Federal Health Care: Comments on H.R. 4401, the Health Care
Infrastructure Investment Act of 2000 (Testimony, 07/11/2000,
GAO/T-AIMD-00-240).

Pursuant to a congressional request, GAO discussed the Health Care
Infrastructure Investment Act of 2000 (H.R. 4401), which calls for the
development of an immediate claim, administration, payment resolution,
and data collection system, focusing on the: (1) effects of the system
on the claims process of both the Medicare part B program and the
Federal Employees Health Benefits Program (FEHBP); and (2) the role and
composition of a proposed Health Care Infrastructure Commission.

GAO noted that: (1) H.R. 4401 would establish an Infrastructure
Commission within the Department of Health and Human Services to design,
construct, and implement an immediate claim, administration, payment
resolution, and data collection system that would initially be used by
the Medicare part B program; (2) this system would: (a) immediately
notify each provider and supplier of coverage determination; (b)
immediately notify each provider and supplier of any incomplete or
invalid claims, including the identification of missing data and coding
errors; (c) immediately process clean claims so that a provider or
supplier may provide a written explanation of medical benefits,
including costs and coverage to any beneficiary at the point of care;
and (d) allow electronic payment of claims for which payment is not made
on a periodic payment basis; (3) one outcome of developing an immediate
claim, administration, payment resolution, and data collection system
would be faster Medicare part B claims payments; (4) while the
development of an immediate claim, administration, payment, resolution,
and data collection system to be used by the Medicare part B program
might be feasible, it would significantly change the government's
current processes because it would require the real-time processing of
certain elements of the claims process that are performed in batch mode
or manually; (5) H.R. 4401 would also affect FEHBP, which is run by the
Office of Personnel Management (OPM); (6) H.R. 4401 requires that: (a)
OPM adapt the immediate claim, administration, payment resolution, and
data collection system for use by the FEHBP; and (b) carriers
participating in FEHBP use the system to satisfy certain minimum
requirements for claim submission, processing, and payment; (7) because
Medicare part B and FEHBP are substantially different programs, it would
be difficult to design and implement a single system to process claims
under both programs, as called for by H.R. 4401; (8) although all health
plans offer inpatient hospital and outpatient medical coverage as well
as certain OPM-required services, specific benefits vary; (9) these
differences would make it challenging and costly to design and implement
a real-time claims processing system for both programs; and (10) if a
real-time claims processing system is to be developed, consideration
should be given to including key Health Care Financing Administration
(HCFA) and carrier officials with health care claims processing, program
integrity, and financial management expertise on the Infrastructure
Commission, as well as OPM and providers, since the system would affect
HCFA, OPM, and the providers.

--------------------------- Indexing Terms -----------------------------

 REPORTNUM:  T-AIMD-00-240
     TITLE:  Federal Health Care: Comments on H.R. 4401, the Health
	     Care Infrastructure Investment Act of 2000
      DATE:  07/11/2000
   SUBJECT:  Health insurance
	     Health care programs
	     Strategic information systems planning
	     Proposed legislation
	     Medical expense claims
	     Claims processing
	     Data collection
	     ADP procurement
IDENTIFIER:  Medicare Program
	     Federal Employees Health Benefits Program
	     HCFA Common Procedure Coding System
	     Supplementary Medical Insurance Trust Fund
	     BLM Automated Land and Mineral Record System Initial
	     Operating Capability
	     HCFA Medicare Transaction System

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Testimony.                                               **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************

GAO/T-AIMD-00-240

   * For Release on Delivery
     Expected at
     10 a.m.

