oversight

Medicare Contractors: Despite Its Efforts, HCFA Cannot Ensure Their Effectiveness or Integrity

Published by the Government Accountability Office on 1999-07-14.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                  United States General Accounting Office

GAO               Report to the Chairman, Permanent
                  Subcommittee on Investigations,
                  Committee on Governmental Affairs,
                  U.S. Senate

July 1999
                  MEDICARE
                  CONTRACTORS
                  Despite Its Efforts,
                  HCFA Cannot Ensure
                  Their Effectiveness or
                  Integrity




GAO/HEHS-99-115
      United States
GAO   General Accounting Office
      Washington, D.C. 20548

      Health, Education, and
      Human Services Division

      B-280248

      July 14, 1999

      The Honorable Susan M. Collins
      Chairman
      Permanent Subcommittee on Investigations
      Committee on Governmental Affairs
      United States Senate

      Dear Madam Chairman:

      At your request, this report examines the Health Care Financing Administration’s (HCFA)
      oversight of its claims administration contractors. Specifically, the report discusses whether
      (1) there are weaknesses in HCFA’s contractor oversight activities that may make Medicare more
      vulnerable to fraud, waste, and abuse and (2) any changes in HCFA’s contracting authority may
      improve its ability to manage its contractors.

      We will send copies of this report to the Honorable Nancy-Ann Min DeParle, Administrator of
      HCFA.
          We will also make copies available to interested parties on request.

      If you or your staff have any questions about this report, please call William J. Scanlon at
      (202) 512-7114. Other GAO contacts and staff acknowledgments are in appendix II.

      Sincerely yours,




      Richard L. Hembra
      Assistant Comptroller General
Executive Summary


             Investigations by the Health Care Financing Administration (HCFA), the
Purpose      Department of Health and Human Services’ (HHS) Office of Inspector
             General (OIG), and the Department of Justice have highlighted Medicare’s
             vulnerability to erroneous and fraudulent billing practices by providers,
             such as hospitals and physicians. The first lines of defense against such
             abusive practices are the intermediaries and carriers with whom HCFA
             contracts to administer Medicare fee-for-service claims. Intermediaries
             primarily review and pay claims from hospitals and other institutional
             providers covered under Medicare part A, while carriers review and pay
             part B claims, which are submitted by physicians and other outpatient
             providers. These contractors processed claims worth an average of more
             than $700 million each business day in fiscal year 1998.

             How well these contractors safeguard the Medicare program from
             payment errors and fraud and how well HCFA monitors their work are
             important concerns because Medicare payment errors represent billions of
             dollars lost to the program each year. The OIG estimated that in fiscal year
             1998, contractors improperly paid over $12 billion for fee-for-service
             claims, the overwhelming majority of which were detected through
             medical record review, which determines whether medical services are
             covered by Medicare and are reasonable, necessary, and appropriate. The
             contractors, who are responsible for ensuring that providers do not
             defraud or abuse Medicare, have themselves been accused of defrauding
             the program; Justice and the OIG are now investigating several Medicare
             contractors regarding allegations of fraud.

             Concerned about how HCFA is overseeing the Medicare contractors, the
             Chairman, Permanent Subcommittee on Investigations, Senate Committee
             on Governmental Affairs, asked GAO to determine whether there are
             weaknesses in HCFA’s contractor oversight activities that may make
             Medicare more vulnerable to fraud, waste, or abuse. During GAO’s review,
             HCFA indicated that new contracting authority could mitigate many of the
             weaknesses GAO was identifying. Accordingly, this report also addresses
             whether any changes in HCFA’s contracting authority may improve its
             ability to manage its contractors.

             The Chairman also asked GAO’s Office of Special Investigations to prepare
             a separate investigative report on contractors that had either been
             convicted of fraud or had settled civil fraud cases involving their
             participation in the Medicare program. GAO is issuing a companion report,
             Medicare: Improprieties by Contractors Compromised Medicare Program
             Integrity (GAO/OSI-99-7, July 14, 1999), which describes deceptive activities



             Page 2                              GAO/HEHS-99-115 Medicare Contractor Oversight
                   Executive Summary




                   by six contractors and the impact of these activities on the Medicare
                   program.


                   Despite its efforts, HCFA’s oversight of Medicare claims administration
Results in Brief   contractors has significant weaknesses that leave the agency without
                   assurance that contractors are paying providers appropriately. Since 1993,
                   six contractors have settled civil and criminal charges following
                   allegations that they did not check claims to ensure proper payment or
                   allowed Medicare to pay claims that should have been paid by other
                   insurers. Even though inadequate management controls and falsified data
                   are a common theme in these cases, GAO found that HCFA still does not
                   regularly check contractors’ internal management controls, management
                   and financial data, and key program safeguards to prevent payment errors.
                   Furthermore, HCFA’s headquarters office generally has not set oversight
                   priorities, leaving such decisions almost entirely to regional office
                   reviewers. This has led to uneven contractor evaluations by regional
                   reviewers, making it more difficult for HCFA to determine which
                   contractors are performing effectively. HCFA’s organizational structure
                   contributes to the problem by dividing responsibilities for contractor
                   oversight between the regions and headquarters without assigning overall
                   accountability to one office. HCFA has begun to take steps to improve its
                   oversight, but it is too soon to tell whether it will succeed in addressing
                   fundamental problems.

                   HCFA  officials believe that increased competition among contractors could
                   enhance contractor performance but that statute and current regulations
                   limit its authority to contract. The statutory limitations were enacted for
                   easier initial implementation of Medicare, but the program now has over
                   30 years of operational experience. Consequently, HCFA is seeking new or
                   explicit authority from the Congress that would allow it to (1) choose its
                   intermediaries, rather than having providers nominate them, and contract
                   with non-health insurance companies; (2) contract separately for specific
                   functions—such as responding to beneficiary inquiries; and (3) use
                   payment methods that would allow contractors to earn profits on their
                   Medicare business, rather than reimbursing contractors only for their
                   costs up to a preset target. While these changes might broaden the pool of
                   contractors HCFA could choose from and would increase its flexibility in
                   contracting for specific functions, past experience with other efforts to
                   change the program has shown that HCFA will need several years to
                   carefully plan, properly implement, and conduct a postimplementation
                   review of any new contracting initiatives.



                   Page 3                             GAO/HEHS-99-115 Medicare Contractor Oversight
                           Executive Summary




                           When Medicare was enacted in 1965, the Congress decided to administer
Background                 the program through contracts with organizations that already served as
                           payers of health care services. The Congress also decided to pay on the
                           basis of contractors’ allowable costs, so that these contractors would
                           neither be penalized for administering Medicare nor unduly profit by doing
                           so. Because such exceptions are specifically written into the Social
                           Security Act, Medicare contracting has unique features that differ from
                           other federal contracting. Medicare contractors are responsible for all
                           aspects of claims administration, including safeguarding the program by
                           conducting particular activities designed to identify potential fraud and
                           abuse and to prevent or recover erroneous payments.

                           HCFA is responsible for ensuring that contractors do their jobs accurately
                           and efficiently, which includes overseeing contractor performance. Both
                           HCFA headquarters and its 10 regional offices have roles in contractor
                           oversight, although regional office staff generally provide direct oversight.
                           Since 1995, to conduct routine oversight, HCFA has relied on its Contractor
                           Performance Evaluation program, which allows regional staff to review
                           any aspect of contractually required duties, classified in five general
                           areas—claims processing, customer service, payment safeguards, fiscal
                           responsibility, and administrative activities. When HCFA reviewers identify
                           problems, contractors may be required to take specific corrective actions
                           under a performance improvement plan. In addition to its routine
                           oversight, HCFA sometimes conducts special “integrity reviews” when it
                           learns of possible integrity or fraud problems at contractors.



Principal Findings

Weaknesses in Contractor   Medicare contractors are HCFA’s front line of defense against provider
Oversight Leave the        fraud, abuse, and erroneous Medicare payments; however, several of them
Medicare Program           have committed fraud against the government. Such misconduct has led to
                           the loss of Medicare program dollars when contractors fail to check
Vulnerable                 provider claims properly to prevent payment errors. Since 1990, nearly one
                           in four claims administration contractors has been alleged—generally by
                           whistle-blowers within the company—to have integrity problems; GAO
                           identified at least 7 of HCFA’s 58 current contractors as being actively
                           investigated by the HHS OIG or Justice. Since 1993, HCFA has received
                           criminal and civil settlement decrees totaling over $235 million from six
                           contractors after investigations of allegations that the contractor




                           Page 4                             GAO/HEHS-99-115 Medicare Contractor Oversight
Executive Summary




employees deleted claims from the processing system, manufactured
documentation to allow processing of claims that otherwise would have
been rejected because the services were not medically necessary, and
deactivated automatic checks that would have halted the processing of
questionable claims.

Despite recent efforts to improve, HCFA’s oversight process has
weaknesses that impede effective review of contractor performance.
These include (1) limited checking of internal management controls and
performance data; (2) few performance standards combined with limited
priority-setting, which allows essential program safeguards to go
unchecked; and (3) inconsistent treatment of contractors resulting from
variations in the intensity of regional monitoring.

When contractors are accused of fraudulent practices, on investigation,
HCFA often finds a lack of management controls and evidence of falsified
data. However, in its ongoing oversight, HCFA generally does little checking
of contractors’ internal management controls and performance data.
Instead, HCFA relies on the contractors themselves to certify that their
controls over the accuracy and security of their payment and data systems
are sound. Despite the OIG’s finding in its recent audits of HCFA’s financial
statements that contractor financial management controls were a material
weakness, GAO found that HCFA rarely validated the contractors’
certifications. Furthermore, HCFA reviewed contractor performance by
asking contractors to generate workload and other performance
data—typically without validating the data’s accuracy. HCFA staff indicated
that validating contractor data is resource intensive, which may help
explain why it often is not done.

Since 1995, when HCFA moved to the Contractor Performance Evaluation
program, its 10 regional offices that directly oversee contractors were
given wide discretion in how they conduct oversight—choosing what and
how to review, and how to monitor contractors’ corrective actions. The
program also set few standards against which to judge
performance—lacking particularly those with which to judge the
contractors’ effectiveness in reducing inappropriate payments and fraud.
As a result, key activities directed toward safeguarding program dollars
received limited scrutiny at some contractors. For example, GAO found that
regional reviewers were not routinely checking how effective contractors
were at identifying primary insurers other than Medicare.




Page 5                             GAO/HEHS-99-115 Medicare Contractor Oversight
                            Executive Summary




                            HCFA has also not taken the actions needed to ensure that all regional
                            offices provide consistent and adequate oversight. For example, while
                            some regions imposed performance improvement plans on contractors
                            when problems were identified, other regions rarely, if ever, required
                            them. HCFA has not formally evaluated its regional offices’ performance in
                            the area of contractor oversight, nor has it regularly shared one region’s
                            best practices with the others.

                            HCFA  has acknowledged that its oversight of contractors needs to be
                            strengthened and has recently initiated some actions to improve it. HCFA
                            set oversight priorities when the regions performed fiscal year 1998
                            contractor evaluations, and this year it restructured headquarters offices
                            that are responsible for oversight activities. GAO believes that it is too early
                            to tell whether these actions will address many of the fundamental
                            problems HCFA faces in ensuring quality performance from its contractors.


New Contracting Authority   HCFA’s current legislative authority, its interpretation of that authority, and
Would Take Time and         its regulations constrain its ability to allocate workload among contractors
Experience to Properly      and attract new companies to administer claims. The Medicare statute’s
                            provider nomination provision allows the professional associations of
Implement                   hospitals and certain other institutional providers to choose claims
                            processing intermediaries on behalf of their members, and the statute
                            requires HCFA to choose health insurance companies as carriers. Further,
                            because it has not yet changed certain regulations, HCFA has generally not
                            been able to separate specific functions, such as conducting hearings or
                            mailings, that it believes can be done more efficiently by other kinds of
                            companies. In addition, HCFA generally contracts only on a cost basis
                            because its authority to contract using other payment methods is
                            restricted. Moreover, HCFA’s leverage to manage its current contractors has
                            weakened as the pool of companies willing and eligible to administer
                            claims has shrunk.

                            HCFA  has proposed several legislative changes to increase its contracting
                            flexibility, such as giving HCFA new authority to contract with non-health
                            insurers and clarifying its authority to choose its contractors. In addition,
                            HCFA is seeking specific authority to contract with companies for
                            individual program functions and a new authority to pay contractors on a
                            basis that allows profit.

                            In 1996, the Congress gave HCFA authority to separately contract for
                            program safeguard activities—activities to ensure that only appropriate



                            Page 6                               GAO/HEHS-99-115 Medicare Contractor Oversight
                Executive Summary




                claims are paid and that providers participating in Medicare comply with
                program rules. HCFA has recently announced its selection of companies to
                conduct specialized safeguard activities for this new Medicare Integrity
                Program (MIP). HCFA’s experience with these new MIP contracts may offer
                information that could help in implementing any other functional
                contracts and will be a first test of the wisdom of contracting for specific
                functions.

                HCFA’s  previous tests of two methods that could allow companies to earn a
                profit raise concerns because these experiments had serious problems.
                This suggests that HCFA should proceed cautiously if it significantly
                changes its current, cost-based contractor payment method. HCFA
                experimented with fixed-price contracts, in which contractors that cut
                their costs could keep any savings, and contracts in which specified levels
                of performance led to incentive payments. As GAO reported in 1986, in two
                past fixed-price contracts, cost-cutting led to over $130 million in benefit
                payment errors. More recently, some contractors who had received
                incentive payments were investigated for falsifying the performance data
                that gained them the incentive payments.

                As HCFA gathers experience with its program safeguards contracts, it may
                be better able to utilize other new authorities. Clearly, these new
                authorities would require a long-term effort and, in any event, would not
                lessen the need for routine and adequate monitoring of contractors.


                The Congress may wish to consider amending the Social Security Act to
Matters for     allow the Secretary of Health and Human Services to (1) freely choose the
Congressional   companies with which HCFA may contract as Medicare intermediaries and
Consideration   (2) contract with non-health insurers for claims administration. The
                Congress may also wish to consider giving HCFA explicit authority to award
                functional contracts for selected claims administration activities to any
                appropriate kind of company and to offer other-than-cost contracts, both
                at the discretion of the Secretary of Health and Human Services. If
                legislation is enacted, to ensure that the new authorities improve the
                efficiency and effectiveness of Medicare program operations, GAO believes
                HCFA should be required to report to the Congress with an independent
                evaluation of its use of these authorities and their impact on the Medicare
                program.




                Page 7                             GAO/HEHS-99-115 Medicare Contractor Oversight
                      Executive Summary




                      In this report, GAO makes a number of specific recommendations to the
Recommendations       HCFA Administrator to correct identified weaknesses and improve the
                      agency’s oversight of its claims administration contractors. Implementing
                      these recommendations should help ensure that

                  •   contractor internal controls are working,
                  •   contractor performance is evaluated against a comprehensive set of
                      clearly defined and measurable performance standards,
                  •   HCFA’s oversight of contractor performance is more consistent,
                  •   best practices are shared among regions, and
                  •   HCFA has a strategic plan for implementing requested legislative
                      modifications sought in contracting proposals.


                      In written comments on a draft of this report, HCFA agreed with each of the
Agency Comments       recommendations and described how it plans to implement them. Overall,
                      GAO believes that HCFA has outlined a series of activities that—if properly
                      designed and implemented—should help improve its management and
                      oversight of Medicare’s claims administration contractors.




