This is the accessible text file for GAO report number GAO-05-656 
entitled 'Medicare: More Effective Screening and Stronger Enrollment 
Standards Needed for Medical Equipment Suppliers' which was released on 
October 12, 2005. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Report to the Chairman, Committee on Finance, U.S. Senate: 

United States Government Accountability Office: 

GAO: 

September 2005: 

Medicare: 

More Effective Screening and Stronger Enrollment Standards Needed for 
Medical Equipment Suppliers: 

GAO-05-656: 

GAO Highlights: 

Highlights of GAO-05-656, a report to the Chairman, Committee on 
Finance, U.S. Senate: 

Why GAO Did This Study: 

In fiscal year 2004, the Centers for Medicare & Medicaid Services (CMS) 
estimated that Medicare improperly paid $900 million for durable 
medical equipment, prosthetics, orthotics, and supplies—in part due to 
fraud by suppliers. To deter such fraud, CMS contracts with the 
National Supplier Clearinghouse (NSC) to verify that suppliers meet 21 
standards before they can bill Medicare. NSC verifies adherence to the 
standards through on-site inspections and document reviews. Recent 
prosecutions of fraudulent suppliers suggest that there may be 
weaknesses in NSC’s efforts to screen suppliers or in the standards. In 
this report, GAO evaluated: 1) NSC’s efforts to verify suppliers’ 
compliance with the 21 standards, 2) the adequacy of the standards to 
screen suppliers, and 3) CMS’s oversight of NSC’s efforts. 

What GAO Found: 

NSC’s efforts to verify compliance with the 21 standards are 
insufficient because of weaknesses in two key screening 
procedures—checking state licensure and conducting on-site inspections. 
NSC’s licensure check is ineffective because it relies on self-reported 
information about the items suppliers intend to provide to 
beneficiaries and does not match this against actual billing later. We 
found a total of 22 suppliers in Florida, Louisiana, and Texas that had 
each been paid at least $1,000 by Medicare in 2004 for providing oxygen 
services, but did not have the required state license. Further, more 
than half of the almost $107 million paid by Medicare for custom-
fabricated orthotics and prosthetics in Florida in 2004 went to 
suppliers that had not had their licenses checked. At least 46 of these 
suppliers were under investigation for fraud as of April 2005. NSC’s on-
site inspections also have weaknesses that limit their effectiveness. 
We estimate that NSC did not conduct required on-site inspections of 
605 suppliers. Further, when conducting on-site inspections, NSC does 
not require its inspectors to examine beneficiary files to assess 
whether suppliers are meeting the standard to maintain proof of 
delivery or check whether suppliers have a real source of inventory, as 
required by Medicare. 

Medicare’s 21 standards are currently too weak to be used effectively 
to screen medical equipment suppliers. Although Medicare paid suppliers 
about $8.8 billion in fiscal year 2004, the program’s 21 standards do 
not include measures related to supplier integrity and capability 
analogous to those that federal agencies generally apply to prospective 
contractors or those used by at least two state Medicaid programs for 
their suppliers. For example, in sworn testimony before the Committee 
on Finance in April 2004, an individual who pleaded guilty to Medicare 
fraud described how she was able to open a sham business with 
$3,000—despite lacking the experience and the financial, technical, and 
managerial resources to operate a legitimate supply company. If an 
agency finds a company does not meet federal contracting standards for 
integrity and capability, the agency may decline to award it a 
contract. If a contractor performs inadequately, the agency can 
terminate the contract. Further, agencies may disqualify a contractor 
from competing for other federal contracts. In addition, a California 
supplier that is disenrolled from Medicaid for failing to meet state 
requirements cannot reenroll for 3 years. In contrast, if a Medicare 
supplier can later demonstrate compliance with the 21 standards, CMS 
readmits it into the program. 

CMS’s oversight has not been sufficient to determine whether NSC is 
meeting its responsibilities in screening and enrolling DMEPOS 
suppliers. For example, CMS was unaware—until we informed the 
agency—that NSC had not conducted all required on-site inspections for 
suppliers. Moreover, while CMS has established performance goals for 
NSC related primarily to processing applications, it has not 
established a method to evaluate NSC’s success in identifying 
noncompliant and fraudulent suppliers and recommending that they be 
removed from the program. 

What GAO Recommends: 

GAO suggests that the Congress consider whether suppliers found to be 
noncompliant should wait a specified period of time before having their 
billing numbers reissued. GAO is also making several recommendations to 
the CMS Administrator to improve NSC’s licensure verification and on-
site inspections, the supplier standards, and CMS’s oversight of NSC. 
CMS generally concurred with all of the recommendations and provided 
information on the actions it was taking to implement each of them. 

www.gao.gov/cgi-bin/getrpt?GAO-05-656. 

To view the full product, including the scope and methodology, click on 
the link above. For more information, contact Leslie G. Aronovitz at 
(312) 220-7600 or aronovitzl@gao.gov. 

[End of section] 

Contents: 

Letter: 

Results in Brief: 

Background: 

NSC's Efforts Are Insufficient to Verify Suppliers' Compliance with the 
21 Standards: 

Medicare's Standards Are Too Weak to be Used Effectively to Screen 
DMEPOS Suppliers: 

CMS's Oversight Is Insufficient to Determine Whether NSC Screens and 
Monitors Suppliers Effectively: 

Conclusions: 

Matter for Congressional Consideration: 

Recommendations: 

Agency Comments: 

Appendix I: Objectives, Scope, and Methodology: 

Appendix II: Medicare's 21 Standards for Suppliers and NSC's Procedures 
to Verify Their Compliance: 

Appendix III: Agency Comments: 

Appendix IV: GAO Contact and Staff Acknowledgments: 

Related GAO Products: 

Tables: 

Table 1: Suppliers That Should Not Have Billed for Oxygen Services, but 
Were Paid at Least $1,000 for Them in 2004: 

Table 2: Examples of Suppliers That Had Billing Privileges Revoked, 
Were Reinstated, and Billed Improperly After Readmission into Medicare: 

Table 3: Medicare's 21 Standards for Medicare Suppliers of DME, 
Prosthetics, Orthotics, and Supplies and NSC's Procedures at Enrollment 
and Reenrollment to Verify Compliance with the Standards: 

Figure: 

Figure 1: Medicare Payments for Prosthetics and Custom-Fabricated 
Orthotics to Florida Suppliers That Did and Did Not Disclose Intention 
to Bill for These Items, 2003 and 2004: 

Abbreviations: 

CMS: Centers for Medicare & Medicaid Services: 
DME: durable medical equipment: 
DMEPOS: durable medical equipment, prosthetics, orthotics, and 
supplies: 
FBI: Federal Bureau of Investigation: 
MMA: Medicare Prescription Drug, Improvement, and Modernization Act of 
2003: 
NSC: National Supplier Clearinghouse: 
OIG: Office of Inspector General: 
OSI: Overland Solutions, Inc.: 
SACU: Supplier Audit and Compliance Unit: 

United States Government Accountability Office: 

Washington, DC 20548: 

September 22, 2005: 

The Honorable Charles E. Grassley: 
Chairman: 
Committee on Finance: 
United States Senate: 

Dear Mr. Chairman: 

Medicare is the federal program that helps pay for a variety of health 
care services and items on behalf of almost 42 million elderly and 
certain disabled beneficiaries. One of the responsibilities of the 
Centers for Medicare & Medicaid Services (CMS), the agency that 
administers Medicare, is to minimize improper payments made on behalf 
of its beneficiaries. Improper payments result from mistakes on the 
part of those who bill Medicare; abusive activities; or fraud, which is 
intentional misrepresentation. According to CMS estimates, in fiscal 
year 2004, Medicare paid about $8.8 billion in claims for durable 
medical equipment, prosthetics, orthotics, and supplies (DMEPOS), of 
which $900 million were improper payments.[Footnote 1] As we previously 
reported in November 2004, some improper payments were made to DMEPOS 
suppliers that were committing fraud.[Footnote 2] For example, in one 
2003 criminal case, 20 individuals in Arizona pleaded guilty to charges 
of defrauding Medicare of more than $25 million by creating about 30 
sham companies that billed for DMEPOS items that they did not deliver 
or that had not been ordered by the beneficiaries' physicians.[Footnote 
3] Similarly, in 2004, the government won a civil suit against 24 
DMEPOS suppliers for $366 million as treble damages to settle charges 
of falsely billing Medicare for items not needed or delivered as 
claimed. 

Because identifying and prosecuting suppliers[Footnote 4] engaged in 
fraudulent activity is time consuming, resource intensive, and costly, 
CMS tries to prevent potentially fraudulent entities from entering the 
Medicare program. To do so, using its statutory authority, CMS 
developed regulations that define the 21 standards that DMEPOS 
suppliers must meet to be authorized to bill Medicare for items and 
services that they provide to beneficiaries.[Footnote 5] The 21 
standards are intended to help ensure that suppliers are legitimate 
businesses as well as properly licensed by the states in which they 
operate--and therefore qualified--to provide DMEPOS items and services. 
CMS contracts with the National Supplier Clearinghouse (NSC) to screen 
potential suppliers and enroll those that comply with the 21 standards 
into the Medicare program. NSC verifies DMEPOS suppliers' compliance 
with most of the standards through on-site inspections[Footnote 6] and 
conducts other verification procedures using information from the 
applications or gathered during the on-site inspections. Enrolled 
suppliers are authorized to bill Medicare, and to retain their billing 
privileges must apply for reenrollment and be rescreened every 3 years. 
NSC may also verify compliance with the standards at other times-- 
usually when it receives information about possible noncompliance or 
fraud. 

Despite these safeguards, recent prosecutions of fraudulent suppliers 
that successfully billed Medicare suggest that there may be weaknesses 
in NSC's efforts to verify compliance with the standards or in the 
standards themselves. Due to concerns that such weaknesses may leave 
the Medicare program vulnerable to improper billing practices or allow 
unqualified suppliers to serve beneficiaries, you asked us to examine 
the procedures used by NSC to ensure that DMEPOS suppliers are 
legitimate businesses and are qualified to bill Medicare. In this 
report, we evaluated: 1) NSC's efforts to verify suppliers' compliance 
with the 21 standards, 2) the adequacy of the standards used to screen 
suppliers, and 3) CMS's oversight of NSC's efforts. 

To evaluate NSC's efforts to verify suppliers' compliance with the 
standards, we examined NSC's contract statement of work and its written 
procedures. Through this analysis, we determined that checking DMEPOS 
suppliers' state licenses[Footnote 7] and conducting on-site 
inspections were two of the most important verification procedures and 
we focused our review on them.[Footnote 8] We analyzed Medicare DMEPOS 
claims data for 2003 and 2004 in four states--Florida, Illinois, 
Louisiana, and Texas--and information from NSC's supplier 
database.[Footnote 9] This helped us determine whether suppliers had 
the state licenses necessary for the items they billed and whether NSC 
had conducted all required on-site inspections. We chose these states 
because they have licensure requirements for certain DMEPOS items and 
have suppliers with fraudulent Medicare DMEPOS billings. We assessed 
the reliability of the 2003 and 2004 claims data from CMS and the NSC 
supplier data files by performing electronic testing of required data 
elements, reviewing existing information about the data and the systems 
that produced them, and interviewing CMS and NSC officials 
knowledgeable about the data. We determined that these data were 
sufficiently reliable to address the issues in this report. We also 
accompanied NSC staff on supplier on-site inspections and had our 
Forensic Audits and Special Investigations staff investigate selected 
suppliers and companies associated with them in Florida and Texas. 

To determine the adequacy of the 21 standards to screen suppliers, we 
compared them to certain standards applicable to government contracting 
and for participating as Medicaid[Footnote 10] DMEPOS suppliers in 
California and Florida. Further, we analyzed appeals from suppliers 
that had their supplier numbers denied or revoked to better understand 
their infractions and obtained documentation on criminal cases of 
suppliers that had defrauded Medicare or were under active 
investigation. We interviewed fraud inspectors at NSC and in the 
Department of Health and Human Services Office of Inspector General 
(OIG), as well as DMEPOS suppliers and their representatives. To assess 
CMS's oversight of NSC, we reviewed the agency's written evaluation 
procedures, evaluation reports, and other documents related to the 
agency's oversight. In addition, we interviewed NSC and CMS officials 
about NSC's efforts to verify compliance, the adequacy of the 
standards, and CMS's oversight of NSC. Appendix I includes a more 
detailed discussion of our scope and methodology. Our work was 
conducted from June 2004 to September 2005 in accordance with generally 
accepted government auditing standards. 

Results in Brief: 

NSC's efforts to verify compliance with the supplier standards in order 
to enroll only legitimate and qualified suppliers in Medicare are 
insufficient because of weaknesses in procedures for checking state 
licensure and conducting on-site inspections and gaps in NSC's 
performance of the procedures. NSC lacks an effective method for 
identifying the state licenses suppliers are required to maintain to 
meet the standard for adhering to all federal and state requirements. 
This is primarily because NSC relies on self-reported information from 
suppliers' enrollment applications about the items they intend to 
provide to beneficiaries and does not match this later against 
suppliers' actual billing. During our work, we found 121 suppliers in 
Florida, Louisiana, and Texas that had each been paid at least $1,000 
by Medicare in 2004 for providing oxygen services but had not both 
disclosed that they would be doing so and provided a license for NSC to 
review. Twenty-two of these suppliers were not licensed to provide 
oxygen services in 2004. Further, CMS requires NSC to check state 
licensure only during initial enrollment, although suppliers may change 
the items supplied or allow licenses to lapse after enrollment. We 
identified 7 other suppliers in Florida, Louisiana, and Texas that 
lacked the needed state license to provide oxygen in 2004, although 
they had disclosed their intention to provide this service to NSC and 
were reimbursed at least $1,000 each by Medicare for providing it. We 
also identified 73 suppliers in Florida that billed for custom- 
fabricated orthotics and prosthetics without informing NSC of their 
intention to provide these items. Routinely identifying the suppliers 
that were billing without the required state license might have avoided 
some of the more than $56.3 million in improper payments made in 
Florida for custom-fabricated orthotics and prosthetics. In regard to 
on-site inspections, NSC's performance in conducting them exhibited 
weaknesses that limited their effectiveness. We estimate that NSC did 
not perform on-site inspections of 605 suppliers to verify those 
suppliers' compliance with Medicare's standards. Further, some of the 
procedures for conducting on-site inspections do not fully verify 
compliance with the standards because CMS has not required NSC to adopt 
a rigorous inspection process. For example, when conducting on-site 
inspections, NSC does not require its inspectors to examine beneficiary 
files to ensure that suppliers are meeting the standard for maintaining 
proof of delivery. Another standard requires suppliers to have 
inventory to fill orders, or a contract to purchase the items needed. 
However, if a supplier indicates that its inventory is stored off-site 
or is provided by another company, NSC does not require site inspectors 
to verify the inventory's existence or confirm that the company serving 
as its source is a legitimate business. 

