Medicare Physician Services: Spending On and Use of Billing Codes for Comprehensive Care Planning Services

Medicare's physician fee schedule contains over 8,000 billing codes for office visits, surgical procedures, or other services provided to beneficiaries. Some provider groups have concerns that these codes do not sufficiently account for the LCCP-type services they provide to Medicare beneficiaries with complex medical needs.

The BBA included a provision that GAO examine billing codes that may be used for LCCP-type services for beneficiaries with a serious or life-threatening illness.

GAO identified, among other things, (1) existing Medicare physician fee schedule billing codes that can be used to bill LCCP-type services; and (2) trends in Medicare spending on these services from 2013 through 2017.

GAO reviewed Centers for Medicare & Medicaid Services (CMS) billing code manuals and American Medical Association (AMA) code descriptors to identify existing codes containing key components of LCCP-type services; analyzed Medicare Part B claims data from 2013 to 2017 (the most recent available at the time of GAO's review); and interviewed officials from CMS and 19 stakeholders, including the AMA, national physician groups, and other provider groups that had previously given input on the topic to Congress.

GAO provided a draft of this report to the Department of Health and Human Services (HHS). In response, HHS provided technical comments, which GAO incorporated as appropriate.

The 2018 Bipartisan Budget Act (BBA) defined longitudinal comprehensive care planning (LCCP) as services involving an interdisciplinary team of providers who develop and communicate a care plan to Medicare beneficiaries diagnosed with a serious or life-threatening illness. GAO identified at least 58 billing codes in Medicare's physician fee schedule that could be used by providers to bill for services that cover some or all of the LCCP service components as defined in the 2018 BBA —referred to by GAO as LCCP-type services. The 58 billing codes may be used individually or in combination, depending on a beneficiary's medical needs. Stakeholders representing providers told GAO their members generally use one or a combination of these codes to bill for LCCP-type services.

Forty-five of the 58 codes are broadly-defined longstanding codes that can be used for LCCP-type services as well as other services such as the treatment of a specific medical complaint.

The remaining 13 codes are more recent narrowly-defined codes introduced starting in 2013 that only cover LCCP-type services. They include transitional care management services introduced in 2013, chronic care management starting in 2015, advance care planning in 2016, and behavioral health integration in 2017.

GAO found that overall Medicare spending on LCCP-type services that were billed to the 58 codes increased from $26 billion in 2013 to almost $29 billion in 2017. While narrowly-defined services accounted for a small share of this total spending ($467 million in 2017), spending on these narrowly-defined services such as chronic care management increased rapidly. Moreover, spending growth on narrowly-defined services was driven by increased use of these services rather than increases in reimbursement rates. From 2013 through 2017, more beneficiaries received and more providers billed for narrowly-defined services. The number of Medicare beneficiaries receiving these services grew from about 267,000 to about 2.5 million. The number of providers billing these services grew from about 31,000 to about 100,000.

Over two-thirds of the 39 million beneficiaries enrolled in Medicare’s  traditional fee-for-service program in 2017 had two or more serious health  conditions, such as diabetes and heart disease. The often complex nature  of these types of conditions and the treatments for them generally  necessitate care planning and coordination among providers in different  medical specialties. For example, a beneficiary with diabetes and heart  disease may be simultaneously under the care of a primary care  physician, an endocrinologist, a cardiologist, and a podiatrist, highlighting  the need for planning and coordination of care to ensure that services are  not being duplicated and that all providers involved in the patient’s care  share important clinical information and have clear expectations about  their roles in the patient’s care.

Providers have historically billed Medicare for care planning and  coordination services using one or more of the over 8,000 billing codes in  the program’s physician fee schedule. The specific code or codes a  provider uses depends on the time, skill, and complexity of the medical  decision-making required for each patient’s unique needs. In particular,  evaluation and management (E/M) billing codes—codes used to bill for  face-to-face patient visits that are provided in various settings such as  physicians’ offices or hospitals—are widely used by all physicians  regardless of their specialty, accounting for over half of the $69.1 billion  spent on all physician fee schedule services in 2017. However, certain  physician specialties (largely those specializing in primary care) have  raised longstanding concerns that E/M codes do not adequately account  for the amount of time they spend in planning and coordinating care for  beneficiaries with complex medical needs.

The Bipartisan Budget Act of 2018 (2018 BBA) defines longitudinal  comprehensive care planning (LCCP) as a service that includes the  following five components: a conversation with a beneficiary diagnosed with a serious or life- shared decision-making through an interdisciplinary team that  includes a physician, registered nurse, and social worker; development of a longitudinal comprehensive care plan (care plan)  that is discussed with the beneficiary that addresses the progression  of the disease and treatment options; a care plan that addresses the beneficiary’s goals, values, and a care plan that discusses the availability of other resources or social  supports that may help mitigate the beneficiary’s health risks.

The 2018 BBA included a provision that we examine Medicare Physician  Fee Schedule billing codes established by the Centers for Medicare &  Medicaid Services (CMS)—the agency within the Department of Health  and Human Services (HHS) that administers the Medicare program—that  may be used for care planning services provided to beneficiaries  diagnosed with a serious or life-threatening illness or illnesses. We refer  to these services as LCCP-type services because they cover some or all  of the LCCP service components as defined in the 2018 BBA.  1.  existing Medicare Physician Fee Schedule billing codes that providers  may use to bill for LCCP-type services;  2.  trends in Medicare spending on LCCP-type services from 2013  3.  stakeholders’ views on the need for a new billing code representing  the LCCP service as defined in the 2018 BBA.

To examine existing Medicare Physician Fee Schedule billing codes that  providers may use to bill for LCCP-type services, we reviewed relevant  information from CMS and the American Medical Association (AMA) and  interviewed key stakeholders. Specifically, we identified billing codes  included in one of the six main categories of codes under Medicare’s  2018 physician fee schedule that would most likely cover some or all of  the LCCP service components as defined in the 2018 BBA. To identify  these codes, we reviewed the code descriptors, claims processing  manuals, and other documents from the Medicare Learning Network on  CMS’s website. We also reviewed CMS’s proposed and final Medicare  Physician Fee Schedule rules from 2012 to 2019 to understand the  agency’s rationale for establishing these codes. Based on our review of  these materials, we developed a preliminary list of billing codes that could  be used to bill for LCCP-type services. As part of our analysis, we  identified the extent to which these codes include the five key  components of the LCCP service as defined in the 2018 BBA. To do this,  we reviewed information from the AMA’s RBRVS DataManager, a  database that includes detailed ‘vignettes’ describing the components of  services provided to a typical patient under each billing code. We also  reviewed estimates of physician and non-physician time used to provide  these services to a typical patient, using publically available time files  from the CMS website. (See app. I for a sample vignette and app. II for  our alignment of the five key LCCP components with equivalent  components in our list of selected billing codes.) We finalized our  preliminary list of billing codes based on our review of this information as  well as input from CMS and 19 stakeholders, including the AMA,  physician specialty societies, and other provider groups. To identify these  stakeholders, we reviewed a list of over 300 organizations that had  participated in a Chronic Care Working Group organized by the Senate  Committee on Finance in 2015. We narrowed the list to national umbrella  organizations representing a mix of physician and non-physician groups  (such as the American College of Physicians and the National  Association of Social Workers) that had specifically commented on the  need for a new billing code. (See app. III for a list of stakeholders.)

To determine trends in Medicare spending on LCCP-type services, we  analyzed Medicare Part B claims data from 2013 through 2017 for the  specific billing codes we identified as covering LCCP-type services. We  examined trends in spending and utilization on these services, including  the number of beneficiaries receiving these services and the number of  providers billing for these services. We report spending and utilization  trends in the aggregate as well as by provider specialty (for example,  internal medicine or family practice), and by setting (for example, facility  settings such as hospitals and hospices, and nonfacility settings such as  physicians’ offices). We assessed the reliability of the Medicare claims  data in several ways, including reviewing relevant CMS data  documentation, performing manual and electronic tests of the data to  identify any outliers or anomalies, and comparing it with data from  published sources. We determined that the claims data were sufficiently  reliable for the purposes of our reporting objectives.

To obtain stakeholder perspectives on the need for a new billing code for  the LCCP service as defined in the 2018 BBA, we interviewed CMS and  the 19 stakeholder groups we had selected for our study and reviewed  written materials they provided to us. We obtained their perspectives on  the extent to which the billing codes we had identified covered the LCCP  service as defined in the 2018 BBA. Where stakeholders expressed  support for a new billing code, we obtained their perspectives on how the  new code should be structured, including beneficiary and provider  eligibility, and the frequency with which the service could be billed (e.g.  one-time, monthly, or as needed). Where available, we analyzed relevant  information or data, including CMS final rules, code descriptors from  AMA’s RBRVS DataManager, and Medicare Part B utilization data found  on the CMS website, to corroborate or provide additional context for  stakeholders’ testimonial evidence.

We conducted this performance audit from July 2018 to July 2019 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

CMS uses the Medicare Physician Fee Schedule to pay physicians and  other providers for services delivered to beneficiaries. Physicians and  other providers bill Medicare for their services using various five-digit  billing codes based in part on codes developed by an AMA panel. Each  year, the panel receives proposals from provider groups and others to  revise existing billing codes or create new codes. The panel requires  those who submit proposals to develop a clinical vignette that describes  the typical patient who would receive the service, the diagnosis and  relevant conditions, and estimates of time that physicians might spend in  providing the service for the typical patient. The panel applies several  criteria in reviewing these proposals. For example, a new code  should represent a unique, well-defined procedure or service clearly  identified and distinguished from existing procedures and services;  should not fragment an existing procedure or service represented by  one or more existing codes;  should reflect the typical (not extraordinary) circumstances related to  the delivery of the service;  should be performed by many physicians or other qualified health  care professionals across the United States; and  should be consistent with current medical practice.

CMS pays providers a fixed amount known as the Medicare fee for each  code. The fees are based on relative values—estimates of resources for  the physician’s work (time, skill, and level of training), and practice  expenses (the costs of running a practice such as salaries of non- physician employees, rent, and overhead) required to provide a service  relative to all other services. In setting fees, CMS also does not allow  certain codes to be billed together if it deems that payment for one code  is already included in another. CMS establishes and updates relative  values annually. By law, the effect of any changes to its payment rates  generally must be budget neutral. That is, if total spending increases by  more than $20 million each year, including due to the creation of new  billing codes, fees for all services would have to be reduced accordingly.

Services billed under the physician fee schedule may be provided in a  variety of settings, including physicians’ offices and institutional settings  such as hospitals, skilled nursing facilities and hospices. Non-physicians  may also bill or be reimbursed by Medicare for services under certain  circumstances. For example, some types of non-physicians practicing  independently—such as physician assistants and nurse practitioners— may bill Medicare for certain services that they are legally authorized to  perform under their respective state laws. In other instances, physicians  may bill as if they had furnished services that were provided by non- physician staff that they employ or with whom they have a contractual  relationship as long as the physician has an established relationship with  the beneficiary, and is on the premises to provide supervision if  necessary.

Providers and other stakeholders have noted that they care for an elderly  population with increasingly complex medical conditions who receive care  from multiple providers across different sites of care including physicians’  offices, hospitals, nursing homes, and hospices. As such, the focus of  primary care has shifted from treating specific medical conditions to  increased care coordination and planning. CMS also noted that a new  trend in care planning is the use of shared care plans between the  beneficiary and the provider rather than those created solely by the  provider. These jointly developed care plans can be particularly important  to improving overall beneficiary outcomes for beneficiaries with serious  illnesses and also allow other providers involved in the beneficiary’s care  access to timely information that supports planned care.

However, stakeholders have suggested that Medicare’s payment system  does not fully reimburse providers for such care planning services. For  example, some note that the E/M billing codes that primary care  physicians generally use to bill for their services were developed at a time  when care coordination and planning was not part of the standard  practice of medicine; as such, these codes do not reflect time spent on  activities that do not require a face-to-face encounter with the beneficiary,  including medical conferences with other physicians, or telephone calls to  coordinate care with other providers. Some primary care physicians have  requested that CMS conduct a comprehensive review of existing E/M  codes to ensure they account for time spent on these services, or develop  new codes that primary care physicians may exclusively use to bill for  these services. However, others have noted that E/M codes have been  reviewed and valued by the AMA, and the codes account for the time  spent on these services. Moreover, they have stated that care  coordination and planning services are delivered by multiple specialties,  not just primary care physicians.

Medicare’s Physician Fee Schedule Contains at Least 58 Billing Codes That Providers May Use to Bill for LCCP-Type Services

Our analysis identified at least 58 Medicare Physician Fee Schedule  billing codes that providers may use to bill for LCCP-type services.  These 58 billing codes generally contain components we determined to  be equivalent to the five key components of the LCCP service as defined  in the 2018 BBA. For example, all 58 codes included a provision for the  development of a care plan that addresses the beneficiary’s goals,  values, and preferences, and a provision for coordination with other  providers, which is equivalent to the LCCP component related to  interdisciplinary care. Providers may choose a single code or a  combination of these codes to account for the time, skill, and resources  needed to deliver the service based on the unique health needs of each  patient. (See app. IV for more information on the 58 codes and the LCCP  components they contain as defined in the 2018 BBA.)

The 58 billing codes for LCCP-type services include 45 longstanding,  broadly-defined codes and 13 narrowly-defined codes that were more  recently introduced starting in 2013.

Broadly-defined codes. Of the 45 broadly-defined codes, 39 are E/M  codes that have existed for decades. E/M codes are broadly defined to  include services provided to treat a variety of illnesses (for example,  treatment of a particular medical complaint), but they may also be used to  bill for LCCP-type services. In general, the E/M codes range in complexity  from low to high depending on the amount of time the provider spends  with a patient as well as the complexity of the medical condition(s) being  treated. E/M codes may also be billed if more than 50 percent of the time  allotted for the service is spent on counseling and care coordination—for  example, explaining treatment options and ways to mitigate the patient’s  health risks—which are key components of the LCCP service as defined  in the 2018 BBA.

The E/M codes we identified as representing LCCP-type services were  the more complex codes that had estimates of time that may be spent  providing the service to a typical patient ranging from 30 to 120 minutes  of physician time and 3 to 71 minutes of non-physician time. While the  majority of E/M codes have existed for decades, CMS added six new E/M  codes starting in 2008—referred to as “prolonged” E/M codes—allowing  payment for additional time for care planning and care management  services for complex conditions.

Narrowly-defined codes. Starting in 2013, CMS added 13 narrowly- defined LCCP-type codes to better account for the time spent  coordinating care for patients with complex treatment needs. CMS  implemented these more narrowly-defined care planning codes largely in  response to provider complaints that E/M codes did not sufficiently  account for extensive care management/coordination of care that was  required across multiple providers and settings. Unlike broadly-defined  codes, these narrowly-defined codes can only be used for LCCP-type  services.

The 13 narrowly-defined LCCP-type codes fall into four types: transitional  care management (TCM), chronic care management (CCM), advance  care planning (ACP), and behavioral health integration (BHI). (See table  1.) While some pertain to patients with specific types of health conditions  or in certain settings, others are more general and may be used for a  range of health conditions.

The estimates of physician and non-physician time that may be spent on  the broadly-defined and narrowly-defined codes vary, as does Medicare’s  2019 fees for these billing codes—see examples of commonly used  LCCP-type billing codes in table 2 and see appendix IV for related  information on all 58 LCCP-type billing codes. For example, some  stakeholders told us they might bill a complex E/M code (99214) along  with a CCM code (99487). As our analysis shows, this combination could  result in the provider spending 66 minutes of physician time and 113  minutes of non-physician time for a typical beneficiary, and receiving total  Medicare fees of about $203 in 2019.

Medicare Spending Increased for All LCCP-Type Services and Increased More Rapidly for New Narrowly-Defined Services That Were Furnished to More Beneficiaries by More Providers

Medicare Spending on All LCCP-Type Services Increased by 11 Percent from 2013 through 2017, While Spending on Narrowly-Defined Services Grew More Rapidly

Overall Medicare spending on LCCP-type services represented by the 58  billing codes we identified increased from $26 billion in 2013 to $29 billion  in 2017, an 11 percent increase. The vast majority of this spending— about $28.3 billion in 2017—was on services represented by the 45  broadly-defined codes we identified earlier (henceforth we refer to these  services as “broadly-defined services.”) By comparison, Medicare  spending on LCCP-type services represented by the 13 narrowly-defined  codes (henceforth referred to as “narrowly-defined services”) was about  $467 million in 2017.

Though smaller in terms of total dollars, spending on narrowly-defined  services grew at a higher rate than spending on broadly-defined services,  from about $2 per beneficiary in 2013 to $14 per beneficiary in 2017. This  higher rate in growth can mostly be attributed to these four new types of  services being introduced during this 4 year period. For example, as  Table 1 shows, two TCM codes were introduced in 2013 and four CCM  codes were introduced from 2015 to 2017. In contrast, spending growth for broadly-defined services was much smaller, increasing from about  $785 per beneficiary in 2013 to $844 per beneficiary in 2017. For all other  Medicare Physician Fee Schedule services combined, per-beneficiary  spending decreased from about $1,488 in 2013 to $1,426 in 2017.

Spending on CCM and TCM services accounted for most of the total  spending on narrowly-defined LCCP-type services from 2013 to 2017.  (See fig. 1.) For example, in 2017, TCM services accounted for almost  half ($213 million of the total spending of $467 million), while spending on  CCM services accounted for over a third ($162 million of the $467  million).

The growth in spending on narrowly-defined services was driven by  increased utilization—that can be attributed in part to the development of  new codes for these services—rather than increases in Medicare fees for  these services. Specifically, utilization of narrowly-defined services  increased from about 9 services per 1,000 beneficiaries in 2013 to about  177 services per 1,000 beneficiaries in 2017. Average Medicare fees for  these services remained flat during this period.

More Beneficiaries Received and More Providers Billed for Narrowly-Defined LCCP- Type Services, with a Small Share of Beneficiaries and Providers Accounting for Most of the Services

The number of beneficiaries receiving narrowly-defined LCCP-type  services increased substantially from 2013 to 2017, as more of these  Medicare billing codes were added and began to be utilized during this  time. Specifically, in 2017, about 2.5 million beneficiaries received  narrowly-defined LCCP-type services, representing an 839 percent  increase from about 267,000 beneficiaries in 2013. (See fig. 2.)

While the overall number of beneficiaries receiving narrowly-defined  services increased, these services were concentrated among a relatively  small share of Medicare beneficiaries. Specifically, one-quarter of  beneficiaries who received any of the narrowly-defined services in 2017  received 62 percent of the approximately 6 million services that were  provided that year. (See fig. 3.)

In 2017, of the total 2.5 million beneficiaries that received narrowly- defined services, 90 percent received only one type of narrowly-defined  LCCP-type service. (See fig. 4.) In contrast, only 10 percent of  beneficiaries received multiple types of narrowly-defined LCCP-type  services, the most common combination being CCM and ACP.

Mirroring beneficiary trends, the number of Medicare providers billing for  narrowly-defined LCCP-type services also increased significantly from  2013 through 2017, as these Medicare billing codes were established and  began to be utilized during this time. In 2017, a total of about 100,000  providers billed for narrowly-defined services, representing a 227 percent  increase from about 31,000 providers in 2013. (See fig. 5.)

As with beneficiary trends, while the overall number of providers billing  narrowly-defined services grew from 2013 to 2017, billing for these  services was also increasingly concentrated among a small share of  providers. Specifically, in 2017, 10 percent of providers who billed for any  narrowly-defined services billed about 76 percent of the approximately 6  million services that were provided in that year. (See fig. 6.)

Each year from 2013 through 2017, physicians specializing in internal  medicine accounted for the largest share of spending on narrowly-defined  LCCP-type services. In 2017, internal medicine accounted for 45 percent  of the $467 million in total Medicare spending on narrowly-defined  services. (See fig. 7.) Family practice and nurse practitioners were the  other specialties accounting for the greatest shares of spending.

In terms of the setting in which narrowly-defined LCCP-type services  were provided, the majority were provided in nonfacility settings such as  physicians’ offices. Specifically, in 2017, 94 percent of narrowly-defined  services were provided in nonfacility settings. This trend was consistent  over each of the 5 years from 2013 to 2017.

Stakeholders Had Mixed Views on Whether a New Billing Code for an LCCP Service Is Needed

Six Stakeholders Did Not Support Creating a New Billing Code for an LCCP Service

Six of the 19 stakeholders we interviewed did not support the creation of  a new billing code for an LCCP service as defined in the 2018 BBA. Two  of these—representing physician specialties that together accounted for  almost one-fifth of total spending on LCCP-type services in 2017—stated  that the existing billing codes were sufficient for them to provide and bill  for the full range of the LCCP service. They stated that billing either a  single code or a combination of an E/M code and one or more of the 13  narrowly-defined LCCP-type codes we identified allowed them to account  for the full range of the LCCP service as defined in the BBA. As such, the  two stakeholders said, there was no need for a new billing code.

The remaining four stakeholders expressed concerns about creating a  new billing code for an LCCP service. These concerns included the  following:

Overlap with existing codes that require the development of care  plans: While not explicitly stating that existing codes were sufficient,  some stakeholders said that if a new billing code were created for the  LCCP service as defined in the 2018 BBA, it would overlap with or  duplicate existing billing codes. For example, three stakeholders  noted potential overlap with existing billing codes, such as the ACP  and CCM. Three stakeholders said that the care plan that would be  required under the new LCCP code would duplicate existing care  plans that are required by law for beneficiaries in hospices or skilled  nursing facilities. In addition, two stakeholders noted that providers  in their specialty already prepare detailed care plans as a standard  practice of care when evaluating their patients and billing for these  services using existing E/M billing codes. They stated that these care  plans exceed the components of the care plan specified in the 2018  BBA. Stakeholders noted that the existence of multiple overlapping  codes that include the development of a care plan could create  confusion for providers in choosing the most appropriate billing code.

Concerns about code proliferation or code fragmentation: Several  stakeholders were concerned that adding another code to Medicare’s  billing system could result in increased Medicare spending and less,  rather than more, care coordination. Specifically, two stakeholders  stated that having multiple billing codes for care planning and care  management, respectively, would have the potential to increase  spending because multiple providers could start billing the new codes  even though one provider may have primary responsibility for the  beneficiary. (In contrast, under the existing billing codes a single  code that encompassed both types of services could be billed.) For  example, one of these stakeholders said that primary care physicians  generally referred beneficiaries with complex treatment needs to a  surgeon or specialist who then both planned and managed the  beneficiary’s care, yet the primary care physician might also bill the  care planning billing code. In addition to the potential for increased  Medicare spending, three stakeholders said that code  fragmentation—splitting existing billing codes into multiple codes for  services that were previously bundled together—was contrary to the  comprehensive patient-centered model of care that Medicare was  moving towards. Specifically, one provider stated that under such a  model, rather than billing multiple different codes for care planning  and coordination, a primary care practice is paid a monthly  management fee to (among other things) improve care coordination  for patients who receive most of their primary care services from that  practice.

Thirteen Stakeholders Stated That a New LCCP Code Could Address Concerns Regarding Interdisciplinary Care Reimbursement and Other Limitations They Identified in Existing Billing Codes

While six of the stakeholders we interviewed did not support creating a  new LCCP code, the remaining 13 stakeholders told us that such a billing  code is needed. According to the stakeholders, a new LCCP code as  defined in the 2018 BBA could address several concerns they identified in  Medicare’s existing billing codes related to the provision of the LCCP  service. However, some of these concerns could be addressed under the  current Medicare billing framework, as shown by our analysis of available  data. For example, stakeholders identified the following limitations that  could be addressed by a new LCCP code:  Inadequate reimbursement for time spent on interdisciplinary care:  The 13 stakeholders stated that Medicare’s existing billing codes  either did not require or did not sufficiently reimburse them for the time  spent on interdisciplinary care. They stated there should be a  separate code to reimburse this type of care. However, stakeholders  representing two specialties told us they had proposed such a code to  the AMA but the AMA had rejected their proposals because  interdisciplinary care is already accounted for in the existing billing  codes. Moreover, as our analysis of the 58 billing codes shows, the  majority of these codes include a provision for consultation and  coordination among providers that is equivalent to input from an  interdisciplinary team. With regard to inadequate reimbursement, as  another stakeholder noted, providers may bill a complex E/M service  along with a narrowly-defined LCCP-type service such as CCM. The  total reimbursement for such a combination of codes would be about  $203 as of 2019. (See table 2.)

Insufficient physician time for care planning: Six stakeholders  representing a mix of primary care and medical specialties stated the  existing billing codes (including the more complex E/M codes) had  insufficient physician time to provide both care planning and care  management, which they maintained are separate and distinct  activities. They stated a new code could include the appropriate time  needed. One stakeholder said that care planning requires at least 30  minutes of time, and the complex E/M codes do not allow providers to  bill for the time it takes to provide both the care management of a  complex patient as well as care planning for the patient. According to  the stakeholder, for example, if a provider bills a complex E/M code  that allows for 40 minutes of physician time, that is insufficient to  provide both types of services. While CMS has recently established  new prolonged E/M codes (which allow for an additional 60 minutes of  time), the stakeholder noted that they do not address the problem of  insufficient time because a prolonged E/M code may only be billed  with a companion E/M code, and the threshold of time needed to bill  the two codes together is now too high—specifically 40 minutes for  the complex E/M code plus 60 minutes for the prolonged E/M code.  However, our review of CMS guidance on billing of prolonged E/M  codes shows that providers do not have to meet the full 60 minutes of  time in order to bill a prolonged E/M code; they may bill it as long as  the total time spent on the visit exceeds the typical time for the E/M  visit plus 30 minutes.

Documentation requirements: Three stakeholders, largely  representing primary care and medical specialties, stated that  burdensome documentation requirements for the more complex E/M  codes hampered their ability to bill these codes. They suggested  that a new billing code could be structured similar to the new ACP or  CCM codes which do not have the same documentation  requirements. While these stakeholders expressed concern regarding  documentation as a discouraging factor, our analysis of 2017  Medicare claims data showed that certain specialties, including some  that had expressed this concern, billed the more complex codes at a  significantly higher rate than the average across all specialties. This  may indicate that these documentation requirements do not  necessarily preclude providers from billing these codes. For example,  83 percent of all the E/M new patient visits billed by geriatricians in  2017 were billed using the more complex E/M codes, compared to 48  percent on average. Similarly, 80 percent of all the E/M established  patient visits billed by clinical psychologists in 2017 were billed using  the more complex E/M codes compared to 50 percent on average.  See appendix V for details on billing patterns for all medical  specialties.

Inability of non-physician staff to independently bill for care planning:  Seven stakeholders expressed concerns that non-physician staff such  as nurses and social workers cannot independently bill the existing  Medicare billing codes that we identified as being LCCP-type  services. As one stakeholder explained, non-physician staff may  spend time providing coordination and care planning services  separately rather than concurrently with the physician, but they cannot  bill for this time independently because the physician was not present.  These stakeholders stated that a new LCCP code that could be billed  by physicians and non-physicians that participated in the care  planning process could address this issue. However, other  stakeholders expressed concerns about the effect on Medicare  spending if multiple providers billed for an LCCP service. Moreover,  reimbursement for non-physicians is built into Medicare fees.  Specifically, Medicare’s fee for each billing code includes  reimbursement for physician’s time as well as their practice expenses  (which cover the costs of non-physician staff), and when the AMA  panel develops resources estimates for each billing code (upon which  Medicare fees are based), it considers the amount of non-physician  time spent on that code. Certain non-physician practitioners, such as  nurse practitioners and physician assistants, may also independently  bill services under the Medicare Physician Fee Schedule subject to  certain requirements, and as specified in their scope of practice under  state law.

Stakeholders generally concurred that if a new LCCP code were  implemented, the definition of interdisciplinary care should be flexible and  not require a social worker. Currently, the LCCP billing code as defined in  the 2018 BBA requires that the interdisciplinary team providing care  planning services include a social worker. However, 13 stakeholders  stated that a typical practice did not include a social worker, but rather  included a nurse who might perform the functions of a social worker. They  stated that smaller office-based medical practices could not afford to hire  a social worker. The stakeholders concurred that social workers were  generally available in larger integrated practices (such as a single or  multiple groups aligning with each other or with a larger hospital system)  and in facility settings such as hospitals or skilled nursing facilities.  (Stakeholders also provided other comments on the structure of a  potential new billing code for the LCCP service should such a code be  established by CMS, which we summarize in app. VI.)

We provided a draft of this report to HHS for review and comment. HHS  provided technical comments, which we incorporated as appropriate.

We are sending copies of this report to the appropriate congressional  committees, the Secretary of Health and Human Services, and other  interested parties. In addition, the report is available at no charge on the  GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-7114 or farbj@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. GAO staff who made major contributions to this report are  listed in appendix VII.

Appendix I: Example of an American Medical Association Vignette

Appendix II: Longitudinal Comprehensive Care Planning Service Components in the Balanced Budget Act of 2018

Appendix II: Longitudinal Comprehensive Care  Planning Service Components in the Balanced  Budget Act of 2018 Pub. L. No. 115-123, § 50342(c)(4), 132 Stat. 211.

Appendix III: Stakeholder Groups Interviewed by GAO

Appendix IV: Medicare Physician Fee Schedule Billing Codes for Longitudinal Comprehensive Care Planning (LCCP)-Type Services

We identified 58 billing codes in Medicare’s physician fee schedule that  may be used to bill for LCCP-type services as defined in the Balanced  Budget Act of 2018 (2018 BBA). Figure 9 shows relevant information on  these billing codes including the short descriptor, beneficiary eligibility  criteria, our analysis of whether the billing code’s components are  equivalent to the components of an LCCP service as defined in the 2018  BBA, and Medicare’s 2019 fee.

Appendix V: Specialty Billing of Complex Evaluation and Management Codes in 2017

Medicare’s physician fee schedule contains evaluation and management  (E/M) codes that providers may use to bill for face-to-face visits in their  offices or other settings such as hospitals. These codes range in  complexity from low to high depending on the amount of time the provider  spends with a patient as well as the complexity of the medical decision-  making and the medical condition(s) being treated. Table 4 shows the  percentage of each specialty’s E/M visits that were billed as complex  visits (moderate or high complexity). In general, primary care and medical  sub-specialties tended to bill complex visits at a higher rate than the all- specialty average, while surgical specialties tended to bill complex visits  at a lower rate than the all-specialty average.

Appendix VI: Longitudinal Comprehensive Care Planning (LCCP) Services: Stakeholder Perspectives on Potential New Billing Code

We interviewed 19 stakeholders including national umbrella groups of  physicians and other providers to obtain their perspectives on the  structure of a new billing code for LCCP-type services as defined in the  Balanced Budget Act of 2018 (2018 BBA), regardless of whether they  supported the creation of a new code. Stakeholders were generally in  agreement that a new billing code for LCCP-type services as defined in  the 2018 BBA, if implemented, should be broadly defined. Specifically,  stakeholders stated that it should not be tied to a specific condition,  should allow for both in-person and non-face-to-face services performed  when the beneficiary was not present, should be billable more than once,  should be available for billing by both primary care physicians and  specialists, and should have restrictions to avoid duplicative billing with  existing billing that provided overlapping services. However,  stakeholders had more mixed views about what these specific restrictions  should be. Stakeholder views about the various structural components or  restrictions included the following:

Applicable medical conditions: The majority of stakeholders (13 of the  17 who responded to this question) stated that the new code should  be broadly defined although they differed in their opinions of what  broadly-defined meant; one stakeholder cautioned against an overly  broad definition, and one suggested pilot testing with a discrete list of  conditions.

Of the 13 stakeholders in favor of a broad definition, 12 stated that  the new billing code should not be tied to any particular specific  illness or medical condition but should be flexible in structure.  Three stakeholders stated that the extent of beneficiaries’ daily  functioning or quality of life should also be considered when  defining applicable medical conditions. For example, a beneficiary  who is not necessarily suffering from a life-threatening illness but  is unable to perform the functions of daily living (such as bathing  and eating) needs extensive care planning and should therefore  be covered under the new LCCP-type service. Three stakeholders  stated that the new code should be billable if a beneficiary’s  existing diagnosis of a serious illness changed. Three  stakeholders stated that a potential new code could be modeled  along the lines of existing billing codes—specifically the advance  care planning (ACP) or chronic care management (CCM) codes— which do not specify any particular medical condition.

Two stakeholders said that a new code should not be so broad  that it could apply to a vast majority of beneficiaries. For example,  one stakeholder stated that the American Medical Association  would likely not approve a code for a generic serious condition  because it would be difficult to differentiate that code from an  existing billing code, such as an evaluation and management  (E/M) code, which may be used for any medical condition  including serious, life-threatening conditions.

One stakeholder suggested pilot testing the code with a discrete  list of conditions, with the intention of expanding the list  afterwards.

In-person or non-face-to-face: The majority of stakeholders (12 of the  15 that responded to this question) stated that a potential new code  should allow for both in-person and non-face-to-face activities (such  as virtual or telehealth—providing clinical care remotely by two-way  video, phone calls with the beneficiary or to arrange referrals or  coordinate care with other providers when the beneficiary was not  present); three said it should only include face-to-face activities.

Twelve stakeholders stated that the visit should include both types  of activities. For example, one stakeholder said the initial visit for  LCCP-type services should be in-person, and follow up activities  such as updating a care plan or remote patient monitoring  (monitoring of patients outside of conventional settings) could be  non-face-to-face.

Three stakeholders said it should only include face-to-face  activities either because of concerns about the potential for  overbilling if the new code included non-face-to-face activities  which might be difficult to verify or because other existing codes,  such as CCM, already cover non-face-to-face activities.

Frequency of billing: All of the 16 stakeholders responding to this  question concurred that the new code should be billable more  frequently than on a one-time basis, although opinions varied on the  exact frequency.

Nine stakeholders said the code should be billable on an ongoing  basis as the beneficiary’s condition changes. For example, one  said that the new code should be on-going because the care  planning and treatment would continue to evolve over time as the  beneficiary’s condition changes.

Seven other stakeholders said that while it should not be an  ongoing service, it should be billable more frequently than once.  For example, one stakeholder specified that it could be billed once  per month or over every three months, but that a target end date  must be specified; otherwise, it would be too similar to existing  billing codes such as the CCM code that may be billed monthly.  Two other stakeholders said it could be billed up to 4-5 times a  year.

Other billing restrictions: All 12 stakeholders responding to this  question indicated that restrictions would be necessary to avoid  overlap with existing billing codes. For example, three stakeholders  suggested that the new code could be billed along with an E/M code  for additional services not covered by the E/M code as long as it does  not overlap with other existing codes that account for additional time  beyond an E/M visit (such as the prolonged E/M visit billing codes).  One suggested that it should not be billed along with any of the  existing narrowly-defined LCCP-type codes, including CCM,  transitional care management, or the ACP codes. One did not specify  any particular code with which the new code should not be billed, but  cautioned that care should be taken to ensure that time spent with the  beneficiary was reported only once.

Providers eligible to bill the code: The majority of stakeholders (13 of  the 15 that responded to this question) stated that both primary care  physicians and specialists should be eligible to bill the new code. Two  of these stakeholders said that there should also be a requirement  that the billing physician has an established relationship with the  beneficiary. Two stakeholders said that only specialists should bill  since they are generally the ones attending to the beneficiary’s  serious illness. Two stakeholders stated that non-physicians  (including social workers) should also be able to bill the code as long  as they are currently allowed to bill separately under the Medicare  Physician Fee Schedule.

Appendix VII: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Karen Doran, Assistant Director;  Iola D’Souza, Analyst-in-Charge; Sarah Belford; Krister Friday; John  Lalomio; and Daniel Ries made key contributions to this report. Also  contributing were George Bogart and Muriel Brown.

A majority of Medicare's 39 million beneficiaries in 2017 had a serious condition, such as diabetes or heart disease. Treatment in these kinds of cases may require planning and coordination among an array of medical specialists.

We looked at how doctors and other health care providers bill Medicare for care planning and how much was spent on these services.

We found at least 58 Medicare codes providers can use to bill for some aspect of care planning—with 13 of them specifically for care planning. In 2017, spending on these 13 codes was about $467 million.


Consumer Data Protection: Action Needed to Strengthen Oversight of Consumer Reporting Agencies

CRAs collect, maintain, and sell to third parties large amounts of sensitive data about consumers, including Social Security numbers and credit card numbers. Businesses and other entities commonly use these data to determine eligibility for credit, employment, and insurance. In 2017, Equifax, one of the largest CRAs, experienced a breach that compromised the records of at least 145.5 million consumers.

This statement is based on GAO's February 2019 report on the CRA oversight roles of FTC and CFPB. This statement summarizes (1) measures FTC has taken to enforce CRA compliance with requirements to protect consumer information, (2) measures CFPB has taken to ensure CRA protection of consumer information, and (3) actions consumers can take after a breach.

In its February 2019 report, GAO found that since 2008, the Federal Trade Commission (FTC) has settled 34 enforcement actions against various entities related to consumer reporting violations of the Fair Credit Reporting Act (FCRA), including 17 actions against consumer reporting agencies (CRA). Some of these settlements included civil penalties—fines for wrongdoing that do not require proof of harm—for FCRA violations or violations of consent orders. However, FTC does not have civil penalty authority for violations of requirements under the Gramm-Leach-Bliley Act (GLBA), which, unlike FCRA, includes a provision directing federal regulators and FTC to establish standards for financial institutions to protect against any anticipated threats or hazards to the security of customer records. To obtain monetary redress for these violations, FTC must identify affected consumers and any monetary harm they may have experienced. However, harm resulting from privacy and security violations can be difficult to measure and can occur years in the future, making it difficult to trace a particular harm to a specific breach. As a result, FTC lacks a practical enforcement tool for imposing civil money penalties that could help to deter companies, including CRAs, from violating data security provisions of GLBA and its implementing regulations.

Since 2015, the Consumer Financial Protection Bureau (CFPB) has had five public settlements with CRAs. Four of these settlements included alleged violations of FCRA; and three included alleged violations of unfair, deceptive, or abusive practices provisions. CFPB is also responsible for supervising larger CRAs (those with more than $7 million in annual receipts from consumer reporting) but lacks the data needed to ensure identification of all CRAs that meet this threshold. Identifying additional sources of information on these CRAs, such as by requiring them to register with the agency through a rulemaking or leveraging state registration information, could help CFPB ensure that it can comprehensively carry out its supervisory responsibilities. After the Equifax breach, CFPB used its existing supervisory authority to examine the data security of certain CRAs. CFPB's process for prioritizing which CRAs to examine does not routinely include an assessment of companies' data security risks, but doing so could help CFPB better detect such risks and prevent the further exposure or compromise of consumer information.

Consumers can take actions to mitigate the risk of identity theft—such as implementing a fraud alert or credit freeze—and can file a complaint with FTC or CFPB. However, consumers are limited in the direct actions they can take against CRAs. Consumers generally cannot exercise choice in the consumer reporting market—such as by choosing which CRAs maintain their information—if they are dissatisfied with a CRA's privacy or security practices. In addition, according to CFPB, consumers cannot remove themselves from the consumer reporting market entirely.

In its February 2019 report, GAO recommended that Congress consider giving FTC civil penalty authority to enforce GLBA's safeguarding provisions. GAO also recommended that CFPB (1) identify additional sources of information on larger CRAs, and (2) reassess its prioritization of examinations to address CRA data security. CFPB neither agreed nor disagreed with GAO's recommendations.

I am pleased to be here today to discuss our recent work on the oversight  of consumer reporting agencies’ (CRA) data protection. As you know,  CRAs collect, maintain, and sell to third parties large amounts of sensitive  data about consumers, including Social Security numbers and credit card  numbers. The 2017 data breach of Equifax highlighted the data security  risks associated with CRAs and underscored the importance of  appropriate federal oversight in this market where consumers have  limited control over whether or which CRAs possess their information.

This statement is based on our February 2019 report. For this work, we  focused on the CRA oversight roles of the Federal Trade Commission  (FTC) and the Consumer Financial Protection Bureau (CFPB). FTC and  CFPB have taken steps to enforce CRA compliance with requirements to  protect consumer information. However, this statement and our report  identified specific actions that could strengthen the oversight of these  companies and better protect consumers from the compromise of their  personal information.

This statement discusses (1) measures FTC has taken to enforce CRA  compliance with requirements to protect consumer information, (2)  measures CFPB has taken to ensure CRA protection of consumer  information, and (3) actions consumers can take after a breach. For this  work, we reviewed the types of enforcement actions available to FTC and  CFPB for violations of relevant laws, as well as specific enforcement  actions these agencies have brought against CRAs. We also reviewed  CFPB examination guidance for supervising these CRAs, including  CFPB’s internal guidelines for conducting data security examinations. In  addition, we reviewed documents related to CFPB’s process for  prioritizing which institutions and which product lines should receive  supervisory examination. We interviewed officials from FTC and CFPB on  their oversight activities. We conducted the work on which this statement  is based in accordance with generally accepted government auditing  standards. More details on our methodology can be found in our February  2019 report.

FTC and, most recently, CFPB, are the federal agencies primarily  responsible for overseeing CRAs. FTC has authority to investigate most  organizations that maintain consumer data and to bring enforcement  actions for violations of statutes and regulations that concern the security  of data and consumer information. CFPB, created in 2010 by the Dodd- Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank  Act), has enforcement authority over all CRAs for violations of certain  consumer financial protection laws. In general, it also has the authority to  issue regulations and guidance for those laws. CFPB has supervisory  authority over larger market participants in the consumer reporting  market. In 2012, CFPB defined larger market participant CRAs as those  with more than $7 million in annual receipts from consumer reporting.  CFPB’s supervision of these companies includes monitoring, inspecting,  and examining them for compliance with the requirements of certain  federal consumer financial laws and regulations. As discussed below,  these laws include most provisions of the Fair Credit Reporting Act  (FCRA); several provisions of the Gramm-Leach-Bliley Act (GLBA); and  provisions of the Dodd-Frank Act concerning unfair, deceptive, or abusive  acts or practices.

Although there is no commonly agreed-upon definition of “data breach,”  the term generally refers to an unauthorized or unintentional exposure,  disclosure, or loss of sensitive information. This information can include  personally identifiable information such as Social Security numbers, or  financial information such as credit card numbers. A data breach can be  inadvertent, such as from the loss of an electronic device; or deliberate,  such as the theft of a device or a cyber-based attack by individuals or  groups, including an organization’s own employees, foreign nationals, or  terrorists. Data breaches have occurred at all types of organizations,  including private, nonprofit, and federal and state entities.

In the Equifax data breach, Equifax system administrators discovered on  July 29, 2017, that intruders had gained unauthorized access via the  Internet to a server housing the company’s online dispute portal. The  breach compromised the personally identifiable information of at least  145.5 million individuals, and included names, addresses, and birth dates;  and credit card, driver’s license, and Social Security numbers. Equifax’s  investigation of the breach identified the following factors that led to the  breach: software vulnerabilities, failure to detect malicious traffic, failure to  isolate databases from each other, and inadequately limiting access to  sensitive information such as usernames and passwords. Equifax’s public  filings after the breach noted that the company took steps to improve  security and notify individuals about the breach. Our August 2018 report  provides more information on the breach and Equifax’s response.

FTC Has Taken Enforcement Measures against CRAs but Lacks Civil Penalty Authority for GLBA Data Protection Provisions

FTC enforces compliance with consumer protection laws under  authorities provided in FCRA, GLBA, and the FTC Act. As we reported in  February 2019, according to FTC, in the last 10 years, it has brought 34  enforcement actions for FCRA violations, including 17 against CRAs. In  addition, FTC said that it has taken 66 actions against companies (not  just in the last 10 years), including CRAs, that allegedly engaged in unfair  or deceptive practices relating to data protection.

In some circumstances, FTC enforcement authority can include civil  money penalties—monetary fines imposed for a violation of a statute or  regulation. However, FTC’s civil penalty authority does not extend to  initial violations of GLBA’s privacy and safeguarding provisions. These  provisions require administrative, physical, and technical safeguards with  an emphasis on protection against anticipated threats and unauthorized  access to customer records. For violations of GLBA provisions, FTC may  seek an injunction to stop a company from violating these provisions and  may seek redress (damages to compensate consumers for losses) or  disgorgement (requirement for wrongdoers to give up profits or other  gains illegally obtained).

Determining the appropriate amount of consumer compensation requires  FTC to identify the consumers affected and the amount of monetary harm  they suffered. In cases involving security or privacy violations resulting  from data breaches, assessing monetary harm can be difficult. In  addition, consumers may not be aware that their identities have been  stolen as a result of a breach and or identity theft, and related harm may  occur years in the future. It can also be difficult to trace instances of  identity theft to specific data breaches. According to FTC staff, these  factors can make it difficult for the agency to identify which individuals  were victimized as a result of a particular breach and to what extent they  were harmed and then obtain related restitution or disgorgement. Having  civil penalty authority for GLBA provisions would allow FTC to fine a  company for a violation such as a data breach without needing to prove  the monetary harm to individual consumers. FTC staff noted that in the  case of a data breach, each consumer record exposed could constitute a  violation; as a result, a data breach that involved a large number of  consumer records could result in substantial fines.

In 2006, we suggested that Congress consider providing FTC with civil  penalty authority for its enforcement of GLBA’s privacy and safeguarding  provisions. We noted that this authority would give FTC a practical tool  to more effectively enforce provisions related to security of data and  consumer information. Following the 2008 financial crisis, Congress  introduced several bills related to data protection and identity theft, which  included giving FTC civil penalty authority for its enforcement of GLBA.  However, in the final adoption of these laws, Congress did not provide  FTC with this authority. Since that time, data breaches at Equifax and  other large organizations have highlighted the need to better protect  sensitive personal information. Accordingly, we continue to believe FTC  and consumers would benefit if FTC had such authority, and we  recommended in our February 2019 report that Congress consider  providing FTC with civil penalty authority for the privacy and safeguarding  provisions of GLBA to help ensure that the agency has the tools it needs  to most effectively act against data privacy and security violations.

CFPB Enforces and Examines CRAs for Compliance with Consumer Protection Laws but Does Not Fully Consider Data Security in Prioritizing Examinations

CFPB enforces compliance with most provisions of FCRA; several  provisions of GLBA; and the prohibition of unfair, deceptive, or abusive  acts or practices under the Dodd-Frank Act. In our February 2019  report, we noted that since 2015, CFPB has had five public settlements  with CRAs. Four of these settlements included alleged violations of  FCRA, and three included alleged violations of provisions related to  unfair, deceptive, or abusive practices. CFPB also has an ongoing  investigation of Equifax’s data breach.

Under its existing authority, CFPB has examined several larger market  participant CRAs, but may not be identifying all CRAs that meet the $7  million threshold. CFPB staff told us that as of October 2018, they were  tracking between 10 and 15 CRAs that might qualify as larger market  participants. CFPB staff told us that they believe the CRA market is highly  concentrated and there were not likely to be many larger market  participants beyond the 10 to 15 they are tracking. However, CFPB staff  said that the 10 to 15 CRAs may not comprise the entirety of larger  market participants, because CRAs’ receipts form consumer reporting  may vary from year to year, and CFPB has limited data to determine  whether CRAs meet the threshold.

Our January 2009 report on reforming the U.S. financial regulatory  structure noted that regulators should be able to identify institutions and  products that pose risks to the financial system, and monitor similar  institutions consistently. CFPB could identify CRAs that meet the larger  market participant threshold by requiring such businesses to register with it, subject to a rulemaking process and cost-benefit analysis of the burden  it could impose on the industry. Another method CFPB could use to  identify CRAs subject to its oversight would be to leverage information  collected by states. We recommended in February 2019 that CFPB  identify additional sources of information, such as through registering  CRAs or leveraging state information, that would help ensure the agency  is tracking all CRAs subject to its authority. CFPB neither agreed nor  disagreed with our recommendation.

Each year CFPB determines the institutions (for example, banks, credit  unions, non-bank mortgage servicers, and CRAs) and the consumer  product lines that pose the greatest risk to consumers, and prioritizes  these for examinations. CFPB segments the consumer product market  into institution product lines, or specific institutions’ offerings of consumer  product lines. CFPB then assesses each institution product line’s risk to  consumers at the market level and institutional level. To assess risk at the  market level, CFPB considers market size and other factors that  contribute to market risk. To assess risk at the institution level, CFPB  considers an institution’s market share within a product line, as well as  field and market intelligence. Field and market intelligence includes  quantitative and qualitative information on an institution’s operations for a  given product line, including the strength of its compliance management  systems, the number of regulatory actions directed at the institution,  findings from prior CFPB examinations, and the number and severity of  consumer complaints CFPB has received about the institution.

CFPB then determines specific areas of compliance to assess by  considering sources such as consumer complaints, public filings and  reports, and past examination findings related to the same or similar  products or institutions. Most recently, CFPB examinations of CRA’s  consumer reporting have focused on issues such as data accuracy,  dispute processes, compliance management, and permissible purposes.

Although CFPB’s examination prioritization incorporates several important  factors and sources, the process does not routinely include assessments  of data security risk, such as how institutions detect and respond to cyber  threats. CFPB staff said the bureau cannot examine for or enforce  compliance with the data security standards in provisions of GLBA and  FCRA or FTC’s implementing rules, even at larger participant CRAs. After  the Equifax breach, however, CFPB used its existing supervisory  authority to develop internal guidelines for examining data security, and  conducted some CRA data security examinations. CFPB staff said that  they do not routinely consider data security risks during their examination  prioritization process and have not reassessed the process to determine  how to incorporate such risks going forward.

Statute requires CFPB to consider risks posed to consumers in the  relevant product and geographic markets in its risk-based supervision  program. In addition, federal internal control standards state that agencies  should identify, analyze, and respond to risks related to achieving defined  objectives. This can entail considering all significant internal and external  factors to identify risks and their significance, including magnitude of  impact, likelihood of occurrence, nature of the risk, and appropriate  response. In light of the Equifax breach, as well as CFPB’s  acknowledgment of the CRA market as a higher-risk market for  consumers, it is important for CFPB to routinely consider factors that  could inform the extent of CRA data security risk such as the number of  consumers that could be affected by a data security incident and the  nature of potential harm resulting from the loss or exposure of  information. In our February 2019 report, we recommended that CFPB  assess whether its process for prioritizing CRA examinations sufficiently  incorporates the data security risks CRAs pose to consumers, and take  any needed steps identified by the assessment to more sufficiently  incorporate these risks. CFPB neither agreed nor disagreed with our  recommendation.

Regulators Inform Consumers about Protections Available and Consumers Can Take Some Actions after a CRA Data Breach

In our February 2019 report, we noted that FTC and CFPB provide  educational information for consumers on ways to mitigate the risk of  identity theft. In addition, after a breach, FTC and CFPB publish  information specific to that breach. For example, shortly after Equifax’s  announcement of the breach, FTC published information on when the  breach occurred, the types of data compromised, and links to additional  information on Equifax’s website. Similarly, CFPB released three blog  posts and several social media posts that included information on ways  that consumers could protect themselves in the wake of the breach and  special protections and actions for service members.

At any time, consumers can take actions to help mitigate the risk of  identity theft. For example, consumers can implement a credit freeze free  of charge, which can help prevent new-account fraud by restricting  potential creditors from accessing the consumer’s credit report.  Similarly, implementing a free fraud alert with a credit bureau can help  prevent fraud because it requires a business to verify a consumer’s  identity before issuing credit. However, consumers are limited in the  direct actions they can take against a CRA in the event of a data breach,  for two primary reasons. First, consumers generally cannot determine the  source of the data used to commit identity theft. As a result, it can be  difficult to link a breach by a CRA (or any other entity) to the harm a  consumer suffers from a particular incidence of identity theft, which  makes it challenging to prevail in a legal action. Second, unlike with many  other products and services, consumers generally cannot exercise choice if they are dissatisfied with a CRA’s privacy or security practices.  Specifically, consumers cannot choose which CRAs maintain information  on them. In addition, consumers do not have a legal right to delete their  records with CRAs, according to CFPB staff, and therefore cannot choose  to remove themselves entirely from the CRA market.

FTC and CFPB have noted that the level of consumer protection required  can depend on the consumer’s ability to exercise choice in a marketplace.  For example, when determining whether a practice constitutes an unfair  practice, FTC considers whether the practice is one that consumers could  choose to avoid. Similarly, according to CFPB staff, the consumer  reporting market may pose higher risk to consumers because consumers  cannot choose whether or which CRAs possess and sell their information.

Chairman Krishnamoorthi, Ranking Member Cloud, and Members of the  Subcommittee, this concludes my prepared remarks. I would be happy to  answer any questions that you may have.

If you or your staff have any questions about this statement, please  contact Michael Clements at (202) 512-8678 or clementsm@gao.gov.  Contact points for our Offices of Congressional Relations and Public  Affairs may be found on the last page of this statement. In addition to the  contact named above, John Forrester (Assistant Director), Winnie Tsen  (Analyst-in-Charge), and Rachel Siegel made key contributions to the  testimony. Other staff who made key contributions to the report cited in  the testimony are identified in the source product.

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.

Consumer reporting agencies are companies that collect, maintain, and sell vast amounts of sensitive data. In 2017, a breach at Equifax, one of the largest companies, compromised at least 145.5 million consumers' data.

Consumers have little control over what information these companies have, so federal oversight is important—and it could be improved. For example, the Consumer Financial Protection Bureau doesn't routinely consider data security risk when prioritizing its company examinations.

This testimony is based on a report in which we recommended improving federal enforcement of data safeguards and oversight of company security practices.