Medicare Advantage: Fundamental Improvements Needed in CMS's Effort to Recover Substantial Amounts of Improper Payments
Highlights
What GAO Found
Medicare Advantage (MA) organizations contract with the Centers for Medicare & Medicaid Services (CMS) to offer beneficiaries a private plan alternative to the original program and are paid a predetermined monthly amount by Medicare for each enrolled beneficiary. These payments are risk adjusted to reflect each enrolled beneficiary's health status and projected spending for Medicare-covered services. CMS conducts risk adjustment data validation (RADV) audits of MA contracts which facilitate the recovery of improper payments from MA organizations that submitted beneficiary diagnoses for payment adjustment purposes that were unsupported by medical records. With a separate national audit, CMS estimated that it improperly paid $14.1 billion in 2013 to MA organizations, primarily because of these unsupported diagnoses.
GAO found that CMS's methodology does not result in the selection of contracts for audit that have the greatest potential for recovery of improper payments. First, CMS's estimate of improper payment risk for each contract, which is based on the diagnoses reported for the beneficiaries in that contract, is not strongly correlated with unsupported diagnoses. Second, CMS does not use other available information to select the contracts at the highest risk of improper payments. As a result, 4 of the 30 contracts CMS selected for its RADV audit of 2011 payments were among the 10 percent of contracts estimated by CMS to be at the highest risk for improper payments. These limitations are impediments to CMS's goal of recovering improper payments and do not align with federal internal control standards, which require that agencies use quality information to achieve their program goals.
CMS's goal of eventually conducting annual RADV audits is in jeopardy because its two RADV audits to date have experienced substantial delays in identifying and recovering improper payments. RADV audits of 2007 and 2011 payments have taken multiple years and are still ongoing for several reasons. First, CMS's RADV audits rely on a system for transferring medical records from MA organizations that has often been inoperable. Second, CMS audit procedures have lacked specified time requirements for completing medical record reviews and for other steps in the RADV audit process. In addition, CMS has not established timeframes for appeal decisions at the first-level of the MA appeal process, as it has done in other contexts.
CMS has not expanded the recovery audit program to MA by the end of 2010, as it was required to do by the Patient Protection and Affordable Care Act. RACs have been used in other Medicare programs to recover improper payments for a contingency fee. In December 2015, CMS issued a request for information seeking industry comment on how an MA RAC could be incorporated into the RADV audit framework. CMS noted in its request that incorporating a RAC into the RADV framework would increase the number of MA contracts audited each year. CMS currently includes 30 MA contracts in each RADV audit, about 5 percent of all MA contracts. Despite the importance of increasing the number of contracts audited, CMS does not have specific plans or a timetable for incorporating RACs into the RADV audit framework, contrary to established project management principles, which stress the importance of developing an overall plan to meet strategic goals.
Why GAO Did This Study
In 2014, Medicare paid about $160 billion to MA organizations to provide health care services for approximately 16 million beneficiaries. CMS, which administers Medicare, estimates that about 9.5 percent of its payments to MA organizations were improper, according to the most recent data—primarily stemming from unsupported diagnoses submitted by MA organizations. CMS currently uses RADV audits to recover improper payments in the MA program.
GAO was asked to review the extent to which CMS is addressing improper payments in the MA program. This report examines the extent to which (1) CMS's contract selection methodology for RADV audits facilitates the recovery of improper payments, (2) CMS has completed RADV audits and appeals in a timely manner, and (3) CMS has made progress toward incorporating RACs into the MA program to identify and assist with improper payment recovery. In addition to reviewing research literature and agency documents, GAO analyzed data from ongoing RADV audits of 2007 and 2011 payments—CMS's two initial contract-level RADV audits. GAO also interviewed CMS officials.
Recommendations
GAO is making five recommendations to CMS to improve its processes for selecting contracts to include in the RADV audits, enhance the timeliness of the audits, and incorporate RACs into the RADV audits. HHS concurred with the recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Centers for Medicare & Medicaid Services | As CMS continues to implement and refine the contract-level RADV audit process to improve the efficiency and effectiveness of reducing and recovering improper payments and to improve the accuracy of CMS's calculation of coding intensity, the Administrator should modify that calculation by taking actions such as the following: (1) including only the three most recent pair-years of risk score data for all contracts; (2) standardizing the changes in disease risk scores to account for the expected increase in risk scores for all MA contracts; (3) developing a method of accounting for diagnostic errors not coded by providers, such as requiring that diagnoses added by MA organizations be flagged as supplemental diagnoses in the agency's Encounter Data System to separately calculate coding intensity scores related only to diagnoses that were added through MA organizations' supplemental record review (that is, were not coded by providers); and (4) including MA beneficiaries enrolled in contracts that were renewed from a different contract under the same MA organization during the pair-year period. |
CMS is working to improve the accuracy of its calculation of coding intensity, as GAO recommended in April 2016. In October 2017, CMS officials told GAO that the agency is reevaluating the design of the risk adjustment data validation audits to ensure their rigor in the context of all the payment error data acquired since the original design of the audits. As part of this work, CMS officials told GAO that the agency will examine whether coding intensity is the best criterion to use to select contracts for audit. In January 2022, CMS officials noted that the agency has significantly changed its approach to selecting MA plans subject to audit and that they are continuing to refine the approach to audit a greater number of contracts, improve operational efficiency, and incrementally improve its ability to find payment errors. Additionally, CMS is taking steps to modernize its audit system to improve reliability. For example, it initiated a project to explore how to directly receive electronic medical record documentation. CMS reported it had no additional updates as of February 2024. CMS needs to provide documentation that these actions address GAO's recommendation to improve the risk adjustment data validation contract-level audit process.
|
| Centers for Medicare & Medicaid Services | As CMS continues to implement and refine the contract-level RADV audit process to improve the efficiency and effectiveness of reducing and recovering improper payments. The Administrator should modify CMS's selection of contracts for contract-level RADV audits to focus on those contracts most likely to have high rates of improper payments by taking actions such as the following: (1) selecting more contracts with the highest coding intensity scores; (2) excluding contracts with low coding intensity scores; (3) selecting contracts with high rates of unsupported diagnoses in prior contract-level RADV audits; (4) if a contract with a high rate of unsupported diagnoses is no longer in operation, selecting a contract under the same MA organization that includes the service area of the prior contract; and (5) selecting some contracts with high enrollment that also have either high rates of unsupported diagnoses in prior contract-level RADV audits or high coding intensity scores. |
CMS modified the methodology used to select Medicare Advantage contracts, as GAO recommended in April 2016. In May 2021, CMS officials reported that they implemented a new methodology using payment error as the key sampling driver for their ongoing 2014 and 2015 audits. As documented in their audit methodology paper, the revised methodology uses a more targeted model-the Enrollee-Level Model-to determine contracts that have high improper payment rates. This model uses historical national sample and contract sample data to predict overpayment estimates per enrollee as well as other variables to inform selection, such as plan type and demographic variables. CMS officials told GAO that they continue to update this model in their audits to help target overpayment and inform sampling strategy. This new methodology will help CMS focus their RADV audits on those contracts most likely to have high rates of improper payments.
|
| Centers for Medicare & Medicaid Services |
Priority Rec.
As CMS continues to implement and refine the contract-level RADV audit process to improve the efficiency and effectiveness of reducing and recovering improper payments. The Administrator should enhance the timeliness of CMS's contract-level RADV process by taking actions such as the following: (1) closely aligning the time frames in CMS's contract-level RADV audits with those of the national RADV audits the agency uses to estimate the MA improper payment rate; (2) reducing the time between notifying MA organizations of contract audit selection and notifying them about the beneficiaries and diagnoses that will be audited; (3) improving the reliability and performance of the agency's process for transferring medical records from MA organizations, including assessing the feasibility of updating Electronic Submission of Medical Documentation for use in transferring medical records in contract-level RADV audits; and (4) requiring that CMS contract-level RADV auditors complete their medical record reviews within a specific number of days comparable to other medical record review time frames in the Medicare program. |
CMS is working to enhance the timeliness of the agency's contract-level RADV process, as GAO recommended in April 2016. CMS officials told GAO that the agency has begun several steps to improve the timeliness of the contract-level RADV process. For example, in December 2021, CMS officials told GAO that it is the agency's intent to explore ways of aligning more closely the time frames of contract-level and national-level RADV audits. Officials noted that resource constraints limit the number of contract level audits that can be completed in a calendar year to two payment years but that they expect to have the audits aligned by calendar year 2023. Additionally, in February 2024, CMS officials told GAO that it has initiated automated reviews that will reduce the amount of time required for medical record review to enhance the timeliness of the RADV process. CMS's 2024 budget justification described additional steps to improve the timeliness of the RADV process, such as developing and testing the use of artificial intelligence technology to further automate the medical record intake process. Until CMS completes these steps to improve the RADV contract-level audit process, it will fail to recover improper payments of hundreds of millions of dollars annually.
|
| Centers for Medicare & Medicaid Services | As CMS continues to implement and refine the contract-level RADV audit process to improve the efficiency and effectiveness of reducing and recovering improper payments. The Administrator should improve the timeliness of CMS's contract-level RADV appeal process by requiring that reconsideration decisions be rendered within a specified number of days comparable to other medical record review and first-level appeal time frames in the Medicare program. |
CMS is working to improve the timeliness of the agency's contract-level risk adjustment data validation appeals process, as GAO recommended in April 2016. In January 2023, CMS officials told us they are exploring policy options to standardize the timelines for RADV appeals at the reconsideration level. For example, CMS officials told GAO they are considering using the federal rulemaking process to establish uniform timelines to expedite the appeals process. Specifically, they plan to require that a findings determination be made within 60-90 days of an arbiter's receipt of each party's arguments at each stage of an appeal. As of February 2024, CMS reported it is reviewing and assessing the implementation of this recommendation. Until CMS takes such actions to improve the risk adjustment data validation contract-level audit process, it will fail to recover improper payments of hundreds of millions of dollars annually.
|
| Centers for Medicare & Medicaid Services | As CMS continues to implement and refine the contract-level RADV audit process to improve the efficiency and effectiveness of reducing and recovering improper payments. The Administrator should ensure that CMS develops specific plans and a timetable for incorporating a RAC in the MA program as mandated by the Patient Protection and Affordable Care Act. |
CMS has attempted to incorporate recovery audit contractor functions into its RADV program, although it has not developed specific plans and a timetable for incorporating a recovery audit contractor in the Medicare Advantage program as GAO recommended in April 2016. In January 2023, CMS reported in its budget justification that it believes the proposed scope of the contract-level risk adjustment data validation audits satisfies GAO's recommendation. CMS officials noted that RADV audits are the primary corrective action that CMS has to address payments in Part C as these audits verify that diagnoses submitted by Medicare Advantage organizations for risk adjusted payment are supported by medical record documentation. In February 2024, CMS reported that while different in program name, the RADV program conducts the same audits as a RAC, and therefore, it would be duplicative in efforts and results. Until CMS completes efforts to improve the risk adjustment data validation contract-level audit process and demonstrates that the changes made to the RADV program satisfy the requirement to incorporate a recovery audit contractor in the Medicare Advantage program, CMS may fail to recover improper payments of hundreds of millions of dollars annually.
|