Prescription Opioids: Medicare Needs Better Information to Reduce the Risk of Harm to Beneficiaries

Misuse of prescription opioids can lead to overdose and death. Medicare and Medicaid, two of the nation's largest health care programs, provide prescription drug coverage that can include opioids. GAO and others have reported on inappropriate activities and risks associated with these prescriptions.

This statement is based on GAO's October 2017 report (GAO-18-15) and discusses (1) CMS oversight of Medicare beneficiaries who receive opioid prescriptions under Part D, and (2) CMS oversight of providers who prescribe opioids to Medicare Part D beneficiaries. For the October 2017 report, GAO reviewed CMS opioid utilization and prescriber data, CMS guidance for plan sponsors, and CMS's strategy to prevent opioid misuse. GAO also interviewed CMS officials, the six largest Part D plan sponsors, and 12 national associations selected to represent insurance plans, pharmacy benefit managers, physicians, patients, and regulatory and law enforcement authorities.

In October 2017, GAO found that the Centers for Medicare & Medicaid Services (CMS) provided guidance on the monitoring of Medicare beneficiaries who received opioid prescriptions to plan sponsors—private organizations that implement the Medicare drug benefit, Part D—but it lacked information on most beneficiaries at risk of harm from opioid use. Specifically, GAO found that

CMS provided guidance to plan sponsors on how they should monitor opioid overutilization among Medicare Part D beneficiaries, and required them to implement drug utilization review systems that use criteria similar to CMS's. Prior to 2018, the agency's criteria focused on beneficiaries who did all the following: (1) received prescriptions of high doses of opioids, (2) received prescriptions from four or more providers, and (3) filled prescriptions at four or more pharmacies. According to CMS, this approach focused actions on beneficiaries the agency determined to have the highest risk of harm. For 2018, CMS revised the criteria to include more at-risk beneficiaries.

CMS's criteria, including recent revisions, did not provide sufficient information about the larger population of potentially at-risk beneficiaries. CMS estimated that, in 2015, 727,016 beneficiaries would have received high doses of opioids regardless of the number of providers or pharmacies, but only 33,223 would have met its revised criteria. In 2016, CMS began to collect information on some of these beneficiaries using a higher dosage threshold for opioid use. However, based on Centers for Disease Control and Prevention guidelines, CMS's approach also missed some who could be at risk of harm. As a result, CMS had limited information to assess progress against the goals of the Medicare and Medicaid programs' Opioid Misuse Strategy, which includes activities to reduce risk of harm to beneficiaries.

CMS provided oversight on prescribing of drugs at high risk of abuse through a variety of projects, but did not analyze data specifically on opioids. According to CMS officials, CMS and plan sponsors identified providers who prescribed large amounts of drugs with a high risk of abuse, and those suspected of fraud or abuse may be referred to law enforcement. However, GAO found that CMS did not identify providers who may be inappropriately prescribing large amounts of opioids separately from other drugs, and did not require plan sponsors to report actions they take when they identified such providers. As a result, CMS lacked information that it could use to assess how opioid prescribing patterns are changing over time, and whether its efforts to reduce harm are effective.

In the October 2017 report, GAO made three recommendations that CMS (1) gather information on the full number of at-risk beneficiaries receiving high doses of opioids, (2) identify providers who prescribe high amounts of opioids, and (3) require plan sponsors to report to CMS on actions related to providers who inappropriately prescribe opioids. HHS concurred with the first two recommendations, but not with the third. GAO continues to believe the recommendation is valid, as discussed in the report and in this statement.

I am pleased to be here to discuss our October 2017 report on oversight  of opioid prescribing in the Medicare program. Misuse of prescription  opioids, which are used to treat both acute and chronic pain, has become  a serious public health problem for the U.S. population, including  Medicare and Medicaid beneficiaries. The Centers for Disease Control  and Prevention (CDC), within the Department of Health and Human  Services (HHS), reported that from 1999 to 2013 the rate of drug  poisoning deaths from prescription opioids nearly quadrupled, and that in  2016, alone, there were more than 17,000 overdose deaths from  prescription opioids.

The Centers for Medicare and Medicaid Services (CMS), also within  HHS, administers Medicare and Medicaid, two of the nation’s largest  health care programs. Medicare is a federal health insurance program for  people age 65 and older, individuals under age 65 with certain disabilities,  and individuals diagnosed with end-stage renal disease. Within Medicare  is Part D, the program’s outpatient prescription drug benefit. Medicaid is  a joint federal-state program that finances health care coverage for  certain low-income and medically needy individuals. Due to concerns  about adequacy of oversight, both Medicare and Medicaid are on our list  of high-risk programs.

HHS’s Office of Inspector General (HHS-OIG) reported that 14.4 million  people (about one-third) who participated in Medicare Part D in 2016  received at least one prescription for opioids, and that Part D spending for  opioids in 2016 was almost $4.1 billion. We and the HHS-OIG have  previously reported on inappropriate activities that can be associated with  such prescriptions, including “doctor shopping” to receive multiple opioid  prescriptions from different providers; the diversion of prescription drugs  for uses other than what was intended; and questionable prescribing  practices by providers.

The Medicaid program also covers opioid prescriptions for its  beneficiaries. In our prior work, we have reported on potentially  inappropriate activities involving Medicaid’s prescription drug coverage. In  2017, for example, we reported on prescriptions for opioid pain  medication among Medicaid beneficiaries. In that report, we noted that  while opioid pain medication can constitute proper medical care for  beneficiaries suffering from painful conditions, the use of these  medications among Medicaid beneficiaries with diagnosed opioid abuse  or dependence raises concerns about potential inappropriate  prescribing. In addition, in a July 2015 report, we found indicators of  potential Medicaid prescription-drug fraud and abuse, such as doctor  shopping.

In March 2015, HHS announced plans to make addressing opioid abuse  a high priority through two broad goals: (1) decreasing opioid overdoses  and overall overdose deaths, and (2) decreasing the prevalence of opioid  use disorder. In 2016, CDC issued guidelines with recommendations for  prescribing opioids in outpatient settings for chronic pain. The guidelines  recommended that providers use caution when prescribing opioids at any  dose, carefully reassess evidence of individual benefits and risks when  increasing opioid dosage to 50 mg morphine-equivalent dose (MED) per  day or more, and avoid or carefully justify dosage at 90 mg MED or more.

CDC guidelines also noted that providers should use additional caution in  prescribing opioids to patients aged 65 and older, because the drugs can  accumulate in the body to toxic levels. Further, in January 2017, CMS  issued its Opioid Misuse Strategy for the Medicare and Medicaid  programs, including Medicare Part D. The strategy includes the  agency’s plans to address concerns about beneficiary use of opioids and  the prescribing of opioids by providers.

My remarks today discuss the findings and recommendations from our  2017 report on CMS efforts to oversee prescription opioids in Medicare.  Accordingly, this testimony focuses on how:  (1)  CMS oversees beneficiaries who receive opioid prescriptions  under Medicare Part D, and   (2)  CMS oversees providers who prescribe opioids to Medicare Part  D beneficiaries.

For our report, we reviewed CMS opioid utilization and prescriber data,  CMS guidance for plan sponsors—private organizations, such as health  insurance companies, contracted by CMS to provide outpatient drug  benefit plans to Medicare beneficiaries—and CMS’s strategy to prevent  opioid misuse. We also interviewed officials from CMS, the six largest  Part D plan sponsors, and 12 national associations selected to represent  insurance plans, pharmacy benefit managers, physicians, patients, and  regulatory and law enforcement agencies. More detailed information on  our objectives, scope, and methodology for that work can be found in the  issued report. We conducted the work on which this statement is based in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

CMS Delegated Monitoring of Beneficiaries who Receive Opioid Prescriptions to Plan Sponsors, but Did Not Have Sufficient Information on Those Most at Risk for Harm

CMS Delegated Monitoring of Individual Beneficiaries’ Opioid Prescriptions to Plan Sponsors

Our October 2017 report found that CMS provided guidance to Medicare  Part D plan sponsors on how they should monitor opioid overutilization  problems among Part D beneficiaries. The agency included this guidance  in its annual letters to plan sponsors, known as call letters; it also  provided a supplemental memo to plan sponsors in 2012. Among other  things, these guidance documents instructed plan sponsors to implement  a retrospective drug utilization review (DUR) system to monitor  beneficiary utilization starting in 2013. As part of the DUR systems,  CMS required plan sponsors to have methods to identify beneficiaries  who were potentially overusing specific drugs or groups of drugs,  including opioids.

Also in 2013, CMS created the Overutilization Monitoring System (OMS),  which outlined criteria to identify beneficiaries with high-risk use of  opioids, and to oversee sponsors’ compliance with CMS’s opioid  overutilization policy. Plan sponsors may use the OMS criteria for their  DUR systems, but they had some flexibility to develop their own targeting  criteria within CMS guidance. At the time of our review, the OMS  considered beneficiaries to be at a high risk of opioid overuse when they  met all three of the following criteria:  1.  received a total daily MED greater than 120 mg for 90 consecutive  2.  received opioid prescriptions from four or more health care providers  in the previous 12 months, and  3.  received opioids from four or more pharmacies in the previous 12  months.

The criteria excluded beneficiaries with a cancer diagnosis and those in  hospice care, for whom higher doses of opioids may be appropriate.

We found that through the OMS, CMS generated quarterly reports that list  beneficiaries who met all of the criteria and who were identified as high- risk, and then distributed the reports to the plan sponsors. Plan sponsors  were expected to review the list of identified beneficiaries, determine  appropriate action, and then respond to CMS with information on their  actions within 30 days. According to CMS officials, the agency also  expected plan sponsors to share any information with CMS on  beneficiaries that they identified through their own DUR systems. We  found that some actions plan sponsors may take included the following:

Case management. Case management may include an attempt to  improve coordination issues, and often involves provider outreach,  whereby the plan sponsor will contact the providers associated with  the beneficiary to let them know that the beneficiary is receiving high  levels of opioids and may be at risk of harm.

Beneficiary-specific point-of-sale (POS) edits. Beneficiary-specific  POS edits are restrictions that limit these beneficiaries to certain  opioids and amounts. Pharmacists receive a message when a  beneficiary attempts to fill a prescription that exceeds the limit in place  for that beneficiary.

Formulary-level POS edits. These edits alert providers who may not  have been aware that their patients are receiving high levels of  opioids from other doctors.

Referrals for investigation. According to the six plan sponsors we  interviewed, the referrals can be made to CMS’s National Benefit  Integrity Medicare Drug Integrity Contractor (NBI MEDIC), which was  responsible for identifying and investigating potential Part D fraud,  waste, and abuse, or to the plan sponsor’s own internal investigative  unit, if they have one. After investigating a particular case, they may  refer the case to the HHS-OIG or a law enforcement agency,  according to CMS, NBI MEDIC, and one plan sponsor.

Based on CMS’s use of the OMS and the actions taken by plan sponsors,  CMS reported a 61 percent decrease from calendar years 2011 through  2016 in the number of beneficiaries meeting the OMS criteria of high  risk—from 29,404 to 11,594 beneficiaries—which agency officials  considered an indication of success toward its goal of decreasing opioid  use disorder.

In addition, we found that CMS relied on separate patient safety  measures developed and maintained by the Pharmacy Quality Alliance to  assess how well Part D plan sponsors were monitoring beneficiaries and  taking appropriate actions. In 2016, CMS started tracking plan sponsors’  performance on three patient safety measures that were directly related  to opioids. The three measures were similar to the OMS criteria in that  they identified beneficiaries with high dosages of opioids (120 mg MED),  beneficiaries that use opioids from multiple providers and pharmacies,  and beneficiaries that do both. However, one difference between these  approaches was that the patient safety measures separately identified  beneficiaries who fulfill each criterion individually.

CMS Did Not Have Sufficient Information on Most Beneficiaries Potentially at Risk for Harm

Our October 2017 report also found that CMS tracked the total number of  beneficiaries who met all three OMS criteria as part of its opioid  overutilization oversight across the Part D program. However, the agency  did not have comparable information on most beneficiaries who receive  high doses of opioids—regardless of the number of providers and  pharmacies used—and who therefore may be at risk for harm, according  to CDC’s 2016 guidelines. These guidelines noted that long-term use of  high doses of opioids—those above a MED of 90 mg per day—are  associated with significant risk of harm and should be avoided if possible.

Based on the CDC guidelines, outreach to Part D plan sponsors, and  CMS analyses of Part D data, CMS has revised its current OMS criteria to  include more at-risk beneficiaries beginning in 2018. The new OMS  criteria define a high user as an individual having an average daily MED greater than 90 mg for any duration;  receiving opioids from four or more providers and four or more  pharmacies, or from six or more providers regardless of the  number of pharmacies, for the prior 6 months.

Based on 2015 data, CMS found that 33,223 beneficiaries would have  met these revised criteria. While the revised criteria would help identify  beneficiaries who CMS determined are at the highest risk of opioid  misuse and therefore may need case management by plan sponsors,  they did not provide information on the total number of Part D  beneficiaries who may be at risk of harm. In developing the revised  criteria, CMS conducted a one-time analysis that estimated there were  727,016 beneficiaries with an average MED of 90 mg or more, for any  length of time during a 6 month measurement period in 2015, regardless  of the number of providers or pharmacies used. According to the CDC  guidelines, these beneficiaries may be at risk of harm from opioids, and  therefore tracking the total number of these beneficiaries over time could  help CMS to determine whether it is making progress toward meeting the  goals specified in its Opioid Misuse Strategy to reduce the risk of opioid  use disorders, overdoses, inappropriate prescribing, and drug diversion.  However, CMS officials told us that the agency did not keep track of the  total number of these beneficiaries, and did not have plans to do so as  part of OMS. (See fig. 1.)

We also found that in 2016, CMS began to gather information from its  patient safety measures on the number of beneficiaries who use more  than 120 mg MED of opioids for 90 days or longer, regardless of the  number of providers and pharmacies. The patient safety measures  identified 285,119 such beneficiaries—counted as member-years—in  2016. However, this information did not include all at-risk beneficiaries,  because the threshold was more lenient than indicated in CDC guidelines  and CMS’s new OMS criteria. Because neither the OMS criteria nor the  patient safety measures included all beneficiaries potentially at risk of  harm from high opioid doses, we recommended that CMS should gather  information over time on the total number of beneficiaries who receive  high opioid morphine equivalent doses regardless of the number of  pharmacies or providers, as part of assessing progress over time in  reaching the agency’s goals related to reducing opioid use. HHS  concurred with our recommendation.

CMS Oversees Providers through its Contractor and Plan Sponsors, but Efforts Did Not Specifically Monitor Opioid Prescriptions

Our October 2017 report found that CMS oversees providers who  prescribe opioids to Medicare Part D beneficiaries through its contractor,  NBI MEDIC, and the Part D plan sponsors.

NBI MEDIC’s data analyses to identify outlier providers. CMS  required NBI MEDIC to identify providers who prescribe high amounts  of Schedule II drugs, which include but are not limited to opioids.  Using prescription drug data, NBI MEDIC conducted a peer  comparison of providers’ prescribing practices to identify outlier  providers—the highest prescribers of Schedule II drugs—and reported  the results to CMS.

NBI MEDIC’s other projects. NBI MEDIC gathered and analyzed  data on Medicare Part C and Part D, including projects using the  Predictive Learning Analytics Tracking Outcome (PLATO) system.  According to NBI MEDIC officials, these PLATO projects sought to  identify potential fraud by examining data on provider behaviors.

NBI MEDIC’s investigations to identify fraud, waste, and abuse.

NBI MEDIC officials conducted investigations to assist CMS in  identifying cases of potential fraud, waste, and abuse among  providers for Medicare Part C and Part D. The investigations were  prompted by complaints from plan sponsors; suspected fraud, waste,  or abuse reported to NBI MEDIC’s call center; NBI MEDIC’s analysis  of outlier providers; or from one of its other data analysis projects.

NBI MEDIC’s referrals. After identifying providers engaged in  potential fraudulent overprescribing, NBI MEDIC officials said they  may refer cases to law enforcement agencies or the HHS-OIG for  further investigation and potential prosecution.

Plan sponsors’ monitoring of providers. CMS required all plan  sponsors to adopt and implement an effective compliance program,  which must include measures to prevent, detect, and correct Part C or  Part D program noncompliance, as well as fraud, waste, and abuse.  CMS’s guidance focused broadly on prescription drugs, and did not  specifically address opioids.

Our report concluded that although these efforts provided valuable  information, CMS lacked information necessary to adequately oversee  opioid prescribing. CMS’s oversight actions focused broadly on Schedule  II drugs rather than specifically on opioids. For example, NBI MEDIC’s  analyses to identify outlier providers did not indicate the extent to which  they may be overprescribing opioids specifically. According to CMS  officials, they directed NBI MEDIC to focus on Schedule II drugs, because  these drugs have a high potential for abuse, whether they are opioids or  other drugs. However, without specifically identifying opioids in these  analyses—or an alternate source of data—CMS lacked data on providers  who prescribe high amounts of opioids, and therefore cannot assess  progress toward meeting its goals related to reducing opioid use, which  would be consistent with federal internal control standards. Federal  internal control standards require agencies to conduct monitoring  activities and to use quality information to achieve objectives and address  risks. As a result, we recommended that CMS require NBI MEDIC to  gather separate data on providers who prescribe high amounts of opioids.  This would allow CMS to better identify those providers who are  inappropriately and potentially fraudulently overprescribing opioids. HHS  agreed, and in April 2018 reported that it is working with NBI MEDIC to  separately identify outlier prescribers of opioids.

In addition, our 2017 report found that CMS also lacked key information  necessary for oversight of opioid prescribing, because it did not require  plan sponsors to report to NBI MEDIC or CMS cases of fraud, waste, and  abuse; cases of overprescribing; or any actions taken against providers.  Plan sponsors collected information on cases of fraud, waste, and abuse,  and could choose to report this information to NBI MEDIC or CMS. While  CMS receives information from plan sponsors who voluntarily reported  their actions, it did not know the full extent to which plan sponsors had  identified providers who prescribed high amounts of opioids, or the full  extent to which sponsors had taken action to reduce overprescribing. We  concluded that without this information, it was difficult for CMS to assess  progress in this area, which would be consistent with federal internal  control standards. In our report, we recommended that CMS require plan  sponsors to report on investigations and other actions taken related to  providers who prescribe high amounts of opioids. HHS did not concur  with this recommendation. HHS noted that plan sponsors have the  responsibility to detect and prevent fraud, waste, and abuse, and that  CMS reviews cases when it conducts audits. HHS also stated that it  seeks to balance requirements on plan sponsors when considering new  regulatory requirements. However, without complete reporting—such as  reporting from all plan sponsors on the actions they take to reduce  overprescribing—we believe that CMS is missing key information that  could help assess progress in this area. Due to the importance of this  information for achieving the agency’s goals, we continue to believe that  CMS should require plan sponsors to report on the actions they take to  reduce overprescribing.

In conclusion, a large number of Medicare Part D beneficiaries use  potentially harmful levels of prescription opioids, and reducing the  inappropriate prescribing of these drugs has been a key part of CMS’s  strategy to decrease the risk of opioid use disorder, overdoses, and  deaths. Despite working to identify and decrease egregious opioid use  behavior—such as doctor shopping—among Medicare Part D  beneficiaries, CMS lacked the necessary information to effectively  determine the full number of beneficiaries at risk of harm, as well as other  information that could help CMS assess whether its efforts to reduce  opioid overprescribing are effective. It is important that health care  providers help patients to receive appropriate pain treatment, including  opioids, based on the consideration of benefits and risks. Access to  information on the risks that Medicare patients face from inappropriate or  poorly monitored prescriptions, as well as information on providers who  may be inappropriately prescribing opioids, could help CMS as it works to  improve care.

Chairman Toomey, Ranking Member Stabenow, and Members of the  Subcommittee, this concludes my prepared statement. I would be  pleased to respond to any questions that you may have at this time.

If you or your staff members have any questions concerning this  testimony, please contact me at (202) 512-7114 or  DeniganMacauleyM@gao.gov. Contact points for our Office of  Congressional Relations and Public Affairs may be found on the last page  of this statement. Other individuals who made key contributions to this  testimony include Will Simerl (Assistant Director) and Carolyn Feis  Korman (Analyst-in-Charge). Also contributing were Amy Andresen,  George Bogart, Andrew Furillo, Drew Long, and Vikki Porter.

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.

What can Medicare do to help address the nation's opioid crisis?

We've previously found problems such as "doctor shopping" and questionable prescribing practices in Medicare's prescription drug benefits. 14.4 million people were prescribed at least one opioid through Medicare in 2016. While many opioids prescribed addressed legitimate need, others may have been overprescribed.

This testimony revisits our analysis of Medicare's efforts to reduce inappropriate opioid prescribing. We suggested ways to help Medicare collect information on doctor investigations and at-risk beneficiaries that could help it determine whether its efforts are working.