Medicare Part D
Some Plan Sponsors Have Not Completely Implemented Fraud and Abuse Programs, and CMS Oversight Has Been Limited Gao ID: GAO-08-760 July 21, 2008The Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA) established a voluntary outpatient prescription drug benefit, known as Medicare Part D. The Centers for Medicare & Medicaid Services (CMS) contracts with private companies to serve as Part D sponsors and administer the Part D prescription drug benefit plans. To protect beneficiaries and the fiscal integrity of the program, the MMA requires Part D sponsors to implement programs to control for fraud and abuse in Part D. Subsequent regulations and guidance from CMS contain requirements and recommended measures for these programs. This report examines (1) the extent to which certain Part D sponsors have implemented programs to control fraud, waste, and abuse and (2) the extent of CMS's oversight of Part D sponsors' programs to control fraud, waste, and abuse. GAO conducted on-site reviews of five of the largest Part D sponsors' fraud and abuse programs. GAO also interviewed officials from CMS and reviewed CMS documents.
The five Part D sponsors in GAO's review had not completely implemented all of CMS's required compliance plan elements and selected recommended measures for Part D fraud and abuse programs. All Part D sponsors had completely implemented the requirements and selected recommendations for three of the seven required compliance plan elements. However, Part D sponsors varied in their implementation of the remaining required elements and selected recommended measures. CMS oversight of Part D sponsors' fraud and abuse programs has been limited. To date, CMS's activities have been limited to the review and approval of sponsors' fraud and abuse program plans submitted as part of the initial Part D applications. For example, CMS officials reported that they worked with sponsors to help them develop fraud and abuse program plans that met the agency's compliance plan requirements and recommendations specific to fraud and abuse. However, CMS has not conducted oversight to assess Part D sponsors' implementation of fraud and abuse programs. Officials from CMS stated that the agency had not audited sponsors' implementation of fraud and abuse programs in 2007, and as of April 2008, no audits of these programs had been conducted.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-08-760, Medicare Part D: Some Plan Sponsors Have Not Completely Implemented Fraud and Abuse Programs, and CMS Oversight Has Been Limited
This is the accessible text file for GAO report number GAO-08-760
entitled 'Medicare Part D: Some Plan Sponsors Have Not Completely
Implemented Fraud and Abuse Programs, and CMS Oversight Has Been
Limited' which was released on August 25, 2008.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Report to the Ranking Member, Committee on Finance, U.S. Senate:
United States Government Accountability Office:
GAO:
July 2008:
Medicare Part D:
Some Plan Sponsors Have Not Completely Implemented Fraud and Abuse
Programs, and CMS Oversight Has Been Limited:
GAO-08-760:
GAO Highlights:
Highlights of GAO-08-760, a report to the Ranking Member, Committee on
Finance, U.S. Senate.
Why GAO Did This Study:
The Medicare Prescription Drug, Improvement, and Modernization Act of
2003 (MMA) established a voluntary outpatient prescription drug
benefit, known as Medicare Part D. The Centers for Medicare & Medicaid
Services (CMS) contracts with private companies to serve as Part D
sponsors and administer the Part D prescription drug benefit plans. To
protect beneficiaries and the fiscal integrity of the program, the MMA
requires Part D sponsors to implement programs to control for fraud and
abuse in Part D. Subsequent regulations and guidance from CMS contain
requirements and recommended measures for these programs.
This report examines (1) the extent to which certain Part D sponsors
have implemented programs to control fraud, waste, and abuse and (2)
the extent of CMS‘s oversight of Part D sponsors‘ programs to control
fraud, waste, and abuse. GAO conducted on-site reviews of five of the
largest Part D sponsors‘ fraud and abuse programs. GAO also interviewed
officials from CMS and reviewed CMS documents.
What GAO Found:
The five Part D sponsors in GAO‘s review had not completely implemented
all of CMS‘s required compliance plan elements and selected recommended
measures for Part D fraud and abuse programs. All Part D sponsors had
completely implemented the requirements and selected recommendations
for three of the seven required compliance plan elements. However, Part
D sponsors varied in their implementation of the remaining required
elements and selected recommended measures.
Table: Summary of Five Part D Sponsors‘ Implementation of the Required
Compliance Plan Elements and Selected Recommended Measures for Fraud
and Abuse Programs:
Required compliance plan elements and selected recommended measures:
1. Written policies, procedures, and standards of conduct; Required
elements; Extent of Part D sponsors' implementation: A: The sponsor met
all of the requirements or selected recommended measures in our review;
Extent of Part D sponsors' implementation: B: The sponsor met all of
the requirements or selected recommended measures in our review; Extent
of Part D sponsors' implementation: C: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation: D: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation: E: The sponsor met all of the
requirements or selected recommended measures in our review.
Required compliance plan elements and selected recommended measures:
1. Written policies, procedures, and standards of conduct; Recommended
measures; Extent of Part D sponsors' implementation: A: The sponsor met
all of the requirements or selected recommended measures in our review;
Extent of Part D sponsors' implementation: B: The sponsor met all of
the requirements or selected recommended measures in our review; Extent
of Part D sponsors' implementation: C: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation: D: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation: E: The sponsor met all of the
requirements or selected recommended measures in our review.
Required compliance plan elements and selected recommended measures:
2. Compliance officer and compliance committee; Required elements;
Extent of Part D sponsors' implementation: A: The sponsor met all of
the requirements or selected recommended measures in our review; Extent
of Part D sponsors' implementation: B: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation: C: The sponsor partially met the
requirements or selected recommended measures if they met some but not
all of the requirements or recommendations in our review; Extent of
Part D sponsors' implementation: D: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation: E: The sponsor met all of the
requirements or selected recommended measures in our review.
Required compliance plan elements and selected recommended measures:
2. Compliance officer and compliance committee; Recommended measures;
Extent of Part D sponsors' implementation: A: The sponsor partially met
the requirements or selected recommended measures if they met some but
not all of the requirements or recommendations in our review; Extent of
Part D sponsors' implementation: B: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation: C: The sponsor partially met the
requirements or selected recommended measures if they met some but not
all of the requirements or recommendations in our review; Extent of
Part D sponsors' implementation: D: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation: E: The sponsor met all of the
requirements or selected recommended measures in our review.
Required compliance plan elements and selected recommended measures:
3. Effective training and education; Required elements; Extent of Part
D sponsors' implementation: A: The sponsor met all of the requirements
or selected recommended measures in our review; Extent of Part D
sponsors' implementation: B: The sponsor partially met the requirements
or selected recommended measures if they met some but not all of the
requirements or recommendations in our review; Extent of Part D
sponsors' implementation: C: The sponsor partially met the requirements
or selected recommended measures if they met some but not all of the
requirements or recommendations in our review; Extent of Part D
sponsors' implementation: D: The sponsor met all of the requirements or
selected recommended measures in our review; Extent of Part D sponsors'
implementation: E: The sponsor did not meet any of the requirements or
selected recommended measures in our review.
Required compliance plan elements and selected recommended measures:
3. Effective training and education; Recommended measures; Extent of
Part D sponsors' implementation: A: The sponsor partially met the
requirements or selected recommended measures if they met some but not
all of the requirements or recommendations in our review; Extent of
Part D sponsors' implementation: B: The sponsor partially met the
requirements or selected recommended measures if they met some but not
all of the requirements or recommendations in our review; Extent of
Part D sponsors' implementation: C: The sponsor partially met the
requirements or selected recommended measures if they met some but not
all of the requirements or recommendations in our review; Extent of
Part D sponsors' implementation: D: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation: E: The sponsor did not meet any of the
requirements or selected recommended measures in our review.
Required compliance plan elements and selected recommended measures:
4. Effective lines of communication; Required elements; Extent of Part
D sponsors' implementation: A: The sponsor met all of the requirements
or selected recommended measures in our review; Extent of Part D
sponsors' implementation: B: The sponsor met all of the requirements or
selected recommended measures in our review; Extent of Part D sponsors'
implementation: C: The sponsor met all of the requirements or selected
recommended measures in our review; Extent of Part D sponsors'
implementation: D: The sponsor met all of the requirements or selected
recommended measures in our review; Extent of Part D sponsors'
implementation: E: The sponsor met all of the requirements or selected
recommended measures in our review.
Required compliance plan elements and selected recommended measures:
4. Effective lines of communication; Recommended measures; Extent of
Part D sponsors' implementation: A: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation: B: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation: C: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation: D: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation: E: The sponsor met all of the
requirements or selected recommended measures in our review.
Required compliance plan elements and selected recommended measures:
5. Enforcement of standards through disciplinary guidelines; Required
elements; Extent of Part D sponsors' implementation: A: The sponsor met
all of the requirements or selected recommended measures in our review;
Extent of Part D sponsors' implementation: B: The sponsor met all of
the requirements or selected recommended measures in our review; Extent
of Part D sponsors' implementation: C: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation: D: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation: E: The sponsor met all of the
requirements or selected recommended measures in our review.
Required compliance plan elements and selected recommended measures:
5. Enforcement of standards through disciplinary guidelines;
Recommended measures; Extent of Part D sponsors' implementation: A: The
sponsor met all of the requirements or selected recommended measures in
our review; Extent of Part D sponsors' implementation: B: The sponsor
met all of the requirements or selected recommended measures in our
review; Extent of Part D sponsors' implementation: C: The sponsor met
all of the requirements or selected recommended measures in our review;
Extent of Part D sponsors' implementation: D: The sponsor met all of
the requirements or selected recommended measures in our review; Extent
of Part D sponsors' implementation: E: The sponsor met all of the
requirements or selected recommended measures in our review.
Required compliance plan elements and selected recommended measures:
6. Internal monitoring and auditing; Required elements; Extent of Part
D sponsors' implementation: A: The sponsor met all of the requirements
or selected recommended measures in our review; Extent of Part D
sponsors' implementation: B: The sponsor met all of the requirements or
selected recommended measures in our review; Extent of Part D sponsors'
implementation: C: The sponsor partially met the requirements or
selected recommended measures if they met some but not all of the
requirements or recommendations in our review; Extent of Part D
sponsors' implementation: D: The sponsor met all of the requirements or
selected recommended measures in our review; Extent of Part D sponsors'
implementation: E: The sponsor did not meet any of the requirements or
selected recommended measures in our review.
Required compliance plan elements and selected recommended measures:
6. Internal monitoring and auditing; Recommended measures; Extent of
Part D sponsors' implementation: A: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation: B: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation: C: The sponsor partially met the
requirements or selected recommended measures if they met some but not
all of the requirements or recommendations in our review; Extent of
Part D sponsors' implementation: D: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation: E: The sponsor did not meet any of the
requirements or selected recommended measures in our review.
Required compliance plan elements and selected recommended measures:
7. Prompt responses to detected offenses; Required elements; Extent of
Part D sponsors' implementation: A: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation: B: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation: C: The sponsor partially met the
requirements or selected recommended measures if they met some but not
all of the requirements or recommendations in our review; Extent of
Part D sponsors' implementation: D: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation: E: The sponsor met all of the
requirements or selected recommended measures in our review.
Required compliance plan elements and selected recommended measures:
7. Prompt responses to detected offenses; Recommended measures; Extent
of Part D sponsors' implementation: A: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation: B: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation: C: The sponsor partially met the
requirements or selected recommended measures if they met some but not
all of the requirements or recommendations in our review; Extent of
Part D sponsors' implementation: D: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation: E: The sponsor met all of the
requirements or selected recommended measures in our review.
Source: GAO analysis of documentation collected from the five Part D
sponsors reviewed.
[End of table]
CMS oversight of Part D sponsors‘ fraud and abuse programs has been
limited. To date, CMS‘s activities have been limited to the review and
approval of sponsors‘ fraud and abuse program plans submitted as part
of the initial Part D applications. For example, CMS officials reported
that they worked with sponsors to help them develop fraud and abuse
program plans that met the agency‘s compliance plan requirements and
recommendations specific to fraud and abuse. However, CMS has not
conducted oversight to assess Part D sponsors‘ implementation of fraud
and abuse programs. Officials from CMS stated that the agency had not
audited sponsors‘ implementation of fraud and abuse programs in 2007,
and as of April 2008, no audits of these programs had been conducted.
What GAO Recommends:
To help safeguard the Medicare Part D program from fraud, waste, and
abuse, GAO recommends that CMS conduct timely audits of Part D
sponsors‘ fraud and abuse programs. CMS disagreed that its oversight
has been limited, but GAO found that CMS has not audited sponsors‘
fraud and abuse programs. CMS concurred with GAO‘s recommendation.
To view the full product, including the scope and methodology, click on
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-760]. For more
information, contact Kathleen King at (202) 512-7114 or kingk@gao.gov.
[End of section]
Contents:
Letter:
Results in Brief:
Background:
The Part D Sponsors We Reviewed Had Not Completely Implemented CMS's
Required Elements and Selected Recommended Measures for Part D Fraud
and Abuse Programs:
CMS's Oversight of Part D Sponsors' Fraud and Abuse Programs Has Been
Limited:
Conclusions:
Recommendation for Executive Action:
Agency Comments and Our Evaluation:
Appendix I: Methodology for Examining Certain Sponsors' Implementation
of Fraud and Abuse Programs for Part D:
Appendix II: Comments from the Centers for Medicare & Medicaid Services:
Appendix III: GAO Contact and Staff Acknowledgments:
Tables:
Table 1: Required Elements of Comprehensive Compliance Plans and
Selected Recommended Measures for Addressing Fraud, Waste, and Abuse in
Part D:
Table 2: Summary of Five Part D Sponsors' Implementation of the
Required Compliance Plan Elements and Selected Recommended Measures for
Fraud and Abuse Programs:
Abbreviations:
CBC:Center for Beneficiary Choices:
CMS: Centers for Medicare & Medicaid Services:
HHS: Department of Health and Human Services:
MA-PD: Medicare Advantage prescription drug plan:
MEDIC: Medicare Drug Integrity Contractor:
MMA: Medicare Prescription Drug, Improvement, and Modernization Act of
2003:
OFM: Office of Financial Management:
OIG: Office of the Inspector General:
PDP: prescription drug plan:
VA: Department of Veterans Affairs:
[End of section]
United States Government Accountability Office:
Washington, DC 20548:
July 21, 2008:
The Honorable Charles E. Grassley:
Ranking Member:
Committee on Finance:
United States Senate:
Dear Senator Grassley:
Medicare Part D provides voluntary, outpatient prescription drug
coverage for eligible individuals 65 years and older and eligible
individuals with disabilities. The Part D program, which began in
January 2006, is administered by the Department of Health and Human
Services' (HHS) Centers for Medicare & Medicaid Services (CMS). CMS
contracts with private companies--such as health insurance companies
and pharmacy benefit managers--to serve as Part D sponsors and
administer the Part D prescription drug benefit plans.[Footnote 1]
About 24 million individuals were enrolled in Medicare Part D[Footnote
2] as of January 2007 and estimated benefit expenditures were $39
billion in calendar year 2007.[Footnote 3] We and others have reported
that the size, nature, and complexity of the Part D program make it a
particular risk for fraud, waste, and abuse.[Footnote 4] The Medicare
program as a whole, including Part D, is vulnerable to fraud, waste,
and abuse. Due in part to this vulnerability, we have designated
Medicare as a high risk program since 1990.[Footnote 5]
To protect beneficiaries and the fiscal integrity of the Medicare
program, the Medicare Prescription Drug, Improvement, and Modernization
Act of 2003 (MMA), which established the Part D program, requires all
Part D sponsors to have programs to safeguard Part D from fraud, waste,
and abuse.[Footnote 6] Accordingly, on January 28, 2005, CMS issued
regulations[Footnote 7] requiring that sponsors have a comprehensive
compliance plan[Footnote 8] that includes a program to control fraud,
waste, and abuse.[Footnote 9] These regulations established required
elements within comprehensive compliance plans. In April 2006, CMS
issued guidance through its Part D Prescription Drug Benefit Manual;
chapter 9 of the Manual contained further interpretation and guidelines
that include recommended measures for how Part D sponsors should
address fraud, waste, and abuse for Part D in each of the required
compliance plan elements.[Footnote 10] In order to fulfill statutory
and regulatory requirements regarding programs to control fraud, waste,
and abuse, Part D sponsors must develop and implement a compliance plan
detailing their fraud and abuse program. The compliance plan, which
must be approved by CMS, articulates policies, processes, and
procedures for Part D sponsors to detect, correct, and prevent fraud,
waste and abuse. Implementation of a compliance plan includes
conducting the activities described in the plan and developing
comprehensive written procedures for activities referenced in the plan.
CMS's required compliance plan elements and the related recommended
measures for a fraud and abuse program specific to Part D include the
following:
1. A sponsor's compliance plan must include written policies,
procedures, and standards of conduct.
2. A sponsor's compliance plan must designate a compliance officer and
a compliance committee that are accountable to senior management.
3. A sponsor's compliance plan must include effective training and
education pertaining to fraud, waste, and abuse for the organization's
employees and contractors. A Part D sponsor may contract some of its
Part D responsibilities to a third party; however, the Part D sponsor
is ultimately responsible for ensuring compliance with required
elements, including those pertaining to education and training.
Contractors include first-tier, downstream, and related entities.
[Footnote 11]
4. A sponsor's compliance plan must include effective lines of
communication that should include a confidential or anonymous
mechanism, such as a hotline, to receive compliance questions and
reports of fraud, waste, or abuse.
5. A sponsor's compliance plan must have well-publicized disciplinary
guidelines through which sponsors must enforce standards.
6. A sponsor's compliance plan must include effective internal
monitoring and auditing procedures which should include the development
and implementation of procedures that are intended to protect Part D
from fraud, waste, and abuse, including monitoring and auditing of
contractors.
7. A sponsor's compliance plan must include procedures for ensuring
prompt responses to detected offenses and development of corrective
action initiatives, including responses to potential offenses.
While Medicare Part D is now in its third year of operation, little is
known about the extent to which Part D sponsors have implemented their
fraud and abuse programs or the extent of CMS's oversight of Part D
sponsors' programs. You asked us to examine the implementation and CMS
oversight of Part D sponsors' programs to control fraud, waste, and
abuse. Specifically, this report examines (1) the extent to which
certain Part D sponsors implemented programs to control fraud, waste,
and abuse and (2) the extent of CMS's oversight of Part D sponsors'
programs to control fraud, waste, and abuse.
To conduct our work, we reviewed relevant laws, regulations, and CMS
guidance to determine the required elements of a comprehensive
compliance plan and recommended measures for a comprehensive fraud and
abuse program. We also interviewed officials from CMS and HHS's Office
of the Inspector General (OIG), and officials from the Department of
Veterans Affair's (VA) Office of Compliance and Business Integrity.
[Footnote 12] We also interviewed industry representatives who were
subject-matter experts to learn more about fraud and abuse programs. In
addition, to examine the extent to which certain Part D sponsors have
implemented programs to control fraud, waste, and abuse, we conducted
on-site reviews at five Part D sponsors. We selected these five
sponsors for our review because they each offered a Part D prescription
drug plan that provided nationwide coverage,[Footnote 13] varied in
enrollment size, and the plans collectively provided coverage for a
sizeable proportion of Part D beneficiaries. (The five national
prescription drug plans selected for our review from these sponsors
represented about 35 percent of total Medicare Part D enrollment as of
April 2007.)[Footnote 14] Our sample is not generalizable to the entire
Part D sponsor population. Four of the five sponsors we reviewed were
private health insurance companies and one was a pharmacy benefit
manager. During our on-site reviews, we reviewed these sponsors
compliance plans and examined the extent to which the sponsors'
implemented CMS's seven required compliance plan elements and selected
recommended measures for detecting, correcting and preventing fraud,
waste, and abuse in Part D. We selected recommended measures for our
review based on a variety of factors, such as measures that we judged
were the most helpful to fulfilling the purpose of the requirements.
(See app. I for more-detailed information on our methodology for
assessing the extent to which certain Part D sponsors implemented their
fraud and abuse programs.)
To examine the extent to which CMS oversees Part D sponsors' programs
to control fraud, waste, and abuse, we interviewed CMS officials from
the Center for Beneficiary Choices (CBC),[Footnote 15] the lead office
for operational oversight, and the Office of Financial Management
(OFM), the lead office for program and fiscal integrity. We also
reviewed documentation from CMS, including CMS's Part D oversight
strategy, CBC's program audit strategies, contracts related to OFM's
Part D program integrity efforts, and technical assistance provided by
CMS that was specific to the fraud and abuse program requirement.
In conducting our work, we focused on the extent of implementation of
fraud and abuse programs rather than the effectiveness of the programs
in detecting, correcting, and preventing fraud, waste, and abuse. We
did not investigate actual occurrences of fraud, waste, and abuse;
however, we did ask for evidence of reported cases of potential fraud,
waste, or abuse that had been investigated. We conducted this
performance audit from October 2006 through June 2008 in accordance
with generally accepted government auditing standards. Those standards
require that we plan and perform the audit to obtain sufficient,
appropriate evidence to provide a reasonable basis for our findings and
conclusions based on our audit objectives. We believe that the evidence
obtained provides a reasonable basis for our findings and conclusions
based on our audit objectives.
Results in Brief:
The five Part D sponsors we reviewed had not completely implemented all
of CMS's seven required compliance plan elements and selected
recommended measures for Part D fraud and abuse programs. All five Part
D sponsors implemented the required elements and selected recommended
measures for written policies, procedures, and standards of conduct
(element 1); effective lines of communication (element 4); and
enforcement of standards through disciplinary guidelines (element 5).
However, these Part D sponsors varied in their implementation of the
remaining required elements and selected recommended measures. Four
Part D sponsors completely met the requirements for having a compliance
officer and compliance committee (element 2). Two sponsors completely
met the requirements for effective training and education by providing
general training to their employees (element 3). Three Part D sponsors
completely met the requirements and selected recommended measures for
internal monitoring and auditing (element 6). One sponsor conducted an
audit that identified more than $1.2 million for possible repayment to
Medicare. Four Part D sponsors completely met the requirements for
prompt responses and corrective action initiatives (element 7). Four
sponsors reported that they had identified cases that warranted
corrective action. For example, one Part D sponsor reported terminating
a pharmacy technician after the technician stole a beneficiary's
prescription from the pharmacy refill center and attempted to sell it
to the beneficiary at a discounted price.
CMS oversight of Part D sponsors' fraud and abuse programs has been
limited. To date, CMS oversight activities have been limited to the
review and approval of sponsors' fraud and abuse program plans
submitted as part of sponsors' initial Part D applications. For
example, CMS officials reported that they worked with sponsors to help
them develop a compliance plan detailing their fraud and abuse program
plans that met the agency's compliance plan requirements and
recommendations specific to Medicare Part D fraud and abuse programs.
Although CMS has conducted self-assessment surveys of sponsors' fraud
and abuse programs, neither of the two offices within CMS with
responsibility for overseeing sponsors' implementation of these
programs has conducted an audit of sponsors' compliance with fraud,
waste, and abuse program requirements. Officials from CMS's CBC stated
that it had not audited fraud and abuse programs in 2007 and that CBC
does not plan to audit these programs in 2008. Separately, CMS's OFM
has contracted with Medicare Drug Integrity Contractors (MEDICs) to
support its audit, oversight, and antifraud and abuse efforts in Part
D. However, as of April 2008, these audits of Part D sponsors' fraud
and abuse programs had not been conducted.
To help safeguard the Medicare Part D program from fraud, waste, and
abuse, we recommend that the Administrator of CMS ensure that CMS
conducts timely audits of Part D sponsors' fraud and abuse program
implementation.
In its comments on a draft of this report, CMS disagreed with our
finding that its oversight of Part D sponsors' fraud, waste, and abuse
programs has been limited. However, CMS's comments did not provide
additional evidence of audits of sponsors' fraud, waste, and abuse
programs, or of oversight activities beyond those described in the
draft report. CMS agreed with our finding regarding the extent to which
Part D sponsors have implemented programs to control fraud, waste, and
abuse. CMS also concurred with our recommendation and stated that the
agency is prioritizing its oversight activities to ensure sponsors'
compliance with CMS's policies.
Background:
In 2003, Congress passed the MMA, which created the Medicare Part D
program. The MMA requires that all Part D sponsors have a program to
control fraud, waste, and abuse. CMS is responsible for safeguarding
the Part D program from fraud, waste, and abuse.
The Medicare Part D Program:
In 2003, Congress passed the MMA, which created a prescription drug
benefit known as Medicare Part D. Voluntary enrollment in the Medicare
Part D program began November 15, 2005, and the benefit went into
effect January 1, 2006. Although the Medicare Part D program is
overseen by CMS, Part D drug benefit plans are administered by private
companies that apply to CMS to participate in the program. When
approved, these private companies contract with the federal government
to be Part D sponsors and market Part D drug plans directly to Medicare
beneficiaries.
Control of Fraud, Waste, and Abuse in Medicare Part D:
The MMA includes a requirement that all Part D sponsors have a program
to control fraud, waste, and abuse in Part D;[Footnote 16] CMS
regulations establish the requirements for comprehensive compliance
plans for Part D plan sponsors.[Footnote 17] To guide Part D sponsors
in designing a fraud and abuse program that addressed Part D risks, in
April 2006, CMS issued recommendations for Part D sponsors' fraud and
abuse programs based on input from various sources, including law
enforcement and industry representatives.[Footnote 18] The guidance,
issued as chapter 9 in the Prescription Drug Benefit Manual, contains
further interpretation and guidelines on the steps sponsors should take
to detect, correct, and prevent fraud, waste, and abuse in Part D.
CMS required Part D sponsors to have fraud and abuse programs
operational and in effect at the time their Part D contracts were
awarded and expected sponsors to adopt the recommendations in chapter 9
by January 1, 2007. Table 1 describes the required elements of a
comprehensive compliance plan and selected recommended measures for
addressing fraud, waste, and abuse specific to Part D in each of the
required compliance plan elements.
Table 1: Required Elements of Comprehensive Compliance Plans and
Selected Recommended Measures for Addressing Fraud, Waste, and Abuse in
Part D:
Comprehensive compliance plan requirements:
1. Written Policies, Procedures, and Standards of Conduct;
* Must have written policies, procedures, and standards of conduct
articulating the organization's commitment to comply with all
applicable federal and state standards;
* Contracts must specify that the contractor[B] must comply with all
applicable federal laws, regulations, and CMS instructions[C];
Selected recommended measures[A]:
* Should have written policies and procedures for detecting,
correcting, and preventing Medicare Part D fraud, waste, and abuse;
* Standards of conduct and applicable policies and procedures should be
made available to employees at time of hire, when the standards are
updated, and annually thereafter;
* Should have employees certify that they received, read, and will
comply with standards of conduct.
Comprehensive compliance plan requirements:
2. Compliance Officer and Compliance Committee;
* Must have a compliance officer who is accountable to senior
management;
* Must have a compliance committee that is accountable to senior
management;
Selected recommended measures[A]:
* Compliance officer should report at least on a quarterly basis to the
sponsor's senior management;
* Compliance officer should be responsible for developing, operating,
and monitoring the fraud and abuse program;
* Compliance committee should meet at least on a quarterly basis or
more frequently.
Comprehensive compliance plan requirements:
3. Effective Training and Education;
* Must provide effective training and education between the compliance
officer and organization employees, contractors,[B] and directors;
Selected recommended measures[A]:
* Should address pertinent laws related to fraud and abuse and include
a discussion of Part D vulnerabilities and common fraudulent schemes;
* Should provide its employees and contractors[B] who have specific
responsibilities for Part D business areas with any specialized
training on the compliance risks posed by their job function;
* Should verify contractor[B] training at least annually.
Comprehensive compliance plan requirements:
47. Effective Lines of Communication;
* Must have effective lines of communication between the compliance
officer and the organization's employees, contractors,[B] directors,
and members of the compliance committee;
Selected recommended measures[A]:
* Should have a confidential or anonymous mechanism, such as a hotline,
to receive compliance questions or reports of fraud, waste, or abuse
from internal and external parties;
* Should publicize the mechanisms for reporting noncompliance or fraud,
waste, or abuse, or both, to its employees, beneficiaries, and
contractors[B];
* Should establish procedures for responding to reports of suspected
compliance issues received through the reporting mechanism(s) in a
timely manner;
* Should have a complaint tracking system with an explicit process for
handing reports of fraud, waste, or abuse;
* Should initiate investigations of any concerns about Part D received
through its internal and external mechanisms within 2 weeks.
Comprehensive compliance plan requirements:
5. Enforcement of Standards through Disciplinary Guidelines;
* Must enforce standards through well-publicized disciplinary
guidelines;
Selected recommended measures[A]:
* Should publicize its disciplinary guidelines to encourage the
reporting of unethical or noncompliant behavior.
Comprehensive compliance plan requirements:
6. Procedures for Effective Internal Monitoring and Auditing;
* Must have procedures for effective internal monitoring and auditing;
* Must have procedures to monitor and audit contractors[B] and related
entities with respect to the drug benefit[C];
Selected recommended measures[A]:
* Should implement internal monitoring and auditing to protect the
Medicare Trust Fund from Part D fraud and abuse and to mitigate the
potential for fraud, waste, and abuse within their organization;
* Should implement monitoring and auditing of contractors[B] with
respect to the drug benefit to identify fraud, waste, and abuse;
* Should conduct data analysis to detect fraud, waste, and abuse at the
sponsor and contractor[B] levels;
* Should conduct a risk assessment to identify the sponsor's risks
related to Part D fraud, waste, and abuse and prioritize the monitoring
and auditing strategy accordingly.
Comprehensive compliance plan requirements:
7. Prompt Responses to Detected Offenses;
* Must have procedures for ensuring prompt responses to detected
offenses and must develop corrective action initiatives;
* Must--upon discovery of misconduct related to Part D-- conduct a
timely, reasonable inquiry into that conduct and must initiate
appropriate corrective actions in response to potential violations,
such as repayment of any overpayment received or disciplinary action
against responsible individuals;
Selected recommended measures[A]:
* Inquiry should be immediate, but no later than two weeks from the
date the potential misconduct is identified;
* Should have procedures to voluntarily self-report potential fraud or
misconduct related to the Part D program to CMS or an appropriate
government authority[D];
* Should self-report to CMS or the Medicare Drug Integrity Contractors
(MEDICs) any findings of potential fraud discovered at the sponsor and
contractor levels.
Source: GAO summary of regulations and CMS data[E].
[A] CMS's chapter 9 guidance provided several recommendations for how
sponsors should implement a program to control fraud, waste, and abuse
as part of an effective Part D compliance plan. Our data collection
instrument did not include all of CMS's recommended measures. We
selected recommended measures for inclusion in our data collection
instrument based on a variety of factors, such as measures that we
judged were the most helpful to fulfilling the purpose of the
requirements.
[B] For the purposes of this report, the term contractor includes first-
tier, downstream, and related entities.
[C] These are requirements in regulations other than the compliance
plan requirements. See 42 C.F.R. § 423.505 concerning contracts or
written arrangements between Part D plan sponsors and contractors.
[D] Though voluntary in nature, procedures for self-reporting potential
fraud or misconduct related to Part D also appear in regulatory
compliance plan requirements.
[E] Data are from select provisions within 42 C.F.R. §§ 423.504 and
423.505, and CMS, Prescription Drug Benefit Manual, chapter 9: Part D
Program to Control Fraud, Waste, and Abuse (April 2006).
[End of table]
In the chapter 9 guidance, CMS recommends that Part D sponsors design
their fraud, waste, and abuse programs to safeguard against identified
risk areas and identifies examples of fraud, waste, and abuse risks
associated with Part D stakeholders, including internal and external
parties. Internal parties include Part D sponsors and their employees;
external parties include physicians, pharmacies, and Medicare
beneficiaries. Chapter 9 also states that sponsors' preexisting fraud
and abuse programs should be focused on controlling fraud by external
parties submitting claims to the sponsor, and stated that Part D
sponsors are to identify and address internal fraud, waste, and abuse
by the sponsor and its employees as well. In chapter 9, CMS also
identified examples of potential fraud, waste, and abuse by Part D
sponsors, such as marketing schemes to improperly enroll Medicare
beneficiaries in Part D plans or deliberately using inaccurate data to
receive improper payments from CMS. CMS identified examples of
potential fraud, waste, and abuse by Medicare beneficiaries, such as
beneficiaries misrepresenting their identity to illegally obtain the
drug benefit or engaging in doctor shopping, where a patient seeks
prescriptions from multiple physicians with the intent to abuse or sell
drugs. CMS identified potential examples of fraud, waste, and abuse by
pharmacies, citing improper billing practices, such as billing for
nonexistent prescriptions.
Regulations and the chapter 9 guidance recognize that contractors can
be significant stakeholders in sponsors' Part D operations.[Footnote
19] CMS permits Part D sponsors to use contractors to perform various
Part D functions.[Footnote 20] However, CMS regulations and chapter 9
state that the Part D sponsor is ultimately responsible for fulfilling
the terms and conditions set out in the sponsor's contract with CMS,
even if the sponsor delegates a Part D function to a contractor. In
addition, Part D rules establish contractual obligations for Part D
sponsors that delegate tasks to contractors.
CMS's Oversight Responsibilities:
CMS is responsible for safeguarding the Part D program from fraud,
waste, and abuse, including ensuring sponsors' compliance with
applicable requirements. While many groups within CMS are responsible
for overseeing different aspects of the Part D program, two divisions
provide oversight of Part D sponsors' fraud and abuse programs. OFM is
the lead office for program integrity and financial oversight,
including responsibility related to oversight of fraud, waste, and
abuse in the Part D program. OFM developed the chapter 9 guidance for
sponsors' fraud and abuse programs and is responsible for reviewing and
approving fraud and abuse program plans when organizations first apply
to become Part D sponsors. CBC is the lead office for operational
oversight of Part D, including sponsor management, program audits, and
enforcement actions.
OFM and CBC are responsible for conducting audits of Part D sponsors'
compliance with fraud and abuse program requirements. CBC is
responsible for conducting broad Part D program audits that include,
but are not limited to, Part D sponsors' implementation of their
compliance plans, including fraud and abuse programs. In contrast, OFM
is responsible for financial audits and audits of Part D sponsors'
fraud and abuse programs.[Footnote 21] CMS contracted with the MEDICs
to support OFM's audit, oversight, and antifraud and abuse efforts in
Part D.[Footnote 22]
In October 2005, CMS issued its Oversight Strategy for overseeing Part
D sponsors, particularly with regard to mitigating fraud, waste, and
abuse. In the strategy, CMS noted that in conducting oversight of Part
D sponsors CBC would rely on self-reported, unaudited data provided to
CMS by Part D sponsors. However, in the strategy, CMS also acknowledged
that program audits conducted by CBC would be necessary to ensure
compliance and to document that CMS has fulfilled its program oversight
responsibilities. According to the Oversight Strategy, CBC would follow
a 3-year audit cycle that would include both desk audits--reviews of
documents requested from Part D sponsors--and on-site audits covering
all aspects of the Prescription Drug Benefit Manual over the 3
years.[Footnote 23] In December 2006, HHS's OIG conducted a review of
Part D sponsors' compliance plans that found that many Part D sponsors'
compliance plans did not address all of CMS's compliance plan
requirements, including fraud and abuse program plans. In response, CMS
reported that "CMS will begin these compliance plan audits in 2007, and
sponsors will be accountable for meeting all requirements."[Footnote 24]
OFM's oversight of Part D sponsors relies on the MEDICs to audit
Medicare Part D fraud and abuse programs. CMS has entered into
contracts under which task orders were issued to three MEDICs to
conduct various activities related to Part D. The first MEDIC began its
work in November 2005, and the other two MEDICs began work in December
2006. At that time, OFM estimated that the MEDICs would conduct audits
of Part D sponsors' fraud and abuse programs in the first years of Part
D. In 2005 and 2006, CMS estimated that at least 10 audits of fraud and
abuse programs would be conducted by each of the MEDICs each year under
task orders to be issued under the contract. Specifically, CMS
estimated that the first MEDIC would complete 10 of these audits during
the 2005--2006 contract year and that the three MEDICs would complete
35 of these audits during the 2006--2007 contract year.
The Part D Sponsors We Reviewed Had Not Completely Implemented CMS's
Required Elements and Selected Recommended Measures for Part D Fraud
and Abuse Programs:
The five Part D sponsors we reviewed had not completely implemented all
of CMS's seven required compliance plan elements and selected
recommended measures for Part D fraud and abuse programs.[Footnote 25]
All Part D sponsors had the required elements and recommended measures
for written policies, procedures, and standards of conduct (element 1);
effective lines of communication (element 4); and enforcement of
standards through disciplinary guidelines (element 5). However, Part D
sponsors varied in their implementation of the remaining required
elements and selected recommend measures. Table 2 illustrates the
variation in the extent to which the five Part D sponsors implemented
the required elements and selected recommended measures for their fraud
and abuse programs.
Table 2: Summary of Five Part D Sponsors' Implementation of the
Required Compliance Plan Elements and Selected Recommended Measures for
Fraud and Abuse Programs:
Required compliance plan elements and selected recommended measures[A]:
1. Written policies, procedures, and standards of conduct; Required
elements; Extent of Part D sponsors' implementation[B]: A[C]: The
sponsor met all of the requirements or selected recommended measures in
our review; Extent of Part D sponsors' implementation[B]: B[C]: The
sponsor met all of the requirements or selected recommended measures in
our review; Extent of Part D sponsors' implementation[B]: C[C]: The
sponsor met all of the requirements or selected recommended measures in
our review; Extent of Part D sponsors' implementation[B]: D: The
sponsor met all of the requirements or selected recommended measures in
our review; Extent of Part D sponsors' implementation[B]: E: The
sponsor met all of the requirements or selected recommended measures in
our review.
Required compliance plan elements and selected recommended measures[A]:
1. Written policies, procedures, and standards of conduct; Recommended
measures; Extent of Part D sponsors' implementation[B]: A[C]: The
sponsor met all of the requirements or selected recommended measures in
our review; Extent of Part D sponsors' implementation[B]: B[C]: The
sponsor met all of the requirements or selected recommended measures in
our review; Extent of Part D sponsors' implementation[B]: C[C]: The
sponsor met all of the requirements or selected recommended measures in
our review; Extent of Part D sponsors' implementation[B]: D: The
sponsor met all of the requirements or selected recommended measures in
our review; Extent of Part D sponsors' implementation[B]: E: The
sponsor met all of the requirements or selected recommended measures in
our review.
Required compliance plan elements and selected recommended measures[A]:
2. Compliance officer and compliance committee; Required elements;
Extent of Part D sponsors' implementation[B]: A[C]: The sponsor met all
of the requirements or selected recommended measures in our review;
Extent of Part D sponsors' implementation[B]: B[C]: The sponsor met all
of the requirements or selected recommended measures in our review;
Extent of Part D sponsors' implementation[B]: C[C]: The sponsor
partially met the requirements or selected recommended measures if they
met some but not all of the requirements or recommendations in our
review; Extent of Part D sponsors' implementation[B]: D: The sponsor
met all of the requirements or selected recommended measures in our
review; Extent of Part D sponsors' implementation[B]: E: The sponsor
met all of the requirements or selected recommended measures in our
review.
Required compliance plan elements and selected recommended measures[A]:
2. Compliance officer and compliance committee; Recommended measures;
Extent of Part D sponsors' implementation[B]: A[C]: The sponsor
partially met the requirements or selected recommended measures if they
met some but not all of the requirements or recommendations in our
review; Extent of Part D sponsors' implementation[B]: B[C]: The sponsor
met all of the requirements or selected recommended measures in our
review; Extent of Part D sponsors' implementation[B]: C[C]: The sponsor
partially met the requirements or selected recommended measures if they
met some but not all of the requirements or recommendations in our
review; Extent of Part D sponsors' implementation[B]: D: The sponsor
met all of the requirements or selected recommended measures in our
review; Extent of Part D sponsors' implementation[B]: E: The sponsor
met all of the requirements or selected recommended measures in our
review.
Required compliance plan elements and selected recommended measures[A]:
3. Effective training and education; Required elements; Extent of Part
D sponsors' implementation[B]: A[C]: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation[B]: B[C]: The sponsor partially met the
requirements or selected recommended measures if they met some but not
all of the requirements or recommendations in our review; Extent of
Part D sponsors' implementation[B]: C[C]: The sponsor partially met the
requirements or selected recommended measures if they met some but not
all of the requirements or recommendations in our review; Extent of
Part D sponsors' implementation[B]: D: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation[B]: E: The sponsor did not meet any of
the requirements or selected recommended measures in our review.
Required compliance plan elements and selected recommended measures[A]:
3. Effective training and education; Recommended measures; Extent of
Part D sponsors' implementation[B]: A[C]: The sponsor partially met the
requirements or selected recommended measures if they met some but not
all of the requirements or recommendations in our review; Extent of
Part D sponsors' implementation[B]: B[C]: The sponsor partially met the
requirements or selected recommended measures if they met some but not
all of the requirements or recommendations in our review; Extent of
Part D sponsors' implementation[B]: C[C]: The sponsor partially met the
requirements or selected recommended measures if they met some but not
all of the requirements or recommendations in our review; Extent of
Part D sponsors' implementation[B]: D: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation[B]: E: The sponsor did not meet any of
the requirements or selected recommended measures in our review.
Required compliance plan elements and selected recommended measures[A]:
4. Effective lines of communication; Required elements; Extent of Part
D sponsors' implementation[B]: A[C]: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation[B]: B[C]: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation[B]: C[C]: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation[B]: D: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation[B]: E: The sponsor met all of the
requirements or selected recommended measures in our review.
Required compliance plan elements and selected recommended measures[A]:
4. Effective lines of communication; Recommended measures; Extent of
Part D sponsors' implementation[B]: A[C]: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation[B]: B[C]: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation[B]: C[C]: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation[B]: D: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation[B]: E: The sponsor met all of the
requirements or selected recommended measures in our review.
Required compliance plan elements and selected recommended measures[A]:
5. Enforcement of standards through disciplinary guidelines; Required
elements; Extent of Part D sponsors' implementation[B]: A[C]: The
sponsor met all of the requirements or selected recommended measures in
our review; Extent of Part D sponsors' implementation[B]: B[C]: The
sponsor met all of the requirements or selected recommended measures in
our review; Extent of Part D sponsors' implementation[B]: C[C]: The
sponsor met all of the requirements or selected recommended measures in
our review; Extent of Part D sponsors' implementation[B]: D: The
sponsor met all of the requirements or selected recommended measures in
our review; Extent of Part D sponsors' implementation[B]: E: The
sponsor met all of the requirements or selected recommended measures in
our review.
Required compliance plan elements and selected recommended measures[A]:
5. Enforcement of standards through disciplinary guidelines;
Recommended measures; Extent of Part D sponsors' implementation[B]:
A[C]: The sponsor met all of the requirements or selected recommended
measures in our review; Extent of Part D sponsors' implementation[B]:
B[C]: The sponsor met all of the requirements or selected recommended
measures in our review; Extent of Part D sponsors' implementation[B]:
C[C]: The sponsor met all of the requirements or selected recommended
measures in our review; Extent of Part D sponsors' implementation[B]:
D: The sponsor met all of the requirements or selected recommended
measures in our review; Extent of Part D sponsors' implementation[B]:
E: The sponsor met all of the requirements or selected recommended
measures in our review.
Required compliance plan elements and selected recommended measures[A]:
6. Internal monitoring and auditing; Required elements; Extent of Part
D sponsors' implementation[B]: A[C]: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation[B]: B[C]: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation[B]: C[C]: The sponsor partially met the
requirements or selected recommended measures if they met some but not
all of the requirements or recommendations in our review; Extent of
Part D sponsors' implementation[B]: D: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation[B]: E: The sponsor did not meet any of
the requirements or selected recommended measures in our review.
Required compliance plan elements and selected recommended measures[A]:
6. Internal monitoring and auditing; Recommended measures; Extent of
Part D sponsors' implementation[B]: A[C]: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation[B]: B[C]: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation[B]: C[C]: The sponsor partially met the
requirements or selected recommended measures if they met some but not
all of the requirements or recommendations in our review; Extent of
Part D sponsors' implementation[B]: D: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation[B]: E: The sponsor did not meet any of
the requirements or selected recommended measures in our review.
Required compliance plan elements and selected recommended measures[A]:
7. Prompt responses to detected offenses; Required elements; Extent of
Part D sponsors' implementation[B]: A[C]: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation[B]: B[C]: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation[B]: C[C]: The sponsor partially met the
requirements or selected recommended measures if they met some but not
all of the requirements or recommendations in our review; Extent of
Part D sponsors' implementation[B]: D: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation[B]: E: The sponsor met all of the
requirements or selected recommended measures in our review.
Required compliance plan elements and selected recommended measures[A]:
7. Prompt responses to detected offenses; Recommended measures; Extent
of Part D sponsors' implementation[B]: A[C]: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation[B]: B[C]: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation[B]: C[C]: The sponsor partially met the
requirements or selected recommended measures if they met some but not
all of the requirements or recommendations in our review; Extent of
Part D sponsors' implementation[B]: D: The sponsor met all of the
requirements or selected recommended measures in our review; Extent of
Part D sponsors' implementation[B]: E: The sponsor met all of the
requirements or selected recommended measures in our review.
Source: GAO analysis of documentation collected from the five Part D
sponsors reviewed.
[A] CMS's chapter 9 guidance provided several recommendations for how
sponsors should implement a program to control fraud, waste, and abuse
as part of an effective Part D compliance plan. Our data collection
instrument did not include all of CMS's recommended measures. We
selected recommended measures for inclusion in our data collection
instrument based on a variety of factors, such as measures that were
the most helpful to fulfilling the purpose of the requirements.
[B] The five sponsors we reviewed are labeled A through E.
[C] For our analyses of requirements and recommendations related to
Part D sponsors' contractors, we limited our review to first-tier
entities. This Part D sponsor had a first-tier entity. First-tier
entities are parties that contract with a Part D sponsor to provide
administrative services or health care services for a Medicare eligible
individual under Part D. One example of a first-tier entity is a
pharmacy benefit manager under contract to a Part D sponsor.
[End of table]
The specific required compliance plan elements and recommended fraud
and abuse measures implemented by the five Part D sponsors we reviewed
were as follows:
Written Policies, Procedures, and Standards of Conduct:
Requirements:
All five Part D sponsors we reviewed completely met the requirements
for written policies, procedures, and standards of conduct. All five
had the required written policies, procedures, or the standards of
conduct that articulated a commitment to comply with all applicable
federal and state standards. All three Part D sponsors that relied on a
first-tier entity in carrying out its Part D responsibilities had
included provisions in their contract with the entity requiring
compliance with all applicable federal laws, regulations, and CMS
instructions.[Footnote 26]
Recommended Measures:
All five Part D sponsors completely met the selected recommended
measures by having written policies, procedures, or standards of
conduct that applied to detecting, correcting, and preventing fraud,
waste, and abuse. All five had standards of conduct that were available
to employees on the Part D sponsors' internal Web sites. In addition,
Part D sponsors reported that information regarding written policies,
procedures, or standards of conduct was disseminated through training
or employees had to sign attestations that they had reviewed and
understood the policies, or both.
Compliance Officer and Compliance Committee:
Requirements:
Four of the five Part D sponsors completely met the requirements for
having both a compliance officer and compliance committee accountable
to senior management. The remaining Part D sponsor only partially met
the requirement because it did not have a compliance committee. Of the
five Part D sponsors' compliance officers, three of the compliance
officers had been in that role since the Part D benefit was implemented
in January 2006. The other two compliance officers started in their
roles during 2007.
All of the Part D compliance committees that existed were overseen by
the compliance officer, were accountable to senior management, and were
responsible for advising the compliance officer on various issues,
ranging from implementing compliance plans to developing their Part D
operations. For example, one Part D compliance committee was involved
in monitoring the implementation of the activities outlined in the
compliance plan, providing regular reports to senior management, and
providing input on training. Another Part D sponsor used its corporate
compliance committee instead of a separate Part D compliance committee
to address Part D issues; a formal Part D compliance committee had not
been implemented. The corporate compliance committee meetings included
senior executives and the Part D compliance officer.
Recommended Measures:
Three Part D sponsors completely met the selected recommended measures
for a compliance officer and committee. Two Part D sponsors partially
met the recommended measures. Of these, one sponsor's compliance
officer did not report to senior management on at least a quarterly
basis.[Footnote 27] The compliance officer from this Part D sponsor
stated that he or she did not report regularly to senior management
because the Part D sponsor had yet to have any cases that were
determined to be fraud, waste, or abuse. The remaining Part D sponsor's
compliance committee did not meet on at least a quarterly basis.
All five Part D compliance officers were responsible for overseeing and
monitoring the implementation and maintenance of fraud and abuse
programs, as recommended. The range of activities and responsibilities
for the Part D compliance officers varied. Two compliance officers were
directly involved in fraud and abuse program activities, while the
other three delegated those responsibilities to other staff, or some
components of their role were a function of another department or were
delegated to a contractor. For example, one compliance officer was
involved in decisions regarding fraud, waste, and abuse investigations
and corrective actions, while another compliance officer delegated this
responsibility.
Effective Training and Education:
Requirements:
We found that four of the five Part D sponsors provided their Part D
employees with general fraud, waste, and abuse training that covered
Part D. Two of these sponsors completely met the requirements for
education and training by also providing or ensuring that their Part D
employees and first-tier entity, if applicable, received general fraud,
waste, and abuse training.[Footnote 28] Two other sponsors partially
met the requirements--they provided general fraud, waste, and abuse
training to Part D employees, but they did not provide this training to
their first-tier entity or ensure that the entity's employees received
it. One Part D sponsor did not meet the requirements because it did not
provide a general training that covered Part D fraud, waste, and abuse
to its employees. However, this sponsor reported that a general fraud,
waste, and abuse training module on Part D was in development.
The training curriculums of the Part D sponsors covered common fraud
risks and vulnerabilities; federal laws related to fraud, waste, and
abuse; and the sponsors' protocols for detection and referral to
government authorities. However, the extent of information about
detecting, correcting, and preventing fraud in Part D varied among the
curriculums.[Footnote 29] For example, one sponsor's corporate-wide
Ethics and Compliance training course contained a section on health-
care fraud that had one reference to Part D. Similarly, another sponsor
added a section to its preexisting healthcare fraud and abuse training
curriculum for identifying Part D violations, such as enrolling a
Medicare beneficiary in a plan different than the one the beneficiary
selected. In contrast, one sponsor developed a fraud and abuse training
that was entirely devoted to Part D and that discussed in detail CMS's
requirements and recommendations for an effective Part D fraud and
abuse program and how the sponsor was meeting those standards. In
addition, this sponsor's curriculum was the only one that identified
the potential for misconduct at the sponsor level. Specifically, this
sponsor's curriculum provided hypothetical scenarios of risks that
employees may encounter on the job--such as a supervisor asking an
employee to falsify Part D data submitted to the government to inflate
enrollment.
Recommended Measures:
Only one Part D sponsor completely met the selected recommended
measures for education and training by providing general training that
covered Part D fraud, waste, and abuse to its employees on at least an
annual basis and providing specialized training to its employees whose
responsibilities or departments, such as marketing, put them at greater
risk of encountering fraud, waste, or abuse.[Footnote 30] This sponsor
provided employees in its pharmacy benefit management department with a
specialized training on the government's guidelines for preventing
fraud, waste, and abuse in Part D. Three sponsors partially met the
recommended measures; two did not provide specialized training to their
Part D employees and three did not ensure that this training was
provided to first-tier entities. One Part D sponsor did not meet any of
the selected recommended measures for effective training and education.
Additionally, we found that one sponsor's interpretation of CMS's
recommendation for specialized training differed from CMS's
expectations. An official from this sponsor considered that operational
training in a particular job function met this recommendation, even
though the training did not include a reference to fraud, waste, and
abuse.
Effective Lines of Communication:
Requirements:
All five Part D sponsors completely met the requirements for effective
lines of communication by having lines of communication between the
compliance officer and the organization's management, employees, and
contractors. While the lines of communications may not have been
directed to the compliance officers, all of these officers had access
to information received on these lines.
Recommended Measures:
In addition, all five Part D sponsors met the selected recommended
measures. Specifically, all five Part D sponsors used reporting
mechanisms to receive reports of potential fraud, waste, and abuse and
had investigated these reports within two weeks, as recommended. All
five had confidential or anonymous mechanisms, such as hotlines, for
receiving compliance questions, reports of potential risks, and reports
of potential fraud, waste, or abuse from internal and external parties.
All five sponsors we reviewed had separate reporting mechanisms for
internal parties, including employees, and for external parties,
including beneficiaries, to report potential offenses.
All five Part D sponsors made information about the methods for
reporting potential offenses available to internal and external
parties, as recommended. For internal parties, all five Part D sponsors
provided information to employees regarding the methods for reporting
potential offenses on their companies' internal Web sites. In addition,
four Part D sponsors provided information regarding the hotline number
and other methods for reporting to employees during their Medicare Part
D fraud and abuse training. For external parties, two of the compliance
officers for the Part D sponsors in our review reported that
beneficiaries were typically informed of the methods for reporting
potential fraud and abuse on their explanation of benefits. One Part D
sponsor provided promotional material to one of their first-tier
entities with the hotline number for reporting potential fraud, waste,
or abuse.
All five Part D sponsors had investigated concerns and reports of
potential offenses received through the internal or external reporting
mechanisms, as recommended. One Part D sponsor delegated investigation
activities to a first-tier entity. Only two of the five Part D sponsors
had received Part D fraud reports through the internal reporting
mechanism. One Part D sponsor stated that Part D concerns may not have
been reported through the internal mechanism because employees were
bypassing the internal hotline and using other mechanisms for
reporting, such as directly reporting a potential case of fraud, waste,
or abuse to the special investigations unit. An official from another
Part D sponsor reported that it had yet to receive any calls related to
Medicare Part D on its internal reporting mechanism.
All five Part D sponsors in our review had addressed or responded to
reports of potential offenses received through their external reporting
mechanism, including reports of potential offenses by beneficiaries and
pharmacy providers. For example, one Part D sponsor received a report
from a pharmacy that a family member of one of the sponsor's
beneficiaries was filling prescriptions for a drug for his own use and
paying for them with the beneficiary's Medicare Part D benefit. Other
Part D sponsors received reports that beneficiaries were doctor
shopping or selling their prescription drugs.
Enforcement of Standards through Disciplinary Guidelines:
Requirements:
The requirements for the enforcement through disciplinary guidelines
were completely met by all five Part D sponsors. All five of the Part D
sponsors in our review enforced standards through well-publicized
disciplinary guidelines for individuals, as required. Most sponsors'
disciplinary guidelines were corporate policies that applied to all
company products, including the Part D prescription drug plan.
Recommended Measures:
All five Part D sponsors promoted the disciplinary guidelines to
encourage reporting of potential offenses, as recommended. Officials
for all five Part D sponsors reported that disciplinary guidelines were
incorporated into training courses or were available on the sponsor's
internal Web sites, or both. To publicize enforcement of disciplinary
standards, one sponsor used its Ethics and Compliance Newsletter to
communicate that disciplinary actions had been taken.
Internal Monitoring and Auditing:
Requirements:
Three Part D sponsors completely met the requirements by having
procedures for internal monitoring and auditing at the sponsor and
first-tier entity level, when applicable. One Part D sponsor partially
met the requirements because, although it had procedures for internal
monitoring and auditing, this sponsor did not have the monitoring and
auditing procedures for its first-tier entity. One Part D sponsor did
not meet the requirements because it did not provide us with internal
monitoring and auditing procedures that met the criteria.
Sponsors' monitoring procedures were often broadly-focused departmental
manuals that generally did not specifically refer to Part D. Auditing
procedures included work plans with time frames for completion or
processes for responding to auditing results.
Recommended Measures:
Three Part D sponsors completely met the recommended measures for
internal auditing and monitoring because they implemented procedures
for monitoring and auditing at the sponsor and first-tier entity, when
applicable, and conducted data analysis and risk assessments. One Part
D sponsor partially met the recommended measures because it had not
monitored or audited its first-tier entity. One Part D sponsor did not
meet any of the recommended measures.
The data-monitoring activities of the sponsors in our review typically
focused on protecting corporate assets against fraudulent claims by
third parties, rather than detecting fraud, waste, or abuse at the
sponsor level as well, as recommended to protect the Medicare program
and its beneficiaries. Sponsors' data monitoring for Part D typically
focused on the conduct of external parties, such as monitoring
pharmacies' dispensing patterns, beneficiaries' drug utilization, and
physicians' prescribing patterns, and did not monitor internal
practices by the sponsor or its employees that also posed risks for
Medicare, such as double billing of Medicare.
Similarly, sponsors' monitoring activities for Part D often reflected
activities in place before Part D for their other lines of business,
such as regular analyses of prescriptions claims data from pharmacies
in their network, and did not generate a separate analysis of Part D
claims. In our review, we found that only one sponsor targeted its
monitoring efforts specifically to detect fraud, waste, and abuse in a
Part D risk area. This sponsor mined Part D claims for irregular
activities, such as signs of doctor shopping among beneficiaries
prescribed narcotics. The sponsor's compliance officer also noted that
the special investigations unit sometimes engaged in additional Part D
data monitoring if prompted by a suspected case of fraud, waste, or
abuse.
We found that four of the five sponsors conducted internal audits for
Part D, as recommended. The audits generally focused on Part D
operations and did not specifically audit for fraud, waste, or abuse.
In general, sponsors' Part D audit subjects related to operational
issues or risks to company assets, such as the accuracy and
completeness of the Part D membership process, Part D disenrollment
issues, and the completeness and accuracy of pharmacy claims data. For
example, one Part D sponsor's audit identified administrative issues in
collecting unpaid premiums from Part D beneficiaries and lack of timely
processing of beneficiary applications. A Part D audit by another
sponsor identified inaccurate pharmacy claims as potentially leading to
overpayments of claims by the sponsor as opposed to Medicare. Only one
sponsor's audit specifically cited detection of possible fraud, waste,
and abuse in Medicare Part D as the purpose of the audit. This audit of
20,000 pharmacy claims identified more than $1.2 million in Part D
overpayments for recovery from pharmacies. This was the only example
provided to us that identified funds for possible repayment to Medicare.
Of the three sponsors that had a first-tier entity for Part D--such as
a pharmacy benefit manager--two monitored and audited their first-tier
entity, as recommended. One sponsor official said that because billing
was a high-risk area for fraud, they check for billing irregularities
in audits of their first-tier entity.
Four sponsors conducted risk assessments to identify risk areas
associated with their Part D programs. Sponsors' risk assessments cited
internal issues that pose risks for fraud, waste, and abuse in Part D-
-such as proper reporting of overpayments to CMS, accuracy and
truthfulness of the data submitted to CMS for the purpose of federal
reimbursement, and sales conduct that may mislead or confuse
beneficiaries, or misrepresent the product. One Part D sponsor had
undertaken internal audits that reflected the internal Part D fraud,
waste, and abuse risks cited in its risk assessment, as recommended.
Prompt Responses to Detected Offenses and Corrective Action:
Requirements:
Four sponsors completely met the requirements for prompt responses and
corrective action initiatives by developing the respective procedures
and conducting timely and reasonable inquiry into potential offenses.
One sponsor only partially met the requirements because this sponsor
had not developed corrective action procedures in the event that fraud,
waste, or abuse was detected. The corrective action procedures provided
by Part D sponsors varied in the level of detail and information
provided. For example, one sponsor cited its employee disciplinary
guidelines as its corrective action procedures, while another sponsor's
corrective action procedures addressed various stakeholders--pharmacy
providers and beneficiaries--and the possible actions to be taken in
the event of a compliance violation or detected offense.
All Part D sponsors reported initiating inquiries into reported
potential offenses as required. Four Part D sponsors reported that they
had cases that warranted corrective action. Only one sponsor reported
the need to take disciplinary action against one of its employees. This
Part D sponsor reported terminating an employee for being involved in
an identity-theft scheme using the personal identification information
of beneficiaries. This Part D sponsor also reported terminating a
pharmacy technician after the technician stole a beneficiary's
prescription from the pharmacy refill center and attempted to sell it
to the beneficiary at a discounted price. As a result of criminal
proceedings, this individual was sentenced to 2 years of probation, and
ordered to pay restitution for the cost of the drug. Finally, three
sponsors reported repaying CMS an overpayment, as required.
The four sponsors that reported taking disciplinary or corrective
actions varied in their understanding and use of such actions. One Part
D sponsor reported that instead of taking corrective or disciplinary
action itself, most often cases were turned over to the MEDICs or local
law enforcement to determine the necessary course of action. Another
Part D sponsor reported that its understanding of taking a corrective
action was reporting the case to the MEDIC.
Recommended Measures:
Three of the Part D sponsors completely met the selected recommended
measures in our review by: (1) having procedures that specified that an
investigation into a detected offense would begin within two weeks
after it was reported; (2) having procedures to voluntarily self-report
any findings of potential fraud or misconduct to CMS or the appropriate
government authority; and (3) self-reporting any findings of potential
fraud or misconduct to CMS or the appropriate government authority, if
warranted. Two Part D sponsors only partially met the recommended
measures because they did not have procedures specifying that an
investigation into a detected offense would begin within 2 weeks after
it was reported.
All five Part D sponsors we reviewed had procedures in place for
voluntarily self-reporting fraud or misconduct to the MEDICs or CMS, as
recommended. All five sponsors had also self-reported potential Part D
fraud or misconduct to the MEDICs. For example, an official from a Part
D sponsor reported that the sponsor referred a case to the MEDIC after
conducting an investigation that identified a "phantom pharmacy"
billing over $2 million in false claims.
CMS's Oversight of Part D Sponsors' Fraud and Abuse Programs Has Been
Limited:
CMS's oversight of Part D sponsors' fraud and abuse programs has been
limited. CMS's oversight activities to date have included the review
and approval of fraud and abuse program plans that Part D sponsors
submit as part of their initial Part D sponsor applications. Although
CMS indicated that it planned to conduct audits to monitor Part D
sponsors' implementation of fraud and abuse programs, CMS has not yet
conducted these audits.
CMS's Activities Have Been Limited to the Initial Review and Approval
of the Plans for Part D Sponsors' Fraud and Abuse Programs:
CMS's oversight activities to date have been limited to review and
approval of Part D sponsors' compliance plans detailing their fraud and
abuse program plans submitted as part of their initial Part D sponsor
applications. A CMS official reported that in 2005, the first year
program plans were reviewed, some sponsors submitted plans that did not
meet the agency's requirements and recommendations specific to fraud,
waste, and abuse in Part D. When starting the Part D program, a CMS
official reported that CMS expected that sponsors would understand the
regulations and that sponsors would articulate clearly how their
compliance plans addressed fraud, waste, and abuse specific to Part D.
However, this official told us that after reviewing the components of
sponsors' compliance plans that were included in their Part D
applications, CMS officials realized that sponsors needed more
guidance. For example, a CMS official told us that some sponsors'
applications needed follow-up on all of the components of their fraud
and abuse programs. According to CMS officials, in many cases, Part D
sponsors initially submitted corporate-wide compliance plans that did
not address fraud, waste, and abuse specific to Part D, as CMS
expected. Rather than disapproving these sponsors' fraud and abuse
program plans, CMS officials reported that they worked with the
sponsors to help them develop fraud and abuse program plans that would
be approved in that first year.
CMS's review of fraud and abuse program plans was limited to the
initial contract-application process. CMS officials reported that
sponsors with approved fraud and abuse program plans prior to the
issuance of chapter 9 in April 2006 were not required to resubmit
program plans in order for CMS to verify that sponsors' plans were in
accordance with the new guidance. In addition, CMS officials told us
that CMS did not require Part D sponsors to submit new or updated fraud
and abuse program plans during the contract renewal process for program
year 2007 or 2008, which limited CMS's ability to ensure that existing
Part D sponsors continued to maintain compliance with this requirement.
CMS also provided technical assistance, such as guidance and
information sessions to Part D sponsors to help them understand the
agency's expectations regarding the development and implementation of
fraud and abuse programs. CMS also clarified its expectations regarding
sponsors' fraud and abuse programs by issuing a final rule in December
2007. In addition, CMS provided information sessions, such as the
Compliance Conference in August 2006 that included Part D and an Open
Door Forum in May 2006, to discuss the guidance for Part D sponsors
regarding the development and implementation of fraud and abuse
programs.
CMS Has Not Conducted Oversight Activities to Monitor Part D Sponsors'
Implementation of Fraud and Abuse Programs:
CMS has not conducted oversight activities of Part D sponsors' program
implementation, such as audit and enforcement actions, to ensure
compliance with fraud and abuse program requirements. CMS has taken a
collaborative rather than an enforcement approach with Part D sponsors
to implement the Part D program and safeguard it from fraud, waste, and
abuse. In its Part D Oversight Strategy, issued in 2005, CMS stated
that it would reserve enforcement activities to large, repeated, or
extreme Part D program violations.[Footnote 31]
Part D oversight responsibilities are shared between two CMS offices.
First, the CBC has responsibility for Part D operational oversight,
including sponsor compliance with all Part D program rules. In April
2006, CMS's CBC issued a Part D Audit Protocol identifying 14 program
areas for its audits of Part D sponsors, such as sponsors'
implementation of CMS's fraud and abuse program requirements.[Footnote
32] However, in November 2006, CBC issued a short-term audit strategy
stating that it had limited resources for auditing Part D programs due
to the increasing number of organizations contracting with CMS to offer
Medicare products. CBC noted that it did not have the resources to
audit every plan, across every program attribute, every 3 years as
originally stated in its 2005 Oversight Strategy. CBC reported that it
would identify the minimal level of effort needed to meet its oversight
responsibilities and ensure that Medicare stakeholders remained
confident in the program. CBC stated that to conserve resources it
would be conducting desk audits as much as possible, which would
consist of reviews of documents requested from Part D sponsors.
In 2007, the CBC initiated program audits based upon the short-term
audit strategy it issued in November 2006. In 2007, these CBC program
audits assessed Part D sponsors' compliance with selected program
areas, but the CBC audits did not assess sponsors' implementation of
fraud and abuse programs. Moreover, CBC does not plan to audit
sponsors' implementation of fraud and abuse programs in 2008. In June
2007, CBC conducted a self-assessment survey of Part D sponsors
regarding the implementation of their fraud and abuse programs. A CBC
official reported that the purpose of the survey was to help CMS
identify the degree to which sponsors implemented compliance plan
requirements and recommended measures. In a follow up survey conducted
in March and April 2008, CBC found that nearly all prescription drug
plans (PDP) reported that they fully met CMS's compliance plan
requirements.
Secondly, CMS's OFM has a targeted role in oversight that focuses on
financial oversight and program integrity, such as Part D fraud
prevention and detection. CMS contracted with the MEDICs, which are
overseen by OFM, to assist with OFM's program integrity efforts for
Part D. Audits of Part D sponsors' compliance plans are part of the
current MEDIC statement of work. However, no task orders specific to
auditing sponsors' fraud and abuse programs have been issued.
Accordingly, no audits of sponsors' fraud and abuse programs have been
initiated since the Part D program began. In comments on a draft of
this report, CMS stated that each MEDIC will begin audits of Part D
sponsors' compliance plans by the end of summer 2008. The MEDICs will
use the Compliance Plan Audit Chapter of the Part D Audit Guide to
perform this work.
An OFM official told us that OFM has limited funding for the MEDICs'
fraud and abuse program audits. OFM explained that under funding levels
as of April 2008, the MEDICs receive and investigate reports of fraud,
but the MEDICs did not have the staff to conduct audits of sponsors'
programs to control fraud, waste, and abuse.[Footnote 33]
Conclusions:
We have designated the overall Medicare program as high risk, and the
size, nature, and complexity of the Part D program make it a particular
risk for fraud, waste, and abuse. In spite of this risk and 3 years
after the start of the Part D program, CMS has not conducted oversight
activities to monitor sponsors' implementation of fraud and abuse
programs. CMS has acknowledged that program compliance and integrity
audits conducted by CMS are necessary to ensure compliance and document
CMS's program oversight responsibilities. In particular, the agency
reported that it would conduct audits of fraud and abuse programs in
2007. However, although both offices have the responsibility to do so,
CBC has not conducted these audits, and OFM has not initiated MEDIC
audits of fraud and abuse programs as it had planned.
Our review of five Medicare Part D sponsors' implementation of fraud,
waste, and abuse programs supports the need for such oversight. We
found that none of these five sponsors, which cover more than a third
of Part D enrollees, completely implemented all of the required
compliance plan elements and selected recommended measures for their
fraud and abuse programs. Lack of CMS oversight of Medicare Part D
sponsors' implementation of programs to prevent fraud, waste, and abuse
risks significant misuse of funds in this $39 billion program. We
believe that CMS oversight of Medicare Part D sponsors' programs could
increase the completeness of sponsors' implementation of required
compliance plan elements and selected recommended measures and, as a
result, reduce the risk to Medicare.
Recommendation for Executive Action:
To help safeguard the Medicare Part D program from fraud, waste, and
abuse, we recommend the Administrator of CMS ensure that CMS conducts
timely audits of Part D fraud and abuse programs to monitor sponsors'
implementation of these programs.
Agency Comments and Our Evaluation:
CMS provided written comments on a draft of this report. CMS stated
that it concurred with our recommendation and that it is prioritizing
its oversight activities to ensure sponsors' compliance with CMS's
policies. CMS also agreed with our finding regarding the extent to
which Part D sponsors have implemented programs to control fraud,
waste, and abuse. CMS disagreed with our finding that the agency's
oversight has been limited. However, CMS's comments did not provide
additional evidence of audits of sponsors' fraud, waste, and abuse
programs, or of oversight activities beyond those described in the
report. We believe that such audits are necessary to ensure sponsors'
compliance.
In addition, CMS stated that insufficient resources have been one of
the primary impediments to its implementation of a robust oversight
strategy. CMS noted that Congress did not respond to its request for
additional program integrity funds in fiscal year 2006 through fiscal
year 2008. However, we believe that program integrity will remain at
risk until CMS conducts timely audits to monitor Part D sponsors'
implementation of fraud and abuse programs. CMS's written comments are
reprinted in appendix II. CMS also provided technical comments, which
we incorporated as appropriate.
As agreed with your office, unless you publicly announce the contents
of this report earlier, we plan no further distribution of it until 30
days from the date of this report. We will then send copies to the
Administrator of CMS, appropriate congressional committees, and other
interested parties. We will also make copies available to others upon
request. This report is also available at no charge on GAO's Web site
at [hyperlink, http://www.gao.gov].
If you or your staff have questions about this report, please contact
me at (202) 512-7114 or at kingk@gao.gov. Contact points for our Office
of Congressional Relations and Public Affairs may be found on the last
page of this report. GAO staff who made major contributions to this
report are listed in appendix III.
Sincerely yours,
Signed by:
Kathleen M. King:
Director, Health Care:
[End of section]
Appendix I: Methodology for Examining Certain Sponsors' Implementation
of Fraud and Abuse Programs for Part D:
To examine the extent to which certain Part D sponsors implemented
programs to control fraud, waste, and abuse, we conducted on-site
reviews at five Part D sponsors. We selected these five sponsors for
our review because they each offered a stand-alone Part D prescription
drug plan that provided nationwide coverage,[Footnote 34] varied in
enrollment size, and collectively provided coverage for a sizeable
proportion of Part D beneficiaries.[Footnote 35] These five national
prescription drug plans (PDP) selected for our review from these five
sponsors represented about 35 percent of total Medicare Part D
enrollment as of April 2007. Our sample is not generalizable to the
entire Part D sponsor population. Four of the five sponsors we reviewed
were private health insurance companies and one was a pharmacy benefit
manager.
For these on-site reviews, we developed a data collection instrument
based on: (1) the required compliance plan elements and certain
recommended measures for fraud and abuse programs outlined in
regulations[Footnote 36] and chapter 9 of the Part D Prescription Drug
Benefit Manual and (2) additional input provided by the Centers for
Medicare & Medicaid Services (CMS).[Footnote 37] CMS's regulations
provided the core required elements of a compliance plan and
established a framework for fraud and abuse programs. CMS's chapter 9
guidance provided several recommendations for how sponsors should
implement a program within that framework to control fraud, waste, and
abuse as part of an effective Part D compliance plan. Our data
collection instrument did not include all of CMS's recommended
measures. We selected recommended measures for inclusion in our data
collection instrument based on a variety of factors, such as measures
that we judged were the most helpful to fulfilling the purpose of the
requirements, measures that were recommended by the OIG and subject-
matter experts for compliance program evaluations, including government
officials from Veterans' Affairs (VA) and an industry representative,
measures that helped tailor a fraud and abuse program to Part D, and
measures that indicated that a required component or procedure had been
implemented. For example, CMS required procedures for internal
monitoring and auditing, but provided a variety of recommendations on
the types of internal monitoring and auditing that could be
implemented. We selected the recommendations we considered to be the
most helpful to fulfilling the requirements, such as the recommendation
to conduct an audit, rather than the recommendation regarding the size,
scope, and structure of the internal audit department.
This study extends beyond a previous report from the Office of the
Inspector General (OIG), which reviewed Part D sponsors' compliance
plans to assess whether the plans addressed all of the requirements and
selected recommendations.[Footnote 38] The OIG limited its assessment
to a document review of the compliance plans submitted to CMS and did
not assess the extent to which the compliance plans had been
implemented. However, we assessed the implementation of the compliance
plans by reviewing documentary evidence on-site to examine how sponsors
addressed fraud, waste, and abuse specific to Medicare Part D for each
of the required elements of each Part D sponsor's compliance plan. This
included the compliance plan and any additional documents, such as
procedures, that were referenced in the compliance plan.
To complete our data collection instrument, we used documentary
evidence to verify implementation of each element. We requested at
least one document pertaining to each of the required elements and
selected recommended measures. For example, we asked the sponsors to
provide a copy of the required auditing procedures and evidence that
the Part D sponsor had implemented the auditing procedures as
recommended by providing a copy of the findings from at least one audit
related to Part D that had been conducted. Our determination of whether
sponsors met the criteria for a requirement or recommendation was based
on the document's applicability to Part D and the specific element
under review, not the extensiveness of the document's content. For
example, some evidence we accepted contained one section referencing
the requirement or recommendation, while other documents were more
detailed. All the policies and procedures in the documents we reviewed
were implemented by sponsors and in use at the time of our on-site
reviews. In addition, we determined that the sponsors' met the
requirements or selected recommendations if they implemented the
required element or selected recommended measures in their compliance
plan.
We also conducted interviews with Part D sponsor senior administrators,
and compliance and other staff, including contractors' employees.
[Footnote 39] To gain a comprehensive picture of the sponsor's fraud
and abuse activities, in some cases, we also interviewed additional
staff members involved in Part D functions, including staff from
departments such as special investigations, monitoring and auditing,
ethics, and pharmacy benefit management.
[End of section]
Appendix II: Comments from the Centers for Medicare & Medicaid Services:
Department Of Health & Human Services:
Office Of The Secretary:
Assistant Secretary for Legislation:
Washington, DC 20201:
July 8, 2008:
Kathleen M. King:
Director, Health Care:
441 G Street NW:
U.S. Government Accountability Office:
Washington, D.C. 20548:
Dear Ms. King:
Enclosed are the Department's comments on the U.S. Government
Accountability Office's (GAO) draft report entitled, "Medicare D: Some
Plan Sponsors Have Not Completely Implemented Fraud and Abuse Programs,
and CMS Oversight Has Been Limited" (GAO 08-760).
The Department appreciates the opportunity to comment on this draft
before its publication.
Sincerely,
Signed by:
Jennifer R. Luong, for:
Vincent J. Ventimiglia, Jr.
Assistant Secretary for Legislation:
Attachment:
Department Of Health & Human Services:
Centers for Medicare and Medicaid Services:
Office of the Administrator:
Washington, DC 20201:
Date: July 3, 2008:
To: Vincent J. Ventimiglia, Jr.
Assistant Secretary for Legislation:
From: [Signed by] Kerry Weems:
Acting Administrator:
Subject: Government Accountability Office (GAO) Draft Report -
"Medicare Part D: Some Plan Sponsors Have Not Completely Implemented
Fraud and Abuse Programs, and CMS Oversight Has Been Limited" (GAO-08-
760):
The Centers for Medicare & Medicaid Services (CMS) appreciates the
opportunity to review and comment on the GAO draft report entitled
"Medicare Part D: Some Plan Sponsors Have Not Completely Implemented
Fraud and Abuse Programs, and CMS Oversight Has Been Limited" (GAO-08-
760). This report specifically examined the extent to which Part D plan
sponsors had implemented programs to control fraud, waste, and abuse
and CMS' oversight of those programs. We agree with GAO's findings
regarding the extent to which Part D plan sponsors have implemented
programs to control fraud, waste, and abuse. However, we disagree with
GAO's finding that CMS' oversight has been limited.
The CMS takes its responsibility to combat fraud, waste, and abuse
seriously. and despite considerable budget constraints has seized many
opportunities to provide oversight of plans' fraud and abuse program
efforts. Through the use of the Medicare Part D Integrity Contractors
(MEDICs), CMS has been monitoring fraud and abuse complaints in the
Part D program since October 2005, and has taken appropriate action in
response to those complaints as needed. One of CMS' first priorities
was to provide detailed guidance to plan sponsors on CMS' expectations
for internal fraud and abuse oversight. As the report indicated, we
issued preliminary guidance in June 2005 and the final guidance in
April 2006. This guidance is contained in Chapter 9, the Part D Program
to Control Fraud. Waste and Abuse, of the Prescription Drug Benefit
Manual and articulates the specific required and recommended fraud and
abuse program elements sponsors should have in place. While we have not
yet conducted onsite fraud and abuse program audits, in June 2007, we
asked plan sponsors to complete a self-assessment survey and several
months later a follow-up survey. These results have helped us identify
the extent to which plan sponsors have implemented their fraud and
abuse programs. We have conducted several training sessions for Part D
plans on the role of the MEDICs and Chapter 9.
MEDIC Funding:
One of the primary impediments to CMS' successful implementation of a
robust oversight strategy has been insufficient resources. Funding for
the Medicare Integrity Program (MIP) budget was capped in 2003 at $720
million. Since then. CMS has sustained a $90 million inflationary loss
to its MIP purchasing power that has seriously degraded CMS' ability to
meet its responsibilities in combating fraud and abuse. This loss,
combined with the addition of the Medicare prescription drug benefit
and the many changes in the Medicare Prescription Drug, Improvement,
and Modernization At of 2003, has created funding challenges for CMS
oversight.
To preserve its commitment to program integrity, and to provide
adequate resources for Part C and Part D oversight, CMS has requested
additional MIP funding in each of the past 4 years. As shown in the
chart below, these additional funds would have been made available
through a discretionary cap adjustment for the Health Care Fraud and
Abuse Control (HCFAC) account. Although no action has been taken to
date on our fiscal year (FY) 2009 request, Congress did not provide any
funding relief in FY 2006, FY 2007, or FY 2008.
Table:
Discretionary Cap Adjustment: 2006;
Additional HCFAC Funding Requested: $80;
MIP Portion: $75;
Congressional Action: 0.
Discretionary Cap Adjustment: 2007;
Additional HCFAC Funding Requested: $118;
MIP Portion: $86;
Congressional Action: 0.
Discretionary Cap Adjustment: 2008;
Additional HCFAC Funding Requested: $183;
MIP Portion: $138;
Congressional Action: 0.
Discretionary Cap Adjustment: 2009;
Additional HCFAC Funding Requested: $198;
MIP Portion: $147;
Congressional Action: TBD.
[End of table]
Though the volume of fraud and abuse complaints has decreased since the
beginning of the Part D program, the volume continues to require
extensive MEDIC resources to thoroughly investigate and respond to all
of those complaints. As such, there have not been sufficient additional
resources to allow the MEDICs to engage in the types of audit oversight
activities originally envisioned at the onset of the program.
GAO Recommendation:
To help safeguard the Medicare Part D program from fraud, waste and
abuse, we recommend the Administrator of CMS ensure that CMS conducts
timely audits of Part D fraud and abuse programs to monitor sponsors'
implementation of these programs.
CMS Response:
We concur with the recommendation. Within the confines of our existing
resources due to budget constraints, we will continue to prioritize our
oversight efforts to the maximum extent possible. CMS already conduct
audits to assess sponsor's compliance with their contract requirements
and is required by Congress to audit one-third of the sponsors each
year to ensure the accuracy of their financial information. CMS will
continue to be aggressive with Part D sponsors that are non-compliant
with our policies. As always, we stand ready to take appropriate action
against any Part D sponsor that fails to meet our requirements. We
share the GAO's goal of ensuring appropriate oversight of the Part D
plan sponsors and numerous efforts are currently in place at CMS to
further that goal, We look forward to working with the GAO as we
proceed to address this issue.
[End of section]
Appendix III: GAO Contact and Staff Acknowledgments:
GAO Contact:
Kathleen M. King at (202) 512-7114 or kingk@gao.gov:
Acknowledgments:
In addition to the contact named above, Martin T. Gahart, Assistant
Director; Jennifer Apter; Catina Bradley; Jawaria Gilani; Jennel
Harvey; Joy Kraybill; Amy Shefrin; and Jennifer Whitworth made key
contributions to this report.
[End of section]
Footnotes:
[1] Medicare beneficiaries who are enrolled in fee-for-service Medicare
may obtain Part D drug coverage through stand-alone prescription drug
plans (PDP), which offer only a prescription drug benefit. Medicare
beneficiaries enrolled in Medicare's managed care program may obtain
Part D drug coverage through Medicare Advantage prescription drug plans
(MA-PD). A majority of Part D enrollees are enrolled in stand-alone
PDPs.
[2] Enrollment in Medicare PDPs and MA-PDs is as of January 2007.
[3] According to CMS, these expenditures are for PDP and MA-PD
contracts only, and are subject to change due to CMS's reconciliation
process.
[4] GAO, Prescription Drugs: Oversight of Drug Pricing in Federal
Programs, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-481T]
(Washington, D.C.: Feb. 9, 2007). U.S. House of Representatives Ways
and Means Subcommittees on Health and Oversight, 110th Cong., March 8,
2007 (testimony of Daniel R. Levinson, HHS Inspector General) and U.S.
House of Representatives Oversight and Government Reform Committee,
110th Cong., February 9, 2007 (testimony of Lewis Morris, Chief Counsel
to the HHS Inspector General).
[5] GAO's audits and evaluations identify federal programs and
operations that we determine are high risk due to their greater
vulnerabilities to fraud, waste, abuse, and mismanagement. See GAO,
High-Risk Series: An Update, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-05-207] (Washington, D.C.: January 2005).
[6] Pub. L. No. 108-173 § 101, 117 Stat. 2066, 2086 (adding Social
Security Act §1860D-4(c)(1)(D)) (codified at 42 U.S.C. § 1395w-
104(c)(1)(D)).
[7] 72 Fed. Reg. 4,194, 4,555. The requirement for comprehensive
compliance plans for Part D sponsors, including sponsors of PDPs and MA-
PDs, is located at 42 C.F.R § 423.504.
[8] In general, a compliance program is the internal set of policies,
processes, and procedures that a provider organization implements to
help it act ethically and lawfully. In this context, compliance plans
help provider organizations prevent and detect violations of Medicare
laws and regulations. See GAO, Medicare: Early Evidence of Compliance
Program Effectiveness Is Inconclusive, GAO/HEHS-99-59 (Washington,
D.C.: April 15, 1999).
[9] Hereafter, we refer to programs to control fraud, waste, and abuse
as fraud and abuse programs.
[10] The Prescription Drug Benefit Manual consists of multiple chapters
related to various Part D program areas and outlines Part D program
requirements and CMS guidance. The chapter in the Manual entitled
"Chapter 9--Part D Program to Control Fraud, Waste and Abuse" addresses
fraud, waste, and abuse in Part D.
[11] For the purposes of this report, the term contractor includes
first-tier, downstream, and related entities. First-tier entities are
parties that enter into written arrangements with a Part D sponsor to
provide administrative services or health care services for a Medicare
eligible individual under Part D. One example of a first-tier entity is
a pharmacy benefit manager under contract to a Part D sponsor to
provide pharmacy benefit management services such as contracting with a
network of pharmacies on behalf of the Part D sponsor. Downstream
entities are those below the level of a first-tier entity, such as a
pharmacy. Related entities are entities that are related to the sponsor
by common ownership or control and meet certain other criteria, such as
performing some of the Part D sponsor's management functions under
contract or delegation. For example, a Part D sponsor may be the parent
company of an entity that the sponsor contracts with to provide
services to Part D enrollees. 42 C.F.R. §§ 422.500(b), 423.501.
[12] At the suggestion of CMS, we spoke with officials from the VA
Office of Compliance and Business Integrity to learn more about the
processes and tools that the VA uses to evaluate compliance and
business integrity programs in the VA.
[13] One of the sponsors selected for the study had two stand-alone
plans that, in combination, provided nationwide coverage. We chose the
largest of these two for our study.
[14] We limited our sample to sponsors' national stand-alone PDPs that
contained greater than one percent of the total Part D enrollment. We
then stratified the sample by enrollment size, selecting two sponsors
from the top tier, two sponsors from the middle tier, and one sponsor
from the bottom tier.
[15] On June 8, 2008, the Center for Beneficiary Choices (CBC) was
reorganized and has been renamed the Center for Drug and Health Plan
Choice (CPC). This reorganization did not affect the responsibilities
of the center as detailed in this report.
[16] Social Security Act § 1860D-4(c)(1)(D).
[17] 42 C.F.R § 423.504(b)(4)(vi). CMS's January 2005 regulation
required Part D sponsors to have a program to detect, correct, and
prevent fraud, waste, and abuse as a specific element of the compliance
plan. 70 Fed. Reg. 4,194, 4,555 (Jan. 28, 2005). CMS later determined
that this element was redundant and issued amended regulations in
December 2007 that removed this element. See 72 Fed. Reg. 68,700,
68,705 (Dec. 5, 2007). In doing so, CMS clarified that each sponsor
must include "measures to detect, correct, and prevent fraud, waste and
abuse" in carrying out the remaining compliance plan elements. For the
purposes of this report, all references to requirements are to the
January 2005 regulations, as amended in December 2007.
[18] In June 2005, CMS issued a summary document, "Review of Sponsors'
Fraud, Waste, and Abuse Responsibilities," which served as a precursor
to its comprehensive guidance for Part D sponsors' fraud and abuse
programs.
[19] Part D sponsors hire contractors to handle a range of activities
in Part D, such as claims processing; pharmacy benefit management;
monitoring and auditing; or fraud, waste, and abuse detection and
investigation.
[20] Certain Part D activities, such as the role of the Compliance
Officer, cannot be delegated to a contractor. 72 Fed. Reg. 68,706.
[21] The MMA requires CMS to annually audit at least one-third of all
Part D organizations' financial records. OFM is responsible for these
audits; however, these audits are outside the scope of our review.
[22] In addition to audits, MEDICs have been engaged to detect fraud,
waste, and abuse in Part D and investigate reports from beneficiaries,
sponsors, and other sources; conduct enrollment, eligibility, and
marketing surveillance; and identify high-risk sponsors requiring
further investigations. These tasks are outside of the scope of our
report.
[23] According to CMS's Part D Audit Protocol, the program audits are
expected to cover 14 broad subjects of program requirements, such as
Enrollment and Disenrollment; Marketing and Beneficiary Information;
Coordination of Benefits/True-Out-of-Pocket Costs; and Grievances,
Coverage Determinations, and Appeals. Under one of those subject areas
for program audits--Compliance Plan--CBC would audit sponsors'
implementation of the compliance plan requirements, including a fraud
and abuse program for Part D.
[24] Department of Health and Human Services, Office of Inspector
General, Prescription Drug Plan Sponsors' Compliance Plans, OEI-03-06-
00100 (December 2006).
[25] Four of the five sponsors we reviewed had fraud and abuse programs
in place prior to Part D, including established investigation units and
internal auditing and monitoring to detect fraud, waste, and abuse
across their corporate entities. These four sponsors, which were
private health insurance companies, reported that they adapted and made
relevant additions to their existing programs to address fraud, waste,
and abuse specific to Part D.
[26] For our analyses of requirements and selected recommendations
related to Part D sponsors' contractors, we limited our review to first-
tier entities. While all five Part D sponsors in our review had
contractors, only three had first-tier entities.
[27] This Part D sponsor also did not have a compliance committee, as
required.
[28] One Part D sponsor that provided the required training to its
employees did not have a first-tier entity; therefore, all of the
required elements and selected recommended measures that applied to
this sponsor were completely met.
[29] In December 2007, CMS reported that it will consider developing a
standardized training program accessible to all Part D stakeholders for
the purpose of the effective training and education requirement.
[30] This sponsor did not have a Part D first-tier entity. Therefore,
the recommendation to provide specialized training to a first-tier
entity was not applicable for our review.
[31] CMS, Part D Oversight Strategy for Contractors/Industry, (Oct. 24,
2005).
[32] This includes program areas such as Compliance Plans; Enrollment
and Disenrollment; Marketing and Beneficiary Information; Coordination
of Benefits/True-Out-of-Pocket Costs; and Grievances, Coverage
Determinations, and Appeals.
[33] In its comments on a draft of this report, CMS stated that
insufficient resources have been one of the primary impediments to its
implementation of a robust oversight strategy.
[34] One of the sponsors selected for the study had two stand-alone
plans that, in combination, provided nationwide coverage. We chose the
largest of these two for our study.
[35] We limited our sample to sponsors' national stand-alone PDPs that
contained greater than 1 percent of the total Part D enrollment. We
then stratified the sample by enrollment size, selecting two sponsors
from the top tier, two sponsors from the middle tier, and one sponsor
from the bottom tier.
[36] 42 C.F.R. § 423.504.
[37] We also conducted a pilot site visit at one Part D sponsor to test
our data collection instrument.
[38] Department of Health and Human Services, Office of Inspector
General, Prescription Drug Plan Sponsors' Compliance Plans, OEI-03-06-
00100 (December 2006).
[39] For our analyses of requirements and selected recommendations of
Part D sponsors' contractors, we limited our review to first-tier
entities. While all five Part D sponsors in our review had contractors,
only three had first-tier entities.
[End of section]
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of newly
posted products every afternoon, go to [hyperlink, http://www.gao.gov]
and select "E-mail Updates."
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. Government Accountability Office:
441 G Street NW, Room LM:
Washington, D.C. 20548:
To order by Phone:
Voice: (202) 512-6000:
TDD: (202) 512-2537:
Fax: (202) 512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Ralph Dawn, Managing Director, dawnr@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548:
