oversight

Medicaid Fraud and Abuse: Stronger Action Needed to Remove Excluded Providers From Federal Health Programs

Published by the Government Accountability Office on 1997-03-31.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                 United States General Accounting Office

GAO              Report to the Chairman, Subcommittee
                 on Human Resources and
                 Intergovernmental Relations, Committee
                 on Government Reform and Oversight,
                 House of Representatives
March 1997
                 MEDICAID FRAUD
                 AND ABUSE
                 Stronger Action
                 Needed to Remove
                 Excluded Providers
                 From Federal Health
                 Programs




GAO/HEHS-97-63
      United States
GAO   General Accounting Office
      Washington, D.C. 20548

      Health, Education, and
      Human Services Division

      B-275645

      March 31, 1997

      The Honorable Christopher Shays
      Chairman, Subcommittee on Human Resources
        and Intergovernmental Relations
      Committee on Government Reform and Oversight
      House of Representatives

      Dear Mr. Chairman:

      Medicaid, a joint federal-state health program for the poor, spent
      approximately $160 billion in 1996 to provide health care coverage for
      about 37 million people. Because of its size and complex structure,
      Medicaid is vulnerable to fraud and abuse. State Medicaid agencies have
      the primary responsibility to protect the program’s financial integrity and
      to ensure that beneficiaries have access to quality care. This responsibility
      includes ensuring that appropriate safeguards are in place to remove from
      state programs those providers that commit fraud or abuse or those that
      are incompetent. State Medicaid agencies must report providers they
      remove from their programs to the Office of the Inspector General (OIG),
      Department of Health and Human Services (HHS). The OIG is responsible
      for determining whether the circumstances that resulted in states’
      removing providers warrant promptly excluding them from federal health
      care programs nationwide.

      Exclusion should be a strong deterrent to unacceptable providers, but the
      deterrent effect is diluted if they can continue to receive payment for
      program services. Concerned that this situation could be occurring, you
      asked us to examine how well the OIG’s exclusion process is working. On
      September 5, 1996, we testified before the Subcommittee on the
      preliminary results of our work,1 which suggested several weaknesses in
      the OIG’s exclusion process. In some instances, these weaknesses have
      resulted in unacceptable providers continuing to participate in federal
      health care programs. The HHS Inspector General agreed with our findings
      and testified that she was taking steps to strengthen the process.

      In this report, we present the final results of our work, expanding on our
      testimony concerning the weaknesses in the OIG’s process. In addition, we
      ascertained what corrective actions the OIG has taken or plans to take and
      further examined the problems states experience when using OIG


      1
       Fraud and Abuse: Providers Excluded From Medicaid Continue to Participate in Federal Health
      Programs (GAO/T-HEHS-96-205, Sept. 5, 1996).



      Page 1                                             GAO/HEHS-97-63 Medicaid Fraud and Abuse
                   B-275645




                   exclusion data. Moreover, we interviewed officials from the OIG and Health
                   Care Financing Administration (HCFA)—the agency that administers
                   Medicaid at the federal level—to determine their plans to improve health
                   care provider data systems, as required by the Health Insurance Portability
                   and Accountability Act of 1996.

                   In developing information for this report, we visited Illinois, Maryland,
                   Missouri, New York, Virginia, and Washington, D.C.2 To understand the
                   processes for removing providers from state Medicaid programs, we
                   worked with officials of state Medicaid agencies, Medicaid fraud control
                   units (MFCU), and state licensing boards. We also met with officials from
                   the four OIG field offices—Chicago, New York, Philadelphia, and
                   Washington, D.C.3—that oversee these six states and with officials from
                   OIG and HCFA headquarters. At selected state agencies, we reviewed case
                   files for a judgmentally selected sample of providers that the states
                   determined had abused the Medicaid program to ascertain the nature of
                   the providers’ wrongdoing and whether they had been referred to the OIG.
                   We followed up at the Chicago, New York, and Philadelphia OIG field
                   offices to determine whether they acted on the referrals and at Medicare
                   contractors to determine whether providers continued to participate in
                   Medicare after they had been excluded from Medicaid. Our scope and
                   methodology are discussed in more detail in appendix I.


                   Over the years, the OIG, working with state agencies, has excluded
Results in Brief   thousands of providers from participating in federal health care programs
                   because of health care fraud, abuse, or quality-of-care problems, thus
                   helping to protect the financial integrity of those programs and decreasing
                   the likelihood that program beneficiaries receive substandard care.
                   However, several weaknesses in this exclusion process allow many
                   unacceptable providers to remain on the rolls of federal health programs.
                   The weaknesses we identified include (1) lack of controls at OIG field
                   offices to ensure that all state referrals received are reviewed and acted on
                   promptly, (2) inconsistencies among OIG field offices as to the criteria for
                   excluding providers, (3) lack of oversight to ensure that states make
                   appropriate exclusion referrals to the OIG, and (4) problems states
                   experience in attempting to identify and remove from their programs
                   providers that appear on the OIG’s exclusion list.



                   2
                    In this report, we refer to Washington, D.C., as a state.
                   3
                    In September 1996, the Washington field office became a suboffice of the Philadelphia field office.



                   Page 2                                                   GAO/HEHS-97-63 Medicaid Fraud and Abuse
             B-275645




             These weaknesses place the health and safety of beneficiaries at risk and
             compromise the financial integrity of Medicaid, Medicare, and other
             federal health programs. For example, OIG delays in acting on state
             referrals allowed one physician to receive nearly $61,000 for services
             provided to Medicare patients; these services were provided for more than
             2 years after a state Medicaid program had removed him for maintaining
             an unacceptable practice. Moreover, difficulties states experienced in
             using OIG exclusion data allowed some providers to continue to be
             enrolled in a state Medicaid program after they had been excluded
             nationwide by the OIG. In one state, there were 13 instances in which this
             occurred. One of the providers had been paid over $25,000 since being
             excluded by the OIG.

             OIG officials attributed many of these problems to repeated cutbacks in
             resources occurring in the past several years. The Health Insurance
             Portability and Accountability Act of 1996, however, addresses this
             concern by providing the OIG with extra funding, specifically for dealing
             with health care fraud. Some of this funding, officials said, will be used to
             hire additional staff to process exclusion referrals. The act also includes
             tools and resources to facilitate identifying unacceptable providers. These
             tools include a system of unique billing numbers for health care
             providers—to be developed to reduce the potential for inappropriate
             payments—and an adverse action data bank—to be established to record
             information on any adverse action taken against a health care provider.
             When implemented, these tools should help to limit the number of
             providers excluded from one program that continue to participate in
             others.

             In the interim, the HHS Inspector General has initiated actions to improve
             the effectiveness of the exclusion process. For example, the OIG has
             initiated a system to track all incoming exclusion referrals, staff have
             received additional training to improve the consistency and quality of
             exclusion processing, and outreach efforts are under way to help ensure
             that states forward all required information. While these efforts are
             significant, we believe further refinements are necessary to improve the
             exclusion process.


             The Secretary of HHS has delegated to the OIG the authority, under sections
Background   1128 and 1156 of the Social Security Act, to exclude certain health care




             Page 3                                  GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645




providers from most federal health care programs.4 Under the law, the OIG,
which acts through its Office of Investigations, must exclude, nationwide,
providers that have been convicted of a criminal offense related to
Medicare5 or any state health care program, a criminal offense related to
patient abuse or neglect, or a felony related to other health care fraud or
controlled substances. Under these circumstances, providers fall into the
category of “mandatory exclusions.”

The OIG also has authority to exclude individuals or organizations if the OIG
determines that the particular facts in a case meet certain criteria. These
actions are termed “permissive exclusions.” They may be based on, for
example, submitting excessive claims, license suspensions and
revocations, and sanctions imposed by federal or state health agencies.
(See app. II for the legal bases for exclusions.)

OIG field offices receive exclusion referrals from state Medicaid agencies,
licensing boards, MFCUs,6 and others. For mandatory exclusion cases, the
field offices assemble and forward to headquarters the case files
containing evidence of a provider’s criminal conviction. For other
referrals, which could result in permissive exclusions, the field offices
receive documents on disciplinary actions taken by state Medicaid
agencies, licensing boards, or others. The field offices assess the relevant
facts and forward to OIG headquarters the names of providers they
recommend for exclusion. OIG headquarters makes the final decision on
excluding the provider from program enrollment.

When the OIG excludes a provider, it sends notification letters to
organizations—such as state Medicaid agencies, Medicare contractors,
and state licensing boards—in the states in which the provider is known to
practice or operate. When applicable, the provider’s employer is also
notified. In addition, the OIG provides HCFA with periodic cumulative


4
 OIG exclusions apply to Medicare (title XVIII of the Social Security Act) and state health care
programs, defined as Medicaid (title XIX), Maternal and Child Health Services Block grant (title V),
and Block Grants to States for Social Services (title XX). As a result of the Federal Acquisition
Streamlining Act of 1994, which mandates and expands the governmentwide effect of all debarments,
suspensions, and other exclusionary actions on federal procurement and nonprocurement programs,
OIG exclusions also apply to health care providers participating in the Federal Employees’ Health
Benefits Program (FEHBP), administered by the U.S. Office of Personnel Management, and the
Civilian Health and Medical Program of the Uniformed Services (CHAMPUS), administered by the
Department of Defense.
5
 Medicare is the federal program financing health care for the nation’s elderly and disabled.
6
 Most states have MFCUs that must be organizationally independent of the agency that operates the
state Medicaid program. An MFCU is usually a component of the state attorney general’s office.
MFCUs investigate and prosecute provider fraud and cases relating to neglect or abuse of patients in
nursing homes and other facilities.


Page 4                                                 GAO/HEHS-97-63 Medicaid Fraud and Abuse
                             B-275645




                             reports and monthly updates on excluded providers, which HCFA
                             distributes nationally.

                             As of October 1996, about 9,500 providers were excluded from federal
                             health care programs nationwide. Three exclusion categories—conviction
                             for program-related crime, conviction for a criminal offense related to
                             patient abuse or neglect, and license suspensions and
                             revocations—accounted for 76 percent of these nationwide exclusions.


                             Unless the OIG maintains accountability for state exclusion referrals,
OIG Process Does Not         providers that have committed fraud or rendered substandard care to
Ensure Accountability        Medicaid beneficiaries in one state can continue to provide services (1) to
and Timely Resolution        Medicaid beneficiaries in other states, (2) under Medicare, or (3) through
                             other federal health programs. Likewise, long delays in processing
of All Exclusion             exclusion referrals allow unacceptable providers to continue to provide
Referrals                    services in federal health care programs. In our review of a judgmental
                             sample of 88 state exclusion referrals to three OIG field offices, we found
                             that almost one-half of the referrals had significant processing problems.
                             Field offices had no record of 11 referrals. Processing time for another 30
                             referrals, or 34 percent, was 1 year or longer. All of the missing and
                             delayed referrals occurred among the 66 referrals we followed up on in the
                             Chicago and New York field offices. In these offices, long delays occurred
                             for both mandatory referrals—which the OIG is required by law to
                             exclude—and permissive referrals—for which the OIG has to decide
                             whether certain exclusion criteria are met. While these referrals remained
                             unresolved, some providers received thousands of dollars from Medicare.


Accountability Lacking for   OIG field offices could not account for all referrals received from state
Referrals                    agencies. While the Philadelphia field office had files for all 22 referrals we
                             reviewed, the Chicago and New York field offices had no records for 11 of
                             the 66 state referrals we checked.

                             The Chicago field office could not locate 5 of 18 referrals from the Illinois
                             Medicaid program and 1 of 14 referrals from the Illinois MFCU. Moreover,
                             three of the state Medicaid agency referrals involved serious
                             quality-of-care issues. For example, in April 1995, the Illinois Medicaid
                             agency excluded a dentist from its program for providing care that placed
                             his patients at risk. Among the charges was that the dentist had performed
                             surgical extractions and had given patients general anesthesia without
                             documented need. The state Medicaid agency’s case file on this dentist



                             Page 5                                   GAO/HEHS-97-63 Medicaid Fraud and Abuse
                       B-275645




                       showed that he had been referred to the OIG in June 1995. When we
                       inquired at the Chicago field office in March 1996, however, no record
                       could be found of the case. After our inquiry, the office opened a case file
                       on the dentist and he was excluded by the OIG in December 1996. During
                       the 17-month period between state removal from Medicaid and OIG
                       exclusion from all federal health care programs, this dentist received over
                       $13,000 for services provided to Medicare patients.

                       Likewise, the New York field office had no record for 5 of the 28 referrals
                       we reviewed that the New York Medicaid officials claimed had been
                       referred to the OIG. Specifically, the field office had no record of a
                       physician who had been excluded from the state’s Medicaid program over
                       a year earlier for a variety of quality-of-care problems, such as failure to
                       evaluate patient problems and overutilization of laboratory and other
                       tests. From the time this physician was removed from Medicaid in New
                       York, Medicare had paid him over $108,000, as of November 1996. In
                       another case, the field office had no record of a durable medical
                       equipment supplier who had been removed from Medicaid 2 years earlier,
                       after an audit determined that the supplier had overbilled the Medicaid
                       program by more than $173,000.


Delays in Processing   OIG processing of state referrals was sometimes delayed while the Chicago
Exclusion Referrals    and New York field offices waited for states to send in documents needed
                       by the OIG to exclude the provider nationwide. In mandatory exclusion
                       cases, the OIG requires copies of conviction and sentencing documents; in
                       permissive cases, the OIG requires basic information describing what the
                       provider did to bring about the state removal. The extent to which states
                       furnished such documentation when referring a case to the OIG varied
                       among state agencies we contacted. This variation seemed due, in part, to
                       an absence of clear guidance from the OIG on the documentation needed
                       for exclusion processing. Moreover, when these documents were not
                       provided with the referral, case files often did not show any indication of
                       field office follow-up to obtain the missing information. Even after all the
                       information was received, some case files showed long periods of
                       inactivity. OIG guidance requires that after field office staff receive a
                       permissive exclusion referral, they must decide, within 60 working days,
                       whether to pursue exclusion. However, the guidance does not set any
                       standards or performance goals for actually processing state referrals after
                       the decision is made to pursue an exclusion.




                       Page 6                                  GAO/HEHS-97-63 Medicaid Fraud and Abuse
    B-275645




    In contrast to the Chicago and New York field offices, the Philadelphia
    field office resolved all of the 22 referrals we reviewed in less than 1 year
    and most took 6 months or less. This situation appeared to be due, in part,
    to the Maryland MFCU—the state agency whose referrals we selected for
    follow-up in the Philadelphia field office—consistently sending the field
    office all the required documentation.

    The following examples illustrate the delays we found in Chicago and New
    York (additional examples can be found in app. III):

•   A pharmacy was removed for overbilling the Illinois Medicaid program by
    more than $117,000. The Chicago field office took 15 months to forward
    this permissive exclusion case to headquarters. The case file showed no
    activity for extended periods of time, including a 10-month period.
•   In a mandatory exclusion case, the Chicago field office referred a provider
    to headquarters for exclusion 19 months after the Illinois MFCU notified it
    that the provider had pled guilty and was sentenced in state court for
    falsely billing for Medicaid services. Two-and-one-half months after the
    case was forwarded to OIG headquarters, the provider was excluded
    nationwide.
•   In another mandatory exclusion case, a dentist was sentenced in June 1995
    for stealing more than $220,000 from New York’s Medicaid program,
    charging for more expensive procedures when less expensive ones were
    actually performed or charging for services not provided. State delays in
    providing documents on the sentencing initially delayed the New York
    field office’s processing of the case. These documents were received in
    November 1995, but no further action had been taken on the case until a
    few days before we reviewed it in November 1996.
•   The Medicare program in New York paid a physician nearly $61,000 during
    the more than 2-year period from the time the state Medicaid agency in
    New York notified the OIG field office that it had removed a physician to
    the time the OIG excluded the physician from all federal health programs.
    The state had removed the physician from Medicaid for maintaining an
    unacceptable practice, keeping inadequate records, and for
    inappropriately sharing fees for professional services. We reviewed the
    New York field office case file on this permissive exclusion, and it showed
    inactivity for extended periods of time, including one 17-month period.
•   In a similar permissive exclusion case, OIG headquarters decided not to
    pursue exclusion against a physician, who had been removed from New
    York’s Medicaid program for providing poor quality of care to Medicaid
    beneficiaries, because it considered the case too old to pursue. The field




    Page 7                                  GAO/HEHS-97-63 Medicaid Fraud and Abuse
                        B-275645




                        office had received the referral 18 months earlier. Since exclusion from
                        Medicaid, Medicare in New York had paid this physician over $86,000.


                        We identified inconsistencies in the way the OIG has handled permissive
Processing of           exclusions, that is, cases in which the OIG has discretion on whether to
Permissive Exclusions   recommend nationwide exclusion. In 1987, the OIG was given expanded
Inconsistent Among      discretionary authority to exclude providers nationwide.7 The OIG,
                        however, has not always used its expanded exclusion authority
Field Offices           consistently. Given competing demands on the OIG’s time, permissive
                        exclusions have sometimes had a relatively low priority, OIG officials said.
                        In October 1992, the OIG instructed its field offices to process state
                        Medicaid agency and licensing board disciplinary actions only when actual
                        harm was done to patients and the provider had moved to another state.
                        Field offices, in turn, asked state agencies to refer only these kinds of
                        cases. About a year later, however, the OIG rescinded this guidance and
                        state agencies were asked once again to refer all cases.

                        We also observed inconsistencies in the way field offices process
                        permissive exclusion cases. As a result, providers with equally serious
                        problems could be treated differently by the OIG, depending on location.
                        For example, the Washington, D.C., field office would not consider
                        recommending nationwide exclusion unless a state Medicaid agency had
                        excluded the provider or a licensing board had revoked a license for at
                        least 1 year, a field office official said. The Chicago and New York field
                        offices, however, use a 2-year rule of thumb. Moreover, cases that
                        appeared to be equally serious received different treatment in the same
                        field office. For example, the New York field office forwarded to OIG
                        headquarters a physician’s case for nationwide exclusion after the state
                        Medicaid agency removed the physician. The reasons for removal were
                        providing excessive services, treating patients inappropriately with the
                        wrong medications, and not performing sufficient testing to determine the
                        cause of patients’ complaints. This field office, however, did not forward
                        the case of another physician, whom the state had removed for similar
                        reasons about a year earlier. The field office case file lacked an
                        explanation or rationale for why this case had not been investigated. The
                        regional inspector general, the head of the field office, said the office’s
                        large backlog of cases and shortage of staff accounted for the situation.




                        7
                         Medicare and Medicaid Patient and Program Protection Act of 1987 (P.L. 100-93).



                        Page 8                                              GAO/HEHS-97-63 Medicaid Fraud and Abuse
                            B-275645




                            Section 1902 of the Social Security Act requires state Medicaid agencies to
OIG Oversight of State      report to HHS whenever a provider of services is terminated, suspended, or
Agencies Could Be           otherwise sanctioned or prohibited from participating in the program.8 For
Improved                    purposes of indicating which providers the OIG may exclude, HHS
                            regulations define the term “otherwise sanctioned” as intending to cover
                            all actions that limit the ability of a person to participate in the program,
                            regardless of what such an action is called, including situations in which
                            an individual or entity voluntarily withdraws from a program to avoid a
                            formal sanction (42 C.F.R. 1001.601).

                            We found, however, that states were not always clear about reporting
                            requirements and OIG field offices did not monitor state agencies to ensure
                            that all cases that fell under the OIG’s exclusion authority were being
                            referred. Consequently, the OIG was not informed of all providers that had
                            committed fraud or abuse or had furnished poor quality of care in a state
                            Medicaid program; such providers could therefore continue providing
                            services to beneficiaries under Medicare or other state Medicaid programs.


Some State Medicaid         During our state visits, we found that four state Medicaid agencies did not
Agencies Not Reporting to   always report removals. Two states—Illinois and New York—did not
the OIG                     notify the OIG of certain providers effectively removed from their
                            programs; Missouri did not report removals to the appropriate OIG field
                            office. Further, the Medicaid agency in Washington, D.C., did not report
                            any removals to the OIG because officials were unaware of the reporting
                            requirements.

                            In Illinois, the state Medicaid program sometimes negotiates a settlement
                            agreement with a provider against whom it has initiated removal
                            proceedings because of, for example, serious quality-of-care problems.
                            The settlement, in effect, excludes the provider, but the state does not
                            spend the time and resources needed to pursue a formal action. In such an
                            agreement, the provider admits no wrongdoing, but agrees to withdraw
                            from participation in Medicaid. The provider also forfeits the right to
                            appeal if denied reinstatement at a later date. The provider does not,
                            however, face the prospect of losing the license to practice because,
                            according to state Medicaid officials, the case is not referred to the state
                            licensing board. In addition, the state does not report such a case to the
                            OIG. This settlement enables Illinois to remove providers from its Medicaid
                            program relatively quickly and keep them out. But, because the state does

                            8
                             Section 1902 of the act also requires MFCUs to operate in accordance with standards established by
                            the Secretary of HHS. One of these standards requires MFCUs to report convictions to the OIG.



                            Page 9                                               GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645




not refer these actions to the state licensing board or the OIG, the providers
may continue to provide services like those for which the state sought the
provider’s removal from Medicaid.

As of June 1996, about 23 percent of the physicians not allowed to
participate in the Illinois Medicaid program had withdrawn rather than
face an adverse action. When we checked on the Medicare status of four
providers who had withdrawn from Medicaid between 1992 and 1995, we
found that all four were still enrolled in Medicare and three continued to
bill for services. These providers had withdrawn from Medicaid for serious
quality-of-care problems. For example, Medicare paid a podiatrist over
$32,000 for services provided to program beneficiaries after he had
withdrawn from the Illinois Medicaid program in August 1995. The
podiatrist withdrew from the program after the state alleged that he had
provided grossly inferior care to Medicaid beneficiaries. Another provider,
a physician, withdrew in April 1995, after the state charged him with
providing poor care to Medicaid beneficiaries. The following were among
the allegations made by the state: diagnoses were inconsistent with
medical findings, abnormal laboratory test results were not addressed, and
medications were used without clinical indications. Since this physician’s
withdrawal from Medicaid, Medicare has paid him over $7,000.

In commenting on this report, Illinois said that federal requirements for
state reporting of negotiated settlements were unclear. Specifically, the
state questioned whether a direct link existed between the statute—which
requires state Medicaid agencies to report providers who are “otherwise
sanctioned”—and the federal regulation—which defines the term to
explain the circumstances under which the OIG may impose a permissive
exclusion. Although the regulation may be somewhat unclear, the OIG
interprets it as requiring states to report providers who voluntarily
withdraw from the Medicaid program.

We do not know how many states, other than Illinois, allow providers to
avoid adverse action by withdrawing from Medicaid. In four other states
we visited—Maryland, Missouri, Virginia, and Washington, D.C.—such
withdrawals seldom occurred or were not allowed. In the remaining state,
New York, providers are sometimes allowed to withdraw from its
program, but state Medicaid officials said these cases are reported to the
OIG, the state licensing board, and others. New York, however, removes
certain providers it suspects of abuse, but does not report the cases to the
OIG. New York program regulations permit either the provider or the state
Medicaid agency to end the provider’s participation in the program



Page 10                                 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645




“without cause,” with 30 days’ written notice. This practice has been used
primarily against pharmacies that the state suspected were heavily
involved in dispensing prescription drugs easily diverted to illicit use. As a
result, the state agency has been able to deal quickly with pharmacies that
it believed were involved in drug diversion.

In the course of our work, we identified two other problems in state
reporting to the OIG. In Missouri, for over 1 year, referrals from the
Missouri Medicaid program did not reach the OIG’s Chicago field office
because of some confusion associated with the closure of the OIG’s Kansas
City field office and a realignment of responsibilities.9 One of the referrals
that was not promptly considered involved a pediatric dentist who had
been removed from the Missouri Medicaid program in May 1995, after the
state licensing board had revoked his license. Among the numerous
charges of poor quality of care against this dentist was that while
attempting to administer a local anesthetic, he penetrated the nasal cavity
of one child and pierced the jaw of another. He was also charged with
being abusive to a patient by striking her and, in another case, failing to
consult with a child’s parent before extracting four front teeth. A program
analyst in the Chicago field office told us he first became aware of, and
started working on, this case in March 1996, after receiving information on
the dentist’s license revocation from the state dental board. The dentist
was excluded nationwide by the OIG in August 1996—approximately 15
months after he had been excluded from the Medicaid program in
Missouri.

Finally, in Washington, D.C., Medicaid officials told us they did not report
disciplinary actions to the OIG, and the official with overall responsibility
for provider enrollment and removal did not know of the requirement to
do so. Records in Washington’s Medicaid agency indicated that as of
August 1996, 36 providers had been removed from its program for
disciplinary reasons. In one case, the Medicaid agency had removed a
provider in April 1994 for poor quality of care and patient abuse.




9
 In April 1996, Missouri Medicaid officials told us that they reported providers they had removed from
their program to the OIG’s Kansas City investigations field office. According to OIG officials, however,
this office had been closed about a year earlier and the state should have been reporting cases to the
Chicago field office. Missouri officials said that the information sent to the Kansas City field office was
never returned, so they had no way of knowing it was not being received. Chicago OIG officials were
unaware that they were not receiving cases from the state Medicaid agency until we brought this to
their attention.



Page 11                                                 GAO/HEHS-97-63 Medicaid Fraud and Abuse
                             B-275645




State MFCUs May Not          In May 1996, the OIG began an effort, known as Project WEED, designed, in
Have Reported All            part, to determine if state MFCUs were reporting all mandatory exclusion
Convictions                  cases. The project identified over 400 convictions resulting from MFCU
                             investigations that, the OIG contended, had not been reported to its field
                             offices. Although some of these cases may not have been reported to the
                             OIG, the OIG may have been unaware of others because field offices lacked
                             accountability over cases, as discussed earlier. One MFCU representative
                             we contacted acknowledged his unit had not been reporting cases.
                             However, a representative from another unit, which accounted for nearly
                             one-third of the Project WEED cases, told us the cases had been reported
                             to the appropriate field office.

                             We believe that the OIG needs to provide clearer guidance to states on its
                             reporting requirements. We also believe improved oversight by OIG field
                             offices of key state agencies that refer cases to the OIG, such as MFCUs and
                             state Medicaid agencies, would at least identify those agencies that are not
                             reporting. Improved oversight would also allow the OIG to be better
                             informed about the extent of states’ compliance with statutory reporting
                             requirements for removed providers.


                             The OIG and HCFA periodically provide state Medicaid agencies with lists of
States Sometimes             providers that have been excluded from federal health care programs.
Have Difficulty              States are expected to use these exclusion data to ensure that
Identifying                  OIG-excluded providers are removed from their Medicaid programs, if
                             currently enrolled, or prevented from enrolling at a later date. Limitations
OIG-Excluded                 in OIG’s exclusion data and inconsistencies between OIG and state tracking
Providers                    systems, however, can make it difficult for states to identify excluded
                             providers. As a result, providers that have been excluded nationwide by
                             the OIG sometimes continue to be enrolled in state Medicaid programs. The
                             Health Insurance Portability and Accountability Act of 1996 contains
                             provisions that could make the identification and tracking of excluded
                             providers easier and more reliable, but these improvements are most likely
                             years away from implementation.


Exclusion Data Distributed   About twice a year, the OIG prepares a Cumulative Sanction Report, which
to State Medicaid Agencies   is an alphabetical list of all individuals and organizations that have been
                             excluded nationwide from federal health programs. For each name listed,
                             the report shows date of birth and Social Security number (for
                             individuals), health care specialty or type of business, and address. Also
                             shown is the authority used to impose the exclusion and the date the



                             Page 12                                GAO/HEHS-97-63 Medicaid Fraud and Abuse
                       B-275645




                       exclusion took effect. The OIG provides a copy of the report, on a diskette,
                       to HCFA. HCFA’s Issuances Unit prepares a paper copy of the report, which
                       is then forwarded to a contractor for printing and distribution to state
                       Medicaid agencies. The HCFA-prepared report does not identify individuals
                       or organizations by Social Security or employer identification number.10
                       We were informed, however, that state Medicaid agencies could obtain a
                       copy of the complete report, on a diskette, from the OIG. The OIG also
                       provides HCFA with monthly exclusion updates on diskette, which HCFA
                       sends to state Medicaid agencies in paper copy and via electronic mail. In
                       contrast to the cumulative report, both the paper copy and, until recently,
                       electronic versions of the monthly updates have included the Social
                       Security numbers of individuals who were excluded since the previous
                       monthly update.


Identifying Excluded   In the six states we visited, Medicaid officials responsible for ensuring that
Providers Is           OIG-excluded providers were not enrolled in their programs were generally

Time-Consuming and     unaware of the availability of cumulative exclusion data on diskette, as
                       well as monthly updates on electronic mail. Thus, to check on providers,
Cumbersome             Medicaid officials typically relied on paper copies of the cumulative
                       exclusion list and monthly updates. Manually comparing the thousands of
                       names on the OIG cumulative list and the dozens of names on the monthly
                       updates with their enrollment files is difficult, if not impractical. Moreover,
                       the paper copy of the cumulative exclusion list received by state Medicaid
                       agencies lacks identifiers, such as Social Security numbers or employer
                       identification numbers, which could facilitate checking. Although the OIG’s
                       diskette of the cumulative exclusion list does not contain employer
                       identification numbers for organizations, it does have Social Security
                       numbers for individuals. Thus, states, if made aware that the diskette is
                       available, could use it to cross-check with their provider enrollment files,
                       to the extent state files contain Social Security numbers.

                       When we cross-checked the automated version of OIG’s February 1996
                       Cumulative Sanction Report against the state Medicaid agency enrolled
                       provider files, we found excluded providers enrolled in five state Medicaid
                       programs. For example, we found 13 out-of-state providers who had been
                       excluded by the OIG between 1988 and 1995, but were still enrolled in the
                       Illinois Medicaid program. Similarly, we found 10 OIG-excluded providers
                       enrolled in the Washington, D.C., Medicaid program, two each enrolled in
                       Maryland and Missouri, and one enrolled in Virginia. One of the Illinois


                       10
                        Since 1996, the cumulative exclusion list and the monthly update have been available on the Internet,
                       but also lack identifiers.



                       Page 13                                              GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645




providers had received almost $25,000, while one of the Missouri providers
had received over $9,000. Although none of the other providers had billed
their state Medicaid programs after being excluded by the OIG, state
Medicaid officials acknowledged that these providers would have been
paid had they submitted claims.11

The states we visited tended to use the paper version of the OIG’s monthly
list for a one-time cross-check against their active provider files. However,
most states did not review earlier monthly lists to cross-check for an
excluded provider who tried to enroll in the state’s Medicaid program in
any month after exclusion. Thus, a provider could enroll in a state’s
Medicaid program, after being excluded nationwide by the OIG, and not be
detected. Likewise, some states we visited did not always cross-check
providers that appeared on the monthly update but had out-of-state
addresses. This can lead to problems because many providers can provide
services in more than one state or can relocate, gaining access to
Medicaid. An official in Missouri, for example, told us that although staff
did cross-check the OIG monthly list against in-state and border state
addresses, they did not check names from other states. New York officials
also told us they only cross-checked names with addresses in their state
because too much time would be required to cross-check the entire list. In
our cross-checking, we found that almost all of the OIG-excluded providers
enrolled in state Medicaid programs were listed with out-of-state
addresses on the OIG’s excluded provider list.

HCFA officials have recently updated a software program that would enable
them to compress cumulative exclusion data and transmit the data to the
states on the Internet. This report—unlike the cumulative report already
available on the Internet and available to the public—would include Social
Security numbers for individual providers. However, because of concerns
about maintaining confidentiality for Social Security numbers transmitted
over the Internet, HCFA decided not to electronically transmit to the states
the cumulative report with Social Security numbers and stopped including
Social Security numbers on the monthly updates. Thus, the OIG’s
cumulative and monthly diskettes are currently the only automated means
to obtain excluded providers’ Social Security numbers.




11
  The OIG has found similar problems in Medicare in Maryland. In Medicare Payments to Excluded and
Unlicensed Health Care Providers, Office of Inspector General, Report No. A-14-96-00202 (Nov. 1996),
the OIG reported that Medicare reimbursed six Maryland providers after they were excluded by the
OIG and six other providers after their licenses were suspended or revoked by the state licensing
board.



Page 14                                             GAO/HEHS-97-63 Medicaid Fraud and Abuse
                      B-275645




                      After we gave several state officials an OIG diskette of excluded providers,
                      including Social Security numbers, they told us that if they could have
                      these data routinely, they would explore the feasibility of cross-checking
                      the data against their enrollment files. For example, one state official told
                      us that once he received automated listings of excluded providers, he
                      intended to do periodic computer matches of OIG exclusion data and state
                      provider files. Such matching, however, would still require extensive
                      manual analysis of the results, he said, because OIG’s format cannot readily
                      be made compatible with the state’s own files. Moreover, such
                      computer-matching would not prevent a provider from enrolling in the
                      program between matches. Much better, he said, would be for the state to
                      integrate the exclusion data into its enrollment file; this integration would
                      automatically ensure that OIG-excluded providers would be removed from
                      the state’s Medicaid program and that OIG-excluded providers not currently
                      enrolled could not enroll later. Consequently, he said, he had requested
                      that the Medicaid agency’s information system staff explore the feasibility
                      of setting up a system for capturing OIG exclusion data. Information system
                      resources are currently focused on the state’s implementation of managed
                      care and other priorities, however, he said, so this project most likely will
                      not receive attention for a long time.


Lack of Common        No universal identifier for health care providers currently exists, and
Identifiers Hampers   health care providers often have multiple identifiers for the programs and
Detection             organizations with which they do business. This makes it difficult to
                      identify and track excluded providers across health care programs. State
                      Medicaid agencies, for instance, sometimes have difficulty determining
                      whether OIG-excluded providers are enrolled or have attempted to enroll in
                      their programs because identifying information about the providers on the
                      exclusion list may be incomplete or different from the identifiers used in
                      state data systems.

                      Although OIG exclusion data usually include Social Security numbers for
                      excluded individuals, the data do not include identifiers for certain
                      excluded organizations, such as pharmacies, home health care agencies,
                      and medical transportation companies. Almost 800 excluded organizations
                      were listed on the OIG’s October 1996 cumulative report. Without an
                      identifier, such as an employer identification number, it is difficult for a
                      state Medicaid agency to determine whether a provider enrolled in its
                      program is the same organization as one on the excluded provider list with
                      the same or a similar name. Although OIG exclusion data usually include
                      the addresses of excluded organizations, they frequently relocate or



                      Page 15                                 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645




operate out of multiple locations. But including employer identification
numbers on the OIG exclusion list would not necessarily solve the problem
because organizations can use different numbers.

The lack of common identifiers also hampers tracking providers in states
that use identifiers other than Social Security numbers. Missouri and
Virginia, for example, give individuals the option of enrolling by Social
Security number or employer identification number. To the extent
individuals in these states use employer identification numbers, excluded
providers are unlikely to be detected through computer-matching of Social
Security numbers. Alternatively, these states could attempt to match by
name, but name-matching can result in many erroneous identifications, as
well as the need for time-consuming research and follow-up. In some
states, however, individual providers are identified solely or primarily by
Social Security numbers, making it relatively easy to cross-check the OIG
exclusion data with state enrollment files.

In addition, certain kinds of excluded providers that do not directly bill a
state Medicaid program—such as nurses, pharmacists, or physicians
employed by hospitals, nursing homes, pharmacies, and health
maintenance organizations—are difficult to identify. These providers, once
excluded, can change employers or move to other states and continue to
provide services through federal health care programs without detection.
To at least partly deal with this problem, OIG exclusion data will be added
to the National Practitioner Data Bank—a repository of information on
practitioners (physicians, dentists, and other state-licensed health care
providers) concerning malpractice payments; clinical privilege actions;
and adverse actions taken by hospitals, insurance companies, licensing
boards, and professional societies. The OIG believes that this action will
substantially reduce the number of excluded licensed providers that
continue to indirectly participate in federal health care programs in
hospitals. This is because hospitals, when making appointments to their
medical staff or granting clinical privileges, are required to query the
database for all new practitioners and all current practitioners every 2
years. But not all excluded providers would be exposed by these queries.
For one thing, not all providers are covered by the database because some
are not state licensed. For example, Maryland does not license nurses’
aides. Moreover, some providers may not be affiliated with hospitals.
Other organizations—such as nursing homes, pharmacies, and health
maintenance organizations—are allowed, but not required, to query the
database.




Page 16                                GAO/HEHS-97-63 Medicaid Fraud and Abuse
                            B-275645




New Legislation May Make    The Health Insurance Portability and Accountability Act of 1996, enacted
Identifying Excluded        in August 1996, has added tools that may help the OIG and states track
Providers Easier and More   unacceptable providers. One of these tools is a system of unique health
                            identifiers for all health care providers, which the act requires HHS to
Reliable                    establish. Assigning a unique identifier to each health care provider should
                            make it easier for state Medicaid agencies to determine if excluded
                            providers are enrolled in their programs, reducing opportunities for
                            excluded providers to receive inappropriate payment. However, full
                            implementation will take several years.

                            The act requires that within 18 months, the Secretary of HHS adopt a
                            standard for a unique health identifier for all health care providers—both
                            individuals and organizations. Since 1993, HCFA has been developing a
                            unique identifier for Medicare providers, known as the National Provider
                            Identifier (NPI). HCFA plans to adapt the NPI to meet the requirements of the
                            act and has begun working to encourage states, private payers, and other
                            federal agencies to adopt the NPI. A proposed regulation announcing the
                            standard and seeking public comment is expected to be published in
                            spring 1997, with a final regulation planned for July 1997.

                            Although the law requires compliance with the standard within 24 months
                            after it is adopted, according to HCFA officials we spoke with, it will most
                            likely take much longer to assign NPIs to all health care providers. The law
                            primarily deals with those providers who bill federal programs
                            electronically, HCFA officials believe. Thus, HCFA will emphasize assigning
                            identification numbers to these providers, reserving for later assigning
                            numbers to other providers, including the estimated thousands who do not
                            participate in federal programs at all. Implementing the provisions for a
                            unique identifier may also be delayed because of unresolved questions on
                            how to (1) meet the cost of implementing the new system, (2) ensure that
                            all health care providers are identified and assigned NPIs, and (3) minimize
                            the disruption to health plans and organizations when converting their
                            provider enrollment files.

                            Another tool provided for by the act—which may help the OIG, state
                            Medicaid agencies, and other health care programs keep track of problem
                            providers—is the Adverse Action Data Bank. Currently, no centralized
                            database exists to track fraud and abuse in the health care system. The
                            OIG’s excluded provider list is but one of several databases and information
                            sources that contain information on problem health care providers. The
                            Adverse Action Data Bank would provide a comprehensive and centralized
                            database of “final adverse actions,” such as criminal convictions, civil



                            Page 17                                 GAO/HEHS-97-63 Medicaid Fraud and Abuse
                            B-275645




                            judgements, exclusions from federal health care programs, administrative
                            sanctions, and other disciplinary actions imposed against health care
                            providers. This database is to be widely accessible to public and private
                            health care organizations.

                            Like assigning unique identifiers, setting up the database will take time to
                            accomplish. The OIG, in conjunction with the Department of Justice, is
                            responsible for overseeing the development of the database, but OIG
                            officials we spoke with estimated implementation was at least a year
                            away. Although start-up costs could be about $2 million, the costs to
                            operate the database are largely unknown. Moreover, certain factors could
                            limit the data bank’s effectiveness. For instance, the law does not contain
                            sanctions or penalties if a government agency or health plan fails to report
                            its adverse actions or use the database. Thus, some way must be found to
                            (1) persuade these entities to report their adverse actions and (2) convince
                            them, especially state agencies and health plans that will be charged for
                            inquiries, that the database is useful. In addition, the law specifies that the
                            database must not duplicate information already contained in the National
                            Practitioner Data Bank. Moreover, the law exempts from reporting those
                            settlements in which no findings of liability have been made, such as the
                            provider withdrawals we found occurring in the Illinois Medicaid program.
                            HCFA and OIG officials fear that if large numbers of providers attempt to
                            enter into settlements to avoid being listed in the database, these
                            exemptions could undermine the usefulness of the database.


                            OIG officials attributed many of the problems we found to resource cuts
The OIG Is Taking           over the last several years. For the audit and investigation of health care
Actions to Strengthen       providers, the Health Insurance Portability and Accountability Act
the Excluded Provider       appropriates for the OIG not less than $60 million and not more than
                            $70 million in extra funds for fiscal year 1997, with additional amounts
Process                     authorized for subsequent years. Headquarters officials plan to use some
                            of this money to hire additional field office staff to process exclusion
                            cases, they said. In addition, under the Project WEED umbrella, the OIG has
                            taken or planned other corrective actions:

                        •   Tracking of incoming exclusion referrals: Since September 1996, the OIG
                            field offices have maintained a database on all exclusion referrals from
                            states. According to a headquarters official, as of December 1, 1996, more
                            than 4,300 exclusion referrals had been logged in.
                        •   Training of field office staff: In July and September 1996, field office staff
                            who process exclusion referrals from states received training. It focused



                            Page 18                                  GAO/HEHS-97-63 Medicaid Fraud and Abuse
                  B-275645




                  on what staff need to do to prepare a case for exclusion and reemphasized
                  the criteria and guidance staff are expected to follow, headquarters
                  officials said.
              •   Outreach efforts: The OIG plans to contact state Medicaid agencies, MFCUs,
                  and licensing boards to ensure that all information needed to process
                  provider exclusions is forwarded to field offices. Letters will be sent to
                  these organizations, describing the specific documentation the OIG needs
                  to process a case for exclusion.


                  When providers defraud federal or state health care programs or give poor
Conclusions       quality care, the OIG has authority to exclude them nationwide from
                  participation in these programs. The process for excluding providers can
                  and has operated successfully, with thousands of unacceptable providers
                  excluded from Medicare, Medicaid, and other federal health care programs
                  over the years.

                  However, we found cases in which unacceptable providers in one state’s
                  Medicaid program can be enrolled as providers under Medicare or in other
                  states. Because of the amount of communication and coordination needed
                  at the state and federal levels, the exclusion process is complex.
                  Nevertheless, we believe that more attention must be paid to a system
                  designed to help ensure the integrity of federal health programs and
                  protect beneficiaries from poor quality care. In the long run, certain
                  provisions of the Health Insurance Portability and Accountability Act of
                  1996 may assist the OIG and states in addressing these problems, but
                  implementation is most likely several years in the future. Interim actions
                  are needed.

                  The OIG has taken several important actions to address some of the
                  problems we identified. Tracking of incoming exclusion referrals should
                  strengthen accountability for referrals received from the states and help
                  ensure that none are overlooked. Training that has been provided to
                  current staff should help reduce inconsistencies among field offices and
                  improve the quality of processing, and plans to hire additional staff should
                  improve the timeliness of exclusion processing. Outreach to states under
                  Project WEED has resulted in identifying previously unknown exclusion
                  cases. The OIG plans for further outreach to states under this project may
                  result in identifying additional cases and may improve the extent to which
                  states refer cases to the OIG.




                  Page 19                                 GAO/HEHS-97-63 Medicaid Fraud and Abuse
                         B-275645




                         The OIG believes—and we concur—that these actions should help correct
                         many of the problems we identified. However, we believe that refinements
                         to these actions would encourage states to refer more unacceptable
                         providers to the OIG and help the OIG to process these referrals promptly.
                         For example, the OIG can further strengthen its exclusion referral process
                         by clarifying reporting requirements and systematically monitoring key
                         state agencies’ compliance. It could also follow through on its plans to
                         contact state agencies to ensure that states provide the documentation the
                         OIG needs to consider an exclusion action. In addition, the OIG could
                         establish consistent standards—performance goals or benchmarks—to
                         facilitate the timely processing of state referrals. Finally, OIG exclusion
                         data need to be distributed to appropriate state officials in a format that
                         aids timely comparison with state provider files.


                         We recommend that the HHS Inspector General
Recommendations to
the HHS Inspector    •   improve oversight of key state agencies that refer cases to the OIG, such as
General                  the state Medicaid agency and MFCU, to ensure that states understand and
                         comply with the statutory reporting requirements for state-removed
                         providers;
                     •   clarify to states that settlements and provider withdrawals to avoid formal
                         sanctions should be reported to the OIG, in accordance with its regulations
                         (42 C.F.R. 1001.601);
                     •   provide ongoing, clear, and consistent guidance to the states on the
                         documentation needed for timely processing;
                     •   establish consistent standards—performance goals or benchmarks—for
                         the timely processing of state referrals; and
                     •   in collaboration with HCFA, transmit OIG exclusion data either electronically
                         or by diskette, including Social Security numbers, to state Medicaid
                         agency officials responsible for enrolling and removing providers.


                         We provided a draft of this report to the HHS Inspector General. In
Agency Comments          providing written comments, she also incorporated comments from HCFA
and Our Evaluation       (see app. IV). In general, she concurred with our recommendations.

                         Concerning our recommendation that the OIG establish consistent
                         standards—performance goals or benchmarks—for the timely processing
                         of state referrals, the HHS Inspector General said she had recently
                         reiterated to regional managers that they should apply criteria in the Office
                         of Investigation’s Special Agent’s Handbook to permissive exclusion cases.



                         Page 20                                 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645




The handbook criteria require that exclusion documents be forwarded
immediately to the appropriate field office supervisor for evaluation and,
as a general rule, within 60 working days of receipt, a decision should be
rendered on whether or not the OIG will process the case for a permissive
exclusion action. We believe that reemphasizing existing guidance as to
time frames for evaluating whether to process an exclusion referral is an
important step to improve timeliness. However, evaluating whether
processing of a referral is warranted is only the first component of the
overall exclusion process. Thus, we believe additional performance
measures or goals, such as target time frames for completing the cases and
referring them to headquarters, need to be established to improve
timeliness, as well as to help the OIG measure the effectiveness of its work.

The Inspector General expressed concern with our recommendation to
ensure that state Medicaid officials responsible for enrolling and removing
providers were aware of the availability of automated exclusion data with
Social Security numbers. She said that it would be unreasonable and
unnecessarily costly for HCFA, which is responsible for distributing
exclusion data to the states, to provide the cumulative and monthly lists to
each official in a state agency who might need that information. Instead,
she said, the state official who receives the lists should ensure that all
appropriate officials who need to be notified of the exclusion also receive
the information. Nevertheless, the Inspector General said she would
encourage HCFA to remind state officials of their responsibility to ensure
the lists reach those who need them.

In making this recommendation, our principal concern was that state
Medicaid officials responsible for removing unacceptable providers from
their programs were unaware that cumulative exclusion data with Social
Security numbers were available in automated form. If state officials had
such information, they might find it easier to ensure that OIG-excluded
providers were not participating in their programs; in addition, the
problems we found through computer-matching might not have occurred.
To respond to the Inspector General’s comments, we revised this
recommendation and combined it with a previous one to emphasize that
the OIG and HCFA should collaborate to provide complete exclusion data, in
automated form, to the states.

We also requested comments on a draft of this report from the six state
Medicaid agencies included in our review, as well as the MFCUs in Illinois,
Maryland, and New York. We received written responses from the Illinois,
Maryland, Missouri, and New York state Medicaid agencies. In general,



Page 21                                 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645




they agreed with our conclusions and recommendations. In addition, the
Illinois and Missouri state Medicaid agencies and the New York MFCU
provided clarifying comments, which we incorporated as appropriate.

Illinois, however, questioned our language indicating that federal
regulations require states to report voluntary withdrawals to the OIG. The
state suggested that federal reporting requirements as to negotiated
settlements were unclear. Specifically, the state questioned whether a
direct link existed between the law—which requires state Medicaid
agencies to report providers who are “otherwise sanctioned”—and the
federal regulations (42 C.F.R. 1001.601)—which define the term for
purposes of explaining the circumstances under which the OIG may impose
a permissive exclusion. We agree that the regulation is unclear.
Consequently, we revised our language to remove any implication that the
state had violated federal regulations by not reporting negotiated
settlement agreements to the OIG. Nevertheless,the OIG interprets the
regulation as requiring states to report providers who voluntarily withdraw
from the Medicaid program to avoid an adverse action and communicated
its interpretation in a letter to Illinois, dated February 24, 1997. In addition,
the OIG plans to contact all state Medicaid agencies by spring 1997 to
provide them with guidelines on the kind of cases that fall within the OIG’s
exclusion authority and the documentation needed to support an
exclusion. The guidance will cover provider withdrawals to avoid formal
exclusion.


As arranged with your office, unless you announce its contents earlier, we
plan no further distribution of this report until 30 days after the date of
this letter. At that time, we will send copies of this report to the Secretary
and the Inspector General of HHS, the Administrator of HCFA, state officials
in the six states we visited, and other interested parties. We also will make
copies available to others upon request.




Page 22                                   GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645




Please call me at (312) 220-7600 or Kathryn G. Allen, Assistant Director, at
(202) 512-7059 if you or your staff have any questions about this report.
Other major contributors to this report include Robert T. Ferschl; Paul T.
Wagner, Jr.; Robert E. Lippencott; Alfred R. Schnupp; and Jonathan H.
Barker.

Sincerely yours,




Leslie G. Aronovitz
Associate Director, Health Financing and
  Systems Issues




Page 23                                 GAO/HEHS-97-63 Medicaid Fraud and Abuse
Contents



Letter                                                                                          1


Appendix I                                                                                     26

Scope and
Methodology
Appendix II                                                                                    28

Legal Basis for
Excluding Providers
Under the Social
Security Act
Appendix III                                                                                   29

OIG Process:
Problems With State
Exclusion Referrals
Appendix IV                                                                                    34

Comments From the
OIG
Table                 Table I.1: Exclusion Referrals Reviewed by GAO                           26




                      Abbreviations

                      HCFA      Health Care Financing Administration
                      HHS       Health and Human Services
                      MFCU      Medicaid fraud control unit
                      NPI       National Provider Identifier
                      OIG       Office of the Inspector General, HHS


                      Page 24                              GAO/HEHS-97-63 Medicaid Fraud and Abuse
Page 25   GAO/HEHS-97-63 Medicaid Fraud and Abuse
Appendix I

Scope and Methodology


                                 To understand federal and state processes for excluding providers from
                                 Medicaid, we discussed the processes with Medicaid officials in six states,
                                 four OIG field offices, and OIG headquarters. In our six judgmentally
                                 selected states—Illinois, Maryland, Missouri, New York, Virginia, and
                                 Washington, D.C.—we spoke with officials who managed units that
                                 (1) enrolled providers in state Medicaid programs, (2) removed these
                                 providers when necessary, or (3) operated computer systems supporting
                                 those functions. In these states, we also contacted officials from the state
                                 MFCU—to obtain information on its fraud and abuse convictions—and
                                 selected state licensing boards—to understand the processes for
                                 disciplining providers that violate state licensing requirements.

                                 In the OIG’s Chicago, New York, Philadelphia, and Washington, D.C., field
                                 offices—which process referrals from the six states—we met with staff
                                 responsible for processing referrals; in OIG headquarters, we met with
                                 officials who make exclusion decisions and prepare the cumulative and
                                 monthly lists of excluded providers. At HCFA, we met with officials
                                 responsible for distributing OIG exclusion data to state Medicaid agencies
                                 and others. We also interviewed officials at OIG headquarters and HCFA to
                                 determine their plans to establish an Adverse Action Data Bank and
                                 develop a unique health care identifier, as required by the Health
                                 Insurance Portability and Accountability Act of 1996.

                                 To examine how well the OIG’s provider exclusion process was working,
                                 we examined a sample of cases, referred by selected state agencies, to
                                 determine their disposition by the OIG. Because field offices did not always
                                 log in or otherwise account for all referrals they received, we could not
                                 identify the universe of all cases from which we could draw a sample.
                                 Instead, we judgmentally sampled referrals made by state agencies to the
                                 Chicago, New York, and Philadelphia OIG field offices. See table I.1 for the
                                 OIG field offices and state agencies we visited and the number of cases we
                                 reviewed.

Table I.1: Exclusion Referrals
Reviewed by GAO                  OIG field office             Referring state agency                    Referrals reviewed
                                 Chicago                      Illinois Department of Public Aida                       18
                                                              Illinois State Police (MFCU)                             14
                                                              Missouri Division of Medical Servicesa                    6
                                 New York                     New York Department of Social Servicesa                  28
                                 Philadelphia                 Maryland MFCU                                            22
                                 Total                                                                                 88
                                 a
                                     State Medicaid agency.




                                 Page 26                                           GAO/HEHS-97-63 Medicaid Fraud and Abuse
Appendix I
Scope and Methodology




In general, these cases represented referrals that state agencies had made
to OIG field offices during 1994 and 1995. We reviewed the case files at OIG
field offices from the Illinois and New York state Medicaid agencies and
the Maryland MFCU. For the Illinois MFCU and Missouri Medicaid agency
cases, we only determined their status at the OIG. In addition, for selected
Illinois and New York Medicaid referrals, we determined if the providers
were enrolled in Medicare, according to the Medicare contractors serving
those states. Because these cases were not randomly selected, results
cannot be generalized to all such cases referred by the states or processed
by the OIG field offices and headquarters. However, the results of the OIG’s
Project WEED indicate that the problems we identified through our work
may be pervasive. In determining the disposition of permissive cases, we
did not question OIG decisions on whether an exclusion was warranted.

To determine whether any nationally excluded providers were still
providing services under state Medicaid programs, we compared the OIG’s
February 1996 list of excluded providers against states’ active provider
files. To ascertain whether states were reporting to the OIG as required, we
also compared states’ lists of providers excluded from their programs
against the OIG’s excluded provider list.

We performed our work between November 1995 and January 1997 in
accordance with generally accepted government auditing standards.




Page 27                                 GAO/HEHS-97-63 Medicaid Fraud and Abuse
Appendix II

Legal Basis for Excluding Providers Under
the Social Security Act


               Section of the act           Exclusion reason
               1128(a)(1)a                  Program-related conviction
               1128(a)(2)a                  Conviction for patient abuse or neglect
               1128(a)(3)a                  Felony conviction related to health care fraud
                             a
               1128(a)(4)                   Felony conviction related to controlled substances
               1128(b)(1)                   Misdemeanor conviction related to health care fraud
               1128(b)(2)                   Conviction for obstructing an investigation
               1128(b)(3)                   Misdemeanor conviction related to controlled substances
               1128(b)(4)                   License revocation or suspension
               1128(b)(5)                   Suspension or exclusion under a federal or state health care
                                            program
               1128(b)(6)                   Excessive claims or furnishing of unnecessary or substandard
                                            items and services
               1128(b)(7)                   Fraud, kickbacks, and related activities
               1128(b)(8)                   Entities owned or controlled by a sanctioned individual
               1128(b)(9)                   Failure to disclose required information
               1128(b)(10)                  Failure to supply requested information on subcontractors and
                                            suppliers
               1128(b)(11)                  Failure to provide payment information
               1128(b)(12)                  Failure to grant immediate access
               1128(b)(13)                  Failure to take corrective action
               1128(b)(14)                  Default on health education loan or scholarship obligations
               1128(b)(15)                  Individuals controlling an excluded entity
               1128A(a)                     Imposition of a civil money penalty or assessment
               1156(b)                      Peer review organization recommendation
               a
                   Mandatory exclusion provisions.




               Page 28                                              GAO/HEHS-97-63 Medicaid Fraud and Abuse
Appendix III

OIG Process: Problems With State Exclusion
Referrals

                     Several examples of (1) cases for which the OIG had no record of state
                     exclusion referrals when we initially inquired and (2) delays in OIG
                     processing of state exclusion referrals (discussed on pp. 5-8). The
                     following are additional examples of these two problems, which we
                     identified in both the Chicago and New York field offices.



No Record of State
Referrals

Example 1            On June 2, 1995, Illinois notified the OIG’s Chicago field office that it had
                     removed a physician from its Medicaid program for providing poor quality
                     care to Medicaid beneficiaries. For example, the state found that the
                     physician often prescribed medications that had no correlation to patient
                     symptoms or diseases and that his diagnoses were often unsupported. In
                     one instance, the physician had prescribed a medication with a high sugar
                     content for a diabetic. In another, he had prescribed the wrong medication
                     for an eye problem. The OIG field office had no record of this case, when
                     we inquired in March 1996. After our review, the field office obtained
                     information on the removal and began processing the case. The physician
                     was excluded in December 1996—18 months after the state first reported
                     the case to the OIG. During this time period, the physician was enrolled in,
                     but did not bill, Medicare.


Example 2            The Chicago field office had no record, when we inquired in March 1996,
                     of a physician who had (1) been removed from the state Medicaid program
                     in September 1995 for defaulting on a state student loan and (2) had his
                     license revoked in October 1995 for leaving a hospitalized patient without
                     physician coverage. As in the case above, the field office obtained
                     information on the case after our review and forwarded the case to
                     headquarters in June 1996. The case remained unresolved, however, as of
                     January 1997, over 14 months after it was first referred by the state of
                     Illinois.


Example 3            When we inquired in March 1996, the Chicago field office had no record of
                     a physician who, according to state files, had been removed from the
                     Illinois Medicaid program in September 1995 and reported to the OIG the
                     following month. The state had removed the physician for repeatedly



                     Page 29                                 GAO/HEHS-97-63 Medicaid Fraud and Abuse
            Appendix III
            OIG Process: Problems With State
            Exclusion Referrals




            providing harmful and grossly inferior care to Medicaid beneficiaries.
            Among the state’s charges were that the physician failed to observe a
            patient during the 18 hours she was in labor in a hospital or to be present
            at the delivery, placed a patient at risk by not promptly treating a bladder
            infection, and failed to refer a patient to a specialist after long-term
            treatment did not control his blood pressure. The field office subsequently
            opened a case on the physician in April 1996. According to field office
            officials, the case remains unresolved as of January 1997. After this
            physician was excluded from Medicaid, he was paid over $9,000 (through
            Dec. 1996) for services provided to Medicare beneficiaries in Illinois.


Example 4   In March 1996, the Chicago field office had no record of a referral sent by
            the Illinois Medicaid agency 9 months earlier, in June 1995. The state had
            removed the provider, a transportation company, from the Medicaid
            program for overbilling. The case did not meet OIG criteria for exclusion,
            OIG officials later said.



Example 5   New York excluded a durable medical equipment supplier from Medicaid,
            effective June 1994, on the basis of a consistent disregard for Medicaid
            rules and regulations, as well as unacceptable recordkeeping practices.
            The state found over 2,000 claims, totaling more than $120,000, for which
            the provider could supply no documentation; for another 148 claims,
            totaling about $9,000, the documentation available was inadequate. About
            $21,500 of these overpayments had been collected as of November 1996.
            Over 2 years have elapsed since this provider was removed by the state,
            but the New York field office had no record of an exclusion.


Example 6   The New York field office had no record of a durable medical equipment
            dealer who had been excluded from the state’s Medicaid program in
            September 1994, after an audit revealed that the provider had billed for
            items not ordered by physicians and had “upcoded” some bills, charging
            for custom-made items when standard items were provided.




            Page 30                                 GAO/HEHS-97-63 Medicaid Fraud and Abuse
                       Appendix III
                       OIG Process: Problems With State
                       Exclusion Referrals




Delays in Processing
State Referrals

Example 1              The OIG excluded a transportation company 16 months after the Illinois
                       Medicaid program reported that it had removed the company for billing for
                       unauthorized services, using improper procedure codes, and failing to
                       keep proper records. The field office case file showed no activity for
                       lengthy periods.


Example 2              Over 16 months elapsed—including one 9-month period when no
                       processing occurred—before the OIG excluded a pharmacy that had
                       overcharged the Illinois Medicaid program by $136,000.


Example 3              After an audit revealed incomplete medical records, no documentation of
                       patient medical histories, and multiple quality-of-care problems, New York
                       removed a physician from Medicaid for 5 years, effective March 1995. The
                       OIG’s New York field office was notified of the case in June 1995, but did
                       not start processing the case until February 1996. Fourteen months after
                       receiving the referral, the OIG excluded the provider.


Example 4              New York’s Medicaid agency excluded a physician for 5 years, in
                       April 1994, after (1) an audit concluded the physician was overprescribing
                       drugs and (2) an undercover investigator was able to obtain prescriptions
                       on request, after a cursory examination. We could not determine from
                       state or OIG case files when the OIG was notified, but about a year after
                       state removal, the New York field office—because it had a backlog of
                       work—transferred the case to the Boston field office. Thirteen months
                       later, the Boston field office recommended exclusion and, in
                       September 1996, the physician was excluded nationwide—more than 2
                       years after first being removed from New York’s Medicaid program.
                       Between the state removal and federal exclusion dates, Medicare paid this
                       provider over $8,700.


Example 5              New York excluded an ophthalmologist for 2 years, effective May 1995,
                       after an audit determined that the physician rendered inappropriate care
                       to Medicaid beneficiaries. The state charged, among other things, that the



                       Page 31                                GAO/HEHS-97-63 Medicaid Fraud and Abuse
            Appendix III
            OIG Process: Problems With State
            Exclusion Referrals




            provider performed excessive glaucoma testing and treated patients
            inappropriately, using medications that were not indicated. In some cases,
            patients were placed at substantial risk. The state notified the New York
            OIG field office of this case in August 1995, and the OIG excluded the
            provider 1 year later.


Example 6   New York excluded a registered physician assistant for 5 years, effective
            March 1995, for conducting an unacceptable practice, maintaining
            inadequate records, and providing medical care and services far in excess
            of patients’ needs. Among other things, the state charged that the
            physician assistant often prescribed medications without adequate
            indication and provided medical care to Medicaid beneficiaries without
            adequate supervision of a licensed physician. The state notified the OIG of
            this case in late April 1995, but other than assigning the case a file number
            some time in 1996, the case file showed no activity when we reviewed it
            almost 19 months later. Given the age of this case and the office’s backlog,
            the regional inspector general said the case was unlikely to be processed
            for exclusion.


Example 7   New York removed a physician from its Medicaid program for 5 years,
            effective May 1994, for false claims, unacceptable recordkeeping,
            excessive services, and failure to meet recognized standards. For example,
            the state claimed that the physician provided potentially dangerous care
            by frequently prescribing the drug Elavil to substance abusers. The state
            also referred the provider to the state licensing board. We could not
            determine precisely when the field office received this case, but more than
            2-1/2 years after the state removed the physician, the case remained
            unresolved. Like the case above, the regional inspector general said that
            because of the age of this case, it was unlikely to be processed for
            exclusion.


Example 8   New York removed a podiatrist from Medicaid, in May 1995, after she was
            convicted of billing Medicaid for services not actually provided. The OIG’s
            New York field office was already aware of this case at the time of the
            state removal because it had been notified of the physician’s indictment in
            February 1994. Although the field office lacked key documents needed to
            process the case for exclusion, the case file showed no evidence of
            follow-up until November 1996. Since the time the podiatrist had been
            removed from Medicaid in New York, Medicare had paid her about $1,900.



            Page 32                                 GAO/HEHS-97-63 Medicaid Fraud and Abuse
            Appendix III
            OIG Process: Problems With State
            Exclusion Referrals




Example 9   A physician assistant was removed from Medicaid in New York, effective
            September 1995, based on an evaluation of quality of care, which showed
            that he did little to attempt to improve the health of patients other than
            frequently repeating laboratory tests. The Medicaid agency concluded that
            this was particularly dangerous because many of his patients had serious
            illnesses. In addition, there was no evidence of the assistant’s supervision
            by a licensed physician. The OIG was notified of this case in November
            1995, but did not open its own case file until May 1996. The case was
            referred to headquarters in July 1996 and was still pending when we
            reviewed the file in November 1996.




            Page 33                                 GAO/HEHS-97-63 Medicaid Fraud and Abuse
Appendix IV

Comments From the OIG




              Page 34   GAO/HEHS-97-63 Medicaid Fraud and Abuse
Appendix IV
Comments From the OIG




Page 35                 GAO/HEHS-97-63 Medicaid Fraud and Abuse
Appendix IV
Comments From the OIG




Page 36                 GAO/HEHS-97-63 Medicaid Fraud and Abuse
Appendix IV
Comments From the OIG




Page 37                 GAO/HEHS-97-63 Medicaid Fraud and Abuse
Appendix IV
Comments From the OIG




Page 38                 GAO/HEHS-97-63 Medicaid Fraud and Abuse
           Appendix IV
           Comments From the OIG




(101518)   Page 39                 GAO/HEHS-97-63 Medicaid Fraud and Abuse
Ordering Information

The first copy of each GAO report and testimony is free.
Additional copies are $2 each. Orders should be sent to the
following address, accompanied by a check or money order
made out to the Superintendent of Documents, when
necessary. VISA and MasterCard credit cards are accepted, also.
Orders for 100 or more copies to be mailed to a single address
are discounted 25 percent.

Orders by mail:

U.S. General Accounting Office
P.O. Box 6015
Gaithersburg, MD 20884-6015

or visit:

Room 1100
700 4th St. NW (corner of 4th and G Sts. NW)
U.S. General Accounting Office
Washington, DC

Orders may also be placed by calling (202) 512-6000
or by using fax number (301) 258-4066, or TDD (301) 413-0006.

Each day, GAO issues a list of newly available reports and
testimony. To receive facsimile copies of the daily list or any
list from the past 30 days, please call (202) 512-6000 using a
touchtone phone. A recorded menu will provide information on
how to obtain these lists.

For information on how to access GAO reports on the INTERNET,
send an e-mail message with "info" in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web Home Page at:

http://www.gao.gov




PRINTED ON    RECYCLED PAPER
United States                       Bulk Rate
General Accounting Office      Postage & Fees Paid
Washington, D.C. 20548-0001           GAO
                                 Permit No. G100
Official Business
Penalty for Private Use $300

Address Correction Requested