United States General Accounting Office GAO Report to the Chairman, Permanent Subcommittee on Investigations, Committee on Governmental Affairs, U.S. Senate July 1999 MEDICARE CONTRACTORS Despite Its Efforts, HCFA Cannot Ensure Their Effectiveness or Integrity GAO/HEHS-99-115 United States GAO General Accounting Office Washington, D.C. 20548 Health, Education, and Human Services Division B-280248 July 14, 1999 The Honorable Susan M. Collins Chairman Permanent Subcommittee on Investigations Committee on Governmental Affairs United States Senate Dear Madam Chairman: At your request, this report examines the Health Care Financing Administration’s (HCFA) oversight of its claims administration contractors. Specifically, the report discusses whether (1) there are weaknesses in HCFA’s contractor oversight activities that may make Medicare more vulnerable to fraud, waste, and abuse and (2) any changes in HCFA’s contracting authority may improve its ability to manage its contractors. We will send copies of this report to the Honorable Nancy-Ann Min DeParle, Administrator of HCFA. We will also make copies available to interested parties on request. If you or your staff have any questions about this report, please call William J. Scanlon at (202) 512-7114. Other GAO contacts and staff acknowledgments are in appendix II. Sincerely yours, Richard L. Hembra Assistant Comptroller General Executive Summary Investigations by the Health Care Financing Administration (HCFA), the Purpose Department of Health and Human Services’ (HHS) Office of Inspector General (OIG), and the Department of Justice have highlighted Medicare’s vulnerability to erroneous and fraudulent billing practices by providers, such as hospitals and physicians. The first lines of defense against such abusive practices are the intermediaries and carriers with whom HCFA contracts to administer Medicare fee-for-service claims. Intermediaries primarily review and pay claims from hospitals and other institutional providers covered under Medicare part A, while carriers review and pay part B claims, which are submitted by physicians and other outpatient providers. These contractors processed claims worth an average of more than $700 million each business day in fiscal year 1998. How well these contractors safeguard the Medicare program from payment errors and fraud and how well HCFA monitors their work are important concerns because Medicare payment errors represent billions of dollars lost to the program each year. The OIG estimated that in fiscal year 1998, contractors improperly paid over $12 billion for fee-for-service claims, the overwhelming majority of which were detected through medical record review, which determines whether medical services are covered by Medicare and are reasonable, necessary, and appropriate. The contractors, who are responsible for ensuring that providers do not defraud or abuse Medicare, have themselves been accused of defrauding the program; Justice and the OIG are now investigating several Medicare contractors regarding allegations of fraud. Concerned about how HCFA is overseeing the Medicare contractors, the Chairman, Permanent Subcommittee on Investigations, Senate Committee on Governmental Affairs, asked GAO to determine whether there are weaknesses in HCFA’s contractor oversight activities that may make Medicare more vulnerable to fraud, waste, or abuse. During GAO’s review, HCFA indicated that new contracting authority could mitigate many of the weaknesses GAO was identifying. Accordingly, this report also addresses whether any changes in HCFA’s contracting authority may improve its ability to manage its contractors. The Chairman also asked GAO’s Office of Special Investigations to prepare a separate investigative report on contractors that had either been convicted of fraud or had settled civil fraud cases involving their participation in the Medicare program. GAO is issuing a companion report, Medicare: Improprieties by Contractors Compromised Medicare Program Integrity (GAO/OSI-99-7, July 14, 1999), which describes deceptive activities Page 2 GAO/HEHS-99-115 Medicare Contractor Oversight Executive Summary by six contractors and the impact of these activities on the Medicare program. Despite its efforts, HCFA’s oversight of Medicare claims administration Results in Brief contractors has significant weaknesses that leave the agency without assurance that contractors are paying providers appropriately. Since 1993, six contractors have settled civil and criminal charges following allegations that they did not check claims to ensure proper payment or allowed Medicare to pay claims that should have been paid by other insurers. Even though inadequate management controls and falsified data are a common theme in these cases, GAO found that HCFA still does not regularly check contractors’ internal management controls, management and financial data, and key program safeguards to prevent payment errors. Furthermore, HCFA’s headquarters office generally has not set oversight priorities, leaving such decisions almost entirely to regional office reviewers. This has led to uneven contractor evaluations by regional reviewers, making it more difficult for HCFA to determine which contractors are performing effectively. HCFA’s organizational structure contributes to the problem by dividing responsibilities for contractor oversight between the regions and headquarters without assigning overall accountability to one office. HCFA has begun to take steps to improve its oversight, but it is too soon to tell whether it will succeed in addressing fundamental problems. HCFA officials believe that increased competition among contractors could enhance contractor performance but that statute and current regulations limit its authority to contract. The statutory limitations were enacted for easier initial implementation of Medicare, but the program now has over 30 years of operational experience. Consequently, HCFA is seeking new or explicit authority from the Congress that would allow it to (1) choose its intermediaries, rather than having providers nominate them, and contract with non-health insurance companies; (2) contract separately for specific functions—such as responding to beneficiary inquiries; and (3) use payment methods that would allow contractors to earn profits on their Medicare business, rather than reimbursing contractors only for their costs up to a preset target. While these changes might broaden the pool of contractors HCFA could choose from and would increase its flexibility in contracting for specific functions, past experience with other efforts to change the program has shown that HCFA will need several years to carefully plan, properly implement, and conduct a postimplementation review of any new contracting initiatives. Page 3 GAO/HEHS-99-115 Medicare Contractor Oversight Executive Summary When Medicare was enacted in 1965, the Congress decided to administer Background the program through contracts with organizations that already served as payers of health care services. The Congress also decided to pay on the basis of contractors’ allowable costs, so that these contractors would neither be penalized for administering Medicare nor unduly profit by doing so. Because such exceptions are specifically written into the Social Security Act, Medicare contracting has unique features that differ from other federal contracting. Medicare contractors are responsible for all aspects of claims administration, including safeguarding the program by conducting particular activities designed to identify potential fraud and abuse and to prevent or recover erroneous payments. HCFA is responsible for ensuring that contractors do their jobs accurately and efficiently, which includes overseeing contractor performance. Both HCFA headquarters and its 10 regional offices have roles in contractor oversight, although regional office staff generally provide direct oversight. Since 1995, to conduct routine oversight, HCFA has relied on its Contractor Performance Evaluation program, which allows regional staff to review any aspect of contractually required duties, classified in five general areas—claims processing, customer service, payment safeguards, fiscal responsibility, and administrative activities. When HCFA reviewers identify problems, contractors may be required to take specific corrective actions under a performance improvement plan. In addition to its routine oversight, HCFA sometimes conducts special “integrity reviews” when it learns of possible integrity or fraud problems at contractors. Principal Findings Weaknesses in Contractor Medicare contractors are HCFA’s front line of defense against provider Oversight Leave the fraud, abuse, and erroneous Medicare payments; however, several of them Medicare Program have committed fraud against the government. Such misconduct has led to the loss of Medicare program dollars when contractors fail to check Vulnerable provider claims properly to prevent payment errors. Since 1990, nearly one in four claims administration contractors has been alleged—generally by whistle-blowers within the company—to have integrity problems; GAO identified at least 7 of HCFA’s 58 current contractors as being actively investigated by the HHS OIG or Justice. Since 1993, HCFA has received criminal and civil settlement decrees totaling over $235 million from six contractors after investigations of allegations that the contractor Page 4 GAO/HEHS-99-115 Medicare Contractor Oversight Executive Summary employees deleted claims from the processing system, manufactured documentation to allow processing of claims that otherwise would have been rejected because the services were not medically necessary, and deactivated automatic checks that would have halted the processing of questionable claims. Despite recent efforts to improve, HCFA’s oversight process has weaknesses that impede effective review of contractor performance. These include (1) limited checking of internal management controls and performance data; (2) few performance standards combined with limited priority-setting, which allows essential program safeguards to go unchecked; and (3) inconsistent treatment of contractors resulting from variations in the intensity of regional monitoring. When contractors are accused of fraudulent practices, on investigation, HCFA often finds a lack of management controls and evidence of falsified data. However, in its ongoing oversight, HCFA generally does little checking of contractors’ internal management controls and performance data. Instead, HCFA relies on the contractors themselves to certify that their controls over the accuracy and security of their payment and data systems are sound. Despite the OIG’s finding in its recent audits of HCFA’s financial statements that contractor financial management controls were a material weakness, GAO found that HCFA rarely validated the contractors’ certifications. Furthermore, HCFA reviewed contractor performance by asking contractors to generate workload and other performance data—typically without validating the data’s accuracy. HCFA staff indicated that validating contractor data is resource intensive, which may help explain why it often is not done. Since 1995, when HCFA moved to the Contractor Performance Evaluation program, its 10 regional offices that directly oversee contractors were given wide discretion in how they conduct oversight—choosing what and how to review, and how to monitor contractors’ corrective actions. The program also set few standards against which to judge performance—lacking particularly those with which to judge the contractors’ effectiveness in reducing inappropriate payments and fraud. As a result, key activities directed toward safeguarding program dollars received limited scrutiny at some contractors. For example, GAO found that regional reviewers were not routinely checking how effective contractors were at identifying primary insurers other than Medicare. Page 5 GAO/HEHS-99-115 Medicare Contractor Oversight Executive Summary HCFA has also not taken the actions needed to ensure that all regional offices provide consistent and adequate oversight. For example, while some regions imposed performance improvement plans on contractors when problems were identified, other regions rarely, if ever, required them. HCFA has not formally evaluated its regional offices’ performance in the area of contractor oversight, nor has it regularly shared one region’s best practices with the others. HCFA has acknowledged that its oversight of contractors needs to be strengthened and has recently initiated some actions to improve it. HCFA set oversight priorities when the regions performed fiscal year 1998 contractor evaluations, and this year it restructured headquarters offices that are responsible for oversight activities. GAO believes that it is too early to tell whether these actions will address many of the fundamental problems HCFA faces in ensuring quality performance from its contractors. New Contracting Authority HCFA’s current legislative authority, its interpretation of that authority, and Would Take Time and its regulations constrain its ability to allocate workload among contractors Experience to Properly and attract new companies to administer claims. The Medicare statute’s provider nomination provision allows the professional associations of Implement hospitals and certain other institutional providers to choose claims processing intermediaries on behalf of their members, and the statute requires HCFA to choose health insurance companies as carriers. Further, because it has not yet changed certain regulations, HCFA has generally not been able to separate specific functions, such as conducting hearings or mailings, that it believes can be done more efficiently by other kinds of companies. In addition, HCFA generally contracts only on a cost basis because its authority to contract using other payment methods is restricted. Moreover, HCFA’s leverage to manage its current contractors has weakened as the pool of companies willing and eligible to administer claims has shrunk. HCFA has proposed several legislative changes to increase its contracting flexibility, such as giving HCFA new authority to contract with non-health insurers and clarifying its authority to choose its contractors. In addition, HCFA is seeking specific authority to contract with companies for individual program functions and a new authority to pay contractors on a basis that allows profit. In 1996, the Congress gave HCFA authority to separately contract for program safeguard activities—activities to ensure that only appropriate Page 6 GAO/HEHS-99-115 Medicare Contractor Oversight Executive Summary claims are paid and that providers participating in Medicare comply with program rules. HCFA has recently announced its selection of companies to conduct specialized safeguard activities for this new Medicare Integrity Program (MIP). HCFA’s experience with these new MIP contracts may offer information that could help in implementing any other functional contracts and will be a first test of the wisdom of contracting for specific functions. HCFA’s previous tests of two methods that could allow companies to earn a profit raise concerns because these experiments had serious problems. This suggests that HCFA should proceed cautiously if it significantly changes its current, cost-based contractor payment method. HCFA experimented with fixed-price contracts, in which contractors that cut their costs could keep any savings, and contracts in which specified levels of performance led to incentive payments. As GAO reported in 1986, in two past fixed-price contracts, cost-cutting led to over $130 million in benefit payment errors. More recently, some contractors who had received incentive payments were investigated for falsifying the performance data that gained them the incentive payments. As HCFA gathers experience with its program safeguards contracts, it may be better able to utilize other new authorities. Clearly, these new authorities would require a long-term effort and, in any event, would not lessen the need for routine and adequate monitoring of contractors. The Congress may wish to consider amending the Social Security Act to Matters for allow the Secretary of Health and Human Services to (1) freely choose the Congressional companies with which HCFA may contract as Medicare intermediaries and Consideration (2) contract with non-health insurers for claims administration. The Congress may also wish to consider giving HCFA explicit authority to award functional contracts for selected claims administration activities to any appropriate kind of company and to offer other-than-cost contracts, both at the discretion of the Secretary of Health and Human Services. If legislation is enacted, to ensure that the new authorities improve the efficiency and effectiveness of Medicare program operations, GAO believes HCFA should be required to report to the Congress with an independent evaluation of its use of these authorities and their impact on the Medicare program. Page 7 GAO/HEHS-99-115 Medicare Contractor Oversight Executive Summary In this report, GAO makes a number of specific recommendations to the Recommendations HCFA Administrator to correct identified weaknesses and improve the agency’s oversight of its claims administration contractors. Implementing these recommendations should help ensure that • contractor internal controls are working, • contractor performance is evaluated against a comprehensive set of clearly defined and measurable performance standards, • HCFA’s oversight of contractor performance is more consistent, • best practices are shared among regions, and • HCFA has a strategic plan for implementing requested legislative modifications sought in contracting proposals. In written comments on a draft of this report, HCFA agreed with each of the Agency Comments recommendations and described how it plans to implement them. Overall, GAO believes that HCFA has outlined a series of activities that—if properly designed and implemented—should help improve its management and oversight of Medicare’s claims administration contractors. Page 8 GAO/HEHS-99-115 Medicare Contractor Oversight Page 9 GAO/HEHS-99-115 Medicare Contractor Oversight Contents Executive Summary 2 Chapter 1 12 Contracting Arrangements for Managing Medicare 12 Introduction Contractors’ Role in Program Management 14 HCFA’s Role in Program Management 16 Scope and Methodology 18 Chapter 2 20 Contractor Integrity Problems Highlight Oversight Weaknesses 20 Weak Oversight of HCFA’s Oversight of Contractor Activities Is Uneven and 23 Contractors Leaves Inconsistent HCFA Lacks a Structure That Ensures Accountability 36 Medicare Vulnerable Chapter 3 43 Constraints on Contracting Authority Limit HCFA’s Ability to 43 HCFA Would Need Attract New Companies Time and Careful HCFA Proposals Seek to Remove Constraints on Contract 46 Authority Implementation to Feasibility Testing Needed to Facilitate Transition to New 56 Benefit From New Contracting Environment Contracting Authority Chapter 4 58 Conclusions 58 Conclusions, Matters for Consideration by the Congress 60 Recommendations, Recommendations to the Administrator, Health Care Financing 60 Administration and Agency Agency Comments and Our Evaluation 62 Comments Appendixes Appendix I: Comments From the Health Care Financing 64 Administration Appendix II: GAO Contacts and Staff Acknowledgments 78 Related GAO Products 80 Tables Table 2.1: Allegations of Wrongdoing in Three Contractor 22 Integrity Cases Page 10 GAO/HEHS-99-115 Medicare Contractor Oversight Contents Table 2.2: Performance Standards Mandated by Law, Regulation, 29 or Judicial Decision, by Evaluation Area Table 2.3: Key MSP Activities Conducted by Contractors 31 Table 2.4: Number of Contracts Overseen and PIPs Required for 35 Contractors, by Region, FY 1996 and 1997 Table 2.5: HCFA Headquarters Units With Responsibilities for 38 Medicare Contractor Issues Figures Figure 2.1: Three Regions’ Rates of Compliance With 30 Requirement to Check Whether Contractor Met Mandated Claims Processing Standards, FY 1995-98 Figure 2.2: Key MSP Activities Reviewed for Seven Contractors, 32 FY 1995-98 Figure 3.1: Number of Medicare Claims Administration 45 Contractors, 1980-99 Abbreviations CMG Contractor Management Group CPE Contractor Performance Evaluation HCFA Health Care Financing Administration HHS Department of Health and Human Services MIP Medicare Integrity Program MSP Medicare Secondary Payer OIG Office of Inspector General PIP Performance Improvement Plan RFP request for proposal Page 11 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 1 Introduction With the help of claims administration contractors, the Health Care Financing Administration (HCFA), within the Department of Health and Human Services (HHS), administers the Medicare program. Medicare is the nation’s largest health insurer, covering nearly 40 million beneficiaries at a net cost of about $193 billion in fiscal year 1998. Contractors processed about 900 million Medicare fee-for-service claims in fiscal year 1998—about 3.5 million claims and $700 million in payments each working day. For processing these claims and for performing other Medicare-related activities, HCFA paid its contractors $1.6 billion in fiscal year 1998. The Medicare program, implemented in 1966, provides coverage under the traditional pay-per-visit or service arrangement. Part A—hospital insurance—covers inpatient hospital, some home health, skilled nursing, and hospice services. Part B—supplementary insurance—covers services provided by physicians, outpatient laboratories, and an array of other providers and supplies. Beneficiaries now have the option to enroll in managed care, but about 85 percent have chosen Medicare’s traditional fee-for-service program. The size and complexity of the fee-for-service Medicare program make its Contracting management a formidable task. The original Medicare legislation and the Arrangements for accompanying committee reports reflected the congressional decision that Managing Medicare the government contract with organizations already serving as payers and managers of health care services to administer Medicare payment functions. HCFA has followed this direction and today uses 58 contractors to handle day-to-day program administration and to pay claims. The claims administration contractors, themselves health insurers, are called intermediaries or carriers, depending on the types of claims they process. Intermediaries, which were chosen from among those nominated by provider associations, process part A and part B claims for institutions, such as hospitals and home health agencies. Carriers, which were chosen directly by the Secretary of Health and Human Services, process part B claims submitted by others, such as physicians and suppliers of durable medical equipment.1 1 Most intermediaries are local Blue Cross Blue Shield companies that subcontract with the national Blue Cross Blue Shield Association. Most carriers are also Blue Cross Blue Shield plans but have direct contracts with HCFA. A local Blue Cross Blue Shield plan may have both an intermediary subcontract and a carrier contract. In this report, the term “contractor” is applied to both prime contractors and subcontractors and to both intermediaries and carriers. Page 12 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 1 Introduction Medicare contracting for intermediaries and carriers differs from contracting for most other federal programs. Generally, in accordance with the Federal Property and Administrative Services Act of 1949 and the implementing regulations known as the Federal Acquisition Regulations,2 which govern standard federal contracts, federal agencies can contract with any entity for any purpose, so long as that entity is not debarred from government contracting and the contract is not for what is an essentially governmental function. Federal agencies can contract using any payment method except cost-plus-percentage-of-cost and are generally required to contract competitively, unless there are specific exceptions in their authorizing legislation, such as there are for Medicare claims administration contracting. Medicare contracts must comply with the Federal Acquisition Regulations except when the Social Security Act, which authorizes Medicare, provides otherwise. For example, the act calls for the use of cost-based reimbursement contracts under which contractors are reimbursed for necessary and proper costs of carrying out Medicare activities but are not permitted to earn a profit on their Medicare claims administration activities, except in certain limited situations.3 Also, carriers may be chosen only from among health-insuring organizations. The services performed by intermediaries and carriers have been bundled together in part by the law and more completely by HCFA-promulgated regulations in a way that makes it difficult to contract for individual functions. However, in 1996, the Congress enacted legislation that authorized separate contracts for payment safeguard activities (medical and utilization review, Medicare Secondary Payer (MSP) activities, cost report audits, and the preparation of fraud and abuse cases). The program created by this legislation, called the Medicare Integrity Program (MIP), has no limitation on the type of companies that can be awarded contracts for these activities or on the basis on which they must be paid. HCFA has identified 12 organizations that it plans to contract with to operate the MIP and refers to them as program safeguard contractors. HCFA believes, however, that specific requirements limit its choice of claims administration contractors. For its intermediaries, HCFA chooses 2 C.F.R. title 48. 3 HCFA has some limited authority to build financial incentives into intermediary and carrier contracts, as long as the intermediary or carrier agrees to enter into the arrangement; performs all of the services listed in sections 1816 or 1842 of the Social Security Act—the sections authorizing contracts with intermediaries and carriers, respectively; and is a health insuring organization. This authority can be found in the Deficit Reduction Act of 1984, section 2326(a), as amended by the Omnibus Budget Reconciliation Acts of 1986, section 9321(b), and 1989, section 6215; and the Social Security Amendments of 1994, section 159. Page 13 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 1 Introduction from among entities that are first selected by associations representing providers, a process called “provider nomination” as set forth in the Social Security Act. While the Congress intended, and the practice has been, for the government to contract with intermediaries and carriers for the administration of the Medicare program, the Congress did not mandate that such contractors be used. Sections 1816 and 1842 of the Social Security Act “authorize” the Secretary to enter into contracts with intermediaries and carriers, respectively, but section 1874 grants the Secretary the authority to “perform any . . . functions under this title directly, or by contract . . . as the Secretary may deem necessary.” The Social Security Act also does not require that claims administration contractors be selected competitively. Provider nomination basically limits competition for intermediary contracts to those chosen by health care provider associations in 1966 and since. HCFA has not usually awarded either intermediary or carrier contracts on the basis of competition. An effect of the absence of competitive procurement is that HCFA has relatively little experience with writing statements of work and estimating the cost of certain tasks. Statements of work and cost estimates are required when contracts are written under the Federal Acquisition Regulations. Medicare contractors are responsible for claims processing and Contractors’ Role in administration, including (1) receiving claims; (2) judging their Program Management appropriateness; (3) paying appropriate ones promptly; (4) identifying potentially fraudulent claims or providers, and withholding payment if necessary; and (5) recovering overpayments or inappropriate payments. They are expected to manage Medicare’s funds in a fiscally responsible manner and to address effectively provider and beneficiary inquiries and problems. Each contractor must also develop a set of criteria to determine which claims it will pay. HCFA contractors use laws, regulations, the Medicare policy manuals, and periodic agency directives to guide their actions. With its broad range of services and billions of dollars in payments to about 1 million providers, Medicare is inherently vulnerable to fraudulent and abusive billing and to payment errors. HCFA relies on contractors to safeguard the program by identifying inappropriate claims and payments. The contractors do this by focusing on four primary areas that constitute HCFA’s payment safeguard activities: (1) medical review, (2) MSP review, (3) audit and reimbursement activities, and (4) fraud unit investigations. Page 14 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 1 Introduction • Contractors conduct medical reviews of claims, including automated and manual prepayment and postpayment reviews, to identify inappropriate claims. Claims may be inappropriate because they are incorrectly prepared, are for services that are medically unnecessary or not covered, or represent fraudulent or abusive billing practices. • Contractors’ MSP activities identify other primary sources of payment, such as employer-sponsored insurance or third-party liability settlements for claims submitted to Medicare. Contractors are required to collect from primary insurers if claims have been paid with Medicare funds that should have been paid by these sources. • Contractor audit and reimbursement activities include the review of overpayment collections and the audit of cost reports from institutions, such as hospitals, nursing homes, and home health agencies. The cost reports these providers submit are used in determining the amount of their Medicare reimbursement. • Contractor fraud units develop potential cases of fraud or abuse identified by beneficiaries, other contractor safeguard units, or other sources; when appropriate, a case is referred to HHS’ Office of Inspector General (OIG) for investigation and possible referral to the Department of Justice, which determines whether the case will be prosecuted. HCFA requires its contractors to submit complete and accurate information on their performance. In addition, the Federal Managers’ Financial Integrity Act of 1982 and the Chief Financial Officers Act of 1990 required each executive branch agency to establish and maintain a system of accounting and internal controls related to all assets for which it is responsible. In complying with this requirement, HCFA requires Medicare contractors, which control many of the funds for which HCFA is ultimately responsible, to submit annual certifications regarding their internal accounting and administrative controls. These certifications must reasonably ensure that the contractors are complying with applicable law and that their operations are safeguarded against waste, loss, or misappropriation. In its audits of HCFA’s financial statements for fiscal years 1997 and 1998, the HHS OIG estimated that contractors improperly paid more than $20 billion and $12 billion, respectively. Ninety percent of the improper payments for 1998 were detected through the medical review of records, which determines whether medical services are covered by Medicare and are reasonable, necessary, and appropriate. In addition, for each of those years, the OIG noted material internal control weaknesses for HCFA and its contractors. Page 15 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 1 Introduction The Social Security Act requires that the Secretary of Health and Human HCFA’s Role in Services develop standards, criteria, and procedures to evaluate Program Management intermediaries and carriers and determine whether contracts should be executed, renewed, or terminated. A few standards, such as how quickly certain claims are paid, are included in the law, and a few have resulted from lawsuit decisions. As the Medicare program steward, HCFA is responsible for ensuring that contractors do their jobs accurately and efficiently. This responsibility is carried out through staff in headquarters and regional offices. At headquarters, the Medicare Carrier and Intermediary Management group, under the newly established position of Deputy Director for Medicare Contractor Management in HCFA’s Center for Beneficiary Services, has overall responsibility for contractor operations. Although a number of other HCFA headquarters offices perform activities associated with contractors, this group serves as the focal point for contractor operations, issuing guidance and direction for contractor oversight. HCFA’s 10 regional offices conduct most of the oversight and evaluation of contractors, although regional office staffs report to their respective regional administrators. They are not organized under the direction of the new Deputy Director for Medicare Contractor Management. Although regions are generally responsible for overseeing contract operations in a specific geographic area, a regional office may oversee a contract outside that area. For example, the Atlanta regional office oversees 16 carrier and intermediary contracts for Alabama, Florida, Georgia, Kentucky, Louisiana, Mississippi, Missouri, North Carolina, South Carolina, and Tennessee. Although Louisiana and Missouri are outside Atlanta’s geographic boundaries, the Atlanta region oversees the intermediary operations for those states. Conversely, the Dallas region oversees a contract held by a South Carolina company to administer durable medical equipment claims, even though that company is located within the boundaries of the Atlanta region. While the Atlanta region oversees 16 contracts, these contracts are held by a smaller number of companies, because some companies hold multiple contracts. The South Carolina company mentioned, for example, holds intermediary and carrier contracts for several types of claims. In total, 44 companies hold the 58 intermediary and carrier contracts. Since fiscal year 1995, the primary tool regions have used to conduct contractor oversight is the Contractor Performance Evaluation (CPE) Page 16 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 1 Introduction program. This restructured evaluation program, which places emphasis on continuous improvement, gives HCFA the flexibility to review a contractor’s performance in any and all aspects of its contractually required duties. This approach was designed to give HCFA regional office reviewers flexibility in determining the types and levels of review for each contractor. CPEs are conducted in five general areas: • claims processing, • customer service, • payment safeguards, • fiscal responsibility, and • administrative activities. HCFA reviewers are expected to incorporate a review of internal controls into their assessments of particular contractor functions. HCFA’s Regional Office Manual for Medicare provides guidance for performing such reviews and requires reviewers to perform a walk-through of internal control procedures to understand any obvious breakdown in controls or noncompliance with procedures. After completing a review in a particular area, the reviewer is to report to the contractor on the results of the review. This report should spell out which areas, if any, need corrective action as a result of an identified deficiency. If corrective action is needed, the contractor must submit a Performance Improvement Plan specifying how the contractor will correct the deficiency. At the end of each fiscal year, the responsible HCFA region is to prepare a Report of Contractor Performance, which should summarize HCFA’s overall evaluation of the contractor’s performance based on the CPEs that were conducted during the year and any other monitoring activity. Recently, HCFA began to conduct what it calls “contractor integrity reviews” when it receives information of possible contractor wrongdoing. Headquarters and regional office staff usually conduct these ad hoc reviews with little advance notice to the contractor. An entrance conference is normally held, but few specifics about the allegations are provided to the contractor. In contrast to CPEs, where very little is done through interviews, integrity reviews are conducted first through interviews in which pointed questions such as “Have you ever altered or been asked to alter documents?” are asked and then through the review of Page 17 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 1 Introduction contractor records, where available. Various actions could be taken as a result of an integrity review, including requiring a Performance Improvement Plan; not renewing or terminating the contract; referring the case to the HHS OIG; or, if circumstances dictate, simply closing the review with no action. To determine whether weaknesses exist in HCFA’s contractor oversight Scope and activities that may make Medicare more vulnerable to fraud, waste, and Methodology abuse, we reviewed and analyzed documents related to HCFA’s oversight of its claims administration contractors, including related GAO and HHS OIG reports, and other documentation concerning lawsuits and integrity reviews of HCFA contractors. We also reviewed and analyzed 225 of the CPEs that HCFA regional reviewers had prepared concerning contractor operations for seven contracts for fiscal years 1995 through 1998. We discussed the oversight issue with responsible HCFA staff at headquarters and in HCFA’s Atlanta, Dallas, and San Francisco regions. Within each of these regions, we discussed HCFA oversight activities with officials at selected claims administration contractors representing intermediaries and carriers and local Blue Cross Blue Shield plans and commercial plans. We also discussed oversight activities with representatives of the Blue Cross Blue Shield Association, which represents local plans, and the Medicare Administration Committee, which represents other Medicare contractors. In addition, to determine whether any changes in HCFA’s contracting authority may improve HCFA’s ability to manage its contractors, we reviewed and analyzed Medicare’s legislative history; legal authorities; the contracting bill proposed by the administration; relevant GAO reports; the Federal Acquisition Regulations, which implement federal contracting law; and HCFA regulations governing Medicare contractors. We obtained written comments on a draft of this report from HCFA. HCFA’s comments, other than its technical comments, are in appendix I. We also obtained oral comments from the Blue Cross Blue Shield Association and the Medicare Administration Committee. We have incorporated their comments where appropriate. We did our work between June 1998 and June 1999 in accordance with generally accepted government auditing standards. To respond to a companion request that the Chairman made to GAO’s Office of Special Investigations, that office prepared a separate report, Page 18 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 1 Introduction Medicare: Improprieties by Contractors Compromised Medicare Program Integrity (GAO/OSI-99-7, July 14, 1999), that discusses deceptive contractor activities in recently completed cases. This report describes how those activities were carried out without HCFA detection and assesses the impact of the activities on the Medicare program. Page 19 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 2 Weak Oversight of Contractors Leaves Medicare Vulnerable HCFA’s oversight of its claims administration contractors has not been sufficient to ensure that contractors are adequately protecting program dollars. One sign of HCFA’s lax oversight is that six contractors since 1993 have settled civil and criminal charges after they were accused of improper activities, such as failing to check claims to ensure proper payment. These and other contractor integrity investigations have found common problems at some contractors—including falsified data and inadequate managerial controls. Despite these incidents, HCFA continues to let contractors self-certify their management controls, rarely checking to ensure that controls are working as required and rarely validating contractors’ self-reported data. HCFA’s oversight process lacks focus and accountability, setting few clear performance standards for contractors to meet and using limited priority-setting for regional reviewers. As a result, essential payment safeguard activities have gone unexamined for years at certain contractors. In addition, regional reviewers are inconsistent in requiring corrective actions when contractor problems are identified. HCFA’s organizational structure for contractor oversight does not ensure regional offices’ accountability for the oversight they perform. HCFA has acknowledged flaws in its oversight process and has begun to take steps to improve by moving toward a more structured evaluation process and reorganizing its contractor activities at headquarters. It is too soon to tell, however, whether these actions will resolve fundamental problems. Since 1990, nearly one in four claims administration contractors have been Contractor Integrity alleged, most often by inside whistle-blowers, to have integrity Problems Highlight problems—that is, that some of their activities were improper and Oversight Weaknesses potentially fraudulent. We identified at least 17 contractors that had either qui tam cases4 filed against them or had integrity reviews of their operations conducted by HCFA. Of the 58 contractors processing Medicare claims today, we identified at least seven that the Department of Justice or the HHS OIG is actively investigating. Since 1993, HCFA has entered into settlement agreements totaling more than $235 million5 as a result of civil and criminal cases against six contractors6—with allegations that company employees 4 Qui tam suits are filed under the False Claims Act, 31 U.S.C. sections 3729-3733. The act’s qui tam provisions permit filers to share in financial recoveries resulting from their case. 5 In addition to the $235 million recovered from these companies as civil settlements and criminal fines and penalties in civil and criminal fraud cases, at least three of these companies have also entered into settlements in civil liability cases brought by HCFA for recovery of about an additional $30 million owed to Medicare under the MSP program. 6 For more detail on these cases, see GAO/OSI-99-7, July 14, 1999. Page 20 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 2 Weak Oversight of Contractors Leaves Medicare Vulnerable • deleted backlogged claims from the processing system, thereby allowing the contractor to avoid paying interest on older claims; • manufactured documentation to allow the processing of claims that otherwise would have been rejected because the services were not medically necessary; • switched off the toll-free beneficiary inquiry lines when staff were unable to answer the calls within the prescribed amount of time; or • disabled computer functions that would have otherwise halted the processing of questionable claims for further review. Contractors misrepresented their performance to HCFA either to appear to meet standards they did not actually meet or to garner financial gain for the company. In a few cases, meeting performance standards was linked directly to financial incentives built into contracts, such as those in the 1991 through 1994 Health Care Service Corporation carrier contracts. In another case, a contractor’s employee admitted that when the company used Medicare resources to conduct its private business, it no longer had enough Medicare resources to hire adequate staff to perform Medicare work. Falsifying workload data allowed the company to appear to continue meeting contractual obligations and avoid nonrenewal of its contract. Table 2.1 illustrates the nature of alleged contractor wrongdoing in three cases. Page 21 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 2 Weak Oversight of Contractors Leaves Medicare Vulnerable Table 2.1: Allegations of Wrongdoing in Three Contractor Integrity Cases Contractor Allegation Blue Cross and Blue In a 1991 case filed under the False Claims Act and settled in Shield of Florida 1993, the contractor paid the Medicare program $10 million to settle allegations that it had —deleted durable medical equipment claims, —added false certifications of medical necessity to durable medical equipment claims to facilitate their processing, and —overridden computerized claims edits to speed claims processing without determining whether payment of the claims was proper. Blue Cross and Blue In 1995, the contractor agreed to pay the Medicare program Shield of Michigan $27.6 million in settlement of a qui tam suit filed by an employee who had alleged that the contractor had —reported that provider cost report audits had been completed when, in fact, important steps had not been completed; —tampered with cost report audits chosen by HCFA for review; —provided false information to HCFA to avoid review of chosen audits in cases in which an audit had too many mistakes; and —falsified overpayment records to make it appear that overpayments had been collected within 30 days, avoiding payment of interest due the government. Health Care Service In 1998, the contractor settled a False Claims Act case against Corporation (Blue it for $140 million and pled guilty to eight felony counts, paying Cross and Blue Shield an additional $4 million in criminal fines, because the contractor of Illinois) was alleged to have —allowed Medicare payment of claims that should have been paid by private health insurance; —destroyed Medicare claims that should have been submitted to another contractor; —periodically disconnected the required toll-free telephone lines used for beneficiary inquiries; —paid claims under $50 even if the services were not covered or not medically necessary; and —deleted, instead of suspending for review, claims with incorrect Health Insurance Claim numbers. HCFA is rarely the first to spot fraudulent practices through its routine oversight of Medicare contractors. Since 1990, HCFA’s routine oversight reviews were the basis for referral to the HHS OIG for only 3 of the 17 contractors we identified as having had integrity problems cited. In another case not included in those three, HCFA received an anonymous complaint alleging that a contractor had falsified documents to pass its annual review. Although HCFA investigated the complaint, it found nothing wrong because the contractor forged a document indicating that the problem was due to a computer error. Two years later, a whistle-blower Page 22 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 2 Weak Oversight of Contractors Leaves Medicare Vulnerable filed a qui tam suit that eventually led to a guilty plea to criminal charges as well as multimillion-dollar criminal fines and civil penalties. Because it is often difficult to detect wrongdoing when collusion is involved, fraudulent actions may go unnoticed for years. One integrity case involved contractors’ actions over a 13-year period, while another involved improper activity for more than 10 years. More than a dozen of these integrity cases were developed from qui tam suits filed by company insiders; leads reported to the HHS OIG; or senior company managers themselves, who called HCFA directly when problems were brought to their attention.7 However, information from whistle-blowers and HCFA officials familiar with integrity investigations suggests that the way that HCFA conducted on-site verification of contractor’s work allowed problems to remain undetected. HCFA reviewers notified contractors in advance concerning the dates of their on-site reviews and specific or probable records to examine, which allowed contractors to manipulate what HCFA reviewed. For example, Blue Cross and Blue Shield of Illinois allegedly used this prior notification to alter sample claim files scheduled for review. Similarly, Blue Shield of California allegedly deleted references to motor vehicle accidents in some claim files, because the medical claims paid might have been the responsibility of a liability insurer rather than Medicare. Moreover, when HCFA had contractors pull the records to be reviewed, it relied on copies of documents provided by the contractor, rather than originals, which made alteration harder to detect. Also, in some cases, HCFA representatives developed close relationships with contractor staff, which impeded HCFA’s ability to objectively review contractor performance, according to investigators, contractor staff, and HCFA officials. HCFA’s oversight process does not ensure that the contractors are HCFA’s Oversight of efficiently and effectively paying fee-for-service claims and protecting the Contractor Activities integrity of the program. First, while HCFA requires contractors to certify Is Uneven and annually that they have sound internal management controls over all of their Medicare operations, we found that HCFA neither regularly validates Inconsistent the effectiveness of the processes behind these self-certifications nor routinely tests contractors’ reported data to ensure that they are accurate. Second, HCFA has set few standards to measure contractor 7 HCFA is not always aware of qui tam suits, which are generally filed under seal until judicial decisions have been published. Page 23 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 2 Weak Oversight of Contractors Leaves Medicare Vulnerable performance—particularly in the area of safeguarding the program—and has generally given regional offices wide discretion in overseeing contractors without setting clear priorities and direction. This has predictably led to uneven results: certain essential payment safeguards at some contractors go unexamined for years, and corrective actions at some contractors are monitored more intensely than at others. HCFA has started to move toward a more structured evaluation process but has not yet addressed all of its oversight weaknesses. HCFA Does Not Regularly A fundamental activity in overseeing contractor performance is obtaining Check Contractors’ reasonable assurance that the contractors’ reporting data are accurate. As Self-Certifications of a first step in providing such assurance, HCFA requires contractors to certify that they have developed effective internal management controls Internal Controls, Nor over all aspects of their operations. However, we found that HCFA rarely Does It Validate Their looks behind the contractors’ self-certifications to ensure their validity, Performance Data nor does it independently validate contractors’ performance data, instead relying heavily on financial and workload data reported by the contractors themselves. HCFA therefore lacks assurance that contractors’ reports of financial and performance data—such as the amount of accounts receivable or claims processing timeliness, volume, and accuracy—are reliable. Medicare contractors are required to certify annually that they have established a system of internal management controls that help ensure that they meet program objectives, comply with laws and regulations, and are able to provide HCFA with reliable financial and management information concerning their operations. This is an important requirement because internal controls, effectively designed and operated, provide the best assurance that Medicare’s objectives will be achieved. In April 1998, as part of its fiscal year 1997 audit of HCFA’s financial statements, the HHS OIG reported that regional offices were not evaluating the accuracy and reliability of the documentation supporting contractor internal controls.8 In response, HCFA sent guidance to its regional reviewers reminding them to validate contractors’ self-certifications during their 1998 evaluation review cycle. Nevertheless, our analysis of fiscal year 1998 reviews performed at seven contractors found no case in which reviewers documented that they had assessed and validated contractors’ self-certified controls. We did find two cases that mentioned such reviews, 8 HHS OIG, Report on the Financial Statement Audit of the Health Care Financing Administration for Fiscal Year 1997, A-17-97-00097 (Washington, D.C.: HHS, Apr. 1, 1998). Page 24 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 2 Weak Oversight of Contractors Leaves Medicare Vulnerable but the reviewers merely checked whether the contractors had provided the required self-certifications—not whether the internal controls were actually in place or effective. The superficiality of these reviews is difficult to understand in light of the large number of contractors that have been found to have, or that are currently being investigated for, integrity problems. When HCFA performs an integrity review that confirms problems at a contractor, the report often concludes that there is a serious lack of internal controls and recommends that any corrective action plan include establishing such controls in vulnerable areas. With only minimal regular review of the contractors’ self-certifications of their management controls, HCFA has little information to assess the integrity of contractors’ operations or the reliability of their management and financial performance. Where internal controls are weak or untested and the risk of error is high, the need to validate self-reported data becomes increasingly important. HCFA largely relies on contractor-submitted financial and workload data when evaluating and monitoring performance and does little independent validation of these data. In our analysis of 170 reviews completed for fiscal years 1995 through 1997 covering seven contractors, only two reviews documented reviewers’ efforts to validate contractor workload data. In one review, HCFA staff tested the accuracy of contractor workload data related to the time the contractor took to perform desk reviews and audits. In the other, HCFA reviewers tested the accuracy of the filing date for claims subjected to medical review to determine whether the contractor reported correct claims processing times. For 1998, staff in one of the three regions we visited validated workload data in five of its reviews—checking, for example, the accuracy of workload data on medical reviews and telephone inquiries that the contractors had reported to HCFA. Staffs in the other two regions did not validate any workload data in fiscal year 1998. Validating workload data has not been a consistent management priority. A HCFA headquarters official told us that although headquarters staff used to validate this type of data—sometimes with the assistance of regional office staff and in addition to any other regional reviews—it has not done so on a routine basis since 1994, when the headquarters group performing validation was dissolved. Regional officials told us that they believe the staff resources and travel funds available to perform detailed testing and validation are not adequate to ensure the accuracy of contractor-reported data. During our work at the regional offices, we found that the frequency Page 25 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 2 Weak Oversight of Contractors Leaves Medicare Vulnerable of on-site reviews varied greatly, and it was not unusual for staff to spend as little as a few days once a year at a contractor’s site. For 1998, however, HCFA directed the regions to validate claims during their examination of contractor medical review activities, and each of the three regions we reviewed did so for at least one contractor. Also, according to HCFA’s Comprehensive Plan for Program Integrity issued early in calendar year 1999, HCFA has contracted for the verification and validation of medical review claims on a sample basis at selected contractors. On the basis of the results of this effort, the verification and validation contractor will make recommendations to HCFA for any necessary corrective action. In addition to workload data being vulnerable to error or misrepresentation, critical financial information also gets limited review and validation—either by the contractors or by HCFA staff. The HHS OIG report on HCFA’s financial statements for fiscal year 1997 found that HCFA relies on its Monthly Contractor Financial Report to ensure that all amounts reported to HCFA by Medicare contractors are accurate, supported, complete, and properly classified. When OIG auditors reviewed these reports, their supporting documentation, and the processes used to produce them at 11 contractors, they found that the contractors’ accounting ledgers were not maintained properly to support these reports, and some contractors did not subject the reports to independent verification. According to the auditors, although they had noted similar weaknesses in prior OIG reports issued to HCFA, the agency had not ensured that contractors had corrected these problems. In response to the OIG’s 1997 audit, HCFA headquarters officials advised regional reviewers in fiscal year 1998 to check key financial data for the largest intermediaries and for any carrier contracts held by the same contractors. As a result, the two regions in our study to which this advice applied reviewed financial data for three of their large contractors, checking items such as accounts payable and accounts receivable. Although the OIG’s 1998 report noted some improvement in this area, it was not sufficient to remove the qualification on the OIG’s opinion of HCFA’s financial statements. Lack of Performance HCFA’s efforts to evaluate contractor performance in the last decade have Standards and Wide suffered from extremes—a previous evaluation approach was inflexible Discretion Given to and not focused on outcomes, while the current approach, in our opinion, is too discretionary and still fails to focus on outcomes. Under its current Reviewers Leads to approach, HCFA has set few measurable performance standards for Inconsistent Oversight Page 26 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 2 Weak Oversight of Contractors Leaves Medicare Vulnerable contractors, has given regional oversight staff wide discretion over what aspects of contractor performance to review, and does not check on the quality of regional oversight. Not surprisingly, important program safeguards have received little scrutiny at some contractors, and regions have been inconsistent in their responses to contractor performance problems. HCFA has begun to give more oversight direction, but its actions to date have been limited. HCFA’s Evaluation Process Under the evaluation process used from fiscal years 1980 to 1995, HCFA Emphasizes Flexibility examined a predetermined subset of contractors’ activities each year and assigned each contractor a numerical score. Although performance standards were explicit under this approach, we reported that the standards focused more on process than outcome. Therefore, the evaluation process did not sufficiently emphasize efforts to ensure that program benefits were paid appropriately, particularly by measuring the effectiveness of program safeguards.9 Furthermore, HCFA believed that this approach encouraged contractors to manage their activities in a way that would maximize their score, thus dissuading HCFA reviewers from targeting other potentially troublesome areas. HCFA developed a new evaluation approach for fiscal year 1995, known as the CPE process, designed to allow individual reviewers “greater flexibility in determining the appropriate types and levels of review for each contractor.”10 Under this approach, HCFA’s reviewers may examine any aspect of contractor operations and, with a few exceptions, have no common standards against which to assess the 58 contractors. Until fiscal year 1998, HCFA did not issue guidance for reviewers to evaluate even a minimum set of essential operations. But because of the OIG’s and our concern about HCFA’s oversight of Medicare contractors, HCFA issued guidance for its regions to review certain areas for fiscal year 1998. The guidance was issued late, however—not until the eighth month of the fiscal year. HCFA’scontractor performance evaluations do not follow a set report format, although regional staffs were reminded by memo in 1998 that evaluations should contain certain key items. Such a flexible evaluation 9 Medicare: HCFA’s Contracting Authority for Processing Medicare Claims (GAO/HEHS-94-171, Aug. 2, 1994) and Medicare: Inadequate Review of Claims Payments Limits Ability to Control Spending (GAO/HEHS-94-42, Apr. 28, 1994). 10 HHS, HCFA, Regional Office Manual, Section 1100, “Contractor Performance Evaluation” (Baltimore, Md.: HCFA, May 1995). Page 27 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 2 Weak Oversight of Contractors Leaves Medicare Vulnerable process has produced a varying assortment of reports that make analytic interpretations difficult and cross-contractor comparisons impossible. HCFA Has Few Measurable Except for standards mandated by legislation, regulation, or judicial Performance Standards decision, HCFA’s current CPE process eliminated the previous evaluation system’s process standards for contractors without requiring sufficient outcome standards (see table 2.2 for the mandated standards). As a result, the current process contains few measurable standards to ensure that contractors adequately perform important program safeguards, such as medical review of claims. The lack of sufficient standards is worrisome because, in the case of medical review, HCFA has made more effective medical review part of its plan to strengthen program integrity. In our opinion, the lack of clear performance standards decreases the likelihood that HCFA will get maximum performance from contractors. Page 28 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 2 Weak Oversight of Contractors Leaves Medicare Vulnerable Table 2.2: Performance Standards Mandated by Law, Regulation, or Evaluation area Applies to Performance standard Judicial Decision, by Evaluation Area Claims processing Electronic part A and part B 95 percent paid within claims properly prepared 14-30 days of receipt and submitted Paper part A and part B 95 percent paid within claims properly prepared 27-30 days of receipt and submitted Part A Administrative Law 5 percent or less Judge reversal rate of claim decisions Part A reconsideration of 75 percent processed claim decisions within 60 days, 90 percent within 90 days Part B reviews of claim 95 percent completed decisions within 45 days Part B hearings of claim 90 percent completed decisions within 120 days Customer service Part B notice to 98 percent properly beneficiaries explaining the generated basis for coverage and reimbursement decisions Part B telephone inquiries Calls answered within 120 from beneficiaries seconds; callers are not to get busy signal more than 20 percent of time Payment safeguards Part A skilled nursing facility All processed accurately demand billsa Part A Tax Equity and Fiscal Completed within 75 days Responsibility Act of 1982 or returned as incomplete target rate adjustments, within 60 days exceptions, and exemptionsb a Skilled nursing facilities are required to determine whether a beneficiary’s care will be covered by Medicare. If a skilled nursing facility determines that a beneficiary’s care will not be covered, it must still submit a demand bill to the contractor for review of the coverage determination, if the beneficiary demands it. b For hospitals not paid on a prospective basis, the 1982 act provided for a ceiling on the allowable rate of increase in hospital inpatient operating costs. Adjustments, exceptions, and exemptions, if properly documented, can be made under the act’s provisions at the request of the hospital. Even for the mandated standards listed in table 2.2, HCFA does not require that regional reviewers check them routinely. According to a HCFA manual, reviewers are not required to evaluate whether contractors meet the mandated standards unless the reviewers choose to evaluate that specific Page 29 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 2 Weak Oversight of Contractors Leaves Medicare Vulnerable area of contractor performance.11 If regional reviewers choose to look at a contractor’s claims processing activity, for example, they are required to check whether contractors met the mandated claims processing timeliness standards. Our analysis of CPE reports for three regional offices found that these regions often did not meet the requirement to review claims processing standards when reviewing claims processing activities. For fiscal years 1995 through 1998, we found that, for seven contractors, claims processing was reviewed at least once a year at one contractor and less frequently at the others. When HCFA reviewers did assess claims processing activities, they checked about half of the applicable mandated standards. In addition, the three regions varied considerably in the percentage of applicable mandated standards their staff checked, as shown in figure 2.1. Figure 2.1: Three Regions’ Rates of Compliance With Requirement to Check Whether Contractor Met Mandated Claims Processing Standards, FY 1995-98 HCFA Does Not Examine The combination of wide discretion, few common measures, and limited Essential Contractor headquarters guidance leads to uneven review of contractor performance Payment Safeguards in critical areas, including the effectiveness of payment safeguards. The following illustrates this effect for two types of program safeguards—MSP and contractor fraud unit activities. 11 HHS, HCFA, Regional Office Manual, Section 1100, p. 1-21.1. Page 30 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 2 Weak Oversight of Contractors Leaves Medicare Vulnerable Medicare Secondary Payer—MSP activities seek to (1) identify insurers that should pay claims mistakenly billed to Medicare and (2) recoup any payments Medicare made for claims not first identified as the responsibility of other insurers. (Table 2.3 shows some of these key activities.) Table 2.3: Key MSP Activities Conducted by Contractors First claim Research the first claim of a beneficiary to identify the possibility development that future claims may not be the primary responsibility of Medicare. One way that contractors determine whether they should pay such claims is to contact beneficiaries when their first claims are received. After first claim development, contractors should be able to catch MSP claims and forward them to the proper payer. Data match Match data contained in several federal information systems—including files from the Internal Revenue Service and the Social Security Administration—to identify beneficiaries that have the potential for being covered by employee health insurance. Claims processing Before paying a claim, check information in HCFA’s regional through the common databases, known as the common working file, to determine working file beneficiary eligibility and reasons for not paying, such as when the beneficiary has other insurance. Retroactive recovery Recovering erroneous Medicare claim payments after mistakes or waiver of recovery have been discovered, such as cases in which coverage, especially by automobile liability and no-fault plans, is not immediately discernible. The recovery can be waived in certain situations, such as when the beneficiary is without fault or recovery would be more expensive than the amount in question. Saving about $3 billion annually from 1994 through 1998, MSP review is a substantial Medicare payment safeguard. Despite the opportunity for large dollar savings, however, our review of three regions’ CPE reports—documenting which of the multiple MSP activities were examined—shows that, over 4 years, reviewers did not check many of the key activities most germane to spotting claims covered by MSP provisions. The check marks in figure 2.2 show that key MSP activities were reviewed rarely, particularly by Region B. Page 31 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 2 Weak Oversight of Contractors Leaves Medicare Vulnerable Figure 2.2: Key MSP Activities Reviewed for Seven Contractors, FY 1995-98 The potential for contractor fraud regarding MSP activities is significant because of an inherent conflict of interest: the private insurance business of the contractor can be the primary payer for some claims subject to the MSP provisions. HCFA has had to pursue certain insurance companies—some with related corporations that are Medicare contractors—in federal civil court for refusing to pay before Medicare when the government contends that Medicare should have been the secondary insurance payer. Since 1995, settlements in cases in which a related company was a Medicare carrier or intermediary have totaled almost $66 million.12 HCFA currently has an additional $98 million in claims 12 These contractors include the national Blue Cross Blue Shield Association, Blue Cross Blue Shield of Florida, Blue Cross Blue Shield of Massachusetts, Blue Cross Blue Shield of Michigan, Transamerica, and Travelers. Page 32 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 2 Weak Oversight of Contractors Leaves Medicare Vulnerable filed against current and former contractors. In our opinion, the considerable size of annual MSP savings, coupled with HCFA’s past experience with contractor performance and the extra effort involved in identifying beneficiaries’ primary insurers, underscore the need for regular scrutiny of these activities. Fraud Units—HCFA requires all intermediaries and carriers to operate special units for detecting and deterring fraud. The units are expected to, among other activities, determine the factual basis of fraud complaints made by beneficiaries and others, explore leads, and develop and refer cases to the HHS OIG. The OIG’s 1998 report on intermediaries’ fraud units found significant disparities in the fraud units’ performances: one unit handled over 600 fraud cases, and others handled none; one referred over 100 cases to the HHS OIG, and others referred none.13 The HHS OIG also found weaknesses in HCFA’s evaluations that allowed contractor performance to go unchecked. For example, HCFA’s reviewers did not routinely check and report on whether contractors were identifying program vulnerabilities, such as loose program guidelines that invited inappropriate billings. Although identification of program vulnerabilities heads the list of fraud unit responsibilities, only 10 percent of HCFA’s CPE reports on fraud units stated whether the unit had carried out this responsibility. In its 1998 report, the OIG recommended that HCFA establish standards for contractor performance; measure performance against those standards; and require that CPE reports list HCFA’s performance standards and state contractors’ compliance with the standards explicitly. HCFA substantively concurred with all of the OIG’s recommendations and noted certain initial steps it had already taken in fiscal year 1998 and its intent to address the recommendations more comprehensively in later years. Reviewers Inconsistent in Without a set of clearly defined and measurable performance standards or Prescribing Corrective measures, contractors lack clear expectations. This has resulted in Actions inconsistencies in HCFA reviewers’ handling of contractor performance problems. Besides the inequity for contractors, such uneven review leaves HCFA without the ability to discriminate between contractors’ performance when assigning new work. 13 HHS OIG, Fiscal Intermediary Fraud Units, OEI-03-97-00350 (Washington, D.C.: HHS OIG, Nov. 1998). Page 33 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 2 Weak Oversight of Contractors Leaves Medicare Vulnerable HCFA officials told us that some regions are known to be “easier” on contractors than others. We found instances in which regions handled similar types of contractor activities differently. For example, one company held two contracts for two states—each overseen by a different region. As part of its program safeguard activities, the company analyzed paid claims at one central location to identify possible fraudulent or abusive provider billing trends. While the company conducted identical types of analyses for both contracts, one region found that the contractor’s data analysis activities did not fulfill HCFA’s expectations, while the other region found the contractor in compliance with HCFA’s analytic expectations. Although these regions had signed a memorandum of understanding to seek consistency in how they directed the contractor, and to coordinate oversight to avoid duplication of effort, they did not work together to resolve their differences and guide the contractor with one voice. HCFA reviewers may not only disagree about whether a problem exists but also take dissimilar actions once a performance problem is identified. HCFA’s normal procedure after identifying a program deficiency is to require the contractor to develop a Performance Improvement Plan (PIP) to correct the problem, and then to monitor the plan. PIPs can be stringent corrective actions for contractors. Contractors operating under a PIP can be required to make complex changes in operations and to submit performance data and reports about their activities until HCFA decides that their performance has improved. HCFA reviewers differ in whether they require PIPs, even in cases that seem quite similar. For example, in one region, a contractor with a high error rate in one component of its medical review process passed its periodic evaluation without any requirements to improve. In another region, a contractor with a similarly high error rate was required to develop and follow a PIP. Similarly, one region required a contractor to develop and follow PIPs for deficiencies in its performance in fraud and abuse prevention and detection. This contractor did not maintain and use a fraud investigation database. All cases were not entered into the database, and there were quality problems with some of the cases that were entered. In contrast, another region, reviewing a different contractor, found many more serious weaknesses with that contractor’s fraud and abuse prevention and detection activities. The reviewer concluded that the contractor did not meet HCFA’s performance expectations, yet did not require a PIP. Included Page 34 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 2 Weak Oversight of Contractors Leaves Medicare Vulnerable in the weaknesses the reviewer identified were (1) spending little or no time actively detecting fraud and abuse; (2) not using data to detect egregious cases; (3) focusing on small, rather than large and more complex, dollar cases; (4) referring only one case to the HHS OIG during the year; (5) inadequately recovering overpayments; (6) failing to suspend payments to questionable providers; (7) failing to prioritize cases; and (8) preparing no fraud alerts. Regions varied widely in their use of PIPs in 1996 and 1997. As table 2.4 shows, some regions required few or no PIPs of the contractors they oversee, while others used this mechanism extensively. We could not determine whether this variance was due to better contractor performance in some regions, or regional practices regarding the use of PIPs. However, HCFA was concerned enough about the variation that in 1998 it provided additional guidance to regions clarifying the difference between a program deficiency, which requires a PIP, and a program vulnerability, which does not. Table 2.4: Number of Contracts Overseen and PIPs Required for FY 1996—number of FY 1997—number of Contractors, by Region, FY 1996 and Region Contracts PIPs Contracts PIPs 1997 Boston 10 7 11 3 New York 7 3 7 7 Philadelphia 10 8 9 16 Atlanta 18 30 16 40 Chicago 14 16 13 100 Dallas 9 1 6 6 Kansas City 8 15 8 11 Denver 8 4 8 0 San Francisco 8 9 5 21 Seattle 6 0 4 10 Total 98 93 87 214 Source: HCFA data. HCFA Has Begun to Move HCFA has recognized that its oversight of contractors has been less than to a More Structured adequate and issued guidance in fiscal year 1998 to have regional Evaluation Process reviewers follow a somewhat more structured evaluation process. However, these actions are only a first step in addressing problems with contractor oversight. Page 35 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 2 Weak Oversight of Contractors Leaves Medicare Vulnerable In May 1998, citing concerns raised by the HHS OIG and us regarding HCFA’s level of contractor oversight, HCFA announced the “need to reengineer our current contractor monitoring and evaluation approach and develop a strategy demonstrating stronger commitment to this effort.” Specifically, HCFA issued a contractor performance evaluation plan specifying three evaluation priorities for fiscal year 1998: (1) year 2000 compliance activities, (2) activities focusing on a subset of financial management operations—accounts receivable and payable, and (3) activities focusing on a subset of medical review activities. Because of the regions’ workload concerns, HCFA later scaled down its requirements in the financial management area. Also in 1998, HCFA emphasized the need for regions to follow its structured CPE report format, including clearly stating whether the contractor complied with HCFA’s performance requirements. Nonetheless, we found that some of the 1998 reviews continued to lack a structured format, making it difficult to compare contractor performance. For example, HCFA’s contractor evaluation plan for fiscal year 1998, issued 5 months before the close of the fiscal year, called for examining contractors’ activities with regard to reviewing claims for medical necessity before they are paid (called prepayment medical review). Our review of the three regions’ fiscal year 1998 CPE reports shows that (1) two regions did not review contractors’ determinations of medical necessity at all contractors included in our study before payment and (2) two regions did not consistently follow the structured report format, making it difficult for HCFA headquarters to evaluate or compare the results. Despite HCFA’s intent to provide more direction to the regions on contractor oversight activities, it continues to issue review guidance late in the year. Agency officials recently told us that its plan for CPE reviews for fiscal year 1999 will include more headquarters involvement in the assessment process, review teams from headquarters and the regions, and multiregional reviews. As of May 1999—7 months into the fiscal year—HCFA had not yet issued its fiscal year 1999 guidance. Two aspects of HCFA’s current organizational structure create problems for HCFA Lacks a overseeing contractors. First, HCFA reorganized its headquarters operations Structure That in 1997, dispersing responsibility for contractor activities from one Ensures headquarters component to seven. Second, although HCFA’s 10 regional offices are the front line for overseeing contractors, they do not report Accountability directly to headquarters units responsible for contractor performance. Page 36 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 2 Weak Oversight of Contractors Leaves Medicare Vulnerable Instead, they report to the HCFA Administrator, through their respective regional administrators and consortia directors. We found that the structural relationship and the dispersal of responsibility for contractor activities to multiple headquarters components contribute to communications problems with contractors, exacerbate the weaknesses of HCFA’s oversight process, and blur accountability for (1) having regions adopt best practices; (2) routinely evaluating the regional offices’ oversight; and (3) enforcing minimum standards for conducting oversight activities, including taking action when a particular region is not performing well in overseeing contractors. To establish more consistency and improve the quality of contractor management and oversight, HCFA recently modified its organizational structure again, but these changes may not be sufficient. HCFA’s Structure HCFA’s 1997 agencywide reorganization dispersed contractor Contributes to Problems in responsibilities to seven headquarters offices. To ensure that contractors Communications and received clear program direction under the new structure, HCFA formalized its process for issuing contractor guidance and making system changes. Oversight However, contractors report continued problems in receiving all required information. In addition, HCFA does not share among regions best practices or lessons learned from integrity reviews, nor does it evaluate the quality of regional oversight. Furthermore, since regional contractor oversight staffs do not report to headquarters staff responsible for contractor activities, HCFA’s structure does not foster consistent accountability and oversight. Before HCFA’s 1997 reorganization, responsibility for managing Medicare contractors fell to the Bureau of Program Operations in headquarters and the 10 regional offices. The Bureau provided guidance to regional offices and was responsible for almost every aspect of contractor management at headquarters, including selection, budgeting, and ensuring proper monitoring of contractor performance. The regional offices carried out the day-to-day oversight at specific contractors. Under the 1997 reorganization, regions retained their role as the primary contract monitors, but responsibility at headquarters for contractor functions was dispersed among seven headquarters components. This functional dispersion, in part, was in response to concern that one office, such as the Bureau, should not oversee all contractor activities, and instead offices with responsibility for contractor functions should have Page 37 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 2 Weak Oversight of Contractors Leaves Medicare Vulnerable more functional independence. Table 2.5 shows the headquarters units involved in contractor management. Table 2.5: HCFA Headquarters Units With Responsibilities for Medicare HCFA organizational Component Contractor Issues component Subcomponents responsibilities Center for Beneficiary Medicare Carrier and Contractor management Services Intermediary Management focal point. Contractor Group: Division of performance evaluations, Contractor Operations, transitions, Division of Contractor customer service, Planning, Division of beneficiary enrollment, Contractor Integrity and coordination of benefits, Performance Evaluation and appeals. Customer and Teleservice Operations Group: Division of Contractor Customer Service Operations and Division of Call Center Operations Beneficiary Membership Administration Group: Division of Membership Operation and Division of Member Rights and Protections Center for Health Plans and Provider Purchasing and Claims processing and Providers Administration Group: payment issues, Division of Institutional provider/supplier enrollment. Claims Processing, Division of Practitioner Claims Processing, Division of Supplier Claims Processing, and Division of Provider/Supplier Enrollment Office of Financial Financial Services Group: Accounting operations, Management Division of Accounting and budget, cost reporting, Division of Financial cash management/letter of Integrity—MSP Operations credit, MIP, other payment Branch, Debt Collection safeguards, and internal Branch, and Provider Audit controls. Operations Branch Program Integrity Group: Division of Program Integrity Operations (continued) Page 38 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 2 Weak Oversight of Contractors Leaves Medicare Vulnerable HCFA organizational Component component Subcomponents responsibilities Office of Information Services Business Systems Change management, Operations Group: Division standard systems, common of Change Management working file, paper and and Division of Standard electronic data interchange, Systems and Common administrative transactions, Working File Security and and systems security. Standards Group: Division of Health Care Information Systems Standards: Division of HCFA Enterprise Standards Office of Internal Customer Acquisition and Grants Contracting issues. Support Group: Division of Medicare Contractors Office of Clinical Standards Coverage issues. and Quality Office of Communications Operations Support Group: Manual and program and Operations Support Division of Regulations and guidance. Issuances Source: HCFA. Because the 1997 reorganization spread contractor-related responsibilities among multiple headquarters units, the Medicare Contractor Management Group (CMG), in the Center for Beneficiary Services, was established as a focal point for providing guidance to the contractors and the regional offices. The CMG worked with other headquarters components and the regional offices to coordinate the issuance of guidance and activities related to contractor selection, budgets, transitions, processing systems, and performance evaluations. Recognizing that the dispersal of responsibilities could confuse contractors, HCFA also established the Medicare Change Management Process in October 1997 to ensure that the newly reorganized agency provided clear program direction directly to its contractors. This process required that the CMG, after coordinating the development of guidance or system programming instructions for the contractors, formally certify the instructions before they were implemented. It also effectively removed the regional offices as conduits for information from headquarters to the contractors. Despite these efforts, there have been problems. Primary among them are the uncertainties that contractors are, in fact, receiving and implementing Page 39 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 2 Weak Oversight of Contractors Leaves Medicare Vulnerable all instructions and that regions are not always aware of the instructions being conveyed. According to agency officials, HCFA is developing a checking process to remedy these problems. To test the adequacy of HCFA’s communications with its contractors, the Blue Cross Blue Shield Association analyzed recent documents that three contractors reporting to three different regions received from headquarters or their respective regional offices. According to the Association’s analysis, each of the three contractors did not receive about half of what they classified as key directives. In addition, at the time, certain HCFA directives were still being funneled through regions to contractors. Regions also varied in how well they transmitted information to their contractors, with one region being noticeably slower at transmitting directives than the other two. In addition to having communications problems with contractors, HCFA also has not communicated to regional reviewers lessons learned from best oversight practices or from integrity investigations. HCFA acknowledges that some regions do a better job than others and would like to capitalize on the successful approaches particular regions employ. In fact, in a memorandum to the regions dated August 4, 1998, from HCFA’s Division of Contractor Integrity and Performance Evaluation, the division director indicated that a sample of regional CPE reports would be reviewed and periodic summaries developed to share best practices with other regions. However, HCFA has not yet prepared any best practices summaries, in part because the CPE reports were submitted late, according to the director. The director also was concerned that the untimely submission of CPE reports to headquarters may indicate that the regions are not providing their contractors with timely information on review results. But because this Division’s relationship with the regions is advisory, the director could not require regions to be more timely. Regions could also benefit from information obtained from contractor integrity investigations, but HCFA has not incorporated such lessons into its routine oversight practices. These integrity investigations follow allegations of wrongdoing and entail interviewing company employees and combing through company records. In some cases, the employee interviews have given HCFA leads that may not have been evident through HCFA’s current CPE process, such as instructions to alter Medicare performance data or to destroy company records. According to staff experienced in conducting integrity reviews, HCFA’s on-site presence also typically leads to the discovery of performance problems not previously Page 40 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 2 Weak Oversight of Contractors Leaves Medicare Vulnerable identified at the contractor under review. We found that integrity reviews are typically done in reaction to allegations of wrongdoing and usually are conducted or directed by headquarters personnel. Because these reviews are seen largely as one-time, unusual events rather than as a pattern of practices at more than one contractor, HCFA has not developed a formal mechanism to communicate information learned about root causes and prevention of these problems. Nor has it incorporated such knowledge into HCFA’s routine oversight. Finally, with few formal requirements for regions to report to headquarters, HCFA does not collect, analyze, or evaluate information on the quality of regional oversight across the country. It does not have information on the relative strengths and weaknesses in regional performance or on whether all contractors are being treated equitably; therefore, it cannot provide formal feedback to regions to improve their performance. Even if it had good information on regional performance, the structural relationship between headquarters units and the regions would not lend itself to HCFA’s scrutiny of its regions. Regional offices report directly to the HCFA Administrator through their respective regional administrators and consortia directors. Regional staffs responsible for contractor oversight do not report to the headquarters unit most involved with contractor oversight. As a result, this headquarters unit is not clearly directing contractor oversight. To illustrate, a HCFA memo to the regions concerning the validation of contractor self-certifications as part of the 1998 review cycle stated that reviewers should perform this activity “if it would be convenient.” A HCFA headquarters staff member told us that the memo was intended to strongly encourage reviewers to do this activity but did not directly order reviewers to do it because the headquarters unit lacked the authority to do so. HCFA Is Again HCFA officials have come to recognize that the agency does not have an Reorganizing Headquarters adequate contractor strategy. During the latter part of our review, HCFA Functions to Address officials told us that they were reorganizing the agency’s contractor management activities. This may be a good start, but it is too soon to tell Management Weaknesses how well this will address the fundamental problems HCFA has had ensuring adequate and consistent contractor oversight. Page 41 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 2 Weak Oversight of Contractors Leaves Medicare Vulnerable In late 1998, HCFA established the Medicare Contractor Oversight Board, a subgroup of the Executive Council,14 to provide high-level oversight of contractor activity and to better represent contractor issues at HCFA. In addition, the HCFA Administrator has created a new deputy position for contractor operations in HCFA’s Center for Beneficiary Services. According to HCFA officials, as a senior HCFA official responsible for contractor operations, this deputy will bring contractor issues to the Executive Council more effectively and will serve as the Executive Director of the Oversight Board, which reports to the HCFA Administrator. HCFA has also established a group of headquarters and regional officials to work with an outside expert to develop a strategic plan for managing Medicare contractors. The plan is expected to be complete in the summer of 1999. Finally, HCFA is adding 21 new contractor management staff at headquarters—11 of which will be involved in coordinating activities with other organizational components. These changes have the potential to elevate contractor issues to more senior decisionmakers and improve communications among the units that share responsibility for contractor management and oversight. However, it is too soon to tell whether this new organization will lead to improved contractor oversight. 14 The Executive Council is a group of senior HCFA executives chaired by the Administrator. Responsible for the operation of HCFA programs, the council establishes performance standards for all HCFA programs and monitors the agency’s operations to ensure that the standards are being met. Page 42 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 3 HCFA Would Need Time and Careful Implementation to Benefit From New Contracting Authority HCFA’s current legislative authority, its interpretation of that authority, and its regulations constrain its ability to choose contractors and attract new companies as contractors. To remedy this, HCFA has proposed legislation that addresses perceived barriers to effective contracting for Medicare claims administration services. The proposed changes include obtaining (1) authority to contract with other than health insuring organizations, coupled with repeal of the provider nomination provision for selecting intermediaries, (2) authority to contract for specific activities other than payment safeguards, and (3) unrestricted authority to award other than cost-based contracts. In 1996, HCFA was given new authority to contract separately just for payment safeguard activities, such as medical review of claims, to ensure the services were medically necessary. HCFA’s experience in implementing its new payment safeguard contract authority attests to the need for significant time to explore and resolve several feasibility issues. In addition, HCFA’s previous experience with the use of fixed price and cost-plus-incentive payments suggests that any change from cost-based contracting will need to be carefully designed and thoughtfully monitored to prevent loss to the Medicare program. Testing different methods of contracting could help HCFA ensure that implementation would improve, rather than weaken, program administration. When Medicare was implemented in 1966, the government used existing Constraints on health insurers, as the Congress intended, to process and pay claims, and Contracting Authority their expertise helped launch the new program. Subsequent regulations Limit HCFA’s Ability and decades of the agency’s own practices have further limited how HCFA contracts for claims administration services. In this regard, HCFA has to Attract New Companies • not contracted with companies other than health insurers to handle any aspects of administering Medicare claims, and only health insurers have met the statutory definition of carriers; • not awarded separate contracts for discrete claims administration functions because its law and regulations impede it from doing so, except for payment safeguard contracts, which have recently been awarded under its 1996 authority to contract separately for these activities only; and • infrequently used financial inducements, such as incentive payments, that would allow a company to earn a profit for superior performance, and its authority to do so has specific limits. The Congress intended the government to contract with intermediaries and carriers for the administration of the Medicare program, but it did not mandate that such contractors be used. Sections 1816 and 1842 of the Page 43 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 3 HCFA Would Need Time and Careful Implementation to Benefit From New Contracting Authority Social Security Act “authorize” the Secretary of Health and Human Services to enter into such contracts. Section 1874 grants the Secretary authority to “perform any of [the] functions under [Medicare] directly, or by contract. . . .” Based largely on what it understands to have been congressional intent, HCFA believes that it is required to contract with intermediaries and carriers for all claims administration. HCFA is pursuing legislation that will provide explicit authority for it to do otherwise. The initial rationale for some of HCFA’s practices under current authority and regulations has faded against the backdrop of today’s health care business environment. In the three decades since Medicare’s creation, the explosion in information management technology, coupled with the diversification of the health insurance industry into activities such as provision of health services, has generated the potential and need for Medicare to use new types of business entities to administer its claims processing and related functions. However, the combination of the health insurer-only limitation, constraints on disaggregating administrative functions, and limits on contractor financial incentives severely hamper efforts to modernize Medicare’s contracting processes and encourage new companies to become contractors. The need to broaden the pool of eligible Medicare contractors has become acute in light of contractor attrition. Since 1980, the number of contractors has dropped by about half. In some cases in the 1980s, contractors were consolidated to achieve administrative efficiencies. However, continued erosion in the number of contractors has left HCFA with fewer choices when one contractor withdraws from the program and another must be chosen to process the claims.15 In the last 10 years, the number of Medicare contractors dropped about a third—from 85 to 58. (See fig. 3.1.) 15 The desired attrition that began in the 1980s occurred after our 1979 report calling for consolidating carrier and intermediary workloads to achieve greater efficiency. See More Can Be Done to Achieve Greater Efficiency in Contracting for Medicare Claims Processing (GAO/HRD-79-76, June 29, 1979). Page 44 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 3 HCFA Would Need Time and Careful Implementation to Benefit From New Contracting Authority Figure 3.1: Number of Medicare Claims Administration Contractors, 1980-99 The pool of contractors eligible and able to assume reassigned work is, in effect, smaller than the 58 intermediaries and carriers currently serving Medicare. First, some existing contractors are too small to easily absorb a substantially increased workload. When a Blue Shield carrier announced that it was leaving the program in 1996, for example, another one wanted to assume the workload, which would have increased the second contractor’s workload about tenfold. According to HCFA officials, however, the agency avoids adding so much work to smaller contractors to mitigate the risk of a breakdown in service—most notably, timely and accurate payments to providers. Second, some contractors may not be interested in expanding their workload. Third, it is not desirable for HCFA to choose a contractor that it knows is being investigated or prosecuted. HCFA has allowed at least one contractor that had been the subject of an investigation to expand its workload.16 16 Several reasons accounted for HCFA’s unusual decision in this case, including (1) the contractor’s self-disclosure of the problem; (2) its willingness to cooperate with HCFA when the agency stepped in to investigate; and (3) the steps the contractor took to ensure that the problem did not recur, including firing employees involved in wrongdoing. Page 45 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 3 HCFA Would Need Time and Careful Implementation to Benefit From New Contracting Authority The threat of financial penalties can influence a company’s decision to drop out of the program. About a third of the nonrenewing contractors since 1990 had allegations of wrongdoing made against them. Of the 58 contractors remaining today,17 at least 7 are subject to ongoing investigations. These seven contractors administered over 30 percent of Medicare’s fee-for-service claims in fiscal year 1998. In recent years, HCFA has sought legislation that would loosen its HCFA Proposals Seek constraints and allow it to contract in new ways. HCFA has once again to Remove made legislative proposals that would make explicit its authority to award Constraints on contracts Contract Authority • to any type of competent business or public entity to perform functions now done by the intermediaries and carriers; • for just one or a subset of the functions now performed by the Medicare fee-for-service contractors; and • using any method of payment appropriate for the contract, without the current restrictions. Authority to Contract With Historical circumstances explain why Medicare law differentiates between Other Than Health Insurers intermediaries and carriers and why, from the outset, the government has Would Expand HCFA’s contracted with only health insurers to process program claims. Before Medicare’s enactment in 1965, providers feared that the program would Options give the government too much control over health care. To achieve Medicare’s acceptance, the program was designed to (1) only include hospital insurance (Medicare part A) for senior citizens and (2) be administered using insurance plans, like Blue Cross, that were already processing private claims submitted by hospitals. For example, the national Blue Cross Association,18 to which many of these plans belonged, was chosen to act as an “intermediary” between the government payer and many hospitals. The decision to cover physician services (Medicare part B) was a late development, thus leading to a claims administration arrangement separate from the intermediary version. The commercial insurance 17 These 58 contractors are actually part of only 44 different companies. In addition, two companies with five contracts are planning a merger, and another with three contracts has agreed to buy a smaller company with only a single contract. Also, four intermediaries have announced their intention to withdraw from Medicare service before the end of fiscal year 1999. 18 At that time, the Blue Cross Blue Shield Association was two separate entities: the Blue Cross Association and the Blue Shield Association. Page 46 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 3 HCFA Would Need Time and Careful Implementation to Benefit From New Contracting Authority industry and certain Blue Shield plans were chosen by geographic locale to process physician claims as “carriers.” Unlike intermediaries, all carriers contract directly with HCFA. The Congress did not mandate that either intermediaries or carriers be used for the administration of the Medicare program. It did, however, authorize the Secretary of Health and Human Services to contract with such entities and clearly expected that this would happen. Nonetheless, HCFA believes that it needs a legislative change in order to contract with other than health insuring organizations for functions currently performed by carriers and intermediaries and to choose intermediaries without using the current provider nomination process. Because of this belief—bolstered by the clear intent of the Congress, HCFA practice, and HCFA’s interpretation of the Social Security Act—intermediaries and carriers have been limited almost entirely to established health insurance companies. To encourage hospitals to participate in the new Medicare program by giving them some choice in their claims processor and to protect current relationships between hospitals and health insurers, the Medicare statute contained a provision called “provider nomination.” This provision authorized, but did not mandate, a system that allowed the professional associations of hospitals and certain other institutional providers to choose claims processing contractors on behalf of their members. When the program began, the American Hospital Association nominated the national Blue Cross Association to serve as its intermediary.19 In 1966, the Association entered into a prime contract and subcontracted with 74 local member Blue plans. Currently, the Association is one of Medicare’s five intermediaries and serves as prime contractor for 32 local member plan subcontractors that together process over 85 percent of all benefits paid by intermediaries. All intermediaries are also health insurance companies. Under the prime contract, when one of the local Blue plans declines to renew its Medicare contract, the Association—rather than HCFA—chooses the replacement contractor. For example, the local Blue plan for Minnesota recently announced that it would soon be giving up its Medicare part A business. Because the hospitals serviced by the Minnesota plan had nominated the Association to serve as their intermediary, the 19 The nominated intermediaries initially chosen were the Blue Cross Association, nine commercial insurance companies, two independent plans, and one state agency. The Association paid claims at that time for most of the nonprofit community hospitals and 87 percent of all hospitals. The Association was also selected by more than half of the extended care facilities in the country. As a result, the Association was responsible for many more providers than the other 12 intermediaries first chosen. No new intermediaries have been named since December 1969, when one of the initial intermediaries was replaced. Page 47 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 3 HCFA Would Need Time and Careful Implementation to Benefit From New Contracting Authority Association conducted a competition among any interested member plans and named Noridian Government Services, formerly known as Blue Cross and Blue Shield of North Dakota, as Minnesota’s successor. This process effectively limited HCFA’s flexibility to choose a commercial plan or even a different local Blue plan to replace a local Blue plan that was withdrawing from the program. Similarly, the government was authorized, but not mandated, to contract directly with individual carriers that were existing payers of health care services for the processing of physician claims.20 The pool of eligible contracting companies has been limited almost entirely to established commercial health insurers and Blue Shield plans. Currently, HCFA contracts with about 22 carriers, of which about two-thirds are local Blue Shield plans that process about 60 percent of all part B claims. Using health insurers entailed certain conflicts of interest. As Medicare contractors, these companies had control over sensitive health status information and payment decisions that could be used to improperly benefit their private lines of business. These inherent conflicts were acknowledged in the companies’ Medicare contracts, which included provisions prohibiting the improper use of privileged information. In addition, the companies responsible for paying Medicare claims were the same companies responsible for later checking that these payments had been made appropriately. More recently, additional conflicts were introduced when insurance companies serving as Medicare contractors began establishing health maintenance organizations and provider networks. The fundamental conflict under such circumstances occurs when a company responsible for reviewing the appropriateness of Medicare claims is also a corporate partner with hospitals, physician networks, and other providers billing the program. Under HCFA’s proposal to repeal the provider nomination authority and the requirement that all carriers be health insurers, HCFA would be free to select its own contractors. The repeal of the nomination authority would allow HCFA to eliminate the prime contract arrangement with the Blue Cross Blue Shield Association. Under the proposed change, whenever a Medicare subcontract is not renewed for a local Blue plan serving as an 20 Under section 1842(f) of the Social Security Act, a “carrier” is (1) “a voluntary association, corporation, partnership, or other nongovernmental organization which is lawfully engaged in providing, paying for, or reimbursing the cost of, health services under group insurance policies or contracts, medical or hospital service agreements, membership or subscription contracts, or similar group arrangements, in consideration of premiums or other periodic charges payable to the carrier, including a health benefits plan duly sponsored or underwritten by an employee organization” or (2) a Medicare intermediary. Page 48 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 3 HCFA Would Need Time and Careful Implementation to Benefit From New Contracting Authority intermediary, HCFA would be able to award that contractor’s workload to any company or combination of companies—including those outside the existing contractor pool—and would no longer be limited to using a plan selected by the Association. In fact, the merit of this nomination authority has been questioned for nearly three decades. In 1970, a Senate Finance Committee report concluded that the original purpose of the provision for provider nomination of the intermediary has largely been served and that with the maturation of Medicare, the Congress should consider modifying the provision.21 Similarly, the proposal to expand carrier eligibility criteria beyond the health-insurer-only restriction could also be used to increase the pool of eligible contractors. Clarified Authority to Health insurers are not the only companies with experience and skills in Award Functional some of the activities now performed by carriers and intermediaries, but Contracts Could until recently, HCFA has not tried to separately contract for specific claims administration functions. HCFA interprets its Medicare regulations, as well Restructure Claims as the Social Security Act, as constraining it from awarding separate Administration contracts for individual claims administration activities. HCFA believes it must obtain clarifying authority from the Congress to do otherwise, as it did recently for payment safeguards, or must publish a superseding regulation.22 Though HCFA is interested in trying to contract by function, Medicare intermediaries and carriers have expressed concern that contracting by function would be disruptive to their operations and the program. While HCFA could revise its regulations and remove some of the constraints on functional contracting, it has chosen for several years to approach the Congress for clarifying legislation so that all of the constraints can be addressed at once. In 1996, HCFA received new authority to contract separately for program safeguard functions. Implementing these functional contracts will give HCFA useful experience in the advantages and possible pitfalls to such contracts. Regulations Limit HCFA’s HCFA’sregulations stipulate that, to qualify as a carrier or intermediary, the Ability to Contract by Function contracting organization must perform all of the Medicare claims 21 Medicare and Medicaid: Problems, Issues, and Alternatives, Report of the Staff to the Committee on Finance, U.S. Senate, Feb. 9, 1970, p. 114. 22 HCFA has published proposed regulations that included language that would change these constraining provisions, but the provisions have never been included in a final regulation. Such language has been included most recently as part of the MIP proposed rule (63 Fed. Reg. 13,590, Mar. 20, 1998), which has not yet been finalized. Page 49 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 3 HCFA Would Need Time and Careful Implementation to Benefit From New Contracting Authority administration functions.23 These functions include, among others, claims processing, adjudicating appeals of payment decisions, collecting debt and recovering overpayments, and responding to customer inquiries. Under this all-or-nothing interpretation, HCFA requires each Medicare claims processing contractor to perform functions that could otherwise be consolidated into a single contract or a few regional contracts to achieve economies of scale. For example, in the fee-for-service Medicare program, each contractor conducts hearings on provider and beneficiary appeals of its own claims decisions. Despite the possible conflict of interest in reviewing its own corporate decisions and the possible inefficiency of operating an individual appeals function at each contractor, HCFA contends that Medicare regulations do not permit awarding a separate consolidated contract for a function such as appeals. In contrast, under different contracting authority used for the Medicare managed care program, which is composed of more than 300 health plans, HCFA consolidated the appeals function into one contract. Similarly, there are companies that could perform some of the functions currently performed by Medicare contractors. With the prospect of separate contractors for medical review activities included as part of the new program safeguard contracts, the argument that contractors for intermediary and carrier functions must be medically oriented is less persuasive. Functions such as printing and mailing or answering beneficiary inquiries might be more economically and efficiently handled under one or a few contracts. The proposal to permit functional contracting could significantly restructure Medicare’s contracting process. Coupled with the proposals that would broaden the choice of contracting entities, functional contracting could enable HCFA to make better business decisions in selecting and retaining contractors. HCFA could select companies on the basis of their particular areas of expertise, consolidate operations to achieve economies of scale, and, in some cases, mitigate the conflicts of interest that currently exist for most Medicare contractors. On the other hand, functional contracting could introduce new problems into the Medicare program. After 30 years of integration, contractors’ functions are not necessarily easy to separate. Contractor representatives told us that their claims processing systems are structured for end-to-end 23 Since 1965, the Medicare statute has required that intermediaries perform payment and payment determination functions as well as some or all of a number of listed functions. Carriers are required to perform some or all of a number of listed functions, which include payment and payment determination functions. Since 1980, regulations governing the functions of intermediaries and carriers have elaborated on their specific responsibilities and what they must do to meet them. 42 C.F.R. part 421. Page 50 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 3 HCFA Would Need Time and Careful Implementation to Benefit From New Contracting Authority claims administration activities. Having multiple companies doing different tasks in claims administration with the current claims systems could create coordination difficulties for the contractors, providers, and HCFA staff. As the functions best suited for separate functional contracts have not yet been determined, feasibility tests might be necessary for the success of such an initiative. MIP Will Test Functional HCFA’s new efforts to contract for program safeguards will test the efficacy Constraints of functional contracting. The program safeguard authority is significant in that it is explicit and, potentially, enables HCFA to mitigate the conflict inherent when an entity processing Medicare claims is the same entity reviewing the claims for error. In addition, the new contracting authority provided under this program affords HCFA greater flexibility in selecting from among competing eligible entities, creating other-than-cost-based contracts, and awarding contracts to conduct specific sets of program safeguard functions rather than the full set of carrier and intermediary activities. This will also provide HCFA with experience in managing a competitive procurement. HCFA’s goal for program integrity is to make correct and prompt payments to legitimate providers for appropriate services rendered to eligible beneficiaries. Accordingly, payment safeguard functions to be performed under the MIP contract include reviewing providers’ claims (medical, utilization, and fraud reviews); auditing providers’ and managed care plans’ cost reports; performing MSP reviews and recovering erroneous program payments; educating providers and beneficiaries about program integrity issues; and maintaining lists of durable medical equipment items requiring prior approval. However, HCFA’s efforts to implement new contracting authority under MIP have moved more slowly than anticipated, suggesting that contracting changes—and any resulting benefits from them—will take time to be fully realized. Over 2 years elapsed before HCFA had a contract and was ready to seek contract bids; the request for proposals was not released until September 1998. In its proposed rule, which includes provisions on the MIP payment safeguard contract, HCFA outlined its strategy to “implement the MIP incrementally in a manner that will provide a way to test alternatives and to transition integrity activities to MIP contractors.” HCFA announced its award of 12 contracts in May 1999. Time will be needed to award task orders, transition workload, and allow contractors to perform the task order functions before an assessment of the program can be made. Also, HCFA does not plan to transfer any workload from the existing contractors Page 51 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 3 HCFA Would Need Time and Careful Implementation to Benefit From New Contracting Authority until it is determined that they have successfully implemented year 2000 computer changes. In preparing to issue a request for proposals (RFP) for the payment safeguard contracts, HCFA had to grapple with several problems similar to those it would face if given the opportunity to implement similar, but more broadly based, contracting changes. For example, HCFA had to define the payment safeguard functions in enough detail in the statement of work so that bidders could understand the functions well enough to allow them to prepare competitive bids. Implementation decisions on task orders in addition to those already released must still be made. The RFP called for the award of one or more contracts with • uncertain delivery dates; • no delineation of which functions within the program integrity statement of work are to be performed; • the possibility of cost-based reimbursement, firm fixed-price, or time and materials pricing arrangements;24 and • no identification of which geographic areas will be served. The 12 companies that HCFA competitively awarded MIP contracts will be eligible to bid on MIP task orders for specific work to be performed within specified time periods under a stated reimbursement method in a specified area. Contractors may refuse any particular task order. HCFA has no obligation to issue any particular task order and will merely be bound by its commitment to offer each contractor a task order worth at least $50,000 during the contract term. While a bidder had to bid for the whole range of possible MIP work and could not bid just for a portion of it in which it might have special expertise, HCFA reserves the right to award any or all of the possible MIP work for a geographic or substantive area to one contractor. Even after full implementation of the MIP contracts, including the transfer of program safeguard activities to the new MIP contractors, HCFA must continue to manage its intermediaries and carriers. To control attrition among them, we believe HCFA must determine what incentives can be offered to those whose program integrity functions are transferred to MIP contractors. Achieving a successful balance between the effective implementation of the new MIP authority and preservation of the current 24 Firm fixed-price contracts require a contractor to perform all specified tasks and activities for an agreed-upon price, no matter what the actual cost is to the contractor. (48 C.F.R. 16.202-1.) Time and materials pricing contracts provide for acquiring goods or services on the basis of labor hours at a fixed hourly rate and materials at cost. (48 C.F.R. 16.601.) Page 52 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 3 HCFA Would Need Time and Careful Implementation to Benefit From New Contracting Authority system of intermediaries and carriers, which will continue to process fee-for-service Medicare claims, answer inquiries, and conduct hearings, will be a formidable challenge. The MIP implementation will also give HCFA needed experience that could be used to help implement the additional contractor management changes it is seeking. Past Experience Suggests Medicare law generally requires intermediary and carrier contracts to be Caution When Adding based on costs. Contractors are paid for the necessary and proper costs of Financial Inducements for carrying out Medicare activities but are not permitted to make a profit. HCFA pays contractors on a unit-cost basis25 up to a targeted amount. If a Medicare’s Claims contractor’s costs exceed the target during the contract year, the Processing Contractors contractor can request supplemental funding. While not able to earn profits, contractors can benefit when Medicare pays a share of corporate overhead. In addition, Medicare has paid for innovations in the program, particularly in electronic claims technology, knowledge, and experience, which some Medicare contractors have been able to transfer to their private businesses. Nevertheless, the adequacy of current contractor funding to fully cover costs is in dispute and may be contributing to contractors withdrawing from the program. HCFA has offered other-than-cost-based contracts in the past, using first its demonstration authority and later its limited authority to use such contracts, as an inducement to contractors, but some of these experiments have had problems. HCFA’s contracts differ from standard government contracts in ways that affect contractor reimbursement for specific work done. Unlike other federal contracts, HCFA’s claims administration contracts do not contain conventional statements of work detailing the tasks and activities to be performed and relating those particular tasks to the price or budget to perform them, but rather incorporate by reference all regulations and general instructions issued by the Secretary of Health and Human Services.26 Such an arrangement gives HCFA flexibility to ask contractors to add specific tasks without going through a formal contract amendment coupled with either additional payment or abatement of other contractually required activities. However, such an arrangement makes less clear the specific tasks and activities that HCFA expects contractors to 25 These unit costs are based on updated historical cost data, adjusted for the contractors’ mix of claims. 26 Intermediary and carrier contracts list types of functions to be performed, but these short lists of a page or two do not compare with the complete descriptions, as found, for example, in the MIP solicitation, which exceeds 100 pages. Page 53 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 3 HCFA Would Need Time and Careful Implementation to Benefit From New Contracting Authority accomplish. It has also left HCFA with a lack of experience in pricing those claims administration tasks and activities that may make moving beyond cost-based reimbursement difficult. Contractor budgets for claims administration have been falling relative to the volume of claims they process. Before fiscal year 1996, contractor budgets were based on an amount per claim—up to a target—for all claims administration activities, including program safeguard activities. After fiscal year 1996, program safeguards were funded separately, but other claims administration activities are still budgeted on a per-claim basis, up to the preset target. In the past two decades, the cost per claim has dropped significantly. Between 1975 and 1997, the amount per claim was reduced by two-thirds without consideration of inflation over the period. Reducing this amount reflected HCFA’s strategy to achieve program savings from increased use of electronic claims processing. However, our past studies showed that program safeguards funding did not keep up with claims volume, which left Medicare vulnerable to unnecessary program outlays and erroneous payments. Although separate funding for program safeguards is now guaranteed through the MIP, contractors continue to express concern that the payments they receive do not fully cover their claims administration costs. One contractor representative summed up the dilemma of contractor reimbursement by stating that: “Some contractors have found that Medicare reimbursement of their operating costs is so inadequate that . . . they are subsidizing Medicare operations. Once a thorough analysis of corporate finances reveals this imbalance, a corporation must decide whether it can balance the books by achieving economies of scale or whether there is some benefit to being a Medicare contractor that makes it worth paying the government for the privilege.” The constraints on earning a profit make participation in the Medicare program less attractive to some current contractors. Initially, the prestige of serving as a Medicare contractor and the advantages of having the government pay a share of overhead costs and being introduced to new automation technology were sufficient to encourage companies to participate in Medicare. Today, however, some of these companies are refocusing their business interests on more lucrative enterprises, such as managed care plans and physician networks, according to the Blue Cross Blue Shield Association and commercial insurer representatives. When these companies consider whether to renew their Medicare contracts, Page 54 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 3 HCFA Would Need Time and Careful Implementation to Benefit From New Contracting Authority HCFA is not in a position to offer financial incentives for their continued participation. Under the proposal to repeal the cost-based contract restrictions, HCFA would be free to award contracts that would permit contractors to earn profits. HCFA’s past experiments with financial incentives, however, generally have not been successful and raise concerns about the success of any immediate implementation of such authority without further testing. HCFA’s experiments with both competitive fixed-price-plus-incentive-fee contracting and adding financial incentives to cost-based contracts have had significant problems. Between 1977 and 1986, eight competitive fixed-price contracts, designed to consolidate the workload of two or more small contractors, were established on an experimental basis. Under these fixed-price-plus-incentive-fee contracts, contractors knew the gain or loss to them from specific ranges of performance of certain activities and concentrated on maximizing reimbursement, to the detriment of other activities. Our 1986 report noted that three of the contracts generated administrative savings.27 Two of the contracts resulted in over $130 million in benefit payment errors (both overpayments and underpayments), so that much of the estimated $48 million to $50 million in administrative savings attributed to the more successful experiments may have been offset by payment error losses. One of the contractors that appeared successful in 1986, having the potential to achieve some administrative savings—the Health Care Service Corporation (Blue Cross Blue Shield of Illinois)—has since agreed to pay a $4 million criminal fine and a $140 million civil settlement for fraudulent and improper activities conducted between 1984 and 1997. This contractor pleaded guilty to eight felony counts in response to allegations that it had failed to safeguard program dollars by paying claims with Medicare funds that should have been paid by other insurers, paying claims for durable medical equipment without checking for medical necessity, and paying claims under $50 without properly screening them. Beginning in 1989, HCFA provided financial incentives in several cost-based contracts when it was given some limited authority to award other-than-cost contracts. Incentives were offered to a few contractors to lower claims unit costs and to improve performance in some safeguard 27 Medicare: Existing Contract Authority Can Provide for Effective Program Administration (GAO/HRD-86-48, Apr. 22, 1986). Page 55 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 3 HCFA Would Need Time and Careful Implementation to Benefit From New Contracting Authority activities. HCFA found that some of the self-reported data contractors used to claim incentive payments were inaccurate. In one case, the financial incentives would not have been paid had a contractor with integrity problems not cheated by “correcting” errors in about a quarter of the 60 claims that were going to be reviewed by HCFA. HCFA’s contracting proposals, besides giving HCFA new authorities, would require a move to competitive contracting in some situations and will thus likely require more initial managerial time and effort than maintaining the current contracting arrangements. In our 1986 report, we questioned HCFA’s ability to manage a large number of competitive contracts. Such contracts require more resources in the beginning of the contracting process for activities not needed for traditional cost-based contracts, such as preparing requests for proposals, evaluating proposals, and awarding contracts. In addition, competitive contracting would increase the need to transition-in new contractors, and HCFA has found that such transitions require additional staff time and travel funds to accomplish successfully. However, HCFA believes that competitive contracting will reduce costs and increase efficiency in the long run. The combination of contracting proposals sought by HCFA might enable it Feasibility Testing to broaden its pool of eligible bidders, improve the administration of Needed to Facilitate Medicare claims, and increase options for attracting and retaining Transition to New contractors. However, HCFA’s experience in designing the payment safeguard specialty contract suggests that sufficient time should be Contracting allowed to test the feasibility of certain concepts before implementing Environment them. Furthermore, HCFA’s past experience with other-than-cost contracting suggests that its new approaches must be carefully thought through so that the incentives that are built into the contracting arrangements improve, rather than weaken, program administration. HCFA would need to test the practicality of separating functions that single contractors have performed for over 30 years. Insurance industry representatives commenting on this issue contended that HCFA would need to ensure coordination among the multiple companies performing different Medicare functions, each using different automated systems to administer a set of claims. They noted that some functions, like hearings and appeals, might be more conducive to performance in isolation. Likewise, building on past experience, HCFA would need to test ways to offer financial incentives that would not foster incentives to submit false data or neglect critical functions. Page 56 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 3 HCFA Would Need Time and Careful Implementation to Benefit From New Contracting Authority Unlike the other proposals, the repeal of provider nomination raises few initial implementation concerns. Allowing HCFA to award intermediary contracts as it determines necessary for the administration of the Medicare program might contribute to the efficiency and effectiveness of the program. With this change in authority, if HCFA is faced with additional Blue contractors unwilling to continue service to the program or unfit because of performance or integrity problems, it could assign intermediary workloads in whatever way makes the most sense. HCFA does not yet have a strategy for use of the proposed authorities, but it has become increasingly concerned that the diminishing pool of current contractors will not have the capacity to meet the future needs of the Medicare program. The experience gained under the MIP program in functional contracting will be valuable in devising a strategy. If the contracts are awarded to entities outside the current contracting pool, and a payment method other than cost reimbursement is used, additional lessons can be learned. However, the delay in implementing MIP, as well as the time necessary to conduct meaningful evaluations of this contracting approach, means that few immediate benefits can be expected from the strategic use of any new authority granted to HCFA. Page 57 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 4 Conclusions, Recommendations, and Agency Comments Medicare’s fee-for-service program pays out the lion’s share of program Conclusions dollars expended by HCFA. With billions of dollars at risk, it is a business that must be carefully monitored. During the last 9 years, HCFA, the HHS OIG, and the Department of Justice have found instances of contractors “cooking the books” to appear to meet HCFA’s requirements. Yet HCFA conducts limited review of contractor activities to ensure that contractors are accurately processing claims and safeguarding Medicare dollars. In its monitoring and oversight of contractors, HCFA has generally accepted financial and workload information as presented, without verifying contractors’ self-certifications that internal controls are working effectively and without systematically validating that financial and workload information is accurately reported. Until HCFA starts regularly assessing that contractor internal controls are working effectively and that contractor performance and financial information is accurate, it cannot be assured of contractors’ integrity, that their payments to providers are accurate, and that they are fiscally responsible in their handling of Medicare funds. HCFA’s current contractor evaluation process has the virtue of allowing regions to focus on contractor weaknesses they may have identified. However, in our opinion, HCFA has not regularly guided its regions in using their limited oversight resources most effectively. Contractor oversight could be strengthened if HCFA balanced an appropriate level of regional discretion with sufficient effort to (1) establish measurable contractor performance standards—particularly in the program safeguard area, (2) set programwide priorities for the assessment of all contractors on core performance standards, and (3) develop a standardized report format that will facilitate comparisons of contractor performance and the use of trend data that will allow for longitudinal assessments of individual contractor performance. Setting clear standards and priorities and measuring contractors on how well they meet the priorities would give HCFA a clearer picture of how well contractors are performing. This also would help HCFA determine which contractors should be given increased work. In addition, giving contractors clear and consistent direction would help meet HCFA’s priorities. Relatedly, HCFA has not established a mechanism for reviewing regions’ oversight for consistency and uniformity and for sharing effective regional oversight strategies. To do so, HCFA needs an organizational structure for contractor oversight that will ensure that regions are evaluated on, and held accountable for, the quality of the oversight they provide to contractors. HCFA headquarters offices must also be accountable to regions Page 58 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 4 Conclusions, Recommendations, and Agency Comments for providing adequate policy guidance and direction so that regional oversight can be effective. HCFA has begun to address its headquarters structure as far as communications is concerned, but it still needs to address the issue of regional accountability. Headquarters should be able to enforce minimum standards for contractor oversight and provide formal feedback to the regions to improve their performance. HCFA also needs a mechanism to regularly share best practices and to ensure that regional oversight staff adopt best practices as they review contractors. Finally, despite its numerous integrity reviews, HCFA has not incorporated the information gained through them to improve routine contractor oversight. Doing more consistent and thorough oversight may require HCFA to allocate more of its resources to these activities. But given the HHS OIG’s estimate of over $12 billion in improperly paid fee-for-service claims and current concerns about fraud, such an investment seems prudent. Because of statutory requirements and established practices, HCFA contracts out claims administration to a shrinking pool of companies whose private interests are increasingly competing with their Medicare responsibilities. HCFA is seeking legislative remedies—including explicit authority to contract in different ways. But even if the Congress grants these authorities, HCFA would need time, additional information, and experience to properly implement them. Eliminating provider nomination, removing the requirement to contract only with health insurers, as well as allowing HCFA to more freely use other-than-cost contracts would give HCFA more control over which companies to use as contractors. In addition, doing so might broaden the pool of prospective contractors. Allowing HCFA to conduct more functional contracting might make Medicare more efficient. Yet HCFA’s experience with the MIP and with previous other-than-cost contracts suggests that many carefully considered intermediate steps need to be taken before HCFA can realize the benefits of such legislative changes. HCFA would need to proceed cautiously, evaluating its implementation of such changes, to be sure that the changes would ultimately benefit the Medicare program. For that reason, over the long term, HCFA could benefit from a strategic plan for routinely conducting competitive procurements and managing claims administration contractors. This plan could be used as a guide on the path from HCFA’s current contracting mode to a new one. HCFA could design this plan to help it determine (1) which contractor activities are most conducive to functional contracting, (2) which activities could be performed by other than health payers, (3) better cost information to facilitate the move to competitive contracting, (4) the functional contracts Page 59 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 4 Conclusions, Recommendations, and Agency Comments that might be conducive to other-than-cost payments, and (5) the feasibility of building financial incentives into the contracts. Legislative change will not solve HCFA’s oversight problems. Even if the Congress grants HCFA the contracting changes it is seeking, the agency will still have to make sure that it addresses the weaknesses associated with its management and oversight of the contractors. Also, if it is authorized to contract in new ways, it will have to customize its oversight to each new type of contract it awards. The Congress may want to consider giving HCFA explicit authority to award Matters for functional contracts for selected claims administration activities to any Consideration by the appropriate type of company and to offer other-than-cost contracts, both Congress at the discretion of the Secretary of Health and Human Services. Also, in view of the possible advantages for managing the Medicare program, the Congress may wish to consider amending the Social Security Act to repeal provider nomination and to allow the Secretary to choose the companies with which HCFA will contract. If the Congress decides to grant HCFA any of the additional contracting authorities it is seeking, the Congress should consider requiring HCFA to report on its implementation of this new authority with an independent evaluation to ensure that these administrative changes improve the efficiency and effectiveness of Medicare program operations. To improve oversight of Medicare’s claims administration contractors, we Recommendations to recommend that the HCFA Administrator take the following actions: the Administrator, Health Care Financing 1. Establish a contractor management policy that requires Administration • verification that each contractor has the internal controls necessary to ensure the adequacy of its operations, starting with the controls most critical for ensuring the financial integrity of the Medicare program; and where controls are weak or lacking, require contractors to strengthen or establish them; and • systematic validation of statistically significant samples of essential contractor-reported data. 2. Improve annual assessments of contractors by Page 60 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 4 Conclusions, Recommendations, and Agency Comments • developing a comprehensive set of clearly defined and measurable performance standards, including measures to test how effectively contractors are safeguarding program dollars; these standards should include collecting comparable baseline data on each contractor’s claims administration and related activities; • assessing all contractors regularly on core performance standards and reviewing any other activities identified through the risk assessment at individual contractors; and • developing a performance report annually for each contractor that includes contractor performance on the core standards and other HCFA-assessed standards, using a uniform format that permits comparisons across contractors as well as longitudinal assessments of individual contractors. 3. Designate a HCFA unit to be responsible for • evaluating the effectiveness of contractor oversight policy and procedural direction provided by headquarters staff to regional offices’ staff, • evaluating regional office performance in conducting contractor oversight activities based on those policies and procedures, and • enforcing minimum standards for the conduct of oversight activities. 4. Ensure that all HCFA staff responsible for contractor oversight learn about contractor problems and best practices and that contractor review staff adopt best oversight practices. 5. Develop a strategic plan for managing Medicare’s claims administration contractors that would include how HCFA intends to use the new authorities it is seeking, the information it will gain by evaluating its current efforts to contract for program safeguard activities, and the results of previous fixed-price and incentive contracting experiments. To do this, HCFA should • assess the feasibility of contracting for specific functions—that is, contracting separately for activities such as hearings and appeals, inquiries and complaints, and printing and mailing; • determine which functional contracts could be performed by entities other than health care payers; • determine the cost of each of the various contractor functions now performed by intermediaries and carriers; • determine which functional contracts would be conducive to the use of other-than-cost contracts; and Page 61 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 4 Conclusions, Recommendations, and Agency Comments • assess the feasibility of building in financial incentives for exceeding performance standards or for developing innovative practices that improve claims administration and can be replicated by other contractors. In written comments on a draft of this report, HCFA agreed with each of our Agency Comments recommendations. Appendix I contains HCFA’s general as well as specific and Our Evaluation comments on each recommendation and its plan for implementing each one. HCFA also provided technical comments, which we incorporated in the report as appropriate. In addition, HCFA listed several other activities that it believes will help to improve and strengthen its contractor management and oversight. Overall, we believe that HCFA has outlined a series of activities to respond to our recommendations that—if properly designed and carried out—should go a long way toward improving its management and oversight of the contractors that engage in claims administration activities for the Medicare program. With regard to verification of internal controls and contractor-reported data, HCFA said that it is hiring an independent public accounting firm to develop standard review procedures and methodologies for the evaluation of documentation supporting the annual certification of internal controls. This firm will prepare individual contractor review reports and recommend improvements in the internal control certification and evaluation processes. On the basis of the result of the firm’s internal control reviews, HCFA said it will also consider using accounting firms to conduct even more in-depth internal control audits. HCFA said it will develop a protocol for validating contractor-reported performance data in fiscal year 2000, which will serve as the basis for data validation reviews beginning in fiscal year 2001. For our recommendation to improve annual contractor assessments, HCFA lists a number of steps it will take during its fiscal year 1999 assessment cycle. These include establishing core evaluation areas, promoting greater consistency through the use of standardized protocols and national review teams for on-site reviews, and using accounting firms to evaluate the quality of the contractors’ provider audits. Concerning performance standards, HCFA said that it will emphasize the development of outcome measures, including development of a contractor-specific claims error rate, assessing the effectiveness of contractor education and outreach activities to reduce provider billing errors, and developing a contractor-specific “fraud rate.” To assist in these measurement efforts, HCFA is developing a new management reporting system that will use data Page 62 GAO/HEHS-99-115 Medicare Contractor Oversight Chapter 4 Conclusions, Recommendations, and Agency Comments derived directly from contractor claims processing systems rather than relying on contractor-reported data. HCFA said that it will assign responsibility for evaluating the effectiveness of regional office oversight to its newly reorganized contractor management group in headquarters, will take steps to share best practices, and will develop a business strategy for contractor management that will include plans for implementation of any new contracting authority. Page 63 GAO/HEHS-99-115 Medicare Contractor Oversight Appendix I Comments From the Health Care Financing Administration Note: HCFA’s technical comments are omitted. Page 64 GAO/HEHS-99-115 Medicare Contractor Oversight Appendix I Comments From the Health Care Financing Administration Page 65 GAO/HEHS-99-115 Medicare Contractor Oversight Appendix I Comments From the Health Care Financing Administration Page 66 GAO/HEHS-99-115 Medicare Contractor Oversight Appendix I Comments From the Health Care Financing Administration Page 67 GAO/HEHS-99-115 Medicare Contractor Oversight Appendix I Comments From the Health Care Financing Administration Page 68 GAO/HEHS-99-115 Medicare Contractor Oversight Appendix I Comments From the Health Care Financing Administration Page 69 GAO/HEHS-99-115 Medicare Contractor Oversight Appendix I Comments From the Health Care Financing Administration Page 70 GAO/HEHS-99-115 Medicare Contractor Oversight Appendix I Comments From the Health Care Financing Administration Page 71 GAO/HEHS-99-115 Medicare Contractor Oversight Appendix I Comments From the Health Care Financing Administration Page 72 GAO/HEHS-99-115 Medicare Contractor Oversight Appendix I Comments From the Health Care Financing Administration Page 73 GAO/HEHS-99-115 Medicare Contractor Oversight Appendix I Comments From the Health Care Financing Administration Page 74 GAO/HEHS-99-115 Medicare Contractor Oversight Appendix I Comments From the Health Care Financing Administration Page 75 GAO/HEHS-99-115 Medicare Contractor Oversight Appendix I Comments From the Health Care Financing Administration Page 76 GAO/HEHS-99-115 Medicare Contractor Oversight Appendix I Comments From the Health Care Financing Administration Page 77 GAO/HEHS-99-115 Medicare Contractor Oversight Appendix II GAO Contacts and Staff Acknowledgments Leslie G. Aronovitz, (312) 220-7600 GAO Contacts Sheila K. Avruch, (202) 512-7277 In addition to those named above, Barrett Bader, Lisanne Bradley, Hannah Staff Fein, Don Kittler, Bob Lappi, and Don Walthall made key contributions to Acknowledgments this report. Page 78 GAO/HEHS-99-115 Medicare Contractor Oversight Page 79 GAO/HEHS-99-115 Medicare Contractor Oversight Related GAO Products Medicare: Improprieties by Contractors Compromised Medicare Program Integrity (GAO/OSI-99-7, July 14, 1999). HCFAManagement: Agency Faces Multiple Challenges in Managing Its Transition to the 21st Century (GAO/T-HEHS-99-58, Feb. 11, 1999). Medicare Computer Systems: Year 2000 Challenges Put Benefits and Services in Jeopardy (GAO/AIMD-98-284, Sept. 28, 1998). Medicare: HCFA’s Use of Anti-Fraud-and-Abuse Funding and Authorities (GAO/HEHS-98-160, June 1, 1998). Medicare: Control Over Fraud and Abuse Remains Elusive (GAO/T-HEHS-97-165, June 26, 1997). High-Risk Series: Medicare (GAO/HR-97-10, Feb. 1997). Medicare: HCFA’s Contracting Authority for Processing Medicare Claims (GAO/HEHS-94-171, Aug. 2, 1994). Medicare: Inadequate Review of Claims Payments Limits Ability to Control Spending (GAO/HEHS-94-42, Apr. 28, 1994). Blue Cross and Blue Shield: Experiences of Weak Plans Underscore the Role of Effective State Oversight (GAO/HEHS-94-71, Apr. 13, 1994). Medicare Secondary Payer Program: Identifying Beneficiaries With Other Insurance Coverage Is Difficult (GAO/T-HRD-93-13, Apr. 2, 1993). Medicare: Contractor Oversight and Funding Need Improvement (GAO/T-HRD-92-32, May 21, 1992). Medicare: Existing Contract Authority Can Provide for Effective Program Administration (GAO/HRD-86-48, Apr. 22, 1986). Experiments Have Not Demonstrated Success of Competitive Fixed-Price Contracting in Medicare (GAO/HRD-82-17, Dec. 1, 1981). More Can Be Done to Achieve Greater Efficiency in Contracting for Medicare Claims Processing (GAO/HRD-79-76, June 29, 1979). (101741) Page 80 GAO/HEHS-99-115 Medicare Contractor Oversight Ordering Information The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. Orders by mail: U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 or visit: Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists. For information on how to access GAO reports on the INTERNET, send an e-mail message with "info" in the body to: firstname.lastname@example.org or visit GAO’s World Wide Web Home Page at: http://www.gao.gov PRINTED ON RECYCLED PAPER United States Bulk Rate General Accounting Office Postage & Fees Paid Washington, D.C. 20548-0001 GAO Permit No. G100 Official Business Penalty for Private Use $300 Address Correction Requested
Medicare Contractors: Despite Its Efforts, HCFA Cannot Ensure Their Effectiveness or Integrity
Published by the Government Accountability Office on 1999-07-14.
Below is a raw (and likely hideous) rendition of the original report. (PDF)