Prescription Opioids: Medicare Needs to Expand Oversight Efforts to Reduce the Risk of Harm

Misuse of prescription opioids can lead to overdose and death. In 2016, over 14 million Medicare Part D beneficiaries received opioid prescriptions, and spending for opioids was almost $4.1 billion. GAO and others have reported on inappropriate activities and risks associated with these prescriptions, such as receiving multiple opioid prescriptions from different providers.

GAO was asked to describe what is known about CMS’s oversight of Medicare Part D opioid use and prescribing. This report examines (1) CMS oversight of beneficiaries who receive opioid prescriptions under Part D, and (2) CMS oversight of providers who prescribe opioids to Medicare Part D beneficiaries.GAO reviewed CMS opioid utilization and prescriber data, CMS guidance for plan sponsors, and CMS’s strategy to prevent opioid misuse. GAO also interviewed CMS officials, the six largest Part D plan sponsors, and 12 national associations selected to represent insurance plans, pharmacy benefit managers, physicians, patients, and regulatory and law enforcement authorities.

The Centers for Medicare & Medicaid Services (CMS) provides guidance on the monitoring of Medicare beneficiaries who receive opioid prescriptions to plan sponsors—private organizations that implement the Medicare drug benefit, Part D—but lacks information on most beneficiaries at risk of harm.

CMS provides plan sponsors guidance on how they should monitor opioid overutilization among Medicare Part D beneficiaries and requires them to implement drug utilization review systems that use criteria similar to CMS's. CMS's criteria focus on beneficiaries who (1) receive prescriptions of high doses of opioids, (2) receive prescriptions from four or more providers, and (3) fill the prescriptions at four or more pharmacies. According to CMS officials, this approach allows plan sponsors to focus their actions on those beneficiaries it determined to have the highest risk of harm from opioid use.

CMS’s criteria, including recent revisions, do not provide sufficient information about the larger population of potentially at-risk beneficiaries. CMS estimates that while 33,223 beneficiaries would have met the revised criteria in 2015, 727,016 would have received high doses of opioids regardless of the number of providers or pharmacies. In 2016, CMS began to collect information on some of these beneficiaries using a higher dosage threshold for opioid use. This approach misses some who could be at risk of harm, based on Centers for Disease Control and Prevention guidelines. As a result, CMS is limited in its ability to assess progress toward meeting the broader goals of its Opioid Misuse Strategy, which includes activities to reduce the risk of harm from opioid use.

CMS Estimates of 2015 Part D Beneficiaries with High Opioid Doses and Those Who Would Have Met Revised Overutilization Monitoring Criteria

CMS oversees the prescribing of drugs at high risk of abuse through a variety of projects, but does not analyze data specifically on opioids. According to CMS officials, CMS and plan sponsors identify providers who prescribe large amounts of drugs with a high risk of abuse, and those suspected of fraud or abuse may be referred to law enforcement. However, GAO found that CMS does not identify providers who may be inappropriately prescribing large amounts of opioids separately from other drugs, and does not require plan sponsors to report actions they take when they identify such providers. As a result, CMS is lacking information that it could use to assess how opioid prescribing patterns are changing over time, and whether its efforts to reduce harm are effective.

GAO recommends that CMS (1) gather information on the full number of at-risk beneficiaries receiving high doses of opioids, (2) identify providers who prescribe high amounts of opioids, and (3) require plan sponsors to report to CMS on actions related to providers who inappropriately prescribe opioids. HHS concurred with the first two recommendations, but not with the third. GAO continues to believe the recommendation is valid, as discussed in the report.

Misuse of prescription opioids, which are used to treat both acute and  chronic pain, has become a serious public health problem for the U.S.  population, including Medicare beneficiaries. The Centers for Disease  Control and Prevention (CDC) reported that from 1999 to 2013 the rate of  drug poisoning deaths from prescription opioids nearly quadrupled from  1.4 to 5.1 per 100,000 people. In addition, the Department of Health and  Human Services (HHS) Office of Inspector General (HHS-OIG) reported  that 14.4 million people (about one-third) who participate in Medicare Part  D received at least one prescription for opioids in 2016, and that Part D  spending for opioids in 2016 was almost $4.1 billion. GAO and the HHS- OIG have previously reported on inappropriate activities that can be  associated with such prescriptions, including “doctor shopping” to receive  multiple opioid prescriptions from different providers, the diversion of  prescription drugs for uses other than intended, and questionable  prescribing practices, including those in Medicare. Additionally, a staff  report issued in 2016 by the Senate Permanent Subcommittee on  Investigations outlined concerns associated with opioid abuse in both  Medicare and private health insurance.

In March 2015, HHS announced plans to make addressing opioid abuse  a high priority through two broad goals: (1) decreasing opioid overdoses  and overall overdose deaths, and (2) decreasing the prevalence of opioid  use disorder. Further, in January 2017, the Centers for Medicare &  Medicaid Services (CMS), the HHS agency that administers Medicare,  issued its Opioid Misuse Strategy for the Medicaid and Medicare  programs, including Part D. One of the four priority areas outlined in the  strategy is implementing activities to reduce the risk of opioid use  disorders, overdoses, inappropriate prescribing, and drug diversion. For  this priority, the strategy includes the agency’s plans to address concerns  about beneficiary use of opioids and the prescribing of opioids by  providers, such as educating and providing feedback to beneficiaries and providers concerning effective pain management and appropriate opioid  prescribing, as well as use of evidence-based prescribing guidelines. The  strategy also outlines attempts to identify providers with a high risk of  fraud, waste, and abuse in prescribing opioids and other drugs. CMS  contracts with the National Benefit Integrity Medicare Drug Integrity  Contractor (NBI MEDIC) to monitor and analyze data to detect potential  fraud, waste, and abuse, and to investigate such potential fraud, waste,  and abuse in Medicare Parts C and D, among other activities.

You asked us for information on CMS’s activities related to reducing the  misuse and overprescribing of opioids. We examined  1.  how CMS oversees beneficiaries who receive opioid prescriptions  under Medicare Part D, and  2.  how CMS oversees providers who prescribe opioids to Medicare Part  D beneficiaries.

To examine CMS oversight of beneficiaries who receive opioid  prescriptions under Medicare Part D, we analyzed CMS documents, such  as CMS’s Opioid Misuse Strategy as well as letters, guidance, and other  documents on the operation of the Part D program; and CMS data about  the number of beneficiaries at risk of opioid overutilization. We also  reviewed CDC guidelines for prescribing opioids. Further, we interviewed  CMS officials involved in these efforts. This information helped us  understand CMS procedures for identifying beneficiaries at risk of  overuse of opioids, as well as to assess trends in such use. We also  interviewed plan sponsors—private organizations under contract with  CMS that provide the Part D drug benefit to Medicare beneficiaries— about their oversight role and the compliance programs they operate to  safeguard the Part D program from fraud, waste, and abuse. In addition,  we interviewed other stakeholders involved in opioid use and prescribing,  including organizations that represent providers, pharmacies,  beneficiaries, and others to further understand issues related to opioid  use.

To examine CMS oversight of providers who prescribe opioids to  Medicare Part D beneficiaries, we analyzed CMS and NBI MEDIC  documents, such as Part D program guidance, and documents sent to  plan sponsors about opioid prescribing patterns, as well as data about  providers who prescribe a large amount of opioids. We also interviewed  CMS officials and officials from NBI MEDIC about monitoring opioid  prescribing. We used this information to understand CMS’s and NBI  MEDIC’s procedures for identifying and addressing opioid  overprescribing. We also interviewed the same plan sponsors and  stakeholders identified above about issues related to opioid prescribing  and CMS’s role in addressing opioid overprescribing.

For both objectives, we compared the information we collected to CMS’s  stated goals and relevant federal internal control standards. We  assessed the reliability of CMS and NBI MEDIC data by reviewing  documents for potential inconsistencies and discussing the  methodologies used to gather the data with officials from both CMS and  NBI MEDIC. We determined that these data were sufficiently reliable for  the purposes of our objectives.

We conducted this performance audit from October 2016 to October 2017  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Opioids, such as hydrocodone, oxycodone, morphine, and methadone,  can be prescribed to treat both acute and chronic pain. Because many  opioids have a high potential for abuse and may lead to severe  psychological or physical dependence, many of them are classified as  Schedule II drugs under the Controlled Substances Act. The abuse of  opioids has been associated with serious consequences, including  addiction, overdose, and death.

Responsibilities of Medicare Part D Plan Sponsors, CMS, and NBI MEDIC

Medicare Part D plan sponsors are private organizations, such as health  insurance companies and pharmacy benefit managers, contracted by  CMS to provide outpatient drug benefit plans to Medicare beneficiaries.  CMS provides guidance to plan sponsors that are responsible for  establishing reasonable and appropriate drug utilization review (DUR)  programs that assist in preventing misuse of prescribed medications in  general, including the unsafe use of opioid pain medications. In 2013,  CMS implemented the Medicare Part D opioid overutilization policy  intended to improve medication safety. Through the Overutilization  Monitoring System (OMS), CMS seeks to ensure that plan sponsors  establish reasonable and appropriate DUR programs to prevent  overutilization of opioids. CMS uses criteria in the OMS to identify high- risk use of opioids. Plan sponsors may, but are not required to, use these  guidelines as part of their DUR.

CMS’s Center for Program Integrity (CPI) oversees Part D program  integrity and coordinates with other parts of CMS that monitor plan  sponsor compliance with the Part D program. CPI has primary  responsibility for overseeing NBI MEDIC, which is responsible for  identifying and investigating potential Part D fraud, waste, and abuse, in  general. NBI MEDIC handles complaints from beneficiaries and others, as  well as requests from law enforcement; investigates providers and refers  them to law enforcement as appropriate; and analyzes Part D program  prescription drug event records and other data to identify patterns that  may indicate fraud, waste, or abuse. NBI MEDIC’s responsibilities are  for all Part D drugs and are not opioid-specific.

One concern associated with prescribed opioids is their diversion—that is,  the redirection of prescription drugs for an illegal purpose such as  recreational use or resale. Diversion can include selling prescription drugs  that were obtained legally, transferring a legitimately prescribed opioid to  family or friends who may be trying to self-medicate, or pretending to be  in pain to obtain a prescription opioid due to an addiction. It is often  associated with “doctor shopping,” the attempt to obtain large amounts of  opioids through multiple providers, or from multiple pharmacies. Doctor  shopping can be used to help support an individual’s addiction or to  obtain opioids for resale on the black market. Drug diversion can also  include illicit prescribing, whereby providers—commonly known as “pill  mills”—write unnecessary prescriptions or prescribe larger quantities than  are medically necessary. Opioids are among the drugs with the highest  potential for drug diversion.

In 2016, CDC issued guidelines with recommendations for prescribing  opioids in outpatient settings for chronic pain, based on consultation with  experts and a review of scientific evidence. CDC noted in the guidelines  that primary care physicians have reported concerns about opioid misuse  and addiction, and find managing patients with chronic pain a challenge,  possibly because of insufficient training in prescribing opioids. According  to the guidelines, most experts agreed that long-term opioid dosage of 50  milligrams (mg) morphine equivalent dose (MED) per day or more  generally increases overdose risk without necessarily adding benefits for  pain control or function. Experts also noted that daily opioid dosages  close to or greater than 100 mg MED per day are associated with  significant risks. The guidelines therefore recommended that providers  use caution when prescribing opioids at any dose, carefully reassess evidence of individual benefits and risks when increasing the dosage to  50 mg MED per day or more, and either avoid or carefully justify dosage  at 90 mg MED or more. In making these recommendations, CDC noted  that there is not a dosage threshold below which the risk of overdose is  eliminated, but found that dosages less than 50 mg MED would reduce  the risk for a large portion of patients. CDC also noted that providers  should use additional caution in prescribing opioids to patients aged 65  and older, because the drugs can accumulate in the body to toxic levels.

CMS Delegates Monitoring of Beneficiaries who Receive Opioid Prescriptions to Plan Sponsors, but Does Not Have Sufficient Information on Most Beneficiaries at Risk for Harm CMS Delegates Monitoring of Individual Beneficiaries’ Opioid Prescriptions to Plan Sponsors

CMS provides guidance to plan sponsors on how they should monitor  opioid overutilization problems among Part D beneficiaries. The agency  includes this guidance in its annual letters to plan sponsors, known as call  letters; it also provided a supplemental memo to plan sponsors in 2012.  Among other things, these guidance documents instructed plan sponsors  to implement a retrospective drug utilization review (DUR) system to  monitor beneficiary utilization starting in 2013. As part of the DUR  systems, CMS requires plan sponsors to have methods to identify  beneficiaries who are potentially overusing specific drugs or groups of  drugs, including opioids.

Also in 2013, CMS created the Overutilization Monitoring System (OMS),  which outlines criteria to identify beneficiaries with high-risk use of opioids  and to oversee sponsors’ compliance with CMS’s opioid overutilization  policy. Plan sponsors may use the OMS criteria for their DUR systems,  but they have some flexibility to develop their own targeting criteria, within  CMS guidance. The OMS considers beneficiaries to be at a high risk of  opioid overuse when they meet all three of the following criteria: (1)  receive a total daily MED greater than 120 mg for 90 consecutive days,  (2) receive opioids prescriptions from four or more providers in the  previous 12 months, and (3) receive opioids from four or more  pharmacies in the previous 12 months. The criteria exclude  beneficiaries with a cancer diagnosis and those in hospice care, for whom  higher doses of opioids may be appropriate.

Officials from all six plan sponsors we interviewed confirmed they have a  DUR system that specifically looks at opioids. In addition, to be consistent  with CMS, all of the plan sponsors adopted criteria similar to the OMS,  with some minor modifications—typically involving the number of months  in which they measured beneficiaries’ opioid prescriptions.

Through the OMS, CMS generates quarterly reports that list beneficiaries  who meet all of the criteria and who are identified as high-risk and then  distributes the reports to the plan sponsors. Plan sponsors are expected  to review the list of identified beneficiaries, determine appropriate action,  and then respond to CMS with information on their actions within 30 days.  According to CMS officials, the agency also expects that plan sponsors  will share any information with CMS on beneficiaries that they identify  through their own DUR systems. Some actions plan sponsors may take  include

Case management. After plan sponsors identify beneficiaries with  patterns of inappropriate opioid use and possible coordination of care  issues through their DUR analysis, they may conduct case  management. Case management may include an attempt to improve  coordination issues, and often involves provider outreach, whereby  the plan sponsor will contact the providers associated with the  beneficiary to let them know that the beneficiary is receiving high  levels of opioids and may be at risk of harm. In addition to outreach,  officials from two of the six plan sponsors we interviewed told us they  focus on provider education and one plan sponsor said they may  direct the providers to the CDC guidelines or other information to help  reduce overutilization. Officials from two plan sponsors reported that  they also reach out to beneficiaries to let them know they are  receiving high levels of opioids and may be at risk of harm.

Beneficiary-specific point-of-sale (POS) edits. When plan sponsors  determine that a beneficiary is at risk for opioid harm, they may  choose to implement a beneficiary-specific POS edit to prevent  overutilization. Beneficiary-specific POS edits are restrictions that limit  these beneficiaries to certain opioids and amounts. Pharmacists  receive a message when a beneficiary attempts to fill a prescription  that exceeds the limit in place for that beneficiary. CMS expects plan  sponsors to report on the POS edits they use through CMS’s  Medicare Advantage and Prescription Drug System for information  sharing and monitoring purposes. That way, if a beneficiary changes  plans, the new plan sponsor will receive an alert about the  beneficiary’s record of POS edits. From February 2014 through March  10, 2016, there were 2,693 POS edits reported in that system for  2,520 beneficiaries.

Formulary-level POS edits. CMS expects plan sponsors to use  formulary-level POS edits to prospectively prevent opioid  overutilization. These edits alert providers who may not have been  aware that their patients are receiving high levels of opioids from other  doctors. CMS recommends these formulary-level edits to be used  when a beneficiary has a cumulative opioid MED of at least 90 mg.

Referrals for investigation. According to the six plan sponsors we  interviewed, the referrals can be made to NBI MEDIC or to the plan  sponsor’s own internal investigative unit, if they have one. After  investigating a particular case, if a plan sponsor or NBI MEDIC  determines that a beneficiary is suspected of diverting opioids, they  may refer the case to the HHS-OIG, or a law enforcement agency,  according to CMS, NBI MEDIC, and one plan sponsor.

Pharmacy lock-ins. Beginning in 2019, Medicare Part D plan  sponsors will be able to restrict certain beneficiaries identified as at- risk for prescription drug abuse to a single pharmacy for all their  opioid prescriptions, known as a pharmacy “lock in.” Some plan  sponsors explained that they use pharmacy lock-ins for their  commercial and Medicaid lines of business, and generally found them  to be a useful tool for controlling opioid use.

Based on CMS’s use of the OMS and the actions taken by plan sponsors,  CMS reported a decrease in the number of beneficiaries meeting the  OMS criteria of high-risk—which agency officials consider an indication of  success toward its goal of decreasing opioid use disorder. From calendar  years 2011 through 2016, there was a 61 percent decrease in the number  of beneficiaries meeting the OMS criteria. (See table 1.)

In addition to using the OMS as a monitoring tool to oversee plan  sponsors’ compliance with their DUR system requirements, CMS relies  on patient safety measures to assess how well Part D plan sponsors are  monitoring beneficiaries and taking appropriate actions. Specifically, CMS  tracks data on plan sponsors’ performance for 15 measures related to  Part D patient safety that are developed and maintained by the Pharmacy  Quality Alliance, and CMS communicates with plan sponsors about their  performance. In 2016, CMS started tracking plan sponsors’  performance on three Pharmacy Quality Alliance-approved patient safety  measures that are directly related to opioids, which were  1.  The proportion of beneficiaries that use opioids at high dosages (more  than 120 mg MED for 90 days or longer) in persons without cancer or  not in hospice care.  2.  The proportion of beneficiaries that use opioids from multiple  providers (four or more providers and four or more pharmacies) in  persons without cancer or not in hospice care.  3.  The proportion of beneficiaries that use opioids at high dosage and  from multiple providers in persons without cancer or not in hospice  care, and that meet both of the other measures.

The three measures are similar to the OMS criteria in that they identify  beneficiaries with high dosages of opioids (120 mg MED) from multiple  providers and pharmacies (four or more of each). However, there are a  number of differences between these measures and the OMS. For  example, the OMS counts actual beneficiaries, while the patient safety  measures report member-years, which are adjusted to account for  beneficiaries who are enrolled in a plan for only part of a year. In  addition, these measures separately identify beneficiaries who fulfill each  of those criteria individually. For example, data gathered on the first  measure indicate that about 285,119 beneficiaries, counted as member- years across all Part D plans, received high doses (more than 120 mg  MED) of opioids for 90 days or longer during calendar year 2016. CMS  also uses these data in different ways from how it uses OMS data. The  OMS criteria were developed and maintained by CMS to identify patients  at risk for harm who may warrant case management and to examine  opioid use trends across the Part D program, including progress toward  its goal of decreasing opioid use disorder. In contrast, CMS officials told  us that the agency uses the patient safety measures to assess plan  sponsor performance. The patient safety measures also serve as a tool  for Part D sponsors to compare their performance to overall averages,  and to track progress in improving these measures over time. CMS also  tracks sponsors’ progress in improving the measures, according to  agency officials. Each quarter, CMS contacts plan sponsors who have the  lowest performance on each measure and expects them to respond about  actions they take to improve performance. Beginning in April 2017, the  agency began distributing to plan sponsors the beneficiary-level files for  the patient safety measures. CMS officials said that these files provide a  complete list of beneficiaries included in each of the measures.

CMS Does Not Have Sufficient Information on Most Beneficiaries Potentially at Risk for Harm

While CMS tracks the total number of beneficiaries who meet all three  OMS criteria as part of its opioid overutilization oversight across the Part  D program, it does not have comparable information on most  beneficiaries who may be at risk for harm. CMS has goals to reduce the  risk of opioid use disorders, overdoses, inappropriate prescribing, and  drug diversion in its Opioid Misuse Strategy, but OMS does not track the  number of beneficiaries with prescriptions for high doses of opioids unless  those beneficiaries are also receiving them both from four or more  providers and from four or more pharmacies; and agency officials told us  that CMS has no plans for OMS to begin doing so. According to CDC  guidelines, long-term use of high opioid dosages—those above a MED of  90 mg per day—are associated with significant risk of harm and should  be avoided if possible.

Based on the CDC guidelines, outreach to Part D plan sponsors, and  CMS analyses of Part D data, CMS has revised its current OMS criteria to  include more at-risk beneficiaries beginning in 2018. The new OMS  criteria define a high user as having an average daily MED greater than  90 mg for any duration, and who receives opioids from four or more  providers and four or more pharmacies, or from six or more providers  regardless of the number of pharmacies, for the prior 6 months.  According to CMS officials, the revised OMS criteria, like the current  criteria, are intended to identify the beneficiaries it determined are at the  greatest risk of harm: those who may lack coordinated care as a result of  using multiple pharmacies and providers. CMS officials also noted that  the revised criteria are intended to limit the increase in the number of  beneficiaries for whom plan sponsors are expected to take action, such  as case management, to avoid overburdening plan sponsors with  unreasonable workload levels.

While the revised criteria will help identify beneficiaries who CMS  determined are at the highest risk of opioid misuse and therefore may  need case management by plan sponsors, they will not provide  information on most Part D beneficiaries who may also be at risk of harm.  In developing the revised criteria, CMS conducted a one-time analysis  that estimated there were 727,016 beneficiaries with an average MED of  90 mg or more, for any length of time during a 6 month measurement  period in 2015, regardless of the number of providers or pharmacies  used. These beneficiaries may be at risk of harm from opioids, according  to CDC guidelines, and therefore tracking the number of these  beneficiaries over time could help CMS to determine whether it is making  progress toward meeting the goals specified in its Opioid Misuse  Strategy. However, CMS officials told us that the agency does not keep  track of these beneficiaries, and does not have plans to do so as part of  OMS. Instead, CMS uses the number of beneficiaries who meet the OMS  criteria as an indicator of progress toward its goals. CMS estimated that  33,223 beneficiaries would have met its revised criteria based on 2015  data, which is a much smaller number than the estimated 727,016  beneficiaries at risk of harm from opioids. (See fig. 1.)

In 2016, CMS began to gather information from its patient safety  measures on the number of beneficiaries who use more than 120 mg  MED of opioids for 90 days or longer, regardless of the number of  providers and pharmacies. However, this information does not include all  at-risk beneficiaries, because the threshold is more lenient than indicated  in CDC guidelines and CMS’s new criteria for OMS. Specifically, CMS’s  one-time analysis of 2015 data indicated that 727,016 beneficiaries  received prescriptions with an average MED of 90 mg or more for any  length of time during a 6-month measurement period. In contrast, the  2016 patient safety measures reports identified significantly fewer  beneficiaries, 285,119, in its most comparable measure—member years  for opioid prescriptions at 120 mg MED for 90 consecutive days or longer.

According to CMS officials, CMS shared feedback with the Pharmacy  Quality Alliance to consider updating the threshold to 90 mg MED to align  with CDC guidelines and the revised OMS criteria. CMS officials said the  agency will consider adopting these updates once complete. In addition,  while CMS monitors the patient safety measure data, these data are  relatively new. CMS officials told us that, as a result, the agency does not  yet have enough data to report changes over time toward its goals to  reduce the risk of opioid use disorders, overdoses, and inappropriate  prescribing.

Neither the data gathered as part of OMS, nor patient safety measures  gathered so far are adequate to provide CMS with the information  necessary to track progress toward meeting its goal of reducing harm  from opioids. While tracking a smaller number of beneficiaries in OMS is  useful for targeting resource-intensive plan sponsor actions, keeping track  of the larger number of beneficiaries at risk of harm from high doses of  opioids—greater than 90 mg MED for any duration regardless of the  number of providers and pharmacies—could provide CMS with  information on progress toward its goals without additional monitoring by  plan sponsors. Doing so would also be consistent with federal internal  control standards, which require agencies to use quality information to  achieve objectives and address risks. Without tracking the number of  beneficiaries who receive potentially dangerous levels of opioids  regardless of the number of providers or pharmacies, and then examining  changes in that number over time, CMS lacks key information that would  be useful to determine if it is making progress toward reducing the risk of  opioid harm for Part D beneficiaries.

CMS Oversees Providers through its Contractor and Plan Sponsors, but Efforts Do Not Specifically Monitor Opioid Prescriptions CMS’s Contractor and Plan Sponsors Seek to Identify Inappropriate Prescribing of Drugs with High Potential for Abuse, Including Opioids NBI MEDIC’s Data Analyses to Identify Outlier Providers

CMS oversees providers who prescribe opioids to Medicare Part D  beneficiaries through its contractor, NBI MEDIC, and the Part D plan  sponsors.

CMS requires NBI MEDIC to identify providers who prescribe high  amounts of drugs classified as Schedule II under the Controlled  Substances Act, which indicates a high potential for abuse and includes  many opioids. Using prescription drug event data, NBI MEDIC conducts a  peer comparison of providers’ prescribing practices to identify outlier  providers—the highest prescribers of Schedule II drugs, which include,  but are not limited to, opioids. NBI MEDIC’s initial analyses focuses on  providers associated with at least 100 prescription drug event records or  at least $100,000 in total Part D payments for Schedule II drugs over the  course of one year. These providers are then classified as outliers if  they are listed as high in both the number of prescription drug records per  prescriber and prescriptions per beneficiary by specialty within each  state. NBI MEDIC reports to CMS on the providers with the highest  number of prescriptions identified by the analysis. Beginning with the  October 2016 report, CMS began sharing NBI MEDIC’s prescriber outlier report with the plan sponsors quarterly to supplement their own  investigations of potential fraud, waste, and abuse. According to data  from NBI MEDIC, the number of outlier providers identified has generally  remained stable except for an increase in 2015. NBI MEDIC and CMS  officials said this increase occurred when a commonly used opioid,  hydrocodone, was added to the analysis after it was reclassified as a  Schedule II drug.

NBI MEDIC gathers data on Medicare Part C and Part D and uses its  Predictive Learning Analytics Tracking Outcome (PLATO) system to  conduct a number of data analysis projects. According to NBI MEDIC  officials, these PLATO projects seek to identify potential fraud by  examining data on provider behaviors. In addition, according to officials,  PLATO is capable of allowing NBI MEDIC to share information on  providers with plan sponsors. NBI MEDIC officials stated there are two  current PLATO projects that include a focus on some opioids.

The TRIO data project identifies providers who prescribe  beneficiaries a combination of an opioid, a benzodiazepine, and the  muscle relaxant Carisoprodol. This well-known combination of drugs  is used to increase the effects of opioids.

The Pill Mill data project identifies providers with abnormal  prescribing behavior in authorizing controlled substances, including  opioids, absent medical necessity. To identify providers potentially  operating a pill mill, 17 risk factors are considered, including the  number of beneficiaries for whom a provider prescribed controlled  substances, the quantity of these medications, the number of  beneficiaries who travel long distances to receive medications, and  the number of beneficiaries treated for drug abuse or misuse at  emergency rooms.

Another analysis that NBI MEDIC conducts, according to its officials, is  the Transmucosal Immediate Release Fentanyl project, which identifies  potential improper payments for medicines containing fentanyl, a  prescription opioid pain reliever. NBI MEDIC looks for instances of this  drug being prescribed to beneficiaries who do not have cancer combined  with breakthrough pain, the only approved use for this drug.

NBI MEDIC’s Investigations to Identify Fraud, Waste, and Abuse

NBI MEDIC officials said they conduct investigations to assist CMS in  identifying cases of potential fraud, waste, and abuse among providers for  Medicare Part C and Part D. The investigations are prompted by  complaints from plan sponsors, calls to NBI MEDIC’s call center, NBI  MEDIC’s analysis of outlier providers, or from one of its other data  analysis projects. As part of its investigations, NBI MEDIC officials said  they may access data from Medicare Part B, which includes coverage for  doctors’ services and outpatient care, to determine whether providers’  diagnoses coincide with their prescriptions. Officials added that they  investigate inappropriate prescribing by reviewing Part D prescription  records, medical records, or PLATO data; or by conducting background  checks, interviewing beneficiaries, or conducting site visits, among other  activities. NBI MEDIC data indicates that the total number of its  investigations decreased from 2013 to 2016, which, according to NBI  MEDIC officials, occurred because it increased activities related to data  analysis and collaboration with plan sponsors.

After identifying providers engaged in potential fraudulent overprescribing,  NBI MEDIC officials said they may refer cases to agencies for further  investigation and potential prosecution, such as the HHS-OIG, state and  local law enforcement, the Federal Bureau of Investigations, or the Drug  Enforcement Administration. In 2016, NBI MEDIC data showed that it  referred a total of 119 cases to the HHS-OIG and 48 to agencies within  the Department of Justice, including the Federal Bureau of Investigations  and the Drug Enforcement Agency. CMS officials told us that they do not  routinely track the results of individual cases referred by NBI MEDIC to  other agencies. A 2016 Senate committee report indicated that the HHS- OIG declined and returned more than half of the cases referred to it from  2013 through 2015. According to NBI MEDIC officials, cases may be  rejected for reasons such as not meeting prosecutorial thresholds for  evidence, or HHS-OIG does not having enough staff to take on the  workload. NBI MEDIC officials told us that HHS-OIG does not always  inform NBI MEDIC of its reasons for declining the referrals.

CMS requires all plan sponsors to adopt and implement an effective  compliance program, which must include measures to prevent, detect,  and correct Part C or Part D program noncompliance, as well as fraud,  waste, and abuse. CMS communicates guidance for plan sponsor’s  compliance programs through Chapter 9 of CMS’s Prescription Drug  Benefit Manual and in annual letters. CMS’s guidance focuses broadly  on prescription drugs, and does not specifically address opioids.

To detect fraud, waste, and abuse among providers, plan sponsors told  us they use their own data analysis and criteria, as well as NBI MEDIC’s  list of outlier providers. For example, plan sponsors identify providers  suspected of fraud, waste, or abuse by looking for certain characteristics,  such as providers who have a large number of beneficiaries traveling  from a different zip code to receive prescriptions, or providers who  prescribe large quantities of commonly abused drugs with no associated  medical claims to support the prescriptions. Once the suspected  providers are identified, plan sponsors said that they conduct their own  investigations to determine if there is sufficient evidence of inappropriate  prescribing.

Plan sponsors told us they may choose to take a number of actions  based on these investigations, including choosing to refer the case to NBI  MEDIC. Additionally, if appropriate, plan sponsors can educate providers  about prescribing guidelines and best practices, or notify them that their  patients may be doctor shopping, in order to improve coordination of care.  They may also terminate a provider from their plan if they find evidence of  fraud or abuse.

CMS Lacks Information Necessary for Oversight of Opioid Prescribing and Plan Sponsors’ Monitoring Activities

CMS lacks the information necessary to adequately determine the  number providers potentially overprescribing opioids, and therefore  cannot determine the effectiveness of efforts to achieve the agency’s  goals of reducing the risk of opioid use disorders, overdoses,  inappropriate prescribing, and drug diversion. CMS’s oversight actions  focus broadly on Schedule II drugs rather than specifically on opioids. For  example, NBI MEDIC’s analyses to identify outlier providers do not  indicate the extent to which they may be overprescribing opioids  specifically. According to CMS officials, they direct NBI MEDIC to focus  on Schedule II drugs, because they have a high potential for abuse,  whether they are opioids or other drugs. However, without specifically  identifying opioids in these analyses—or an alternate source of data— CMS lacks data on providers who prescribe high amounts of opioids, and  therefore cannot assess progress toward meeting its goals related to  opioid use.

CMS also lacks key information necessary for oversight of opioid  prescribing, because it does not require plan sponsors to report to NBI  MEDIC or CMS cases of fraud, waste, and abuse; cases of  overprescribing; or any actions taken against providers. Plan sponsors  collect information on cases of fraud, waste, and abuse, and can choose  to report this information to NBI MEDIC or CMS. PLATO, a voluntary  reporting system, is one way that plan sponsors can report information to  NBI MEDIC or CMS, and share with other plan sponsors about providers  they investigate and about actions they take. While CMS receives some  information from plan sponsors who voluntarily report their actions, it does  not know the full extent to which plan sponsors have identified providers  who have prescribed high amounts of opioids and taken action to reduce  overprescribing. Without this information, CMS cannot determine the  extent to which plan sponsors are taking action to reduce overprescribing,  making it difficult to assess progress in this area. CMS officials told us  that they receive reports on what information plan sponsors enter into  PLATO. However, according to these officials, they do not have  information on all actions taken by plan sponsors; therefore, CMS does  not know how often plan sponsors use PLATO or what proportion of  actions they report.

A 2015 HHS-OIG report recommended that CMS require plan sponsors  to report all potential fraud and abuse to CMS and/or NBI MEDIC. CMS  disagreed with this recommendation, and stated that plan sponsors  currently have several options for referring incidents, that CMS has  worked with plan sponsors to improve organizational performance, and  that plan sponsors regularly share information on best practices for  prevention and detection of fraud. The HHS-OIG continues to recommend  that CMS require reporting due to the lack of a comprehensive set of data  needed to monitor providers’ inappropriate prescribing.

Without specifically monitoring providers’ overprescribing of opioids, CMS  cannot determine if its efforts, or the efforts of NBI MEDIC and plan  sponsors, are helping to contribute to its goals related to opioid use.  Federal internal control standards require agencies to conduct monitoring  activities and to use quality information to achieve objectives and address  risks. Without adequate information on providers’ opioid prescribing  patterns in Part D, CMS is unable to determine whether its related  oversight efforts—including such efforts by NBI MEDIC or Part D plan  sponsors—are effective or should be adjusted.

A large number of Medicare Part D beneficiaries use prescription opioids,  and reducing the inappropriate prescribing of these drugs is a key part of  CMS’s strategy to decrease the risk of opioid use disorder, overdoses,  and deaths. Despite working to identify and decrease egregious opioid  use behavior—such as doctor shopping—among beneficiaries in  Medicare Part D, CMS lacks the necessary information to effectively  determine the full number of beneficiaries at risk of opioid harm. CMS  recently expanded the number of beneficiaries for whom it expects plan  sponsors to conduct intervention efforts, such as case management, and  has begun to collect additional patient safety measure data on  beneficiaries at risk of harm from opioids. However, these efforts have not  yet provided CMS with sufficient data to track how many beneficiaries are  receiving large doses of opioids, and therefore are at risk of harm.  Without expanding and enhancing its data collection efforts to include  information on more at-risk beneficiaries, CMS cannot fully assess  whether it is making sufficient progress toward its goals of reducing opioid  use disorders, overdoses, inappropriate prescribing, and drug diversion.

CMS’s efforts to oversee opioid prescribing specifically are also  inadequate. CMS directs NBI MEDIC to focus its analyses on providers  who prescribe any drugs with a high risk of abuse, but NBI MEDIC does  not specifically track those providers who prescribe opioids. Absent  opioid-specific monitoring, CMS cannot assess whether its efforts to  reduce opioid overprescribing are effective, or if opioid prescribing  patterns are changing over time. In addition, neither CMS nor NBI MEDIC  can be sure they have complete information about providers potentially  overprescribing opioids to Part D beneficiaries, because plan sponsors  are not required to report to CMS or NBI MEDIC all potential fraud and  abuse incidents or actions sponsors have taken against providers. As a  result, CMS lacks information about plan sponsors’ monitoring of  providers who overprescribe opioids, and is therefore unable to determine  if the agency’s and plan sponsors’ efforts are successful in achieving  CMS’s goals.

We are making the following three recommendations to CMS.

The Administrator of CMS should gather information over time on the  number of beneficiaries at risk of harm from opioids, including those  who receive high opioid morphine equivalent doses regardless of the  number of pharmacies or providers, as part of assessing progress  over time in reaching the agency’s goals related to reducing opioid  use. (Recommendation 1)

The Administrator of CMS should require its contractor, NBI MEDIC,  to identify and conduct analyses on providers who prescribe high  amounts of opioids separately from providers who prescribe high  amounts of any Schedule II drug. (Recommendation 2)

The Administrator of CMS should require plan sponsors to report to  CMS on investigations and other actions taken related to providers  who prescribe high amounts of opioids. (Recommendation 3)

We provided a draft of this report to HHS for comment. HHS provided  written comments, which are reprinted in appendix I, and technical  comments, which we incorporated as appropriate. In its written  comments, HHS described its efforts to reduce opioid overutilization in  Medicare Part D. HHS noted that these efforts include a medication  safety approach to improve care coordination for high-risk beneficiaries  using opioids, quality metrics for plan sponsors, and data analysis of  prescribing patterns to target potential fraud, waste, and abuse. For  example, HHS noted that CMS adopted a Medicare Part D opioid  overutilization policy in 2013 that provided specific guidance to Part D  plans on effective drug utilization review programs to reduce  overutilization of opioids. As described in our report, CMS’s opioid  overutilization policy requires sponsors to implement retrospective drug  utilization review programs to identify beneficiaries who are potentially  overusing opioids. Among other things, sponsors may choose to  implement beneficiary-specific edits that limit high-risk beneficiaries to  certain opioids and amounts, and CMS expects them to use formulary- level edits to alert providers when their patients are receiving high levels  of opioids from other doctors.

HHS also concurred with two of our three recommendations.

HHS concurred with our recommendation that CMS gather  information over time on the number of beneficiaries at risk of harm  from opioids, as part of assessing progress toward agency goals.  HHS commented that CMS tracks beneficiaries who meet these  criteria through the patient safety measures. However, while these  patient safety measures are a potential source of this information,  they currently do not include all at-risk beneficiaries, because the  opioid use threshold they use (120 mg MED for 90 days or longer) is  more lenient than indicated in CDC guidelines or in CMS’s revised  OMS criteria. In addition, while CMS uses the patient safety measures  to assess plan sponsor performance, the data are relatively new, and  CMS has not yet used them to report progress over time toward its  goals.

HHS concurred with our recommendation that CMS require NBI  MEDIC to gather separate data on providers who prescribe high  amounts of opioids, and HHS noted that it intends to work with NBI  MEDIC to identify trends in outlier prescribers of opioids.

HHS did not concur with our recommendation that CMS require plan  sponsors to report on investigations and other actions taken related to  providers who prescribe high amounts of opioids. HHS noted that plan  sponsors have the responsibility to detect and prevent fraud, waste,  and abuse and that CMS reviews cases when it conducts audits. HHS  also stated that it seeks to balance requirements on plan sponsors  when considering new regulatory requirements. As noted in our  report, plan sponsors conduct investigations and take actions against  providers, and some plan sponsors report actions to CMS and NBI  MEDIC. However, without complete reporting, such as reporting from  all plan sponsors on the actions they take to reduce overprescribing,  CMS is missing key information that could help assess progress in  this area. Due to the importance of this information, we continue to  believe that CMS should require plan sponsors to report on the  actions they take.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of HHS and  the Administrator of CMS. In addition, the report will be available at no  charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-7114 or CurdaE@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix II.

Appendix I: Comments from the Department of Health and Human Services

Appendix II: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Will Simerl (Assistant Director),  Carolyn Feis Korman (Analyst-in-Charge), Amy Andresen, Samantha  Pawlak, and Patricia Roy made key contributions to this report. Also  contributing were Muriel Brown, Drew Long, and Emily Wilson.

More than 14 million people received opioid prescriptions in 2016 through the Medicare drug benefit program, Part D.

The Centers for Medicare & Medicaid Services delegate monitoring of these beneficiaries to the private organizations that implement the Medicare Part D benefit. These organizations follow CMS monitoring criteria.

While these criteria identify beneficiaries at the greatest risk of harm from opioid use, we found that it does not capture data on an even larger population of beneficiaries potentially at risk of harm from high doses of opioids. We recommended three actions to improve oversight.

On November 19, 2018, GAO posted an HTML version of this report.