Medicare Part D
CMS Oversight of Part D Sponsors' Fraud and Abuse Programs Has Been Limited, but CMS Plans Oversight Expansion Gao ID: GAO-10-481T March 3, 2010Medicare Part D, the voluntary, outpatient prescription drug benefit for eligible individuals 65 years and older and certain individuals with disabilities, is at risk for fraud, waste, and abuse. Part D is administered by the Centers for Medicare & Medicaid Services (CMS). All Part D sponsors--private companies that operate Part D benefit plans--are required to have programs to safeguard the Part D program from fraud, waste, and abuse. GAO refers to these programs as fraud and abuse programs. This statement discusses CMS's oversight of Part D sponsors' fraud and abuse programs, including its past efforts and planned oversight activities. It is primarily based on the GAO report, Medicare Part D: Some Plan Sponsors Have Not Completely Implemented Fraud and Abuse Programs, and CMS Oversight Has Been Limited (GAO-08-760). The five Part D sponsors GAO reviewed for that report had not completely implemented all of CMS's elements for Part D fraud and abuse programs at that time. CMS agreed with GAO's recommendation in the report that it conduct timely audits of Part D sponsors' fraud and abuse programs. For the 2008 report, GAO reviewed laws, regulation, and CMS documents, including fraud and abuse program guidance. GAO also interviewed CMS officials. For this statement, GAO updated selected information on CMS's oversight by interviewing CMS officials and reviewing agency documents.
In July 2008, GAO reported that CMS's review of fraud and abuse program plans was limited to the review and approval of Part D sponsors' fraud and abuse program plans submitted as part of the initial contract-application process. For example, CMS indicated that the agency did not require Part D sponsors to submit new or updated fraud and abuse program plans during the contract renewal process for program years 2007 or 2008. Further, in the July 2008 report, GAO noted that CMS had not conducted audits as it had detailed in its 2005 Part D Oversight Strategy to ensure that sponsors had implemented fraud and abuse program plans. In February 2010, CMS officials told us the agency had completed desk audits (reviews of requested documents) in 2008 and 2009 and was beginning to implement an expanded oversight strategy. CMS officials reported that between October 2008 and April 2009 the agency's contractors had completed 16 desk audits of selected Part D sponsors' fraud and abuse programs. These officials reported that the agency has revised its audit protocol and piloted on-site audits (which include interviews and other face-to-face evaluations) to assess the effectiveness of these programs more thoroughly. In addition, CMS issued a proposed rule in 2009 to increase its oversight efforts and ensure that sponsors have effective compliance programs in place. CMS noted in issuing the proposed rule that GAO requested that CMS take actions to evaluate and oversee fraud and abuse programs. CMS expects the rule to be finalized in March 2010.
GAO-10-481T, Medicare Part D: CMS Oversight of Part D Sponsors' Fraud and Abuse Programs Has Been Limited, but CMS Plans Oversight Expansion
This is the accessible text file for GAO report number GAO-10-481T
entitled 'Medicare Part D: CMS Oversight of Part D Sponsors' Fraud and
Abuse Programs Has Been Limited, but CMS Plans Oversight Expansion'
which was released on March 3, 2010.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as
part of a longer term project to improve GAO products' accessibility.
Every attempt has been made to maintain the structural and data
integrity of the original printed product. Accessibility features,
such as text descriptions of tables, consecutively numbered footnotes
placed at the end of the file, and the text of agency comment letters,
are provided but may not exactly duplicate the presentation or format
of the printed version. The portable document format (PDF) file is an
exact electronic replica of the printed version. We welcome your
feedback. Please E-mail your comments regarding the contents or
accessibility features of this document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Testimony:
Before the Subcommittee on Federal Financial Management, Government
Information, Federal Services, and International Security, Homeland
Security and Governmental Affairs Committee, U.S. Senate:
United States Government Accountability Office:
GAO:
For Release on Delivery:
Expected at 2:30 p.m. EST:
Wednesday, March 3, 2010:
Medicare Part D:
CMS Oversight of Part D Sponsors' Fraud and Abuse Programs Has Been
Limited, but CMS Plans Oversight Expansion:
Statement of Kathleen M. King:
Director, Health Care:
GAO-10-481T:
GAO Highlights:
Highlights of GAO-10-481T, a testimony before the Subcommittee on
Federal Financial Management, Government Information, Federal
Services, and International Security, Homeland Security and
Governmental Affairs Committee, U.S. Senate.
Why GAO Did This Study:
Medicare Part D, the voluntary, outpatient prescription drug benefit
for eligible individuals 65 years and older and certain individuals
with disabilities, is at risk for fraud, waste, and abuse. Part D is
administered by the Centers for Medicare & Medicaid Services (CMS).
All Part D sponsors”private companies that operate Part D benefit
plans”are required to have programs to safeguard the Part D program
from fraud, waste, and abuse. GAO refers to these programs as fraud
and abuse programs.
This statement discusses CMS‘s oversight of Part D sponsors‘ fraud and
abuse programs, including its past efforts and planned oversight
activities. It is primarily based on the GAO report, Medicare Part D:
Some Plan Sponsors Have Not Completely Implemented Fraud and Abuse
Programs, and CMS Oversight Has Been Limited (GAO-08-760). The five
Part D sponsors GAO reviewed for that report had not completely
implemented all of CMS‘s elements for Part D fraud and abuse programs
at that time. CMS agreed with GAO‘s recommendation in the report that
it conduct timely audits of Part D sponsors‘ fraud and abuse programs.
For the 2008 report, GAO reviewed laws, regulation, and CMS documents,
including fraud and abuse program guidance. GAO also interviewed CMS
officials. For this statement, GAO updated selected information on
CMS‘s oversight by interviewing CMS officials and reviewing agency
documents.
What GAO Found:
In July 2008, GAO reported that CMS‘s review of fraud and abuse
program plans was limited to the review and approval of Part D sponsors‘
fraud and abuse program plans submitted as part of the initial
contract-application process. For example, CMS indicated that the
agency did not require Part D sponsors to submit new or updated fraud
and abuse program plans during the contract renewal process for
program years 2007 or 2008. Further, in the July 2008 report, GAO
noted that CMS had not conducted audits as it had detailed in its 2005
Part D Oversight Strategy to ensure that sponsors had implemented
fraud and abuse program plans. In February 2010, CMS officials told us
the agency had completed desk audits (reviews of requested documents)
in 2008 and 2009 and was beginning to implement an expanded oversight
strategy. CMS officials reported that between October 2008 and April
2009 the agency‘s contractors had completed 16 desk audits of selected
Part D sponsors‘ fraud and abuse programs. These officials reported
that the agency has revised its audit protocol and piloted on-site
audits (which include interviews and other face-to-face evaluations)
to assess the effectiveness of these programs more thoroughly. In
addition, CMS issued a proposed rule in 2009 to increase its oversight
efforts and ensure that sponsors have effective compliance programs in
place. CMS noted in issuing the proposed rule that GAO requested that
CMS take actions to evaluate and oversee fraud and abuse programs. CMS
expects the rule to be finalized in March 2010.
View [hyperlink, http://www.gao.gov/products/GAO-10-481T] or key
components. For more information, contact Kathleen M. King at (202)
512-7114 or kingk@gao.gov.
[End of section]
Mr. Chairman and Members of the Subcommittee:
I am pleased to be here today to discuss CMS's oversight of programs
that address the risks for fraud, waste, and abuse in Medicare Part D.
The Medicare Part D program, administered by the Centers for Medicare
& Medicaid Services (CMS), provides a voluntary, outpatient
prescription drug benefit for eligible individuals 65 years and older
and eligible individuals with disabilities. CMS contracts with private
companies--such as health insurance companies and companies that
manage pharmacy benefits--to provide Part D prescription drug benefit
plans for Medicare beneficiaries. These companies are referred to as
Part D sponsors. About 27 million individuals were enrolled as of
December 2009, and estimated Medicare Part D spending was $51 billion
in fiscal year 2009.Because of its vulnerability to fraud, waste, and
abuse, GAO has designated Medicare as a high-risk program since 1990.
[Footnote 1] We and others have previously reported that the size,
nature, and complexity of the Part D program make it a particular risk
for fraud, waste, and abuse.[Footnote 2]
The Medicare Prescription Drug, Improvement, and Modernization Act of
2003 (MMA),[Footnote 3] which established the Part D program,requires
all Part D sponsors to have programs to safeguard Part D from fraud,
waste, and abuse.[Footnote 4] CMS regulations require Part D sponsors
to have compliance plans detailing their fraud and abuse programs.
[Footnote 5] In April 2006, CMS issued guidance in chapter 9 of its
Medicare Prescription Drug Benefit Manual on the seven required
elements of these plans.[Footnote 6] (See table 1.)
Table 1: Description of Required Medicare Part D Compliance Plan
Elements for Fraud and Abuse Programs:
Compliance plan elements: Written Policies, Procedures, and Standards
of Conduct;
Description: Include written policies, procedures, and standards of
conduct articulating the organization's commitment to comply with all
applicable federal and state standards.
Compliance plan elements: Compliance Officer and Compliance Committee;
Description: Designate a compliance officer and a compliance committee
that are accountable to senior management.
Compliance plan elements: Effective Training and Education;
Description: Include effective training and education pertaining to
fraud, waste, and abuse for the organization's employees, contractors
and directors.
Compliance plan elements: Effective Lines of Communication;
Description: Include effective lines of communication between the
compliance officer and the organization's employees, contractors,
directors, and the members of the compliance committee.
Compliance plan elements: Enforcement of Standards through
Disciplinary Guidelines;
Description: Have well-publicized disciplinary guidelines through
which sponsors must enforce standards.
Compliance plan elements: Internal Monitoring and Auditing;
Description: Include effective internal monitoring and auditing
procedures.
Compliance plan elements: Prompt Responses to Detected Offenses;
Description: Include procedures for ensuring prompt responses to
detected offenses and development of corrective action initiatives,
including responses to potential offenses.
Source: GAO summary of regulations.
[End of table]
In this testimony, we focus on the extent of CMS's oversight of Part D
sponsors' fraud and abuse programs, including its past efforts and
planned oversight activities. My statement is based primarily on our
July 2008 report, which focused on Part D sponsors' implementation of
fraud and abuse programs and CMS's oversight of those Part D sponsors'
programs.[Footnote 7] Our July 2008 report is part of a larger GAO
body of ongoing work on Part D oversight and fraud, waste, and abuse
prevention (see "Related GAO Products," attached). This statement also
includes selected updated information on CMS's oversight obtained from
CMS since our July 2008 report.
In our July 2008 report, we found that the five Part D sponsors we
reviewed, which covered more than one-third of total Part D enrollees,
had not completely implemented all seven of CMS's required compliance
plan elements for a Part D fraud and abuse program. All Part D
sponsors had completely implemented the requirements for three of the
seven required compliance plan elements. However, Part D sponsors
varied in their implementation of the remaining required elements.
[Footnote 8] For example, only two of the five sponsors met the
requirements for effective training and education related to fraud and
abuse prevention.
To conduct our evaluation of CMS's oversight for the July 2008 report,
we reviewed relevant laws, regulations, and CMS guidance to determine
the elements of a comprehensive compliance plan including fraud and
abuse programs. We also interviewed officials from CMS and the
Department of Health and Human Services' (HHS) Office of the Inspector
General (OIG). In addition, we reviewed documentation from CMS,
including CMS's Part D oversight strategy, program audit strategies,
contracts related to Part D program integrity efforts, and technical
assistance provided by CMS specific to the fraud and abuse program. A
detailed explanation of our methodology is included in our July 2008
report. For this statement, we also interviewed officials from CMS and
reviewed agency documents to obtain selected updated information on
CMS oversight. We discussed the information in this statement with a
CMS official responsible for Part D oversight.
We conducted the performance audit for the July 2008 report from
October 2006 through June 2008 and we updated information regarding
CMS's oversight of Part D sponsors' fraud and abuse programs in
February 2010, in accordance with generally accepted government
auditing standards. Those standards require that we plan and perform
the audit to obtain sufficient, appropriate evidence to provide a
reasonable basis for our findings and conclusions based on our audit
objectives. We believe that the evidence obtained provides a
reasonable basis for our findings and conclusions based on our audit
objectives.
While CMS's Oversight of Part D Sponsors' Fraud and Abuse Programs Has
Been Limited, the Agency Plans to Expand Its Oversight:
While CMS oversight of Part D fraud and abuse programs has been
limited, the agency plans to expand this oversight, including adding
on-site audits (which include interviews and other face-to-face
evaluations) in place of the desk audits (reviews of requested
documents only) it has completed. In July 2008, we reported that CMS's
review of fraud and abuse program plans was limited to the review and
approval of Part D sponsors' compliance plans detailing their fraud
and abuse program plans submitted as part of the initial contract-
application process. For example, CMS officials reported that Part D
sponsors with approved fraud and abuse program plans prior to the
issuance of chapter 9 of CMS's Medicare Prescription Drug Benefit
Manual in April 2006 were not required to resubmit program plans. In
addition, CMS told us the agency did not require Part D sponsors to
submit new or updated fraud and abuse program plans during the
contract-renewal process for program years 2007 or 2008, which limited
CMS's ability to ensure that existing Part D sponsors continued to
maintain compliance with this requirement.
In 2008, we also reported that CMS had not conducted audits of
sponsors' fraud and abuse program plans as it had detailed in its 2005
Part D Oversight Strategy. In its 2005 comprehensive Oversight
Strategy for the program, CMS noted that it would mainly rely on self-
reported, unaudited data provided by Part D sponsors, but acknowledged
that program audits would be necessary to ensure compliance and to
document that CMS had fulfilled its program oversight
responsibilities. CMS further stated that it would reserve enforcement
activities to large, repeated, or extreme Part D program violations.
[Footnote 9]
Offices within CMS with oversight authority cited resource problems in
2006, Part D's first year of operation, that either prevented audits
from occurring or changed the audit strategy to use desk audits rather
than on-site audits. In 2007, CMS assessed Part D sponsors' compliance
with selected program areas, but did not assess sponsors'
implementation of fraud and abuse programs. Moreover, the agency said
it did not plan to audit sponsors' implementation of fraud and abuse
programs in 2008. In addition, CMS originally estimated that 10 of
these audits would be completed by the Medicare Drug Integrity
Contractors (MEDICs) during the 2005-2006 contract year of the program
and that 35 of these audits would be conducted during the 2006-2007
contract year. However, these audits did not occur.[Footnote 10]
In February 2010, CMS officials told us the agency had completed desk
audits in 2008 and 2009 and is beginning to implement an expanded
oversight strategy. CMS officials reported that between October 2008
and April 2009 its MEDICs completed 16 desk audits of selected Part D
sponsors' fraud and abuse programs. Since then, these officials
reported that CMS has revised its audit protocol and piloted on-site
audits, rather than desk audits, to assess the effectiveness of these
programs more thoroughly. The agency has conducted two on-site audits
in the pilot so far and plans to conduct additional on-site audits of
selected Part D sponsors' fraud and abuse programs by April 2010.
Similar to our July 2008 findings, in conducting their desk and pilot
on-site audits, CMS officials told us they found that sponsors had
deficiencies in implementation of two of the required compliance
elements--internal auditing and monitoring and training and education.
However, the effectiveness of CMS's planned audits cannot be assessed
until they are completed.
In addition, CMS issued a proposed rule in 2009 to increase its
oversight efforts and ensure that sponsors have effective compliance
programs in place.[Footnote 11] In issuing the proposed rule, CMS
noted that we requested the agency take actions to evaluate and
oversee fraud and abuse programs to ensure sponsors have effective
programs in place.[Footnote 12] The proposed rule would clarify
existing policies regarding the elements of sponsors' compliance plans
and CMS expects it to be finalized in March 2010. CMS officials told
us that once the proposed rule is finalized, the agency will
incorporate it into its expanded on-site audit protocol and update its
guidance in chapter 9 of the Medicare Prescription Drug Benefit Manual
to reflect the changes.
Mr. Chairman, this concludes my prepared statement. I would be happy
to answer any questions you or other members of the subcommittee may
have.
GAO Contact and Staff Acknowledgments:
For further information about this statement, please contact Kathleen
M. King at (202) 512-7114 or kingk@gao.gov.
Contact points for our Offices of Congressional Relations and Public
Affairs may be found on the last page of this statement. Catina
Bradley and Martin T. Gahart, Assistant Directors; Jennie F. Apter,
Jennel Harvey, Amy Shefrin, and Jennifer Whitworth were key
contributors to this statement.
[End of section]
Related GAO Products:
Improper Payments: Improper Payments: Responses to Posthearing
Questions Related to Eliminating Waste and Fraud in Medicare and
Medicaid. [hyperlink, http://www.gao.gov/products/GAO-09-838R].
Washington, D.C.: July 20, 2009.
Medicare Part D: Opportunities Exist for Improving Information Sent to
Enrollees and Scheduling the Annual Election Period. [hyperlink,
http://www.gao.gov/products/GAO-09-4]. Washington, D.C.: December 12,
2008.
Medicare Part D Prescription Drug Coverage: Federal Oversight of
Reported Price Concessions Data. [hyperlink,
http://www.gao.gov/products/GAO-08-1074R]. Washington, D.C.: September
30, 2008.
Medicare Part D Low-Income Subsidy: Assets and Income Are Both
Important in Subsidy Denials, and Access to State and Manufacturer
Drug Programs Is Uneven. [hyperlink,
http://www.gao.gov/products/GAO-08-824]. Washington, D.C.: September
5, 2008.
Medicare Part D: Some Plan Sponsors Have Not Completely Implemented
Fraud and Abuse Programs, and CMS Oversight Has Been Limited.
[hyperlink, http://www.gao.gov/products/GAO-08-760]. Washington, D.C.:
July 21, 2008.
Medicare Part D: Complaint Rates Are Declining, but Operational and
Oversight Challenges Remain. [hyperlink,
http://www.gao.gov/products/GAO-08-719]. Washington, D.C.: June 27,
2008.
Medicare Part D: Plan Sponsors' Processing and CMS Monitoring of Drug
Coverage Requests Could Be Improved. [hyperlink,
http://www.gao.gov/products/GAO-08-47]. Washington, D.C.: January 22,
2008.
[End of section]
Footnotes:
[1] GAO's audits and evaluations identify federal programs and
operations that we determine are high risk due to their greater
vulnerabilities to fraud, waste, abuse, and mismanagement. See GAO,
High-Risk Series: An Update, [hyperlink,
http://www.gao.gov/products/GAO-05-207] (Washington, D.C.: January
2005).
[2] GAO, Prescription Drugs: Oversight of Drug Pricing in Federal
Programs, [hyperlink, http://www.gao.gov/products/GAO-07-481T]
(Washington, D.C.: Feb. 9, 2007). U.S. House of Representatives Ways
and Means Subcommittees on Health and Oversight, 110th Cong., March 8,
2007 (testimony of Daniel R. Levinson, HHS Inspector General) and U.S.
House of Representatives Oversight and Government Reform Committee,
110th Cong., February 9, 2007 (testimony of Lewis Morris, Chief
Counsel to the HHS Inspector General).
[3] Pub. L. No. 108-173 § 101, 117 Stat. 2066, 2086 (adding Social
Security Act § 1860D-4(c)(1)(D)) (codified at 42 U.S.C. § 1395w-
104(c)(1)(D)).
[4] Hereafter, we refer to programs to control fraud, waste, and abuse
as fraud and abuse programs.
[5] 42 C.F.R. § 423.504(b)(4)(vi).
[6] The Medicare Prescription Drug Benefit Manual consists of multiple
chapters related to various Part D program areas and outlines Part D
program requirements and CMS guidance. The chapter in the manual
entitled "chapter 9--Part D Program to Control Fraud, Waste, and
Abuse" addresses fraud, waste, and abuse in Part D.
[7] GAO, Medicare Part D: Some Plan Sponsors Have Not Completely
Implemented Fraud and Abuse Programs, and CMS Oversight Has Been
Limited, [hyperlink, http://www.gao.gov/products/GAO-08-760]
(Washington, D.C.: July 21, 2008).
[8] We conducted on-site reviews at five of the largest Part D
sponsors to examine the extent to which these Part D sponsors
implemented fraud and abuse programs.
[9] CMS, Part D Oversight Strategy for Contractors/Industry (Oct. 24,
2005).
[10] CMS contracted with the MEDICs to support its audit, oversight,
and antifraud and abuse efforts in Part D. In addition to audits, the
MEDICs have been engaged to detect fraud, waste, and abuse in Part D
and investigate reports from beneficiaries, sponsors, and other
sources; conduct enrollment, eligibility, and marketing surveillance;
and identify high-risk sponsors requiring further investigations.
These tasks were outside the scope of the July 2008 report and are
outside the scope of our current testimony.
[11] Policy and Technical Changes to the Medicare Advantage and the
Medicare Prescription Drug Benefit Programs, 74 Fed. Reg. 54,634
(proposed Oct. 22, 2009).
[12] In the July 2008 report, we recommended that CMS conduct timely
audits of Part D sponsors' fraud and abuse programs. CMS agreed with
our recommendation.
[End of section]
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of newly
posted products every afternoon, go to [hyperlink, http://www.gao.gov]
and select "E-mail Updates."
Order by Phone:
The price of each GAO publication reflects GAO‘s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO‘s Web site,
[hyperlink, http://www.gao.gov/ordering.htm].
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional
information.
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Ralph Dawn, Managing Director, dawnr@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548:
