Medicare and Medicaid: CMS Should Assess Documentation Necessary to Identify Improper Payments

In fiscal year 2017, Medicare FFS had an estimated $23.2 billion in improper payments due to insufficient documentation, while Medicaid FFS had $4.3 billion—accounting for most of the programs' estimated FFS medical review improper payments. Medicare FFS coverage policies are generally national, and the program directly pays providers, while Medicaid provides states flexibility to design coverage policies, and the federal government and states share in program financing.

Among other things, GAO examined: (1) Medicare and Medicaid documentation requirements and factors that contribute to improper payments due to insufficient documentation; and (2) the extent to which Medicaid reviews provide states with actionable information. GAO reviewed Medicare and Medicaid documentation requirements and improper payment data for fiscal years 2005 through 2017, and interviewed officials from CMS, CMS contractors, and six state Medicaid programs. GAO selected the states based on, among other criteria, variation in estimated state improper payment rates, and FFS spending and enrollment.

The Centers for Medicare & Medicaid Services (CMS) uses estimates of improper payments to help identify the causes and extent of Medicare and Medicaid program risks and develop strategies to protect the integrity of the programs. CMS estimates Medicare and Medicaid fee-for-service (FFS) improper payments, in part, by conducting medical reviews—reviews of provider-submitted medical record documentation to determine whether the services were medically necessary and complied with coverage policies. Payments for services not sufficiently documented are considered improper payments. In recent years, CMS estimated substantially more improper payments in Medicare, relative to Medicaid, primarily due to insufficient documentation (see figure).

For certain services, Medicare generally has more extensive documentation requirements than Medicaid. For example, Medicare requires additional documentation for services that involve physician referrals, while Medicaid requirements vary by state and may rely on other mechanisms—such as requiring approval before services are provided—to ensure compliance with coverage policies. Although Medicare and Medicaid pay for similar services, the same documentation for the same service can be sufficient in one program but not the other. The substantial variation in the programs' improper payments raises questions about how well the programs' documentation requirements help identify causes of program risks. As a result, CMS may not have the information it needs to effectively address program risks and direct program integrity efforts.

CMS's Medicaid medical reviews may not provide the robust state-specific information needed to identify causes of improper payments and address program risks. In fiscal year 2017, CMS medical reviews identified fewer than 10 improper payments in more than half of all states. CMS directs states to develop corrective actions specific to each identified improper payment. However, because individual improper payments may not be representative of the causes of improper payments in a state, the resulting corrective actions may not effectively address program risks and may misdirect state program integrity efforts. Augmenting medical reviews with other sources of information, such as state auditor findings, is one option to better ensure that corrective actions address program risks.

GAO is making four recommendations to CMS, including that CMS assess and ensure the effectiveness of Medicare and Medicaid documentation requirements, and that CMS take steps to ensure Medicaid's medical reviews effectively address causes of improper payments and result in appropriate corrective actions. CMS concurred with three recommendations, but did not concur with the recommendation on Medicaid medical reviews. GAO maintains that this recommendation is valid as discussed in this report.

Medicare and Medicaid provide health insurance coverage to nearly 120  million Americans, with combined annual expenditures that exceeded $1  trillion in fiscal year 2017. We have designated Medicare and Medicaid  high-risk programs in part because their size and complexity make them  vulnerable to improper payments—payments that should not have been  made or were made in incorrect amounts based on program  requirements.

Medicare and Medicaid provide health coverage through different  mechanisms, including fee-for-service (FFS), in which individual health  care providers are paid for each service delivered. In fiscal year 2017,  Medicare FFS spending was an estimated $381 billion, and combined  federal and state spending for Medicaid FFS was an estimated $320  billion. In the same year, estimated Medicare FFS improper payments  were $36.2 billion and estimated Medicaid FFS improper payments were  $41.2 billion.

The Centers for Medicare & Medicaid Services (CMS)—the Department  of Health and Human Services (HHS) agency responsible for  administering the Medicare program and, in conjunction with the states,  the Medicaid program—estimates Medicare and Medicaid FFS improper  payments in part by reviewing provider medical record documentation to  determine whether claims that providers submit for payment comply with  program coverage policies. Among other types of improper payment  errors, payments are improper when providers do not submit required  documentation to support their claims, or the documentation submitted is  insufficient to demonstrate compliance with coverage policies. In fiscal  year 2017, Medicare had an estimated $23.8 billion in improper payments  due to providers submitting no or insufficient documentation, while  Medicaid had an estimated $6.8 billion. CMS uses estimates of improper  payments, including those due to no and insufficient documentation, to  better understand the causes and extent of program risks, develop  strategies to protect program integrity, and measure progress toward  reducing improper payments.

We prepared this report under the authority of the Comptroller General to  conduct evaluations to support congressional oversight of issues of  national importance. This report:  1.  describes CMS’s processes for obtaining and reviewing medical  record documentation needed to estimate improper payments in  Medicare and Medicaid FFS;  2.  examines Medicare and Medicaid documentation requirements and  factors that contribute to improper payments due to insufficient  documentation; and  3.  examines the extent to which reviews of medical record  documentation provide state Medicaid agencies with actionable  information on the underlying causes of improper payments.

To describe CMS’s processes for obtaining and reviewing medical record  documentation to estimate improper payments in Medicare and Medicaid  FFS, we reviewed CMS documents for Medicare’s Comprehensive Error  Rate Testing (CERT) and Medicaid’s Payment Error Rate Measurement  (PERM) programs, respectively. CMS uses the CERT and PERM  programs to identify improper payments and estimate Medicare and  Medicaid improper payment amounts and rates. We interviewed CMS  officials and CMS’s CERT and PERM contractors regarding processes for  obtaining and reviewing documentation, including steps taken by the  contractors before determining that a claim is improper due to no or  insufficient documentation. We obtained data on the outreach to  providers conducted by the CERT and PERM contractors to obtain  documentation, and information on referrals of claims with evidence of  potential fraud to other Medicare and Medicaid program integrity entities.

To examine Medicare and Medicaid documentation requirements and  factors that contribute to improper payments due to insufficient  documentation, we reviewed Medicare and Medicaid documentation  requirements based on statutes, regulations, and other national and state  coverage policies. We reviewed data on Medicare improper payment  amounts for fiscal years 2005 through 2017; Medicaid improper payment  amounts for fiscal years 2011 through 2017; and fiscal year 2017  estimated improper payment amounts and rates for four selected services  types—home health, durable medical equipment (DME), laboratory, and  hospice. We selected these services based on their relatively high  estimated amounts and rates of improper payments due to insufficient  documentation, particularly in Medicare. Specifically, these services  accounted for $10.7 billion of $23.2 billion in Medicare improper payments  due to insufficient documentation in fiscal year 2017. We interviewed  CMS officials; CERT and PERM contractor staff; officials from six state  Medicaid agencies—California, Delaware, Indiana, Massachusetts,  Michigan, and New York; officials from provider associations representing  the four selected services; and an association representing physicians  regarding the causes of improper payments due to insufficient  documentation. We selected the six states to review based on a range  of estimated FFS improper payment rates, a range of FFS enrollment and  expenditures, regional geographic diversity, and states representing each  PERM cycle year. The information we obtained from the six states and  the provider associations cannot be generalized. We obtained illustrative  examples from CMS of Medicare and Medicaid improper payments due to  insufficient documentation for our selected services; these examples  cannot be generalized. We also reviewed documentation about CMS  initiatives to examine and revise provider documentation requirements.  We assessed Medicare and Medicaid documentation requirements and  processes for identifying improper payments due to insufficient  documentation against Standards for Internal Control in the Federal  Government.

To examine the extent to which reviews of medical record documentation  provide actionable information on the underlying causes of improper  payments, we reviewed CMS’s PERM and corrective action plan  guidance, the PERM program’s processes for estimating improper  payments, national and state-level error rate data, and relevant statutes,  regulations, and state coverage policies. We interviewed officials from the  Office of Management and Budget (OMB) regarding agency requirements  to estimate and address improper payments. We also interviewed officials  from the six selected state Medicaid agencies regarding the PERM  process, and reviewed the states’ improper payments rates, causes of  improper payments, and corrective action plans to address identified  improper payments. The information we obtained from the six states  cannot be generalized. Additionally, we reviewed guidance from the  Association of Certified Fraud Examiners and interviewed officials from  the HHS Office of the Inspector General (HHS-OIG) and the National  Association of Medicaid Fraud Control Units to learn about best practices  for investigative and review entities. We assessed PERM processes  and corrective actions plans against federal internal control standards and  best practices for investigative and review entities.

The scope of our review is limited to the estimation of Medicare and  Medicaid FFS improper payments and thus does not include other  estimates of improper payments in these programs. In addition to the  CERT’s estimation of Medicare FFS improper payments, CMS has  separate programs to estimate improper payments for Medicare’s  managed care and outpatient prescription drug programs, neither of  which are included in the scope of our review. The PERM program  estimates Medicaid improper payments for three key components of the  Medicaid program—FFS, managed care, and beneficiary eligibility  determinations. Our review only examines the FFS component of the  PERM program, and within the FFS component, those improper  payments identified through reviews of documentation. Medicaid FFS  claims are also subject to data processing reviews and these reviews are  not within the scope of our review.

We conducted this performance audit from August 2017 to March 2019 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Medicare and Medicaid FFS are federal health care programs, though  there are certain distinctions between the programs’ coverage and  financing. Medicare coverage policies are generally established at the  national level, and the program directly pays providers for services  rendered. Medicaid is a federal-state program, and states are provided  flexibility to design their coverage policies. State Medicaid agencies pay  providers for services rendered, and the federal government and states  share in the financing of the program, with the federal government  matching most state expenditures.

Estimating Improper Payments in Medicare and Medicaid

The Improper Payments Information Act of 2002 (IPIA), as amended,  requires federal executive branch agencies to report a statistically valid  estimate of the annual amount of improper payments for programs  identified as susceptible to significant improper payments. To  accomplish this, agencies follow guidance for estimating improper  payments issued by OMB. According to the HHS-OIG, which conducts  annual compliance reviews and regularly reviews the estimation  methodology for both the Medicare FFS and Medicaid improper payment  measurement programs, the methodology for both programs’ estimates  comply with federal improper payment requirements.

To estimate improper payments in Medicare and Medicaid FFS,  respectively, CMS’s CERT and PERM contractors randomly sample and  manually review medical record documentation associated with FFS  claims for payment from providers, also known as medical reviews. The  CERT and PERM programs project the improper payments identified in  the sample to all FFS claims to estimate improper payment amounts and  rates for the programs nationally for a given fiscal year. For Medicare, the  CERT contractor conducted medical reviews on about 50,000 Medicare  claims in fiscal year 2017. For Medicaid, the PERM contractor conducted  medical reviews on nearly 31,000 Medicaid claims across fiscal years  2015, 2016, and 2017 to estimate fiscal year 2017 improper payments.  Although IPIA, as amended, only requires agencies to develop one  improper payment estimate for each identified program, both the CERT  and PERM programs also estimate national service-specific improper  payment amounts and rates to identify services at high risk for improper  payment. Additionally, the PERM program estimates state-level improper  payment rates based on the amounts of improper payments identified  through medical reviews in each state.

The CERT and PERM contractors conduct medical reviews to determine  whether claims were paid or denied properly in accordance with program  coverage policies—including coverage policies based on statutes,  regulations, other CMS coverage rules, and each state’s coverage  policies in the case of Medicaid. To perform medical reviews, trained  clinicians review documentation—such as progress notes, plans of care,  certificates of medical necessity, and physician orders for services—to  ensure that claims meet program coverage policies.

In general, Medicare and Medicaid documentation requirements define  the documentation needed to ensure that services are medically  necessary and demonstrate compliance with program coverage policies.  For example, Medicare home health services must be supported by  documentation demonstrating compliance with the coverage policy that  beneficiaries be homebound, among other requirements. Certain  coverage policies and documentation requirements were implemented to  help reduce the potential for fraud, waste, and abuse. For example,  Medicare implemented a requirement that DME providers maintain  documentation demonstrating proof of item delivery, to better ensure  program integrity. (Figure 1 presents an example of a progress note to  support the medical necessity of Medicare home health services. See  App. III for additional examples of provider documentation).

The CERT and PERM contractors classify improper payments identified  through medical review by the type of payment error. Two types of errors  are related to documentation—no documentation and insufficient  documentation.

No documentation: Improper payments in which providers fail to  submit requested documentation or respond that they do not have the  requested documentation.

Insufficient documentation: Improper payments in which providers  submit documentation that is insufficient to determine whether a claim  was proper, such as when there is insufficient documentation to  determine if services were medically necessary, or when a specific,  required documentation element, such as a signature, is missing.

In fiscal year 2017, insufficient documentation comprised the majority of  estimated FFS improper payments in both Medicare and Medicaid, with  64 percent of Medicare and 57 percent of Medicaid medical review  improper payments. Improper payments stemming from insufficient  documentation in Medicare FFS increased substantially starting in 2009,  while insufficient documentation in Medicaid has remained relatively  stable since 2011 (see Fig. 2).

CMS has attributed the increase in Medicare insufficient documentation  since 2009 in part to changes made in CERT review criteria. Prior to  2009, CERT medical reviewers used “clinical inference” to determine that  claims were proper even when specific documentation was missing if,  based on other documentation and beneficiary claim histories, the  reviewers could reasonably infer that the services were provided and  medically necessary. Beginning with CMS’s fiscal year 2009 CERT  report, in response to 2008 HHS-OIG recommendations, CMS revised the  criteria for CERT medical reviews to no longer allow clinical inference and  the use of claim histories as a source of review information. More recent  policy changes that added to Medicare documentation requirements may  have also contributed to the increase in insufficient documentation in  Medicare FFS.

CMS’s Medicare and Medicaid Contractors Make Multiple Attempts to Contact Providers to Obtain Documentation to Estimate Improper Payments

Medicare’s CERT and Medicaid’s PERM contractors make multiple  attempts to contact providers to request medical record documentation for  medical reviews, and review all documentation until they must finalize the  FFS improper payment estimate. The CERT and PERM contractors allow  providers 75 days to submit documentation, though providers can  generally submit late documentation up to the date each program must  finalize its improper payment estimate, known as the cut-off date (See  Fig. 3.). Both programs also contact providers to subsequently request  additional documentation if the initial documentation submitted by the  providers does not meet program requirements.

Initial documentation request: The CERT and PERM contractors make  initial requests for documentation by sending a letter and calling the  provider. After the initial provider request, if there is no response, the  contractors contact the provider at least three additional times to remind  them to submit the required documentation. If there is no response, the  claim is determined to be improper due to no documentation. Claims are  also classified as improper due to no documentation when the provider  responds but cannot produce the documentation, such as providers that  do not have the beneficiary’s documentation or records for the date of  service, among other reasons (see Table 1). For referred services, such  as home health, DME, and laboratory services, the CERT contractor also  conducts outreach to referring physicians to request documentation. For  example, for a laboratory claim, the CERT contractor may contact the  physician who ordered the laboratory test to request associated  documentation, such as progress notes. Conversely, the PERM  contractor told us they generally do not contact referring physicians to  request documentation.

Subsequent documentation request: If a provider initially submits  documentation that is insufficient to support a claim, then the CERT and  PERM contractors subsequently request additional documentation.

In fiscal year 2017, of the 50,000 claims in the CERT sample, the  contractor requested additional documentation from 22,815  providers. Providers did not submit additional documentation to  sufficiently support 56 percent of the associated claims.

For the 3 years that comprise the 2017 Medicaid improper payment  rate, of the nearly 31,000 claims in the PERM sample, the contractor  requested additional documentation for 5,448, and providers did not  submit additional documentation to sufficiently support about 8  percent of the 5,448 claims.

In addition to having similar outreach to providers for obtaining  documentation, the CERT and PERM contractors also have processes to  refer suspected fraud to the appropriate program integrity entity, to  ensure the accuracy of medical reviews, and to allow providers to dispute  improper payment determinations.

Suspected fraud: When CERT and PERM contractors identify claims  with evidence of suspected fraud, they are required to refer the claims to  other program integrity entities that are responsible for investigating  suspected fraud. CERT and PERM contractor officials said that in 2017,  the CERT contractor referred 35 claims, and the PERM contractor did not  make any referrals.

Interrater reliability (IRR) reviews: As a part of their medical review  processes, both the CERT and PERM contractors conduct IRR reviews,  where two reviewers conduct medical reviews on the same claim and  compare their medical review determinations. These IRR reviews ensure  the consistency of medical review determinations and processes for  resolving differences identified through the IRR reviews. CMS staff said  that they also review a sample of the CERT and PERM contractors’  payment determinations to ensure their accuracy.

CERT: The contractor performs IRR reviews for at least 300 claims  each month, including claims with and without improper payment  determinations.

PERM: The contractor conducts IRR reviews of all improper payment  determinations, except improper payments due to no documentation,  and 10 percent of all correctly paid claims in the sample, which  combined was about 3,600 claims for the fiscal year 2017 national  improper payment rate.

Disputing improper payment determinations: Both CERT and PERM  contractors have processes in place for disputing the CERT or PERM  contractor’s improper payment determinations. These processes involve  reviewing the claim, including any newly submitted documentation, and  may result in upholding or overturning the initial improper payment  determination. Improper payment determinations that are overturned prior  to the CERT and PERM contractors’ cut-off dates are no longer  considered improper, and estimated improper payment amounts and  rates are adjusted appropriately.

CERT: Medicare Administrative Contractors, which process and pay  claims, may dispute the CERT contractor’s improper payment  determinations first with the CERT contractors and then, if desired,  with CMS. Additionally, Medicare providers can appeal the CERT  contractor’s improper payment determinations through the Medicare  appeals process.

PERM: State Medicaid officials may dispute the PERM contractor’s  improper payment determinations first with the PERM contractor and  then, if desired, with CMS. Providers are not directly involved in this  process; instead, providers can contact the state to appeal the  improper payment determination.

Differing Medicare and Medicaid Documentation Requirements May Result in Inconsistent Assessments of Program Risks

Differences in Documentation Requirements for Medicare and Medicaid May Result in Differing Improper Payment Rates and Assessments of Program Risks

We found that Medicare, relative to Medicaid, had a higher estimated FFS  improper payment rate primarily due to insufficient documentation in fiscal  year 2017. According to CMS data, across all services in fiscal year 2017,  the rate of insufficient documentation was 6.1 percent for Medicare and  1.3 percent in Medicaid, substantially greater than the difference in rates  for all other types of errors, which were 3.4 and 1.0 percent, respectively.  For home health, DME, and laboratory services, the insufficient  documentation rate was at least 27 percentage points greater for  Medicare than for Medicaid, and for hospice services, the rate was 9  percentage points greater (see Fig. 4).

Differences between Medicare and Medicaid coverage policies and  documentation requirements likely contributed to the substantial variation  in the programs’ insufficient documentation rates for the services we  examined. Among the services we examined, there are four notable  differences in coverage policy and documentation requirements that likely  affected how the programs conducted medical reviews: face-to-face  examinations; prior authorization; signature requirements; and  documentation from referring physicians for referred services, as  discussed below.

Face-to-face examinations. In part to better ensure program integrity,  the Patient Protection and Affordable Care Act established a requirement  for referring physicians to conduct a face-to-face examination of  beneficiaries as a condition of payment for certain Medicare and Medicaid  services. States were still in the process of implementing the policies for  Medicaid in fiscal year 2017. include narrative information that  sufficiently supported that the  beneficiary had a life expectancy of  less than 6 months.   include the certification date span. documentation supporting that the referring physician conducted an  examination when certifying the medical necessity of the service.  Hospice providers must submit documentation of a face-to-face  examination when recertifying the medical necessity of hospice  services for beneficiaries who receive care beyond 6 months after  their date of admission. (See sidebar for examples of insufficient  documentation in Medicare hospice services.) CMS officials told us  that documentation requirements for the face-to-face examination  policy for home health services in particular led to an increase in  insufficient documentation. When initially implemented in April 2011,  home health providers had to submit separate documentation from  the referring physician detailing the examination and the need for  home health services. Beginning January 2015, CMS changed the  requirement to allow home health providers to instead use  documentation from the referring physician, such as progress notes,  to support the examinations. CMS and several stakeholders attributed  recent decreases in the home health improper payment rate to the  amended documentation requirement (see Fig. 5). agency did not apply to the sampled day  of care associated with the claim. health and DME services in Medicaid in 2016; however, the  requirement likely did not apply to many claims subject to fiscal year  2017 PERM medical reviews. Medicaid does not have a face-to-face  policy for hospice services, and most states we interviewed did not  have such policies. (See sidebar for examples of insufficient  documentation in Medicaid.)

Prior authorization. Medicare does not have the same broad authority  as state Medicaid agencies to implement prior authorization, which can  be used to review documentation and verify the need for coverage prior to  services being rendered. State Medicaid agencies we spoke with credit  prior authorization with preventing improper payments from being paid in  the first place.

CMS has used prior authorization in Medicare for certain services  through temporary demonstration projects and models, as well as one  permanent program. In April 2018, we found that savings from a  series of Medicare temporary demonstrations and models that began  in 2012 could be as high as about $1.1 to $1.9 billion as of March  2017. We recommended that CMS take steps, based on its  evaluations of the demonstrations, to continue prior authorization.

All six of our selected states use prior authorization in Medicaid for at  least one of the four services we examined. In particular, all six  selected states require prior authorization for DME, and five require  prior authorization for home health. Officials from several states  noted that they often apply prior authorization to services at high risk  for improper payments, and most told us that prior authorization  screens potential improper payments before services are rendered.  We did not evaluate the effectiveness of states’ use of prior  authorization, or review the documentation required by states for prior  authorization. (See Fig 6 for an example state Medicaid prior  authorization form.)

Physician signatures: While both Medicare and state Medicaid agencies  require signatures on provider documents to ensure their validity,  Medicare has detailed standards for what constitutes a valid signature. physician did not support the medical  necessity for the specific type of catheter  ordered. variety of situations. For example, illegible signatures and initials on  their own are generally invalid, though they are valid when over a  printed name.

Examples of insufficient documentation in  Medicare laboratory

Documentation from the referring  physician did not support the order or an  intent to order the billed laboratory tests.

In Medicaid, PERM contractor staff told us that state agencies  generally have not set detailed standards for valid signatures, and that  reviewers generally rely on their judgment to assess signature validity.

Documentation from the referring  physician did not support that the  beneficiary’s currently has diabetes for a  billed laboratory test for the management  and control of diabetes.

Documentation for referred services. Medicare requires documentation  from referring physicians to support the medical necessity of the referred  services that we examined—home health, DME, and laboratory  services—but Medicaid generally does not require such documentation.

Medicare generally requires documentation from the referring  physician, such as progress notes, to support the medical necessity of  referred services. CMS officials told us that Medicare requires such  documentation from referring physicians to ensure that medical  necessity determinations are independent of the financial incentive to  provide the referred service, particularly as certain referred services  are high risk for fraud, waste, and abuse. (See sidebar for examples  of insufficient documentation in Medicare home health, DME, and  laboratory services.)

In Medicaid, documentation requirements to support the medical  necessity of referred services are primarily established by states, and  states generally do not require documentation, such as progress  notes from referring physicians, to support medical necessity. Further,  PERM contractor staff told us that they generally do not review such  documentation when conducting medical reviews of claims for  referred services.

Officials from CMS, the CERT contractor, and provider associations told  us that Medicare’s documentation requirements for referred services  present challenges for providers of referred services to submit sufficient  documentation since they are dependent on referring physician  documentation to support medical necessity. Some officials further stated  that referring physicians may lack incentive to ensure the sufficiency of  such documentation, as they do not experience financial repercussions  when payments for referred services are determined to be improper.  Officials told us that:  It is generally not standard administrative practice for laboratories or  DME providers to obtain referring physician documentation, and  referring physicians may not submit them when the referred services  are subject to medical review. For example, laboratories generally  render services based solely on physician orders for specific tests,  and generally do not obtain associated physician medical records.

Referring physicians may not document their medical records in a way  that meets Medicare documentation requirements to support the  medical necessity of referred services. Officials from a physician  organization told us that physicians refer beneficiaries for a broad  array of services, and face challenges documenting their medical  records to comply with Medicare documentation requirements for  various referred services. We previously reported on CMS provider  education efforts and recommended that CMS take steps to focus  education on services at high risk for improper payments and to better  educate referring physicians on documentation requirements for DME  and home health services. CMS agreed with and has fully  addressed our recommendation.

Medicare and Medicaid pay for many of the same services, to some of  the same providers, and likely face many of the same underlying program  risks. However, because of differences in documentation requirements  between the two programs, the same documentation for the same service  can be sufficient in one program but not the other. The substantial  variation in the programs’ improper payment rates raise questions about  how well their documentation requirements help in determining whether  services comply with program coverage policies, and accordingly help  identify causes of program risks. This is inconsistent with federal internal  control standards, which require agencies to identify, analyze, and  respond to program risks.

CMS officials attributed any differences in the two programs’  documentation requirements to the role played by the states in  establishing such requirements under Medicaid, and told us that they  have not assessed the implications of how differing requirements  between the programs may lead to differing assessments of the  programs’ risks. CMS relies on improper payment estimates to help  develop strategies to reduce improper payments, such as informing  Medicare’s use of routine medical reviews, educational outreach to  providers, and efforts to address fraud. Without a better understanding  of how documentation requirements affect estimates of improper  payments, CMS may not have the information it needs to effectively  identify and analyze program risks, and develop strategies to protect the  integrity of the Medicare and Medicaid programs.

CMS Has Ongoing Efforts to Examine Insufficient Documentation in Medicare and Revise Documentation Requirements

CMS’s Patients over Paperwork initiative is an ongoing effort to simplify  provider processes for complying with Medicare FFS requirements,  including documentation requirements. Although CMS officials said this  initiative is intended to help providers meet documentation requirements  in both Medicare and Medicaid, current efforts only address Medicare  documentation requirements. As part of the initiative, CMS solicited  comments from stakeholders through proposed rulemaking on  documentation requirements that often lead to insufficient documentation,  and CMS officials stated that they have met with provider associations to  obtain feedback. The initiative is generally focused on reviewing  documentation requirements the agency has the authority to easily  update, namely requirements that are based on CMS coverage rules, as  opposed to requirements based on statute. Through this initiative, CMS  has clarified and amended several Medicare documentation  requirements. For example, CMS clarified Medicare documentation  requirements for DME providers to support proof of item delivery.

As part of another initiative to examine insufficient documentation in  Medicare, CMS found that 3 percent of improper payments due to  insufficient documentation were clerical in nature in fiscal year 2018. For  the CERT’s fiscal year 2018 medical reviews, the CERT contractor  classified whether improper payments due to insufficient documentation  were clerical in nature—meaning the documentation supported that the  service was covered and necessary, had been rendered, and was paid  correctly, but did not comply with all Medicare documentation  requirements. Such errors would not result in an improper payment  determination if the documentation had been corrected. For example,  such clerical errors may involve missing documentation elements that  may be found elsewhere within the medical records.

According to CMS officials, the information gathered on clerical errors  may inform efforts to simplify documentation requirements. Specifically,  CMS plans to use this information to help identify requirements that may  not be needed to demonstrate medical necessity or compliance with  coverage policies. CMS said that it does not plan to engage in similar  efforts to examine insufficient documentation errors in Medicaid because  of challenges associated with variations in state Medicaid documentation  requirements and the additional burden it would place on states.

Medicaid Medical Reviews May Not Provide Actionable Information for States, and Other Practices May Compromise Fraud Investigations

Medicaid Medical Reviews Do Not Provide Robust State-Specific Information; Resulting Corrective Actions May Not Address the Most Prevalent Causes of Improper Payments

On a national basis, CMS’s PERM program generates statistically valid  improper payment estimates for the Medicaid FFS program. At the state  level, however, CMS officials told us that the PERM contractor’s medical  reviews do not generate statistically generalizable information about  improper payments by service type and, as a result, they do not provide  robust state-specific information on the corrective actions needed to  address the underlying causes of improper payments.

According to CMS, the number of improper payments identified through  medical reviews is too small to generate robust state-specific results. In  fiscal year 2017, the PERM contractor identified 918 improper payments  nationwide out of nearly 31,000 claims subjected to medical reviews.  More than half of all states had 10 or fewer improper payments identified  through medical reviews in fiscal year 2017, and these made up about 7  percent of total sample improper payments identified through medical  reviews (see Table 2).

According to CMS officials, estimating improper payments for specific  service types within each state with the same precision as the national  estimate would involve substantially expanding the number of medical  reviews conducted and commensurately increasing PERM program  costs. CMS officials also estimated federal spending on PERM Medicaid  FFS medical reviews at about $8 million each year, which does not  include state costs, the federal share of the state costs, or providers’  costs. Of our six selected states, officials from one state said that data  on service-specific improper payment rates at the state level would be  useful, though officials had reservations about increasing sample sizes  because of the resources involved in doing so.

CMS requires state Medicaid agencies to develop corrective actions to  rectify each improper payment identified. However, since the Medicaid  review sample in a state typically is not large enough to be statistically  generalizable by service type, the identified improper payments may not  be representative of the prevalence of improper payments associated  with different services within the state. Accordingly, corrective actions  designed to rectify specific individual improper payments may not address  the most prevalent underlying causes of improper payments. For  example, state Medicaid officials in four of our six states said that most  improper payments identified through PERM medical reviews are unique  one-time events. Federal internal control standards require agencies to  identify and analyze program risks so they can effectively respond to such  risks, and OMB expects agencies to implement corrective actions that  address underlying causes of improper payments. Without estimates  that provide information on the most prevalent underlying causes of  improper payments within a state, particularly by service type, a state  Medicaid agency may not be able to develop appropriate corrective  actions or prioritize activities to effectively address program risks.  Corrective actions that do not address the underlying causes of improper  payments are unlikely to be an effective use of state resources.

Increasing sample sizes of the PERM is one approach that could improve  the usefulness of the medical reviews for states—but other options also  exist. For example, PERM findings could be augmented with data from  other sources—such as findings from other CMS program integrity efforts,  state auditors, and HHS-OIG reports. States conduct their own program  integrity efforts, including medical reviews, to identify improper payments  and state Medicaid officials we spoke with in four of our six selected  states said that they largely rely on such efforts to identify program risks.  One state’s Medicaid officials said that state-led audits allow them to  more effectively identify—and subsequently monitor—services that are at  risk for improper payments in the state. CMS also could use data from  other sources on state-specific program risks to help design states’  PERM samples. These options could help CMS and the states better  identify the most prevalent causes of improper payments and more  effectively focus corrective actions and program integrity strategies to  address program risks.

CMS Policy May Limit State Identification of Medicaid Providers Under Fraud Investigation

State Medicaid agencies may, but are not required to, determine whether  providers included in the PERM sample are under fraud investigation and  notify the PERM contractor. Under CMS policy, when a state notifies the  PERM contractor of a provider under investigation, the contractor will end  all contact with the provider to avoid compromising the fraud  investigation, and the claim will be determined to be improper, due to no  documentation. In fiscal year 2017, of the 328 Medicaid improper  payments due to no documentation, 27 (8 percent) from five states,  according to CMS, were because the provider was under fraud  investigation.

If a state Medicaid agency does not notify the PERM contractor about  providers under fraud investigation, the PERM contractor will conduct its  medical review, which involves contacting the provider to obtain  documentation as a part of its normal process, and communicate about  improper payment determinations. Contacting providers that are under  fraud investigation as part of PERM reviews could interfere with an  ongoing investigation, such as in the following ways we identified based  on information from the Association of Certified Fraud Examiners and  others.

The contact by the PERM contractor to request documentation,  although unrelated to the fraud investigation, may give the impression  that the provider is under heightened scrutiny. This could prompt the  provider to change its behavior, or to destroy, falsify, or create  evidence. These actions could in turn disrupt or complicate law  enforcement efforts to build a criminal or civil case.

The PERM contractor’s communication about improper payment  determinations may prompt states to conduct educational outreach to  the provider about proper billing procedures. This may inadvertently  change the billing practices of a fraudulent provider for whom law  enforcement is trying to establish a pattern of behavior.

We found that states may not have processes to determine whether  providers included in the PERM sample are under fraud investigation. Of  the six states we spoke with, officials from two states said they did not  have a mechanism in place to identify providers under fraud investigation.  However, it is a best practice for investigative and review entities to  communicate and coordinate with one another to determine if multiple  entities are reviewing the same provider and for investigators to work  discreetly without disrupting the normal course of business, based on our  analysis of information from the Association of Certified Fraud Examiners  and others. Accordingly, investigators should be aware of other  government entities that are in contact with providers under investigation,  such as the PERM contractor, who may contact providers multiple times  to request documentation, and refer identified improper payments for  recovery. If multiple entities are reviewing the same provider, one entity  may be directed to pause or cease its activities, such as a PERM medical  review, to reduce the risk of compromising an active fraud investigation.  CMS has stated that it is not the agency’s intention to negatively impact  states’ provider fraud investigations and, therefore, it has provided states  the option to notify the PERM contractor of any providers under  investigation to avoid compromising investigations. However, CMS does  not require states to determine whether providers under PERM medical  reviews are also under fraud investigation, which creates the potential  that PERM reviews could interfere with ongoing investigations.

State Medicaid agencies may not have incentives to notify the PERM  contractor of providers under fraud investigation, as doing so will  automatically result in a no documentation error, which increases states’  improper payment rates. Medicaid officials from one state we spoke with  said that while they check whether providers subject to PERM reviews  are under investigation for fraud, they do not report these instances to the  PERM contractor because the PERM contractor would find a no  documentation error and the claim would be cited as improper, increasing  the state’s improper payment rate. Officials from another state said this  policy penalizes states, in the form of higher state-level improper payment  rates that may reflect poorly on states. Additionally, officials from this  state were reluctant to develop corrective actions for improper payments  stemming from such no documentation errors.

CMS and states need information about the underlying causes of  improper payments to develop corrective actions that will effectively  prevent or reduce future improper payments in Medicare and Medicaid  FFS. The substantial variation in Medicare and Medicaid estimated  improper payment rates for the services we examined raise questions  about how well the programs’ documentation requirements ensure that  services were rendered in accordance with program coverage policies.  While our study focused on certain services with high rates of insufficient  documentation, differences in documentation requirements between the  programs may apply to other services as well. Without examining how the  programs’ differing documentation requirements affect their improper  payment rates, CMS’s ability to better identify and address FFS program  risks and design strategies to assist providers with meeting requirements  may be hindered.

At the state level, PERM medical reviews do not provide robust  information to individual states. CMS’s requirements to address individual  improper payments may lead states to take corrective actions that may  not fully address underlying causes of improper payments identified  through medical review, and may misdirect state efforts to reduce  improper payments. Absent a more comprehensive review of existing  sources of information on the underlying causes of Medicaid improper  payments, CMS and states are missing an opportunity to improve their  ability to address program risks. In addition, the lack of a requirement for  state Medicaid agencies to determine whether providers whose claims  are selected for PERM medical reviews are also under fraud investigation  risks compromising ongoing investigations. Further, citing such claims as  improper payments in states’ estimated improper payment rates may  discourage state Medicaid agencies from notifying the PERM contractor  that a provider is under investigation.

We are making the following four recommendations to CMS:  The Administrator of CMS should institute a process to routinely  assess, and take steps to ensure, as appropriate, that Medicare and  Medicaid documentation requirements are necessary and effective at  demonstrating compliance with coverage policies while appropriately  addressing program risks. (Recommendation 1)

The Administrator of CMS should take steps to ensure that Medicaid  medical reviews provide robust information about and result in  corrective actions that effectively address the underlying causes of  improper payments. Such steps could include adjusting the sampling  approach to reflect state-specific program risks, and working with  state Medicaid agencies to leverage other sources of information,  such as state auditor and HHS-OIG findings. (Recommendation 2)

The Administrator of CMS should take steps to minimize the potential  for PERM medical reviews to compromise fraud investigations, such  as by directing states to determine whether providers selected for  PERM medical reviews are also under fraud investigation and to  assess whether such reviews could compromise investigations. (Recommendation 3)

The Administrator of CMS should address disincentives for state  Medicaid agencies to notify the PERM contractor of providers under  fraud investigation. This could include educating state officials about  the benefits of reporting providers under fraud investigation, and  taking actions such as revising how claims from providers under fraud  investigation are accounted for in state-specific FFS improper  payment rates, or the need for corrective actions in such cases. (Recommendation 4)

We provided a draft of this report to HHS for comment, and its comments  are reprinted in appendix I. HHS also provided us with technical  comments, which we incorporated in the report as appropriate.

HHS concurred with our first recommendation that CMS institute a  process to routinely assess and ensure that Medicare and Medicaid  documentation requirements are necessary and effective. HHS stated  that CMS’s Patients over Paperwork initiative is focused on simplifying  Medicare documentation requirements and noted that for the Medicaid  program, CMS will identify and share documentation best practices with  state Medicaid agencies. CMS’s Patients over Paperwork initiative may  help CMS streamline Medicare documentation requirements. However,  we believe CMS should take steps to assess documentation  requirements in both programs to better understand the variation in the  programs’ requirements and their effect on estimated improper payment  rates. Without an assessment of how the programs’ documentation  requirements affect estimates of improper payments, CMS may not have  the information it needs to ensure that Medicare and Medicaid  documentation requirements are effective at demonstrating compliance  and appropriately address program risks.

HHS did not concur with our second recommendation that CMS ensure  that Medicaid medical reviews provide robust information about and result  in corrective actions that effectively address the underlying causes of  improper payments. HHS noted that increasing the PERM sample size  would involve increasing costs and state Medicaid agencies’ burden, and  that incorporating other sources of information into the PERM sample  design could jeopardize the sample’s statistical validity. HHS also  commented that it already uses a variety of sources to identify and take  corrective actions to address underlying causes of improper Medicaid  payments. We acknowledge that increasing the sample size would  increase the costs of the PERM medical review program, though the level  of improper payments warrants continued action. Further, under the  current approach, we found that CMS and state Medicaid agencies are  expending time and resources developing and implementing corrective  actions that may not be representative of the underlying causes of  improper payments in their states. It is important that corrective actions  effectively and efficiently address the most prevalent causes of improper  payments, and our report presents options that could improve the  usefulness of the PERM’s medical reviews—such as augmenting medical  reviews with other sources of information during the development of  corrective actions. We continue to believe that corrective actions based  on more robust information would help CMS and state Medicaid agencies  more effectively address Medicaid program risks.

HHS concurred with our third and fourth recommendations that CMS  minimize the potential for PERM medical reviews to compromise fraud  investigations and address disincentives for state Medicaid agencies to  notify the PERM contractor of providers under fraud investigation. In its  comments HHS described the actions it has taken and is considering  taking to implement these recommendations.

We are sending copies of this report to appropriate congressional  committees, to the Secretary of Health and Human Services, the  Administrator of CMS, and other interested parties. In addition, the report  is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-7114, or cosgrovej@gao.gov or yocomc@gao.gov.  Contact points for our Offices of Congressional Relations and Public  Affairs may be found on the last page of this report. GAO staff who made  key contributions to this report are listed in appendix IV.

Appendix I: Comments from the Department of Health and Human Services

Appendix II: Fiscal year 2018 Medicare Improper Payment Data

During the period of our review, fiscal year 2017 data represented the  most recent, complete data for both Medicare and Medicaid fee-for- service (FFS) estimated improper payment amounts and rates. As of  March 2019, the Centers for Medicare & Medicaid Services published the  fiscal year 2018 Medicare FFS Supplemental Improper Payment Data  report, but had not published the 2018 Medicaid FFS Supplemental  Improper Payment Data report. The Centers for Medicare & Medicaid  Services estimated Medicare FFS spending of $389 billion, and $32  billion in improper payments.

Table 3 below presents updated fiscal year 2018 data for the Medicare  improper payment data by the services examined in our report.

Appendix III: Selected Examples of Medical Record Templates for Medicare and Medicaid Providers

Medicare and state Medicaid agencies have released template medical  record documentation, such as certificates of medical necessity and plans  of care that providers may use to document information necessary to  ensure compliance with coverage policies. This appendix presents  examples of such templates.

Figure 7 presents a Medicare template that referring physicians can use  to certify beneficiary need for home health services.

Figure 8 presents a Medicare template that referring physicians can use  to certify beneficiary need for home oxygen supplies.

Figure 9 presents a template from the Indiana Medicaid program that  hospices may use to document beneficiary plans of care.

Appendix IV: GAO Contacts and Staff Acknowledgments

In addition to the contact named above, Leslie V. Gordon (Assistant  Director), Michael Erhardt (Analyst-in-Charge), Arushi Kumar, and Dawn  Nelson made key contributions to this report. Also contributing were Sam  Amrhein, Vikki Porter, and Jennifer Rudisill.

Medicare and Medicaid review medical record documentation to ensure that they're only paying eligible doctors and hospitals for medically necessary, covered services. These reviews found an estimated $27.5 billion in payment errors due to insufficient documentation in FY 2017.

We found that Medicare and Medicaid have different documentation requirements for some of the same services, contributing to substantially different estimated error rates.

We recommended that the programs look into their documentation requirements, and more.

Both programs are on our High Risk List.