Medicare's standards are currently too weak to be used effectively to 
screen DMEPOS suppliers. Although Medicare pays millions of dollars to 
suppliers, the program's 21 standards do not include measures related 
to supplier integrity and capability analogous to those that federal 
agencies generally apply to prospective contractors or those used by at 
least two state Medicaid programs for their suppliers. Federal 
agencies--including CMS--determine whether companies seeking federal 
contracts are "responsible"--that is, whether they have a satisfactory 
record of performance, integrity, and business ethics, as well as the 
financial, technical, and managerial ability to provide the specified 
products and services. According to federal requirements, agencies are 
not to award government contracts to companies that are not 
responsible. After receiving a federal government contract, a business 
that performs poorly on that contract can lose it and may have 
difficulty securing federal contracts in the future because of previous 
poor performance. In addition, in the case of certain serious offenses, 
a company can be debarred from federal contracting, generally for up to 
3 years. The Florida and California Medicaid agencies also have 
barriers to reentry of problematic Medicaid suppliers that have 
violated program rules--a 3-year exclusion in some cases. In contrast, 
because Medicare suppliers are not CMS contractors, they are not 
subject to federal procurement standards. Instead, they are subject to 
Medicare's standards, which generally do not require suppliers to 
demonstrate that they are responsible and do not limit the reentry of 
suppliers that have remedied past noncompliance with Medicare's 
standards. Having weak standards for suppliers helps individuals intent 
on defrauding Medicare to obtain billing privileges and be paid for 
fraudulent claims. For example, in sworn testimony before the Senate 
Committee on Finance in April 2004, an individual who pleaded guilty to 
Medicare fraud described how she was able to obtain a billing number by 
opening a sham business with $3,000--despite lacking the experience and 
the financial, technical, and managerial resources to operate a 
legitimate DMEPOS company. Even when CMS revokes suppliers' billing 
privileges, suppliers that have violated multiple standards have been 
able to reenroll within an average of 3 months. 

CMS's oversight has not been sufficient to determine whether NSC is 
meeting its responsibilities in screening, enrolling, and monitoring 
DMEPOS suppliers. For example, CMS has not effectively overseen NSC's 
verification of suppliers' state licenses. In addition, CMS was 
unaware--until we informed the agency--that NSC had not conducted 
required on-site inspections for suppliers and that--in contrast to CMS 
requirements--NSC's procedures allow its staff to use discretion in 
selecting suppliers for on-site inspections. These lapses may be 
attributed in part to limitations in the means through which CMS 
oversees its contractor--an annual inspection and monthly reports. 
During its annual inspection, CMS analyzes a small random sample of 
supplier files to determine, for instance, whether NSC is conducting on-
site inspections, verifying licenses, and denying or revoking billing 
privileges in accordance with CMS requirements. However, we determined 
that CMS's sample sizes are too small to identify systematic problems. 
Further, the monthly report CMS receives from NSC provides useful 
information on the contractor's workload, but does not provide 
information on the thoroughness of NSC's screening and enrollment 
efforts. Similarly, while CMS has established performance goals in 
NSC's contract related primarily to processing applications and 
handling supplier inquiries, it has not established performance goals 
connected to effective screening or fraud prevention efforts, such as 
examining whether the on-site inspections are conducted thoroughly 
enough to uncover noncompliance. 

To strengthen the supplier standards, we are suggesting that the 
Congress consider whether suppliers that violate the standards should 
have to wait a specified period of time from the date of their 
revocation to have a billing number reissued. We are also making 
several recommendations to the CMS Administrator to improve NSC's 
licensure verification and on-site inspections, the supplier standards, 
and CMS's oversight of NSC's screening efforts. CMS generally concurred 
with all of our recommendations and provided information on the actions 
it was taking to implement each of them. 

Background: 

Most Medicare beneficiaries elect to enroll in Part B 
insurance,[Footnote 11] which helps pay for certain physician, 
outpatient hospital, laboratory, and other services; DME, such as 
oxygen, wheelchairs, hospital beds, and walkers; prosthetics and 
orthotics; and certain supplies. Medicare, under Part B, pays for most 
DMEPOS based on a series of state-specific or regional-specific fee 
schedules. Under the schedules, Medicare pays 80 percent, and the 
beneficiary pays the balance, of either the actual charge submitted by 
the supplier or the fee schedule amount, whichever is less. To review 
and process DMEPOS claims, CMS contracts with four insurance companies, 
known as DME regional carriers. The DME regional carriers review and 
pay DMEPOS claims submitted by outpatient providers and suppliers on 
behalf of beneficiaries residing in specific regions of the 
country.[Footnote 12] 

CMS contracts with Palmetto Government Benefits Administrators to serve 
as the National Supplier Clearinghouse. In fiscal year 2004, NSC 
received $11.4 million for these activities, and for fiscal year 2005, 
its approved budget was $11.5 million. Palmetto also serves as the DME 
regional carrier for Region C. In addition, Palmetto serves as the 
Statistical Analysis Durable Medical Equipment Regional Carrier, which 
analyzes claims and reports to the DME regional carriers and CMS on 
trends in DMEPOS payment and areas of potential fraud. 

Medicare's Supplier Standards: 

Medicare's 21 supplier standards were introduced primarily to deter 
individuals intent on committing fraud from entering the program and to 
safeguard Medicare beneficiaries by ensuring that suppliers were 
qualified. The 21 standards apply to a variety of business practices 
and establish certain requirements. (See app. II for a list of the 21 
standards.) For example, the standards require suppliers to have a 
physical facility on an appropriate site that is accessible to 
beneficiaries and to CMS, with stated business hours clearly posted. 
CMS established the requirement for having an appropriate physical 
facility in December 2000 after investigators discovered fraudulent 
suppliers without fixed locations claiming vans or station wagons as 
their place of business or using mail drop boxes to receive Medicare 
payments for items they billed but never delivered. Among other things, 
the standards also require suppliers to: 

* comply with applicable federal and state regulatory requirements, 
including state licensure, when providing DMEPOS items or services; 

* maintain inventory on site or off site, or available through valid 
contracts with other companies not excluded from doing business with 
the federal government or its health care programs; and: 

* obtain comprehensive liability insurance. 

The 21 supplier standards also prohibit certain practices. For example, 
one standard generally prohibits suppliers from using telephone calls 
to solicit new business, because the Social Security Act prohibits this 
type of marketing to Medicare beneficiaries.[Footnote 13] 

Verifying Compliance with Supplier Standards: 

NSC verifies compliance with the supplier standards primarily during 
enrollment and reenrollment, through on-site inspections[Footnote 14] 
and desk reviews conducted by NSC analysts. (App. II lists the 
standards and how NSC verifies them during enrollment and 
reenrollment.) For example, the on-site inspections are used to check 
the compliance with the standards for whether the supplier: 

* has a physical facility on an appropriate site that is accessible to 
beneficiaries and to CMS, with a clearly visible sign with hours 
posted; 

* has its own inventory in stock on site, off site at another location, 
or has a contract with another company for the purchase of inventory; 

* maintains records that document delivery of items to beneficiaries 
and information provided to beneficiaries on warranties, including how 
repairs and exchanges will be handled, and how to contact the supplier 
in case of questions or problems; and: 

* has a written beneficiary complaint resolution policy and maintains 
records on beneficiary complaints and their resolution. 

NSC's analysts are expected to follow procedures to review information 
provided by the on-site inspection and take other steps to verify 
suppliers' compliance with the standards. For example, when on site the 
inspectors are expected to check that the supplier has all the valid 
occupation and business licenses required by its state and has a 
comprehensive liability insurance policy. The NSC analyst is expected 
to check that the supplier has all the state licenses that it would 
need to provide the items it disclosed in its application. The NSC 
analyst also is expected to contact the insurance underwriter to ensure 
that the supplier's policy is valid,[Footnote 15] and the post office 
to make sure the supplier's address is listed. NSC also has a procedure 
to match data from its supplier database with computerized lists 
maintained by the federal government to ensure that supply company 
owners are not prohibited from participating in federal health care 
programs or debarred from federal contracting. 

NSC does not specifically verify adherence to 4 of the 21 standards at 
enrollment and reenrollment, because violations would generally be 
apparent through its verification of other standards. For example, the 
standard that requires suppliers to furnish NSC with complete and 
accurate information on the application and notify NSC of any changes 
within 30 days is verified through checking the accuracy of the 
suppliers' disclosures of information for other standards--such as 
ownership and the appropriateness of the physical facility. 

On-site Inspection Procedures: 

The majority of on-site inspections are conducted by more than 380 
field representatives of Overland Solutions, Inc. (OSI), a company that 
performs this work as a subcontractor to NSC. In addition, NSC uses its 
own personnel, who are located in six cities, to conduct on-site 
inspections. NSC and OSI conducted over 20,000 on-site inspections in 
fiscal year 2004. 

In performing their reviews, the site inspectors follow certain 
procedures. NSC requires that site inspectors arrive unannounced for 
any inspection. Before the inspection, NSC provides the inspectors with 
briefing information on the supplier, including information on whether 
the supplier is enrolling or reenrolling and the type of state licenses 
to verify. While on site, inspectors are expected to take photographs 
of the supplier's sign with its business name, posted hours of 
operation, complete inventory in stock, and facility.[Footnote 16] NSC 
also expects site inspectors to obtain copies of relevant documents, 
such as state licenses, comprehensive liability insurance, contracts 
with companies for inventory, and contracts for the service and 
maintenance of DME. 

Enrollment, Disenrollment, and Appeals: 

As long as suppliers can demonstrate that they comply with the 
standards and have not been excluded from participating in any federal 
health care program, NSC must enroll or reenroll them in 
Medicare.[Footnote 17] Enrolled suppliers are issued a Medicare billing 
number. If NSC discovers that a new applicant or enrolled supplier is 
not in compliance with any of the 21 supplier standards, NSC can deny 
the application or, with CMS's approval, revoke the supplier's billing 
number.[Footnote 18] 

Suppliers whose applications have been denied or whose numbers have 
been revoked can submit a plan to NSC to correct the noncompliance or 
appeal the denial or revocation by requesting a hearing or both. If a 
supplier requests a hearing, the first level of appeal is conducted by 
a carrier hearing officer who was not involved in the original 
determination. The supplier can submit new information to address the 
compliance problems identified by NSC. If dissatisfied with the carrier 
hearing officer's ruling, either NSC or the supplier can request a 
review by an administrative law judge, which became the second level of 
appeal as of December 8, 2004.[Footnote 19] Prior to that date, second 
level appeal hearings were conducted by a CMS review official. At both 
levels of the hearing process, if the supplier can demonstrate that it 
is currently in compliance with the standards, the supplier will be 
given a billing number. 

Other NSC Efforts to Verify Suppliers' Compliance with Medicare's 
Standards: 

NSC's Supplier Audit and Compliance Unit (SACU) also has responsibility 
to help verify suppliers' compliance with the 21 standards and identify 
fraudulent activity. The SACU supervises NSC's site inspectors and 
oversees the OSI on-site inspections. It also analyzes supplier billing 
and enrollment patterns. Based on billing or other irregularities, the 
SACU can help NSC identify suppliers for additional on-site 
inspections. For example, the SACU might discover that several new 
suppliers are owned by the same individuals as other companies that are 
under investigation for fraudulent billing. Based on this information, 
the SACU could target the new suppliers for additional on-site 
inspections or refer the suppliers for investigation by federal law 
enforcement, such as the OIG and the Federal Bureau of Investigation 
(FBI). 

NSC's Efforts Are Insufficient to Verify Suppliers' Compliance with the 
21 Standards: 

NSC's verification procedures have weaknesses that leave the Medicare 
program without assurance that suppliers billing the program are 
meeting the 21 standards, and thus, are qualified and legitimate. NSC's 
procedures to verify state licenses have gaps that have allowed 
suppliers to be paid for DMEPOS items they are not licensed to supply 
in their states. In part, this is because CMS has not set requirements 
for a stronger licensure verification effort. Further, although on-site 
inspections play a key role in verifying suppliers' compliance with the 
21 standards, we estimate that NSC did not conduct more than 600 
required on-site inspections and its inspection procedures have 
limitations. 

NSC's Procedures to Verify State Licenses Have Gaps: 

NSC does not have an effective means of identifying suppliers that 
violate the standard to have appropriate state licensure for the items 
they provide to beneficiaries. This is partly because CMS's 
requirements are inadequate to assure an effective process and partly 
because NSC does not have effective procedures that are consistently 
followed. To determine whether it needs to verify a supplier's license, 
NSC relies on the information the supplier provides--in enrollment or 
reenrollment applications--regarding the items or services the supplier 
intends to provide to Medicare beneficiaries. Suppliers are required to 
certify on their applications that they will notify CMS of any changes 
to the information they provided on the form. However, if the supplier 
fills out the application incorrectly or dishonestly and does not 
provide a license during an on-site inspection, NSC would not verify 
whether the supplier has all the licenses needed in its state. We also 
found that NSC did not consistently resolve discrepancies or omissions 
in the information provided by suppliers--such as not forwarding a copy 
of a needed state license--before issuing suppliers billing numbers. 
Further, even though suppliers may change the items they supply, CMS's 
contract requires NSC to verify licensure only during enrollment and 
does not require verification at any later time, such as during 
reenrollment. Thus, even if a supplier begins to bill for items that 
require a state license and discloses this information during 
reenrollment, CMS does not require NSC to check the supplier's state 
licenses. Further, CMS does not require NSC to recheck suppliers prior 
to reenrollment to ensure that the supplier's license has not lapsed. 
Finally, CMS has not required NSC to verify licensure after enrollment 
by routinely comparing a supplier's actual billing history against the 
DMEPOS items and services originally disclosed on the supplier's 
application. Without such a check, CMS lacks assurance that suppliers 
are billing only for items they disclosed to NSC and for which NSC has 
verified a license. 

As a result of these gaps, Medicare paid suppliers when NSC had not 
verified their licenses, including some suppliers that lacked the 
appropriate license. As table 1 shows, by analyzing 2004 DMEPOS claims 
data, we found 121 suppliers in Florida, Louisiana, and Texas that were 
each paid at least $1,000 by Medicare for oxygen services, even though 
they should not have billed for them. These suppliers either had not 
informed NSC that they would be billing for oxygen, did not provide NSC 
with the appropriate state license to verify, or both. Therefore, these 
suppliers were not in compliance with the 21 standards. In total, these 
suppliers were paid almost $6 million by Medicare. When we checked with 
the three states, we found that 22 of these suppliers did not have a 
license to provide oxygen in their states in 2004. These unlicensed 
suppliers were paid $231,730 in 2004 by Medicare for oxygen on behalf 
of beneficiaries. In addition, we verified licensure with the 
respective states for a sample of the suppliers that had disclosed to 
NSC their intention to bill for oxygen and had been paid at least 
$1,000 by Medicare for this service. Through this process, we 
identified 7 more suppliers that did not have the required state 
license to provide oxygen services in 2004. 

Table 1: Suppliers That Should Not Have Billed for Oxygen Services, but 
Were Paid at Least $1,000 for Them in 2004: 

Number of suppliers that should not have billed for oxygen; 
Florida: 62; 
Louisiana: 14; 
Texas: 45. 

As a percentage of all suppliers paid at least $1,000 for oxygen 
services in the state; 
Florida: 6.4; 
Louisiana: 10.9; 
Texas: 6.4. 

Oxygen payments to suppliers that should not have billed for oxygen; 
Florida: $3,299,445; 
Louisiana: $855,659; 
Texas: $1,831,868. 

As a percentage of payments to all suppliers paid at least $1,000 for 
oxygen services in the state; 
Florida: 2.4%; 
Louisiana: 4.6%; 
Texas: 1.5%. 

Number of suppliers that should not have billed for oxygen and also 
lacked the appropriate state license in 2004[A]; 
Florida: 7; 
Louisiana: 3; 
Texas: 12. 

Payments to suppliers that should not have billed for oxygen and lacked 
the appropriate state license in 2004[A]; 
Florida: $41,382; 
Louisiana: $25,322; 
Texas: $165,026. 

Source: GAO. 

Note: Table is based on analysis of NSC's active supplier data file as 
of May 31, 2004, verified by NSC; analysis of Medicare claims data for 
each state; and information on whether the suppliers had a license 
provided by the states of Florida, Louisiana, and Texas. Suppliers 
should not have billed for oxygen if they did not disclose to NSC the 
intention to do so, did not provide a license for verification, or 
both. 

[A] Suppliers that had a state license for any part of 2004 were not 
included. 

[End of table] 

Similarly, in 2003 and 2004, Medicare paid prosthetics and custom- 
fabricated orthotics[Footnote 20] claims submitted by suppliers that 
did not both disclose to NSC that they would supply these items and 
provide a copy of their licenses.[Footnote 21] Thus, they should not 
have been allowed to bill Medicare for these items. We found 28 
suppliers in Illinois and Texas that were paid a total of about 
$197,000 in 2004 for prosthetics and custom-fabricated orthotics even 
though they should not have been billing for these items. 

Routinely comparing suppliers' billing to the information they report 
on the enrollment or reenrollment application regarding the items and 
services they intend to provide might have avoided some of the improper 
prosthetics and orthotics payments that occurred in Florida. In this 
state, Medicare payments for prosthetics and custom-fabricated 
orthotics inexplicably tripled in 1 year--from about $32.5 million in 
2003 to almost $107.0 million in 2004. As figure 1 shows, most of the 
increase was in payments to suppliers that did not disclose to NSC that 
they intended to provide these items. In 2004, the 73 suppliers that 
did not disclose the intention to provide prosthetics or orthotics were 
paid more than $56.3 million. These 73 suppliers were paid more than 
the amount paid to the 262 suppliers that had informed NSC that they 
would provide these items. The DME regional carrier has established 
about $16.3 million as overpaid to 70 of the 73 suppliers, but has 
collected less than $2.3 million plus interest payments of $60,820, as 
of April 21, 2005.[Footnote 22] Investigative staff at the Region C DME 
regional carrier informed us that at least 46 of the 73 suppliers are 
currently under active investigation for health care fraud.[Footnote 
23] 

Figure 1: Medicare Payments for Prosthetics and Custom-Fabricated 
Orthotics to Florida Suppliers That Did and Did Not Disclose Intention 
to Bill for These Items, 2003 and 2004: 

[See PDF for image] 

Note: Figure is based on analysis of NSC's active supplier data file as 
of May 31, 2004, verified by NSC, and analysis of Medicare claims data. 

[End of figure] 

When NSC reviewed each case we identified of suppliers that billed for 
oxygen or prosthetics and custom-fabricated orthotics without 
disclosing the intention to do so, its analysis revealed several types 
of problems with its processing of suppliers' applications. For 
example, in Florida, for one case that we identified, the supplier had 
not correctly filled out the application to disclose the intention of 
providing prosthetics and custom-fabricated orthotics but had given NSC 
a copy of its state license. In two cases, the supplier disclosed the 
intention of providing prosthetics and custom-fabricated orthotics, but 
did not give NSC a copy of its state license to review. Despite the 
discrepancies in the information provided by suppliers, NSC enrolled or 
reenrolled these suppliers. In three cases, the supplier disclosed the 
intention to provide prosthetics and custom-fabricated orthotics and 
gave NSC a copy of its license, but NSC staff did not update their 
information appropriately in the supplier database. 

During this engagement, we discussed with CMS NSC's weaknesses in 
verifying suppliers' licenses. CMS officials acknowledged that the law 
requires CMS to restrict Medicare payment of prosthetics and certain 
custom-fabricated orthotics to those supplied by a qualified 
practitioner and fabricated by a qualified practitioner or 
supplier.[Footnote 24] The law defines qualified practitioners as a 
physician; an orthotist or a prosthetist who is licensed, certified, or 
has credentials and qualifications approved by the Secretary of Health 
and Human Services; or a qualified physical therapist or occupational 
therapist. The law defines qualified suppliers as entities accredited 
by the American Board of Certification in Orthotics and Prosthetics, 
Inc., the Board for Orthotist/Prosthetist Certification, or a program 
approved by the Secretary of Health and Human Services. CMS is in the 
process of developing proposed regulations that would further define 
qualified practitioners and suppliers of prosthetics and certain custom-
fabricated orthotics on a national level. As an interim step, as of 
October 3, 2005, CMS will be requiring its DME regional carriers to put 
edits in their payment systems to deny claims for prosthetics and 
certain custom-fabricated orthotics submitted by any suppliers that are 
not qualified, or do not have qualified practitioners on staff, in the 
states that currently require licensure or certification. CMS indicated 
that these two actions should help address the problem of unlicensed 
suppliers billing for prosthetics and custom-fabricated orthotics. 
However, if NSC does not resolve discrepancies in the information 
provided by suppliers to have an accurate supplier database, the DME 
regional carriers will not have accurate information for approving or 
denying prosthetics and certain custom-fabricated orthotics claims. 
Further, the agency has not restricted payments for any other items 
that require state licensure--such as oxygen. Nor has it taken action 
to prevent payments to suppliers that have violated the standard for 
accurate disclosure of application information by billing for items 
they have not disclosed to NSC--whether or not a license is required in 
their states to provide these items. 

CMS has recently added another requirement for verifying licensure and 
other certifications. During this evaluation, we pointed out to CMS 
staff that the agency's contract with NSC was not specific about 
whether a license close to its expiration date when submitted to NSC 
should be rechecked to ensure the supplier had renewed it. CMS was 
developing a new statement of work for NSC and as a result of our 
discussion, the new statement of work requires NSC to follow up to 
ensure renewal of licenses, insurance policies, and certifications 
submitted within 60 days of expiration. 

NSC Has Not Conducted All of the Routine On-site Inspections Required 
to Verify Standards: 

NSC has not conducted the routine on-site inspections to verify 
supplier standards for all the DMEPOS suppliers that CMS requires it to 
inspect. We estimate that 605 enrolled suppliers that NSC was required 
to inspect never received an on-site inspection.[Footnote 25] We also 
estimate that NSC conducted on-site inspections for another 3,079 
suppliers, but did not properly record the date of these inspections in 
its supplier database.[Footnote 26] As a result, the database--with 
inaccurate or missing information--is not a reliable management tool 
for CMS to use in overseeing NSC's activities. 

NSC may not have conducted all of the required on-site inspections 
because of its procedures for determining which suppliers to inspect. 
According to NSC's written procedures, NSC staff use discretion to 
decide if an on-site inspection should be conducted prior to the 
enrollment or reenrollment of a supplier. In contrast, while CMS's 
contract with NSC exempts certain types of suppliers from routine on- 
site inspection, it does not state that NSC should use its discretion 
to choose whether to inspect the nonexempt suppliers. CMS staff 
informed us that NSC is required to inspect suppliers on initial 
enrollment and reenrollment, with some exceptions, and they were 
unaware that NSC was not conducting all of the required on-site 
inspections. 

Furthermore, because CMS's statements of work in its fiscal year 2004 
and 2005 contracts with NSC were not clear about what constitutes a 
supplier chain, NSC was not inspecting other suppliers that could be 
eligible for on-site inspections. NSC did not have to inspect supplier 
chains with 25 or more locations. However, the contract did not clearly 
state whether all 25 locations in the chain have to have active billing 
numbers. As a result, NSC was exempting some suppliers in chains that 
currently have fewer than 25 locations with active billing 
numbers.[Footnote 27] We found 484 active suppliers included in chains 
with 24 or fewer locations with active billing numbers as of May 31, 
2004. Of these 484 active suppliers, 257 did not have any on-site 
inspections recorded. For example, NSC indicated to us that no on-site 
inspection was needed for Responsive Home Health Care, because it was 
included in a chain with 50 locations. However, it was part of a chain 
with 24 active locations, one location whose billing number had been 
revoked, and 25 inactive locations. We recently informed CMS that its 
contract language on chain suppliers was not clear, because CMS was 
developing a new statement of work for the next NSC contract. As a 
result, CMS revised its contract language for fiscal year 2006 to 
clarify that a chain consisted of 25 or more active supplier locations. 

NSC's Procedures for Conducting On-site Inspections May Limit Their 
Effectiveness in Verifying Compliance with Standards: 

Even if NSC had conducted all of its on-site inspections, the 
contractor's procedures for conducting them limit their effectiveness 
as a means of verifying compliance with the supplier standards in 
several ways. Thus, the procedures cannot assure suppliers' legitimacy 
and qualifications to serve beneficiaries. First, NSC does not 
explicitly require its site inspectors to review a specific number of 
suppliers' beneficiary files during their inspections. NSC told us that 
inspectors reviewed beneficiary files, but OSI told us that its 
inspectors were not required to review the contents of any beneficiary 
files. 

Without reviewing beneficiary files, it is unclear how inspectors can 
verify suppliers' compliance with the standard that requires suppliers 
to maintain several forms of documentation--including proof of delivery 
and evidence of their efforts to educate beneficiaries on how to use 
the equipment. Further, reviewing beneficiary files is also helpful to 
provide support beyond a written supplier policy that other standards 
are being met. For example, a record of equipment maintenance is better 
proof that the supplier repairs equipment than a written policy alone. 
Reviewing beneficiary files can also enable an inspector to identify 
potentially fraudulent patterns of behavior and fabrications designed 
to cover up lack of compliance with the 21 standards. For example, NSC 
investigators told us that when many beneficiaries using one supplier 
have the same physician's signature on certificates that are required 
by Medicare to affirm the medical necessity of certain DMEPOS items, 
this can be a sign of fraudulent certifications designed to falsify 
compliance with Medicare's rules.[Footnote 28] The Region C DME 
regional carrier is currently investigating a group of suppliers using 
the same set of physicians on their certificates. 

Second, NSC does not routinely provide its site inspectors with the 
dollar amounts and specific DMEPOS items a supplier billed to Medicare. 
Knowing a supplier's billing history would enable inspectors to 
determine whether the supplier's submitted claims coincide with its 
inventory, invoices, delivery tickets, and other documentation in 
beneficiary files. When we accompanied NSC inspectors to the physical 
facilities of several suppliers about which NSC had suspicions--based 
on the suppliers' billing patterns or their association with other 
companies under investigation--the site inspectors did not have data on 
the billing histories for the suppliers being inspected. As a result, 
the inspectors did not know what types and amounts of inventory, 
delivery tickets, or invoices they should expect to find.[Footnote 29] 

Third, neither CMS nor NSC explicitly requires the site inspectors to 
verify a supplier's inventory when it is stored at, or purchased from, 
another location. The inventory standard does not preclude a supplier 
from storing inventory off site or relying on another supplier--even a 
competitor--to provide its inventory. However, when this occurs, 
without taking additional verification steps, NSC would not know 
whether the off-site inventory exists or whether the source of 
inventory is legitimate. According to the inventory standard, suppliers 
cannot contract with companies that are currently excluded from the 
Medicare program, any state health programs, or from any other federal 
procurement or nonprocurement programs. However, without investigating 
the companies that are cited as sources of inventory, NSC would not 
know if this standard was being met. NSC's procedures suggest, but do 
not require, its site inspectors to verify off-site inventory 
locations. Because CMS does not require NSC to conduct verification of 
off-site inventory or an assessment of the company cited as the source 
of inventory, the current procedures do not fully verify the inventory 
standard. 

Inspecting off-site inventory or assessing the validity of inventory 
contracts can help pinpoint violations of the standard for inventory 
and can also identify potentially fraudulent activities. For instance, 
when NSC inspected an address of a company that a supplier gave as its 
source for inventory, it discovered an auto body shop at that address. 
In another instance, NSC found a vacant building at the address given 
as a supplier's inventory source. These suppliers violated the 
standards for disclosing accurate information to NSC and for having 
inventory or a contract to procure it. Further, citing a nonexistent 
source of inventory suggests the possibility that these suppliers were 
engaging in fraud. Similarly, groups of suppliers under investigation 
for fraud in Houston in 2003 and 2004 were using the same company as 
their fictitious source of inventory. SACU investigators were able to 
identify other suppliers participating in the same fraud scheme because 
the suppliers claimed they were obtaining inventory from a source that 
was under investigation. 

Through examining sources of inventory, our investigators identified 
companies with questionable financial transactions or owners involved 
with suppliers engaged in potentially fraudulent billing. For example, 
we identified and investigated one distribution company in Florida that 
six suppliers had cited as one of their main sources of 
inventory.[Footnote 30] CMS had denied or revoked the billing numbers 
for the six suppliers, in part because they did not appear to have 
inventory, but five of them were able to obtain or regain their billing 
numbers after providing contracts for inventory from this distribution 
company. Our investigators found that the distribution company's bank 
had filed 27 separate reports identifying cash withdrawals from company 
accounts in amounts ranging from $10,000 to more than $98,000 over a 
period of 20 months--almost $1 million in total.[Footnote 31] Such cash 
withdrawals are suspicious because they can indicate attempts to 
disguise illicit funds and make them more difficult to track. Even more 
suspicious, our investigators found that this distribution company did 
not appear to be an active business. Through on-site inspections 
conducted in March 2005, we found that two of the addresses given for 
it were vacant office/storage units and one was a custom woodworking 
shop. In June 2005, we investigated a fourth possible address for the 
company. This address had been leased by an individual who identified 
himself in leasing paperwork as being associated with a "Medical 
Equipment" business and was found to be a storage unit littered with 
debris and a pile of boxes, many of which were crushed and broken. The 
investigators saw no posted signs or activities that would indicate an 
active business. In addition, of the five suppliers currently 
reenrolled in Medicare that cited this source of inventory, three were 
under investigation in March 2005 by the Region C DME regional 
carrier's fraud control unit. 

NSC Is Not Required by Contract to Conduct a Minimum Number of Out-of- 
cycle On-site Inspections: 

Out-of-cycle on-site inspections have been effective in identifying 
suppliers that are not complying with Medicare's standards. For 
example, during the April 2004 hearing before the Senate Committee on 
Finance on the Medicare power wheelchair benefit, the attendees watched 
a video of law enforcement surveillance that showed individuals 
bringing office equipment and DMEPOS items into an office suite in 
order to appear to meet the standards for having an appropriate 
physical facility and inventory to pass an on-site inspection. Because 
the timing of enrollment and reenrollment inspections are predictable, 
a supplier intent on committing fraud can anticipate an enrollment on- 
site inspection and create the illusion of legitimacy, fully 
understanding that an inspector is not likely to return for 3 years. 
Out-of-cycle on-site inspections can be so valuable that we previously 
recommended that CMS direct NSC to routinely conduct them for suppliers 
suspected of billing improperly.[Footnote 32] CMS agreed with the 
recommendation and pointed out the number of out-of-cycle inspections 
that were being completed. In 2003, NSC conducted over 600 out-of-cycle 
inspections and found 306 DMEPOS suppliers not complying with 
Medicare's standards. NSC continued this practice in fiscal year 2004, 
conducting over 400 out-of-cycle on-site inspections targeted 
specifically at high-volume suppliers that were not part of 
chains.[Footnote 33] CMS has also requested NSC to conduct out-of-cycle 
on-site inspections in fiscal year 2005. Nevertheless, NSC's contract 
does not explicitly require it to conduct out-of-cycle on-site 
inspections. 

Although NSC has conducted out-of-cycle on-site inspections in the last 
several years, without becoming an explicit part of its contract, this 
activity could be curtailed at any time. We discussed our concerns 
about this with CMS staff writing the revised statement of work for a 
new contract that is scheduled to be awarded in December 2005. As a 
result, CMS included language in the revised statement of work that 
will explicitly require the contractor for NSC to conduct random, out- 
of-cycle on-site inspections as resources permit. However, the change 
in the statement of work does not require NSC to conduct a minimum 
number of out-of-cycle on-site inspections as a routine part of its 
activities. 

Medicare's Standards Are Too Weak to be Used Effectively to Screen 
DMEPOS Suppliers: 

Medicare's standards are currently too weak to be used effectively for 
screening DMEPOS suppliers that want to enroll in the program. The 21 
standards focus on certain operational characteristics. However, they 
do not include standards related to supplier integrity and capability 
analogous to those that federal agencies generally apply to prospective 
contractors or those used by at least two state Medicaid programs for 
their suppliers. For example, federal agencies do not have to contract 
with companies that have demonstrated poor performance in the past. In 
contrast, CMS has reenrolled suppliers whose billing numbers have been 
revoked, after they have demonstrated compliance with the standards--no 
matter how many standards they had previously violated. We found cases 
of suppliers that had billed improperly and violated standards, 
reentered the program, and then began to bill improperly for other 
items. CMS is currently developing more specific guidance for applying 
some of its 21 standards. In addition, to implement provisions in the 
Medicare Prescription Drug, Improvement, and Modernization Act of 2003 
(MMA),[Footnote 34] CMS is introducing a competitive bidding process 
for DME, off-the-shelf orthotics, and supplies, and is developing 
quality standards that would supplement the existing ones. When 
implemented, these steps could help ensure that DMEPOS suppliers are 
legitimate businesses and qualified to bill Medicare. 

Medicare's Standards Lack Assessment of Integrity and Capability Like 
Those for Federal Contractors and Some State Medicaid Suppliers: 

Although a federal agency primarily pays for items provided by DMEPOS 
suppliers, these businesses are not held to standards analogous to 
those that apply to companies that seek to contract with the federal 
government. Under federal procurement regulations, agencies are 
generally required to determine whether a potential contractor is 
"responsible"--that is, whether it has a satisfactory record of 
performance, integrity, and business ethics, as well as the financial, 
technical, and managerial ability to provide the specified products and 
services.[Footnote 35] Federal agencies can consider a contractor's 
past performance as an indicator of future performance and require a 
disclosure of financial and management information to make their 
assessment. In addition, after a contract is awarded, federal agencies 
can terminate the contract for default or convenience.[Footnote 36] 
Further, for committing certain crimes or not meeting certain federal 
requirements, a company may be debarred from receiving federal 
contracts, generally for up to 3 years.[Footnote 37] 

Some state governments have requirements to ensure that Medicaid 
suppliers are responsible. For example, California's Medicaid program 
requires DME suppliers to have the administrative and fiscal foundation 
to survive as a business, demonstrated by financial records, such as a 
business plan, bank statements, and contractual agreements. California 
state officials told us that a DME supplier in their state could not 
meet the definition of being an established business for the Medicaid 
program if it sold power wheelchairs out of a residence, as some 
Medicare DME suppliers have done.[Footnote 38] Similarly, Florida's 
Medicaid program requires suppliers to provide evidence of being a 
viable, ongoing business. Florida also requires anyone with 5 percent 
or greater ownership, and the manager of the supplier, to be 
fingerprinted and undergo a criminal background investigation, because 
the state will not enroll suppliers with owners convicted of several 
types of crimes, such as health care fraud or patient abuse. 

In contrast, suppliers are not CMS contractors, and CMS's standards do 
not require suppliers to demonstrate that they are responsible based on 
their financial, technical, and managerial ability, their integrity, 
and their past performance. As a result, suppliers that are not 
legitimate DMEPOS businesses have enrolled in Medicare and have been 
paid millions of dollars in improper payments without having to 
demonstrate that they have the ability and integrity to serve 
beneficiaries, as the following examples show. 

For example, in sworn testimony before the Senate Committee on Finance 
in April 2004, a witness who pleaded guilty to fraud explained her part 
in a $25 million fraud scheme that she and a group of 19 others 
committed against the Medicare program. She explained how she was able 
to set up a sham company--Mercury Medical Supplies--with $3,000 and 
obtain a Medicare billing number, even though she had no prior 
experience, expertise, or discernible resources for providing DMEPOS 
items or services. From September 2000 to December 2001, when its 
billing number was revoked, Medicare paid Mercury Medical Supplies 
$1,158,482 for providing DMEPOS items that were falsely billed based on 
forged physicians' prescriptions and were generally not supplied to 
beneficiaries. While the Medicare program paid Mercury Medical Supplies 
over $1 million but did not inquire into its financial ability to 
supply DMEPOS items, one federal agency refused to award a $230,000 
contract to a company with $32,500 in working capital, in part because 
the agency's contracting officer did not think that the company was 
financially strong enough to fulfill the contractual 
obligations.[Footnote 39] 

Like Mercury Medical Supplies, All-Divine Health Services in Lufkin, 
Texas was not a legitimate DMEPOS business, but managed to enroll in 
Medicare in December 2002. NSC's inspector noted on an initial site 
inspection report that the owner explained that she was awaiting 
inventory, which was why she had none in her storage area prior to 
enrollment in the Medicare program. Once enrolled, All-Divine Health 
Services began to bill for power wheelchairs, an item for which 
Medicare pays over $5,000. However, because of concerns about 
inappropriate power wheelchair billing, NSC conducted out-of-cycle on- 
site inspections of All-Divine and other power wheelchair suppliers in 
the area. The site inspector found evidence of potential fraud, such as 
altered certificates from physicians attesting to the beneficiaries' 
medical need for the items to be supplied, as well as violations of 
Medicare's standards. Following the out-of-cycle inspection, CMS found 
that All-Divine was in violation of four standards, because it lacked 
comprehensive liability insurance, lacked a state license to provide 
bedding, did not have adequate contracts for inventory, and did not 
have adequate provision to repair and service DME. All-Divine's billing 
number was revoked effective August 6, 2003. After the owner pleaded 
guilty to conspiracy to commit health care fraud on June 25, 2004, her 
lawyer testified that All-Divine's owner had not understood the 
intricacies of proper Medicare billing and had no experience managing a 
DMEPOS company. The owner told her lawyer that she did not think she 
was committing a crime, although she admitted purchasing paperwork 
certifying beneficiaries as needing power wheelchairs and then 
submitting claims on their behalf. Her lawyer also testified that the 
owner stated that her firm lacked the operational controls to ensure 
that beneficiaries actually received the power wheelchairs for which 
the company billed and was paid by Medicare. Before its billing number 
was revoked, All-Divine was paid over $1.8 million by the program, 
predominantly for power wheelchairs not provided as billed. 

Medicare Suppliers Do Not Face the Same Penalties for Not Meeting 
Federal Requirements as Contractors and Medicaid Suppliers: 

While federal agencies, including CMS, may choose not to conduct 
business with companies that lack integrity or perform poorly, and may 
disqualify companies from competing for federal contracts, suppliers 
that have failed to comply with Medicare's standards have not lost 
their billing privileges for any substantial length of time. Federal 
agencies can terminate contracts at their convenience or for default-- 
which is when a contractor fails to perform the contract. For certain 
serious violations, contractors can be debarred from receiving any 
federal contract, generally for up to 3 years.[Footnote 40] Willful 
failure to perform the terms of a government contract is a basis for 
debarment. In addition, apart from debarment, agencies can refuse to 
offer new contracts to companies exhibiting previous performance 
problems or a lack of integrity in the past.[Footnote 41] This may 
occur after conviction for criminal charges, but sometimes the refusals 
follow allegations of wrongdoing. For example, one agency refused to 
offer a new contract to a company that had allegedly provided false 
certifications in the past.[Footnote 42] Another agency used the 
results of criminal investigative reports as a basis for refusing to 
offer contracts to companies.[Footnote 43] 

Compared with Medicare, the Medicaid programs of California and Florida 
put more barriers to reenrollment of problematic suppliers into 
Medicaid. For example, California provisionally enrolls new Medicaid 
providers for 12 to 18 months.[Footnote 44] During this period, if the 
provider fails to meet state requirements, the state agency disenrolls 
the provider from Medicaid.[Footnote 45] In addition, if a provider 
fails to accurately disclose information, such as the ownership of the 
company, California can disenroll the provider from Medicaid and keep 
it from reenrolling for 3 years.[Footnote 46] The California Medicaid 
program denies applications from providers under investigation for 
criminal offenses. Florida will not reenroll suppliers that have been 
excluded from the program. When NSC identifies suppliers that violate 
Medicare's standards, CMS may revoke their billing privileges. However, 
in contrast to California and Florida Medicaid, if a supplier can 
demonstrate compliance with the 21 standards, CMS readmits it into 
Medicare unless it has been otherwise excluded from participating in 
the program. 

DMEPOS suppliers that have their billing privileges revoked and then 
later reenter Medicare are not uncommon. We identified 1,038 DMEPOS 
suppliers that lost their billing privileges in 2003, generally for 
violating multiple standards. Of these suppliers, 192 were reenrolled 
in Medicare as of May 31, 2004, with the average period of suspension 
lasting about 3 months. None of these suppliers encountered any barrier 
to enrollment for violating the standards. Further, when some suppliers 
that had billed improperly because they were unlicensed reentered the 
program, they resumed improper billing for different types of items. 
See table 2 for two examples. 

Table 2: Examples of Suppliers That Had Billing Privileges Revoked, 
Were Reinstated, and Billed Improperly After Readmission into Medicare: 

Revocation basis: Noncompliance with five standards, including 
providing oxygen and orthotics without a state license and not having 
an active liability insurance policy, business telephone number, or 
inventory; 
Revocation period (in months): 5; 
Improper billing closely following readmission: After reenrollment in 
early 2004, Wonderful Medical Supply Company submitted claims totaling 
about $2.6 million and was paid about $1.27 million, predominantly for 
one type of layered bandage. Because Wonderful Medical Supply's billing 
was suspicious, the DME regional carrier began to review claims from 
this supplier. Most of the claims it submitted in the fall of 2004 were 
denied and the DME regional carrier collected overpayments of almost 
$500,000 for claims that had previously been paid improperly. The 
supplier's enrollment in Medicare was terminated in late 2004. The 
supplier was also under criminal investigation by federal and local law 
enforcement for health care fraud in 2005. 

Revocation basis: Noncompliance with six standards, including billing 
for orthotics without the proper state license, not having inventory, 
not offering beneficiaries the required option of renting equipment, 
and not having the ability, or a contract, to repair broken equipment; 
Revocation period (in months): 3; 
Improper billing closely following readmission: After being reenrolled 
in Medicare, Fabulous Medical Supply in Miami, Florida was investigated 
by the Region C DME regional carrier because of suspicions that it was 
not providing items as billed. In 2004, it was paid almost $1.4 million 
by Medicare for one colostomy supply item that was being abusively 
billed by a number of suppliers during this period. Because of the 
abusive billing, payments for this item increased over 14,000 percent 
in a year in the region. To combat the abusive billing, starting in May 
2004, the DME regional carrier requested additional documentation--such 
as physicians' orders--from all of the suppliers billing this item to 
support their claims. Fabulous Medical Supply did not provide any 
documentation to support its billing, and its subsequent claims for 
this item were denied. The DME regional carrier suspended payments to 
Fabulous Medical Supply during the summer of 2004 and revoked its 
billing number in 2005 after the supplier's liability insurance lapsed. 
In 2004, Fabulous Medical Supply was paid almost $2.7 million by 
Medicare, but $1.6 million is currently being held by the DME regional 
carrier, pending determination of overpayments, and almost $200,000 has 
been established as an overpayment owed to Medicare. This supplier was 
under criminal investigation by federal and local law enforcement for 
health care fraud as of July 2005. 

Source: GAO. 

Note: We are using aliases for these suppliers, because they are 
currently or have been under active investigation by federal and local 
law enforcement. This table is based on information provided by the 
Region C DME regional contractor's benefit integrity unit. 

[End of table] 

CMS's Efforts to Strengthen the Supplier Standards and Other Recent 
Steps May Partially Address Identified Weaknesses: 

According to NSC and CMS officials, strengthening the supplier 
standards by increasing their specificity is an important step in 
preventing enrollment of suppliers that are intent on committing fraud. 
NSC and CMS officials agreed that the inventory and physical facility 
standards are not specific enough. These standards do not specify the 
characteristics of an inventory, or the amount, type, or source of 
inventory that should be required for the items or services the 
supplier intends to provide to Medicare beneficiaries. According to 
these officials, the lack of specificity in the standards has allowed 
suppliers that were not legitimate companies to acquire Medicare 
billing numbers and then defraud the program. NSC and OIG officials 
investigating enrolled suppliers with potentially fraudulent billing 
reported that many had physical facilities not conducive to conducting 
a legitimate DMEPOS business. For example, these investigators have 
found multiple suppliers located in close proximity in small suites in 
the same building. In addition, they found suppliers in buildings that 
were not located where beneficiaries were likely to come and purchase 
DMEPOS items. The investigators also reported finding DMEPOS suppliers 
operating out of their houses and garages.[Footnote 47] These suppliers 
had few DMEPOS items in stock, but claimed that they had contracts for 
acquiring inventory. These documents sometimes lacked the usual 
elements of a contract, such as the clear signature of authorized 
individuals from both companies and the time period for the contract. 
Nevertheless, these suppliers met the current standards. 

In early 2004, based on NSC proposals, CMS drafted new guidance on the 
current supplier standards to make them more specific. For example, CMS 
added more details to describe what constituted a reasonable amount of 
inventory, the elements of an acceptable contract for inventory, and an 
appropriate physical facility from which to provide items and services 
to Medicare beneficiaries. As of June 2005, CMS had not issued the new 
guidance. According to an agency official, some of the revisions have 
been incorporated into a proposed regulation under review within the 
agency. The official told us that CMS plans to issue other changes 
through revisions of Medicare guidance manuals, once the proposed 
regulation had been issued. 

In addition to the new guidance, provisions of the MMA that require CMS 
to develop quality standards for DMEPOS suppliers and competitive 
bidding, when implemented, could enhance the agency's ability to screen 
suppliers. The MMA requires CMS to develop quality standards for all 
DMEPOS suppliers and to select one or more independent accreditation 
organizations that will apply these standards to determine if suppliers 
are meeting them.[Footnote 48] CMS has not finished its development of 
the quality standards, so it is not clear whether the standards will 
incorporate requirements for suppliers to demonstrate that they have 
the integrity and capability to perform their functions analogous to 
the standards for federal contractors. In addition, the MMA requires 
CMS to establish competitive bidding among suppliers for DME, supplies, 
off-the-shelf orthotics, and enteral nutrients and related equipment 
and supplies in at least 10 of the largest metropolitan areas by 2007 
and in 80 of these areas by 2009. The MMA will require suppliers chosen 
by competitive bidding to comply with the quality standards that are 
being developed for all DMEPOS suppliers as well as new financial 
standards to be specified by the Secretary. However, competitive 
bidding will be limited to certain DMEPOS items and localities, so not 
all Medicare DMEPOS suppliers will be held to the new financial 
standards. CMS anticipates issuing a proposed rule in the fall of 2005 
on DME competitive bidding and on quality standards and accreditation 
and a final rule in 2006. 

CMS's Oversight Is Insufficient to Determine Whether NSC Screens and 
Monitors Suppliers Effectively: 

CMS's oversight has not been sufficient to determine whether NSC is 
meeting its responsibilities in screening, enrolling, and monitoring 
DMEPOS suppliers. CMS was unaware--until we informed the agency--that 
NSC had not conducted all required on-site inspections of suppliers. 
Furthermore, CMS did not know that, in contrast to its requirements, 
NSC's procedures allow its staff to use discretion in selecting which 
suppliers received on-site inspections. In addition, CMS did not 
recognize gaps in NSC's verification of suppliers' state licenses and 
as a result, Medicare paid suppliers whose licenses the contractor did 
not verify. 

During our review, we found weaknesses in the methods CMS uses to 
oversee its contractor that could lead to the agency not recognizing 
problems in the verification process. CMS evaluates NSC's performance 
primarily through an annual inspection. During this inspection, CMS 
analyzes a small random sample of supplier files to determine, for 
instance, whether NSC is conducting on-site inspections, processing 
enrollment applications, and handling appeals of denied or revoked 
billing privileges in accordance with its requirements. The analysis of 
NSC's supplier files is CMS's most direct means of assessing NSC's 
efforts to screen and enroll suppliers; however, we determined that 
CMS's past practice of basing NSC's performance on a sample selected 
from a single quarter of the year may not be adequate. NSC's 
performance might differ during the quarters in which it was not 
reviewed. CMS also recognized problems with basing its review on a 
single quarter, and in October 2004 began to institute quarterly 
reviews of a sample of supplier files. However, if any problems are 
uncovered, the sample sizes examined by CMS are too small to be used as 
a means of oversight, relative to the number of application files 
processed and other type of files reviewed. During fiscal year 2004, 
NSC processed more than 58,000 supplier applications for enrollment or 
reenrollment. To evaluate NSC's efforts to enroll suppliers during its 
fiscal year 2004 inspection, CMS examined a sample of 10 approved 
supplier applications, as well as 10 denied and 10 returned 
applications. To evaluate NSC's efforts to reenroll suppliers, CMS 
examined a sample of 20 approved reenrollments. If CMS uncovered any 
problems, it would need to select a much larger sample to determine if 
the problems were systemic, a step that is not indicated in the 
evaluation protocol. 

CMS's evaluation of NSC's performance is focused primarily on whether 
the suppliers' applications are filled out and processed correctly--not 
whether NSC has conducted the required verification tasks thoroughly. 
For example, while NSC may have a supplier site inspection form with 
the boxes checked to indicate that a supplier is complying with various 
standards--such as the one to maintain documentation of delivery of 
items to beneficiaries--CMS cannot know from reviewing the form if the 
inspector checking that supplier actually examined any beneficiary 
files. 

CMS also oversees NSC through reviewing monthly reports from NSC, but 
this does not provide information on the thoroughness of NSC's 
screening and enrollment efforts. Instead, CMS reviews the monthly 
reports to monitor NSC's workload--including the number of enrollment 
and reenrollment applications received, pending, approved, and 
returned; the timeliness in processing applications; the number of 
denials and revocations; and the timeliness with which NSC handles 
inquiries from suppliers. This monitoring is important to ensure that 
NSC is managing its workload, but does not inform CMS as to how well 
NSC performs these activities. 

Finally, while CMS has established performance goals in NSC's contract 
related primarily to processing supplier applications and managing 
other aspects of NSC's workload--such as handling inquiries--it has not 
established performance goals connected to effectiveness of the 
screening or fraud prevention efforts. CMS uses both the annual 
inspection and the monthly reports to measure NSC's performance against 
goals established in its contract. These goals are linked to timeliness 
in processing suppliers' applications, appeals, and inquiries. For 
example, according to its contract, NSC must: 

* process 90 percent of all applications and reenrollments accurately 
within 60 calendar days of receipt and 99 percent of applications 
within 120 calendar days of receipt, 

* process 90 percent of appeals accurately within 60 calendar days of 
receipt, and: 

* answer 85 percent of supplier telephone calls within the first 60 
seconds. 

These performance measures do not indicate the success of NSC or its 
SACU in identifying noncompliant and fraudulent suppliers. Further, 
CMS's contract requires NSC to maintain a SACU,[Footnote 49] but the 
contract does not establish outcomes expected from this unit. 
Similarly, in its annual inspection, CMS does not evaluate the SACU's 
efforts--whether, for instance, the SACU has adequately educated 
suppliers, adequately supervised the quality of on-site inspections, or 
analyzed supplier enrollment and billing data so that NSC can identify 
suppliers for additional inspections. 

Conclusions: 

CMS is responsible for assuring that Medicare beneficiaries have access 
to the equipment, supplies, and services they need, and at the same 
time, for protecting the program from abusive billing and fraud. The 
supplier standards and NSC's gatekeeping activities were intended to 
provide assurance that potential suppliers are qualified and would 
comply with Medicare's rules. However, there is overwhelming evidence-
-in the form of criminal convictions, revocations, and recoveries--that 
the supplier enrollment processes and the standards are not strong 
enough to thoroughly protect the program from fraudulent entities. 

We believe that CMS must focus on strengthening the standards and 
overseeing the supplier enrollment process. It needs to better focus on 
ways to scrutinize suppliers to ensure that they are responsible 
businesses, analogous to federal standards for evaluating potential 
contractors. CMS's current effort to develop additional guidance on the 
standards and the development of quality standards for DMEPOS suppliers 
provide an opportunity for the agency to establish stronger 
requirements for potential and enrolled suppliers. Developing more 
rigorous quality standards that include an assessment of suppliers' 
performance, integrity, and financial, managerial, and technical 
ability would help ensure that only qualified companies became 
suppliers. Suppliers whose previous performance was poor or that 
demonstrated a lack of integrity should not be allowed to quickly 
reenter the program. CMS also needs to provide more specific 
requirements in NSC's contract so that the program's policies will be 
consistently carried out. Finally, we believe that CMS has not 
adequately evaluated NSC's activities to ensure that it is meeting all 
of its responsibilities and using all of the tools available to 
identify, and address, problem suppliers. 

Matter for Congressional Consideration: 

The Congress should consider whether suppliers that have violated 
standards should have to wait a specified period of time from the date 
of revocation to have a billing number reissued. 

Recommendations: 

To improve the supplier enrollment process and oversight of NSC, we 
recommend that the Administrator of CMS take eight actions--five 
related to NSC's efforts to verify DMEPOS suppliers' compliance with 
the 21 standards, one related to the supplier standards, and two 
related to the agency's oversight of NSC. We recommend that CMS: 

* Starting in states where licensure is mandatory, require NSC to 
routinely check suppliers' billing for oxygen, prosthetics, orthotics, 
and any other items requiring licensure, against the items the 
suppliers declared they are providing on applications. Where suppliers 
are billing for services not declared, take appropriate action to 
revoke the billing numbers of suppliers not complying with program 
requirements. 

* Require NSC to provide information from suppliers' billing histories 
to inspectors before they conduct on-site inspections to help them 
collect information to assess whether suppliers' inventory or contracts 
to obtain inventory are congruent with the suppliers' Medicare 
payments. 

* When suppliers report having inventory that is primarily maintained 
off site or supplied through another company, require NSC to evaluate 
the legitimacy of the supply location or source and any related 
contracts. 

* As part of the on-site inspections, require inspectors to review, and 
provide information to NSC analysts on the contents of, a minimum 
number of patient files to determine supplier adherence to standards 
for maintaining documentation of services and information provided to 
beneficiaries. 

* Oversee NSC's activities to ensure that it conducts on-site 
inspections of suppliers as required by CMS and maintains accurate data 
on the on-site inspections it conducts. 

* Establish a minimum number of out-of-cycle on-site inspections in its 
contract that NSC must perform each year. 

* Develop standards that incorporate requirements for suppliers to 
demonstrate that they have the integrity and capability to perform 
their functions analogous to the standards for federal contractors. 

* Revise current evaluation procedures to fully assess the outcomes 
expected from the SACU's activities and NSC's adherence to contract 
requirements. 

Agency Comments: 

In its written comments on a draft of this report, CMS generally 
concurred with our eight recommendations and cited actions it is taking 
to implement each recommendation. It also affirmed its commitment to 
protect beneficiaries and Medicare from fraud, waste, and abuse by 
ensuring that NSC only enrolled qualified suppliers and enforced the 
supplier standards. 

CMS agreed with our five recommendations related to improving NSC's 
efforts to verify DMEPOS suppliers' compliance with the 21 standards. 
In response to four of these recommendations, CMS stated that it has 
revised the statement of work for fiscal year 2006 to require NSC to: 

* check suppliers' licenses and liability insurance each year, rather 
than every 3 years at reenrollment, and compare suppliers' billing 
histories to the licenses they provide at that time; 

* provide on-site inspectors with the billing histories of DMEPOS 
suppliers they are reviewing; 

* conduct site inspections of suppliers' off-site inventory storage 
locations and of businesses that provide them with inventory through 
contracts; and: 

* conduct out-of-cycle inspections, the number of which CMS will manage 
based on NSC's workload and budgetary constraints. 

In addition to the completed revisions, to address the other 
recommendation related to NSC's efforts to verify suppliers' compliance 
with the 21 standards, CMS indicated that it intends to further revise 
the statement of work to require site inspectors to review a minimum 
number of beneficiary files maintained by suppliers. 

CMS also agreed with our recommendation to develop standards for 
suppliers to ensure they have the integrity and capability to perform 
their functions analogous to the standards for federal contractors. In 
its response to that recommendation, CMS indicated that the quality 
standards the agency is developing for suppliers will improve its 
ability to deter health care fraud and abuse. The agency stated that it 
will publish a proposed rule to implement the standards in the fall of 
2005 and expects to issue a final rule in 2006. 

Finally, to address the two recommendations on improving its oversight, 
CMS stated that it intends to more closely review NSC's activities to 
ensure that the contractor conducts on-site inspections as required and 
maintains accurate data on these inspections. CMS also noted that it 
had expanded its oversight and evaluation procedures during fiscal year 
2005 to include quarterly reviews of NSC and SACU enrollment functions. 
CMS's written comments on a draft of this report are included in 
appendix III. CMS also provided technical comments, which we included 
as appropriate. 

As agreed with your office, unless you publicly announce its contents 
earlier, we plan no further distribution of this report until 30 days 
after its issue date. At that time, we will send copies of this report 
to the Administrator of CMS, appropriate congressional committees, and 
other interested parties. We will also make copies available to others 
upon request. This report is also available at no charge on GAO's Web 
site at http://www.gao.gov. 

If you or your staff have any questions about this report, please 
contact me at (312) 220-7600 or aronovitzl@gao.gov. Contact points for 
our Offices of Congressional Relations and Public Affairs may be found 
on the last page of this report. GAO staff who made major contributions 
to this report are listed in appendix IV. 

Sincerely yours, 

Signed by: 

Leslie G. Aronovitz: 
Director, Health Care: 

[End of section] 

Appendix I: Objectives, Scope, and Methodology: 

To evaluate the National Supplier Clearinghouse's (NSC) efforts to 
verify suppliers' compliance with the 21 standards, we conducted 
interviews, document reviews, field inspections, investigations, and 
data analysis. We interviewed the Centers for Medicare & Medicaid 
Services (CMS) officials that oversee NSC and NSC staff, assessed CMS's 
contract statement of work for enrollment screening, and reviewed NSC's 
written procedures to gain a better understanding of the procedures 
used. Through that assessment, we determined that its procedures to 
check licensure and conduct on-site inspections of suppliers were 
critical to verifying compliance with the standards and we focused our 
evaluation on these procedures. To better understand the on-site 
inspection process, we accompanied NSC officials as they conducted on- 
site inspections of 12 suppliers in Maryland during August 9 and 10, 
2004. In addition, to test the effectiveness of the licensure 
verification, we analyzed Medicare durable medical equipment, 
orthotics, prosthetics, and supplies (DMEPOS) claims data for 2003 and 
2004 from Florida, Illinois, Louisiana, and Texas [Footnote 50] and 
NSC's active supplier data file to determine whether suppliers had the 
licenses necessary for items billed. We also tested whether all 
required on-site inspections had been conducted through an analysis of 
NSC's active supplier data file and inspection procedures. To assess 
the reliability of the 2003 and 2004 claims from CMS and NSC's supplier 
data files, we performed electronic testing of required data elements, 
reviewed existing information about the data and the systems that 
produced them, and interviewed CMS and NSC officials knowledgeable 
about the data. We determined that these data were sufficiently 
reliable for the purposes of this report. We also contacted Florida, 
Texas, and Louisiana to determine which of the suppliers that had not 
disclosed to NSC that they would be providing oxygen and were paid at 
least $1,000 for oxygen claims in 2004 actually had the needed state 
licenses. In addition, we also checked with these states to determine 
whether a small sample of suppliers that had disclosed the intention to 
bill for oxygen, and were paid at least $1,000 for oxygen claims in 
2004, had the needed state licenses. For custom-fabricated orthotics 
and prosthetics, we were not able to confirm whether the suppliers that 
had not disclosed to NSC that they would be providing these items and 
were paid at least $1,000 for such claims in 2004 in Florida, Illinois, 
and Texas had the proper state licenses, because those states license 
individuals to be allowed to supply these items, not companies. To 
evaluate procedures for on-site inspections, we analyzed on-site 
inspection instructions and the standards and interviewed on-site 
inspectors and officials in NSC and Overland Solutions, Inc. We 
investigated two companies cited as sources of inventory by two groups 
of Florida and Texas suppliers that had their billing privileges denied 
or revoked, in part because of inventory issues, and also investigated 
those suppliers. 

To evaluate the adequacy of the 21 supplier standards, we compared them 
to the requirements for government contractors and those imposed by the 
California and Florida Medicaid program on suppliers. In addition, we 
analyzed cases of revocations that had been appealed to CMS in 2004 to 
determine if weaknesses in the standards were leading to suppliers with 
questionable billing practices being reinstated in the program. We also 
obtained documentation on cases of suppliers that had defrauded 
Medicare and interviewed fraud inspectors at NSC and in the Department 
of Health and Human Services Office of Inspector General to develop 
insight into the problems that they saw with the 21 standards. We also 
interviewed NSC and CMS officials and individuals from the following 
organizations: the American Association for Homecare, the American 
Orthotic and Prosthetic Association, Hoveround, National Association 
for Home Care and Hospice, Power Mobility Coalition, and a 
representative from the National Supplier Clearinghouse's Advisory 
Council. 

To evaluate CMS's oversight of NSC, we considered the information we 
had gathered to answer the previous questions. We reviewed CMS's 
written procedures used to evaluate NSC and other documents related to 
CMS's oversight. We also discussed CMS's oversight with CMS and NSC 
officials. 

Our work was conducted from June 2004 to September 2005 in accordance 
with generally accepted government auditing standards. 

[End of section] 

Appendix II: Medicare's 21 Standards for Suppliers and NSC's Procedures 
to Verify Their Compliance: 

Suppliers of durable medical equipment (DME), prosthetics, orthotics, 
and supplies must meet 21 standards in order to obtain and retain their 
Medicare billing privileges. The NSC is responsible for screening 
suppliers to ensure that they meet the standards. An abbreviated 
summary of the most recent version of these standards, which became 
effective December 11, 2000, is presented in table 3. The Medicare 
Prescription Drug, Improvement, and Modernization Act of 2003 requires 
CMS to develop quality standards that must be at least as stringent as 
current standards for all Medicare suppliers of DME, prosthetics, 
orthotics, and supplies. Supplier compliance with the quality standards 
will be determined by one or more designated independent accreditation 
organizations. 

Table 3: Medicare's 21 Standards for Medicare Suppliers of DME, 
Prosthetics, Orthotics, and Supplies and NSC's Procedures at Enrollment 
and Reenrollment to Verify Compliance with the Standards: 

Standard number: 1; 
Standard's description of what supplier must do: Comply with all 
applicable federal and state licensure and regulatory requirements; 
NSC's verification procedures: Desk review - The NSC enrollment analyst 
matches the supplier's legal business name in the application to the 
legal business name listed in Internal Revenue Service forms and on 
licenses. Through a computerized edit, the analyst checks the listed 
organizations and owners against the General Services Administration 
debarment list and the Office of Inspector General's sanction list to 
determine eligibility to receive income from the Medicare Trust Funds. 
The analyst also checks all names listed in the supplier's application 
against the CMS's Fraud Investigative Database. The analyst matches 
information in the application on the type of supplier and products and 
services to be furnished with state licenses attached to the 
application. If the license appears to be altered, the analyst checks 
with the state to determine if the state license is valid; On-site 
inspection - The site inspector is expected to collect copies of 
applicable state, business, and occupational licenses and a listing of 
the names of owners and records the information on the site inspection 
form, if applicable. 

Standard number: 2; 
Standard's description of what supplier must do: Provide complete and 
accurate information on the application and report any changes to NSC 
within 30 days; 
NSC's verification procedures: NSC verifies compliance with this 
standard through verification of the other standards. 

Standard number: 3; 
Standard's description of what supplier must do: Have an authorized 
individual--whose signature is binding--sign the application; 
NSC's verification procedures: NSC relies on supplier self-report that 
an authorized individual, as defined in the application, has signed. 

Standard number: 4; 
Standard's description of what supplier must do: Fill orders from its 
own inventory or contracts with other companies for the purchase of 
items necessary to fill the order. A supplier may not contract with any 
entity excluded from the Medicare program or state health care programs 
or from any other federal procurement or nonprocurement program or 
activity; 
NSC's verification procedures: On-site inspection - The site inspector 
takes photographs of inventory and requests copies of the supplier's 
contracts with other companies for the purchase of items. The site 
inspector may inspect or telephone the supplier listed in the contract, 
if it is in the local area; Desk review - The analyst reviews any 
contracts for inventory to determine whether the terms and conditions 
of the contracts are acceptable. The analyst also contacts the vendor 
to verify that the contract is authentic. 

Standard number: 5; 
Standard's description of what supplier must do: Advise beneficiaries 
that they may rent or purchase inexpensive or routinely purchased DME 
and of the purchase option for capped rental DME; 
NSC's verification procedures: On-site inspection - The site inspector 
interviews the owner, manager, or another responsible employee about 
the supplier's policy, records the responses on the site inspection 
form, and collects a copy of supplier's policy, if any. 

Standard number: 6; 
Standard's description of what supplier must do: Honor all warranties 
under applicable state law and repair or replace free of charge 
Medicare-covered items that are under warranty; 
NSC's verification procedures: On-site inspection - The site inspector 
interviews the owner, manager, or another responsible employee and 
records the responses on the site inspection form. The site inspector 
collects a copy of supplier's documentation, if any, such as a written 
policy that the supplier provides warranty information to beneficiaries 
and replaces items under warranty free of charge. If the supplier does 
not have the required policy or forms, the site inspector educates the 
supplier about what is needed to comply with this standard and advises 
the supplier of where a model warranty information form can be 
obtained. The supplier then has 48 hours from the time of the 
inspection to provide any needed documentation to the site inspector. 

Standard number: 7; 
Standard's description of what supplier must do: Maintain a physical 
facility on an appropriate site; 
NSC's verification procedures: On-site inspection - The site inspector 
interviews the owner, manager, or another responsible employee and 
records responses on the site inspection form. The site inspector takes 
photographs of the physical facility to document the site and its 
accessibility for handicapped beneficiaries and records the approximate 
size of the facility on the site inspection form; Desk review - The 
analyst reviews the site inspection documents and photographs to ensure 
that the facility complies with the standard. 

Standard number: 8; 
Standard's description of what supplier must do: Permit on-site 
inspections to determine compliance with the standards and maintain an 
appropriate physical facility accessible to beneficiaries and to CMS 
during reasonable business hours, with a visible sign and posted hours 
of operation; 
NSC's verification procedures: On-site inspection - The site inspector 
inspects the physical facility, records the posted hours on the site 
inspection form, and determines if the location is open during that 
time period. The site inspector also records on the site inspection 
form whether customers are in the facility during the inspection and 
whether the supplier shares space with another DMEPOS supplier or other 
business. The site inspector also photographs the signage, posted hours 
of operation, and the physical facility to document the site and its 
accessibility for handicapped beneficiaries; Desk review - The analyst 
reviews the site inspection documents and photographs to ensure that 
the facility complies with the standard. If the facility does not 
appear to be accessible to handicapped beneficiaries, the analyst 
contacts the supplier to determine how it accommodates the needs of 
these individuals. 

Standard number: 9; 
Standard's description of what supplier must do: Maintain a primary 
business telephone listed under the name of the business in a local 
directory or a toll-free number available through directory assistance. 
The exclusive use of a beeper, answering service, answering machine, 
pager, facsimile machine, or car phone as the primary business 
telephone number is prohibited; 
NSC's verification procedures: Desk review - The analyst verifies the 
telephone number and whether it is listed at the supplier's facility by 
calling the supplier, contacting telephone directory assistance, and 
using the Internet to check telephone directories; On-site inspection 
- The site inspector interviews the owner, manager, or another 
responsible employee to determine where the majority of the supplier's 
calls are received and records the responses on the site inspection 
form. The site inspector confirms the telephone number by viewing the 
telephone directory, telephone bills, or contacting directory 
assistance. 

Standard number: 10; 
Standard's description of what supplier must do: Have comprehensive 
liability insurance in the amount of at least $300,000 that covers both 
the supplier's place of business and all customers and employees of the 
supplier. If the supplier manufactures its own items, this insurance 
must also cover product liability and completed operations; 
NSC's verification procedures: Desk review - The analyst verifies the 
supplier's legal name and address on the policy, the insurance policy 
number, issue and expiration dates, scope of insurance, and amount of 
coverage. Effective August 1, 2004, a supplier's underwriter is 
requested to notify NSC of any changes in the supplier's comprehensive 
liability insurance policy; On-site inspection - The site inspector 
obtains a copy of the insurance policy, if necessary, and records the 
information on the site inspection form. 

Standard number: 11; 
Standard's description of what supplier must do: Agree not to initiate 
telephone contact with beneficiaries, with a few exceptions allowed, 
and is prohibited from using telephone contact to solicit new business; 
NSC's verification procedures: On-site inspection - The site inspector 
interviews the owner, manager, or another responsible employee and 
records the response on the site inspection form. 

Standard number: 12; 
Standard's description of what supplier must do: Be responsible for 
delivery, document that beneficiaries were instructed on the use of 
Medicare-covered items, and maintain proof of delivery; 
NSC's verification procedures: On-site inspection - The site inspector 
interviews the owner, manager, or another responsible employee, 
requests a copy of the written delivery policy, and records information 
on the site inspection form. The site inspector may review beneficiary 
files to check for proof of delivery. 

Standard number: 13; 
Standard's description of what supplier must do: Answer questions and 
respond to complaints of beneficiaries, and maintain documentation of 
such contacts; 
NSC's verification procedures: On-site inspection - The site inspector 
interviews the owner, manager, or another responsible employee, 
requests a copy of the written complaint policy, views the complaint 
log, and records information on the site inspection form. The site 
inspector may review beneficiary files to check for communications 
about complaints. 

Standard number: 14; 
Standard's description of what supplier must do: Must maintain and 
replace at no charge or repair directly, or through a service contract 
with another company, Medicare-covered items it has rented to 
beneficiaries; 
NSC's verification procedures: On- site inspection - The site inspector 
interviews the owner, manager, or another responsible employee, 
requests a copy of any written repair policy, if it exists, and records 
the information on the site inspection form. The site inspector may 
also check beneficiary files to review maintenance records of equipment 
that has been supplied. 

Standard number: 15; 
Standard's description of what supplier must do: Accept returns of 
substandard (less than full quality) or unsuitable (inappropriate for 
the beneficiary at the time it was fitted and sold) items from 
beneficiaries; 
NSC's verification procedures: On- site inspection - The site inspector 
interviews the owner, manager, or another responsible employee, 
collects the written return policy, if any, and records information on 
the site inspection form. 

Standard number: 16; 
Standard's description of what supplier must do: Disclose the supplier 
standards to each of the beneficiaries served; 
NSC's verification procedures: On-site inspection - The site inspector 
interviews the owner, manager, or another responsible employee about 
how the supplier discloses the standards to beneficiaries and records 
the information on the site inspection form. The site inspector 
determines if the supplier is using the current standards and, if not, 
advises the supplier of the regulatory requirement and provides the 
supplier with a copy of the current standards. 

Standard number: 17; 
Standard's description of what supplier must do: Disclose to the 
government any person having ownership, financial, or controlling 
interest in the DMEPOS supplier; 
NSC's verification procedures: Desk review - The analyst reviews 
information provided in the application and uses the information as 
part of verification of standard 1 by determining if any listed owners 
have been previously sanctioned or disbarred; On-site inspection - The 
site inspector interviews the owner, manager, or other responsible 
employee to elicit names of the supplier's owners and managers, as well 
as any other companies owned or managed by these individuals, and 
records the information on the site inspection form. 

Standard number: 18; 
Standard's description of what supplier must do: Not sell, or allow 
another entity to use, its Medicare billing number; 
NSC's verification procedures: NSC verifies through the same process as 
standard 17. 

Standard number: 19; 
Standard's description of what supplier must do: Have a complaint 
resolution protocol established to address beneficiary complaints that 
relate to these standards and maintain a record of the complaints at 
the physical facility; 
NSC's verification procedures: On-site inspection - The site inspector 
interviews the owner, manager, or other responsible employee, obtains a 
copy of the complaint resolution protocol and complaint log, observes 
where complaint records are stored, and records the information on the 
site inspection form. If the supplier does not have the required 
complaint resolution protocol or log, the inspector educates the 
supplier and advises the supplier of where model forms can be obtained. 
The supplier has 48 hours from the time of the inspection to provide 
the needed documents to the site inspector. 

Standard number: 20; 
Standard's description of what supplier must do: Include in its 
beneficiary complaint records the name, address, telephone number, and 
beneficiary insurance number; a summary of the complaint, including its 
resolution; and any actions taken to resolve it; 
NSC's verification procedures: On-site inspection - The site inspector 
obtains a copy of the complaint log and records observations on the 
site inspection form. If the supplier does not have complaint records, 
the site inspector educates the supplier about the need for them and 
advises the supplier about where model forms can be obtained. The 
supplier has 48 hours from the time of the inspection to provide the 
needed documents to the site inspector; Desk review - The analyst 
reviews the complaint log obtained by the site inspector to ensure that 
each complaint record includes the required information. 

Standard number: 21; 
Standard's description of what supplier must do: Agree to furnish CMS 
with any information required by the Medicare statute and implementing 
regulations; 
NSC's verification procedures: NSC verifies compliance with this 
standard through verifying compliance with the other standards. 

Source: GAO analysis of 42 C.F.R. § 424.57(c) (2004) and 42 C.F.R § 
420.206 (2004), CMS's Medicare Program Integrity Manual, NSC's contract 
statement of work, NSC's procedures, the site inspection form, and 
information from NSC officials. 

[End of table] 

[End of section] 

Appendix III: Agency Comments: 

DEPARTMENT OF HEALTH & HUMAN SERVICES: 
Centers for Medicare & Medicaid Service:
Administrator: 
Washington, DC 20201: 

DATE: AUG 30 2005: 

TO: Leslie G. Aronovitz: 
Director: 
Health Care: 
Government Accountability Office: 

FROM: Mark B. McClellan, M.D., Ph.D. 
Administrator: 

Initialed by Mark B. McClellan: 

SUBJECT: Government Accountability Office's (GAO) Draft Report: 
MEDICARE: More Effective Screening and Stronger Enrollment Standards 
Needed for Medical Equipment Suppliers (GAO-05-656): 

Thank you for the opportunity to review and comment on the above GAO 
draft report. The Centers for Medicare & Medicaid Services (CMS) is 
committed to protecting beneficiaries and the Medicare Trust fund from 
fraud, waste, and abuse by ensuring that only qualified suppliers are 
enrolled via the National Supplier Clearinghouse (NSC) and assuring the 
NSC enforces the twenty-one supplier standards. In the past year, the 
NSC has already started conducting ad-hoc, out-of-cycle site 
inspections in vulnerable areas of the country, including Miami and Los 
Angeles, resulting in revocation of supplier numbers. NSC is also 
working with other contractors to develop an analytical approach to 
identify suppliers intent on fraud who "sand-bag" billing numbers to be 
used in the event other numbers they have are revoked or suspended. 

The CMS has already made changes to the statement of work (SOW) that 
the NSC will operate under beginning fiscal year (FY) 2006, as well as 
under the new durable medical equipment (DME) Medicare administrative 
contract, expected to be awarded later this year and implemented in 
calendar year 2006. CMS will be pursuing regulatory changes to 
strengthen current supplier standards, including providing interpretive 
guidance on inventory and physical facility requirements, keeping a 
revoked supplier from reentering the program for a specified period of 
time, and temporarily limiting the approval of supplier enrollment 
applications in parts of the country experiencing fraud and abuse in 
the durable medical equipment, prosthetics, orthotics and supplies 
(DMEPOS) community. CMS also recently added a Program Integrity 
satellite office in southern California that is focusing on Medicare 
DMEPOS supplier fraud. This office is working closely with the 
NSC/Supplier Audit and Compliance Unit (SACU) on many initiatives to 
combat fraud and abuse. 

The CMS appreciates the level of effort that the GAO expended in 
drafting this report. We look forward to working collaboratively with 
GAO to protect the Medicare Trust Funds in the future. 

Attached are the detailed comments to the GAO's recommendations. 

Centers for Medicare & Medicaid Services' Comments to the Government 
Accountability Office's Draft Report: MEDICARE: More Effective 
Screening and Stronger Enrollment Standards Needed for Medical 
Equipment Suppliers (GAO-05-656): 

GAO Recommendation: 

Starting in states where licensure is mandatory, require NSC to 
routinely check suppliers' billing for oxygen, prosthetics, orthotics, 
and any other items requiring licensure against the items the suppliers 
declared they are providing on applications. Where suppliers are 
billing for services not declared, take appropriate action to revoke 
the billing numbers of suppliers not complying with program 
requirements. 

CMS Response: 

The CMS recently issued instructions to our durable medical equipment 
regional carriers (DMERC) claims processing area to institute edits of 
claims for prosthetics and certain custom-fabricated orthotics for 
suppliers who supply such items and are located in a state requiring 
licensure. These instructions are scheduled for implementation on 
October 3, 2005. Beginning with FY 2006, an additional statement of 
work requirement for the NSC will be to annually check for compliance 
with all applicable licensure and certification requirements, and 
confirm the comprehensive liability insurance policy remains in effect 
(that is, that it has not been cancelled or allowed to lapse). This is 
currently being done every three years as part of the reenrollment 
process. Part of this check will include a comparison to a supplier's 
billing history. CMS is also exploring the institution of edits for 
other licensed specialties, including oxygen. 

The CMS will explore the idea of requiring the NSC, where appropriate, 
to routinely compare the items for which a supplier bills that require 
licensure against the items the supplier indicates on the enrollment 
application it will supply to Medicare beneficiaries. We also believe 
that Footnote 22 on page 15 inappropriately suggests that CMS is not 
concerned with the failure of some DMEPOS suppliers to comply with 
state licensure requirements. CMS is very concerned with this issue, 
and is exploring ways to pursue collection of overpayments for 
licensure violations. To that end, the NSC has begun providing specific 
information to the DMERCs regarding when a DMEPOS supplier's license on 
file has expired, with instruction to develop and collect an 
overpayment for any claims submitted for items or services furnished 
after licensure has lapsed. 

GAO Recommendation: 

Require NSC to provide information. from suppliers' billing histories 
to inspectors before they conduct on-site inspections to help them 
collect information to assess whether suppliers' inventory or contracts 
to obtain inventory are congruent with the suppliers' Medicare 
payments. 

CMS Response: 

We concur. With the start of FY 2006, the requirements in the NSC SOW 
have been revised to include the provision of a DMEPOS supplier's 
billing history to on-site inspectors prior to inspectors conducting 
onsite inspections. 

GAO Recommendation: 

When suppliers report having inventory that is primarily maintained off-
site or supplied through another company, require NSC to evaluate the 
legitimacy of the supply location or source and any related contracts. 

CMS Response: 

We concur. The FY 2006 SOW requires the NSC to make site visits to a 
suppliers off-site inventory storage location and to make site visits 
to businesses that sell the supplier inventory or fulfill orders 
through inventory-supply contracts. 

GAO Recommendation: 

As part of the on-site inspections, require inspectors to review and 
provide information to NSC analysts on the contents of, a minimum 
number of patient fates to determine supplier adherence to standards 
for maintaining documentation of services and information provided to 
beneficiaries. 

CMS Response: 

We concur and believe that by reviewing beneficiary tiles, inspectors 
can verify that suppliers are properly documenting services and 
information provided to beneficiaries. Inspectors will be required to 
review a percentage of the tiles. The exact percentage of files that 
could be reviewed will depend on factors such as the number of total 
beneficiary files, the inspectors' workload, budgetary constraints, and 
other available sources for review of claims files. This specific 
requirement will be further defined in the NSC's SOW. 

GAO Recommendation: 

Oversee NSC's activities to ensure that it conducts on-site inspections 
for suppliers as required by CMS and maintains accurate data on the on- 
site inspections it conducts. 

CMS Response: 

We concur. CMS will add this oversight function to the quarterly 
contractor performance evaluations that were started in FY 2005. CMS 
would like to review the procedures used by GAO to arrive at its 
conclusions regarding whether the NSC was conducting all on-site 
inspections as required by NSC's SOW, and then incorporate these 
procedures into the quarterly contractor performance evaluation. CMS 
will also develop a mechanism to audit the workload figures reported by 
NSC to CMS as part of their ongoing workload reporting requirements. 

GAO Recommendation: 

Establish a minimum number of out-of-cycle on-site inspections in its 
contract that NSC must perform each year. 

CMS Response: 

We concur. As mentioned above, the NSC has already begun conducting out-
of-cycle inspections in FY 2005. Beginning in FY 2006, the requirement 
to perform out-of-cycle onsite inspections has been added to their SOW. 
The exact number of inspections that NSC shall perform will depend on 
NSC's workload and budgetary constraints, and will be monitored on a 
monthly basis by CMS. 

GAO Recommendation: 

Develop standards that incorporate requirements for suppliers to 
demonstrate that they have the integrity and capability to perform 
their functions analogous to the standards for federal contractors. 

CMS Response: 

We concur, and are in the process of developing quality standards for 
suppliers. As noted in your report, the Medicare Modernization Act of 
2003 (MMA) requires CMS to establish competitive bidding among 
suppliers for DME and supplies used in conjunction with DME, enteral 
nutrients, and off-the-shelf orthotics. Such bidding, which will be 
subject to the Federal Acquisition Regulation (FAR), must be introduced 
to at least 10 of the largest metropolitan areas by 2007 and to 80 of 
these areas by 2009. (Although the bidding will be subject to the FAR, 
the Secretary may waive FARs as needed to efficiently implement the 
bidding process.) 

The MMA also requires CMS to develop quality standards for all DMEPOS 
suppliers and to select one or more independent accreditation 
organizations to apply these quality standards. We believe that this 
requirement will raise the bar for all suppliers and will improve our 
ability to deter health care fraud and abuse. Comments we have received 
from interested parties about this MMA provision have supported 
requiring accreditation of Medicare DMEPOS suppliers. 

The CMS will be publishing an NPRM in the fall of this year on DME 
competitive bidding, quality standards and accreditation. We expect to 
have a final rule by next year. There will be a period for selection by 
CMS of one or more accreditation organizations to apply the quality 
standards. CMS will coordinate implementation of the DMEPOS 
accreditation requirement with the DME competitive bidding program. 

GAO Recommendation: 

Revise current evaluation procedures to fully assess the outcomes 
expected from SACU's activities and NSC 's adherence to contract 
requirements. 

CMS Response: 

We concur. As mentioned earlier, beginning with the second quarter of 
FY 2005, CMS has already expanded its oversight and evaluation 
procedures to include quarterly reviews of N SC and SACU enrollment 
functions. This effort was undertaken to better assess the outcomes 
expected from SACU's activities and NSC's adherence to contract 
requirements. 

[End of section] 

Appendix IV: GAO Contact and Staff Acknowledgments: 

GAO Contact: 

Leslie G. Aronovitz, (312) 220-7600 or aronovitzl@gao.gov: 

Acknowledgments: 

In addition to the contact named above, Sheila K. Avruch, Assistant 
Director; Kevin Dietz; Cynthia Forbes; Krister Friday; Christine 
Hodakievic; Daniel Lee; Lisa Rogers; John Ryan; and Craig Winslow made 
key contributions to this report. 

[End of section] 

Related GAO Products: 

Medicare: CMS's Program Safeguards Did Not Deter Growth in Spending for 
Power Wheelchairs. GAO-05-43. Washington, D.C.: November 17, 2004. 

Medicare: Past Experience Can Guide Future Competitive Bidding for 
Medical Equipment and Supplies. GAO-04-765. Washington, D.C.: September 
7, 2004. 

Medicare: CMS Did Not Control Rising Power Wheelchair Spending. GAO-04- 
716T. Washington, D.C.: April 28, 2004. 

Medicare: HCFA to Strengthen Medicare Provider Enrollment 
Significantly, but Implementation Behind Schedule. GAO-01-114R. 
Washington, D.C.: November 2, 2000. 

FOOTNOTES 

[1] Medicare law defines durable medical equipment (DME) as equipment 
that serves a medical purpose, can withstand repeated use, is generally 
not useful in the absence of an illness or injury, and is appropriate 
for use in the home. DME includes items such as wheelchairs, hospital 
beds, and walkers. Medicare law defines prosthetic devices (other than 
dental) as devices that are needed to replace a body part or function. 
Prosthetic devices include artificial limbs and eyes and cardiac 
pacemakers. Medicare law defines orthotic devices to include leg, arm, 
back, and neck braces that provide rigid or semirigid support to weak 
or deformed body parts or restrict or eliminate motion in a diseased or 
injured part of the body. Medicare-reimbursed DME supplies are items 
that are used in conjunction with DME and are consumed during the use 
of the equipment--such as drugs used for inhalation therapy--or items 
that need to be replaced on a frequent, usually daily, basis--such as 
surgical dressings. 

[2] GAO, Medicare: CMS's Program Safeguards Did Not Deter Growth in 
Spending for Power Wheelchairs, GAO-05-43 (Washington, D.C.: Nov. 17, 
2004). 

[3] According to the Department of Health and Human Services Office of 
Inspector General that investigates alleged DMEPOS and other fraud, 
from 2003-2004, nine criminal cases involving DMEPOS supplier fraud 
have gone to trial. As of February 4, 2005, 21 individuals involved in 
such cases have been convicted of fraud, and over $70 million in 
improper payments has been recovered. 

[4] In this report, the term supplier is used only for DMEPOS 
suppliers. 

[5] Three of the 21 standards were created by statute (42 U.S.C. § 
1395m(j)(1)(B) (2000)) and the other 18 standards were established by 
regulation. The 21 standards are found at 42 C.F.R. § 424.57(c) (2004). 

[6] The supplier standards require suppliers to permit on-site 
inspections, while the statement of work governing NSC's activities 
generally refers to these as site visits. The two terms refer to the 
same activity and we use the term on-site inspection throughout this 
report. 

[7] In order to sell certain DMEPOS items or services, including 
oxygen, orthotics, and prosthetics, certain states require licensure. 
The types of licensure vary by state. For example, according to CMS, 
nine states require licensure or certifications to provide prosthetics 
and orthotics. Holding a valid state license, in states that require 
them, indicates that the state has determined that the supplier has met 
the state's minimum requirements to supply the item. 

[8] We did not review NSC's procedures to verify that suppliers have 
comprehensive liability insurance, because these procedures have 
recently been strengthened and we believe that they should be adequate 
as a result. We also did not review NSC's procedure to check supplier 
companies and their owners to ensure that they are not excluded from 
participating in federal health care programs or debarred from federal 
contracting, because this is done through a routine data procedure 
matching the names against federal files that list the names of 
excluded and debarred companies and individuals. 

[9] NSC maintains a database with information on Medicare DMEPOS 
suppliers. From this database NSC sent us three files with information 
on active, inactive, and revoked suppliers as of May 31, 2004. The 
files included information such as the supplier's legal business name, 
billing number, address, date of the most recent on-site inspection, 
the DMEPOS items and services the supplier provides, and information on 
whether the supplier had its billing number revoked. 

[10] Medicaid is a state-administered health care program, jointly 
funded by the federal and state governments, that covers approximately 
54.9 million eligible low-income individuals. Each state administers 
its own program and determines, under broad federal guidelines, 
eligibility for, coverage of, and reimbursement for specific items and 
services, such as DME. Each state is also responsible for its own 
enrollment process for suppliers and other providers. 

[11] Unlike Part A, Part B requires enrollees to pay a monthly premium 
for their Part B coverage. Part A of Medicare covers inpatient 
hospital, skilled nursing facility, hospice, and certain home health 
services. 

[12] The four DME regional carriers are HealthNow New York, Inc. 
(Region A, which includes 10 states in the northeast from Maine to 
Delaware); AdminaStar Federal (Region B, which includes 9 states in the 
midwest, from Maryland to Minnesota, and the District of Columbia); 
Palmetto Government Benefits Administrators (Region C, which includes 
14 states in the south, from North Carolina to New Mexico, and Puerto 
Rico and the Virgin Islands); and CIGNA Government Services, LLC 
(Region D, which includes 17 states in the west, from Missouri to 
Washington, and Guam, Mariana Islands, and American Samoa). 

[13] 42 U.S.C. § 1395m(a)(17) (2000). 

[14] CMS requires NSC to conduct on-site inspections of DMEPOS 
suppliers--with certain exceptions. Specifically, the statement of work 
under which NSC operates states that NSC shall apply certain procedures 
to verify information provided by new applicants, including conducting 
inspections for those suppliers requiring them, and will perform 
inspections on reenrolling suppliers as required to verify information. 
It further states that all suppliers are subject to on-site inspections 
upon initial enrollment and reenrollment, except physicians, certified 
Medicare suppliers, and supplier chains with 25 or more locations. 
Certified Medicare suppliers include hospitals; skilled nursing 
facilities; home health agencies; clinics, rehabilitation agencies, and 
public health agencies; comprehensive outpatient rehabilitation 
facilities; hospices; critical access hospitals; and community mental 
health centers. The statement of work also provides that NSC, at 
reenrollment, does not have to conduct on-site inspections of suppliers 
with $34,000 or less in allowed charges in the previous year. According 
to CMS, NSC is responsible for conducting enrollment and reenrollment 
on-site inspections for all suppliers listed as not exempt. 

[15] NSC also requires suppliers to name NSC as a certificate holder 
for their liability insurance, which means that an insurer must notify 
NSC when a supplier's policy is cancelled. 

[16] NSC began requiring photographic evidence as part of the on-site 
inspection in December 2003. 

[17] Federal health care programs include Medicare, Medicaid, and all 
other plans and programs that provide health benefits funded directly 
or indirectly by the United States (other than the Federal Employees 
Health Benefits Program). 

[18] First-time applicants for enrollment can be denied, while DMEPOS 
suppliers currently enrolled in the program that are renewing their 
applications for billing privileges may have their current billing 
numbers revoked. DMEPOS suppliers must renew their Medicare enrollment 
application every 3 years. 

[19] The Medicare Prescription Drug, Improvement, and Modernization Act 
of 2003 gave suppliers the right, after December 8, 2004, to take their 
second level of appeal to an administrative law judge. Suppliers 
dissatisfied with the decision of the administrative law judge can 
pursue additional judicial appeals. Pub. L. No. 108-173, § 936(a)(2), 
117 Stat. 2066, 2411-2412 (to be codified at 42 U.S.C. § 1395cc(j)). 

[20] Custom-fabricated orthotic devices are braces that are 
individually fabricated for a specific patient. For our analysis, we 
used a list of codes developed by CMS to identify prosthetic devices 
and custom-fabricated orthotic devices. 

[21] We restricted our analysis to suppliers with at least $1,000 in 
prosthetics or custom-fabricated orthotics payments. 

[22] A Region C DME regional carrier official told us that it was not 
routinely identifying and assessing overpayments against suppliers that 
have been identified as billing without the proper state licenses and 
CMS has not directed it to do so. The DME regional carrier assessed 
overpayments for prosthetics and custom-fabricated orthotics claims 
against the suppliers in Florida cited above after receiving permission 
to do so by the CMS satellite field office in Miami. The overpayment 
assessments were established based on information from investigations 
and medical review of claims that suggested many of these payments were 
not proper. In its comments on a draft of this report, CMS informed us 
that NSC has begun providing specific information to the DME regional 
carriers regarding when a DMEPOS supplier's license on file has 
expired, with instructions to develop and collect an overpayment for 
any items or services furnished after licensure has lapsed. 

[23] In response to the rise in suspicious prosthetics and custom- 
fabricated orthotics billing, Region C DME regional carrier staff began 
several special projects, such as requiring suppliers to provide 
documentation to back up their claims before paying for 148 prosthetic 
and orthotic items and investigating and referring 74 cases to law 
enforcement. 

[24] 42 U.S.C. § 1395m(h)(1)(F) (2000). 

[25] After excluding all of the types of suppliers NSC is not required 
to inspect at enrollment and reenrollment, we analyzed NSC's active 
supplier data file to determine whether all of the suppliers for which 
an on-site inspection was required had one listed. We found that 14 
percent--3,684--of the enrolled suppliers that should have received an 
on-site inspection did not have an inspection date recorded. NSC 
reviewed our random sample of 67 of these 3,684 suppliers. In most 
cases, the suppliers without an on-site inspection date recorded had 
received one, but NSC had not updated its supplier database. However, 
11 of the 67 suppliers did not receive the required on-site inspection. 
Based on this sample, we estimated that between 545 and 667 of the 
3,684 suppliers had not received an on-site inspection, based on a 
confidence interval of + or - 10 percent. 

[26] On April 1, 2005, NSC informed us that it had implemented edits in 
its supplier data system to ensure that on-site inspections conducted 
after August 20, 2004, were recorded. 

[27] In these cases, the chains also include other locations with 
supplier billing numbers that are either inactive or revoked. 

[28] Falsely certifying beneficiaries' medical need for DMEPOS items is 
a violation of the standard that requires suppliers to comply with all 
applicable federal regulatory requirements, and may constitute a civil 
or criminal offense. 

[29] In addition, the inspectors were not told exactly why NSC was 
suspicious of these suppliers--for example, whether it was due to their 
billing patterns or to their connection to an ongoing investigation of 
other suppliers. Understanding why the inspection was taking place 
could help focus the inspector's review. 

[30] We analyzed fiscal year 2004 appeals to CMS by suppliers that had 
their billing numbers denied or revoked, in part because they did not 
have inventory to fill orders, to identify suppliers that provided 
contracts with the same companies as their sources of inventory in 
order to contest the revocations. 

[31] Banks and other financial institutions are required to file 
reports on currency transactions of $10,000 or more. 31 C.F.R. § 103.22 
(2004). These reports assist law enforcement in identifying financial 
transactions that may be associated with criminal activities. 

[32] See GAO-05-43. 

[33] NSC has focused its review on nonchain suppliers, based on its 
previous experience with the suppliers found most likely to have 
problematic billing. 

[34] Pub. L. No. 108-173, § 302(b), 117 Stat. 2066, 2224-2228. 

[35] 48 C.F.R. § 9.104-1 (2004). A federal officer awarding a contract 
has broad discretion to use any current facts indicating financial 
weakness in making responsibility determinations, such as the firm's 
profitability, ratio of assets to liabilities, liquidity of assets, and 
credit ratings. In addition, a prospective contractor must have the 
"necessary organization, experience, accounting and operational 
controls, and technical skills or the ability to obtain them." This is 
often determined by examining the prior experience of the prospective 
contractor, its past performance, the past performance of a predecessor 
firm, and the experience of the principal officers. 

[36] Termination for convenience means the federal government 
completely or partially terminates a contractor's performance of work 
under the contract when it is in the government's interest. Termination 
for default means the federal government completely or partially 
terminates a contract because of the contractor's actual or anticipated 
failure to perform its contractual obligations. 48 C.F.R. § 2.101 
(2004). 

[37] 48 C.F.R. §§ 9.406-2 and 9.406-4 (2004). 

[38] The Medicare standard for a physical location does not forbid 
suppliers from operating out of their homes. 

[39] Costec Assocs., B-215827, Dec. 5, 1984, 84-2 CPD ¶ 626. 

[40] HHS also has authority to debar entities that engage in 
nonprocurement transactions with the department. See 45 C.F.R. pt. 76 
(2004). HHS officials that we contacted were not aware of this 
authority ever being used to debar Medicare suppliers. A CMS official 
indicated that the supplier-specific regulations are used to address 
noncompliant DMEPOS suppliers. 

[41] In practice, federal agencies do not always use their authority 
and sometimes continue to contract with companies that have failed to 
perform adequately or have shown a lack of integrity in performing 
their contracts. 

[42] Mayfair Constr. Co., B-192023, Sept. 11, 1978, 78-2 CPD ¶ 187. 

[43] See Garten-und Landschaftsbau GmbH Frank Mohr, B-237276, Feb. 13, 
1990, 90-1 CPD ¶ 186; see also Becker and Schwindenhammer, GmbH, B- 
225396, Mar. 2, 1987, 87-1 CPD ¶ 235. 

[44] This requirement applies to all providers, not just suppliers. 

[45] The state can also disenroll providers after the first year, but 
the process to do so is more complex. 

[46] After discovering significant fraud among DME suppliers, 
California Medicaid required all DME suppliers to reapply in 2000. Less 
than half reenrolled. California Medicaid has not enrolled any DME 
suppliers since that time. Any supplier disenrolled after 2000 cannot 
be reenrolled until the state begins a new reenrollment cycle for DME 
suppliers, which the state does not plan to do in the near term. 

[47] One supplier recently investigated by the FBI and the OIG was 
located in a gym and fitness center. 

[48] Pub. L. No. 108-173, § 302(a), 117 Stat. 2066, 2223-2224. 

[49] According to NSC's contract, the SACU must educate suppliers about 
the Medicare application process; participate in Medicare and DME 
regional-carrier-sponsored fraud conferences, meetings, and 
discussions; serve as a point of contact with GAO, the OIG, and the FBI 
on NSC-related Medicare fraud issues; establish contacts among 
governmental fraud prevention agencies; support the on-site inspection 
process; and take whatever steps it deems necessary, including 
appropriate travel, in compliance with existing laws and regulations to 
prevent fraudulent suppliers from gaining and keeping access to the 
Medicare program. 

[50] These states were chosen because they have licensure requirements 
for certain DMEPOS items and are known to have suppliers with 
fraudulent Medicare DMEPOS billings. 

GAO's Mission: 

The Government Accountability Office, the investigative arm of 
Congress, exists to support Congress in meeting its constitutional 
responsibilities and to help improve the performance and accountability 
of the federal government for the American people. GAO examines the use 
of public funds; evaluates federal programs and policies; and provides 
analyses, recommendations, and other assistance to help Congress make 
informed oversight, policy, and funding decisions. GAO's commitment to 
good government is reflected in its core values of accountability, 
integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through the Internet. GAO's Web site ( www.gao.gov ) contains 
abstracts and full-text files of current reports and testimony and an 
expanding archive of older products. The Web site features a search 
engine to help you locate documents using key words and phrases. You 
can print these documents in their entirety, including charts and other 
graphics. 

Each day, GAO issues a list of newly released reports, testimony, and 
correspondence. GAO posts this list, known as "Today's Reports," on its 
Web site daily. The list contains links to the full-text document 
files. To have GAO e-mail this list to you every afternoon, go to 
www.gao.gov and select "Subscribe to e-mail alerts" under the "Order 
GAO Products" heading. 

Order by Mail or Phone: 

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to: 

U.S. Government Accountability Office 

441 G Street NW, Room LM 

Washington, D.C. 20548: 

To order by Phone: 

Voice: (202) 512-6000: 

TDD: (202) 512-2537: 

Fax: (202) 512-6061: 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm 

E-mail: fraudnet@gao.gov 

Automated answering system: (800) 424-5454 or (202) 512-7470: 

Public Affairs: 

Jeff Nelligan, managing director, 

NelliganJ@gao.gov 

(202) 512-4800 

U.S. Government Accountability Office, 

441 G Street NW, Room 7149 

Washington, D.C. 20548: