House Energy and Commerce Subcommittee on Oversight and Investigations Hearing

Testimony by Shantanu Agrawal, Deputy Administrator and Director, Center for Program Integrity, Centers for Medicare and Medicaid Services, U.S. Department of Health and Human Services

Chairman Murphy, Ranking Member DeGette, and members of the Subcommittee, thank you for the invitation to discuss the Centers for Medicare & Medicaid Services' efforts to strengthen program integrity in the Medicare and Medicaid programs. Enhancing program integrity is a top priority for the administration and an agency-wide effort at CMS. We share this Subcommittee's commitment to protecting beneficiaries and ensuring taxpayer dollars are spent on legitimate items and services, both of which are at the forefront of our program integrity mission. CMS is coordinating a variety of efforts with Federal and State partners, as well as the private sector to better share information to address vulnerabilities, prevent improper payments and verify provider and beneficiary eligibility.

CMS understands that it has a responsibility to make sure our programs pay the right amount, to the right party, for the right beneficiary, in accordance with the law and agency and state policies. CMS is focused on preventing fraud, waste, and abuse in Medicare, Medicaid, and the Children's Health Insurance Program (CHIP). Historically, CMS and our law enforcement partners have been dependent upon "pay and chase" activities, by working to identify and recoup fraudulent payments after claims were paid. Now, CMS is using a variety of tools, including innovative data analytics, to keep fraudsters out of our programs in the first place and to uncover fraudulent schemes and trends quickly before they drain valuable resources from our Trust Funds.

Insight and recommendations from the Government Accountability Office (GAO) and the Department of Health and Human Services Office of Inspector General (HHS-OIG) are a critical component of these efforts. In the last year, we have implemented 38 GAO recommendations and 122 recommendations from the HHS-OIG across all CMS programs, and have submitted approximately 100 additional recommendations to the GAO and 129 to the HHS-OIG for their review and closure.

Our efforts to implement GAO and HHS-OIG recommendations stretch across our programs. For example, CMS will eliminate the use of beneficiaries' Social Security Numbers on Medicare cards by April 2019, as required by the Medicare Access & CHIP Reauthorization Act of 2015 (MACRA), a step that both GAO n1 and HHS-OIG n2 have recommended to protect beneficiaries and prevent fraudulent activity. Based on input from the HHS-OIG n3, GAO, and stakeholders, over the past several years, CMS has broadened its initial focus of strengthening beneficiary access to prescribed drugs to also address fraud and drug abuse by making sure Part D sponsors implement effective safeguards and provide coverage for drug therapies that meet safety and efficacy standards. Today, CMS requires Part D plan sponsors to have drug utilization review systems, policies, and procedures designed to ensure that a review of the prescribed drug therapy is performed before each prescription is dispensed to an enrollee in a sponsor's Part D plan. CMS also issued a Final Rule that both establishes a new revocation authority for abusive prescribing patterns and requires most prescribers of Part D drugs to enroll in Medicare or have a valid opt-out affidavit on file. CMS has made a number of enhancements to the provider enrollment and revalidation process as the GAO has recommended, n4 which is described in more detail below. CMS also recently finalized the first overhaul of Medicaid and CHIP managed care regulations in more than a decade n5, and addresses several recommendations that the HHS-OIG has made in recent years n6 to strengthen program integrity in Medicaid and CHIP Managed Care. The final rule strengthens the fiscal transparency and integrity in Medicaid and CHIP managed care by requiring more transparency in the managed care rate setting process, adding a standard for the calculation and reporting of medical loss ratios, identifying minimum standards for provider screening and enrollment, expanding managed care plan responsibilities in program integrity efforts, and adding requirements related to encounter data submissions.

Our efforts strike an important balance: protecting beneficiary access to necessary health care services and reducing the administrative burden on legitimate providers and suppliers, while ensuring that taxpayer dollars are not lost to fraud, waste, and abuse. Fraud can inflict real harm on beneficiaries. Beneficiaries are at risk when fraudulent providers perform medically unnecessary tests, treatments, procedures, or surgeries, or prescribe dangerous drugs without thorough examinations or medical necessity. When we prevent fraud, we ensure that beneficiaries are less exposed to risks and harm from fraudulent providers, and are provided with improved access to quality health care from legitimate providers while preserving Trust Fund dollars.

Fraud Prevention System

In addition to traditional provider-enrollment activities, CMS' sophisticated predictive analytics technology, the Fraud Prevention System (FPS), identifies investigative leads to further protect the Medicare program from inappropriate billing practices and provide oversight on provider-enrollment actions. Since CMS implemented the technology in June 2011, the FPS has identified or prevented $820 million in inappropriate payments by identification of new leads or contribution to existing investigations; including approximately $242 million in cost-avoidance savings from revoking provider billing privileges as a result of FPS leads. n7

CMS is required to have the HHS-OIG certify the savings and costs of the FPS. CMS achieved certification in the second and third year of the program. For the first time in the history of federal health care programs, the HHS-OIG certified a methodology to calculate cost avoidance due to removing a provider from the program. This is a critical achievement as moving towards prevention requires a clear measurement of the future costs avoided. During the third year (defined in statute as January 2014 - December 2014), the FPS identified or prevented $454 million in inappropriate payments through actions taken due to the FPS or through investigations expedited, augmented, or corroborated by the FPS. Total savings were 80 percent higher in the third year than the savings from the previous implementation year, with a nearly 10:1 return on investment (ROI). expedited, augmented, or corroborated by the FPS. Total savings were 80 percent higher in the third year than the savings from the previous implementation year, with a nearly 10:1 return on investment (ROI).

Provider Enrollment

A critical component to preventing fraud, waste and abuse is to ensure that only legitimate providers have the ability to bill our programs in the first place. Provider enrollment is the gateway to billing our programs, and CMS is engaging in new efforts to make sure that only legitimate providers are enrolling in Medicare, Medicaid, and CHIP. By preventing fraudulent or unqualified providers or suppliers from enrolling in the program and removing existing unqualified providers and suppliers, CMS ensures that fewer beneficiaries are exposed to risks and harm, and taxpayer dollars are spent only on services provided by legitimate providers and suppliers.

The Affordable Care Act provided tools, including the use of risk-based screening of providers and suppliers, to enhance our ability to screen providers and suppliers upon enrollment and identify those that possibly may be at heightened risk for committing fraud. In February 2011, CMS finalized regulations to implement categorical risk-based screening of newly enrolling Medicare and Medicaid providers and suppliers and revalidate all current providers and suppliers under new requirements established by the Affordable Care Act. Provider and supplier types in the "limited risk" category undergo verification of licensure, verification of compliance with federal regulations and state requirements, and various database checks. Provider and supplier types in the "moderate risk" or "high risk" categories undergo additional screening, including unannounced site visits. Additionally, owners with a five percent or greater direct or indirect ownership interest in a provider or supplier that are in the high risk category must consent to criminal background checks including fingerprinting. This risk based approach to provider screening allows CMS to target our resources as efficiently as possible, applying the most scrutiny to higher risk categories while limiting the burden and requirements on the types of providers and suppliers that pose a lower risk.

We are seeing real results from our efforts, and we estimate that Affordable Care Act authorities have saved the Medicare program $1.4 billion from revocations since March 2011, protecting both beneficiaries and the Medicare Trust Funds. These actions are part of a larger set of provider enrollment and screening activities which have saved the Medicare program $2.4 billion in avoided costs. n8 These savings reflect the actions CMS has taken to deactivate billing privileges for more than 543,100 providers and suppliers that do not meet Medicare requirements, and to revoke the enrollment and billing privileges of an additional 34,800 providers and suppliers since 2011. n9 Increased screening efforts have led CMS to deny 7,293 applications in the last 12 months (February 2015-February 2016) based on improved enrollment screening, preventing these providers or suppliers from ever submitting a claim.

Provider Enrollment in Medicare

Before they can bill Medicare, all providers and suppliers are required to undergo a baseline screening, including confirmation of the provider's or supplier's Social Security Number through the Social Security Administration and license and certification through the state licensing boards; and searches in the General Services Administration's (GSA) System for Award Management for Government contracting exclusion (suspension and debarments) and the HHS-OIG's exclusion list for all individuals listed on the application. Additionally, all Medicare providers and suppliers already enrolled prior to the new screening requirements becoming effective were sent revalidation notices, and those that did not respond or did not meet these new screening requirements had their billing privileges deactivated or revoked.

To enroll in the Medicare program, a provider or supplier may submit its enrollment application online using the Provider Enrollment, Chain and Ownership System (PECOS) or by paper by sending a CMS-855 to its Medicare Administrative Contractor. PECOS is a centralized database that contains providers' and suppliers' enrollment information. that contains providers' and suppliers' enrollment information. that contains providers' and suppliers' enrollment information. When enrolling in Medicare, providers and suppliers (including physicians and non-physician practitioners) are required to supply on their application the address of the location from which they offer services, and we are taking steps to ensure that providers are practicing at the addresses they say they are in accordance with GAO's recommendations.

CMS is enhancing our address verification software in PECOS to better detect vacant or invalid addresses or commercial mail reporting agencies (CMRAs). Earlier this year, as recommended by the GAO, CMS replaced the previous PECOS address verification software with new software that includes Delivery Point Verification (DPV) in addition to the previous functionality. This new DPV functionality flags addresses that may be vacant, CMRAs, or invalid addresses. CMS is now continuously monitoring and identifying addresses that may have become vacant or non-operational after initial enrollment. This monitoring is done through monthly data analysis that validates provider and supplier enrollment practice location addresses against the U.S. Postal Service address verification database. Earlier this year, CMS also began deactivating providers and suppliers that have not billed Medicare in the last 13 months. n10 This approach will remove providers and suppliers with potentially invalid addresses from PECOS without requiring site visits. This work will strengthen the integrity of the Medicare program while minimizing burden on the provider and supplier community.

Additionally, CMS uses site visits to verify that a provider's or supplier's practice location meets Medicare requirements, which helps prevent questionable providers and suppliers from enrolling or maintaining enrollment in the Medicare program. As of May 2016, CMS has performed over 290,000 site visits on Medicare providers and suppliers since 2011. CMS has the authority, when deemed necessary, to perform onsite review of a provider or supplier to verify that the enrollment information submitted to CMS or its agents is accurate and to determine compliance with Medicare enrollment requirements. n11 Under this authority, CMS has increased site visits, initially focusing on those providers and suppliers receiving high reimbursements by Medicare that are located in high risk geographic areas. initially focusing on those providers and suppliers receiving high reimbursements by Medicare that are located in high risk geographic areas.

CMS has also made additional improvements to the National Site Visit Contractor (NSVC) training processes since the HHS-OIG completed a review of provider enrollment activities.n12 All NSVC inspectors are required to receive CMS approved training and testing and undergo annual retraining. In addition, reminders and updates to procedures are provided to the inspectors throughout the year through bulletins and newsletters. All site inspections are reviewed by an NSVC official before being submitted to CMS. In addition, certain site inspections undergo a second level of quality assurance by an independent official that includes interviews with the provider and the inspector. CMS may take corrective action based on the results of this process. 12

CMS Oversight of State Medicaid Provider Enrollment

Because Medicaid is jointly funded by states and the Federal Government and is administered by states within Federal guidelines, both the Federal Government and states have key roles as stewards of the program, and CMS and states work together closely to carry out these responsibilities.

States bear the primary responsibility for provider screening, credentialing, and enrollment for Medicaid. CMS has taken several steps to help states fulfill the requirement created by the Affordable Care Act to revalidate Medicaid providers. CMS has provided states with direct access to Medicare's PECOS enrollment database, as well as monthly PECOS data extracts that states can use to systematically compare state enrollment records against available PECOS information. CMS assigned staff to coordinate directly with each state and is providing extensive guidance and technical assistance to assist states on their revalidation efforts.

CMS published several toolkits to help address some of the most frequent findings from state program integrity reviews in the area of provider enrollment, both in fee-for-service and managed care. The toolkits address a wide range of issues, including issues with provider disclosures of ownership and control, business transactions, and criminal convictions; federaldatabase checks for excluded parties; and the reporting of adverse actions taken against providers to the HHS-OIG. The toolkits identify common issues observed and provide practical solutions that states can implement. n13 CMS has also taken several steps to help states conduct site visits and perform fingerprint-based criminal background checks for the relevant categories of providers.

In March 2016, CMS released additional guidance in the Medicaid Provider Enrollment Compendium n14 to help states in implementing various enrollment requirements including the site visit requirements and provider ownership disclosure requirements. CMS worked with the Federal Bureau of Investigation to publish guidance to help states implement fingerprint-based criminal background checks for providers in the high risk category. n15 CMS continues to help states implement the provider ownership disclosure requirements and other requirements through regular state program integrity reviews to assess the effectiveness of states' program integrity efforts.

As discussed earlier, CMS also recently finalized a rule n16 strengthening program integrity in Medicaid managed care by identifying minimum standards for provider screening and enrollment and expanding managed care plan responsibilities in program integrity efforts.

Enrollment Moratoria

CMS has used authority provided by the Affordable Care Act to impose temporary enrollment moratoria. The moratoria temporarily halted the enrollment of new home health agencies (HHAs) and ground ambulance suppliers in certain geographic areas, giving CMS the opportunity to analyze and monitor the existing provider and supplier base, as well as further focus additional fraud prevention and detection tools in these areas. CMS consulted with HHS-OIG and the Department of Justice, and found that fraud trends warranted these moratoria. Part of CMS' work included a review of key factors of potential fraud risk, including findings of a disproportionate number of providers and suppliers relative to beneficiaries, and extremely high utilization rates relative to comparable geographic areas. All the geographic areas named in the moratoria ranked high in these fraud risk factors. After imposing the initial moratoria on July 31, 2013, 848 HHAs and 14 ambulance companies in all geographic areas affected by the moratoria had their applications denied. n17

Earlier this year, CMS released a Moratoria Provider and Supplier Services and Utilization Data Tool.For the first release, the data provide information on the number of Medicare ambulance suppliers and home health providers servicing a geographic region, with moratoria regions at the state and county level clearly indicated, and the number of Medicare beneficiaries who use one of these services. The data can also be used to reveal the degree to which use of these services is related to the number of providers and suppliers servicing a geographic region. Provider and supplier services and utilization data by geographic regions are easily compared using the interactive maps. n18 The tool uses ambulance and HHA paid claims data within CMS systems for Medicare fee-for-service beneficiaries. The data, which do not contain any individually identifiable information about Medicare beneficiaries or their providers, cover the period from October 1, 2014 to September 30, 2015, and are updated quarterly. The tool includes interactive maps and a dataset that shows national-, state-, and county-level provider and supplier services and utilization data for selected health service areas.

Efforts to Identify and Address Improper Payments

CMS takes seriously our responsibility to limit improper payments and ensure that taxpayers' dollars are spent wisely. It is important to remember that improper payments are not typically fraudulent payments. Rather, they are usually payments made for items or services that do not meet Medicare or Medicaid's coverage and medical necessity criteria, that are incorrectly coded, or that do not include the necessary documentation. Correctly recording and documenting medical services is an important part of good stewardship of these programs, and we strive to improve these practices among providers serving Medicare, Medicaid, and CHIP beneficiaries.

While some progress has been made, we must and we will continue our work to reduce the improper payment rates in Medicare, Medicaid, and CHIP. We experienced reductions in the Medicare-fee for service error rate from 2014 to 2015, as CMS's "Two Midnight" rule and corresponding educational efforts led to a reduction in improper inpatient hospitals claims. The improper payment rate for durable medical equipment, prosthetics, orthotics and supplies (DMEPOS) also decreased. Corrective actions implemented over a six-year period, including the DMEPOS Accreditation Program, contractor visits to large supplier sites, competitive bidding, and a demonstration testing prior authorization of power mobility devices, contributed to the reduction in the improper payment rate for these items and supplies.

We know we have more work to do to sustain this progress and meet improper payment rate reduction targets. One area in Medicare fee-for-service on which we are focusing our efforts is in home health services, which have had particularly high improper payment rates in recent years, mainly due to documentation errors. To address this, CMS has made changes to what providers need to submit in order to comply with our payment policies and clarified these policies for providers. CMS believes clarifying requirements will lead to a decrease in these errors and improve provider compliance with regulatory requirements, while continuing to strengthen the integrity of the Medicare program. To ensure providers understand the regulations and documentation requirements, CMS has implemented a probe and educate program for all home health agencies. This program reviews a small number of claims for every home health agency, identifies whether the reviewed claims complied with Medicare policies, and offers education to providers who require assistance in properly documenting home health claims.

CMS has also implemented additional prior authorization models to help make sure services are provided in compliance with Medicare coverage, coding, and payment rules before services are rendered and claims are paid. Through prior authorization, a request for provisional affirmation of coverage is submitted for review before a service is furnished to a beneficiary and before a claim is submitted for payment. Prior authorization does not create additional documentation requirements or delay medical service. It requires the same information that is currently necessary to support Medicare payment, but earlier in the process. Prior authorization is an effective way to promote compliance with Medicare rules for some items and services and to help prevent improper payments before they occur.

In addition to certain power mobility devices (PMDs), CMS is now utilizing a prior authorization process in certain states for non-emergent hyperbaric oxygen therapy and repetitive scheduled non-emergent ambulance transports. n19 Lastly, CMS published a final regulation on December 30, 2015 establishing a prior authorization program for certain durable medical equipment, prosthetics, orthotics, and supplies items frequently subject to unnecessary utilization. n20

The Medicare Prior Authorization of PMDs Demonstration was initially implemented in California, Illinois, Michigan, New York, North Carolina, Florida, and Texas. Since implementation, we have observed a decrease in expenditures for PMDs in the demonstration states and non-demonstration states. Based on claims processed from September 1, 2012 through June 2015, monthly expenditures for the PMD codes included in the demonstration decreased from $12 million to $3 million in the seven original demonstration states, without affecting beneficiary access to appropriate services. Subsequently, we expanded the demonstration to twelve additional states n21 on October 1, 2014. Based on claims processed from September 1, 2012 through June 2015, monthly expenditures in these twelve additional states decreased from $10 million to $2 million. On July 15, 2015, we extended the demonstration for all nineteen states until August 31, 2018. Monthly expenditure also decreased in the non-demonstration states, from $10 million in September 2012 to $3 million in June 2015. n22

We also have more work to do to meet error rate reduction targets in Medicare Advantage, Medicaid, and CHIP. To better address and prevent improper payments in Medicare Advantage, in December 2015, CMS issued a Request for Information (RFI) n23 to solicit feedback on a proposal to contract with one or more Recovery Auditors (RA) to identify and correct improper payments in Medicare Advantage through a significantly expanded Risk Adjustment Data Validation (RADV) audit initiative. As a result of existing RADV audits and new regulations requiring Medicare Advantage organizations to report and return identified overpayments, during FY 2015, Medicare Advantage Organizations reported and returned approximately $650 million in overpayments.

Medicaid and CHIP also experienced increases with their improper payment rates from fiscal year 2014 to 2015. Similar to FY 2014, the primary reason for the increase was related to state difficulties bringing systems into compliance with certain requirements, including that all referring or ordering providers be enrolled in Medicaid and that states screen providers under a risk-based screening process prior to enrollment. While these requirements will ultimately strengthen Medicaid's integrity, it is not unusual to see increases in improper payment rates following the implementation of new requirements because it takes time for states to make systems changes required for compliance.

Conclusion

CMS is deeply committed to our efforts to prevent waste, fraud and abuse in Medicare and Medicaid programs, protecting both taxpayers and the beneficiaries that we serve. The GAO and HHS-OIG are critical partners in these continuous improvement efforts, and both programs are stronger today as a direct result of their insights. We look forward to continuing our partnership with GAO and OIG to work together on additional ways to identify and eliminate vulnerabilities and to strengthen both of these programs.

n1 http://www.gao.gov/products/GAO-13-761

n2 http://oig.hhs.gov/oei/reports/oei-02-10-00040.pdf

n3 http://oig.hhs.gov/oei/reports/oei-03-13-00030.pdf

n4 For more information: https://blog.cms.gov/2016/02/22/cms-strengthens-provider-and-supplier-enrollment-screening/

n5 https://www.federalregister.gov/articles/2016/05/06/2016-09581/medicaid-and-childrens-health-insurance-program-chip-programs-medicaid-managed-care-chip-delivered

n6 See, for example, OIG, State and CMS Oversight of the Medicaid Managed Care Credentialing Process (OEI-09-10-00270) (Nov. 2013), available at http://oig.hhs.gov/oei/reports/oei-09-10-00270.pdf; OIG, Excluded Providers in Medicaid Managed Care Entities (OEI-07-09-00630) (Feb. 2012), available at https://oig.hhs.gov/oei/reports/oei-07-09-00630.pdf; OIG, Medicaid Managed Care: Fraud and Abuse Concerns Remain Despite Safeguards (OEI-01-09-00550) (Dec. 2011), available at http://oig.hhs.gov/oei/reports/oei-01-09-00550.pdf.

n7 Report to Congress: Fraud Prevention System Third Implementation Year. Available at: http://www.cms.gov/About-CMS/Components/CPI/Center-for-program-integrity.html

n8 These savings estimates use the same methodology as the identified "costs avoided by revoking billing privileges" savings measure that was certified by the OIG in the 2nd and 3rd Year FPS Reports to Congress. Please see CMS' Report to Congress: Fraud Prevention System Third Implementation Year, for more information (available at: http://www.cms.gov/About-CMS/Components/CPI/Center-for-program-integrity.html). While these particular estimates have not been certified by the OIG, they reflect comparable calculations applied to actions taken under authorities provided in both the Affordable Care Act and CMS' previously existing authorities.

n9 Deactivated providers and suppliers have their Medicare billing privileges stopped; however, their billing privileges can be restored upon the submission and approval of an updated enrollment application. Revoked providers and suppliers have their Medicare billing privileges terminated and are barred from re-entering the Medicare program for a period of one to three years, depending on the severity of the revocation.

n10 Note: Providers and suppliers that may be exempted from the deactivation for non-billing include: those enrolled solely to order, refer, prescribe; or certain specialty types (e.g., pediatricians, dentists and mass immunizers (roster billers)).

n11 42 C.F.R. 424.517

n12 http://oig.hhs.gov/oei/reports/oei-03-13-00050.asp

n13 https://www.cms.gov/Medicare-Medicaid-Coordination/Fraud-Prevention/FraudAbuseforProfs/frequent-findings-toolkits-121714.html

n14 https://www.medicaid.gov/affordablecareact/provisions/downloads/mpec-032116.pdf

n15 https://www.medicaid.gov/federal-policy-guidance/downloads/smd060115.pdf

n16 https://www.federalregister.gov/articles/2016/05/06/2016-09581/medicaid-and-childrens-health-insurance-program-chip-programs-medicaid-managed-care-chip-delivered

n17 https://www.federalregister.gov/articles/2016/02/02/2016-01835/medicare-medicaid-and-childrens-health-insurance-programs-announcement-of-the-extended-temporary

n18 https://data.cms.gov/moratoria-data

n19 For more information: https://www.cms.gov/Research-Statistics-Data-and-Systems/Monitoring-Programs/Medicare-FFS-Compliance-Programs/Prior-Authorization-Initiatives/Prior-Authorization-Initiatives-.html

n20 https://www.cms.gov/Research-Statistics-Data-and-Systems/Monitoring-Programs/Medicare-FFS-Compliance-Programs/Prior-Authorization-Initiatives/Downloads/DMEPOS_6050_Final_12_30_15.pdf

n21 Maryland, New Jersey, Pennsylvania, Indiana, Kentucky, Ohio, Georgia, Tennessee, Louisiana, Missouri, Washington, and Arizona.

n22 https://www.cms.gov/Research-Statistics-Data-and-Systems/Monitoring-Programs/Medicare-FFS-Compliance-Programs/Medical-Review/Downloads/PMDDemoOctoberStatusUpdate10142015.pdf

n23 https://www.fbo.gov/index?s=opportunity&mode=form&id=83f1ec085c52a81a6a6ce7cba3ffbc5d&tab=core&_cview=0

Read this original document at: http://docs.house.gov/meetings/IF/IF02/20160524/104979/HHRG-114-IF02-Wstate-AgrawalS-20160524.pdf