Policy & Regulation News

GAO: Weak Medicare, Medicaid Provider Screening Allows Fraud

The Centers for Medicare & Medicaid Services’ poor provider screening process allowed ineligible providers to collect $59B in 2015.

By Catherine Sampson

- The Centers for Medicare & Medicaid Services’ (CMS) provider enrollment screening process is vulnerable to fraud because many ineligible providers are still being entered into the Provider Enrollment, Chain and Ownership System (PECOS), the Government Accountability Office (GAO) said this week. As a result, CMS is losing billions due to improper payments made by ineligible providers.

 Ineligible providers are able to collect billions in improper payments because CMS had a poor provider screening process.

In 2015, Medicare paid $568.9 billion for healthcare and related services, and about 10.5 percent ($59.6 billion) of this total was considered improper payment, GAO said in testimony submitted to House of Representatives Subcommittee on Oversight and Investigations.

“GAO identified weaknesses in CMS's verification of provider practice location, physician licensure status, and criminal-background histories,” said Seto J. Bagdoyan, GAO’s Director, Forensic Audits and Investigative Service. “These weaknesses may have resulted in CMS improperly paying thousands of potentially ineligible providers and suppliers.”

PECOS is a centralized database designed to contain provider and supplier enrollment information. The enrollment-screening process is supposed to detect and prevent ineligible providers from enrolling in PECOS, which had about 1.9 million providers and suppliers in its database in 2015.

  • Mending Payer Relations Smooths Revenue Cycle at Northwestern Med
  • 3 Hard Reimbursement Questions Physicians Are Afraid to Ask
  • CMS Announces Top 3 Volume to Value Medicare Payment Goals
  • In 2013, 147 physicians listed in PECOS still received a final adverse action against their medical license from a state medical board for various felonies that should have prevented them from being able to bill Medicare, GAO said. CMS did not collect enough information on these physicians, so they were still able to collect payments.

    “CMS also did not collect adverse-action history or other medical licenses a provider may have in other states that were not used to enroll into Medicare,” Bagdoyan said.

    About 23,400 (22 percent) of 105,234 of practice location addresses in PECOS in 2013 were “potentially ineligible.” CMS’s Finalist software, which is used to validate practice location addresses, did not flag potentially ineligible addresses. This software is integrated into PECOS and it is supposed to standardize addresses. However, the Finalist software does not indicate whether an address is vacant or invalid.

    “In our June 2015 report, we found thousands of questionable practice location addresses for providers and suppliers listed in PECOS,” Bagdoyan said. “Of the 23,400 potentially ineligible addresses submitted as practice locations, we estimate that, from 2005 to 2013, 2,600 were associated with providers that had claims that were $500,000 or more per address.”

    One provider listed a mailbox rental store as its practice location. Another provider listed a fast food franchise as his practice, Bagdoyan noted.

    Under federal regulations, providers and suppliers are required to be operational in order to provide Medicare covered services. This means that they must have a qualified physical practice location that is open to the public for the purpose of providing healthcare. The location needs to be “properly staffed, equipped, and stocked” to furnish healthcare services, Bagdoyan said.

    CMS currently utilizes Medicare administrative contractors (MACs) that use the Finalist software and the National Supplier Clearinghouse to validate a practice location. MACs are responsible for verifying provider and supplier application information in PECOS before the providers and suppliers are permitted to enroll into Medicare.

    GAO recommended that CMS have Medicare administrative contractors conduct additional research, beyond phone calls to applicants, on the practice location addresses that are flagged as a commercial mail receiving agency, vacant, or invalid address.

    However, CMS did not agree with this recommendation. CMS said that having Medicare administrative contractors contact an individual listed in an application to verify a practice location address and use the Finalist software to standardize the address was sufficient enough. CMS only requires contractors to do additional verification if the Finalist software is unable to standardize an address, Bagdoyan explained.

    GAO also recommended that CMS collect and review additional license information, and CMS agreed to incorporate a new database to obtain additional information on physicians’ license history. Additionally, GAO recommended that CMS incorporate flags into its software to help identify questionable addresses. CMS agreed with this recommendation and has replaced the PECOS address verification software.

    “By updating the address verification software, CMS can ensure that providers with ineligible practice location are not listed in PECOS,” Bagdoyan said.

    Dig Deeper: