Medicare and Medicaid: CMS Needs to Fully Align Its Antifraud Efforts with the Fraud Risk Framework

CMS, an agency within the Department of Health and Human Services (HHS), provides health coverage for over 145 million Americans through its four principal programs, with annual outlays of about $1.1 trillion. GAO has designated the two largest programs, Medicare and Medicaid, as high risk partly due to their vulnerability to fraud, waste, and abuse. In fiscal year 2016, improper payment estimates for these programs totaled about $95 billion.

GAO's Fraud Risk Framework and the subsequent enactment of the Fraud Reduction and Data Analytics Act of 2015 have called attention to the importance of federal agencies' antifraud efforts. This report examines (1) CMS's approach for managing fraud risks across its four principal programs, and (2) how CMS's efforts managing fraud risks in Medicare and Medicaid align with the Fraud Risk Framework.

GAO reviewed laws and regulations and HHS and CMS documents, such as program-integrity manuals. It also interviewed CMS officials and a sample of CMS stakeholders, including state officials and contractors. GAO selected states based on fraud risk and other factors, such as geographic diversity. GAO selected contractors based on a mix of companies and geographic areas served.

The approach that the Centers for Medicare & Medicaid Services (CMS) has taken for managing fraud risks across its four principal programs—Medicare, Medicaid, the Children's Health Insurance Program (CHIP), and the health-insurance marketplaces—is incorporated into its broader program-integrity approach. According to CMS officials, this broader program-integrity approach can help the agency develop control activities to address multiple sources of improper payments, including fraud. As the figure below shows, CMS views fraud as part of a spectrum of actions that may result in improper payments.

CMS's efforts managing fraud risks in Medicare and Medicaid partially align with GAO's 2015 A Framework for Managing Fraud Risks in Federal Programs (Fraud Risk Framework). This framework describes leading practices in four components: commit , assess , design and implement , and evaluate and adapt . CMS has shown commitment to combating fraud in part by establishing a dedicated entity—the Center for Program Integrity—to lead antifraud efforts. Furthermore, CMS is offering and requiring antifraud training for stakeholder groups such as providers, beneficiaries, and health-insurance plans. However, CMS does not require fraud-awareness training on a regular basis for employees, a practice that the framework identifies as a way agencies can help create a culture of integrity and compliance. Regarding the assess and design and implement components, CMS has taken steps to identify fraud risks, such as by designating specific provider types as high risk and developing associated control activities. However, it has not conducted a fraud risk assessment for Medicare or Medicaid, and has not designed and implemented a risk-based antifraud strategy. A fraud risk assessment allows managers to fully consider fraud risks to their programs, analyze their likelihood and impact, and prioritize risks. Managers can then design and implement a strategy with specific control activities to mitigate these fraud risks, as well as an appropriate evaluation approach consistent with the evaluate and adapt component. By developing a fraud risk assessment and using that assessment to create an antifraud strategy and evaluation approach, CMS could better ensure that it is addressing the full portfolio of risks and strategically targeting the most-significant fraud risks facing Medicare and Medicaid.

GAO recommends that CMS (1) provide and require fraud-awareness training to its employees, (2) conduct fraud risk assessments, and (3) create an antifraud strategy for Medicare and Medicaid, including an approach for evaluation. HHS concurred with GAO's recommendations.

The Centers for Medicare & Medicaid Services (CMS)—an agency within  the Department of Health and Human Services (HHS)—provides health  coverage for over 145 million Americans, but its programs are susceptible  to fraud. Instances of fraud in CMS programs have been regularly and  widely reported, involving multimillion-dollar scams and false claims. For  example, in 2015 a Michigan oncologist was sentenced for submitting $34  million in fraudulent claims to Medicare and private insurance companies  for administering medically unnecessary chemotherapy to 553 patients.  Every year, the federal government investigates hundreds of fraud cases  involving CMS programs and during fiscal year 2016 won or negotiated  about $2.5 billion in health-care fraud judgments and settlements as a  result of federal investigations and prosecutions.

According to the Congressional Budget Office (CBO), annual mandatory  outlays for CMS’s four principal programs—Medicare, Medicaid, the  Children’s Health Insurance Program (CHIP), and the health-insurance  marketplaces—total about $1.1 trillion. Total outlays across these CMS  programs are projected to nearly double in the next 10 years. Medicare  and Medicaid are the largest CMS programs, covering approximately 129  million individuals in fiscal year 2016, with total outlays of about $1 trillion.

In addition to their size and related expenditures, the complexities of  these programs—such as Medicare’s four distinct program parts and the  variation in states’ design and implementation of Medicaid—pose  challenges to CMS oversight and present opportunities to be exploited for  fraud. We have designated Medicare and Medicaid as high-risk  programs due to their size, complexity, and vulnerability to fraud, waste, and abuse. Although the extent of fraud in Medicare and Medicaid is  unknown, given the large size of the programs even a small percentage  of fraud poses significant risks to the integrity of these programs.

This report addresses CMS fraud risk management efforts in light of  GAO’s July 2015 A Framework for Managing Fraud Risks in Federal  Programs (Fraud Risk Framework), which describes key components and  leading practices for agencies to proactively and strategically manage  fraud risks. Our objectives were to determine: (1) CMS’s approach for  managing fraud risks across its four principal programs and (2) how  CMS’s efforts for managing fraud risks in Medicare and Medicaid align  with GAO’s Fraud Risk Framework. We performed our work under the  authority of the Comptroller General to assist Congress with its oversight.

To address both objectives, we reviewed relevant laws, regulations, and  HHS and CMS documents, such as strategic plans, reports to Congress,  program-integrity manuals, guidance, and other documents issued from  2011 through 2017. We also reviewed reports by GAO and the HHS  Office of the Inspector General (OIG) on antifraud and program-integrity  topics across Medicare and Medicaid.

Furthermore, for both objectives, we interviewed CMS officials from the  Center for Program Integrity (CPI) as well as officials from other centers  and offices within CMS. We interviewed a nongeneralizable sample of  CMS stakeholders including states, contractors, private health-insurance  plans, federal law-enforcement agencies, as well as industry experts.

For our sample of stakeholders, we selected four states—Florida,  Maryland, Michigan, and Oregon—based on health-care fraud risk  factors. We selected two states (Florida and Michigan) meeting our high- risk criteria: the presence of Medicare Fraud Strike Force Teams, temporary moratoriums on certain newly enrolling providers and suppliers  in specific geographic areas, and a high number of Medicaid fraud  investigations. We also selected two states (Maryland and Oregon) that  did not meet our high-risk criteria. These four states also represented a  mix of Medicaid spending, enrollment in managed care, and geographic  variation. For each state, we interviewed state officials from the Medicaid  program-integrity unit, Medicaid Fraud Control Unit (MFCU), and state  audit organization.

In addition to the states, we interviewed national and regional CMS  contractors. We interviewed all national contractors that we identified as  most directly involved in CMS’s antifraud and program-integrity efforts;  there were six such contractors. We also interviewed six regional CMS  contractors. We identified six types of regional CMS antifraud and  program-integrity contractors, and interviewed one of each type. We  selected these contractors to achieve a mix of companies holding each  type of regional contract (some companies hold more than one type of  contract), and to ensure geographic diversity of the areas they serve. We  also interviewed officials from one national and one regional private  health-insurance plan. We chose these two plans because they are  among larger plans that provide Medicare, Medicaid, and commercial  services. We chose one large regional and one national health-insurance  plan to obtain a diversity of perspectives.

In addressing our second objective, we evaluated CMS’s efforts against  the four components of the Fraud Risk Framework: (1) commit to  combating fraud by creating an organizational culture and structure  conducive to fraud risk management; (2) plan regular fraud risk  assessments and assess risks to determine a fraud risk profile; (3) design  and implement strategy with specific control activities to mitigate  assessed fraud risks and collaborate to help ensure effective  implementation; and (4) evaluate outcomes using a risk-based approach  and adapt activities to improve fraud risk management. In doing so, we  reviewed agency documents and information obtained from interviews  that enabled us to compare CMS’s antifraud efforts against each of these  components. We did not evaluate the effectiveness of individual CMS  fraud control activities and other antifraud efforts we describe in the  report.

We conducted this performance audit from May 2016 to December 2017  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

CMS has four principal programs: Medicare, Medicaid, CHIP, and the  health-insurance marketplaces. See table 1 for information about the four  programs.

As discussed earlier, Medicare and Medicaid are CMS’s largest programs  and have been growing steadily (see fig. 1). CBO projects that, in 2026,  under current law, Medicare spending will reach $1.3 trillion. Medicaid is  also expected to continue to grow—program spending is projected to  increase 66 percent to over $950 billion by fiscal year 2025, and more  than half of the states have chosen to expand their Medicaid programs by  covering certain low-income adults not historically eligible for Medicaid  coverage, as authorized under the Patient Protection and Affordable Care  Act of 2010 (PPACA).

The two programs’ use of managed-care delivery systems to provide care  has also increased. For example, the number and percentage of Medicare beneficiaries enrolled in Medicare Part C has grown steadily  over the past several years, increasing from 8.7 million (20 percent of all  Medicare beneficiaries) in calendar year 2007 to 17.5 million (32 percent  of all Medicare beneficiaries) in calendar year 2015. As of July 1, 2015,  nearly two-thirds of all Medicaid beneficiaries were enrolled in managed- care plans and about 40 percent of expenditures in fiscal year 2015 were  for health-care services delivered through managed care.

CMS Funding to Address Fraud, Waste, and Abuse

CMS receives appropriations to carry out antifraud activities through  several funds including the Health Care Fraud and Abuse Control  (HCFAC) program and the Medicaid Integrity Program. The HCFAC  program was established under the Health Insurance Portability and  Accountability Act of 1996 to coordinate federal, state, and local law- enforcement efforts to address health-care fraud and abuse and to  conduct investigations and audits, among other things. In fiscal year  2016, CMS received $560 million through the HCFAC program  appropriations. The Medicaid Integrity Program, established by the Deficit  Reduction Act of 2005, supports contracts to audit and identify  overpayments in Medicaid claims, and provides technical assistance for  states’ program-integrity efforts. According to CMS, it received $75  million every year since fiscal year 2009 through the Medicaid Integrity  Program appropriations. According to CMS, in fiscal year 2016, total  program-integrity obligations to address fraud, waste, and abuse for  Medicare and Medicaid were $1.45 billion.

Fraud Vulnerabilities and Improper Payments in Medicare and Medicaid

As mentioned previously, we designated Medicare and Medicaid as high- risk programs starting in 1990 and 2003, respectively, because their size,  scope, and complexity make them vulnerable to fraud, waste, and  abuse. Similarly, the Office of Management and Budget (OMB)  designated all parts of Medicare as well as Medicaid “high-priority”  programs because these programs report $750 million or more in  estimated improper payments in a given year. We also highlighted  challenges associated with improper payments in Medicare and Medicaid  in our annual report on duplication and opportunities for cost savings in  federal programs.

Improper payments are a significant risk to the Medicare and Medicaid  programs and can include payments made as a result of fraud. Improper  payments are payments that are either made in an incorrect amount  (overpayments and underpayments) or those that should not be made at  all. For example, CMS estimated in fiscal year 2016 that the Medicare  fee-for-service (FFS) improper payment rate was 11 percent  (approximately $41 billion) and the Medicaid improper payment rate was  10.5 percent (approximately $36 billion). Improper payment  measurement does not specifically identify or estimate improper  payments due to fraud.

Types of Health-Care Fraud and Fraud Risk

Health-care fraud can take many forms, and a single case can involve  more than one scheme. Schemes may include fraudulent billing for  services not provided, services provided that were not medically necessary, and services intentionally billed at a higher level than  appropriate. These fraud schemes may include compensating providers,  beneficiaries, or others for participating in the fraud scheme. Fraud can  be regionally focused or can target particular service areas such as  home-health services, or durable medical equipment such as  wheelchairs. Fraud may also have nonfinancial effects. For example,  patients may be subjected to harmful or unnecessary services by  fraudulent providers. Fraud can be perpetrated by different actors, such  as providers, beneficiaries, health-insurance plans, as well as organized  crime.

Fraud and “fraud risk” are distinct concepts. Fraud is challenging to detect  because of its deceptive nature. Additionally, once suspected fraud is  identified, alleged fraud cases may be prosecuted. If the court determines  that fraud took place, then fraudulent spending may be recovered. Fraud  risk exists when individuals have an opportunity to engage in fraudulent  activity, have an incentive or are under pressure to commit fraud, or are  able to rationalize committing fraud. When fraud risks can be identified  and mitigated, fraud may be less likely to occur.

Although the occurrence of one or more cases of health-care fraud  indicates there is a fraud risk, a fraud risk can exist even if fraud has not  yet been identified or occurred. Suspicious billing patterns, certain types  of health-care providers, or complexities in program design may indicate  a risk of fraud. Information to help identify potential fraud risks may come  from various sources, including whistleblowers, agency officials,  contractors, law-enforcement agencies, beneficiaries, or providers.

Fraud Risk Management Standards and Guidance

According to federal standards and guidance, executive-branch agency  managers are responsible for managing fraud risks and implementing  practices for combating those risks. Federal internal control standards call  for agency management officials to assess the internal and external risks  their entities face as they seek to achieve their objectives. The standards  state that as part of this overall assessment, management should  consider the potential for fraud when identifying, analyzing, and  responding to risks. Risk management is a formal and disciplined  practice for addressing risk and reducing it to an acceptable level.

In July 2015, GAO issued the Fraud Risk Framework, which provides a  comprehensive set of key components and leading practices that serve  as a guide for agency managers to use when developing efforts to  combat fraud in a strategic, risk-based way. The Fraud Risk Framework  describes leading practices in four components: commit, assess, design  and implement, and evaluate and adapt, as depicted in figure 2.

The Fraud Reduction and Data Analytics Act of 2015, enacted in June  2016, requires OMB to establish guidelines for federal agencies to create  controls to identify and assess fraud risks and design and implement  antifraud control activities. The act further requires OMB to incorporate  the leading practices from the Fraud Risk Framework in the guidelines. In  July 2016, OMB published guidance about enterprise risk management  and internal controls in federal executive departments and agencies.  Among other things, this guidance affirms that managers should adhere  to the leading practices identified in the Fraud Risk Framework. Further,  the act requires federal agencies to submit to Congress a progress report  each year for 3 consecutive years on the implementation of the controls  established under OMB guidelines, among other things.

CMS Manages Fraud Risks as Part of Its Agency-Wide Program-Integrity Activities and through an Extensive Network of Stakeholders

Fraud Risk Management Is a Part of CMS’s Broader Program-Integrity Approach

CMS’s antifraud efforts for its four principal programs are part of the  agency’s broader program-integrity approach to address fraud, waste,  and abuse. CMS’s Center for Program Integrity (CPI) is the agency’s  focal point for program integrity across the programs. According to CMS,  its approach to program-integrity allows it to “address the whole spectrum  of fraud, waste, and abuse.” For example, CMS describes its program- integrity activities as addressing unintentional errors resulting from  providers being unaware of recent policy changes on one end of the  spectrum, through somewhat more-serious patterns of abuse such as  billing for a more-expensive service than was performed (known as  upcoding), and finally up to serious fraudulent activities, such as billing for  services that were not provided. CMS then aims to target its corrective  actions to fit the risk. See figure 3 for CMS’s description of the spectrum  of fraud, waste, and abuse that its program-integrity activities aim to  address.

Within its program-integrity activities, CMS has established several  control activities that are specific to managing fraud risks, while others  serve broader program-integrity purposes. According to CMS officials,  the agency’s antifraud control activities mainly focus on providers in  Medicare FFS. Officials told us that when CPI began operating, its  primary focus was developing program integrity for Medicare FFS and, as  a result, it is the most “mature” of all of CPI’s programs. CMS’s specific  fraud control activities include, for example, the Fraud Prevention System  (FPS), a predictive-analytics system that helps identify potentially  fraudulent payments in Medicare FFS, and the Unified Program Integrity  Contractors (UPIC), which detect and investigate aberrant provider  behavior and potential fraud in Medicare and Medicaid. Other control  activities serve broader program-integrity purposes such as to reduce  improper payments resulting from error, waste, and abuse in addition to preventing or detecting potential fraud. For example, CMS provides  education and outreach to Medicare providers and beneficiaries on issues  identified through data analyses in order to reduce improper payments  and to increase their awareness of fraud.

HHS and CMS department- and agency-wide strategic plans guide  CMS’s program-integrity activities—including antifraud activities. The  program-integrity goals identified in the HHS strategic plan primarily focus  on improper payments and are driven by statutory requirements. For  example, the HHS strategic plan for fiscal years 2014–2018 includes  performance goals of reducing the percentage of improper payments  made under Medicare FFS and Medicare Parts C and D. One antifraud- focused goal in the HHS strategic plan is to increase the percentage of  Medicare providers and suppliers identified as high risk that receive  administrative actions, such as suspending payments to providers or  revoking providers’ billing privileges.

HHS and CMS department- and agency-wide strategic plans also include  an emphasis on fraud prevention and early detection—a leading practice  in the Fraud Risk Framework—and moving away from a “pay-and-chase”  model. For example, the HHS strategic plan calls for “fostering early  detection and prevention of improper payments by focusing on preventing  bad actors from enrolling or remaining in Medicare and Medicaid” and to  “use public-private partnerships to prevent and detect fraud across the  health care industry by sharing fraud-related information and data  between the public and private sectors.” As a part of this emphasis on  prevention, CMS developed FPS in response to the Small Business Jobs  Act of 2010, which required CMS to implement predictive-analytics  technologies. Also, the Patient Protection and Affordable Care Act of  2010 (PPACA) included provisions to strengthen Medicare and  Medicaid’s provider enrollment standards and procedures, among other  program-integrity provisions.

CMS Uses an Extensive Network of Stakeholders to Manage Fraud Risks and Plays Varying Roles in These Relationships

CMS works with an extensive and complex network of stakeholders to  manage fraud risks in its four principal programs. In Medicaid and CHIP,  CMS partners with and oversees the 50 states and the District of  Columbia. Until the Deficit Reduction Act of 2005 expanded CMS’s role in  Medicaid program integrity to provide effective federal support and  assistance to states’ efforts to combat fraud, waste, and abuse, states  were primarily responsible for Medicaid program integrity. Each state  has its own Medicaid program-integrity unit, Medicaid Fraud Control Unit  (MFCU), and state audit organization.

CMS also uses numerous contractors to conduct the majority of its  program-integrity activities. Since the enactment of Medicare in 1965,  contractors have played an integral role in the administration of the  program. The original Medicare program was designed so that the federal  government contracted with health insurers or similar organizations  experienced in handling physician and hospital claims to pay Medicare  claims. Later, the Health Insurance Portability and Accountability Act of  1996 required the Secretary of Health and Human Services to enter into  contracts to promote the integrity of the Medicare program. According to  CMS officials, in fiscal year 2016 contractors received 92 percent of  CMS’s program-integrity funding. Medicare and Medicaid program- integrity contractors play a variety of roles: (1) processing and reviewing  claims, (2) conducting site visits of providers enrolling in Medicare, (3)  auditing claims and recovering overpayments, (4) performing data  analysis, and (5) investigating aberrant claims and provider behaviors,  among other things. States also use contractors in many of these roles for  managing program integrity.

Additionally, multiple private health-insurance plans in Medicare Parts C  and D and over 200 health-insurance plans in Medicaid managed care  also carry out program-integrity activities. For the health-insurance  marketplaces, CMS is responsible for operating the federally facilitated  marketplace and overseeing the state-based marketplaces. CMS also  developed the Federal Data Services Hub, which acts as a portal for  exchanging information between state-based marketplaces, the federally  facilitated marketplace, and state Medicaid agencies, among other  entities, as well as other external partners, including other federal  agencies, such as the Internal Revenue Service. Finally, law- enforcement groups, including the joint Department of Justice (DOJ) and  HHS OIG Medicare Fraud Strike Force Teams, identify, investigate, and  prosecute instances of fraud in CMS programs. See figure 4 for a  depiction of CMS’s stakeholder network for managing fraud risks. This  figure illustrates approximate numbers of stakeholders (through the  concentration of dots), but not the extent of individual stakeholder roles.

CMS provides oversight to, or partners with, these stakeholders to  manage fraud risks. For oversight, CMS creates policies and guidance to  direct stakeholders’ antifraud efforts, such as Medicare and Medicaid  program-integrity manuals and the Medicaid Provider Enrollment  Compendium. CMS also provides technical assistance to states in  areas such as provider enrollment and data analysis. In areas where  CMS does not have a primary role, it acts as a partner by collaborating  and coordinating program-integrity and antifraud activities. For example,  CMS is directly responsible for Medicare program integrity, but, in  Medicaid and CHIP, states are the first line of program-integrity efforts.  Similarly, CMS maintains control over Medicare FFS program integrity,  but within Medicare managed care, it provides guidance for health- insurance plans to carry out their own program-integrity activities.

In the health-insurance marketplaces, CMS reviews state-based  marketplaces’ procedures for verifying applicant eligibility for coverage.  For example, it conducts annual reviews of the state-based marketplaces,  which include a review of states’ fraud, waste, and abuse policies.

See figure 5 for a further description of CMS’s and various stakeholders’  roles and responsibilities in fraud risk management.

CMS also facilitates collaboration among federal, state, and private  entities for managing fraud risks. In 2012, CMS created the Healthcare  Fraud Prevention Partnership (HFPP) to share information with public and  private stakeholders and to conduct studies related to health-care fraud,  waste, and abuse. According to CMS, as of October 2017, the HFPP  included 89 public and private partners, including Medicare- and  Medicaid-related federal and state agencies, law-enforcement agencies,  private health-insurance plans (payers), and antifraud and other health- care organizations. The HFPP has conducted studies that pool and  analyze multiple payers’ claims data to identify providers with patterns of  suspect billing across payers. In a recent report, participants separately  told us that the HFPP’s studies helped them to identify and take action  against potentially fraudulent providers and payment vulnerabilities of  which they might not otherwise have been aware, and fostered both  formal and informal information sharing.

CMS’s relationships with stakeholders were varied in terms of maturity  and extent of information sharing, according to stakeholders we  interviewed. While some relationships between CMS and stakeholders  have been long-standing, some are developing, and others exist on an ad  hoc basis. For example, CMS has had a long-standing relationship with  state Medicaid program-integrity units, by collaborating through monthly  meetings of the Medicaid Fraud and Abuse Technical Advisory Group,  sending fraud alerts, and offering courses through the Medicaid Integrity  Institute. However, in our interviews with state program-integrity units,  and as we recently reported, some state Medicaid agencies shared  concerns about the communication, level of policy guidance, and  technical support provided by and received from CMS for managing fraud  risks in Medicaid. This concern was echoed by state audit officials, with  whom CMS recently initiated coordination to build relationships that would  facilitate state auditing of Medicaid programs.

CMS also has varying relationships with its law-enforcement partners. For  example, the relationship between CMS and DOJ’s Health Care Fraud  unit, which leads the DOJ and HHS OIG Medicare Fraud Strike Force  Teams, has been ad hoc. According to CMS and DOJ officials, the  interactions between the agencies have been based on specific fraud  cases such as coordination of national takedowns when DOJ provided  CMS with the names of providers committing fraud so that CMS could  suspend them consistently with the timing of the enforcement efforts.  According to CMS officials, they coordinate more with HHS OIG, working  together on payment suspensions and revocations for OIG cases, or  working with it to take administrative actions against large providers.

CMS’s Efforts Managing Fraud Risks in Medicare and Medicaid Are Partially Aligned with the Fraud Risk Framework

CMS’s antifraud efforts partially align with the Fraud Risk Framework.  Consistent with the framework, CMS has demonstrated commitment to  combating fraud by creating a dedicated entity to lead antifraud efforts. It  has also taken steps to establish a culture conducive to fraud risk  management, although it could expand its antifraud training to include all  employees. CMS has taken some steps to identify fraud risks in Medicare  and Medicaid; however, it has not conducted a fraud risk assessment or  developed a risk-based antifraud strategy for Medicare and Medicaid as  defined in the Fraud Risk Framework. CMS has established monitoring  and evaluation mechanisms for its program-integrity control activities that,  if aligned with a risk-based antifraud strategy, could enhance the  effectiveness of fraud risk management in Medicare and Medicaid.

CMS Has Shown Commitment to Combating Fraud by Creating an Organizational Structure and Taking Steps to Establish a Culture Conducive to Fraud Risk Management CMS’s Organizational Structure Includes a Dedicated Entity for Program-Integrity and Antifraud Efforts

The commit component of the Fraud Risk Framework calls for an agency  to commit to combating fraud by creating an organizational culture and  structure conducive to fraud risk management. This component includes  establishing a dedicated entity to lead fraud risk management activities.

Within CMS, the Center for Program Integrity (CPI) serves as the  dedicated entity for fraud, waste, and abuse issues in Medicare and  Medicaid, which is consistent with the Fraud Risk Framework. CPI was  established in 2010, in response to a November 2009 Executive Order on  reducing improper payments and eliminating waste in federal programs.  This formalized role, according to CMS officials, elevated the status of  program-integrity efforts, which previously were carried out by other parts  of CMS.

As an executive-level Center—on the same level with five other  executive-level Centers at CMS, such as the Center for Medicare and the  Center for Medicaid and CHIP Services—CPI has a direct reporting line  to executive-level management at CMS. The Fraud Risk Framework  identifies a direct reporting line to senior-level managers within the  agency as a leading practice. According to CMS officials, this elevated  organizational status offers CPI heightened visibility across CMS,  attention by CMS executive leadership, and involvement in executive- level conversations.

Additionally, in 2014, CMS established a Program Integrity Board that has  brought together senior officials across CMS Centers on a monthly basis  to coordinate on fraud and program-integrity vulnerabilities. According to  CPI officials, the board is one of the mechanisms through which CPI  engages other executive-level offices at CMS. CPI chairs the meetings  and typically develops meeting agendas to solicit information from and  disseminate information to other CMS units or stakeholders. Further, the  board may establish small working groups, known as integrated project  teams, to address specific vulnerabilities. For example, according to CMS  officials, in 2016 the board established a Marketplace integrated project  team to resolve potential fraud eligibility and enrollment issues in the  federally facilitated marketplace using the Fraud Risk Framework.

CPI has further demonstrated commitment to addressing fraud, waste,  and abuse through several organizational changes with the goal of  improving coordination and communication of program-integrity activities  across Medicare and Medicaid. Most recently, in 2014, CPI reorganized  its structure to align functional areas across Medicare and Medicaid,  where possible. Previously, separate units within CPI administered their  own program-integrity activities for Medicare and Medicaid programs. For  example, CPI established a Provider Enrollment and Oversight Group,  responsible for provider screening and enrollment functions in both  Medicare and Medicaid. According to CMS officials, if CPI employees  identify an issue in provider enrollment in Medicare, the same CPI  employees also consider how this issue applies to Medicaid. According to  CMS officials, the reorganization has helped CPI to look at vulnerabilities  in a crosscutting way and to facilitate communication across programs.

Similarly, since 2016, CPI began shifting contracting functions from  separate Medicare and Medicaid regional contractors that identify and  investigate cases of potential fraud and conduct audits to five regional  UPICs responsible for a range of program-integrity and fraud-specific  activities in both Medicare FFS and Medicaid. According to CMS, the  purpose of the UPICs is to coordinate provider investigations across  Medicare and Medicaid, improve collaboration with states by providing a  mutually beneficial service, and increase contractor accountability through  coordinated oversight. CMS officials told us that UPIC integration is a  cornerstone of CMS’s contract management strategy and would help to  ensure communication and coordination across Medicare and Medicaid  program-integrity efforts. CMS plans to award all the UPIC contracts by  the end of 2017, ultimately phasing out the ZPICs and Medicaid Integrity  Contractors.

CMS Has Taken Steps to Create a Culture Conducive to Fraud Risk Management but Could Enhance Antifraud Training for Employees

The commit component of the Fraud Risk Framework also includes  creating an organizational culture to combat fraud at all levels of the  agency.

Consistent with the Fraud Risk Framework, CMS has promoted an  antifraud culture by demonstrating a senior-level commitment to  combating fraud through public statements, increased resource levels,  and internal and external coordination.

In addition to HHS and CMS strategic documents discussed earlier, CMS  and CPI leaders have testified publicly about CMS’s commitment to  preventing fraud and protecting taxpayers and beneficiaries. For example,  CPI’s former Director testified in May 2016 before the House Committee  on Energy and Commerce’s Subcommittee on Oversight and  Investigations that “CMS is deeply committed to our efforts to prevent  waste, fraud and abuse in Medicare and Medicaid programs, protecting  both taxpayers and the beneficiaries that we serve.” More recently,  CMS’s new Administrator testified in her February 2017 confirmation  hearing regarding her intent to prioritize efforts around preventing fraud  and abuse.

CPI’s budget and resources have increased over time to support its  ongoing program-integrity mission. According to CMS, program-integrity  obligations for Medicare and Medicaid increased from about $1.02 billion  in fiscal year 2010 to $1.45 billion in fiscal year 2016. According to CMS  officials, the Health Care Fraud and Abuse Control (HCFAC) account,  one of the primary sources of CPI funding, has never received a funding  reduction. Additionally, in 2015, CPI received additional funding based on  a discretionary cap adjustment to HCFAC. Similarly, CPI staff resources have increased over time. According to CMS, CPI’s full-time equivalent  positions increased from 177 in 2011 to 419 in 2017.

Consistent with leading practices in the Fraud Risk Framework to involve  all levels of the agency in setting an antifraud tone, CPI has also worked  collaboratively with other CMS Centers. In addition to engaging  executive-level officials of other CMS Centers through the Program  Integrity Board, CPI has worked collaboratively with other Centers within  CMS to incorporate antifraud features into new program design or policy  development and established regular communication at the staff level.  For example:

Center for Medicare and Medicaid Innovation (CMMI). When  developing the Medicare Diabetes Prevention Program, CMMI  officials told us they worked with CPI’s Provider Enrollment and  Oversight Group and Governance Management Group to develop  risk-based screening procedures for entities that would enroll in  Medicare to provide diabetes-prevention services, among other  activities. The program was expanded nationally in 2016, and CMS  determined that an entity may enroll in Medicare as a program  supplier if it satisfies enrollment requirements, including that the  supplier must pass existing high categorical risk-level screening  requirements.

Center for Medicaid and CHIP Services (CMCS). CMCS officials told  us they worked closely with CPI to issue Medicaid guidance and best  practices to states on home and community-based services that  incorporate program-integrity provisions. A senior CMCS official told  us that, to address fraud, CMS has requested that states include  provider information on claims to determine whether providers are  meeting eligibility criteria.

Center for Medicare (CM). In addition to building safeguards into  programs and developing policies, CM officials told us that there are  several standing meetings, on monthly, biweekly, and weekly bases,  between groups within CM and CPI that discuss issues related to  provider enrollment, FFS operations, and contractor management. A  senior CM official also told us that there are ad hoc meetings taking  place between CM and CPI: “We interact multiple times daily at  different levels of the organization. Working closely is just a regular  part of our business.”

CMS has also demonstrated its commitment to addressing fraud, waste,  and abuse to its stakeholders. Representatives of CMS’s extensive  stakeholder network whom we interviewed—state officials, contractors,  and officials from public and private entities—generally recognized the  agency’s commitment to combating fraud. In our interviews with  stakeholders, officials observed CMS’s increased commitment over time  to address fraud, waste, and abuse and cited examples of specific CMS  actions. State officials, for example, told us that the Medicaid Integrity  Institute, a training center coordinated jointly by CMS and DOJ, has been  a helpful resource for states to build capacity to address fraud and  program integrity. CMS contractors told us that CMS’s commitment to  combating fraud is incorporated into contractual requirements, such as  requiring (1) data analysis for potential fraud leads and (2) fraud-  awareness training for providers. Officials from entities that are members  of the HFPP, specifically, a health-insurance plan and the National Health  Care Anti-Fraud Association, added that CMS’s effort to establish the  HFPP and its ongoing collaboration and information sharing reflect CMS’s  commitment to combat fraud in Medicare and Medicaid.

The Fraud Risk Framework identifies training as one way of  demonstrating an agency’s commitment to combating fraud. Training and  education intended to increase fraud awareness among stakeholders,  managers, and employees, serves as a preventive measure to help  create a culture of integrity and compliance within the agency. The Fraud  Risk Framework discusses requiring all employees to attend training upon  hiring and on an ongoing basis thereafter.

To increase awareness of fraud risks in Medicare and Medicaid, CMS  offers and requires training for stakeholder groups such as providers,  beneficiaries, and health-insurance plans. Specifically, through its  National Training Program and Medicare Learning Network, CMS makes  available training materials on combating Medicare and Medicaid fraud,  waste, and abuse. These materials help to identify and report fraud,  waste, and abuse in CMS programs and are geared toward providers,  beneficiaries, as well as trainers and other stakeholders. Separately,  CMS requires health-insurance plans working with CMS to provide annual  fraud, waste, and abuse training to their employees.

However, CMS does not offer or require similar fraud-awareness training  for the majority of its workforce. For a relatively small portion of its overall  workforce—specifically, contracting officer representatives who are  responsible for certain aspects of the acquisition function—CMS requires  completion of fraud and abuse prevention training every 2 years.  According to CMS, 638 of its contracting officer representatives (or about  10 percent of its overall workforce) completed such training in 2016 and  2017. Although CMS offers fraud-awareness training to others, the  agency does not require fraud-awareness training for new hires or on a  regular basis for all employees because the agency has focused on  providing process-based internal controls training for its employees.

While fraud-awareness training for contracting officer representatives is  an important step in helping to promote fraud risk management, fraud- awareness training specific to CMS programs would be beneficial for all  employees. Such training would not only be consistent with what CMS  offers to or requires of its stakeholders and some of its employees, but  would also help to keep the agency’s entire workforce continuously aware  of fraud risks and examples of known fraud schemes, such as those  identified in successful OIG investigations. Such training would also keep  employees informed as they administer CMS programs or develop  agency policies and procedures. Considering the vulnerability of Medicare  and Medicaid programs to fraud, waste, and abuse, without regular  required training CMS cannot be assured that its workforce of over 6,000  employees is continuously aware of risks facing its programs.

Although CMS has shown commitment to combating fraud, at times CPI’s  efforts to combat fraud compete with other mission priorities, such as (1)  ensuring beneficiary access to health-care services and (2) limiting  provider burden. CPI leadership has been aware of this inherent  challenge. For example, at a congressional hearing in May 2016, CPI’s  Director stated that “our efforts strike an important balance: protecting  beneficiary access to necessary health care services and reducing the  administrative burden on legitimate providers and suppliers, while  ensuring that taxpayer dollars are not lost to fraud, waste, and abuse.”

Beneficiary access to care. In accordance with its mission statement,  providing and improving beneficiaries’ access to health care is a CMS  priority. CMS’s commitment to providing access to high-quality care and  coverage is reflected in the agency’s mission statement and is one of its  four strategic goals. As a result, before taking administrative actions  against a Medicare Part A provider, such as a hospice, or providers in  rural areas, CMS officials told us that they first look at whether there is a  sufficient number of providers in an area by running a provider search by  provider county and adjacent counties and considering how heavily  populated an area is with Medicare beneficiaries. According to these  officials, rather than taking an administrative action against a provider that  would limit beneficiaries’ access to services, the agency may enter into a  corrective action plan with the provider. CMS officials told us that revoking  a provider’s enrollment in Medicare, an option available to CMS in cases  of provider noncompliance or misconduct, is rare.

Administrative burden on providers. According to CMS documents and  officials, concern over placing undue burden on providers—the majority of  whom are presumed to be honest—provides a counterforce to  implementing program-integrity control activities. CMS’s web page  entitled Reducing Provider Burden states: “CMS is committed to reducing  improper payments but must be mindful of provider burden because  medical review is a resource-intensive process for both the healthcare  provider and the Medicare review contractor.” Two CMS contractors told  us that they scaled back or did not pursue audits of providers’  documentation because of provider burden or sensitivity considerations.  One contractor removed providers from audit samples after some  providers opposed having to supply multiple medical records. CPI officials  told us that they want to reduce provider burden in a logical manner. For  example, according to CMS officials, in the Medicare FFS Recovery Audit  Program, CMS established limits on Additional Documentation Requests,  which are requests for medical documentation supporting a claim being  reviewed. CMS requires such documentation adjustments so that they  align with a providers’ claim denial rates. Providers with low denial rates  will have lower documentation requirements, while providers with high  denial rates will have higher documentation requirements, thus adjusting  provider burden based on demonstrated compliance.

CMS Has Taken Steps to Identify Program Fraud Risks but Has Not Conducted a Fraud Risk Assessment for Medicare or Medicaid

CMS Has Taken Steps to Identify Some Fraud Risks for Medicare and Medicaid

The assess component of the Fraud Risk Framework calls for federal  managers to plan regular fraud risk assessments and to assess risks to  determine a fraud risk profile. Identifying fraud risks is one of the steps  included in the Fraud Risk Framework for assessing risks to determine a  fraud risk profile.

CMS has taken steps to identify some fraud risks through several control  activities that target areas the agency has designated as higher risk within  Medicare and Medicaid, including specific provider types, such as home  health agencies, and specific geographic locations. As discussed earlier,  CMS officials told us that CPI initially focused on developing control  activities for Medicare FFS and considers these activities to be the most  mature of all CPI efforts to address fraud risks. CMS has identified fraud  risks in the following selected examples, which are not an exhaustive list  of its control activities.

Data analytics to assist investigations in Medicare FFS. In 2011, CMS  implemented FPS, a data-analytic system that screens all Medicare FFS  claims to identify health-care providers with suspect billing patterns for  further investigation. Medicare FFS contractors—ZPICs and UPICs— have used FPS to identify and prioritize leads for investigations of  potential fraud by high-risk Medicare FFS providers. Contractors told us  that FPS allows them to quickly identify and triage leads. CMS’s guidance  requires contractors to prioritize investigations with the greatest program  impact or urgency and identifies required criteria for prioritizing  investigations, such as patient abuse or harm, multistate fraud, and high  dollar amount of potential overpayments. One contractor we interviewed  developed a risk-prioritization model that incorporated CMS’s required  criteria, such as patient harm, as well as additional criteria, such as  provider spikes in billing, into a tool that automatically creates a provider  risk score to help the contractor focus and prioritize investigative  resources.

Prior authorization for Medicare FFS services or supplies. CMS published  a final rule in December 2015 that identifies a master list of durable  medical equipment, prosthetics, orthotics, and supplies for which CMS  can require prior authorization before suppliers submit a Medicare FFS  claim. In this rule, CMS identified 135 items that are frequently subject to  unnecessary utilization and stated that the agency expects the final rule  to result in savings in the form of reduced unnecessary utilization, fraud,  waste, and abuse. Under this program, prior authorization is a condition  of payment for claims. CMS can choose which items on the master list to  subject to prior authorization. For example, in March 2017, it began  requiring prior authorization for selected power wheelchairs in four states  and expanded the prior authorization program for these items to all states  in July 2017.

CMS also began to test the use of prior authorization on a voluntary basis  through a series of fixed-length demonstrations for items and services  that have been associated with high levels of improper payments,  including high incidences of fraud in some cases, and unnecessary  utilization in certain geographic areas. For example, CMS began  implementing a voluntary prior authorization demonstration in September  2012 for other power mobility devices, such as power scooters, in seven  states where historically there has been extensive evidence of fraud and  improper payments. CMS expanded the demonstration to an additional  12 states in October 2014, for a total of 19 states. According to the initial  Federal Register notice, CMS planned to use the demonstration to  develop improved methods for investigation and prosecution of fraud to  protect federal funds from fraudulent actions and the resulting improper  payments. Under the demonstration, providers and suppliers are  encouraged—but not required—to submit a request for prior authorization  for certain items before they provide the item to the beneficiary and  submit a claim for payment.

Revised provider screening and enrollment processes for Medicare FFS  and Medicaid FFS. In response to PPACA, in 2011 CMS implemented a  revised screening process for providers and suppliers who enroll in  Medicare and Medicaid based on identified provider risk categories.  CMS placed all Medicare provider and supplier types into one of three  risk categories—limited, moderate, or high—based on its assessment of  the potential risk of fraud, waste, and abuse each provider and supplier  type poses. For example, CMS designated prospective (newly enrolling)  home health agencies and prospective suppliers of durable medical  equipment, prosthetics, orthotics, and supplies in the high-risk category.  According to the final rule and our interviews with CMS officials, CMS  developed these risk-based categories based on its review and synthesis  of various information sources about the fraud risks posed by each  provider and supplier type, including (1) the agency’s experience with  claims data used to identify potentially fraudulent billing practices, (2)  expertise of contractors responsible for investigating and identifying  Medicare fraud, and (3) GAO and OIG reports. CMS designated specific  screening activities for each risk category, with increased requirements  for moderate- and high-risk provider and supplier types. For example,  moderate- and high-risk providers and suppliers must receive  preenrollment site visits, and high-risk providers and suppliers also are  subject to fingerprint-based criminal-background checks. As part of the  revised screening process, beginning in September 2011, CMS also  undertook its first program-wide effort to rescreen, or revalidate, the  enrollment records of about 1.5 million existing Medicare FFS providers  and suppliers, to determine whether they remain eligible to bill  Medicare.

Temporary provider enrollment moratoriums for certain providers and  geographic areas for Medicare FFS and Medicaid FFS. CMS identified  certain provider types and geographic areas as high risk for fraud and  used its authority under PPACA to implement temporary moratoriums to  suspend enrollment of such Medicare and Medicaid providers in those  areas. For example, in July 2016, CMS extended temporary moratoriums  statewide on the enrollment of new Medicare Part B nonemergency  ambulance suppliers and Medicare home health agencies statewide in six  states, as applicable. The statewide moratoriums also apply to  Medicaid. According to the Federal Register notice, CMS imposed the  temporary moratoriums based on qualitative and quantitative factors  suggesting a high risk of fraud, waste, or abuse, such as law-enforcement  expertise with emerging fraud trends and investigations. CMS’s data  analysis also confirmed the agency’s determination of a high risk of fraud,  waste, and abuse for these provider and supplier types within certain  geographic areas, according to the notice.

Medicaid state program integrity reviews and desk reviews. CMS tailored  state Medicaid program-integrity reviews to areas it identified as high risk  for improper payments, such as personal care services, which may also  be at high risk for fraud. In March 2017, we reported that, from fiscal  years 2014 through 2016, CMS conducted focused reviews of state  program-integrity efforts in 31 states, reviewing 10 or 11 states annually.  For each state, CMS tailored its focused reviews to the state’s managed  care plans and relevant other high-risk areas, including provider  enrollment and screening, nonemergency medical transportation, and  personal care services. CMS and state officials we spoke with as part of  that work told us that the tailored oversight had been beneficial and  helped identify areas for improvement. CMS has also initiated desk  reviews of state program-integrity efforts. According to CMS, these desk  reviews allow the agency to provide states with customized program- integrity oversight.

Vulnerability tracking system for Medicare. CPI recently initiated an effort  to centralize and formalize a vulnerability tracking process for Medicare,  which could support identification of specific fraud risks, both in Medicare  and possibly Medicaid. As described by CPI officials, the process aims  to collect information on fraud-related vulnerabilities from CMS  employees, contractors, and other sources, such as GAO and HHS OIG  reports.

CMS Has Not Conducted a Fraud Risk Assessment for Medicare or Medicaid

The assess component of the Fraud Risk Framework calls for federal  managers to plan regular fraud risk assessments and assess risks to  determine a fraud risk profile. Furthermore, federal internal control  standards call for agency management to assess the internal and  external risks their entities face as they seek to achieve their objectives.  The standards state that, as part of this overall assessment, management  should consider the potential for fraud when identifying, analyzing, and  responding to risks.

The Fraud Risk Framework states that, in planning the fraud risk  assessment, effective managers tailor the fraud risk assessment to the  program by, among other things, identifying appropriate tools, methods,  and sources for gathering information about fraud risks and involving  relevant stakeholders in the assessment process. Fraud risk  assessments that align with the Fraud Risk Framework involve (1)  identifying inherent fraud risks affecting the program, (2) assessing the  likelihood and impact of those fraud risks, (3) determining fraud risk  tolerance, (4) examining the suitability of existing fraud controls and  prioritizing residual fraud risks, and (5) documenting the results. (See fig.  6.)

Although, as discussed earlier, CMS has identified some fraud risks  posed by providers in Medicare FFS and, to a lesser degree, Medicaid  FFS, the agency has not conducted a fraud risk assessment for either the  Medicare or Medicaid program. Such a risk assessment would provide  the detailed information and insights needed to create a fraud risk profile,  which, in turn, is the basis for creating an antifraud strategy.

According to CMS officials, CMS has not conducted a fraud risk  assessment for Medicare or Medicaid because, within CPI’s broader  approach of preventing and eliminating improper payments, its focus has  been on addressing specific vulnerabilities among provider groups that  have shown themselves particularly prone to fraud, waste, and abuse.  With this approach, however, it is unlikely that CMS will be able to design  and implement the most-appropriate control activities to respond to the  full portfolio of fraud risks.

A fraud risk assessment consists of discrete activities that build upon  each other. Specifically:  Identifying inherent fraud risks affecting the program. As discussed  earlier, CMS has taken steps to identify fraud risks. However, CMS  has not used a process to identify inherent fraud risks from the  universe of potential vulnerabilities facing Medicare and Medicaid  programs, including threats from various sources. According to CPI  officials, most of the agency’s fraud control activities are focused on  fraud risks posed by providers. The Fraud Risk Framework discusses  fully considering inherent fraud risks from internal and external  sources in light of fraud risk factors such as incentives, opportunities,  and rationalization to commit fraud. For example, according to CMS  officials, the inherent design of the Medicare Part C program may  pose fraud risks that are challenging to detect. A fraud risk  assessment would help CMS identify all sources of fraudulent  behaviors, beyond threats posed by providers, such as those posed  by health-insurance plans, contractors, or employees.

Assessing the likelihood and impact of fraud risks and determining  fraud risk tolerance. CMS has taken steps to prioritize fraud risks in  some areas, but it has not assessed the likelihood or impact of fraud  risks or determined fraud risk tolerance across all parts of Medicare  and Medicaid. Assessing the likelihood and impact of inherent fraud  risks would involve consideration of the impact of fraud risks on  program finances, reputation, and compliance. Without assessing the  likelihood and impact of risks in Medicare or Medicaid or internally  determining which fraud risks may fall under the tolerance threshold,  CMS cannot be certain that it is aware of the most-significant fraud  risks facing these programs and what risks it is willing to tolerate  based on the programs’ size and complexity.

Examining the suitability of existing fraud controls and prioritizing  residual fraud risks. CMS has not assessed existing control activities  or prioritized residual fraud risks. According to the Fraud Risk  Framework, managers may consider the extent to which existing  control activities—whether focused on prevention, detection, or  response—mitigate the likelihood and impact of inherent risks and  whether the remaining risks exceed managers’ tolerance. This  analysis would help CMS to prioritize residual risks and to determine  mitigation approaches. For example, CMS has not established  preventive fraud control activities in Medicare Part C. Using a fraud  risk assessment for Medicare Part C and closely examining existing  fraud control activities and residual risks, CMS could be better  positioned to address fraud risks facing this growing program and  develop preventive control activities. Further, without assessing  existing fraud control activities and prioritizing residual fraud risks,  CMS cannot be assured that its current control activities are  addressing the most-significant risks. Such analysis would also help  CMS determine whether additional, preferably preventive, fraud  controls are needed to mitigate residual risks, make adjustments to  existing control activities, and potentially scale back or remove control  activities that are addressing tolerable fraud risks.

Documenting the risk-assessment results in a fraud risk profile. CMS  has not developed a fraud risk profile that documents key findings and  conclusions of the fraud risk assessment. According to the Fraud Risk  Framework, the risk profile can also help agencies decide how to  allocate resources to respond to residual fraud risks. Given the large  size and complexity of Medicare and Medicaid, a documented fraud  risk profile could support CMS’s resource-allocation decisions as well  as facilitate the transfer of knowledge and continuity across CMS staff  and changing administrations.

Senior CPI officials told us that the agency plans to start a fraud risk  assessment for Medicare and Medicaid after it completes a separate  fraud risk assessment of the federally facilitated marketplace. This fraud  risk assessment for the federally facilitated marketplace eligibility and  enrollment process is being conducted in response to a recommendation  we made in February 2016. In April 2017, CPI officials told us that this  fraud risk assessment was largely completed, although in September  2017 CPI officials told us that the assessment was undergoing agency  review. CPI officials told us that they have informed CM and CMCS  officials that there will be future fraud risk assessments for Medicare and  Medicaid; however, they could not provide estimated timelines or plans  for conducting such assessments, such as the order or programmatic  scope of the assessments.

Once completed, CMS could use the federally facilitated marketplace  fraud risk assessment and apply any lessons learned when planning for  and designing fraud risk assessments for Medicare and Medicaid.  According to the Fraud Risk Framework, factors such as size, resources,  maturity of the agency or program, and experience in managing risks can  influence how the entity plans the fraud risk assessment. Additionally,  effective managers tailor the fraud risk assessment to the program when  planning for it. The large scale and complexity of Medicare and Medicaid  as well as time and resources involved in conducting a fraud risk  assessment underscore the importance of a well-planned and tailored  approach to identifying the assessment’s programmatic scope. Planning  and tailoring may involve decisions to conduct a fraud risk assessment for  Medicare and Medicaid programs as a whole or divided into several  subassessments to reflect their various component parts (e.g., Medicare  FFS, Medicaid managed care) as well as determining the timing and  order of assessments (e.g., concurrently or consecutively for Medicare  and Medicaid).

CMS’s existing fraud risk identification efforts as well as communication  channels with stakeholders could serve as a foundation for developing a  fraud risk assessment for Medicare and Medicaid. The leading practices  identified in the Fraud Risk Framework discuss the importance of  identifying appropriate tools, methods, and sources for gathering  information about fraud risks and involving relevant stakeholders in the  assessment process. CMS’s fraud risk identification efforts discussed  earlier could provide key information about fraud risks and their likelihood  and impact. Further, existing relationships and communication channels  across CMS and its extensive network of stakeholders could support  building a comprehensive understanding of known and potential fraud  risks for the purposes of a fraud risk assessment. For example, the fraud  vulnerabilities identified through data analysis and information sharing  with states, health-insurance plans, law-enforcement organizations, and  contractors through the HFPP could inform a fraud risk assessment.  CPI’s Command Center missions—facilitated collaboration sessions that  bring together experts from various disciplines to improve the processes  for fraud prevention in Medicare and Medicaid—could bring together  experts to identify potential or emerging fraud vulnerabilities or to  brainstorm approaches to mitigate residual fraud risks.

As CMS makes plans to move forward with a fraud risk assessment for  Medicare and Medicaid, it will be important to consider the frequency with  which the fraud risk assessment would need to be updated. While,  according to the Fraud Risk Framework, the time intervals between  updates can vary based on the programmatic and operating environment,  assessing fraud risks on an ongoing basis is important to ensure that  control activities are continuously addressing fraud risks. The constantly  evolving fraud schemes, the size of the programs in terms of beneficiaries  and expenditures, as well as continual changes in Medicare and Medicaid  programs—such as development of innovative payment models and  increasing managed-care enrollment—call for constant vigilance and  regular updates to the fraud risk assessment.

CMS Has Not Developed a Risk-Based Antifraud Strategy for Medicare and Medicaid, Which Would Include Plans for Monitoring and Evaluation

CMS Has Not Developed a Risk-Based Antifraud Strategy

The design and implement component of the Fraud Risk Framework calls  for federal managers to design and implement a strategy with specific  control activities to mitigate assessed fraud risks and collaborate to help  ensure effective implementation.

According to the Fraud Risk Framework, effective managers develop and  document an antifraud strategy that describes the program’s approach for  addressing the prioritized fraud risks identified during the fraud risk  assessment, also referred to as a risk-based antifraud strategy. A risk- based antifraud strategy describes existing fraud control activities as well  as any new fraud control activities a program may adopt to address  residual fraud risks. In developing a strategy and antifraud control  activities, effective managers focus on fraud prevention over detection,  develop a plan for responding to identified instances of fraud, establish  collaborative relationships with stakeholders, and create incentives to  help effectively implement the strategy. Additionally, as part of a  documented strategy, management identifies roles and responsibilities of  those involved in fraud risk management activities; describes control  activities as well as plans for monitoring and evaluation, creates timelines,  and communicates the antifraud strategy to employees and stakeholders,  among other things.

As discussed earlier, CMS has some control activities in place to identify  fraud risk in Medicare and Medicaid, particularly in the FFS program.  However, CMS has not developed and documented a risk-based  antifraud strategy to guide its design and implementation of new antifraud  activities and to better align and coordinate its existing activities to ensure  it is targeting and mitigating the most-significant fraud risks.

Antifraud strategy. CMS officials told us that CPI does not have a  documented risk-based antifraud strategy. Although CMS has developed  several documents that describe efforts to address fraud, the agency  has not developed a risk-based antifraud strategy for Medicare and  Medicaid because, as discussed earlier, it has not conducted a fraud risk  assessment that would serve as a foundation for such strategy.

In 2016, CPI identified five strategic objectives for program integrity,  which include antifraud elements and an emphasis on prevention.  However, according to CMS officials, these objectives were identified  from discussions with CMS leadership and various stakeholders and not  through a fraud risk assessment process to identify inherent fraud risks  from the universe of potential vulnerabilities, as described earlier and  called for in the leading practices. These strategic objectives were  presented at an antifraud conference in 2016, but were not announced  publicly until the release of the Annual Report to Congress on the  Medicare and Medicaid Integrity Programs for Fiscal Year 2015 in June  2017.

Stakeholder relationships and communication. CMS has established  relationships and communicated with stakeholders, but, without an  antifraud strategy, stakeholders we spoke with lacked a common  understanding of CMS’s strategic approach. Prior work on practices that  can help federal agencies collaborate effectively calls for a strategy that is  shared with stakeholders to promote trust and understanding. Once an  antifraud strategy is developed, the Fraud Risk Framework calls for  managers to collaborate to ensure effective implementation. Although some CMS stakeholders were able to describe various CMS program- integrity priorities and activities, such as home health being a fraud risk  priority, the stakeholders could not communicate, articulate, or cite a  common CMS strategic approach to address fraud risks in its programs.

Incentives. The Fraud Risk Framework discusses creating incentives to  help ensure effective implementation of the antifraud strategy once it is  developed. Currently, some incentives within stakeholder relationships  may complicate CMS’s antifraud efforts. As discussed earlier, CMS is a  partner and provides oversight to states’ program-integrity functions.  Officials from one state told us that they were reluctant to share their  program vulnerabilities because CMS would use this information to later  audit the state. Among contractors, CMS encourages information sharing  through conferences and workshops; however, competition for CMS  business among contractors can be a disincentive to information sharing.  CMS officials acknowledged this concern and said that they expect  contractors to share information related to fraud schemes, outcomes of  investigations, and tips for addressing fraud, but not proprietary  information such as algorithms to risk-score providers.

Without developing and documenting an antifraud strategy based on a  fraud risk assessment, as called for in the design and implement  component of the Fraud Risk Framework, CMS cannot ensure that it has  a coordinated approach to address the range of fraud risks and to  appropriately target and allocate resources for the most-significant risks.  Considering fraud risks to which the Medicare and Medicaid programs are  most vulnerable, in light of the malicious intent of those who aim to exploit  the programs, would help CMS to examine its current control activities  and potentially design new ones with recognition of fraudulent behavior it  aims to prevent. This focus on fraud is distinct from a broader view of  program integrity and improper payments by considering the intentions  and incentives of those who aim to deceive rather than well-intentioned  providers who make mistakes. Also, continued growth of the programs,  such as growth of Medicare Part C and Medicaid managed care, call for  consideration of preventive fraud control activities across the entire  network of entities involved.

Further, considering the large size and complexity of Medicare and  Medicaid and the extensive stakeholder network involved in managing  fraud in the programs, a strategic approach to managing fraud risks within  the programs is essential to ensure that a number of existing control  activities and numerous stakeholder relationships and incentives are  being aligned to produce desired results. Once developed, an antifraud  strategy that is clearly articulated to various CMS stakeholders would help  CMS to address fraud risks in a more coordinated and deliberate fashion.  Thinking strategically about existing control activities, resources, tools,  and information systems could help CMS to leverage resources while  continuing to integrate Medicare and Medicaid program-integrity efforts  along functional lines. A strategic approach grounded in a comprehensive  assessment of fraud risks could also help CMS to identify future  enhancements for existing control activities, such as new preventive  capabilities for FPS or additional fraud factors in provider enrollment and  revalidation, such as provider risk scoring, to stay in step with evolving  fraud risks.

CMS Has Established Monitoring and Evaluation Mechanisms That Could Inform a Risk-Based Antifraud Strategy for Medicare and Medicaid

The evaluate and adapt component of the Fraud Risk Framework calls for  federal managers to evaluate outcomes using a risk-based approach and  adapt activities to improve fraud risk management. Furthermore,  according to federal internal control standards, managers should  establish and operate monitoring activities to monitor the internal control  system and evaluate the results, which may be compared against an  established baseline. Ongoing monitoring and periodic evaluations  provide assurances to managers that they are effectively preventing,  detecting, and responding to potential fraud.

CMS has established monitoring and evaluation mechanisms for its  program-integrity activities that it could incorporate into an antifraud  strategy.

In Medicare, CMS has taken steps to measure the rate of fraud in a  particular service area. We have previously reported that agencies may  face challenges measuring outcomes of fraud risk management activities  in a reliable way. These challenges include the difficulty of measuring the  extent of deterred fraud, isolating potential fraud from legitimate activity or  other forms of improper payments, and determining the amount of  undetected fraud. Despite these challenges, CMS has taken steps to  estimate a fraud baseline—meaning the rate of probable fraud—in the  home health benefit. In fiscal year 2016, CMS conducted a pretest in the  Miami-Dade area of Florida to evaluate its potential measurement  approach that could later be used in a nationwide study of probable fraud  among home health agencies. The pretest was not a random sample and was not intended to produce a rate of fraud, but instead was intended to  test the interview instruments and data-collection methodology CMS  might use in a study nationwide. CMS and its contractor collected  information from home health agencies, the attending providers, and  Medicare beneficiaries in the Miami-Dade area in order to test these  interview instruments. CMS completed this pretest, but, according to CMS  officials, the agency does not yet have plans to roll out a nationwide study  that would estimate a probable fraud rate for the Medicare FFS home  health benefit.

In its 2015 annual report to Congress, CMS stated that “documenting the  baseline amount of fraud in Medicare is of critical importance, as it allows  officials to evaluate the success of ongoing fraud prevention activities.”  CMS officials working on the pilot told us that having an estimate of the  rate of fraud in home health benefits would allow CMS to reliably assess  its efforts at eliminating or reducing fraud. Without a baseline, officials  said, the agency cannot know whether its antifraud efforts are as effective  as they could be. We previously reported that the lack of a baseline for  the amount of health-care fraud that exists limits CMS’s ability to  determine whether its activities are effectively reducing health care fraud  and abuse. A baseline estimate could provide an understanding of the  extent of fraud and, with additional information on program activities,  could help to inform decision making related to allocation of resources to  combat health-care fraud.

As described in the Fraud Risk Framework, in the absence of a fraud  baseline, agencies can gather additional information on the short-term or  intermediate outcomes of some antifraud initiatives, which may be more  readily measured. For example, CMS has developed some performance  measures to provide a basis for monitoring its progress towards meeting  the program-integrity goals set in the HHS Strategic Plan and Annual  Performance Plan. Specifically, CMS measures whether it is meeting its  goal of “increasing the percentage of Medicare FFS providers and  suppliers identified as high risk that receive an administrative action.”  CMS does not set specific antifraud goals for other parts of Medicare or  Medicaid; other CMS performance measures relate to measuring or  reducing improper payments in CHIP, Medicaid, and the various parts of  Medicare.

CMS uses return-on-investment and savings estimates to measure the  effectiveness of its Medicare program-integrity activities and FPS. For  example, CMS uses return-on-investment to measure the effectiveness of  FPS and, in response to a recommendation we made in 2012, CMS  developed outcome-based performance targets and milestones for FPS.  CMS has also conducted individual evaluations of its program-integrity  activities, such as an interim evaluation of the prior-authorization  demonstration for power mobility devices that began in 2012 and is  currently implemented in 19 states.

Commensurate with greater maturity of control activities in Medicare FFS  compared to other parts of Medicare and Medicaid, monitoring and  evaluation activities for Medicare Parts C and D and Medicaid are more  limited. For example, CMS calculates savings for its program-integrity  activities in Medicare Parts C and D, but not a full return-on-investment.  CMS officials told us that calculating costs for specific activities is  challenging because of overlapping activities among contractors. CMS  officials said they continue to refine methods and develop new savings  estimates for additional program-integrity activities.

According to the Fraud Risk Framework, effective managers develop a  strategy and evaluate outcomes using a risk-based approach. In  developing an effective strategy and antifraud activities, managers  consider the benefits and costs of control activities. Ongoing monitoring  and periodic evaluations provide reasonable assurance to managers that  they are effectively preventing, detecting, and responding to potential  fraud. Monitoring and evaluation activities can also support managers’  decisions about allocating resources, and help them to demonstrate their  continued commitment to effectively managing fraud risks.

As CMS takes steps to develop an antifraud strategy, it could include  plans for refining and building on existing methods such as return-on- investment or savings measures, and setting appropriate targets to  evaluate the effectiveness of all of CMS’s antifraud efforts. Such a  strategy would help CMS to efficiently allocate program-integrity  resources and to ensure that the agency is effectively preventing,  detecting, and responding to potential fraud. For example, while doing so  would involve challenges, CMS’s strategy could detail plans to advance  efforts to measure a potential fraud rate through baseline and periodic  measures. Fraud rate measurement efforts could also inform risk  assessment activities, identify currently unknown fraud risks, align  resources to priority risks, and develop effective outcome metrics for  antifraud controls. Such a strategy would also help CMS ensure that it  has effective performance measures in place to assess its antifraud  efforts beyond those related to providers in Medicare FFS, and establish  appropriate targets to measure the agency’s progress in addressing fraud  risks.

As CMS makes plans to move forward with a strategy and to further  develop evaluation and monitoring mechanisms, it will be important to  share its efforts with stakeholders. The Fraud Risk Framework states that  effective managers communicate lessons learned from fraud risk  management activities to stakeholders. For example, CMS could be a  leader to states in measuring the effectiveness of program-integrity  efforts. Officials in three of the four states we spoke with expressed  interest in receiving CMS guidance on how to measure the effectiveness  of their Medicaid program-integrity efforts, such as by providing models  for how to calculate return-on-investment.

Medicare and Medicaid provide health insurance to over 129 million  Americans, but the size—in terms of number of beneficiaries and amount  of expenditures—as well as complexity of these programs make them  inherently susceptible to fraud and improper payments. CMS currently  manages these risks across its programs as part of a broader approach  to identifying and controlling for multiple sources of improper payments  and by developing relationships with an extensive network of  stakeholders. In Medicare and Medicaid specifically, we note that CMS  has taken many important steps toward implementing a strategic  approach for managing fraud. However, the agency could benefit by more  fully aligning its efforts with the four components of the Fraud Risk  Framework.

CMS is well positioned to leverage its fraud risk management efforts— such as demonstrated leadership for combating fraud, existing control  activities, and stakeholder relationships—to provide additional antifraud  training, as well as to develop an antifraud strategy based on fraud risk  assessments for Medicare and Medicaid. We recognize that the effort  may be challenging, given the size and complexity of Medicare and  Medicaid, and the need to balance antifraud activities with CMS’s other  mission priorities. However, by not employing the actions identified in the  Fraud Risk Framework and incorporating them in its approach to  managing fraud risks, CMS is missing a significant opportunity to better  ensure employee vigilance against fraud, and to organize and focus its  many antifraud and program-integrity activities and related resources into  a comprehensive strategy. Such a strategy would (1) provide reasonable  assurance that CMS is targeting the most-significant fraud risks in its  programs and (2) help protect the government’s substantial and growing  investments in these programs.

We are making the following three recommendations to CMS:

The Administrator of CMS should provide fraud-awareness training  relevant to risks facing CMS programs and require new hires to  undergo such training and all employees to undergo training on a  recurring basis. (Recommendation 1)

The Administrator of CMS should conduct fraud risk assessments for  Medicare and Medicaid to include respective fraud risk profiles and  plans for regularly updating the assessments and profiles.  (Recommendation 2)

The Administrator of CMS should, using the results of the fraud risk  assessments for Medicare and Medicaid, create, document,  implement, and communicate an antifraud strategy that is aligned with  and responsive to regularly assessed fraud risks. This strategy should  include an approach for monitoring and evaluation. (Recommendation  3)

We provided a draft of this report to HHS and DOJ for comment. HHS  provided written comments, which are reprinted in appendix I. DOJ did  not have comments. HHS and DOJ also provided technical comments,  which we incorporated as appropriate.

In commenting on this report, HHS agreed with our three  recommendations. Specifically, in response to our first recommendation  to provide required fraud-awareness training to all employees, HHS  stated that it will develop and implement a fraud-awareness training plan  to ensure all CMS employees receive training.

Regarding our second recommendation to conduct fraud risk  assessments for Medicare and Medicaid, HHS stated that it is currently  conducting a fraud risk assessment on the federally facilitated  marketplace and, when this assessment is complete, will apply the  lessons learned in assessing this program to fraud risk assessments of  Medicare and Medicaid.

In response to our third recommendation to create, document, implement,  and communicate an antifraud strategy that is aligned with and  responsive to regularly assessed fraud risks, HHS stated that it will  develop respective risk-based antifraud strategies after completing fraud  risk assessments for Medicare and Medicaid.

We are sending copies of this report to the Acting Secretary of Health and  Human Services, the Administrator of CMS, the Assistant Attorney  General for Administration at DOJ, as well as appropriate congressional  committees and other interested parties. In addition, this report is  available at no charge on the GAO website at http://www.gao.gov.

If you or your staff members have any questions about this report, please  contact me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found   on the last page of this report. GAO staff who made contributions to this  report are listed in appendix II.

Appendix I: Comments from the Department of Health and Human Services

Appendix II: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Tonita Gillich (Assistant Director),  Irina Carnevale (Analyst-in-Charge), Michael Duane, Laura Sutton  Elsberg, and Catrin Jones made key contributions to this report. Also  contributing to the report were Lori Achman, James Ashley, Colin Fallon,  Leslie V. Gordon, Maria McMullen, Sabrina Streagle, and Shana Wallace.