs rely on
automated prepayment controls--called edits. Edits automatically check
claims before payment to make sure that they appear to be valid. PSCs are
responsible for developing and implementing a specific type of edit,
called a medical review edit.^23 Medical review edits specifically allow a
PSC to check that an item on a claim appears medically necessary for the
beneficiary under Medicare's coverage criteria. Medical review edits can
either lead to the automatic denial of an improper claim, or subject a
claim to a manual review. For example, a medical review edit could be
established to automatically deny any claim submitted for specific items
for a beneficiary if it had been determined that the beneficiary's
Medicare number was used repeatedly on claims from different suppliers for
DMEPOS items that the beneficiary did not need. Alternatively, medical
review edits can flag claims for manual medical review before payment,
which requires that a PSC reviewer examine data on the claim, along with
any related supporting documentation.^24 The reviewer determines whether
to allow the claim to continue through the payment process, obtain more
documentation, or deny the claim.

^22CMS monitors the accuracy of Part B claims payments through its
Comprehensive Error Rate Testing program. Beginning in 2003, CMS published
yearly reports on the accuracy of claims payments. See Centers for
Medicare & Medicaid Services, Improper Medicare FFS Payments Long Report
(Web Version) for November 2006 (Baltimore, Md.: Nov. 2006)
[26]https://www4.cms.hhs.gov/apps/er_report/preview_er_report_print.asp?from=public&
which=long&reportID=5 (downloaded Nov. 16, 2006). See also GAO, Medicare
Payment: CMS Methodology Adequate to Estimate National Error Rate,
[27]GAO-06-300 (Washington, D.C.: Mar. 24, 2006).

Gaps with Medical Review Edits Can Lead to Improper Payments

We identified three gaps in medical review edits that could lead to
improper payments. First, DMERCs and the Region A PSC^25 generally did not
have medical review edits in place to identify claims associated with
atypical billing patterns. Such billing patterns involve rapid or dramatic
increases in the billed amounts of claims. Atypical billing patterns can
involve legitimate claims, when, for example, CMS expands the coverage
rules for an item or service. However, atypical billing patterns have
often been associated with improper claims and payments. Atypical billing
patterns can appear with claims (1) submitted by a particular supplier,
(2) covering a particular DMEPOS item, (3) based on referrals from the
same prescribing physician, (4) submitted on behalf of a particular
beneficiary, or (5) associated with atypical billing that is clustered in
a particular geographic area. The DMERC and PSC officials we interviewed
told us that they did not use medical review edits that would routinely
flag claims that had reached predesignated thresholds--such as ones that
would signal an unusually large increase in payment to a supplier. One
contractor indicated that, depending on the threshold set, introducing
these types of edits could allow too many claims to be flagged for medical
review.

^23Another type of edit--the claims processing edit--is designed and put
in place by DME MAC and DMERC staff to ensure that claims contain complete
information that is consistent with certain previously submitted data and
appear payable. The DME MACs and DMERC program the claims processing
system with claims processing edits to determine whether to continue
processing the claim for payment, deny it, or flag it for review. For
example, a claims processing edit can flag a claim for review if it
appears to be a duplicate of a previously processed claim.

^24Some DMEPOS items require that the supplier has a form signed by a
physician to certify that an item is needed for the beneficiary. A
reviewer can request this form be submitted to serve as proof that the
item is considered medically necessary.

^25At the time our audit work on medical review edits was conducted, only
Region A had a PSC conducting program integrity activities.

In the absence of threshold edits to avoid paying improper claims
associated with atypical billing patterns, the DMERCs paid claims that
represented large increases over historical billing amounts submitted. For
example, we found that from the first quarter of 2003 through the first
quarter of 2005, 225 suppliers increased their billing to Medicare by
$500,000 and 50 percent from at least one 3-month period to the next.^26
At least 38 of the 225 suppliers were under criminal investigation during
2004. In November 2004, the U.S. government won a default civil judgment
of $366 million against 16 of these suppliers.^27 These suppliers had
billed for services not rendered and committed other offenses, and they
had been paid almost $40 million from January 2003 through September 2004.
As of December 2006, DOJ had collected about $738,000 from suppliers
involved in the case. HHS OIG investigators in Miami told us that it was
not uncommon for fraudulent suppliers to close up their businesses at the
first sign of an investigation or to quickly move their Medicare payments
out of their accounts in ways that are difficult to track. By the time law
enforcement can act against fraudulent suppliers, much of the money gained
from Medicare has disappeared and cannot be recouped.

We found that contractors paid claims that were medically improbable
because they did not have edits to flag them. Such claims represent items
unlikely to be prescribed, or unlikely to be prescribed in the quantity
billed, for a beneficiary as part of routine quality care. In conjunction
with the SADMERC, we identified three instances where medically improbable
claims were routinely being paid by Medicare for more than a year. For
example, if a Medicare beneficiary has a foot amputated, that person would
usually need a prosthetic foot for that limb. As a result, the beneficiary
should not also need a brace for a limb that no longer exists. From
October 2002 through March 2005, Medicare paid over $2 million for
beneficiaries' braces after the program had paid for prosthetics within
the last year for the same beneficiaries' legs, feet or ankles. (See table
2 for two other examples.) A SADMERC official told us that the contractors
could develop edits for medically improbable circumstances that could
avoid improper payments.

^26As a single example, in the fourth quarter of 2003, one Florida
supplier had an increase in billing of over 51,000 percent from the prior
quarter, from $4,486 to $2,307,236. In the next quarter, the supplier's
billing for DMEPOS products increased to $14,611,458. Although many of the
charges were denied, CMS paid the supplier over $5 million for DMEPOS
claims from October 2003 through March 2004.

^27A default judgment is rendered as a result of a party's failure to
appear in court or to answer a complaint.

Table 2: Examples of Medically Improbable Claims and Possible Edits to
Address Them

Why it is medically Description of
Type of claim improbable possible edit Payment amounts
More than 500 Clinical information A glucose test CMS paid about
glucose test and surveys of strip edit^a would $156 million for
strips per beneficiaries indicate limit diabetics who test strips in
year for that noninsulin-treated do not use insulin excess of 500
diabetics who diabetics generally do to 500 test strips per year for
are not not test their blood per year (41 per diabetic
treated with sugar level more than month)--a level beneficiaries
insulin once per day. which is more that were not
generous than the treated with
contractors' insulin in
coverage policies 2003.^b
currently allow and
would allow testing
more than once a
day. If more than
500 test strips
were billed in a
year, the claims
processing system
would deny the
claims containing
this code.
Multiple According to the An edit for From October
claims for SADMERC medical multiple 2002 through
prosthetics director, a beneficiary prosthetics^c would March 2005, CMS
provided for who receives a limit the number of paid almost
the same body prosthesis for a prostheses provided $500,000 to
part specific body part for the same body suppliers
should not need part for the same providing more
multiple versions of beneficiary to two than two of the
the same prosthesis. On per year. If more same prostheses
some occasions, a than two for the same leg
beneficiary may need to occurrences were of the same
be refitted, but no billed in a year, beneficiary
more than two of the the claims within a single
same prostheses per processing system year.
year should be would deny the
necessary. claims containing
this code or flag
the claims for
prepayment manual
medical review.

Source: GAO analysis of SADMERC data.

aThe glucose test strip edit was developed by SADMERC and relies on
SADMERC data.

bSADMERC was able to determine whether beneficiaries were treated with
insulin based on the diagnosis information submitted on their claims.

cThe edit for multiple prosthetics was developed by GAO and relies on
SADMERC data.

In recognition of the value of edits to detect medically improbable
claims, CMS has begun a process to have its contractors implement such
edits. In January 2007, the agency plans to introduce 19 edits for DMEPOS
items, albeit not for the items described in table 2.^28 These 19 edits
will deny claims for DMEPOS items if a medically improbable quantity of
the item is listed on the claim for a single beneficiary in one day. The
agency plans to introduce additional edits for more DMEPOS items and other
services later in 2007.

Finally, CMS does not require its contractors to share information on
their edits with contractors in other regions or adopt edits that have
been effective in other contractors' regions. CMS requires each of its
contractors to develop and maintain its own edits. Contractors are free to
adopt or eliminate edits at their discretion based on such factors as the
effectiveness of an edit in reducing improper payments, the added cost of
implementing and maintaining an edit, and the presence or absence of
other, more costly, improper payments. CMS officials we spoke with told us
that CMS expects contractors to add edits at their own discretion, based
on their resources. CMS maintains a database through which contractors
provide information to the agency on the effectiveness of their edits. At
present, contractors do not have access to other contractors' information
in the database.

Our analysis found that if contractors were to adopt edits that have been
effective in other contractors' regions, they could likely reduce their
improper payments. For example, in 2005, the DMERC in Region C had an edit
in place to restrict payment for the same or similar types of home-use
hospital beds to one item per month per beneficiary, by automatically
denying any additional claims submitted for these items. Our analysis
identified a potential savings within Region C of $50.7 million from
January 1, 2003, through June 30, 2005. Based on the claims submitted over
this time period in the other three regions, we found that this edit could
have generated an additional savings of up to $70.6 million if it had been
implemented in the other three regions.^29 Overall, our analysis of a
sample of seven edits^30--selected from a list of automated edits that was
provided in response to our request and included edits estimated to be the
most effective by the contractors that developed them--found that each
contractor had edits that could have denied up to an additional $74.1
million in claims from January 2003 through June 2005, had all seven edits
been used by each contractor.^31

28CMS plans to implement a total of 2,776 edits for Part B items and
services. These edits would automatically deny claims for Part B items and
services if a medically improbable quantity of the item or service is
billed for a single beneficiary as having been provided on the same day.

^29Our analysis also found that this edit did not lead to equal amounts of
savings in all DMEPOS regions and therefore was of more potential value in
some DMEPOS regions than in others. For example, Region D showed a
potential savings of $36.6 million; Region A, $18.1 million; and Region B,
$15.9 million.

PSC Case Referrals to Law Enforcement Are a Key Aspect of Benefit Integrity
Activities

Under their benefit integrity responsibilities, PSCs are expected to
identify and investigate cases of suspected fraud within their regions and
refer these cases to law enforcement for further investigation and
prosecution. A PSC's investigation can include examining medical and other
records associated with a particular claim or claims, questioning
beneficiaries about whether they received items that were billed, and
conducting site visits to suppliers' facilities. PSCs also use analysis of
claims data to look for atypical billing patterns and other factors that
may indicate fraud, such as the number of complaints against, or prior
investigations of, a supplier.

PSCs are required by CMS to refer cases of suspected fraud to the HHS OIG
for further investigation.^32 PSCs are also required to support law
enforcement's investigation and prosecution of fraud by providing supplier
and beneficiary information and other relevant case-related data, as
requested by law enforcement entities. Along with these tasks, the PSC
statements of work outline other required activities, including
participating in regular case-related contact with law enforcement,
coordinating and participating in antifraud conferences and related
gatherings, updating a national database maintained by CMS that tracks
Medicare fraud, and providing educational programs for law enforcement on
contractor operations and Medicare issues. Prior to the transfer of
benefit integrity activities to PSCs on March 1, 2006, DMERCs were
responsible for these activities in three of the four regions. In the
fourth region--Region A--a PSC was responsible for these activities prior
to this date.

^30Two of the seven edits examined wheelchair and commode seating items
and were developed by the Region A PSC. Four of the seven edits examined
oxygen delivery, respiratory assistance devices, nutrition to be provided
through feeding tubes, and hospital beds, and were developed by the Region
C DMERC. The final edit examined eyeglass lens coatings and was developed
by the Region D DMERC.

^31These figures represent a maximum possible savings by assuming that
none of the claims denials generated by these edits would be manually
overridden. Further, if claims denials are subsequently appealed and
payment made to suppliers, an edit could be less effective than a
contractor's data would suggest.

^32When the HHS OIG accepts a case referral from a PSC or other source, it
may investigate the case on its own or involve other federal and state law
enforcement entities in its investigation. After completing its
investigation, the HHS OIG refers each case to the U.S. Attorney's Office.
The U.S. Attorney's Office decides whether the case should be prosecuted
and is responsible for prosecution. If the HHS OIG declines a case,
however, the PSC has the option to refer it directly to other federal or
state law enforcement entities, such as the FBI or a State Office of
Attorney General.

Our analysis of CMS contractor benefit integrity performance evaluations
from 2001 through 2005--the most recent years for which these evaluations
were available--generally found few serious problems. According to these
evaluations, the PSC in Region A and the DMERCs in Regions B and C met
most or all of CMS's benefit integrity requirements in all years, with any
problems identified by these evaluations labeled as "minor." The DMERC in
Region D--which no longer holds this contract^33--met all benefit
integrity requirements in two recent evaluation periods (which covered
October 1, 2003, through May 31, 2004, and October 1, 2004, through April
15, 2005). However, in three earlier evaluation periods preceding October
1, 2003, CMS found "major" problems relating to the DMERC's case referral
activities, such as less than timely development of cases and lack of
documentation to support case files.

Despite the PSC's and DMERCs' positive evaluations by CMS in recent years,
law enforcement officials we spoke with stated that the contractors could
have done more to support law enforcement activities. For example, law
enforcement officials we interviewed in Miami and Southern California^34
told us that, while they were satisfied with the quality of information
presented in the case referrals, the case files often pertained to fraud
that had occurred too far in the past to be effectively investigated by
the time the referral was received. The Los Angeles FBI office as well as
the U.S. Attorney's office responsible for prosecuting Medicare fraud in
the Los Angeles area (Region D) told us that the typical case referral
submitted to the office for prosecution in 2005 related to suspect
suppliers whose peak billing activity occurred during 2003.^35 The Miami
FBI office and the U.S. Attorney's office responsible for prosecuting
Medicare fraud in the Miami area expressed similar concerns on the
timeliness of case referrals.

^33As noted earlier, the Region D contract was transitioned to Noridian
Administrative Services, LLC, as of September 30, 2006.

^34These included officials from the Miami HHS OIG, U.S. Attorney's and
FBI offices, as well as officials from the HHS OIG, U.S. Attorney's, and
FBI offices responsible for the Los Angeles area.

Law enforcement officials explained that when case referrals are made
after a supplier is no longer in business, investigating and prosecuting
the suspected fraud is difficult or even impossible because law
enforcement may not be able to locate the company's owners, its records,
or the Medicare funds it received. Law enforcement officials we
interviewed did not cite a single cause for the delays in contractor
referrals. Officials in Los Angeles attributed the delays to a lack of
on-site contractor presence in the Los Angeles area and on contractor
over-emphasis on producing polished referrals. Officials in Miami
attributed the delays to the referral process itself, citing too many
steps in the process, and some officials were uncertain as to the cause.
When we discussed these issues with CMS officials, however, they did not
raise concerns about the DMERCs' and PSC's effectiveness in supporting law
enforcement with comprehensive and timely referrals. On the contrary, the
officials we interviewed expressed satisfaction with the DMERCs' and PSC's
past performance.

CMS Oversees PSCs through Various Means, and Is Implementing Annual Evaluations
of Program Integrity Activities

CMS has various means of overseeing PSCs' program integrity efforts. To
establish expectations and guidelines for the PSCs, and to monitor their
program integrity efforts, CMS relies on PSC statements of work, the PIM,
and PSCs' reports on their activities. The PSC statements of work contain
general information about the agency's expectations for the PSCs,
including a list of deliverables that each one is required to provide to
CMS. The PIM establishes the requirements and guidance that the PSCs must
follow when conducting their program integrity activities. In addition,
CMS staff monitor the PSCs' reports about their activities. Examples of
these reports include updated medical review strategies and updates about
the types of information requested by law enforcement for its use in
investigating and prosecuting suppliers. After reviewing a contractor's
reports, CMS may suggest changes to a PSC, such as adjustments to its
medical review strategy.

^35The U.S. Attorneys do not typically receive case referrals directly
from DMERCs, but rather from investigative agencies such as the HHS OIG or
the FBI, who receive the case directly from the DMERCs and may further
develop the case referral.

In addition, CMS has developed plans for annually evaluating the PSCs'
program integrity activities and is in the process of implementing these
evaluations. CMS has developed three evaluation tools to assess each PSC's
(1) general performance, (2) performance in conducting medical review, and
(3) performance in conducting benefit integrity activities. The criteria
used in each of the three evaluation tools reflect the responsibilities
described in the PIM and the PSCs' statements of work. In May and June of
2006, CMS conducted an initial evaluation of the first several months of
the three PSCs' work,^36 using the general performance evaluation tool. In
May and June of 2007, CMS will conduct the first of a planned annual,
comprehensive, full-year evaluation of each PSC, including assessments of
its medical review and benefit integrity efforts. CMS officials said that
the agency will use the results to decide whether to renew a PSC's
contract.^37 The officials also said that CMS will use these results to
determine whether a PSC may earn award fees--a monetary performance reward
for good performance--in addition to the regular payments it receives
under its contract.

The general performance evaluation tool is intended to assess the PSCs in
four overall areas: (1) the quality of their work and work products; (2)
their success in completing their work within an agreed upon budget; (3)
their ability to provide work products on time; and (4) their ability to
develop and maintain productive business relationships with law
enforcement and suppliers.

The medical review evaluation tool is intended to assess PSC performance
in reviewing claims before and after payment. For example, the tool is
designed to assess the degree to which a PSC reviewed claims in accordance
with the medical review strategy that the PSC established for that year,
and that had been approved by CMS. The tool also is intended to verify the
accuracy of medical review for each PSC by using a sample of five claims
that had received medical review from the respective PSC. CMS officials
told us that they are currently in the process of determining whether a
broader measure of a region's improper payments will be reflected in the
evaluations of PSC performance in the future.

^36CMS evaluated each PSC's total workload, rather than its efforts in a
particular region. Because one PSC holds the contracts for both Regions A
and B, that PSC received a single evaluation.

^37The PSCs each have a 5-year contract. This includes an option for CMS
to review the contract each year during its 5-year time frame and renew
the contract for the next year. If CMS is satisfied with the PSC's
performance, it can renew the contract for 1 year, up to four times,
without having to open the contract to competition.

The benefit integrity evaluation tool is intended to assess a PSC's
investigations of suppliers suspected of fraud, development of supplier
case referrals for the HHS OIG, and assistance to law enforcement. For
instance, the benefit integrity evaluation tool requires evaluators to
assess whether a PSC maintains a documented audit trail of the actions it
has taken for each supplier investigation initiated. It also requires an
assessment of whether a PSC's case referrals to the HHS OIG include all of
the elements for law enforcement to pursue an investigation.

Conclusions

When CMS and its contractors fall short in protecting the Medicare
program, hundreds of millions of dollars can be lost to improper payments
for DMEPOS. The agency and its contractors conduct a number of program
integrity activities designed to prevent and minimize improper payments
for DMEPOS. However, we found that CMS's contractors did not have
sufficient automated prepayment controls to flag claims that are part of
unexplained increases in billing, or that were medically improbable.
Currently, the PSCs and DME MACs are not required to exchange information
about their successful automated prepayment controls that could be
effective in other regions. While PSCs have the flexibility to implement
prepayment controls that they consider to be the most effective for their
region, knowing about effective controls in other regions could provide
useful information when developing their own. CMS's recent initiative to
add automated prepayment controls that would deny certain medically
improbable claims is a positive step towards reducing improper DMEPOS
payments.

Recommendations for Executive Action

We recommend that the Administrator of CMS take two actions:

o Require the PSCs to develop thresholds for unexplained increases
in billing--and use them to develop automated prepayment controls
as one component of their manual medical review strategies.

o Require the DME MACs, DMERC, and PSCs to exchange information on
their automated prepayment controls, and have each of these
contractors consider whether the automated prepayment controls
developed by the others could reduce their incidence of improper
payments.

Agency Comments

CMS provided comments on a draft of this report, agreed with both
of our recommendations, and stated that it has begun efforts to
address them. Specifically, CMS agreed with our recommendation to
require PSCs to develop thresholds for unexplained increases in
billing and use them in developing their automated prepayment
controls. CMS responded that it would build upon existing PSC
processes for identifying billing increases and would work to
improve contractors' automated prepayment controls. CMS also
discussed a related initiative it has begun to automatically deny
or automatically suspend payment for services billed in excess of
medically probable amounts. CMS stated that this initiative will
address some of the issues that we raised in our report. We
consider this initiative to be one important aspect of preventing
improper payments for DMEPOS.

CMS also agreed with our recommendation to require the DME MACs,
DMERC, and PSCs to exchange information on their automated
prepayment controls and to have each of these contractors consider
whether the controls developed by the others could reduce their
incidence of improper payments. CMS responded that these
contractors' Joint Operating Agreements (JOA) provide a means
through which information can be shared among them, and stated
that it believes the contractors are currently coordinating their
automated prepayment control processes. CMS also said it would
review the JOAs to ensure that information-sharing requirements
are clear and are being followed by the contractors. This would be
a good first step towards ensuring that information sharing occurs
and that the contractors are considering the prepayment controls
of other contractors when developing their own prepayment
controls.

CMS's comments appear in appendix III.

We provided DOJ with a draft of this report for its review. DOJ
provided us with technical comments, which we incorporated as
appropriate.

As agreed with your office, unless you publicly announce its
contents earlier, we plan no further distribution of this report
until 30 days after its date. We will then send a copy of this
report to the Secretary of HHS, the Administrator of CMS, and the
Attorney General, appropriate congressional committees, and other
interested parties. We will also make copies available to others
upon request. This report also will be available at no charge on
GAO's Web site at http://www.gao.gov .

If you or your staff have any questions about this report, please
contact me at (312) 220-7600 or [email protected] . Contact
points for our Offices of Congressional Relations and Public
Affairs may be found on the last page of this report. GAO staff
who made major contributions to this report are listed in appendix
IV.

Sincerely yours,

Leslie G. Aronovitz
Director, Health Care

Appendix I: DMEPOS Regions and Associated DME MACs and PSCs

Appendix II: Scope and Methodology

To discuss the program integrity activities of the Centers for
Medicare & Medicaid Services (CMS) and its contractors to prevent
and minimize improper payments made for durable medical equipment,
prosthetics, orthotics, and supplies (DMEPOS), we reviewed aspects
of the contractors' medical review and benefit integrity
responsibilities. We reviewed the automated prepayment
controls--called edits--that contractors introduce into their
payment systems to deny claims or flag them for medical review,
and contractors' benefit integrity activities. We included edits
because they are generally the contractors' first line of defense
for avoiding payment of improper claims. We did not evaluate other
aspects of medical review, which can include analysis or
examination of claims after payment, but we discuss these
functions in relation to automated prepayment controls and benefit
integrity activities. We also included benefit integrity
efforts--such as referring potential cases to law
enforcement--because these efforts allow contractors to enlist
federal law enforcement agencies to act against suppliers who have
defrauded Medicare. As part of our work, we reviewed related GAO
reports and CMS's Medicare Program Integrity Manual (PIM), which
establishes CMS's guidelines for contractors' program integrity
activities. We also conducted interviews with CMS officials
responsible for safeguarding Medicare, as well as contractor
officials responsible for program integrity activities in three of
the four DMEPOS regions-- Regions A, C, and D.^1 These contractor
officials included staff at the outgoing Durable Medical Equipment
Regional Carriers (DMERC) for Regions C and D,^2 and the incoming
Program Safeguard Contractors (PSC) for Regions A, C, and D. We
interviewed staff at the incoming Durable Medical Equipment
Medicare Administrative Contractor (DME MAC) for Region A, which
had the only DME MAC contract within our selected regions that had
been implemented at the time of our interviews. We also
interviewed contractor staff at the Statistical Analysis Durable
Medical Equipment Regional Carrier (SADMERC)--a contractor which
is responsible for performing statistical analyses on national and
regional DMEPOS billing data to identify potential fraud.

In order to specifically review edits, we analyzed national
Medicare DMEPOS claims data on atypical billing trends for
suppliers and items for the first quarter of 2003 through the
first quarter of 2005 generated by SADMERC. We performed further
analyses on individual Medicare DMEPOS claims data from the first
quarter of 2003 through the second quarter of 2005 from five
states--California, Florida, Illinois, New York, and Texas.^3 We
also obtained data from the National Supplier Clearinghouse
(NSC)--a contractor which is responsible for enrolling suppliers
in Medicare and revoking the billing privileges of suppliers who
do not comply with program guidelines. We used the NSC data to
obtain information on the geographic location of the suppliers'
companies, such as by zip code and state, and to inform us as to
whether the Medicare billing privileges of certain suppliers were
considered by the NSC to be active, inactive, or revoked, as of
October 3, 2005. In addition, we used other analyses performed by
SADMERC on national DMEPOS claims data to simulate how many
dollars might have been saved for periods of time from 2002
through 2005 by adding certain edits into the payment system to
identify potential improper payments. We assessed the reliability
of the data sets used for these analyses by reviewing
documentation related to each data set, and we determined that
each was sufficiently reliable to address the issues in this
report.