Tuesday,

July 11, 2000

GAO/T-AIMD-00-240

FEDERAL HEALTH CARE

Comments on H.R. 4401, the Health Care Infrastructure Investment Act of 2000

        Statement of Joel C. Willemssen

Director, Civil Agencies Information Systems

and

Gloria L. Jarmon

Director, Health, Education, and Human Services

Accounting and Financial Management Issues

Accounting and Information Management Division

Testimony

Before the Subcommittee on Government Management, Information and
Technology, Committee on Government Reform, House of Representatives

United States General Accounting Office

GAO

Mr. Chairman and Members of the Subcommittee:

Thank you for inviting us to participate in today's hearing on H.R. 4401,
the Health Care Infrastructure Investment Act of 2000. As you know, this is
a companion to Senate bill S. 2312 of the same name. H.R. 4401 calls for the
establishment of an advanced informational infrastructure to immediately
process certain health benefits claims.

After briefly discussing the bill's provisions, we will address the current
Medicare part B claims process and how it can be used to pay claims more
quickly. We will then provide our perspectives on (1) the development of an
immediate claim, administration, payment resolution, and data collection
system that would initially be applied to the Medicare part B program; (2)
applying this system to the Federal Employees Health Benefits Program
(FEHBP); and (3) the role and composition of a proposed Health Care
Infrastructure Commission. Finally, as requested, we will point out some of
the lessons drawn from a failed HCFA information technology project in the
mid-1990s that could pertain to the systems development effort envisioned by
this bill.

H.R. 4401: The Health Care Infrastructure Investment Act of 2000

In addition, H.R. 4401 would affect FEHBP-the federal government's health
benefits program for employees and retirees-which is run by the Office of
Personnel Management (OPM). It would require OPM to adapt the immediate
claim, administration, payment resolution, and data collection system for
use by FEHBP and require FEHBP carriers to use that system. H.R. 4401 also
sets a timetable with specific performance measures for initial,
intermediate, and full implementation of the system.

Although H.R. 4401 is explicit in that the proposed system would cover the
Medicare part B program and FEHBP, it is unclear whether other federal
health programs would also be included in this system. H.R. 4401 calls for
the establishment of an advanced informational infrastructure for "[f]ederal
health benefits programs which consists of an immediate claim,
administration, payment resolution, and data collection system . . . that is
initially for use by carriers to process claims submitted by providers and
suppliers under part B of the [M]edicare program . . . ." (In a later
section, the bill requires that this system be applied to FEHBP.) The bill
does not define "federal health benefits programs," and provides for
inclusion of only Medicare part B and FEHBP in the system. However, if in
the future the proposed system is intended to include other federal health
benefits programs such as Medicare part A, Medicaid, veterans' health
services, the Department of Defense's health services, and Indian health
services, development and implementation of the system envisioned by the
bill would be different and much more challenging.

These other federal health programs are markedly different. In some cases,
the federal government acts like other large employers that contract with
insurance companies and health plans to offer health benefits to employees
and their dependents. In other cases, it acts like a large insurance company
that pays directly for health care services. In still other instances, it
acts like a large staff-model health maintenance organization that operates
a network of hospitals and employs health care professionals. Accordingly,
if the proposed real-time claims processing system were to later be intended
to address the claims processing requirements of any of these programs, it
would have a significant impact on the system's design and complexity.

Current Medicare
Part B Claims Process

For the Medicare part B program, HCFA uses 22 companies doing business as
carriers to process claims. Each carrier relies on one of four standard
systems to process its claims, adding its own front-end and back-end
processing systems. These systems interface with the common working file
(CWF)-a set of nine databases containing beneficiary information for
specific geographic regions-to authorize claims payments and determine
beneficiary eligibility. The CWF obtains information, such as beneficiary
enrollment data, from HCFA's internal systems. Contractors pay approved
claims by check or by electronic funds transfers. Each day, contractors'
banks draw money from the Federal Reserve System sufficient to cover the
provider checks and electronic funds transfers expected to clear the bank
during the next business day. Figure 1 provides an overview of the Medicare
fee-for-service claims process for the part B program.

Figure 1: Overview of the Medicare Part B Fee-For-Service Claims Process

Source: GAO, from HCFA documentation.

In fiscal year 1999, about 81 percent of part B claims that were completed
were submitted electronically by providers or billing services, which use
one of two standard electronic formats. As illustrated in figure 2, once
claims are submitted, carriers and HCFA use a variety of automated edits to
determine the validity of these claims.

Note: This flowchart does not reflect claims payment adjustments that may
occur.

Source: GAO, verified by officials from two carriers.

Carriers generally use three types of edits before authorizing the payment
of a claim. First, front-end edits are used to ensure that valid values are
used and appropriate fields are completed. Claims that fail the front-end
edits are rejected and returned to the provider. Second, carriers use
utilization/medical policy edits to check claims against the
medical-necessity criteria in medical policies. Utilization/medical policy
edits are particularly important because Medicare pays providers a fee for
covered medical services, which are identified through a complex,
three-level coding system, the HCFA Common Procedure Coding System. Using
these codes, utilization/medical policy edits flag indicators such as
whether the medical diagnosis was appropriate for the patient's gender or
age or whether the medical procedure exceeded the threshold allowed during a
given year. These edits can result in (1) a claim passing to the next set of
edits, (2) a claim denial, (3) a claim being suspended until a manual review
by claims examiners (who may request additional documentation) is conducted,
or (4) a claim adjustment. The third type of carrier edits check for other
payers, which are other primary sources of payment, such as
employer-sponsored insurance or third-party liability settlements. If
another potential payer is identified, the claim is generally denied.

Once a claim passes the carrier edits, the claim is checked against one of
the nine CWFs that are processed at seven different computer sites around
the country. The CWF edits check for items such as beneficiary eligibility,
deductibles and limits, and duplicate claims. These edits can result in
(1) an authorized claim, (2) a claim returned to the carrier for further
review, or (3) a claim adjustment. The CWF also checks for other payers and,
if found, the claim is returned to the carrier for further review.

Medicare Part B Claims Could Be Paid Faster Using Current Processes, But
Less Interest Would Be Earned

One drawback to eliminating the mandatory payment delay is that the
Supplementary Medical Insurance trust fund, from which the Medicare part B
program is funded, would lose some of the interest it earns on its balance
if payments were made more quickly. Under HCFA's current claims processing
environment, we estimate that the trust fund could lose as much as about
$140 million in interest revenue annually if the mandatory payment delay
were removed. This amount assumes (1) annual part B outlays of $60 billion,
(2) that the average time to pay claims would drop from 17.3 days to 5 days,
and (3) an average interest rate of about 7 percent on securities. The
amount the trust fund could lose may be even higher if a real-time claims
processing system were implemented because the average time to pay a claim
could drop below 5 days. The Medicare Supplementary Medical Insurance trust
fund is financed by payments from federal government general revenues and by
monthly premiums charged beneficiaries. Consequently, a decrease in interest
earnings could prompt the need for additional appropriations or increases in
beneficiaries' premiums to compensate for the interest that the trust fund
would otherwise have earned.

Actions to Minimize Risks Necessary Before Developing an Immediate Claim,
Administration, Payment Resolution, and Data Collection System

While the development of an immediate claim, administration, payment
resolution, and data collection system to be used by the Medicare part B
program might be feasible, it would significantly change the government's
current processes because it would require the real-time processing of
certain elements of the claims process that are currently performed in batch
mode or manually. In the abstract, a real-time Medicare part B claims
process could be achievable if appropriate systems development policies and
techniques are used. Although more beneficiaries might have to pay their
copayments immediately, it could provide health care providers and
beneficiaries with several benefits-primarily the immediate notification of
approved or denied claims. However, without appropriate safeguards, a
real-time claims processing system could involve serious risks because it
opens the process to a possible rise in the number of improper Medicare
payments. In addition, the technical and cost risks associated with
developing a real-time claims processing system could be considerable.

A Real-Time Medicare Claims Processing System Should Include Controls to
Minimize Improper Payments

A major internal control challenge that a real-time claims processing system
would have to overcome is ensuring that prepayment processes currently
performed manually are adequately addressed. Any new real-time claims
process applied to all claims would have to find a way to accommodate
existing manual processes (e.g., postpone until after claims payment or
provide tentative claims approval in certain circumstances), such as in the
case of claims examiners' reviews of claims that are suspended because they
did not pass utilization/medical policy edits or in cases that involved
claims in which Medicare should be the secondary, rather than primary,
payer. This latter issue is particularly problematic because determining
another insurer's liability can be a time-consuming process of discovering
whether insurance coverage overlaps and, if so, ascertaining Medicare's
liability. If issues such as these are not adequately addressed, additional
improper Medicare payments can result.

It is also essential that current program safeguards, such as the edit
process illustrated in figure 2, not be compromised. The utilization/medical
policy edits that address the often complex art of coding claims are a
particular area of concern. As previously mentioned, HCFA's Common Procedure
Coding System uses three levels of codes:

   * Level 1, the American Medical Association's Physicians' Current
     Procedural Terminology, consists of a list of 5-digit codes for most of
     the services performed by physicians. These codes are used to bill for
     most procedures and services but have limited selections for describing
     supplies, materials, and injections.
   * Level 2 are national codes that supplement the level 1 codes and are
     used to bill for a range of services and supplies such as vision
     services and surgical supplies. These codes have a uniform description
     nationwide, but due to what is known as "carrier discretion," their
     processing and reimbursement are not necessarily uniform.
   * Level 3 are local codes developed by individual Medicare carriers. The
     codes are often used to describe new services, supplies, and materials,
     as well as to report procedures and services that have been deleted
     from Current Procedural Terminology codes but are still recognized and
     reimbursed by the carrier.

The Medicare coding system is difficult to use because it (1) attempts to
identify codes for all accepted medical procedures, including codes to
describe minor procedures that are components of more comprehensive
procedures, and (2) changes every year. For example, the fee for surgery
often includes the cost of related services for the global service period,
that is, for a set number of days before and after the surgery. To prevent
overpayment in these cases, Medicare carriers need to identify when claims
for surgery include codes that represent related services and reduce the
payment accordingly. These complexities can inadvertently lead providers to
submit improperly coded claims. They also make the Medicare program
vulnerable to abuse from providers or billing services that attempt to
maximize reimbursement by intentionally submitting claims containing
inappropriate combinations of codes.

Because a real-time claims processing system can be particularly vulnerable
to code manipulation (e.g., through repeated submission of fraudulent claims
until they pass the system's edits), it would be prudent to exclude problem
providers from participating in a real-time system and require that new
providers complete a probationary period before they become eligible to
participate. In another situation-agency "fast pay" initiatives (when
payment authorization is made prior to verifying receipt and acceptance of
goods or services)-we have similarly stated that agencies should limit its
use to those cases in which suppliers have had and continue to have good
ongoing business relationships with the agency. While the system proposed by
H.R. 4401 is not a "fast pay" situation, it would be prudent to employ these
same controls since Medicare has areas in which mispayment and fraud have
been particular problems. For example, medical equipment supply is an area
vulnerable to fraud, as indicated by its the high payment error rate.
Indeed, according to fiscal year 1997 and 1998 Department of Justice
reports, a few medical equipment suppliers were able to enroll in the
Medicare program and obtain millions of dollars in fraudulent payments
before post-payment reviews and utilization analyses were able to identify
the fraudulent activity.

Further, ensuring that adequate documentation controls (e.g., detailed
history files and/or logs) are in place and enforced to ensure that the
electronic trail is not lost or tampered with would be particularly
important in a Medicare real-time processing environment. The importance of
maintaining detailed Medicare payment histories and medical records is
demonstrated by the results of HHS' Office of the Inspector General's fiscal
year 1999 claims review. The Office of the Inspector General found that
claim payment histories and provider medical records were essential to
identifying the payment errors it found.

Technical and Cost Risks Should Also Be Considered

Response times, which can be slowed by the amount and type of
telecommunications involved and the complexity of processing, are a critical
factor in the success of real-time systems. An example of a systems
development that failed, in part due to a response time problem, is the
Bureau of Land Management's Automated Land and Mineral Record System Initial
Operating Capability. As we testified in March 1999, during an operational
assessment test and evaluation, users reported that system response time
problems were severe or catastrophic at all test sites. Because of this and
other problems and after obligating over $67 million, the Bureau of Land
Management decided that the Initial Operating Capability was not deployable.
While a high-quality system design would reduce the risk of slow response
times, hundreds of thousands of providers could be submitting millions of
transactions daily (carriers completed action on almost 718 million Medicare
part B claims in fiscal year 1999). Moreover, it is critical that system
controls (such as the many and varied edits previously discussed) not be
compromised in an effort to achieve reasonable response times.

Security, already a major concern in the Medicare program, must also be
adequately addressed in any proposed real-time claims processing system.
H.R. 4401 requires that the real-time claims processing system include
strict security measures that guard system integrity, including protecting
the privacy of patients and the confidentiality of personally identifiable
health insurance data. Implementing such requirements, however, is not easy.

Both HHS' Office of the Inspector General and we have reported that HCFA's
computer controls do not effectively prevent unauthorized access to, and
disclosure of, sensitive Medicare information. This problem could be
compounded if appropriate security controls are not designed into the
proposed system. In particular, without appropriate controls, electronic
connections can provide a path that can be used by hackers and others to
gain access to databases that contain sensitive information or to simply
disrupt operations.

Recent experiences with the Melissa and "ILOVEYOU" computer viruses
demonstrate the formidable challenge the federal government faces in
protecting its information technology assets and sensitive data. Although
key government services remained largely operational, these viruses were
disruptive and provided evidence that computer attack tools and techniques
are becoming increasingly sophisticated. Moreover, if the design for the
real-time claims processing system includes a World Wide Web-based system,
the possibility of other types of attacks must also be considered and
addressed. For example, a "denial-of-service" attack (e.g., a web site is
flooded with fake requests for pages) can make it difficult or even
impossible for legitimate customers to access a web site or cause the
targeted system to crash. Computer attacks are also a cause for broader
information security concerns across government because of the inability to
detect, protect against, and recover from computer attacks; inadequately
segregated duties, which increase the risk that people can take unauthorized
actions without detection; and weak configuration management processes.

Developing a Single Real-Time Claims Processing System for Both Medicare
Part B and FEHBP Would Be Challenging

Under FEHBP, the government contracts with private plans to finance or
provide care to federal workers and retirees for negotiated annual premiums.
The government runs no plans, pays no claims, and its financial obligations
are limited to its share of the cost of the private plan premiums and
certain administrative costs. For 2000, federal employees could select from
seven nationwide fee-for-service plans, six fee-for-service plans open to
specific groups, and hundreds of health maintenance organization plans
available throughout the nation.

As we explained in August 1998, Medicare and FEHBP are significantly
different. For example, HCFA and its carriers authorize claims payments and
monitor abuse or fraud, while these roles are delegated to the hundreds of
health plans that are enrolled under FEHBP. In addition, traditional
Medicare covers the same standard package of services and requires the same
deductibles, coinsurance, and copayment requirements for all beneficiaries.
In contrast, FEHBP does not require participating plans to cover a standard
or core benefits package. Although all plans offer inpatient hospital and
outpatient medical coverage as well as certain OPM-required services,
specific benefits vary. These differences would make it challenging and
costly to design and implement a real-time claims processing system for both
programs. Moreover, FEHBP carriers may balk at being forced to implement a
system that was not developed with their particular systems and processes in
mind, and it could cause them to drop out of the program.

Role and Composition of the Health Care Infrastructure Commission Should Be
Carefully Considered

The commission could elect to use HCFA for the development, implementation,
and maintenance of the system. In such a case, if a real-time claims
processing system is to be developed, it may be more fitting for the
proposed commission to oversee HCFA's actions, rather than develop and
implement the system itself. Such oversight could include evaluating the
system design and monitoring HCFA's development and implementation actions.

Aside from its role, the composition of the commission also needs to be
carefully considered. In particular, having health care and financial
management expertise on the commission would be critical. As currently
conceived, though, the commission includes several officials from federal
agencies with expertise in advanced information technology but not health
care or financial management. Specifically, the bill explicitly calls for
each official appointed to the commission to "be an expert in advanced
information technology" but does not address health care or financial
management expertise. If a real-time claims processing system is to be
developed, as envisioned by the bill, consideration should be given to
including key HCFA and carrier officials with health care claims processing,
program integrity, and financial management expertise on the commission.

One reason it is important for HCFA and its contractors to be part of the
commission is that the development of a real-time claims processing system
could overlap-and possibly conflict with-ongoing and planned HCFA
initiatives, which could be costly and disruptive to both efforts. For
example, HCFA plans to transition from four to two standard Medicare part B
systems (one is only for durable medical equipment carriers) by fiscal year
2003. Initiatives such as this would clearly affect, and be affected by, a
real-time claims processing system.

Other entities that should be considered for membership in the commission if
the real-time claims processing system set out in the bill is to be
developed are OPM and providers. A representative from OPM should be
considered as a member of the commission since, as currently called for in
the bill, any system developed would be applied to the FEHBP. Moreover, it
may be desirable to have a representative from the provider community on the
commission, since a real-time claims processing system would also
significantly affect providers.

Past HCFA Failure Could Provide Useful Lessons for Proposed System

The learning experience HCFA gained from MTS can provide lessons for the
proposed real-time claims processing system. In particular, as we reported
in May 1997, MTS was not adequately managed as an investment. HCFA had not
followed practices that are essential if management is to make informed
information technology decisions. Such practices include preparing a valid
cost-benefit analysis, considering viable alternatives and assessing risks,
and evaluating how the proposed technology will contribute to improvements
in mission performance.

While H.R. 4401 requires the commission to perform a study on the design and
construction of the proposed real-time claims processing system, the bill
does not require that analyses such as these be performed, which can reduce
risks and help ensure that information technology projects achieve maximum
return on investment. Accordingly, the proposed system could benefit from
the completion of investment management analyses before a decision is made
about whether the system should be implemented. These analyses could
determine whether cost-effective ways to address the issues that we have
outlined exist.

Another lesson that can be learned from the MTS project is that a phased
approach can reduce the financial, schedule, and technical risks of a
project. The original MTS schedule was developed on the basis of a grand
design approach, in which the complete system would be implemented at one
time. A phased approach can reduce the risks inherent in any large computer
development effort-cost overruns, schedule delays, and the system's failure
to perform as expected. Accordingly, it might also be desirable to take a
phased approach to the proposed real-time claims processing system, which
could reduce its risks.

Before an implementation decision is made, it is particularly important to
demonstrate that a real-time claims processing system can be designed that
provides the safeguards necessary to minimize improper payments. Moreover,
because of the complexity of the Medicare process, additional analyses of
the technical and cost risks of a real-time claims processing system would
be prudent before requiring that it be developed and implemented. In
addition, the administrative and benefits differences between Medicare and
FEHBP would make the development and implementation of a system applicable
to both programs difficult. Further, the role and makeup of the commission
should be carefully considered to help ensure that any such system would
take into account the current Medicare environment, as well as health care
and financial management issues. Finally, lessons learned in HCFA's MTS
failure demonstrate that it is important that critical analyses be performed
before implementation decisions are made. Accordingly, it may be premature
to require implementation of the system envisioned by the bill until such
analyses are completed.

Mr. Chairman, this concludes our statement on H.R. 4401. We have also
provided additional technical comments on the bill to your staff. We would
be pleased to respond to any questions that you or other members of the
Subcommittee may have at this time.

Contacts and Acknowledgments

(511858/916364)

        Orders by Internet

For information on how to access GAO reports on the Internet, send an e-mail
message with "info" in the body to:

[email protected]

or visit GAO's World Wide Web home page at:

http://www.gao.gov

        Web site: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: [email protected]

1-800-424-5454 (automated answering system)
  
*** End of document. ***