This is the accessible text file for GAO report number GAO-10-481T 
entitled 'Medicare Part D: CMS Oversight of Part D Sponsors' Fraud and 
Abuse Programs Has Been Limited, but CMS Plans Oversight Expansion' 
which was released on March 3, 2010. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as 
part of a longer term project to improve GAO products' accessibility. 
Every attempt has been made to maintain the structural and data 
integrity of the original printed product. Accessibility features, 
such as text descriptions of tables, consecutively numbered footnotes 
placed at the end of the file, and the text of agency comment letters, 
are provided but may not exactly duplicate the presentation or format 
of the printed version. The portable document format (PDF) file is an 
exact electronic replica of the printed version. We welcome your 
feedback. Please E-mail your comments regarding the contents or 
accessibility features of this document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Testimony: 

Before the Subcommittee on Federal Financial Management, Government 
Information, Federal Services, and International Security, Homeland 
Security and Governmental Affairs Committee, U.S. Senate: 

United States Government Accountability Office: 
GAO: 

For Release on Delivery: 
Expected at 2:30 p.m. EST: 
Wednesday, March 3, 2010: 

Medicare Part D: 

CMS Oversight of Part D Sponsors' Fraud and Abuse Programs Has Been 
Limited, but CMS Plans Oversight Expansion: 

Statement of Kathleen M. King:
Director, Health Care: 

GAO-10-481T: 

GAO Highlights: 

Highlights of GAO-10-481T, a testimony before the Subcommittee on 
Federal Financial Management, Government Information, Federal 
Services, and International Security, Homeland Security and 
Governmental Affairs Committee, U.S. Senate. 

Why GAO Did This Study: 

Medicare Part D, the voluntary, outpatient prescription drug benefit 
for eligible individuals 65 years and older and certain individuals 
with disabilities, is at risk for fraud, waste, and abuse. Part D is 
administered by the Centers for Medicare & Medicaid Services (CMS). 
All Part D sponsors—private companies that operate Part D benefit 
plans—are required to have programs to safeguard the Part D program 
from fraud, waste, and abuse. GAO refers to these programs as fraud 
and abuse programs. 

This statement discusses CMS’s oversight of Part D sponsors’ fraud and 
abuse programs, including its past efforts and planned oversight 
activities. It is primarily based on the GAO report, Medicare Part D: 
Some Plan Sponsors Have Not Completely Implemented Fraud and Abuse 
Programs, and CMS Oversight Has Been Limited (GAO-08-760). The five 
Part D sponsors GAO reviewed for that report had not completely 
implemented all of CMS’s elements for Part D fraud and abuse programs 
at that time. CMS agreed with GAO’s recommendation in the report that 
it conduct timely audits of Part D sponsors’ fraud and abuse programs. 

For the 2008 report, GAO reviewed laws, regulation, and CMS documents, 
including fraud and abuse program guidance. GAO also interviewed CMS 
officials. For this statement, GAO updated selected information on 
CMS’s oversight by interviewing CMS officials and reviewing agency 
documents. 

What GAO Found: 

In July 2008, GAO reported that CMS’s review of fraud and abuse 
program plans was limited to the review and approval of Part D sponsors’
 fraud and abuse program plans submitted as part of the initial 
contract-application process. For example, CMS indicated that the 
agency did not require Part D sponsors to submit new or updated fraud 
and abuse program plans during the contract renewal process for 
program years 2007 or 2008. Further, in the July 2008 report, GAO 
noted that CMS had not conducted audits as it had detailed in its 2005 
Part D Oversight Strategy to ensure that sponsors had implemented 
fraud and abuse program plans. In February 2010, CMS officials told us 
the agency had completed desk audits (reviews of requested documents) 
in 2008 and 2009 and was beginning to implement an expanded oversight 
strategy. CMS officials reported that between October 2008 and April 
2009 the agency’s contractors had completed 16 desk audits of selected 
Part D sponsors’ fraud and abuse programs. These officials reported 
that the agency has revised its audit protocol and piloted on-site 
audits (which include interviews and other face-to-face evaluations) 
to assess the effectiveness of these programs more thoroughly. In 
addition, CMS issued a proposed rule in 2009 to increase its oversight 
efforts and ensure that sponsors have effective compliance programs in 
place. CMS noted in issuing the proposed rule that GAO requested that 
CMS take actions to evaluate and oversee fraud and abuse programs. CMS 
expects the rule to be finalized in March 2010. 

View [hyperlink, http://www.gao.gov/products/GAO-10-481T] or key 
components. For more information, contact Kathleen M. King at (202) 
512-7114 or kingk@gao.gov. 

[End of section] 

Mr. Chairman and Members of the Subcommittee: 

I am pleased to be here today to discuss CMS's oversight of programs 
that address the risks for fraud, waste, and abuse in Medicare Part D. 
The Medicare Part D program, administered by the Centers for Medicare 
& Medicaid Services (CMS), provides a voluntary, outpatient 
prescription drug benefit for eligible individuals 65 years and older 
and eligible individuals with disabilities. CMS contracts with private 
companies--such as health insurance companies and companies that 
manage pharmacy benefits--to provide Part D prescription drug benefit 
plans for Medicare beneficiaries. These companies are referred to as 
Part D sponsors. About 27 million individuals were enrolled as of 
December 2009, and estimated Medicare Part D spending was $51 billion 
in fiscal year 2009.Because of its vulnerability to fraud, waste, and 
abuse, GAO has designated Medicare as a high-risk program since 1990. 
[Footnote 1] We and others have previously reported that the size, 
nature, and complexity of the Part D program make it a particular risk 
for fraud, waste, and abuse.[Footnote 2] 

The Medicare Prescription Drug, Improvement, and Modernization Act of 
2003 (MMA),[Footnote 3] which established the Part D program,requires 
all Part D sponsors to have programs to safeguard Part D from fraud, 
waste, and abuse.[Footnote 4] CMS regulations require Part D sponsors 
to have compliance plans detailing their fraud and abuse programs. 
[Footnote 5] In April 2006, CMS issued guidance in chapter 9 of its 
Medicare Prescription Drug Benefit Manual on the seven required 
elements of these plans.[Footnote 6] (See table 1.) 

Table 1: Description of Required Medicare Part D Compliance Plan 
Elements for Fraud and Abuse Programs: 

Compliance plan elements: Written Policies, Procedures, and Standards 
of Conduct; 
Description: Include written policies, procedures, and standards of 
conduct articulating the organization's commitment to comply with all 
applicable federal and state standards. 

Compliance plan elements: Compliance Officer and Compliance Committee; 
Description: Designate a compliance officer and a compliance committee 
that are accountable to senior management. 

Compliance plan elements: Effective Training and Education; 
Description: Include effective training and education pertaining to 
fraud, waste, and abuse for the organization's employees, contractors 
and directors. 

Compliance plan elements: Effective Lines of Communication; 
Description: Include effective lines of communication between the 
compliance officer and the organization's employees, contractors, 
directors, and the members of the compliance committee. 

Compliance plan elements: Enforcement of Standards through 
Disciplinary Guidelines; 
Description: Have well-publicized disciplinary guidelines through 
which sponsors must enforce standards. 

Compliance plan elements: Internal Monitoring and Auditing; 
Description: Include effective internal monitoring and auditing 
procedures. 

Compliance plan elements: Prompt Responses to Detected Offenses; 
Description: Include procedures for ensuring prompt responses to 
detected offenses and development of corrective action initiatives, 
including responses to potential offenses. 

Source: GAO summary of regulations. 

[End of table] 

In this testimony, we focus on the extent of CMS's oversight of Part D 
sponsors' fraud and abuse programs, including its past efforts and 
planned oversight activities. My statement is based primarily on our 
July 2008 report, which focused on Part D sponsors' implementation of 
fraud and abuse programs and CMS's oversight of those Part D sponsors' 
programs.[Footnote 7] Our July 2008 report is part of a larger GAO 
body of ongoing work on Part D oversight and fraud, waste, and abuse 
prevention (see "Related GAO Products," attached). This statement also 
includes selected updated information on CMS's oversight obtained from 
CMS since our July 2008 report. 

In our July 2008 report, we found that the five Part D sponsors we 
reviewed, which covered more than one-third of total Part D enrollees, 
had not completely implemented all seven of CMS's required compliance 
plan elements for a Part D fraud and abuse program. All Part D 
sponsors had completely implemented the requirements for three of the 
seven required compliance plan elements. However, Part D sponsors 
varied in their implementation of the remaining required elements. 
[Footnote 8] For example, only two of the five sponsors met the 
requirements for effective training and education related to fraud and 
abuse prevention. 

To conduct our evaluation of CMS's oversight for the July 2008 report, 
we reviewed relevant laws, regulations, and CMS guidance to determine 
the elements of a comprehensive compliance plan including fraud and 
abuse programs. We also interviewed officials from CMS and the 
Department of Health and Human Services' (HHS) Office of the Inspector 
General (OIG). In addition, we reviewed documentation from CMS, 
including CMS's Part D oversight strategy, program audit strategies, 
contracts related to Part D program integrity efforts, and technical 
assistance provided by CMS specific to the fraud and abuse program. A 
detailed explanation of our methodology is included in our July 2008 
report. For this statement, we also interviewed officials from CMS and 
reviewed agency documents to obtain selected updated information on 
CMS oversight. We discussed the information in this statement with a 
CMS official responsible for Part D oversight. 

We conducted the performance audit for the July 2008 report from 
October 2006 through June 2008 and we updated information regarding 
CMS's oversight of Part D sponsors' fraud and abuse programs in 
February 2010, in accordance with generally accepted government 
auditing standards. Those standards require that we plan and perform 
the audit to obtain sufficient, appropriate evidence to provide a 
reasonable basis for our findings and conclusions based on our audit 
objectives. We believe that the evidence obtained provides a 
reasonable basis for our findings and conclusions based on our audit 
objectives. 

While CMS's Oversight of Part D Sponsors' Fraud and Abuse Programs Has 
Been Limited, the Agency Plans to Expand Its Oversight: 

While CMS oversight of Part D fraud and abuse programs has been 
limited, the agency plans to expand this oversight, including adding 
on-site audits (which include interviews and other face-to-face 
evaluations) in place of the desk audits (reviews of requested 
documents only) it has completed. In July 2008, we reported that CMS's 
review of fraud and abuse program plans was limited to the review and 
approval of Part D sponsors' compliance plans detailing their fraud 
and abuse program plans submitted as part of the initial contract- 
application process. For example, CMS officials reported that Part D 
sponsors with approved fraud and abuse program plans prior to the 
issuance of chapter 9 of CMS's Medicare Prescription Drug Benefit 
Manual in April 2006 were not required to resubmit program plans. In 
addition, CMS told us the agency did not require Part D sponsors to 
submit new or updated fraud and abuse program plans during the 
contract-renewal process for program years 2007 or 2008, which limited 
CMS's ability to ensure that existing Part D sponsors continued to 
maintain compliance with this requirement. 

In 2008, we also reported that CMS had not conducted audits of 
sponsors' fraud and abuse program plans as it had detailed in its 2005 
Part D Oversight Strategy. In its 2005 comprehensive Oversight 
Strategy for the program, CMS noted that it would mainly rely on self-
reported, unaudited data provided by Part D sponsors, but acknowledged 
that program audits would be necessary to ensure compliance and to 
document that CMS had fulfilled its program oversight 
responsibilities. CMS further stated that it would reserve enforcement 
activities to large, repeated, or extreme Part D program violations. 
[Footnote 9] 

Offices within CMS with oversight authority cited resource problems in 
2006, Part D's first year of operation, that either prevented audits 
from occurring or changed the audit strategy to use desk audits rather 
than on-site audits. In 2007, CMS assessed Part D sponsors' compliance 
with selected program areas, but did not assess sponsors' 
implementation of fraud and abuse programs. Moreover, the agency said 
it did not plan to audit sponsors' implementation of fraud and abuse 
programs in 2008. In addition, CMS originally estimated that 10 of 
these audits would be completed by the Medicare Drug Integrity 
Contractors (MEDICs) during the 2005-2006 contract year of the program 
and that 35 of these audits would be conducted during the 2006-2007 
contract year. However, these audits did not occur.[Footnote 10] 

In February 2010, CMS officials told us the agency had completed desk 
audits in 2008 and 2009 and is beginning to implement an expanded 
oversight strategy. CMS officials reported that between October 2008 
and April 2009 its MEDICs completed 16 desk audits of selected Part D 
sponsors' fraud and abuse programs. Since then, these officials 
reported that CMS has revised its audit protocol and piloted on-site 
audits, rather than desk audits, to assess the effectiveness of these 
programs more thoroughly. The agency has conducted two on-site audits 
in the pilot so far and plans to conduct additional on-site audits of 
selected Part D sponsors' fraud and abuse programs by April 2010. 
Similar to our July 2008 findings, in conducting their desk and pilot 
on-site audits, CMS officials told us they found that sponsors had 
deficiencies in implementation of two of the required compliance 
elements--internal auditing and monitoring and training and education. 
However, the effectiveness of CMS's planned audits cannot be assessed 
until they are completed. 

In addition, CMS issued a proposed rule in 2009 to increase its 
oversight efforts and ensure that sponsors have effective compliance 
programs in place.[Footnote 11] In issuing the proposed rule, CMS 
noted that we requested the agency take actions to evaluate and 
oversee fraud and abuse programs to ensure sponsors have effective 
programs in place.[Footnote 12] The proposed rule would clarify 
existing policies regarding the elements of sponsors' compliance plans 
and CMS expects it to be finalized in March 2010. CMS officials told 
us that once the proposed rule is finalized, the agency will 
incorporate it into its expanded on-site audit protocol and update its 
guidance in chapter 9 of the Medicare Prescription Drug Benefit Manual 
to reflect the changes. 

Mr. Chairman, this concludes my prepared statement. I would be happy 
to answer any questions you or other members of the subcommittee may 
have. 

GAO Contact and Staff Acknowledgments: 

For further information about this statement, please contact Kathleen 
M. King at (202) 512-7114 or kingk@gao.gov. 

Contact points for our Offices of Congressional Relations and Public 
Affairs may be found on the last page of this statement. Catina 
Bradley and Martin T. Gahart, Assistant Directors; Jennie F. Apter, 
Jennel Harvey, Amy Shefrin, and Jennifer Whitworth were key 
contributors to this statement. 

[End of section] 

Related GAO Products: 

Improper Payments: Improper Payments: Responses to Posthearing 
Questions Related to Eliminating Waste and Fraud in Medicare and 
Medicaid. [hyperlink, http://www.gao.gov/products/GAO-09-838R]. 
Washington, D.C.: July 20, 2009. 

Medicare Part D: Opportunities Exist for Improving Information Sent to 
Enrollees and Scheduling the Annual Election Period. [hyperlink, 
http://www.gao.gov/products/GAO-09-4]. Washington, D.C.: December 12, 
2008. 

Medicare Part D Prescription Drug Coverage: Federal Oversight of 
Reported Price Concessions Data. [hyperlink, 
http://www.gao.gov/products/GAO-08-1074R]. Washington, D.C.: September 
30, 2008. 

Medicare Part D Low-Income Subsidy: Assets and Income Are Both 
Important in Subsidy Denials, and Access to State and Manufacturer 
Drug Programs Is Uneven. [hyperlink, 
http://www.gao.gov/products/GAO-08-824]. Washington, D.C.: September 
5, 2008. 

Medicare Part D: Some Plan Sponsors Have Not Completely Implemented 
Fraud and Abuse Programs, and CMS Oversight Has Been Limited. 
[hyperlink, http://www.gao.gov/products/GAO-08-760]. Washington, D.C.: 
July 21, 2008. 

Medicare Part D: Complaint Rates Are Declining, but Operational and 
Oversight Challenges Remain. [hyperlink, 
http://www.gao.gov/products/GAO-08-719]. Washington, D.C.: June 27, 
2008. 

Medicare Part D: Plan Sponsors' Processing and CMS Monitoring of Drug 
Coverage Requests Could Be Improved. [hyperlink, 
http://www.gao.gov/products/GAO-08-47]. Washington, D.C.: January 22, 
2008. 

[End of section] 

Footnotes: 

[1] GAO's audits and evaluations identify federal programs and 
operations that we determine are high risk due to their greater 
vulnerabilities to fraud, waste, abuse, and mismanagement. See GAO, 
High-Risk Series: An Update, [hyperlink, 
http://www.gao.gov/products/GAO-05-207] (Washington, D.C.: January 
2005). 

[2] GAO, Prescription Drugs: Oversight of Drug Pricing in Federal 
Programs, [hyperlink, http://www.gao.gov/products/GAO-07-481T] 
(Washington, D.C.: Feb. 9, 2007). U.S. House of Representatives Ways 
and Means Subcommittees on Health and Oversight, 110th Cong., March 8, 
2007 (testimony of Daniel R. Levinson, HHS Inspector General) and U.S. 
House of Representatives Oversight and Government Reform Committee, 
110th Cong., February 9, 2007 (testimony of Lewis Morris, Chief 
Counsel to the HHS Inspector General). 

[3] Pub. L. No. 108-173 § 101, 117 Stat. 2066, 2086 (adding Social 
Security Act § 1860D-4(c)(1)(D)) (codified at 42 U.S.C. § 1395w- 
104(c)(1)(D)). 

[4] Hereafter, we refer to programs to control fraud, waste, and abuse 
as fraud and abuse programs. 

[5] 42 C.F.R. § 423.504(b)(4)(vi). 

[6] The Medicare Prescription Drug Benefit Manual consists of multiple 
chapters related to various Part D program areas and outlines Part D 
program requirements and CMS guidance. The chapter in the manual 
entitled "chapter 9--Part D Program to Control Fraud, Waste, and 
Abuse" addresses fraud, waste, and abuse in Part D. 

[7] GAO, Medicare Part D: Some Plan Sponsors Have Not Completely 
Implemented Fraud and Abuse Programs, and CMS Oversight Has Been 
Limited, [hyperlink, http://www.gao.gov/products/GAO-08-760] 
(Washington, D.C.: July 21, 2008). 

[8] We conducted on-site reviews at five of the largest Part D 
sponsors to examine the extent to which these Part D sponsors 
implemented fraud and abuse programs. 

[9] CMS, Part D Oversight Strategy for Contractors/Industry (Oct. 24, 
2005). 

[10] CMS contracted with the MEDICs to support its audit, oversight, 
and antifraud and abuse efforts in Part D. In addition to audits, the 
MEDICs have been engaged to detect fraud, waste, and abuse in Part D 
and investigate reports from beneficiaries, sponsors, and other 
sources; conduct enrollment, eligibility, and marketing surveillance; 
and identify high-risk sponsors requiring further investigations. 
These tasks were outside the scope of the July 2008 report and are 
outside the scope of our current testimony. 

[11] Policy and Technical Changes to the Medicare Advantage and the 
Medicare Prescription Drug Benefit Programs, 74 Fed. Reg. 54,634 
(proposed Oct. 22, 2009). 

[12] In the July 2008 report, we recommended that CMS conduct timely 
audits of Part D sponsors' fraud and abuse programs. CMS agreed with 
our recommendation. 

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "E-mail Updates." 

Order by Phone: 

The price of each GAO publication reflects GAO’s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO’s Web site, 
[hyperlink, http://www.gao.gov/ordering.htm]. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional 
information. 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: fraudnet@gao.gov: 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Ralph Dawn, Managing Director, dawnr@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, D.C. 20548: 

Public Affairs: 

Chuck Young, Managing Director, youngc1@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: