Medicare Program: Continued Action Required to Address Weaknesses in Provider and Supplier Enrollment Controls

What GAO Found

In June 2015 and April 2016, GAO reported on CMS's implementation of enrollment-screening procedures that the Centers for Medicare & Medicaid Services (CMS) uses to prevent and detect ineligible or potentially fraudulent providers and suppliers from enrolling into its Provider Enrollment, Chain and Ownership System (PECOS). GAO identified weaknesses in CMS's verification of provider practice location, physician licensure status, and criminal-background histories. These weaknesses may have resulted in CMS improperly paying thousands of potentially ineligible providers and suppliers.

Specifically, in June 2015, GAO's examination of 2013 data found that about 23,400 (22 percent) of 105,234 of practice location addresses were potentially ineligible. The computer software CMS used as a method to validate applicants' addresses did not flag potentially ineligible addresses, such as those that are of a Commercial Mail Receiving Agency (such as a UPS store mailbox), vacant, or invalid. GAO recommended that CMS incorporate flags into its software to help identify potentially questionable addresses, among other things. CMS concurred with this recommendation and has replaced the PECOS address verification software.

Also, in June 2015, GAO found that, as of March 2013, 147 out of about 1.3 million physicians listed in PECOS had received a final adverse action against their medical license from a state medical board for various felonies that may have made them ineligible to bill Medicare. However, they were either not revoked from the Medicare program until months after the adverse action or never removed because CMS only collected information on the medical license numbers providers used to enroll into the Medicare program. CMS also did not collect adverse-action history or other medical licenses a provider may have in other states that were not used to enroll into Medicare. GAO recommended that CMS collect and review additional license information. CMS has incorporated a new database to obtain additional license history.

In April 2016, GAO reported on CMS's process to conduct criminal-background checks on Medicare providers and suppliers and found that opportunities exist for CMS to recover about $1.3 million in potential overpayments made to 16 out of 66 potentially ineligible providers with criminal backgrounds. In April 2014, CMS implemented procedures to obtain greater access to data to verify criminal backgrounds of existing and prospective Medicare providers and suppliers than it obtained previously; however, the results of GAO's review of the 2013 data identified an opportunity for CMS to recover potential overpayments that were made prior to putting the revised procedures in place.

In addition to its actions in response to GAO's recommendations, CMS has taken some actions to remove or recover overpayments from potentially ineligible providers and suppliers that GAO referred to it in April 2015 and April 2016, but its review and response to the referrals are ongoing.

Why GAO Did This Study

In fiscal year 2015, Medicare paid $568.9 billion for health care and related services. CMS estimates that $59.6 billion (about 10.5 percent) of that total was paid improperly. To establish and maintain Medicare billing privileges, providers and suppliers must be enrolled in a CMS database known as PECOS. About 1.9 million providers and suppliers were in PECOS as of December 2015, according to CMS.

GAO published reports in June 2015 and April 2016 that examined Medicare's provider and supplier enrollment-screening procedures to determine whether PECOS was vulnerable to fraud. This testimony discusses the extent to which selected enrollment-screening procedures are designed and implemented to prevent and detect the enrollment of ineligible or potentially fraudulent Medicare providers and suppliers into PECOS.

In its reports, GAO matched providers and suppliers in PECOS, as of March 2013, to several databases to identify potentially ineligible providers and suppliers, and used Medicare claims data to verify whether they were paid during this period. GAO also examined relevant documentation, interviewed CMS officials, and obtained information from the CMS contractors that evaluate provider applications. From August 2015 through May 2016, GAO obtained updated information from CMS staff and reviewed documents related to actions.

CMS has taken or has plans to take some actions to address all of GAO's recommendations and referrals of potentially ineligible providers and suppliers.

For more information, contact Seto Bagdoyan at (202) 512-6722 or bagdoyans@gao.gov.