                      Page 8                            GAO/HEHS-99-115 Medicare Contractor Oversight
Page 9   GAO/HEHS-99-115 Medicare Contractor Oversight
Contents



Executive Summary                                                                                   2


Chapter 1                                                                                          12
                        Contracting Arrangements for Managing Medicare                             12
Introduction            Contractors’ Role in Program Management                                    14
                        HCFA’s Role in Program Management                                          16
                        Scope and Methodology                                                      18

Chapter 2                                                                                          20
                        Contractor Integrity Problems Highlight Oversight Weaknesses               20
Weak Oversight of       HCFA’s Oversight of Contractor Activities Is Uneven and                    23
Contractors Leaves        Inconsistent
                        HCFA Lacks a Structure That Ensures Accountability                         36
Medicare Vulnerable
Chapter 3                                                                                          43
                        Constraints on Contracting Authority Limit HCFA’s Ability to               43
HCFA Would Need           Attract New Companies
Time and Careful        HCFA Proposals Seek to Remove Constraints on Contract                      46
                          Authority
Implementation to       Feasibility Testing Needed to Facilitate Transition to New                 56
Benefit From New          Contracting Environment
Contracting Authority
Chapter 4                                                                                          58
                        Conclusions                                                                58
Conclusions,            Matters for Consideration by the Congress                                  60
Recommendations,        Recommendations to the Administrator, Health Care Financing                60
                          Administration
and Agency              Agency Comments and Our Evaluation                                         62
Comments
Appendixes              Appendix I: Comments From the Health Care Financing                        64
                          Administration
                        Appendix II: GAO Contacts and Staff Acknowledgments                        78

Related GAO Products                                                                               80


Tables                  Table 2.1: Allegations of Wrongdoing in Three Contractor                   22
                          Integrity Cases




                        Page 10                          GAO/HEHS-99-115 Medicare Contractor Oversight
          Contents




          Table 2.2: Performance Standards Mandated by Law, Regulation,             29
            or Judicial Decision, by Evaluation Area
          Table 2.3: Key MSP Activities Conducted by Contractors                    31
          Table 2.4: Number of Contracts Overseen and PIPs Required for             35
            Contractors, by Region, FY 1996 and 1997
          Table 2.5: HCFA Headquarters Units With Responsibilities for              38
            Medicare Contractor Issues

Figures   Figure 2.1: Three Regions’ Rates of Compliance With                       30
            Requirement to Check Whether Contractor Met Mandated Claims
            Processing Standards, FY 1995-98
          Figure 2.2: Key MSP Activities Reviewed for Seven Contractors,            32
            FY 1995-98
          Figure 3.1: Number of Medicare Claims Administration                      45
            Contractors, 1980-99




          Abbreviations

          CMG        Contractor Management Group
          CPE        Contractor Performance Evaluation
          HCFA       Health Care Financing Administration
          HHS        Department of Health and Human Services
          MIP        Medicare Integrity Program
          MSP        Medicare Secondary Payer
          OIG        Office of Inspector General
          PIP        Performance Improvement Plan
          RFP        request for proposal


          Page 11                         GAO/HEHS-99-115 Medicare Contractor Oversight
Chapter 1

Introduction


                    With the help of claims administration contractors, the Health Care
                    Financing Administration (HCFA), within the Department of Health and
                    Human Services (HHS), administers the Medicare program. Medicare is the
                    nation’s largest health insurer, covering nearly 40 million beneficiaries at a
                    net cost of about $193 billion in fiscal year 1998. Contractors processed
                    about 900 million Medicare fee-for-service claims in fiscal year
                    1998—about 3.5 million claims and $700 million in payments each working
                    day. For processing these claims and for performing other
                    Medicare-related activities, HCFA paid its contractors $1.6 billion in fiscal
                    year 1998.

                    The Medicare program, implemented in 1966, provides coverage under the
                    traditional pay-per-visit or service arrangement. Part A—hospital
                    insurance—covers inpatient hospital, some home health, skilled nursing,
                    and hospice services. Part B—supplementary insurance—covers services
                    provided by physicians, outpatient laboratories, and an array of other
                    providers and supplies. Beneficiaries now have the option to enroll in
                    managed care, but about 85 percent have chosen Medicare’s traditional
                    fee-for-service program.


                    The size and complexity of the fee-for-service Medicare program make its
Contracting         management a formidable task. The original Medicare legislation and the
Arrangements for    accompanying committee reports reflected the congressional decision that
Managing Medicare   the government contract with organizations already serving as payers and
                    managers of health care services to administer Medicare payment
                    functions. HCFA has followed this direction and today uses 58 contractors
                    to handle day-to-day program administration and to pay claims.

                    The claims administration contractors, themselves health insurers, are
                    called intermediaries or carriers, depending on the types of claims they
                    process. Intermediaries, which were chosen from among those nominated
                    by provider associations, process part A and part B claims for institutions,
                    such as hospitals and home health agencies. Carriers, which were chosen
                    directly by the Secretary of Health and Human Services, process part B
                    claims submitted by others, such as physicians and suppliers of durable
                    medical equipment.1



                    1
                     Most intermediaries are local Blue Cross Blue Shield companies that subcontract with the national
                    Blue Cross Blue Shield Association. Most carriers are also Blue Cross Blue Shield plans but have direct
                    contracts with HCFA. A local Blue Cross Blue Shield plan may have both an intermediary subcontract
                    and a carrier contract. In this report, the term “contractor” is applied to both prime contractors and
                    subcontractors and to both intermediaries and carriers.



                    Page 12                                        GAO/HEHS-99-115 Medicare Contractor Oversight
Chapter 1
Introduction




Medicare contracting for intermediaries and carriers differs from
contracting for most other federal programs. Generally, in accordance
with the Federal Property and Administrative Services Act of 1949 and the
implementing regulations known as the Federal Acquisition Regulations,2
which govern standard federal contracts, federal agencies can contract
with any entity for any purpose, so long as that entity is not debarred from
government contracting and the contract is not for what is an essentially
governmental function. Federal agencies can contract using any payment
method except cost-plus-percentage-of-cost and are generally required to
contract competitively, unless there are specific exceptions in their
authorizing legislation, such as there are for Medicare claims
administration contracting. Medicare contracts must comply with the
Federal Acquisition Regulations except when the Social Security Act,
which authorizes Medicare, provides otherwise. For example, the act calls
for the use of cost-based reimbursement contracts under which
contractors are reimbursed for necessary and proper costs of carrying out
Medicare activities but are not permitted to earn a profit on their Medicare
claims administration activities, except in certain limited situations.3 Also,
carriers may be chosen only from among health-insuring organizations.

The services performed by intermediaries and carriers have been bundled
together in part by the law and more completely by HCFA-promulgated
regulations in a way that makes it difficult to contract for individual
functions. However, in 1996, the Congress enacted legislation that
authorized separate contracts for payment safeguard activities (medical
and utilization review, Medicare Secondary Payer (MSP) activities, cost
report audits, and the preparation of fraud and abuse cases). The program
created by this legislation, called the Medicare Integrity Program (MIP), has
no limitation on the type of companies that can be awarded contracts for
these activities or on the basis on which they must be paid. HCFA has
identified 12 organizations that it plans to contract with to operate the MIP
and refers to them as program safeguard contractors.

HCFA believes, however, that specific requirements limit its choice of
claims administration contractors. For its intermediaries, HCFA chooses


2
 C.F.R. title 48.
3
 HCFA has some limited authority to build financial incentives into intermediary and carrier contracts,
as long as the intermediary or carrier agrees to enter into the arrangement; performs all of the services
listed in sections 1816 or 1842 of the Social Security Act—the sections authorizing contracts with
intermediaries and carriers, respectively; and is a health insuring organization. This authority can be
found in the Deficit Reduction Act of 1984, section 2326(a), as amended by the Omnibus Budget
Reconciliation Acts of 1986, section 9321(b), and 1989, section 6215; and the Social Security
Amendments of 1994, section 159.



Page 13                                         GAO/HEHS-99-115 Medicare Contractor Oversight
                       Chapter 1
                       Introduction




                       from among entities that are first selected by associations representing
                       providers, a process called “provider nomination” as set forth in the Social
                       Security Act. While the Congress intended, and the practice has been, for
                       the government to contract with intermediaries and carriers for the
                       administration of the Medicare program, the Congress did not mandate
                       that such contractors be used. Sections 1816 and 1842 of the Social
                       Security Act “authorize” the Secretary to enter into contracts with
                       intermediaries and carriers, respectively, but section 1874 grants the
                       Secretary the authority to “perform any . . . functions under this title
                       directly, or by contract . . . as the Secretary may deem necessary.”

                       The Social Security Act also does not require that claims administration
                       contractors be selected competitively. Provider nomination basically limits
                       competition for intermediary contracts to those chosen by health care
                       provider associations in 1966 and since. HCFA has not usually awarded
                       either intermediary or carrier contracts on the basis of competition. An
                       effect of the absence of competitive procurement is that HCFA has
                       relatively little experience with writing statements of work and estimating
                       the cost of certain tasks. Statements of work and cost estimates are
                       required when contracts are written under the Federal Acquisition
                       Regulations.


                       Medicare contractors are responsible for claims processing and
Contractors’ Role in   administration, including (1) receiving claims; (2) judging their
Program Management     appropriateness; (3) paying appropriate ones promptly; (4) identifying
                       potentially fraudulent claims or providers, and withholding payment if
                       necessary; and (5) recovering overpayments or inappropriate payments.
                       They are expected to manage Medicare’s funds in a fiscally responsible
                       manner and to address effectively provider and beneficiary inquiries and
                       problems. Each contractor must also develop a set of criteria to determine
                       which claims it will pay. HCFA contractors use laws, regulations, the
                       Medicare policy manuals, and periodic agency directives to guide their
                       actions.

                       With its broad range of services and billions of dollars in payments to
                       about 1 million providers, Medicare is inherently vulnerable to fraudulent
                       and abusive billing and to payment errors. HCFA relies on contractors to
                       safeguard the program by identifying inappropriate claims and payments.
                       The contractors do this by focusing on four primary areas that constitute
                       HCFA’s payment safeguard activities: (1) medical review, (2) MSP review,
                       (3) audit and reimbursement activities, and (4) fraud unit investigations.



                       Page 14                            GAO/HEHS-99-115 Medicare Contractor Oversight
    Chapter 1
    Introduction




•   Contractors conduct medical reviews of claims, including automated and
    manual prepayment and postpayment reviews, to identify inappropriate
    claims. Claims may be inappropriate because they are incorrectly
    prepared, are for services that are medically unnecessary or not covered,
    or represent fraudulent or abusive billing practices.
•   Contractors’ MSP activities identify other primary sources of payment, such
    as employer-sponsored insurance or third-party liability settlements for
    claims submitted to Medicare. Contractors are required to collect from
    primary insurers if claims have been paid with Medicare funds that should
    have been paid by these sources.
•   Contractor audit and reimbursement activities include the review of
    overpayment collections and the audit of cost reports from institutions,
    such as hospitals, nursing homes, and home health agencies. The cost
    reports these providers submit are used in determining the amount of their
    Medicare reimbursement.
•   Contractor fraud units develop potential cases of fraud or abuse identified
    by beneficiaries, other contractor safeguard units, or other sources; when
    appropriate, a case is referred to HHS’ Office of Inspector General (OIG) for
    investigation and possible referral to the Department of Justice, which
    determines whether the case will be prosecuted.

    HCFA requires its contractors to submit complete and accurate information
    on their performance. In addition, the Federal Managers’ Financial
    Integrity Act of 1982 and the Chief Financial Officers Act of 1990 required
    each executive branch agency to establish and maintain a system of
    accounting and internal controls related to all assets for which it is
    responsible. In complying with this requirement, HCFA requires Medicare
    contractors, which control many of the funds for which HCFA is ultimately
    responsible, to submit annual certifications regarding their internal
    accounting and administrative controls. These certifications must
    reasonably ensure that the contractors are complying with applicable law
    and that their operations are safeguarded against waste, loss, or
    misappropriation.

    In its audits of HCFA’s financial statements for fiscal years 1997 and 1998,
    the HHS OIG estimated that contractors improperly paid more than
    $20 billion and $12 billion, respectively. Ninety percent of the improper
    payments for 1998 were detected through the medical review of records,
    which determines whether medical services are covered by Medicare and
    are reasonable, necessary, and appropriate. In addition, for each of those
    years, the OIG noted material internal control weaknesses for HCFA and its
    contractors.



    Page 15                            GAO/HEHS-99-115 Medicare Contractor Oversight
                     Chapter 1
                     Introduction




                     The Social Security Act requires that the Secretary of Health and Human
HCFA’s Role in       Services develop standards, criteria, and procedures to evaluate
Program Management   intermediaries and carriers and determine whether contracts should be
                     executed, renewed, or terminated. A few standards, such as how quickly
                     certain claims are paid, are included in the law, and a few have resulted
                     from lawsuit decisions.

                     As the Medicare program steward, HCFA is responsible for ensuring that
                     contractors do their jobs accurately and efficiently. This responsibility is
                     carried out through staff in headquarters and regional offices. At
                     headquarters, the Medicare Carrier and Intermediary Management group,
                     under the newly established position of Deputy Director for Medicare
                     Contractor Management in HCFA’s Center for Beneficiary Services, has
                     overall responsibility for contractor operations. Although a number of
                     other HCFA headquarters offices perform activities associated with
                     contractors, this group serves as the focal point for contractor operations,
                     issuing guidance and direction for contractor oversight. HCFA’s 10 regional
                     offices conduct most of the oversight and evaluation of contractors,
                     although regional office staffs report to their respective regional
                     administrators. They are not organized under the direction of the new
                     Deputy Director for Medicare Contractor Management.

                     Although regions are generally responsible for overseeing contract
                     operations in a specific geographic area, a regional office may oversee a
                     contract outside that area. For example, the Atlanta regional office
                     oversees 16 carrier and intermediary contracts for Alabama, Florida,
                     Georgia, Kentucky, Louisiana, Mississippi, Missouri, North Carolina, South
                     Carolina, and Tennessee. Although Louisiana and Missouri are outside
                     Atlanta’s geographic boundaries, the Atlanta region oversees the
                     intermediary operations for those states. Conversely, the Dallas region
                     oversees a contract held by a South Carolina company to administer
                     durable medical equipment claims, even though that company is located
                     within the boundaries of the Atlanta region.

                     While the Atlanta region oversees 16 contracts, these contracts are held by
                     a smaller number of companies, because some companies hold multiple
                     contracts. The South Carolina company mentioned, for example, holds
                     intermediary and carrier contracts for several types of claims. In total, 44
                     companies hold the 58 intermediary and carrier contracts.

                     Since fiscal year 1995, the primary tool regions have used to conduct
                     contractor oversight is the Contractor Performance Evaluation (CPE)



                     Page 16                            GAO/HEHS-99-115 Medicare Contractor Oversight
    Chapter 1
    Introduction




    program. This restructured evaluation program, which places emphasis on
    continuous improvement, gives HCFA the flexibility to review a contractor’s
    performance in any and all aspects of its contractually required duties.
    This approach was designed to give HCFA regional office reviewers
    flexibility in determining the types and levels of review for each
    contractor.

    CPEs   are conducted in five general areas:

•   claims processing,
•   customer service,
•   payment safeguards,
•   fiscal responsibility, and
•   administrative activities.

    HCFA  reviewers are expected to incorporate a review of internal controls
    into their assessments of particular contractor functions. HCFA’s Regional
    Office Manual for Medicare provides guidance for performing such
    reviews and requires reviewers to perform a walk-through of internal
    control procedures to understand any obvious breakdown in controls or
    noncompliance with procedures.

    After completing a review in a particular area, the reviewer is to report to
    the contractor on the results of the review. This report should spell out
    which areas, if any, need corrective action as a result of an identified
    deficiency. If corrective action is needed, the contractor must submit a
    Performance Improvement Plan specifying how the contractor will correct
    the deficiency. At the end of each fiscal year, the responsible HCFA region
    is to prepare a Report of Contractor Performance, which should
    summarize HCFA’s overall evaluation of the contractor’s performance based
    on the CPEs that were conducted during the year and any other monitoring
    activity.

    Recently, HCFA began to conduct what it calls “contractor integrity
    reviews” when it receives information of possible contractor wrongdoing.
    Headquarters and regional office staff usually conduct these ad hoc
    reviews with little advance notice to the contractor. An entrance
    conference is normally held, but few specifics about the allegations are
    provided to the contractor. In contrast to CPEs, where very little is done
    through interviews, integrity reviews are conducted first through
    interviews in which pointed questions such as “Have you ever altered or
    been asked to alter documents?” are asked and then through the review of



    Page 17                              GAO/HEHS-99-115 Medicare Contractor Oversight
              Chapter 1
              Introduction




              contractor records, where available. Various actions could be taken as a
              result of an integrity review, including requiring a Performance
              Improvement Plan; not renewing or terminating the contract; referring the
              case to the HHS OIG; or, if circumstances dictate, simply closing the review
              with no action.


              To determine whether weaknesses exist in HCFA’s contractor oversight
Scope and     activities that may make Medicare more vulnerable to fraud, waste, and
Methodology   abuse, we reviewed and analyzed documents related to HCFA’s oversight of
              its claims administration contractors, including related GAO and HHS OIG
              reports, and other documentation concerning lawsuits and integrity
              reviews of HCFA contractors. We also reviewed and analyzed 225 of the
              CPEs that HCFA regional reviewers had prepared concerning contractor
              operations for seven contracts for fiscal years 1995 through 1998. We
              discussed the oversight issue with responsible HCFA staff at headquarters
              and in HCFA’s Atlanta, Dallas, and San Francisco regions. Within each of
              these regions, we discussed HCFA oversight activities with officials at
              selected claims administration contractors representing intermediaries
              and carriers and local Blue Cross Blue Shield plans and commercial plans.
              We also discussed oversight activities with representatives of the Blue
              Cross Blue Shield Association, which represents local plans, and the
              Medicare Administration Committee, which represents other Medicare
              contractors.

              In addition, to determine whether any changes in HCFA’s contracting
              authority may improve HCFA’s ability to manage its contractors, we
              reviewed and analyzed Medicare’s legislative history; legal authorities; the
              contracting bill proposed by the administration; relevant GAO reports; the
              Federal Acquisition Regulations, which implement federal contracting law;
              and HCFA regulations governing Medicare contractors.

              We obtained written comments on a draft of this report from HCFA. HCFA’s
              comments, other than its technical comments, are in appendix I. We also
              obtained oral comments from the Blue Cross Blue Shield Association and
              the Medicare Administration Committee. We have incorporated their
              comments where appropriate. We did our work between June 1998 and
              June 1999 in accordance with generally accepted government auditing
              standards.

              To respond to a companion request that the Chairman made to GAO’s
              Office of Special Investigations, that office prepared a separate report,



              Page 18                            GAO/HEHS-99-115 Medicare Contractor Oversight
Chapter 1
Introduction




Medicare: Improprieties by Contractors Compromised Medicare Program
Integrity (GAO/OSI-99-7, July 14, 1999), that discusses deceptive contractor
activities in recently completed cases. This report describes how those
activities were carried out without HCFA detection and assesses the impact
of the activities on the Medicare program.




Page 19                            GAO/HEHS-99-115 Medicare Contractor Oversight
Chapter 2

Weak Oversight of Contractors Leaves
Medicare Vulnerable

                       HCFA’s oversight of its claims administration contractors has not been
                       sufficient to ensure that contractors are adequately protecting program
                       dollars. One sign of HCFA’s lax oversight is that six contractors since 1993
                       have settled civil and criminal charges after they were accused of
                       improper activities, such as failing to check claims to ensure proper
                       payment. These and other contractor integrity investigations have found
                       common problems at some contractors—including falsified data and
                       inadequate managerial controls. Despite these incidents, HCFA continues to
                       let contractors self-certify their management controls, rarely checking to
                       ensure that controls are working as required and rarely validating
                       contractors’ self-reported data. HCFA’s oversight process lacks focus and
                       accountability, setting few clear performance standards for contractors to
                       meet and using limited priority-setting for regional reviewers. As a result,
                       essential payment safeguard activities have gone unexamined for years at
                       certain contractors. In addition, regional reviewers are inconsistent in
                       requiring corrective actions when contractor problems are identified.
                       HCFA’s organizational structure for contractor oversight does not ensure
                       regional offices’ accountability for the oversight they perform. HCFA has
                       acknowledged flaws in its oversight process and has begun to take steps to
                       improve by moving toward a more structured evaluation process and
                       reorganizing its contractor activities at headquarters. It is too soon to tell,
                       however, whether these actions will resolve fundamental problems.


                       Since 1990, nearly one in four claims administration contractors have been
Contractor Integrity   alleged, most often by inside whistle-blowers, to have integrity
Problems Highlight     problems—that is, that some of their activities were improper and
Oversight Weaknesses   potentially fraudulent. We identified at least 17 contractors that had either
                       qui tam cases4 filed against them or had integrity reviews of their
                       operations conducted by HCFA. Of the 58 contractors processing Medicare
                       claims today, we identified at least seven that the Department of Justice or
                       the HHS OIG is actively investigating. Since 1993, HCFA has entered into
                       settlement agreements totaling more than $235 million5 as a result of civil
                       and criminal cases against six contractors6—with allegations that
                       company employees


                       4
                        Qui tam suits are filed under the False Claims Act, 31 U.S.C. sections 3729-3733. The act’s qui tam
                       provisions permit filers to share in financial recoveries resulting from their case.
                       5
                        In addition to the $235 million recovered from these companies as civil settlements and criminal fines
                       and penalties in civil and criminal fraud cases, at least three of these companies have also entered into
                       settlements in civil liability cases brought by HCFA for recovery of about an additional $30 million
                       owed to Medicare under the MSP program.
                       6
                        For more detail on these cases, see GAO/OSI-99-7, July 14, 1999.



                       Page 20                                         GAO/HEHS-99-115 Medicare Contractor Oversight
    Chapter 2
    Weak Oversight of Contractors Leaves
    Medicare Vulnerable




•   deleted backlogged claims from the processing system, thereby allowing
    the contractor to avoid paying interest on older claims;
•   manufactured documentation to allow the processing of claims that
    otherwise would have been rejected because the services were not
    medically necessary;
•   switched off the toll-free beneficiary inquiry lines when staff were unable
    to answer the calls within the prescribed amount of time; or
•   disabled computer functions that would have otherwise halted the
    processing of questionable claims for further review.

    Contractors misrepresented their performance to HCFA either to appear to
    meet standards they did not actually meet or to garner financial gain for
    the company. In a few cases, meeting performance standards was linked
    directly to financial incentives built into contracts, such as those in the
    1991 through 1994 Health Care Service Corporation carrier contracts. In
    another case, a contractor’s employee admitted that when the company
    used Medicare resources to conduct its private business, it no longer had
    enough Medicare resources to hire adequate staff to perform Medicare
    work. Falsifying workload data allowed the company to appear to
    continue meeting contractual obligations and avoid nonrenewal of its
    contract. Table 2.1 illustrates the nature of alleged contractor wrongdoing
    in three cases.




    Page 21                                GAO/HEHS-99-115 Medicare Contractor Oversight
                                       Chapter 2
                                       Weak Oversight of Contractors Leaves
                                       Medicare Vulnerable




Table 2.1: Allegations of Wrongdoing
in Three Contractor Integrity Cases    Contractor              Allegation
                                       Blue Cross and Blue     In a 1991 case filed under the False Claims Act and settled in
                                       Shield of Florida       1993, the contractor paid the Medicare program $10 million to
                                                               settle allegations that it had

                                                               —deleted durable medical equipment claims,
                                                               —added false certifications of medical necessity to durable
                                                               medical equipment claims to facilitate their processing, and
                                                               —overridden computerized claims edits to speed claims
                                                               processing without determining whether payment of the claims
                                                               was proper.
                                       Blue Cross and Blue     In 1995, the contractor agreed to pay the Medicare program
                                       Shield of Michigan      $27.6 million in settlement of a qui tam suit filed by an employee
                                                               who had alleged that the contractor had

                                                               —reported that provider cost report audits had been completed
                                                               when, in fact, important steps had not been completed;
                                                               —tampered with cost report audits chosen by HCFA for review;
                                                               —provided false information to HCFA to avoid review of chosen
                                                               audits in cases in which an audit had too many mistakes; and
                                                               —falsified overpayment records to make it appear that
                                                               overpayments had been collected within 30 days, avoiding
                                                               payment of interest due the government.
                                       Health Care Service     In 1998, the contractor settled a False Claims Act case against
                                       Corporation (Blue       it for $140 million and pled guilty to eight felony counts, paying
                                       Cross and Blue Shield   an additional $4 million in criminal fines, because the contractor
                                       of Illinois)            was alleged to have

                                                               —allowed Medicare payment of claims that should have been
                                                               paid by private health insurance;
                                                               —destroyed Medicare claims that should have been submitted
                                                               to another contractor;
                                                               —periodically disconnected the required toll-free telephone
                                                               lines used for beneficiary inquiries;
                                                               —paid claims under $50 even if the services were not covered
                                                               or not medically necessary; and
                                                               —deleted, instead of suspending for review, claims with
                                                               incorrect Health Insurance Claim numbers.

                                       HCFA is rarely the first to spot fraudulent practices through its routine
                                       oversight of Medicare contractors. Since 1990, HCFA’s routine oversight
                                       reviews were the basis for referral to the HHS OIG for only 3 of the 17
                                       contractors we identified as having had integrity problems cited. In
                                       another case not included in those three, HCFA received an anonymous
                                       complaint alleging that a contractor had falsified documents to pass its
                                       annual review. Although HCFA investigated the complaint, it found nothing
                                       wrong because the contractor forged a document indicating that the
                                       problem was due to a computer error. Two years later, a whistle-blower




                                       Page 22                                 GAO/HEHS-99-115 Medicare Contractor Oversight
                        Chapter 2
                        Weak Oversight of Contractors Leaves
                        Medicare Vulnerable




                        filed a qui tam suit that eventually led to a guilty plea to criminal charges
                        as well as multimillion-dollar criminal fines and civil penalties.

                        Because it is often difficult to detect wrongdoing when collusion is
                        involved, fraudulent actions may go unnoticed for years. One integrity
                        case involved contractors’ actions over a 13-year period, while another
                        involved improper activity for more than 10 years. More than a dozen of
                        these integrity cases were developed from qui tam suits filed by company
                        insiders; leads reported to the HHS OIG; or senior company managers
                        themselves, who called HCFA directly when problems were brought to their
                        attention.7

                        However, information from whistle-blowers and HCFA officials familiar
                        with integrity investigations suggests that the way that HCFA conducted
                        on-site verification of contractor’s work allowed problems to remain
                        undetected. HCFA reviewers notified contractors in advance concerning the
                        dates of their on-site reviews and specific or probable records to examine,
                        which allowed contractors to manipulate what HCFA reviewed. For
                        example, Blue Cross and Blue Shield of Illinois allegedly used this prior
                        notification to alter sample claim files scheduled for review. Similarly,
                        Blue Shield of California allegedly deleted references to motor vehicle
                        accidents in some claim files, because the medical claims paid might have
                        been the responsibility of a liability insurer rather than Medicare.
                        Moreover, when HCFA had contractors pull the records to be reviewed, it
                        relied on copies of documents provided by the contractor, rather than
                        originals, which made alteration harder to detect. Also, in some cases,
                        HCFA representatives developed close relationships with contractor staff,
                        which impeded HCFA’s ability to objectively review contractor
                        performance, according to investigators, contractor staff, and HCFA
                        officials.


                        HCFA’s oversight process does not ensure that the contractors are
HCFA’s Oversight of     efficiently and effectively paying fee-for-service claims and protecting the
Contractor Activities   integrity of the program. First, while HCFA requires contractors to certify
Is Uneven and           annually that they have sound internal management controls over all of
                        their Medicare operations, we found that HCFA neither regularly validates
Inconsistent            the effectiveness of the processes behind these self-certifications nor
                        routinely tests contractors’ reported data to ensure that they are accurate.
                        Second, HCFA has set few standards to measure contractor

                        7
                          HCFA is not always aware of qui tam suits, which are generally filed under seal until judicial decisions
                        have been published.



                        Page 23                                         GAO/HEHS-99-115 Medicare Contractor Oversight
                          Chapter 2
                          Weak Oversight of Contractors Leaves
                          Medicare Vulnerable




                          performance—particularly in the area of safeguarding the program—and
                          has generally given regional offices wide discretion in overseeing
                          contractors without setting clear priorities and direction. This has
                          predictably led to uneven results: certain essential payment safeguards at
                          some contractors go unexamined for years, and corrective actions at some
                          contractors are monitored more intensely than at others. HCFA has started
                          to move toward a more structured evaluation process but has not yet
                          addressed all of its oversight weaknesses.


HCFA Does Not Regularly   A fundamental activity in overseeing contractor performance is obtaining
Check Contractors’        reasonable assurance that the contractors’ reporting data are accurate. As
Self-Certifications of    a first step in providing such assurance, HCFA requires contractors to
                          certify that they have developed effective internal management controls
Internal Controls, Nor    over all aspects of their operations. However, we found that HCFA rarely
Does It Validate Their    looks behind the contractors’ self-certifications to ensure their validity,
Performance Data          nor does it independently validate contractors’ performance data, instead
                          relying heavily on financial and workload data reported by the contractors
                          themselves. HCFA therefore lacks assurance that contractors’ reports of
                          financial and performance data—such as the amount of accounts
                          receivable or claims processing timeliness, volume, and accuracy—are
                          reliable.

                          Medicare contractors are required to certify annually that they have
                          established a system of internal management controls that help ensure
                          that they meet program objectives, comply with laws and regulations, and
                          are able to provide HCFA with reliable financial and management
                          information concerning their operations. This is an important requirement
                          because internal controls, effectively designed and operated, provide the
                          best assurance that Medicare’s objectives will be achieved.

                          In April 1998, as part of its fiscal year 1997 audit of HCFA’s financial
                          statements, the HHS OIG reported that regional offices were not evaluating
                          the accuracy and reliability of the documentation supporting contractor
                          internal controls.8 In response, HCFA sent guidance to its regional reviewers
                          reminding them to validate contractors’ self-certifications during their
                          1998 evaluation review cycle. Nevertheless, our analysis of fiscal year 1998
                          reviews performed at seven contractors found no case in which reviewers
                          documented that they had assessed and validated contractors’
                          self-certified controls. We did find two cases that mentioned such reviews,

                          8
                           HHS OIG, Report on the Financial Statement Audit of the Health Care Financing Administration for
                          Fiscal Year 1997, A-17-97-00097 (Washington, D.C.: HHS, Apr. 1, 1998).



                          Page 24                                       GAO/HEHS-99-115 Medicare Contractor Oversight
Chapter 2
Weak Oversight of Contractors Leaves
Medicare Vulnerable




but the reviewers merely checked whether the contractors had provided
the required self-certifications—not whether the internal controls were
actually in place or effective.

The superficiality of these reviews is difficult to understand in light of the
large number of contractors that have been found to have, or that are
currently being investigated for, integrity problems. When HCFA performs
an integrity review that confirms problems at a contractor, the report often
concludes that there is a serious lack of internal controls and recommends
that any corrective action plan include establishing such controls in
vulnerable areas. With only minimal regular review of the contractors’
self-certifications of their management controls, HCFA has little information
to assess the integrity of contractors’ operations or the reliability of their
management and financial performance. Where internal controls are weak
or untested and the risk of error is high, the need to validate self-reported
data becomes increasingly important.

HCFA  largely relies on contractor-submitted financial and workload data
when evaluating and monitoring performance and does little independent
validation of these data. In our analysis of 170 reviews completed for fiscal
years 1995 through 1997 covering seven contractors, only two reviews
documented reviewers’ efforts to validate contractor workload data. In
one review, HCFA staff tested the accuracy of contractor workload data
related to the time the contractor took to perform desk reviews and audits.
In the other, HCFA reviewers tested the accuracy of the filing date for
claims subjected to medical review to determine whether the contractor
reported correct claims processing times. For 1998, staff in one of the
three regions we visited validated workload data in five of its
reviews—checking, for example, the accuracy of workload data on
medical reviews and telephone inquiries that the contractors had reported
to HCFA. Staffs in the other two regions did not validate any workload data
in fiscal year 1998.

Validating workload data has not been a consistent management priority.
A HCFA headquarters official told us that although headquarters staff used
to validate this type of data—sometimes with the assistance of regional
office staff and in addition to any other regional reviews—it has not done
so on a routine basis since 1994, when the headquarters group performing
validation was dissolved. Regional officials told us that they believe the
staff resources and travel funds available to perform detailed testing and
validation are not adequate to ensure the accuracy of contractor-reported
data. During our work at the regional offices, we found that the frequency



Page 25                                GAO/HEHS-99-115 Medicare Contractor Oversight
                         Chapter 2
                         Weak Oversight of Contractors Leaves
                         Medicare Vulnerable




                         of on-site reviews varied greatly, and it was not unusual for staff to spend
                         as little as a few days once a year at a contractor’s site. For 1998, however,
                         HCFA directed the regions to validate claims during their examination of
                         contractor medical review activities, and each of the three regions we
                         reviewed did so for at least one contractor. Also, according to HCFA’s
                         Comprehensive Plan for Program Integrity issued early in calendar year
                         1999, HCFA has contracted for the verification and validation of medical
                         review claims on a sample basis at selected contractors. On the basis of
                         the results of this effort, the verification and validation contractor will
                         make recommendations to HCFA for any necessary corrective action.

                         In addition to workload data being vulnerable to error or
                         misrepresentation, critical financial information also gets limited review
                         and validation—either by the contractors or by HCFA staff. The HHS OIG
                         report on HCFA’s financial statements for fiscal year 1997 found that HCFA
                         relies on its Monthly Contractor Financial Report to ensure that all
                         amounts reported to HCFA by Medicare contractors are accurate,
                         supported, complete, and properly classified. When OIG auditors reviewed
                         these reports, their supporting documentation, and the processes used to
                         produce them at 11 contractors, they found that the contractors’
                         accounting ledgers were not maintained properly to support these reports,
                         and some contractors did not subject the reports to independent
                         verification. According to the auditors, although they had noted similar
                         weaknesses in prior OIG reports issued to HCFA, the agency had not ensured
                         that contractors had corrected these problems.

                         In response to the OIG’s 1997 audit, HCFA headquarters officials advised
                         regional reviewers in fiscal year 1998 to check key financial data for the
                         largest intermediaries and for any carrier contracts held by the same
                         contractors. As a result, the two regions in our study to which this advice
                         applied reviewed financial data for three of their large contractors,
                         checking items such as accounts payable and accounts receivable.
                         Although the OIG’s 1998 report noted some improvement in this area, it was
                         not sufficient to remove the qualification on the OIG’s opinion of HCFA’s
                         financial statements.


Lack of Performance      HCFA’s efforts to evaluate contractor performance in the last decade have
Standards and Wide       suffered from extremes—a previous evaluation approach was inflexible
Discretion Given to      and not focused on outcomes, while the current approach, in our opinion,
                         is too discretionary and still fails to focus on outcomes. Under its current
Reviewers Leads to       approach, HCFA has set few measurable performance standards for
Inconsistent Oversight


                         Page 26                                GAO/HEHS-99-115 Medicare Contractor Oversight
                            Chapter 2
                            Weak Oversight of Contractors Leaves
                            Medicare Vulnerable




                            contractors, has given regional oversight staff wide discretion over what
                            aspects of contractor performance to review, and does not check on the
                            quality of regional oversight. Not surprisingly, important program
                            safeguards have received little scrutiny at some contractors, and regions
                            have been inconsistent in their responses to contractor performance
                            problems. HCFA has begun to give more oversight direction, but its actions
                            to date have been limited.

HCFA’s Evaluation Process   Under the evaluation process used from fiscal years 1980 to 1995, HCFA
Emphasizes Flexibility      examined a predetermined subset of contractors’ activities each year and
                            assigned each contractor a numerical score. Although performance
                            standards were explicit under this approach, we reported that the
                            standards focused more on process than outcome. Therefore, the
                            evaluation process did not sufficiently emphasize efforts to ensure that
                            program benefits were paid appropriately, particularly by measuring the
                            effectiveness of program safeguards.9 Furthermore, HCFA believed that this
                            approach encouraged contractors to manage their activities in a way that
                            would maximize their score, thus dissuading HCFA reviewers from targeting
                            other potentially troublesome areas.

                            HCFA  developed a new evaluation approach for fiscal year 1995, known as
                            the CPE process, designed to allow individual reviewers “greater flexibility
                            in determining the appropriate types and levels of review for each
                            contractor.”10 Under this approach, HCFA’s reviewers may examine any
                            aspect of contractor operations and, with a few exceptions, have no
                            common standards against which to assess the 58 contractors. Until fiscal
                            year 1998, HCFA did not issue guidance for reviewers to evaluate even a
                            minimum set of essential operations. But because of the OIG’s and our
                            concern about HCFA’s oversight of Medicare contractors, HCFA issued
                            guidance for its regions to review certain areas for fiscal year 1998. The
                            guidance was issued late, however—not until the eighth month of the
                            fiscal year.

                            HCFA’scontractor performance evaluations do not follow a set report
                            format, although regional staffs were reminded by memo in 1998 that
                            evaluations should contain certain key items. Such a flexible evaluation



                            9
                             Medicare: HCFA’s Contracting Authority for Processing Medicare Claims (GAO/HEHS-94-171, Aug. 2,
                            1994) and Medicare: Inadequate Review of Claims Payments Limits Ability to Control Spending
                            (GAO/HEHS-94-42, Apr. 28, 1994).
                            10
                               HHS, HCFA, Regional Office Manual, Section 1100, “Contractor Performance Evaluation”
                            (Baltimore, Md.: HCFA, May 1995).



                            Page 27                                      GAO/HEHS-99-115 Medicare Contractor Oversight
                          Chapter 2
                          Weak Oversight of Contractors Leaves
                          Medicare Vulnerable




                          process has produced a varying assortment of reports that make analytic
                          interpretations difficult and cross-contractor comparisons impossible.

HCFA Has Few Measurable   Except for standards mandated by legislation, regulation, or judicial
Performance Standards     decision, HCFA’s current CPE process eliminated the previous evaluation
                          system’s process standards for contractors without requiring sufficient
                          outcome standards (see table 2.2 for the mandated standards). As a result,
                          the current process contains few measurable standards to ensure that
                          contractors adequately perform important program safeguards, such as
                          medical review of claims. The lack of sufficient standards is worrisome
                          because, in the case of medical review, HCFA has made more effective
                          medical review part of its plan to strengthen program integrity. In our
                          opinion, the lack of clear performance standards decreases the likelihood
                          that HCFA will get maximum performance from contractors.




                          Page 28                                GAO/HEHS-99-115 Medicare Contractor Oversight
                                        Chapter 2
                                        Weak Oversight of Contractors Leaves
                                        Medicare Vulnerable




Table 2.2: Performance Standards
Mandated by Law, Regulation, or         Evaluation area                      Applies to                         Performance standard
Judicial Decision, by Evaluation Area   Claims processing                    Electronic part A and part B 95 percent paid within
                                                                             claims properly prepared     14-30 days of receipt
                                                                             and submitted
                                                                             Paper part A and part B            95 percent paid within
                                                                             claims properly prepared           27-30 days of receipt
                                                                             and submitted
                                                                             Part A Administrative Law    5 percent or less
                                                                             Judge reversal rate of claim
                                                                             decisions
                                                                             Part A reconsideration of          75 percent processed
                                                                             claim decisions                    within 60 days, 90 percent
                                                                                                                within 90 days
                                                                             Part B reviews of claim            95 percent completed
                                                                             decisions                          within 45 days
                                                                             Part B hearings of claim           90 percent completed
                                                                             decisions                          within 120 days
                                        Customer service                     Part B notice to                   98 percent properly
                                                                             beneficiaries explaining the       generated
                                                                             basis for coverage and
                                                                             reimbursement decisions
                                                                             Part B telephone inquiries         Calls answered within 120
                                                                             from beneficiaries                 seconds; callers are not to
                                                                                                                get busy signal more than
                                                                                                                20 percent of time
                                        Payment safeguards                   Part A skilled nursing facility All processed accurately
                                                                             demand billsa
                                                                             Part A Tax Equity and Fiscal Completed within 75 days
                                                                             Responsibility Act of 1982   or returned as incomplete
                                                                             target rate adjustments,     within 60 days
                                                                             exceptions, and
                                                                             exemptionsb
                                        a
                                         Skilled nursing facilities are required to determine whether a beneficiary’s care will be covered
                                        by Medicare. If a skilled nursing facility determines that a beneficiary’s care will not be covered, it
                                        must still submit a demand bill to the contractor for review of the coverage determination, if the
                                        beneficiary demands it.
                                        b
                                         For hospitals not paid on a prospective basis, the 1982 act provided for a ceiling on the
                                        allowable rate of increase in hospital inpatient operating costs. Adjustments, exceptions, and
                                        exemptions, if properly documented, can be made under the act’s provisions at the request of the
                                        hospital.



                                        Even for the mandated standards listed in table 2.2, HCFA does not require
                                        that regional reviewers check them routinely. According to a HCFA manual,
                                        reviewers are not required to evaluate whether contractors meet the
                                        mandated standards unless the reviewers choose to evaluate that specific




                                        Page 29                                          GAO/HEHS-99-115 Medicare Contractor Oversight
                                      Chapter 2
                                      Weak Oversight of Contractors Leaves
                                      Medicare Vulnerable




                                      area of contractor performance.11 If regional reviewers choose to look at a
                                      contractor’s claims processing activity, for example, they are required to
                                      check whether contractors met the mandated claims processing timeliness
                                      standards.

                                      Our analysis of CPE reports for three regional offices found that these
                                      regions often did not meet the requirement to review claims processing
                                      standards when reviewing claims processing activities. For fiscal years
                                      1995 through 1998, we found that, for seven contractors, claims processing
                                      was reviewed at least once a year at one contractor and less frequently at
                                      the others. When HCFA reviewers did assess claims processing activities,
                                      they checked about half of the applicable mandated standards. In addition,
                                      the three regions varied considerably in the percentage of applicable
                                      mandated standards their staff checked, as shown in figure 2.1.


Figure 2.1: Three Regions’ Rates of
Compliance With Requirement to
Check Whether Contractor Met
Mandated Claims Processing
Standards, FY 1995-98




HCFA Does Not Examine                 The combination of wide discretion, few common measures, and limited
Essential Contractor                  headquarters guidance leads to uneven review of contractor performance
Payment Safeguards                    in critical areas, including the effectiveness of payment safeguards. The
                                      following illustrates this effect for two types of program safeguards—MSP
                                      and contractor fraud unit activities.



                                      11
                                        HHS, HCFA, Regional Office Manual, Section 1100, p. 1-21.1.



                                      Page 30                                        GAO/HEHS-99-115 Medicare Contractor Oversight
                                Chapter 2
                                Weak Oversight of Contractors Leaves
                                Medicare Vulnerable




                                Medicare Secondary Payer—MSP activities seek to (1) identify insurers that
                                should pay claims mistakenly billed to Medicare and (2) recoup any
                                payments Medicare made for claims not first identified as the
                                responsibility of other insurers. (Table 2.3 shows some of these key
                                activities.)

Table 2.3: Key MSP Activities
Conducted by Contractors
                                First claim           Research the first claim of a beneficiary to identify the possibility
                                development           that future claims may not be the primary responsibility of
                                                      Medicare. One way that contractors determine whether they
                                                      should pay such claims is to contact beneficiaries when their first
                                                      claims are received. After first claim development, contractors
                                                      should be able to catch MSP claims and forward them to the
                                                      proper payer.
                                Data match            Match data contained in several federal information
                                                      systems—including files from the Internal Revenue Service and the
                                                      Social Security Administration—to identify beneficiaries that have
                                                      the potential for being covered by employee health insurance.
                                Claims processing  Before paying a claim, check information in HCFA’s regional
                                through the common databases, known as the common working file, to determine
                                working file       beneficiary eligibility and reasons for not paying, such as when the
                                                   beneficiary has other insurance.
                                Retroactive recovery Recovering erroneous Medicare claim payments after mistakes
                                or waiver of recovery have been discovered, such as cases in which coverage,
                                                      especially by automobile liability and no-fault plans, is not
                                                      immediately discernible. The recovery can be waived in certain
                                                      situations, such as when the beneficiary is without fault or recovery
                                                      would be more expensive than the amount in question.

                                Saving about $3 billion annually from 1994 through 1998, MSP review is a
                                substantial Medicare payment safeguard. Despite the opportunity for large
                                dollar savings, however, our review of three regions’ CPE
                                reports—documenting which of the multiple MSP activities were
                                examined—shows that, over 4 years, reviewers did not check many of the
                                key activities most germane to spotting claims covered by MSP provisions.
                                The check marks in figure 2.2 show that key MSP activities were reviewed
                                rarely, particularly by Region B.




                                Page 31                                   GAO/HEHS-99-115 Medicare Contractor Oversight
                                          Chapter 2
                                          Weak Oversight of Contractors Leaves
                                          Medicare Vulnerable




Figure 2.2: Key MSP Activities Reviewed for Seven Contractors, FY 1995-98




                                          The potential for contractor fraud regarding MSP activities is significant
                                          because of an inherent conflict of interest: the private insurance business
                                          of the contractor can be the primary payer for some claims subject to the
                                          MSP provisions. HCFA has had to pursue certain insurance
                                          companies—some with related corporations that are Medicare
                                          contractors—in federal civil court for refusing to pay before Medicare
                                          when the government contends that Medicare should have been the
                                          secondary insurance payer. Since 1995, settlements in cases in which a
                                          related company was a Medicare carrier or intermediary have totaled
                                          almost $66 million.12 HCFA currently has an additional $98 million in claims

                                          12
                                           These contractors include the national Blue Cross Blue Shield Association, Blue Cross Blue Shield of
                                          Florida, Blue Cross Blue Shield of Massachusetts, Blue Cross Blue Shield of Michigan, Transamerica,
                                          and Travelers.



                                          Page 32                                       GAO/HEHS-99-115 Medicare Contractor Oversight
                            Chapter 2
                            Weak Oversight of Contractors Leaves
                            Medicare Vulnerable




                            filed against current and former contractors. In our opinion, the
                            considerable size of annual MSP savings, coupled with HCFA’s past
                            experience with contractor performance and the extra effort involved in
                            identifying beneficiaries’ primary insurers, underscore the need for regular
                            scrutiny of these activities.

                            Fraud Units—HCFA requires all intermediaries and carriers to operate
                            special units for detecting and deterring fraud. The units are expected to,
                            among other activities, determine the factual basis of fraud complaints
                            made by beneficiaries and others, explore leads, and develop and refer
                            cases to the HHS OIG. The OIG’s 1998 report on intermediaries’ fraud units
                            found significant disparities in the fraud units’ performances: one unit
                            handled over 600 fraud cases, and others handled none; one referred over
                            100 cases to the HHS OIG, and others referred none.13

                            The HHS OIG also found weaknesses in HCFA’s evaluations that allowed
                            contractor performance to go unchecked. For example, HCFA’s reviewers
                            did not routinely check and report on whether contractors were
                            identifying program vulnerabilities, such as loose program guidelines that
                            invited inappropriate billings. Although identification of program
                            vulnerabilities heads the list of fraud unit responsibilities, only 10 percent
                            of HCFA’s CPE reports on fraud units stated whether the unit had carried out
                            this responsibility. In its 1998 report, the OIG recommended that HCFA
                            establish standards for contractor performance; measure performance
                            against those standards; and require that CPE reports list HCFA’s
                            performance standards and state contractors’ compliance with the
                            standards explicitly.

                            HCFA substantively concurred with all of the OIG’s recommendations and
                            noted certain initial steps it had already taken in fiscal year 1998 and its
                            intent to address the recommendations more comprehensively in later
                            years.


Reviewers Inconsistent in   Without a set of clearly defined and measurable performance standards or
Prescribing Corrective      measures, contractors lack clear expectations. This has resulted in
Actions                     inconsistencies in HCFA reviewers’ handling of contractor performance
                            problems. Besides the inequity for contractors, such uneven review leaves
                            HCFA without the ability to discriminate between contractors’ performance
                            when assigning new work.


                            13
                              HHS OIG, Fiscal Intermediary Fraud Units, OEI-03-97-00350 (Washington, D.C.: HHS OIG, Nov. 1998).



                            Page 33                                       GAO/HEHS-99-115 Medicare Contractor Oversight
Chapter 2
Weak Oversight of Contractors Leaves
Medicare Vulnerable




HCFA officials told us that some regions are known to be “easier” on
contractors than others. We found instances in which regions handled
similar types of contractor activities differently. For example, one
company held two contracts for two states—each overseen by a different
region. As part of its program safeguard activities, the company analyzed
paid claims at one central location to identify possible fraudulent or
abusive provider billing trends. While the company conducted identical
types of analyses for both contracts, one region found that the contractor’s
data analysis activities did not fulfill HCFA’s expectations, while the other
region found the contractor in compliance with HCFA’s analytic
expectations. Although these regions had signed a memorandum of
understanding to seek consistency in how they directed the contractor,
and to coordinate oversight to avoid duplication of effort, they did not
work together to resolve their differences and guide the contractor with
one voice.

HCFA  reviewers may not only disagree about whether a problem exists but
also take dissimilar actions once a performance problem is identified.
HCFA’s normal procedure after identifying a program deficiency is to
require the contractor to develop a Performance Improvement Plan (PIP)
to correct the problem, and then to monitor the plan. PIPs can be stringent
corrective actions for contractors. Contractors operating under a PIP can
be required to make complex changes in operations and to submit
performance data and reports about their activities until HCFA decides that
their performance has improved.

HCFA  reviewers differ in whether they require PIPs, even in cases that seem
quite similar. For example, in one region, a contractor with a high error
rate in one component of its medical review process passed its periodic
evaluation without any requirements to improve. In another region, a
contractor with a similarly high error rate was required to develop and
follow a PIP.

Similarly, one region required a contractor to develop and follow PIPs for
deficiencies in its performance in fraud and abuse prevention and
detection. This contractor did not maintain and use a fraud investigation
database. All cases were not entered into the database, and there were
quality problems with some of the cases that were entered. In contrast,
another region, reviewing a different contractor, found many more serious
weaknesses with that contractor’s fraud and abuse prevention and
detection activities. The reviewer concluded that the contractor did not
meet HCFA’s performance expectations, yet did not require a PIP. Included



Page 34                                GAO/HEHS-99-115 Medicare Contractor Oversight
                                      Chapter 2
                                      Weak Oversight of Contractors Leaves
                                      Medicare Vulnerable




                                      in the weaknesses the reviewer identified were (1) spending little or no
                                      time actively detecting fraud and abuse; (2) not using data to detect
                                      egregious cases; (3) focusing on small, rather than large and more
                                      complex, dollar cases; (4) referring only one case to the HHS OIG during the
                                      year; (5) inadequately recovering overpayments; (6) failing to suspend
                                      payments to questionable providers; (7) failing to prioritize cases; and
                                      (8) preparing no fraud alerts.

                                      Regions varied widely in their use of PIPs in 1996 and 1997. As table 2.4
                                      shows, some regions required few or no PIPs of the contractors they
                                      oversee, while others used this mechanism extensively. We could not
                                      determine whether this variance was due to better contractor performance
                                      in some regions, or regional practices regarding the use of PIPs. However,
                                      HCFA was concerned enough about the variation that in 1998 it provided
                                      additional guidance to regions clarifying the difference between a program
                                      deficiency, which requires a PIP, and a program vulnerability, which does
                                      not.

Table 2.4: Number of Contracts
Overseen and PIPs Required for                                               FY 1996—number of       FY 1997—number of
Contractors, by Region, FY 1996 and   Region                                 Contracts        PIPs   Contracts         PIPs
1997
                                      Boston                                        10           7           11           3
                                      New York                                       7           3            7           7
                                      Philadelphia                                  10           8            9          16
                                      Atlanta                                       18          30           16          40
                                      Chicago                                       14          16           13         100
                                      Dallas                                         9           1            6           6
                                      Kansas City                                    8          15            8          11
                                      Denver                                         8           4            8           0
                                      San Francisco                                  8           9            5          21
                                      Seattle                                        6           0            4          10
                                      Total                                         98          93           87         214
                                      Source: HCFA data.




HCFA Has Begun to Move                HCFA has recognized that its oversight of contractors has been less than
to a More Structured                  adequate and issued guidance in fiscal year 1998 to have regional
Evaluation Process                    reviewers follow a somewhat more structured evaluation process.
                                      However, these actions are only a first step in addressing problems with
                                      contractor oversight.




                                      Page 35                                  GAO/HEHS-99-115 Medicare Contractor Oversight
                 Chapter 2
                 Weak Oversight of Contractors Leaves
                 Medicare Vulnerable




                 In May 1998, citing concerns raised by the HHS OIG and us regarding HCFA’s
                 level of contractor oversight, HCFA announced the “need to reengineer our
                 current contractor monitoring and evaluation approach and develop a
                 strategy demonstrating stronger commitment to this effort.” Specifically,
                 HCFA issued a contractor performance evaluation plan specifying three
                 evaluation priorities for fiscal year 1998: (1) year 2000 compliance
                 activities, (2) activities focusing on a subset of financial management
                 operations—accounts receivable and payable, and (3) activities focusing
                 on a subset of medical review activities. Because of the regions’ workload
                 concerns, HCFA later scaled down its requirements in the financial
                 management area.

                 Also in 1998, HCFA emphasized the need for regions to follow its structured
                 CPE report format, including clearly stating whether the contractor
                 complied with HCFA’s performance requirements. Nonetheless, we found
                 that some of the 1998 reviews continued to lack a structured format,
                 making it difficult to compare contractor performance. For example,
                 HCFA’s contractor evaluation plan for fiscal year 1998, issued 5 months
                 before the close of the fiscal year, called for examining contractors’
                 activities with regard to reviewing claims for medical necessity before they
                 are paid (called prepayment medical review). Our review of the three
                 regions’ fiscal year 1998 CPE reports shows that (1) two regions did not
                 review contractors’ determinations of medical necessity at all contractors
                 included in our study before payment and (2) two regions did not
                 consistently follow the structured report format, making it difficult for
                 HCFA headquarters to evaluate or compare the results.


                 Despite HCFA’s intent to provide more direction to the regions on
                 contractor oversight activities, it continues to issue review guidance late in
                 the year. Agency officials recently told us that its plan for CPE reviews for
                 fiscal year 1999 will include more headquarters involvement in the
                 assessment process, review teams from headquarters and the regions, and
                 multiregional reviews. As of May 1999—7 months into the fiscal
                 year—HCFA had not yet issued its fiscal year 1999 guidance.


                 Two aspects of HCFA’s current organizational structure create problems for
HCFA Lacks a     overseeing contractors. First, HCFA reorganized its headquarters operations
Structure That   in 1997, dispersing responsibility for contractor activities from one
Ensures          headquarters component to seven. Second, although HCFA’s 10 regional
                 offices are the front line for overseeing contractors, they do not report
Accountability   directly to headquarters units responsible for contractor performance.



                 Page 36                                GAO/HEHS-99-115 Medicare Contractor Oversight
                             Chapter 2
                             Weak Oversight of Contractors Leaves
                             Medicare Vulnerable




                             Instead, they report to the HCFA Administrator, through their respective
                             regional administrators and consortia directors. We found that the
                             structural relationship and the dispersal of responsibility for contractor
                             activities to multiple headquarters components contribute to
                             communications problems with contractors, exacerbate the weaknesses of
                             HCFA’s oversight process, and blur accountability for (1) having regions
                             adopt best practices; (2) routinely evaluating the regional offices’
                             oversight; and (3) enforcing minimum standards for conducting oversight
                             activities, including taking action when a particular region is not
                             performing well in overseeing contractors. To establish more consistency
                             and improve the quality of contractor management and oversight, HCFA
                             recently modified its organizational structure again, but these changes may
                             not be sufficient.


HCFA’s Structure             HCFA’s  1997 agencywide reorganization dispersed contractor
Contributes to Problems in   responsibilities to seven headquarters offices. To ensure that contractors
Communications and           received clear program direction under the new structure, HCFA formalized
                             its process for issuing contractor guidance and making system changes.
Oversight                    However, contractors report continued problems in receiving all required
                             information. In addition, HCFA does not share among regions best practices
                             or lessons learned from integrity reviews, nor does it evaluate the quality
                             of regional oversight. Furthermore, since regional contractor oversight
                             staffs do not report to headquarters staff responsible for contractor
                             activities, HCFA’s structure does not foster consistent accountability and
                             oversight.

                             Before HCFA’s 1997 reorganization, responsibility for managing Medicare
                             contractors fell to the Bureau of Program Operations in headquarters and
                             the 10 regional offices. The Bureau provided guidance to regional offices
                             and was responsible for almost every aspect of contractor management at
                             headquarters, including selection, budgeting, and ensuring proper
                             monitoring of contractor performance. The regional offices carried out the
                             day-to-day oversight at specific contractors.

                             Under the 1997 reorganization, regions retained their role as the primary
                             contract monitors, but responsibility at headquarters for contractor
                             functions was dispersed among seven headquarters components. This
                             functional dispersion, in part, was in response to concern that one office,
                             such as the Bureau, should not oversee all contractor activities, and
                             instead offices with responsibility for contractor functions should have




                             Page 37                                GAO/HEHS-99-115 Medicare Contractor Oversight
                                     Chapter 2
                                     Weak Oversight of Contractors Leaves
                                     Medicare Vulnerable




                                     more functional independence. Table 2.5 shows the headquarters units
                                     involved in contractor management.

Table 2.5: HCFA Headquarters Units
With Responsibilities for Medicare   HCFA organizational                                           Component
Contractor Issues                    component                     Subcomponents                   responsibilities
                                     Center for Beneficiary        Medicare Carrier and            Contractor management
                                     Services                      Intermediary Management         focal point. Contractor
                                                                   Group: Division of              performance evaluations,
                                                                   Contractor Operations,          transitions,
                                                                   Division of Contractor          customer service,
                                                                   Planning, Division of           beneficiary enrollment,
                                                                   Contractor Integrity and        coordination of benefits,
                                                                   Performance Evaluation          and appeals.

                                                                   Customer and Teleservice
                                                                   Operations Group: Division
                                                                   of Contractor Customer
                                                                   Service Operations and
                                                                   Division of Call Center
                                                                   Operations

                                                                   Beneficiary Membership
                                                                   Administration Group:
                                                                   Division of Membership
                                                                   Operation and Division of
                                                                   Member Rights and
                                                                   Protections
                                     Center for Health Plans and   Provider Purchasing and      Claims processing and
                                     Providers                     Administration Group:        payment issues,
                                                                   Division of Institutional    provider/supplier enrollment.
                                                                   Claims Processing, Division
                                                                   of Practitioner Claims
                                                                   Processing, Division of
                                                                   Supplier Claims Processing,
                                                                   and Division of
                                                                   Provider/Supplier Enrollment
                                     Office of Financial           Financial Services Group:       Accounting operations,
                                     Management                    Division of Accounting and      budget, cost reporting,
                                                                   Division of Financial           cash management/letter of
                                                                   Integrity—MSP Operations        credit, MIP, other payment
                                                                   Branch, Debt Collection         safeguards, and internal
                                                                   Branch, and Provider Audit      controls.
                                                                   Operations Branch

                                                                   Program Integrity Group:
                                                                   Division of Program Integrity
                                                                   Operations
                                                                                                                      (continued)




                                     Page 38                                 GAO/HEHS-99-115 Medicare Contractor Oversight
Chapter 2
Weak Oversight of Contractors Leaves
Medicare Vulnerable




HCFA organizational                                          Component
component                      Subcomponents                 responsibilities
Office of Information Services Business Systems              Change management,
                               Operations Group: Division    standard systems, common
                               of Change Management          working file, paper and
                               and Division of Standard      electronic data interchange,
                               Systems and Common            administrative transactions,
                               Working File Security and     and systems security.
                               Standards Group: Division
                               of Health Care Information
                               Systems Standards:
                               Division of HCFA Enterprise
                               Standards
Office of Internal Customer    Acquisition and Grants      Contracting issues.
Support                        Group: Division of Medicare
                               Contractors
Office of Clinical Standards                                 Coverage issues.
and Quality
Office of Communications       Operations Support Group:     Manual and program
and Operations Support         Division of Regulations and   guidance.
                               Issuances

Source: HCFA.



Because the 1997 reorganization spread contractor-related responsibilities
among multiple headquarters units, the Medicare Contractor Management
Group (CMG), in the Center for Beneficiary Services, was established as a
focal point for providing guidance to the contractors and the regional
offices. The CMG worked with other headquarters components and the
regional offices to coordinate the issuance of guidance and activities
related to contractor selection, budgets, transitions, processing systems,
and performance evaluations.

Recognizing that the dispersal of responsibilities could confuse
contractors, HCFA also established the Medicare Change Management
Process in October 1997 to ensure that the newly reorganized agency
provided clear program direction directly to its contractors. This process
required that the CMG, after coordinating the development of guidance or
system programming instructions for the contractors, formally certify the
instructions before they were implemented. It also effectively removed the
regional offices as conduits for information from headquarters to the
contractors.

Despite these efforts, there have been problems. Primary among them are
the uncertainties that contractors are, in fact, receiving and implementing



Page 39                                 GAO/HEHS-99-115 Medicare Contractor Oversight
Chapter 2
Weak Oversight of Contractors Leaves
Medicare Vulnerable




all instructions and that regions are not always aware of the instructions
being conveyed. According to agency officials, HCFA is developing a
checking process to remedy these problems.

To test the adequacy of HCFA’s communications with its contractors, the
Blue Cross Blue Shield Association analyzed recent documents that three
contractors reporting to three different regions received from
headquarters or their respective regional offices. According to the
Association’s analysis, each of the three contractors did not receive about
half of what they classified as key directives. In addition, at the time,
certain HCFA directives were still being funneled through regions to
contractors. Regions also varied in how well they transmitted information
to their contractors, with one region being noticeably slower at
transmitting directives than the other two.

In addition to having communications problems with contractors, HCFA
also has not communicated to regional reviewers lessons learned from
best oversight practices or from integrity investigations. HCFA
acknowledges that some regions do a better job than others and would
like to capitalize on the successful approaches particular regions employ.
In fact, in a memorandum to the regions dated August 4, 1998, from HCFA’s
Division of Contractor Integrity and Performance Evaluation, the division
director indicated that a sample of regional CPE reports would be reviewed
and periodic summaries developed to share best practices with other
regions. However, HCFA has not yet prepared any best practices
summaries, in part because the CPE reports were submitted late, according
to the director. The director also was concerned that the untimely
submission of CPE reports to headquarters may indicate that the regions
are not providing their contractors with timely information on review
results. But because this Division’s relationship with the regions is
advisory, the director could not require regions to be more timely.

Regions could also benefit from information obtained from contractor
integrity investigations, but HCFA has not incorporated such lessons into its
routine oversight practices. These integrity investigations follow
allegations of wrongdoing and entail interviewing company employees and
combing through company records. In some cases, the employee
interviews have given HCFA leads that may not have been evident through
HCFA’s current CPE process, such as instructions to alter Medicare
performance data or to destroy company records. According to staff
experienced in conducting integrity reviews, HCFA’s on-site presence also
typically leads to the discovery of performance problems not previously



Page 40                                GAO/HEHS-99-115 Medicare Contractor Oversight
                            Chapter 2
                            Weak Oversight of Contractors Leaves
                            Medicare Vulnerable




                            identified at the contractor under review. We found that integrity reviews
                            are typically done in reaction to allegations of wrongdoing and usually are
                            conducted or directed by headquarters personnel. Because these reviews
                            are seen largely as one-time, unusual events rather than as a pattern of
                            practices at more than one contractor, HCFA has not developed a formal
                            mechanism to communicate information learned about root causes and
                            prevention of these problems. Nor has it incorporated such knowledge
                            into HCFA’s routine oversight.

                            Finally, with few formal requirements for regions to report to
                            headquarters, HCFA does not collect, analyze, or evaluate information on
                            the quality of regional oversight across the country. It does not have
                            information on the relative strengths and weaknesses in regional
                            performance or on whether all contractors are being treated equitably;
                            therefore, it cannot provide formal feedback to regions to improve their
                            performance.

                            Even if it had good information on regional performance, the structural
                            relationship between headquarters units and the regions would not lend
                            itself to HCFA’s scrutiny of its regions. Regional offices report directly to
                            the HCFA Administrator through their respective regional administrators
                            and consortia directors. Regional staffs responsible for contractor
                            oversight do not report to the headquarters unit most involved with
                            contractor oversight. As a result, this headquarters unit is not clearly
                            directing contractor oversight. To illustrate, a HCFA memo to the regions
                            concerning the validation of contractor self-certifications as part of the
                            1998 review cycle stated that reviewers should perform this activity “if it
                            would be convenient.” A HCFA headquarters staff member told us that the
                            memo was intended to strongly encourage reviewers to do this activity but
                            did not directly order reviewers to do it because the headquarters unit
                            lacked the authority to do so.


HCFA Is Again               HCFA  officials have come to recognize that the agency does not have an
Reorganizing Headquarters   adequate contractor strategy. During the latter part of our review, HCFA
Functions to Address        officials told us that they were reorganizing the agency’s contractor
                            management activities. This may be a good start, but it is too soon to tell
Management Weaknesses       how well this will address the fundamental problems HCFA has had
                            ensuring adequate and consistent contractor oversight.




                            Page 41                                GAO/HEHS-99-115 Medicare Contractor Oversight
Chapter 2
Weak Oversight of Contractors Leaves
Medicare Vulnerable




In late 1998, HCFA established the Medicare Contractor Oversight Board, a
subgroup of the Executive Council,14 to provide high-level oversight of
contractor activity and to better represent contractor issues at HCFA. In
addition, the HCFA Administrator has created a new deputy position for
contractor operations in HCFA’s Center for Beneficiary Services. According
to HCFA officials, as a senior HCFA official responsible for contractor
operations, this deputy will bring contractor issues to the Executive
Council more effectively and will serve as the Executive Director of the
Oversight Board, which reports to the HCFA Administrator. HCFA has also
established a group of headquarters and regional officials to work with an
outside expert to develop a strategic plan for managing Medicare
contractors. The plan is expected to be complete in the summer of 1999.
Finally, HCFA is adding 21 new contractor management staff at
headquarters—11 of which will be involved in coordinating activities with
other organizational components.

These changes have the potential to elevate contractor issues to more
senior decisionmakers and improve communications among the units that
share responsibility for contractor management and oversight. However, it
is too soon to tell whether this new organization will lead to improved
contractor oversight.




14
  The Executive Council is a group of senior HCFA executives chaired by the Administrator.
Responsible for the operation of HCFA programs, the council establishes performance standards for
all HCFA programs and monitors the agency’s operations to ensure that the standards are being met.



Page 42                                       GAO/HEHS-99-115 Medicare Contractor Oversight
Chapter 3

HCFA Would Need Time and Careful
Implementation to Benefit From New
Contracting Authority
                            HCFA’s current legislative authority, its interpretation of that authority, and
                            its regulations constrain its ability to choose contractors and attract new
                            companies as contractors. To remedy this, HCFA has proposed legislation
                            that addresses perceived barriers to effective contracting for Medicare
                            claims administration services. The proposed changes include obtaining
                            (1) authority to contract with other than health insuring organizations,
                            coupled with repeal of the provider nomination provision for selecting
                            intermediaries, (2) authority to contract for specific activities other than
                            payment safeguards, and (3) unrestricted authority to award other than
                            cost-based contracts. In 1996, HCFA was given new authority to contract
                            separately just for payment safeguard activities, such as medical review of
                            claims, to ensure the services were medically necessary. HCFA’s experience
                            in implementing its new payment safeguard contract authority attests to
                            the need for significant time to explore and resolve several feasibility
                            issues. In addition, HCFA’s previous experience with the use of fixed price
                            and cost-plus-incentive payments suggests that any change from
                            cost-based contracting will need to be carefully designed and thoughtfully
                            monitored to prevent loss to the Medicare program. Testing different
                            methods of contracting could help HCFA ensure that implementation would
                            improve, rather than weaken, program administration.


                            When Medicare was implemented in 1966, the government used existing
Constraints on              health insurers, as the Congress intended, to process and pay claims, and
Contracting Authority       their expertise helped launch the new program. Subsequent regulations
Limit HCFA’s Ability        and decades of the agency’s own practices have further limited how HCFA
                            contracts for claims administration services. In this regard, HCFA has
to Attract New
Companies               •   not contracted with companies other than health insurers to handle any
                            aspects of administering Medicare claims, and only health insurers have
                            met the statutory definition of carriers;
                        •   not awarded separate contracts for discrete claims administration
                            functions because its law and regulations impede it from doing so, except
                            for payment safeguard contracts, which have recently been awarded under
                            its 1996 authority to contract separately for these activities only; and
                        •   infrequently used financial inducements, such as incentive payments, that
                            would allow a company to earn a profit for superior performance, and its
                            authority to do so has specific limits.

                            The Congress intended the government to contract with intermediaries
                            and carriers for the administration of the Medicare program, but it did not
                            mandate that such contractors be used. Sections 1816 and 1842 of the



                            Page 43                             GAO/HEHS-99-115 Medicare Contractor Oversight
Chapter 3
HCFA Would Need Time and Careful
Implementation to Benefit From New
Contracting Authority




Social Security Act “authorize” the Secretary of Health and Human
Services to enter into such contracts. Section 1874 grants the Secretary
authority to “perform any of [the] functions under [Medicare] directly, or
by contract. . . .” Based largely on what it understands to have been
congressional intent, HCFA believes that it is required to contract with
intermediaries and carriers for all claims administration. HCFA is pursuing
legislation that will provide explicit authority for it to do otherwise.

The initial rationale for some of HCFA’s practices under current authority
and regulations has faded against the backdrop of today’s health care
business environment. In the three decades since Medicare’s creation, the
explosion in information management technology, coupled with the
diversification of the health insurance industry into activities such as
provision of health services, has generated the potential and need for
Medicare to use new types of business entities to administer its claims
processing and related functions. However, the combination of the health
insurer-only limitation, constraints on disaggregating administrative
functions, and limits on contractor financial incentives severely hamper
efforts to modernize Medicare’s contracting processes and encourage new
companies to become contractors.

The need to broaden the pool of eligible Medicare contractors has become
acute in light of contractor attrition. Since 1980, the number of contractors
has dropped by about half. In some cases in the 1980s, contractors were
consolidated to achieve administrative efficiencies. However, continued
erosion in the number of contractors has left HCFA with fewer choices
when one contractor withdraws from the program and another must be
chosen to process the claims.15 In the last 10 years, the number of
Medicare contractors dropped about a third—from 85 to 58. (See fig. 3.1.)




15
 The desired attrition that began in the 1980s occurred after our 1979 report calling for consolidating
carrier and intermediary workloads to achieve greater efficiency. See More Can Be Done to Achieve
Greater Efficiency in Contracting for Medicare Claims Processing (GAO/HRD-79-76, June 29, 1979).



Page 44                                         GAO/HEHS-99-115 Medicare Contractor Oversight
                                        Chapter 3
                                        HCFA Would Need Time and Careful
                                        Implementation to Benefit From New
                                        Contracting Authority




Figure 3.1: Number of Medicare Claims
Administration Contractors, 1980-99




                                        The pool of contractors eligible and able to assume reassigned work is, in
                                        effect, smaller than the 58 intermediaries and carriers currently serving
                                        Medicare. First, some existing contractors are too small to easily absorb a
                                        substantially increased workload. When a Blue Shield carrier announced
                                        that it was leaving the program in 1996, for example, another one wanted
                                        to assume the workload, which would have increased the second
                                        contractor’s workload about tenfold. According to HCFA officials, however,
                                        the agency avoids adding so much work to smaller contractors to mitigate
                                        the risk of a breakdown in service—most notably, timely and accurate
                                        payments to providers. Second, some contractors may not be interested in
                                        expanding their workload. Third, it is not desirable for HCFA to choose a
                                        contractor that it knows is being investigated or prosecuted. HCFA has
                                        allowed at least one contractor that had been the subject of an
                                        investigation to expand its workload.16



                                        16
                                          Several reasons accounted for HCFA’s unusual decision in this case, including (1) the contractor’s
                                        self-disclosure of the problem; (2) its willingness to cooperate with HCFA when the agency stepped in
                                        to investigate; and (3) the steps the contractor took to ensure that the problem did not recur, including
                                        firing employees involved in wrongdoing.



                                        Page 45                                         GAO/HEHS-99-115 Medicare Contractor Oversight
                                 Chapter 3
                                 HCFA Would Need Time and Careful
                                 Implementation to Benefit From New
                                 Contracting Authority




                                 The threat of financial penalties can influence a company’s decision to
                                 drop out of the program. About a third of the nonrenewing contractors
                                 since 1990 had allegations of wrongdoing made against them. Of the 58
                                 contractors remaining today,17 at least 7 are subject to ongoing
                                 investigations. These seven contractors administered over 30 percent of
                                 Medicare’s fee-for-service claims in fiscal year 1998.


                                 In recent years, HCFA has sought legislation that would loosen its
HCFA Proposals Seek              constraints and allow it to contract in new ways. HCFA has once again
to Remove                        made legislative proposals that would make explicit its authority to award
Constraints on                   contracts

Contract Authority           •   to any type of competent business or public entity to perform functions
                                 now done by the intermediaries and carriers;
                             •   for just one or a subset of the functions now performed by the Medicare
                                 fee-for-service contractors; and
                             •   using any method of payment appropriate for the contract, without the
                                 current restrictions.


Authority to Contract With       Historical circumstances explain why Medicare law differentiates between
Other Than Health Insurers       intermediaries and carriers and why, from the outset, the government has
Would Expand HCFA’s              contracted with only health insurers to process program claims. Before
                                 Medicare’s enactment in 1965, providers feared that the program would
Options                          give the government too much control over health care. To achieve
                                 Medicare’s acceptance, the program was designed to (1) only include
                                 hospital insurance (Medicare part A) for senior citizens and (2) be
                                 administered using insurance plans, like Blue Cross, that were already
                                 processing private claims submitted by hospitals. For example, the
                                 national Blue Cross Association,18 to which many of these plans belonged,
                                 was chosen to act as an “intermediary” between the government payer
                                 and many hospitals.

                                 The decision to cover physician services (Medicare part B) was a late
                                 development, thus leading to a claims administration arrangement
                                 separate from the intermediary version. The commercial insurance

                                 17
                                  These 58 contractors are actually part of only 44 different companies. In addition, two companies
                                 with five contracts are planning a merger, and another with three contracts has agreed to buy a smaller
                                 company with only a single contract. Also, four intermediaries have announced their intention to
                                 withdraw from Medicare service before the end of fiscal year 1999.
                                 18
                                  At that time, the Blue Cross Blue Shield Association was two separate entities: the Blue Cross
                                 Association and the Blue Shield Association.



                                 Page 46                                        GAO/HEHS-99-115 Medicare Contractor Oversight
Chapter 3
HCFA Would Need Time and Careful
Implementation to Benefit From New
Contracting Authority




industry and certain Blue Shield plans were chosen by geographic locale
to process physician claims as “carriers.” Unlike intermediaries, all
carriers contract directly with HCFA.

The Congress did not mandate that either intermediaries or carriers be
used for the administration of the Medicare program. It did, however,
authorize the Secretary of Health and Human Services to contract with
such entities and clearly expected that this would happen. Nonetheless,
HCFA believes that it needs a legislative change in order to contract with
other than health insuring organizations for functions currently performed
by carriers and intermediaries and to choose intermediaries without using
the current provider nomination process. Because of this belief—bolstered
by the clear intent of the Congress, HCFA practice, and HCFA’s interpretation
of the Social Security Act—intermediaries and carriers have been limited
almost entirely to established health insurance companies.

To encourage hospitals to participate in the new Medicare program by
giving them some choice in their claims processor and to protect current
relationships between hospitals and health insurers, the Medicare statute
contained a provision called “provider nomination.” This provision
authorized, but did not mandate, a system that allowed the professional
associations of hospitals and certain other institutional providers to
choose claims processing contractors on behalf of their members. When
the program began, the American Hospital Association nominated the
national Blue Cross Association to serve as its intermediary.19 In 1966, the
Association entered into a prime contract and subcontracted with 74 local
member Blue plans. Currently, the Association is one of Medicare’s five
intermediaries and serves as prime contractor for 32 local member plan
subcontractors that together process over 85 percent of all benefits paid
by intermediaries. All intermediaries are also health insurance companies.

Under the prime contract, when one of the local Blue plans declines to
renew its Medicare contract, the Association—rather than HCFA—chooses
the replacement contractor. For example, the local Blue plan for
Minnesota recently announced that it would soon be giving up its
Medicare part A business. Because the hospitals serviced by the Minnesota
plan had nominated the Association to serve as their intermediary, the

19
  The nominated intermediaries initially chosen were the Blue Cross Association, nine commercial
insurance companies, two independent plans, and one state agency. The Association paid claims at
that time for most of the nonprofit community hospitals and 87 percent of all hospitals. The
Association was also selected by more than half of the extended care facilities in the country. As a
result, the Association was responsible for many more providers than the other 12 intermediaries first
chosen. No new intermediaries have been named since December 1969, when one of the initial
intermediaries was replaced.



Page 47                                        GAO/HEHS-99-115 Medicare Contractor Oversight
Chapter 3
HCFA Would Need Time and Careful
Implementation to Benefit From New
Contracting Authority




Association conducted a competition among any interested member plans
and named Noridian Government Services, formerly known as Blue Cross
and Blue Shield of North Dakota, as Minnesota’s successor. This process
effectively limited HCFA’s flexibility to choose a commercial plan or even a
different local Blue plan to replace a local Blue plan that was withdrawing
from the program.

Similarly, the government was authorized, but not mandated, to contract
directly with individual carriers that were existing payers of health care
services for the processing of physician claims.20 The pool of eligible
contracting companies has been limited almost entirely to established
commercial health insurers and Blue Shield plans. Currently, HCFA
contracts with about 22 carriers, of which about two-thirds are local Blue
Shield plans that process about 60 percent of all part B claims.

Using health insurers entailed certain conflicts of interest. As Medicare
contractors, these companies had control over sensitive health status
information and payment decisions that could be used to improperly
benefit their private lines of business. These inherent conflicts were
acknowledged in the companies’ Medicare contracts, which included
provisions prohibiting the improper use of privileged information. In
addition, the companies responsible for paying Medicare claims were the
same companies responsible for later checking that these payments had
been made appropriately. More recently, additional conflicts were
introduced when insurance companies serving as Medicare contractors
began establishing health maintenance organizations and provider
networks. The fundamental conflict under such circumstances occurs
when a company responsible for reviewing the appropriateness of
Medicare claims is also a corporate partner with hospitals, physician
networks, and other providers billing the program.

Under HCFA’s proposal to repeal the provider nomination authority and the
requirement that all carriers be health insurers, HCFA would be free to
select its own contractors. The repeal of the nomination authority would
allow HCFA to eliminate the prime contract arrangement with the Blue
Cross Blue Shield Association. Under the proposed change, whenever a
Medicare subcontract is not renewed for a local Blue plan serving as an

20
  Under section 1842(f) of the Social Security Act, a “carrier” is (1) “a voluntary association,
corporation, partnership, or other nongovernmental organization which is lawfully engaged in
providing, paying for, or reimbursing the cost of, health services under group insurance policies or
contracts, medical or hospital service agreements, membership or subscription contracts, or similar
group arrangements, in consideration of premiums or other periodic charges payable to the carrier,
including a health benefits plan duly sponsored or underwritten by an employee organization” or (2) a
Medicare intermediary.



Page 48                                        GAO/HEHS-99-115 Medicare Contractor Oversight
                                  Chapter 3
                                  HCFA Would Need Time and Careful
                                  Implementation to Benefit From New
                                  Contracting Authority




                                  intermediary, HCFA would be able to award that contractor’s workload to
                                  any company or combination of companies—including those outside the
                                  existing contractor pool—and would no longer be limited to using a plan
                                  selected by the Association. In fact, the merit of this nomination authority
                                  has been questioned for nearly three decades. In 1970, a Senate Finance
                                  Committee report concluded that the original purpose of the provision for
                                  provider nomination of the intermediary has largely been served and that
                                  with the maturation of Medicare, the Congress should consider modifying
                                  the provision.21 Similarly, the proposal to expand carrier eligibility criteria
                                  beyond the health-insurer-only restriction could also be used to increase
                                  the pool of eligible contractors.


Clarified Authority to            Health insurers are not the only companies with experience and skills in
Award Functional                  some of the activities now performed by carriers and intermediaries, but
Contracts Could                   until recently, HCFA has not tried to separately contract for specific claims
                                  administration functions. HCFA interprets its Medicare regulations, as well
Restructure Claims                as the Social Security Act, as constraining it from awarding separate
Administration                    contracts for individual claims administration activities. HCFA believes it
                                  must obtain clarifying authority from the Congress to do otherwise, as it
                                  did recently for payment safeguards, or must publish a superseding
                                  regulation.22 Though HCFA is interested in trying to contract by function,
                                  Medicare intermediaries and carriers have expressed concern that
                                  contracting by function would be disruptive to their operations and the
                                  program. While HCFA could revise its regulations and remove some of the
                                  constraints on functional contracting, it has chosen for several years to
                                  approach the Congress for clarifying legislation so that all of the
                                  constraints can be addressed at once. In 1996, HCFA received new authority
                                  to contract separately for program safeguard functions. Implementing
                                  these functional contracts will give HCFA useful experience in the
                                  advantages and possible pitfalls to such contracts.

Regulations Limit HCFA’s          HCFA’sregulations stipulate that, to qualify as a carrier or intermediary, the
Ability to Contract by Function   contracting organization must perform all of the Medicare claims




                                  21
                                     Medicare and Medicaid: Problems, Issues, and Alternatives, Report of the Staff to the Committee on
                                  Finance, U.S. Senate, Feb. 9, 1970, p. 114.
                                  22
                                    HCFA has published proposed regulations that included language that would change these
                                  constraining provisions, but the provisions have never been included in a final regulation. Such
                                  language has been included most recently as part of the MIP proposed rule (63 Fed. Reg. 13,590,
                                  Mar. 20, 1998), which has not yet been finalized.



                                  Page 49                                        GAO/HEHS-99-115 Medicare Contractor Oversight
Chapter 3
HCFA Would Need Time and Careful
Implementation to Benefit From New
Contracting Authority




administration functions.23 These functions include, among others, claims
processing, adjudicating appeals of payment decisions, collecting debt and
recovering overpayments, and responding to customer inquiries.

Under this all-or-nothing interpretation, HCFA requires each Medicare
claims processing contractor to perform functions that could otherwise be
consolidated into a single contract or a few regional contracts to achieve
economies of scale. For example, in the fee-for-service Medicare program,
each contractor conducts hearings on provider and beneficiary appeals of
its own claims decisions. Despite the possible conflict of interest in
reviewing its own corporate decisions and the possible inefficiency of
operating an individual appeals function at each contractor, HCFA contends
that Medicare regulations do not permit awarding a separate consolidated
contract for a function such as appeals. In contrast, under different
contracting authority used for the Medicare managed care program, which
is composed of more than 300 health plans, HCFA consolidated the appeals
function into one contract. Similarly, there are companies that could
perform some of the functions currently performed by Medicare
contractors. With the prospect of separate contractors for medical review
activities included as part of the new program safeguard contracts, the
argument that contractors for intermediary and carrier functions must be
medically oriented is less persuasive. Functions such as printing and
mailing or answering beneficiary inquiries might be more economically
and efficiently handled under one or a few contracts.

The proposal to permit functional contracting could significantly
restructure Medicare’s contracting process. Coupled with the proposals
that would broaden the choice of contracting entities, functional
contracting could enable HCFA to make better business decisions in
selecting and retaining contractors. HCFA could select companies on the
basis of their particular areas of expertise, consolidate operations to
achieve economies of scale, and, in some cases, mitigate the conflicts of
interest that currently exist for most Medicare contractors.

On the other hand, functional contracting could introduce new problems
into the Medicare program. After 30 years of integration, contractors’
functions are not necessarily easy to separate. Contractor representatives
told us that their claims processing systems are structured for end-to-end

23
 Since 1965, the Medicare statute has required that intermediaries perform payment and payment
determination functions as well as some or all of a number of listed functions. Carriers are required to
perform some or all of a number of listed functions, which include payment and payment
determination functions. Since 1980, regulations governing the functions of intermediaries and carriers
have elaborated on their specific responsibilities and what they must do to meet them. 42 C.F.R. part
421.



Page 50                                         GAO/HEHS-99-115 Medicare Contractor Oversight
                           Chapter 3
                           HCFA Would Need Time and Careful
                           Implementation to Benefit From New
                           Contracting Authority




                           claims administration activities. Having multiple companies doing
                           different tasks in claims administration with the current claims systems
                           could create coordination difficulties for the contractors, providers, and
                           HCFA staff. As the functions best suited for separate functional contracts
                           have not yet been determined, feasibility tests might be necessary for the
                           success of such an initiative.

MIP Will Test Functional   HCFA’s  new efforts to contract for program safeguards will test the efficacy
Constraints                of functional contracting. The program safeguard authority is significant in
                           that it is explicit and, potentially, enables HCFA to mitigate the conflict
                           inherent when an entity processing Medicare claims is the same entity
                           reviewing the claims for error. In addition, the new contracting authority
                           provided under this program affords HCFA greater flexibility in selecting
                           from among competing eligible entities, creating other-than-cost-based
                           contracts, and awarding contracts to conduct specific sets of program
                           safeguard functions rather than the full set of carrier and intermediary
                           activities. This will also provide HCFA with experience in managing a
                           competitive procurement.

                           HCFA’s  goal for program integrity is to make correct and prompt payments
                           to legitimate providers for appropriate services rendered to eligible
                           beneficiaries. Accordingly, payment safeguard functions to be performed
                           under the MIP contract include reviewing providers’ claims (medical,
                           utilization, and fraud reviews); auditing providers’ and managed care
                           plans’ cost reports; performing MSP reviews and recovering erroneous
                           program payments; educating providers and beneficiaries about program
                           integrity issues; and maintaining lists of durable medical equipment items
                           requiring prior approval.

                           However, HCFA’s efforts to implement new contracting authority under MIP
                           have moved more slowly than anticipated, suggesting that contracting
                           changes—and any resulting benefits from them—will take time to be fully
                           realized. Over 2 years elapsed before HCFA had a contract and was ready to
                           seek contract bids; the request for proposals was not released until
                           September 1998. In its proposed rule, which includes provisions on the MIP
                           payment safeguard contract, HCFA outlined its strategy to “implement the
                           MIP incrementally in a manner that will provide a way to test alternatives
                           and to transition integrity activities to MIP contractors.” HCFA announced its
                           award of 12 contracts in May 1999. Time will be needed to award task
                           orders, transition workload, and allow contractors to perform the task
                           order functions before an assessment of the program can be made. Also,
                           HCFA does not plan to transfer any workload from the existing contractors




                           Page 51                              GAO/HEHS-99-115 Medicare Contractor Oversight
    Chapter 3
    HCFA Would Need Time and Careful
    Implementation to Benefit From New
    Contracting Authority




    until it is determined that they have successfully implemented year 2000
    computer changes.

    In preparing to issue a request for proposals (RFP) for the payment
    safeguard contracts, HCFA had to grapple with several problems similar to
    those it would face if given the opportunity to implement similar, but more
    broadly based, contracting changes. For example, HCFA had to define the
    payment safeguard functions in enough detail in the statement of work so
    that bidders could understand the functions well enough to allow them to
    prepare competitive bids. Implementation decisions on task orders in
    addition to those already released must still be made. The RFP called for
    the award of one or more contracts with

•   uncertain delivery dates;
•   no delineation of which functions within the program integrity statement
    of work are to be performed;
•   the possibility of cost-based reimbursement, firm fixed-price, or time and
    materials pricing arrangements;24 and
•   no identification of which geographic areas will be served.

    The 12 companies that HCFA competitively awarded MIP contracts will be
    eligible to bid on MIP task orders for specific work to be performed within
    specified time periods under a stated reimbursement method in a specified
    area. Contractors may refuse any particular task order. HCFA has no
    obligation to issue any particular task order and will merely be bound by
    its commitment to offer each contractor a task order worth at least
    $50,000 during the contract term. While a bidder had to bid for the whole
    range of possible MIP work and could not bid just for a portion of it in
    which it might have special expertise, HCFA reserves the right to award any
    or all of the possible MIP work for a geographic or substantive area to one
    contractor.

    Even after full implementation of the MIP contracts, including the transfer
    of program safeguard activities to the new MIP contractors, HCFA must
    continue to manage its intermediaries and carriers. To control attrition
    among them, we believe HCFA must determine what incentives can be
    offered to those whose program integrity functions are transferred to MIP
    contractors. Achieving a successful balance between the effective
    implementation of the new MIP authority and preservation of the current

    24
      Firm fixed-price contracts require a contractor to perform all specified tasks and activities for an
    agreed-upon price, no matter what the actual cost is to the contractor. (48 C.F.R. 16.202-1.) Time and
    materials pricing contracts provide for acquiring goods or services on the basis of labor hours at a
    fixed hourly rate and materials at cost. (48 C.F.R. 16.601.)



    Page 52                                         GAO/HEHS-99-115 Medicare Contractor Oversight
                            Chapter 3
                            HCFA Would Need Time and Careful
                            Implementation to Benefit From New
                            Contracting Authority




                            system of intermediaries and carriers, which will continue to process
                            fee-for-service Medicare claims, answer inquiries, and conduct hearings,
                            will be a formidable challenge. The MIP implementation will also give HCFA
                            needed experience that could be used to help implement the additional
                            contractor management changes it is seeking.


Past Experience Suggests    Medicare law generally requires intermediary and carrier contracts to be
Caution When Adding         based on costs. Contractors are paid for the necessary and proper costs of
Financial Inducements for   carrying out Medicare activities but are not permitted to make a profit.
                            HCFA pays contractors on a unit-cost basis25 up to a targeted amount. If a
Medicare’s Claims           contractor’s costs exceed the target during the contract year, the
Processing Contractors      contractor can request supplemental funding. While not able to earn
                            profits, contractors can benefit when Medicare pays a share of corporate
                            overhead. In addition, Medicare has paid for innovations in the program,
                            particularly in electronic claims technology, knowledge, and experience,
                            which some Medicare contractors have been able to transfer to their
                            private businesses. Nevertheless, the adequacy of current contractor
                            funding to fully cover costs is in dispute and may be contributing to
                            contractors withdrawing from the program. HCFA has offered
                            other-than-cost-based contracts in the past, using first its demonstration
                            authority and later its limited authority to use such contracts, as an
                            inducement to contractors, but some of these experiments have had
                            problems.

                            HCFA’s contracts differ from standard government contracts in ways that
                            affect contractor reimbursement for specific work done. Unlike other
                            federal contracts, HCFA’s claims administration contracts do not contain
                            conventional statements of work detailing the tasks and activities to be
                            performed and relating those particular tasks to the price or budget to
                            perform them, but rather incorporate by reference all regulations and
                            general instructions issued by the Secretary of Health and Human
                            Services.26 Such an arrangement gives HCFA flexibility to ask contractors to
                            add specific tasks without going through a formal contract amendment
                            coupled with either additional payment or abatement of other
                            contractually required activities. However, such an arrangement makes
                            less clear the specific tasks and activities that HCFA expects contractors to


                            25
                              These unit costs are based on updated historical cost data, adjusted for the contractors’ mix of
                            claims.
                            26
                             Intermediary and carrier contracts list types of functions to be performed, but these short lists of a
                            page or two do not compare with the complete descriptions, as found, for example, in the MIP
                            solicitation, which exceeds 100 pages.



                            Page 53                                         GAO/HEHS-99-115 Medicare Contractor Oversight
Chapter 3
HCFA Would Need Time and Careful
Implementation to Benefit From New
Contracting Authority




accomplish. It has also left HCFA with a lack of experience in pricing those
claims administration tasks and activities that may make moving beyond
cost-based reimbursement difficult.

Contractor budgets for claims administration have been falling relative to
the volume of claims they process. Before fiscal year 1996, contractor
budgets were based on an amount per claim—up to a target—for all claims
administration activities, including program safeguard activities. After
fiscal year 1996, program safeguards were funded separately, but other
claims administration activities are still budgeted on a per-claim basis, up
to the preset target. In the past two decades, the cost per claim has
dropped significantly. Between 1975 and 1997, the amount per claim was
reduced by two-thirds without consideration of inflation over the period.
Reducing this amount reflected HCFA’s strategy to achieve program savings
from increased use of electronic claims processing. However, our past
studies showed that program safeguards funding did not keep up with
claims volume, which left Medicare vulnerable to unnecessary program
outlays and erroneous payments. Although separate funding for program
safeguards is now guaranteed through the MIP, contractors continue to
express concern that the payments they receive do not fully cover their
claims administration costs.

One contractor representative summed up the dilemma of contractor
reimbursement by stating that:

“Some contractors have found that Medicare reimbursement of their operating costs is so
inadequate that . . . they are subsidizing Medicare operations. Once a thorough analysis of
corporate finances reveals this imbalance, a corporation must decide whether it can
balance the books by achieving economies of scale or whether there is some benefit to
being a Medicare contractor that makes it worth paying the government for the privilege.”


The constraints on earning a profit make participation in the Medicare
program less attractive to some current contractors. Initially, the prestige
of serving as a Medicare contractor and the advantages of having the
government pay a share of overhead costs and being introduced to new
automation technology were sufficient to encourage companies to
participate in Medicare. Today, however, some of these companies are
refocusing their business interests on more lucrative enterprises, such as
managed care plans and physician networks, according to the Blue Cross
Blue Shield Association and commercial insurer representatives. When
these companies consider whether to renew their Medicare contracts,




Page 54                                   GAO/HEHS-99-115 Medicare Contractor Oversight
Chapter 3
HCFA Would Need Time and Careful
Implementation to Benefit From New
Contracting Authority




HCFA is not in a position to offer financial incentives for their continued
participation.

Under the proposal to repeal the cost-based contract restrictions, HCFA
would be free to award contracts that would permit contractors to earn
profits. HCFA’s past experiments with financial incentives, however,
generally have not been successful and raise concerns about the success
of any immediate implementation of such authority without further
testing.

HCFA’s  experiments with both competitive fixed-price-plus-incentive-fee
contracting and adding financial incentives to cost-based contracts have
had significant problems. Between 1977 and 1986, eight competitive
fixed-price contracts, designed to consolidate the workload of two or
more small contractors, were established on an experimental basis. Under
these fixed-price-plus-incentive-fee contracts, contractors knew the gain
or loss to them from specific ranges of performance of certain activities
and concentrated on maximizing reimbursement, to the detriment of other
activities.

Our 1986 report noted that three of the contracts generated administrative
savings.27 Two of the contracts resulted in over $130 million in benefit
payment errors (both overpayments and underpayments), so that much of
the estimated $48 million to $50 million in administrative savings
attributed to the more successful experiments may have been offset by
payment error losses. One of the contractors that appeared successful in
1986, having the potential to achieve some administrative savings—the
Health Care Service Corporation (Blue Cross Blue Shield of Illinois)—has
since agreed to pay a $4 million criminal fine and a $140 million civil
settlement for fraudulent and improper activities conducted between 1984
and 1997. This contractor pleaded guilty to eight felony counts in response
to allegations that it had failed to safeguard program dollars by paying
claims with Medicare funds that should have been paid by other insurers,
paying claims for durable medical equipment without checking for medical
necessity, and paying claims under $50 without properly screening them.

Beginning in 1989, HCFA provided financial incentives in several cost-based
contracts when it was given some limited authority to award
other-than-cost contracts. Incentives were offered to a few contractors to
lower claims unit costs and to improve performance in some safeguard

27
 Medicare: Existing Contract Authority Can Provide for Effective Program Administration
(GAO/HRD-86-48, Apr. 22, 1986).



Page 55                                      GAO/HEHS-99-115 Medicare Contractor Oversight
                       Chapter 3
                       HCFA Would Need Time and Careful
                       Implementation to Benefit From New
                       Contracting Authority




                       activities. HCFA found that some of the self-reported data contractors used
                       to claim incentive payments were inaccurate. In one case, the financial
                       incentives would not have been paid had a contractor with integrity
                       problems not cheated by “correcting” errors in about a quarter of the 60
                       claims that were going to be reviewed by HCFA.

                       HCFA’s  contracting proposals, besides giving HCFA new authorities, would
                       require a move to competitive contracting in some situations and will thus
                       likely require more initial managerial time and effort than maintaining the
                       current contracting arrangements. In our 1986 report, we questioned
                       HCFA’s ability to manage a large number of competitive contracts. Such
                       contracts require more resources in the beginning of the contracting
                       process for activities not needed for traditional cost-based contracts, such
                       as preparing requests for proposals, evaluating proposals, and awarding
                       contracts. In addition, competitive contracting would increase the need to
                       transition-in new contractors, and HCFA has found that such transitions
                       require additional staff time and travel funds to accomplish successfully.
                       However, HCFA believes that competitive contracting will reduce costs and
                       increase efficiency in the long run.


                       The combination of contracting proposals sought by HCFA might enable it
Feasibility Testing    to broaden its pool of eligible bidders, improve the administration of
Needed to Facilitate   Medicare claims, and increase options for attracting and retaining
Transition to New      contractors. However, HCFA’s experience in designing the payment
                       safeguard specialty contract suggests that sufficient time should be
Contracting            allowed to test the feasibility of certain concepts before implementing
Environment            them. Furthermore, HCFA’s past experience with other-than-cost
                       contracting suggests that its new approaches must be carefully thought
                       through so that the incentives that are built into the contracting
                       arrangements improve, rather than weaken, program administration.

                       HCFA  would need to test the practicality of separating functions that single
                       contractors have performed for over 30 years. Insurance industry
                       representatives commenting on this issue contended that HCFA would need
                       to ensure coordination among the multiple companies performing
                       different Medicare functions, each using different automated systems to
                       administer a set of claims. They noted that some functions, like hearings
                       and appeals, might be more conducive to performance in isolation.
                       Likewise, building on past experience, HCFA would need to test ways to
                       offer financial incentives that would not foster incentives to submit false
                       data or neglect critical functions.



                       Page 56                              GAO/HEHS-99-115 Medicare Contractor Oversight
Chapter 3
HCFA Would Need Time and Careful
Implementation to Benefit From New
Contracting Authority




Unlike the other proposals, the repeal of provider nomination raises few
initial implementation concerns. Allowing HCFA to award intermediary
contracts as it determines necessary for the administration of the
Medicare program might contribute to the efficiency and effectiveness of
the program. With this change in authority, if HCFA is faced with additional
Blue contractors unwilling to continue service to the program or unfit
because of performance or integrity problems, it could assign intermediary
workloads in whatever way makes the most sense.

HCFA  does not yet have a strategy for use of the proposed authorities, but it
has become increasingly concerned that the diminishing pool of current
contractors will not have the capacity to meet the future needs of the
Medicare program. The experience gained under the MIP program in
functional contracting will be valuable in devising a strategy. If the
contracts are awarded to entities outside the current contracting pool, and
a payment method other than cost reimbursement is used, additional
lessons can be learned. However, the delay in implementing MIP, as well as
the time necessary to conduct meaningful evaluations of this contracting
approach, means that few immediate benefits can be expected from the
strategic use of any new authority granted to HCFA.




Page 57                              GAO/HEHS-99-115 Medicare Contractor Oversight
Chapter 4

Conclusions, Recommendations, and
Agency Comments

              Medicare’s fee-for-service program pays out the lion’s share of program
Conclusions   dollars expended by HCFA. With billions of dollars at risk, it is a business
              that must be carefully monitored. During the last 9 years, HCFA, the HHS OIG,
              and the Department of Justice have found instances of contractors
              “cooking the books” to appear to meet HCFA’s requirements. Yet HCFA
              conducts limited review of contractor activities to ensure that contractors
              are accurately processing claims and safeguarding Medicare dollars. In its
              monitoring and oversight of contractors, HCFA has generally accepted
              financial and workload information as presented, without verifying
              contractors’ self-certifications that internal controls are working
              effectively and without systematically validating that financial and
              workload information is accurately reported. Until HCFA starts regularly
              assessing that contractor internal controls are working effectively and that
              contractor performance and financial information is accurate, it cannot be
              assured of contractors’ integrity, that their payments to providers are
              accurate, and that they are fiscally responsible in their handling of
              Medicare funds.

              HCFA’s  current contractor evaluation process has the virtue of allowing
              regions to focus on contractor weaknesses they may have identified.
              However, in our opinion, HCFA has not regularly guided its regions in using
              their limited oversight resources most effectively. Contractor oversight
              could be strengthened if HCFA balanced an appropriate level of regional
              discretion with sufficient effort to (1) establish measurable contractor
              performance standards—particularly in the program safeguard area,
              (2) set programwide priorities for the assessment of all contractors on
              core performance standards, and (3) develop a standardized report format
              that will facilitate comparisons of contractor performance and the use of
              trend data that will allow for longitudinal assessments of individual
              contractor performance. Setting clear standards and priorities and
              measuring contractors on how well they meet the priorities would give
              HCFA a clearer picture of how well contractors are performing. This also
              would help HCFA determine which contractors should be given increased
              work. In addition, giving contractors clear and consistent direction would
              help meet HCFA’s priorities.

              Relatedly, HCFA has not established a mechanism for reviewing regions’
              oversight for consistency and uniformity and for sharing effective regional
              oversight strategies. To do so, HCFA needs an organizational structure for
              contractor oversight that will ensure that regions are evaluated on, and
              held accountable for, the quality of the oversight they provide to
              contractors. HCFA headquarters offices must also be accountable to regions



              Page 58                            GAO/HEHS-99-115 Medicare Contractor Oversight
Chapter 4
Conclusions, Recommendations, and
Agency Comments




for providing adequate policy guidance and direction so that regional
oversight can be effective. HCFA has begun to address its headquarters
structure as far as communications is concerned, but it still needs to
address the issue of regional accountability. Headquarters should be able
to enforce minimum standards for contractor oversight and provide formal
feedback to the regions to improve their performance. HCFA also needs a
mechanism to regularly share best practices and to ensure that regional
oversight staff adopt best practices as they review contractors. Finally,
despite its numerous integrity reviews, HCFA has not incorporated the
information gained through them to improve routine contractor oversight.

Doing more consistent and thorough oversight may require HCFA to
allocate more of its resources to these activities. But given the HHS OIG’s
estimate of over $12 billion in improperly paid fee-for-service claims and
current concerns about fraud, such an investment seems prudent.

Because of statutory requirements and established practices, HCFA
contracts out claims administration to a shrinking pool of companies
whose private interests are increasingly competing with their Medicare
responsibilities. HCFA is seeking legislative remedies—including explicit
authority to contract in different ways. But even if the Congress grants
these authorities, HCFA would need time, additional information, and
experience to properly implement them. Eliminating provider nomination,
removing the requirement to contract only with health insurers, as well as
allowing HCFA to more freely use other-than-cost contracts would give HCFA
more control over which companies to use as contractors. In addition,
doing so might broaden the pool of prospective contractors. Allowing HCFA
to conduct more functional contracting might make Medicare more
efficient. Yet HCFA’s experience with the MIP and with previous
other-than-cost contracts suggests that many carefully considered
intermediate steps need to be taken before HCFA can realize the benefits of
such legislative changes. HCFA would need to proceed cautiously,
evaluating its implementation of such changes, to be sure that the changes
would ultimately benefit the Medicare program. For that reason, over the
long term, HCFA could benefit from a strategic plan for routinely
conducting competitive procurements and managing claims
administration contractors. This plan could be used as a guide on the path
from HCFA’s current contracting mode to a new one. HCFA could design this
plan to help it determine (1) which contractor activities are most
conducive to functional contracting, (2) which activities could be
performed by other than health payers, (3) better cost information to
facilitate the move to competitive contracting, (4) the functional contracts



Page 59                             GAO/HEHS-99-115 Medicare Contractor Oversight
                            Chapter 4
                            Conclusions, Recommendations, and
                            Agency Comments




                            that might be conducive to other-than-cost payments, and (5) the
                            feasibility of building financial incentives into the contracts.

                            Legislative change will not solve HCFA’s oversight problems. Even if the
                            Congress grants HCFA the contracting changes it is seeking, the agency will
                            still have to make sure that it addresses the weaknesses associated with its
                            management and oversight of the contractors. Also, if it is authorized to
                            contract in new ways, it will have to customize its oversight to each new
                            type of contract it awards.


                            The Congress may want to consider giving HCFA explicit authority to award
Matters for                 functional contracts for selected claims administration activities to any
Consideration by the        appropriate type of company and to offer other-than-cost contracts, both
Congress                    at the discretion of the Secretary of Health and Human Services. Also, in
                            view of the possible advantages for managing the Medicare program, the
                            Congress may wish to consider amending the Social Security Act to repeal
                            provider nomination and to allow the Secretary to choose the companies
                            with which HCFA will contract.

                            If the Congress decides to grant HCFA any of the additional contracting
                            authorities it is seeking, the Congress should consider requiring HCFA to
                            report on its implementation of this new authority with an independent
                            evaluation to ensure that these administrative changes improve the
                            efficiency and effectiveness of Medicare program operations.


                            To improve oversight of Medicare’s claims administration contractors, we
Recommendations to          recommend that the HCFA Administrator take the following actions:
the Administrator,
Health Care Financing       1. Establish a contractor management policy that requires

Administration          •   verification that each contractor has the internal controls necessary to
                            ensure the adequacy of its operations, starting with the controls most
                            critical for ensuring the financial integrity of the Medicare program; and
                            where controls are weak or lacking, require contractors to strengthen or
                            establish them; and
                        •   systematic validation of statistically significant samples of essential
                            contractor-reported data.

                            2. Improve annual assessments of contractors by




                            Page 60                             GAO/HEHS-99-115 Medicare Contractor Oversight
    Chapter 4
    Conclusions, Recommendations, and
    Agency Comments




•   developing a comprehensive set of clearly defined and measurable
    performance standards, including measures to test how effectively
    contractors are safeguarding program dollars; these standards should
    include collecting comparable baseline data on each contractor’s claims
    administration and related activities;
•   assessing all contractors regularly on core performance standards and
    reviewing any other activities identified through the risk assessment at
    individual contractors; and
•   developing a performance report annually for each contractor that
    includes contractor performance on the core standards and other
    HCFA-assessed standards, using a uniform format that permits comparisons
    across contractors as well as longitudinal assessments of individual
    contractors.

    3. Designate a HCFA unit to be responsible for

•   evaluating the effectiveness of contractor oversight policy and procedural
    direction provided by headquarters staff to regional offices’ staff,
•   evaluating regional office performance in conducting contractor oversight
    activities based on those policies and procedures, and
•   enforcing minimum standards for the conduct of oversight activities.

    4. Ensure that all HCFA staff responsible for contractor oversight learn
    about contractor problems and best practices and that contractor review
    staff adopt best oversight practices.

    5. Develop a strategic plan for managing Medicare’s claims administration
    contractors that would include how HCFA intends to use the new
    authorities it is seeking, the information it will gain by evaluating its
    current efforts to contract for program safeguard activities, and the results
    of previous fixed-price and incentive contracting experiments. To do this,
    HCFA should


•   assess the feasibility of contracting for specific functions—that is,
    contracting separately for activities such as hearings and appeals, inquiries
    and complaints, and printing and mailing;
•   determine which functional contracts could be performed by entities other
    than health care payers;
•   determine the cost of each of the various contractor functions now
    performed by intermediaries and carriers;
•   determine which functional contracts would be conducive to the use of
    other-than-cost contracts; and



    Page 61                             GAO/HEHS-99-115 Medicare Contractor Oversight
                         Chapter 4
                         Conclusions, Recommendations, and
                         Agency Comments




                     •   assess the feasibility of building in financial incentives for exceeding
                         performance standards or for developing innovative practices that
                         improve claims administration and can be replicated by other contractors.


                         In written comments on a draft of this report, HCFA agreed with each of our
Agency Comments          recommendations. Appendix I contains HCFA’s general as well as specific
and Our Evaluation       comments on each recommendation and its plan for implementing each
                         one. HCFA also provided technical comments, which we incorporated in the
                         report as appropriate. In addition, HCFA listed several other activities that it
                         believes will help to improve and strengthen its contractor management
                         and oversight. Overall, we believe that HCFA has outlined a series of
                         activities to respond to our recommendations that—if properly designed
                         and carried out—should go a long way toward improving its management
                         and oversight of the contractors that engage in claims administration
                         activities for the Medicare program.

                         With regard to verification of internal controls and contractor-reported
                         data, HCFA said that it is hiring an independent public accounting firm to
                         develop standard review procedures and methodologies for the evaluation
                         of documentation supporting the annual certification of internal controls.
                         This firm will prepare individual contractor review reports and
                         recommend improvements in the internal control certification and
                         evaluation processes. On the basis of the result of the firm’s internal
                         control reviews, HCFA said it will also consider using accounting firms to
                         conduct even more in-depth internal control audits. HCFA said it will
                         develop a protocol for validating contractor-reported performance data in
                         fiscal year 2000, which will serve as the basis for data validation reviews
                         beginning in fiscal year 2001.

                         For our recommendation to improve annual contractor assessments, HCFA
                         lists a number of steps it will take during its fiscal year 1999 assessment
                         cycle. These include establishing core evaluation areas, promoting greater
                         consistency through the use of standardized protocols and national review
                         teams for on-site reviews, and using accounting firms to evaluate the
                         quality of the contractors’ provider audits. Concerning performance
                         standards, HCFA said that it will emphasize the development of outcome
                         measures, including development of a contractor-specific claims error
                         rate, assessing the effectiveness of contractor education and outreach
                         activities to reduce provider billing errors, and developing a
                         contractor-specific “fraud rate.” To assist in these measurement efforts,
                         HCFA is developing a new management reporting system that will use data




                         Page 62                             GAO/HEHS-99-115 Medicare Contractor Oversight
Chapter 4
Conclusions, Recommendations, and
Agency Comments




derived directly from contractor claims processing systems rather than
relying on contractor-reported data.

HCFA said that it will assign responsibility for evaluating the effectiveness
of regional office oversight to its newly reorganized contractor
management group in headquarters, will take steps to share best practices,
and will develop a business strategy for contractor management that will
include plans for implementation of any new contracting authority.




Page 63                             GAO/HEHS-99-115 Medicare Contractor Oversight
Appendix I

Comments From the Health Care Financing
Administration

Note: HCFA’s technical
comments are omitted.




                         Page 64   GAO/HEHS-99-115 Medicare Contractor Oversight
Appendix I
Comments From the Health Care Financing
Administration




Page 65                               GAO/HEHS-99-115 Medicare Contractor Oversight
Appendix I
Comments From the Health Care Financing
Administration




Page 66                               GAO/HEHS-99-115 Medicare Contractor Oversight
Appendix I
Comments From the Health Care Financing
Administration




Page 67                               GAO/HEHS-99-115 Medicare Contractor Oversight
Appendix I
Comments From the Health Care Financing
Administration




Page 68                               GAO/HEHS-99-115 Medicare Contractor Oversight
Appendix I
Comments From the Health Care Financing
Administration




Page 69                               GAO/HEHS-99-115 Medicare Contractor Oversight
Appendix I
Comments From the Health Care Financing
Administration




Page 70                               GAO/HEHS-99-115 Medicare Contractor Oversight
Appendix I
Comments From the Health Care Financing
Administration




Page 71                               GAO/HEHS-99-115 Medicare Contractor Oversight
Appendix I
Comments From the Health Care Financing
Administration




Page 72                               GAO/HEHS-99-115 Medicare Contractor Oversight
Appendix I
Comments From the Health Care Financing
Administration




Page 73                               GAO/HEHS-99-115 Medicare Contractor Oversight
Appendix I
Comments From the Health Care Financing
Administration




Page 74                               GAO/HEHS-99-115 Medicare Contractor Oversight
Appendix I
Comments From the Health Care Financing
Administration




Page 75                               GAO/HEHS-99-115 Medicare Contractor Oversight
Appendix I
Comments From the Health Care Financing
Administration




Page 76                               GAO/HEHS-99-115 Medicare Contractor Oversight
Appendix I
Comments From the Health Care Financing
Administration




Page 77                               GAO/HEHS-99-115 Medicare Contractor Oversight
Appendix II

GAO Contacts and Staff Acknowledgments


                  Leslie G. Aronovitz, (312) 220-7600
GAO Contacts      Sheila K. Avruch, (202) 512-7277


                  In addition to those named above, Barrett Bader, Lisanne Bradley, Hannah
Staff             Fein, Don Kittler, Bob Lappi, and Don Walthall made key contributions to
Acknowledgments   this report.




                  Page 78                           GAO/HEHS-99-115 Medicare Contractor Oversight
Page 79   GAO/HEHS-99-115 Medicare Contractor Oversight
Related GAO Products


              Medicare: Improprieties by Contractors Compromised Medicare Program
              Integrity (GAO/OSI-99-7, July 14, 1999).

              HCFAManagement: Agency Faces Multiple Challenges in Managing Its
              Transition to the 21st Century (GAO/T-HEHS-99-58, Feb. 11, 1999).

              Medicare Computer Systems: Year 2000 Challenges Put Benefits and
              Services in Jeopardy (GAO/AIMD-98-284, Sept. 28, 1998).

              Medicare: HCFA’s Use of Anti-Fraud-and-Abuse Funding and Authorities
              (GAO/HEHS-98-160, June 1, 1998).

              Medicare: Control Over Fraud and Abuse Remains Elusive
              (GAO/T-HEHS-97-165, June 26, 1997).

              High-Risk Series: Medicare (GAO/HR-97-10, Feb. 1997).

              Medicare: HCFA’s Contracting Authority for Processing Medicare Claims
              (GAO/HEHS-94-171, Aug. 2, 1994).

              Medicare: Inadequate Review of Claims Payments Limits Ability to Control
              Spending (GAO/HEHS-94-42, Apr. 28, 1994).

              Blue Cross and Blue Shield: Experiences of Weak Plans Underscore the
              Role of Effective State Oversight (GAO/HEHS-94-71, Apr. 13, 1994).

              Medicare Secondary Payer Program: Identifying Beneficiaries With Other
              Insurance Coverage Is Difficult (GAO/T-HRD-93-13, Apr. 2, 1993).

              Medicare: Contractor Oversight and Funding Need Improvement
              (GAO/T-HRD-92-32, May 21, 1992).

              Medicare: Existing Contract Authority Can Provide for Effective Program
              Administration (GAO/HRD-86-48, Apr. 22, 1986).

              Experiments Have Not Demonstrated Success of Competitive Fixed-Price
              Contracting in Medicare (GAO/HRD-82-17, Dec. 1, 1981).

              More Can Be Done to Achieve Greater Efficiency in Contracting for
              Medicare Claims Processing (GAO/HRD-79-76, June 29, 1979).




(101741)      Page 80                            GAO/HEHS-99-115 Medicare Contractor Oversight
Ordering Information

The first copy of each GAO report and testimony is free.
Additional copies are $2 each. Orders should be sent to the
following address, accompanied by a check or money order
made out to the Superintendent of Documents, when
necessary. VISA and MasterCard credit cards are accepted, also.
Orders for 100 or more copies to be mailed to a single address
are discounted 25 percent.

Orders by mail:

U.S. General Accounting Office
P.O. Box 37050
Washington, DC 20013

or visit:

Room 1100
700 4th St. NW (corner of 4th and G Sts. NW)
U.S. General Accounting Office
Washington, DC

Orders may also be placed by calling (202) 512-6000
or by using fax number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and
testimony. To receive facsimile copies of the daily list or any
list from the past 30 days, please call (202) 512-6000 using a
touchtone phone. A recorded menu will provide information on
how to obtain these lists.

For information on how to access GAO reports on the INTERNET,
send an e-mail message with "info" in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web Home Page at:

http://www.gao.gov




PRINTED ON    RECYCLED PAPER
United States                       Bulk Rate
General Accounting Office      Postage & Fees Paid
Washington, D.C. 20548-0001           GAO
                                 Permit No. G100
Official Business
Penalty for Private Use $300

Address Correction Requested