Testimony
Before the Senate Appropriations Committee
Subcommittee on Labor, Health and Human Services, Education
Medicare Waste, Fraud & Abuse
Statement of
June Gibbs Brown
Inspector General
Department of Health and Human Services
March 9, 2000
My statement today will focus first on our audit of Fiscal Year (FY) 1999 Medicare fee-for-service payments. This was our fourth annual estimate of the extent of fee-for-service payments that did not comply with laws and regulations. As part of our analysis, we profiled all 4 years' results and identified specific trends, where appropriate, by the major types of errors found and the types of health care providers whose claims were erroneous. Then I will briefly describe the significant findings of our audit of HCFA's FY 1999 financial statements, which is required by the Government Management Reform Act of 1994. The purpose of financial statements is to accurately portray agencies' financial operations, including what they own (assets), what they owe (liabilities), and how they spend taxpayer dollars. The purpose of our audit was to independently evaluate the statements.
Before I begin, I would like to acknowledge the cooperation and support we received from the Department, HCFA, and the General Accounting Office (GAO). The HCFA's assistance in making available medical review staff at the Medicare contractors and the peer review organizations (PRO) was invaluable in reviewing benefit payments. Also, I want to point out that we worked closely with GAO, which is responsible for auditing the consolidated financial statements of the Federal Government. The Department is one of the most significant agencies included in these Governmentwide statements.
MEDICARE PAYMENT ERRORS
Overview
With expenditures of approximately $316 billion, assets of $212 billion, and liabilities of $39 billion, HCFA is the largest component of the Department. The HCFA is also the largest single purchaser of health care in the world. In 1999, Medicare and Medicaid outlays represented 33.7 cents of every dollar of health care spent in the United States. In view of Medicare's 39.5 million beneficiaries, 870 million claims processed and paid annually, complex reimbursement rules, and decentralized operations, the program is inherently at high risk for payment errors.
Like other insurers, Medicare makes payments based on a standard claim form. Providers typically bill Medicare using standard procedure codes without submitting detailed supporting medical records. However, regulations specifically require providers to retain supporting documentation and to make it available upon request.
As part of our first audit of the HCFA financial statements for FY 1996, we began reviewing claim expenditures and supporting medical records. At HCFA's request, we have continued these reviews because of the high risk of Medicare payment errors and the huge dollar impact on the financial statements ($169.5 billion in FY 1999 fee-for-service claims).
Our primary objective each year has been to determine whether Medicare benefit payments were made in accordance with Title XVIII of the Social Security Act (Medicare) and implementing regulations. Specifically, we examined whether services were (1) furnished by certified Medicare providers to eligible beneficiaries; (2) reimbursed by HCFA's Medicare contractors in accordance with Medicare laws and regulations; and (3) medically necessary, accurately coded, and sufficiently supported in the beneficiaries' medical records.
Sampling Methodology
To accomplish our objective, we used a multistage, stratified sample design. The first stage consisted of a selection of 12 contractor quarters for FY 1999. The selection of the contractor quarters was based on probabilities proportional to the FY 1998 fee-for-service benefit payments. The second stage consisted of a stratified, random sample of 50 beneficiaries from each contractor quarter. The resulting sample of 600 beneficiaries produced 5,223 claims valued at $5.4 million for review.
For each selected beneficiary during the 3-month period, we reviewed all claims processed for payment. We first contacted each provider in our sample by letter requesting copies of all medical records supporting services billed. In the event that we did not receive a response, we made numerous follow-up contacts by letter, telephone calls, and/or onsite visits. Then medical review staff from the Medicare contractors (fiscal intermediaries and carriers) and PROs assessed the medical records to determine whether the services billed were reasonable, adequately supported, medically necessary, and coded in accordance with Medicare reimbursement rules and regulations.
Concurrent with the medical reviews, we made additional detailed claim reviews to determine whether (1) the contractor paid, recorded, and reported the claim correctly; (2) the beneficiary and the provider met all Medicare eligibility requirements; (3) the contractor did not make duplicate payments or payments for which another primary insurer should have been responsible under Medicare secondary payer requirements; and (4) all services were subjected to applicable deductible and co-insurance amounts and were priced in accordance with payment regulations.
Sample Results
Through detailed medical and audit review of a statistical selection of 600 beneficiaries nationwide with 5,223 fee-for-service claims processed for payment during FY 1999, we found that 1,034 claims did not comply with Medicare laws and regulations. By projecting these sample results, we estimated that FY 1999 net payment errors totaled about $13.5 billion nationwide, or about 7.97 percent of total Medicare fee-for-service benefit payments. This is the mid-point of the estimated range, at the 95 percent confidence level, of $9.1 billion to $17.9 billion, or 5.4 percent to 10.6 percent, respectively. As in past years, the payment errors could range from inadvertent mistakes to outright fraud and abuse, such as phony records or kickbacks. We cannot quantify what portion of the error rate is attributable to fraud.
Medical professionals detected 92 percent of the improper payments. When these claims were submitted for payment to Medicare contractors, they contained no visible errors. It should be noted that the HCFA contractors' claim processing controls were generally adequate for (1) ensuring beneficiary and provider Medicare eligibility, (2) pricing claims based on information submitted, and (3) ensuring that the services as billed were allowable under Medicare rules and regulations. However, their controls were not effective in detecting the types of errors we found.
Historical Analysis of Error Rates
Our analysis of payment errors from FY 1996 through FY 1999 demonstrates HCFA's continued vigilance in monitoring and reducing payment errors. This year's $13.5 billion estimate is, in fact, $9.7 billion less than the FY 1996 estimate. In addition, our audit results clearly show that the majority of health care providers submit claims to Medicare for services that are medically necessary, billed correctly, and sufficiently supported. For both FYs 1998 and 1999, we estimated that over 90 percent of fee-for-service payments contained no errors. This is a very positive reflection on the diligence of the health care provider community to comply with Medicare reimbursement requirements. However, our analysis shows that unsupported and medically unnecessary services continue to be pervasive problems. These two error categories accounted for more than 70 percent of the total improper payments over the 4 years.
The attached chart presents an historical analysis of improper payments by major error categories:
(1) unsupported services, (2) medically unnecessary services, (3) incorrect coding, and (4)
noncovered services and miscellaneous errors.
Unsupported Services
Unsupported services represented the largest error category every year except FY 1998, when they dropped dramatically. This year we saw a $3.4 billion increase over last year's estimate; however, these errors remained below the levels found in FYs 1996 and 1997.
Medicare regulation, 42 CFR 482.24(c) specifically requires providers to maintain records that contain sufficient support to justify diagnoses, admissions, treatments performed, and continued care. When the records were insufficient or missing, medical reviewers could not determine whether services billed were actually provided to Medicare beneficiaries, the extent of the services, or their medical necessity. It should be noted that HCFA upheld 99 percent of the overpayments identified in the FY 1998 sample and recovered about 87 percent; the remaining 13 percent has not been collected due to an ongoing investigation.
This year's estimated $5.5 billion in unsupported services consisted of $4.5 billion in claims for which medical review staff found that the documentation was insufficient to support the billed services and $1 billion in claims for which no documentation was provided. These errors were largely attributable to three provider groups: home health agencies ($1.7 billion), durable medical equipment (DME) suppliers ($1.6 billion), and physicians ($1.1 billion).
Some examples of unsupported services follow:
A home health agency was paid $84 for
a psychiatric nurse visit to a patient. While documentation evidenced that
the visit had been made, neither the patient's plan of care nor the doctor's
orders authorized the home health agency to provide the psychiatric nursing
care. As a result, medical reviewers denied the payment.
A DME supplier was paid $815 for an enteral
feeding supply kit, a gastrostomy tube, and 380 units of enteral formula.
Medical review staff concluded that the supplier's documentation was not
sufficient to support the claim because the records did not include physician
progress notes, laboratory values, radiological studies ordered, or weight
charts. In addition, because the delivery ticket did not provide individual
beneficiary information, medical reviewers were unable to determine what
products were delivered and to whom. As a result, the total payment was
denied.
A physician was paid $28 for a hospital visit. However, medical reviewers found a note in the medical records which stated, "Pt [patient] not in room." Because a patient encounter could not be verified and no other documentation substantiated the visit, the payment was denied.
Medically Unnecessary Services
Medically unnecessary services constituted a significant part of the historical error rate: 37 percent of the improper payments in both FYs 1996 and 1997, 56 percent in FY 1998, and 32 percent in FY 1999. For these errors, medical reviewers found enough documentation in the medical records to make an informed decision that the medical services or products received were not medically necessary. As in past years, Medicare contractor or PRO medical staff made decisions on medical necessity using Medicare reimbursement rules and regulations. They followed their normal claim review procedures to determine whether the medical records supported the claims.
These types of errors in inpatient prospective payment system (PPS) claims
were significant in all 4 years (FY 1996 - 39 percent of the total $8.5
billion; FY 1997 - 31 percent of the total $7.5 billion; FY 1998 - 40 percent
of the total $7 billion; and FY 1999 - 45 percent of the total $4.4 billion).
For example:
A PPS hospital was paid $3,883 to treat an inpatient with
an episode of hypoglycemia. According to medical reviewers, the patient's
condition and the treatment given did not require admission to the acute
level of care, and the patient could have been safely evaluated and treated
at a less acute level. Therefore, the entire payment was denied as medically
unnecessary.
Another PPS hospital was paid $7,642 to treat an inpatient for dehydration. The beneficiary, who was initially treated in the emergency room, was eventually admitted to the hospital's acute care unit. The beneficiary received x-rays, blood tests, IV fluids, Tylenol, and a fever work-up but was discharged the same day. Medical reviewers concluded that the patient's condition did not require acute hospital inpatient care and that the services could have been rendered in an outpatient setting. Therefore, the entire payment was denied.
Incorrect Coding
The medical industry uses a standard coding system to bill Medicare for services provided. For most of the coding errors found, medical reviewers determined that the documentation submitted by providers supported a lower reimbursement code. However, we did find a few instances of downcoding which we offset against identified upcoding situations.
Incorrect coding was the third highest error category this year, with $2.1 billion in improper payments. Physician and inpatient PPS claims accounted for 90 percent of the coding errors over the 4 years reviewed.
Examples of incorrect coding follow:
A PPS hospital was paid $9,387 for an inpatient respiratory
system surgical procedure. The medical records, however, supported a nonsurgical
procedure. Medical reviewers' correction of the procedure code produced
a lesser valued diagnosis-related group of $2,481, resulting in denial of
$6,905 of the payment.
A physician was paid $50 for a psychotherapy session which requires medical evaluation and management. According to medical review staff, the physician's records evidenced neither the time spent nor the psychotherapy services performed. However, the records supported psychiatric medication management services in an office setting, for which a lower level of service would have been appropriate. Therefore, $31 of the payment was denied.
Noncovered Services
Errors due to noncovered services consistently constituted the smallest
error category. Noncovered services are defined as those that Medicare will
not reimburse because the services do not meet Medicare reimbursement rules
and regulations. For example:
A physician was paid $30 for nail debridement. Medicare
covers this procedure if there is evidence of diabetes in the beneficiary's
medical history. However, there was no indication of diabetes in this beneficiary's
history. Therefore, the service was considered routine foot care, which
Medicare does not cover, and payment was denied.
A hospital was paid $21 for medications to an outpatient that medical reviewers determined could have been self-administered. Medications furnished in an outpatient setting are covered only if they are of a type that cannot be self-administered. As a result, medical reviewers denied the payment.
FINANCIAL STATEMENT AUDIT
Audit Opinion
For FY 1999, we are very pleased to issue the first unqualified, or "clean," audit opinion on HCFA's financial statements. In achieving this important milestone in financial accountability, HCFA has successfully resolved billions of dollars in past problems that formed the basis of our audit opinion for 3 years. Deficiencies in reporting and supporting Medicare accounts receivable, in particular, have been systemic and longstanding.
Medicare accounts receivable are debts that providers and other entities owe to HCFA. More than 50 Medicare contractors are responsible for tracking and collecting most of this debt through their claim processing systems. However, as we previously reported, their claim processing systems lacked general ledger capabilities and traditional accounting system features, such as a dual-entry process. In addition, the contractors used ad hoc spreadsheet applications to tabulate, summarize, and report information to HCFA. This reporting process was labor intensive, requiring significant manual input and reconciliations between various systems and spreadsheets. Previous audits found millions of dollars in discrepancies as a result; that is, the Medicare contractors were unable to support beginning balances, reported incorrect activity, and could not reconcile ending balances with subsidiary records.
This year HCFA embarked on an extensive effort to validate and document receivables. The project, which was jointly conducted by HCFA, my office, and two independent accounting firms, covered accounts receivable at 15 Medicare contractors (accounting for over 80 percent of the contractor receivable balance) and at the HCFA central and regional offices. The validation team identified over $2 billion in overstated and understated receivables:
This validation effort, together with HCFA's aggressive action to require that contractors maintain support for this debt, enabled us to conclude that the receivables balance was fairly presented and sufficiently documented for the first time in 4 years.
Internal Control Weaknesses
While the receivables balance was supported at the end of FY 1999, the underlying internal control environment and accounting systems still need substantial improvements, such as a basic double-entry bookkeeping system and adequate checks and balances to promptly detect errors and irregularities. These control weaknesses impair HCFA's ability to accumulate and analyze accounts receivable activity and to ensure that future receivables will be properly reflected in financial reports. These weaknesses also increase the risk that future debt may not be collected timely and that receivables may not be properly safeguarded. Compounding these problems, the HCFA central office does not routinely analyze receivable balances other than on a very aggregate level. Therefore, the FY 1999 report on internal controls again includes Medicare accounts receivable as a material weakness. Material weaknesses are defined as serious deficiencies in internal controls that can lead to material misstatements of amounts reported in subsequent financial statements unless corrective actions are taken. To ensure that future accounts receivable activity and balances are fairly stated, HCFA will need to continue a very aggressive validation effort.
The other material weaknesses noted last year also carried over:
Financial systems and reporting. Controls over financial systems and reporting remain serious concerns. The HCFA did not perform adequate analyses of accounts receivable, revenues, and expenditures to understand why fluctuations took place and to ensure that balances were correct. For example:
The HCFA had to make billions of dollars in manual adjustments to payables
and receivables before producing final, auditable financial statements in
late January 2000 -- 4 months after the fiscal year ended. In addition,
we noted that five of eight sampled Medicare contractors did not formally
reconcile paid claims activity to monthly expenditures reported to HCFA.
Without these reconciliations, the risk of material misstatement in the
financial statements increases.
Medicare electronic data processing (EDP). Because HCFA's FY 1999 resources were largely devoted to Year 2000 readiness issues, not all prior-year EDP control problems were resolved. Weaknesses remained in access controls at the HCFA central office and in application change controls at a "shared" system used by certain Medicare contractors to process and pay claims. Internal controls over Medicare systems are essential to ensure the integrity, confidentiality, and reliability of critical data while reducing the risk of errors, fraud, and other illegal acts.
Controls Over Cash Management
In a matter related to our financial statement audit, we recently reviewed certain controls over cash management. The HCFA and the Medicare contractors have agreements with several banks to maintain Medicare accounts to cover payments to providers. The HCFA expressed concerns about the way one bank handled Medicare funds related to eight fiscal intermediaries and one carrier. At HCFA's request, we reviewed the financial activities of the bank and the Medicare contractors. We noted that during an 11-day period, the bank withdrew funds from the Federal Reserve in excess of Medicare contractor expenditures. The excess ranged from $104 million to over $420 million per day and earned more than $700,000 in interest.
In addition, since 1993, the bank has routinely withdrawn funds a day earlier than needed to cover Medicare expenses and has earned interest on those funds by investing them overnight. The bank estimated that the interest earned through these overnight investments totaled $12.5 million. In 1999, HCFA advised the bank to stop this practice because it was contrary to the provisions of the agreement with HCFA and the Medicare contractors. Bank officials believed that withdrawing funds a day early was a "perk" of maintaining Medicare accounts and that bank charges alone were not sufficient to cover administrative expenses for the accounts.
Each of the Medicare contractors has a monthly limit on the total amount of Medicare funds that can be drawn down by the bank, and HCFA and its contractors have various reconciliation procedures to compare bank cash draws to expenditures and to Federal Reserve Bank reports. However, these controls were ineffective in preventing both types of improper withdrawals made by the bank.
CONCLUSIONS AND RECOMMENDATIONS
We are encouraged by HCFA's sustained success in reducing Medicare payment errors and by the important progress made in resolving prior years' financial reporting problems. We remain concerned, however, that inadequate internal controls over accounts receivable leave the Medicare program vulnerable to potential loss or misstatement. As HCFA begins a lengthy process to integrate its accounting system with the Medicare contractor systems, internal controls must be strengthened to ensure that debt is accurately recorded, an adequate debt collection process is in place, and information is properly reflected on the financial statements.
We offered a number of recommendations which, if implemented, will strengthen
controls over receivables and financial reporting. With the Year 2000 remediation
challenge successfully completed, we urge HCFA to focus on these critical
internal controls while continuing its efforts to reduce improper payments
and ensure provider integrity. Specifically, we recommended that HCFA:
Establish an integrated financial management system at the contractors
to promote consistency and reliability in recording and reporting accounts
receivable information.
Establish a formal review process over accounts receivable to detect unusual
fluctuations, anomalies, and unexpected variances.
Ensure that contractors develop control procedures to provide independent
checks of the validity, accuracy, and completeness of receivable amounts
reported to HCFA.
Develop an independent internal oversight group or internal audit function
to monitor the contractors' compliance with HCFA reporting requirements
for accounts receivable and verify the accuracy and completeness of information
reported to the HCFA central office.
Establish procedures for contractors to periodically reconcile accounts
receivable balances to supporting documentation.
Periodically review contractors' control procedures over the accounts receivable
reconciliation process.
Consider establishing a weekly limit on the total amount of Medicare funds
that can be drawn by contractor banks.