In order to specifically describe contractors' benefit integrity
efforts, we interviewed law enforcement officials on both the
national and local levels who are responsible for investigating
and prosecuting such cases, and for coordinating their efforts
with the CMS contractors. The officials we interviewed included
those from Department of Health and Human Services (HHS) Office of
Inspector General (OIG), who receive suspected fraud cases from
Medicare contractors and may opt to investigate the cases further;
the Federal Bureau of Investigation (FBI), which may opt to assist
in the investigation of Medicare fraud cases or open an
independent investigation on cases for which the HHS OIG has
decided not to open an investigation; and U.S. Attorney's offices,
which are responsible for the prosecution of Medicare fraud cases.
In addition to interviewing headquarters officials from these
organizations, we also interviewed local law enforcement officials
from these agencies in Los Angeles, California; Miami, Florida;
and New York City, New York.

To describe CMS's oversight of its PSCs' program integrity
efforts, we reviewed the PIM, and the PSCs' statements of work,
which describe the terms of the PSC contracts. We also read CMS's
PSC performance evaluation tools, and interviewed CMS officials
about PSC oversight. In addition, we interviewed PSC contractors
about CMS's oversight of its PSCs. We performed our work from June
2005 through January 2007 in accordance with generally accepted
government auditing standards.

^1We selected Region A because it was the only DMEPOS region in which a
program safeguard contractor (PSC) was already conducting program
integrity functions when we began our work. We selected Regions C and D
because they each have one state--Florida and California,
respectively--which CMS and its contractors have identified as
experiencing a higher level of DMEPOS fraud and abuse than other states.

^2We did not interview the DMERC for Region A because the program
integrity activities in that region were already being conducted by a PSC.

^3We obtained data from these states because they are each recognized by
CMS or law enforcement as states which have experienced Medicare fraud and
abuse.

Appendix III: Agency Comments

Appendix IV: GAO Contact and Staff Acknowledgments

GAO Contact

Leslie G. Aronovitz, (312) 220-2600 or [email protected]

Acknowledgments

In addition to the contact named above, Sheila K. Avruch,
Assistant Director; Ramsey L. Asaly; Kevin Dietz; Krister P.
Friday; Kelli A. Jones; Joy L. Kraybill; Suzanne M. Post; and
Craig Winslow made key contributions to this report.

Related GAO Products

Medicare Integrity Program: Agency Approach for Allocating Funds
Should Be Revised. [30]GAO-06-813 . Washington, D.C.: September 6,
2006.

Medicare Payment: CMS Methodology Adequate to Estimate National
Error Rate. [31]GAO-06-300 . Washington, D.C.: March 24, 2006.

Medicare: More Effective Screening and Stronger Enrollment
Standards Needed for Medical Equipment Suppliers. [32]GAO-05-656 .
Washington, D.C.: September 22, 2005.

Medicare Contracting Reform: CMS's Plan Has Gaps and Its
Anticipated Savings Are Uncertain. [33]GAO-05-873 . Washington,
D.C.: August 17, 2005.

Health Care Fraud and Abuse Control Program: Results of Review of
Annual Reports for Fiscal Years 2002 and 2003. [34]GAO-05-134 .
Washington, D.C.: April 29, 2005.

High-Risk Series: An Update. [35]GAO-05-207 . Washington, D.C.:
January 2005.

Medicare: CMS's Program Safeguards Did Not Deter Growth in
Spending for Power Wheelchairs. [36]GAO-05-43 . Washington, D.C.:
November 17, 2004.

Medicare: CMS Did Not Control Rising Power Wheelchair Spending.
[37]GAO-04-716T . Washington, D.C.: April 28, 2004.

GAO’s Mission

The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in
meeting its constitutional responsibilities and to help improve
the performance and accountability of the federal government for
the American people. GAO examines the use of public funds;
evaluates federal programs and policies; and provides analyses,
recommendations, and other assistance to help Congress make
informed oversight, policy, and funding decisions. GAO's
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at
no cost is through GAO's Web site ( www.gao.gov ). Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of
newly posted products every afternoon, go to www.gao.gov and
select "Subscribe to Updates."

Order by Mail or Phone

The first copy of each printed report is free. Additional copies
are $2 each. A check or money order should be made out to the
Superintendent of Documents. GAO also accepts VISA and Mastercard.
Orders for 100 or more copies mailed to a single address are
discounted 25 percent. Orders should be sent to:

U.S. Government Accountability Office 441 G Street NW, Room LM
Washington, D.C. 20548

To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax:
(202) 512-6061

To Report Fraud, Waste, and Abuse in Federal Programs

Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail:
[email protected] Automated answering system: (800) 424-5454 or
(202) 512-7470

Congressional Relations

Gloria Jarmon, Managing Director, [email protected] (202)
512-4400 U.S. Government Accountability Office, 441 G Street NW,
Room 7125 Washington, D.C. 20548

Public Affairs

Paul Anderson, Managing Director, [email protected] (202)
512-4800 U.S. Government Accountability Office, 441 G Street NW,
Room 7149 Washington, D.C. 20548

(290464)

www.gao.gov/cgi-bin/getrpt?GAO-07-59 .

To view the full product, including the scope
and methodology, click on the link above.

For more information, contact Leslie G. Aronovitz, (312) 220-7600 or
[email protected].

Highlights of [45]GAO-07-59 , a report to the Ranking Minority Member,
Committee on Finance, U.S. Senate

January 2007

MEDICARE

Improvements Needed to Address Improper Payments for Medical Equipment and
Supplies

[46]What GAO Recommends

GAO recommends that CMS require its contractors to develop automated
prepayment controls to identify potentially improper claims when supplier
billing reaches atypical levels and consider adopting the most
cost-effective controls of other contractors. CMS concurred with the
recommendations.

To prevent and minimize improper DMEPOS payments, CMS's contractors
conduct program integrity activities, which include performing medical
reviews of certain claims before they are paid to determine whether the
items meet criteria for Medicare coverage. As part of their efforts, CMS's
contractors responsible for medical review use automated prepayment
controls to deny claims that should not be paid or identify claims that
should be reviewed. However, GAO found three shortfalls in these automated
prepayment controls that make the Medicare program vulnerable to improper
payments.

o Contractors responsible for medical review did not have
automated prepayment controls in place to identify questionable
claims that are part of an atypically rapid increase in billing.
o In some instances, these contractors did not have automated
prepayment controls in place to identify claims for items unlikely
to be prescribed in the course of routine quality medical care.
CMS has recently begun an initiative to add controls of this kind
for some DMEPOS items.
o CMS does not require these contractors to share information on
the most effective automated prepayment controls of the other
contractors or consider adopting them. For example, Medicare might
have saved almost $71 million in less than 2 years if one
effective automated prepayment control designed to prevent
Medicare from paying for more than one home-use hospital bed per
month for a beneficiary, which was used by one of these
contractors, had been used by the others.

CMS oversees the PSCs' program integrity activities by providing written
manuals and contracts to guide their work. As part of its oversight, CMS
is implementing an annual contractor performance evaluation process, based
on three evaluation tools, to assess each PSC's performance. CMS officials
said that the agency will use the results of these evaluations to
determine two things: whether to renew a PSC's contract, and whether a PSC
may earn award fees--a monetary reward for good performance--in addition
to the regular payments it receives under its contract.

References

Visible links
23. http://www.gao.gov/cgi-bin/getrpt?GAO-05-207
24. http://www.gao.gov/cgi-bin/getrpt?GAO-05-656
25. http://www.gao.gov/cgi-bin/getrpt?GAO-05-873
26. https://www4.cms.hhs.gov/apps/er_report/preview_er_report_print.sap?from=public&which=long&reportID=5
27. http://www.gao.gov/cgi-bin/getrpt?GAO-06-300
28. http://www.gao.gov/
30. http://www.gao.gov/cgi-bin/getrpt?GAO-06-813
31. http://www.gao.gov/cgi-bin/getrpt?GAO-06-300
32. http://www.gao.gov/cgi-bin/getrpt?GAO-05-656
33. http://www.gao.gov/cgi-bin/getrpt?GAO-05-873
34. http://www.gao.gov/cgi-bin/getrpt?GAO-05-134
35. http://www.gao.gov/cgi-bin/getrpt?GAO-05-207
36. http://www.gao.gov/cgi-bin/getrpt?GAO-05-43
37. http://www.gao.gov/cgi-bin/getrpt?GAO-04-716T
45. http://www.gao.gov/cgi-bin/getrpt?GAO-07-59
*** End of document. ***