Medicare Part D

The Medicare Part D program, administered by the Department of Health and Human Services' (HHS) Centers for Medicare & Medicaid Services (CMS), provides a voluntary, outpatient prescription drug benefit for eligible individuals 65 years and older and eligible individuals with disabilities. CMS contracts with private companies--such as health insurance companies and companies that manage pharmacy benefits--to provide Part D prescription drug plans for Medicare beneficiaries. These companies are referred to as Part D sponsors. About 27 million individuals were enrolled in Medicare Part D as of December 2009, and estimated Medicare Part D spending was $51 billion in fiscal year 2009. Because of Medicare's vulnerability to fraud, waste, and abuse, GAO has designated Medicare as a high-risk program. We and HHS's Inspector General have previously reported that the size, nature, and complexity of the Part D program make it a particular risk for fraud, waste, and abuse. The Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA), which established the Part D program, requires all Part D sponsors to have programs to safeguard Part D from fraud, waste, and abuse. CMS is responsible for managing and overseeing the Part D program. CMS regulations require Part D sponsors to have compliance plans that must include measures that detect, correct, and prevent fraud, waste, and abuse. In April 2006, CMS issued guidance in chapter 9 of its Medicare Part D Prescription Drug Benefit Manual on the seven required elements of these plans. These compliance plans, which must be approved by CMS, articulate policies, processes, and procedures for Part D sponsors to detect, correct, and prevent fraud, waste, and abuse. Implementation of a compliance plan includes conducting the activities described in the plan and developing comprehensive written procedures for activities referenced in the plan. CMS oversees Part D sponsors' fraud and abuse programs and may conduct audits to ensure that sponsors are in compliance with program requirements. Specifically, the Center for Medicare, Program Compliance and Oversight Group (CM/PCOG)--the lead office for CMS's Part D audits (including compliance plan audits) and enforcement of program requirements--coordinates with the Center for Program Integrity (CPI)--the focal point for program integrity, fraud, and abuse issues--to oversee fraud and abuse program compliance. CMS has contracted with Medicare Drug Integrity Contractors (MEDICs) to support its Part D audit efforts. Congress asked us to examine the extent of CMS's implementation of planned oversight of Part D sponsors' compliance plans to ensure that sponsors have effective programs in place to protect Part D from fraud, waste, and abuse. Specifically, this report provides an update on the status of CMS's implementation of on-site audits of sponsors' compliance plans that the agency described in its March 2010 testimony.

CMS conducted its planned on-site compliance plan audits of 33 sponsors in 2010. Findings for all of these 2010 audits are not yet available; however, CMS anticipated finalizing them in early 2011. Consistent with the audit plans CMS officials reported to us in February 2010, the agency scheduled on-site compliance plan audits to assess more thoroughly the effectiveness of sponsors' fraud and abuse programs. CMS officials reported that the agency scheduled and conducted on-site compliance plan audits of 33 of the 290 Medicare Part D sponsors in 2010, the majority of which were conducted as part of wider risk-based on-site performance audits. Performance audits are also conducted by CM/PCOG and assess compliance with certain CMS program requirements, such as Part D formulary administration and compliance plans, that CMS considers to be at risk for deficiencies or compliance issues. In auditing sponsors' compliance plans, CM/PCOG audits sponsors' implementation of the compliance plan requirements, including a fraud and abuse program for Part D. CMS officials stated that although the performance audits conducted in 2010 assessed Part D sponsors' compliance plans, the audits did so as part of overall assessments of sponsors' compliance with all Medicare requirements. While performance audits are more expansive than the compliance-plan-only audits, CMS's completion of these on-site audits was consistent with their plans to complete compliance plan audits that they reported to us in February 2010. The audits were conducted by CMS central and regional staff as well as CMS contractors between January and September 2010. The 33 sponsors represented 11 percent of Part D sponsors, 56 percent of plans, and covered 62 percent of enrolled beneficiaries in 2010 according to agency officials. As of February 2011, CMS had not made all audit findings available but had taken formal enforcement actions against several sponsors resulting from the on-site audits according to agency officials. CMS officials reported that they anticipated finalizing all audit findings in early 2011. Potential oversight or enforcement actions resulting from the audits could include issuing audit report notices, giving sponsors an opportunity to correct deficiencies, or where appropriate for serious violations, imposing civil monetary penalties, imposing intermediate sanctions, or terminating a contract. As of December 2010, officials reported that the agency had issued five marketing and enrollment sanctions and one contract termination action based, in part, on the results of these audit findings noting failure to comply with CMS compliance plan requirements.