GAO-08-760, Medicare Part D: Some Plan Sponsors Have Not Completely Implemented Fraud and Abuse Programs, and CMS Oversight Has Been Limited


This is the accessible text file for GAO report number GAO-08-760 
entitled 'Medicare Part D: Some Plan Sponsors Have Not Completely 
Implemented Fraud and Abuse Programs, and CMS Oversight Has Been 
Limited' which was released on August 25, 2008.

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov.

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately.

Report to the Ranking Member, Committee on Finance, U.S. Senate:

United States Government Accountability Office: 
GAO:

July 2008:

Medicare Part D:

Some Plan Sponsors Have Not Completely Implemented Fraud and Abuse 
Programs, and CMS Oversight Has Been Limited:

GAO-08-760: 

GAO Highlights:

Highlights of GAO-08-760, a report to the Ranking Member, Committee on 
Finance, U.S. Senate. 

Why GAO Did This Study:

The Medicare Prescription Drug, Improvement, and Modernization Act of 
2003 (MMA) established a voluntary outpatient prescription drug 
benefit, known as Medicare Part D. The Centers for Medicare & Medicaid 
Services (CMS) contracts with private companies to serve as Part D 
sponsors and administer the Part D prescription drug benefit plans. To 
protect beneficiaries and the fiscal integrity of the program, the MMA 
requires Part D sponsors to implement programs to control for fraud and 
abuse in Part D. Subsequent regulations and guidance from CMS contain 
requirements and recommended measures for these programs.

This report examines (1) the extent to which certain Part D sponsors 
have implemented programs to control fraud, waste, and abuse and (2) 
the extent of CMS’s oversight of Part D sponsors’ programs to control 
fraud, waste, and abuse. GAO conducted on-site reviews of five of the 
largest Part D sponsors’ fraud and abuse programs. GAO also interviewed 
officials from CMS and reviewed CMS documents.

What GAO Found:

The five Part D sponsors in GAO’s review had not completely implemented 
all of CMS’s required compliance plan elements and selected recommended 
measures for Part D fraud and abuse programs. All Part D sponsors had 
completely implemented the requirements and selected recommendations 
for three of the seven required compliance plan elements. However, Part 
D sponsors varied in their implementation of the remaining required 
elements and selected recommended measures. 

Table: Summary of Five Part D Sponsors’ Implementation of the Required 
Compliance Plan Elements and Selected Recommended Measures for Fraud 
and Abuse Programs: 

Required compliance plan elements and selected recommended measures: 
1. Written policies, procedures, and standards of conduct; Required 
elements; Extent of Part D sponsors' implementation: A: The sponsor met 
all of the requirements or selected recommended measures in our review; 
Extent of Part D sponsors' implementation: B: The sponsor met all of 
the requirements or selected recommended measures in our review; Extent 
of Part D sponsors' implementation: C: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation: D: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation: E: The sponsor met all of the 
requirements or selected recommended measures in our review.

Required compliance plan elements and selected recommended measures: 
1. Written policies, procedures, and standards of conduct; Recommended 
measures; Extent of Part D sponsors' implementation: A: The sponsor met 
all of the requirements or selected recommended measures in our review; 
Extent of Part D sponsors' implementation: B: The sponsor met all of 
the requirements or selected recommended measures in our review; Extent 
of Part D sponsors' implementation: C: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation: D: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation: E: The sponsor met all of the 
requirements or selected recommended measures in our review.

Required compliance plan elements and selected recommended measures: 
2. Compliance officer and compliance committee; Required elements; 
Extent of Part D sponsors' implementation: A: The sponsor met all of 
the requirements or selected recommended measures in our review; Extent 
of Part D sponsors' implementation: B: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation: C: The sponsor partially met the 
requirements or selected recommended measures if they met some but not 
all of the requirements or recommendations in our review; Extent of 
Part D sponsors' implementation: D: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation: E: The sponsor met all of the 
requirements or selected recommended measures in our review.

Required compliance plan elements and selected recommended measures: 
2. Compliance officer and compliance committee; Recommended measures; 
Extent of Part D sponsors' implementation: A: The sponsor partially met 
the requirements or selected recommended measures if they met some but 
not all of the requirements or recommendations in our review; Extent of 
Part D sponsors' implementation: B: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation: C: The sponsor partially met the 
requirements or selected recommended measures if they met some but not 
all of the requirements or recommendations in our review; Extent of 
Part D sponsors' implementation: D: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation: E: The sponsor met all of the 
requirements or selected recommended measures in our review.

Required compliance plan elements and selected recommended measures: 
3. Effective training and education; Required elements; Extent of Part 
D sponsors' implementation: A: The sponsor met all of the requirements 
or selected recommended measures in our review; Extent of Part D 
sponsors' implementation: B: The sponsor partially met the requirements 
or selected recommended measures if they met some but not all of the 
requirements or recommendations in our review; Extent of Part D 
sponsors' implementation: C: The sponsor partially met the requirements 
or selected recommended measures if they met some but not all of the 
requirements or recommendations in our review; Extent of Part D 
sponsors' implementation: D: The sponsor met all of the requirements or 
selected recommended measures in our review; Extent of Part D sponsors' 
implementation: E: The sponsor did not meet any of the requirements or 
selected recommended measures in our review. 

Required compliance plan elements and selected recommended measures: 
3. Effective training and education; Recommended measures; Extent of 
Part D sponsors' implementation: A: The sponsor partially met the 
requirements or selected recommended measures if they met some but not 
all of the requirements or recommendations in our review; Extent of 
Part D sponsors' implementation: B: The sponsor partially met the 
requirements or selected recommended measures if they met some but not 
all of the requirements or recommendations in our review; Extent of 
Part D sponsors' implementation: C: The sponsor partially met the 
requirements or selected recommended measures if they met some but not 
all of the requirements or recommendations in our review; Extent of 
Part D sponsors' implementation: D: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation: E: The sponsor did not meet any of the 
requirements or selected recommended measures in our review. 

Required compliance plan elements and selected recommended measures: 
4. Effective lines of communication; Required elements; Extent of Part 
D sponsors' implementation: A: The sponsor met all of the requirements 
or selected recommended measures in our review; Extent of Part D 
sponsors' implementation: B: The sponsor met all of the requirements or 
selected recommended measures in our review; Extent of Part D sponsors' 
implementation: C: The sponsor met all of the requirements or selected 
recommended measures in our review; Extent of Part D sponsors' 
implementation: D: The sponsor met all of the requirements or selected 
recommended measures in our review; Extent of Part D sponsors' 
implementation: E: The sponsor met all of the requirements or selected 
recommended measures in our review.

Required compliance plan elements and selected recommended measures: 
4. Effective lines of communication; Recommended measures; Extent of 
Part D sponsors' implementation: A: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation: B: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation: C: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation: D: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation: E: The sponsor met all of the 
requirements or selected recommended measures in our review.

Required compliance plan elements and selected recommended measures: 
5. Enforcement of standards through disciplinary guidelines; Required 
elements; Extent of Part D sponsors' implementation: A: The sponsor met 
all of the requirements or selected recommended measures in our review; 
Extent of Part D sponsors' implementation: B: The sponsor met all of 
the requirements or selected recommended measures in our review; Extent 
of Part D sponsors' implementation: C: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation: D: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation: E: The sponsor met all of the 
requirements or selected recommended measures in our review.

Required compliance plan elements and selected recommended measures: 
5. Enforcement of standards through disciplinary guidelines; 
Recommended measures; Extent of Part D sponsors' implementation: A: The 
sponsor met all of the requirements or selected recommended measures in 
our review; Extent of Part D sponsors' implementation: B: The sponsor 
met all of the requirements or selected recommended measures in our 
review; Extent of Part D sponsors' implementation: C: The sponsor met 
all of the requirements or selected recommended measures in our review; 
Extent of Part D sponsors' implementation: D: The sponsor met all of 
the requirements or selected recommended measures in our review; Extent 
of Part D sponsors' implementation: E: The sponsor met all of the 
requirements or selected recommended measures in our review.

Required compliance plan elements and selected recommended measures: 
6. Internal monitoring and auditing; Required elements; Extent of Part 
D sponsors' implementation: A: The sponsor met all of the requirements 
or selected recommended measures in our review; Extent of Part D 
sponsors' implementation: B: The sponsor met all of the requirements or 
selected recommended measures in our review; Extent of Part D sponsors' 
implementation: C: The sponsor partially met the requirements or 
selected recommended measures if they met some but not all of the 
requirements or recommendations in our review; Extent of Part D 
sponsors' implementation: D: The sponsor met all of the requirements or 
selected recommended measures in our review; Extent of Part D sponsors' 
implementation: E: The sponsor did not meet any of the requirements or 
selected recommended measures in our review.

Required compliance plan elements and selected recommended measures: 
6. Internal monitoring and auditing; Recommended measures; Extent of 
Part D sponsors' implementation: A: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation: B: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation: C: The sponsor partially met the 
requirements or selected recommended measures if they met some but not 
all of the requirements or recommendations in our review; Extent of 
Part D sponsors' implementation: D: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation: E: The sponsor did not meet any of the 
requirements or selected recommended measures in our review.

Required compliance plan elements and selected recommended measures: 
7. Prompt responses to detected offenses; Required elements; Extent of 
Part D sponsors' implementation: A: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation: B: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation: C: The sponsor partially met the 
requirements or selected recommended measures if they met some but not 
all of the requirements or recommendations in our review; Extent of 
Part D sponsors' implementation: D: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation: E: The sponsor met all of the 
requirements or selected recommended measures in our review.

Required compliance plan elements and selected recommended measures: 
7. Prompt responses to detected offenses; Recommended measures; Extent 
of Part D sponsors' implementation: A: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation: B: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation: C: The sponsor partially met the 
requirements or selected recommended measures if they met some but not 
all of the requirements or recommendations in our review; Extent of 
Part D sponsors' implementation: D: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation: E: The sponsor met all of the 
requirements or selected recommended measures in our review.

Source: GAO analysis of documentation collected from the five Part D 
sponsors reviewed.

[End of table] 

CMS oversight of Part D sponsors’ fraud and abuse programs has been 
limited. To date, CMS’s activities have been limited to the review and 
approval of sponsors’ fraud and abuse program plans submitted as part 
of the initial Part D applications. For example, CMS officials reported 
that they worked with sponsors to help them develop fraud and abuse 
program plans that met the agency’s compliance plan requirements and 
recommendations specific to fraud and abuse. However, CMS has not 
conducted oversight to assess Part D sponsors’ implementation of fraud 
and abuse programs. Officials from CMS stated that the agency had not 
audited sponsors’ implementation of fraud and abuse programs in 2007, 
and as of April 2008, no audits of these programs had been conducted. 

What GAO Recommends:

To help safeguard the Medicare Part D program from fraud, waste, and 
abuse, GAO recommends that CMS conduct timely audits of Part D 
sponsors’ fraud and abuse programs. CMS disagreed that its oversight 
has been limited, but GAO found that CMS has not audited sponsors’ 
fraud and abuse programs. CMS concurred with GAO’s recommendation. 

To view the full product, including the scope and methodology, click on 
[hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-760]. For more 
information, contact Kathleen King at (202) 512-7114 or kingk@gao.gov. 

[End of section] 

Contents:

Letter:

Results in Brief:

Background:

The Part D Sponsors We Reviewed Had Not Completely Implemented CMS's 
Required Elements and Selected Recommended Measures for Part D Fraud 
and Abuse Programs:

CMS's Oversight of Part D Sponsors' Fraud and Abuse Programs Has Been 
Limited:

Conclusions:

Recommendation for Executive Action:

Agency Comments and Our Evaluation:

Appendix I: Methodology for Examining Certain Sponsors' Implementation 
of Fraud and Abuse Programs for Part D:

Appendix II: Comments from the Centers for Medicare & Medicaid Services:

Appendix III: GAO Contact and Staff Acknowledgments:

Tables:

Table 1: Required Elements of Comprehensive Compliance Plans and 
Selected Recommended Measures for Addressing Fraud, Waste, and Abuse in 
Part D:

Table 2: Summary of Five Part D Sponsors' Implementation of the 
Required Compliance Plan Elements and Selected Recommended Measures for 
Fraud and Abuse Programs:

Abbreviations:

CBC:Center for Beneficiary Choices: 

CMS: Centers for Medicare & Medicaid Services: 

HHS: Department of Health and Human Services: 

MA-PD: Medicare Advantage prescription drug plan: 

MEDIC: Medicare Drug Integrity Contractor: 

MMA: Medicare Prescription Drug, Improvement, and Modernization Act of 
2003: 

OFM: Office of Financial Management: 

OIG: Office of the Inspector General: 

PDP: prescription drug plan: 

VA: Department of Veterans Affairs: 

[End of section] 

United States Government Accountability Office: 
Washington, DC 20548:

July 21, 2008:

The Honorable Charles E. Grassley: 
Ranking Member: 
Committee on Finance: 
United States Senate:

Dear Senator Grassley:

Medicare Part D provides voluntary, outpatient prescription drug 
coverage for eligible individuals 65 years and older and eligible 
individuals with disabilities. The Part D program, which began in 
January 2006, is administered by the Department of Health and Human 
Services' (HHS) Centers for Medicare & Medicaid Services (CMS). CMS 
contracts with private companies--such as health insurance companies 
and pharmacy benefit managers--to serve as Part D sponsors and 
administer the Part D prescription drug benefit plans.[Footnote 1] 
About 24 million individuals were enrolled in Medicare Part D[Footnote 
2] as of January 2007 and estimated benefit expenditures were $39 
billion in calendar year 2007.[Footnote 3] We and others have reported 
that the size, nature, and complexity of the Part D program make it a 
particular risk for fraud, waste, and abuse.[Footnote 4] The Medicare 
program as a whole, including Part D, is vulnerable to fraud, waste, 
and abuse. Due in part to this vulnerability, we have designated 
Medicare as a high risk program since 1990.[Footnote 5]

To protect beneficiaries and the fiscal integrity of the Medicare 
program, the Medicare Prescription Drug, Improvement, and Modernization 
Act of 2003 (MMA), which established the Part D program, requires all 
Part D sponsors to have programs to safeguard Part D from fraud, waste, 
and abuse.[Footnote 6] Accordingly, on January 28, 2005, CMS issued 
regulations[Footnote 7] requiring that sponsors have a comprehensive 
compliance plan[Footnote 8] that includes a program to control fraud, 
waste, and abuse.[Footnote 9] These regulations established required 
elements within comprehensive compliance plans. In April 2006, CMS 
issued guidance through its Part D Prescription Drug Benefit Manual; 
chapter 9 of the Manual contained further interpretation and guidelines 
that include recommended measures for how Part D sponsors should 
address fraud, waste, and abuse for Part D in each of the required 
compliance plan elements.[Footnote 10] In order to fulfill statutory 
and regulatory requirements regarding programs to control fraud, waste, 
and abuse, Part D sponsors must develop and implement a compliance plan 
detailing their fraud and abuse program. The compliance plan, which 
must be approved by CMS, articulates policies, processes, and 
procedures for Part D sponsors to detect, correct, and prevent fraud, 
waste and abuse. Implementation of a compliance plan includes 
conducting the activities described in the plan and developing 
comprehensive written procedures for activities referenced in the plan.

CMS's required compliance plan elements and the related recommended 
measures for a fraud and abuse program specific to Part D include the 
following:

1. A sponsor's compliance plan must include written policies, 
procedures, and standards of conduct.

2. A sponsor's compliance plan must designate a compliance officer and 
a compliance committee that are accountable to senior management.

3. A sponsor's compliance plan must include effective training and 
education pertaining to fraud, waste, and abuse for the organization's 
employees and contractors. A Part D sponsor may contract some of its 
Part D responsibilities to a third party; however, the Part D sponsor 
is ultimately responsible for ensuring compliance with required 
elements, including those pertaining to education and training. 
Contractors include first-tier, downstream, and related entities. 
[Footnote 11]

4. A sponsor's compliance plan must include effective lines of 
communication that should include a confidential or anonymous 
mechanism, such as a hotline, to receive compliance questions and 
reports of fraud, waste, or abuse.

5. A sponsor's compliance plan must have well-publicized disciplinary 
guidelines through which sponsors must enforce standards.

6. A sponsor's compliance plan must include effective internal 
monitoring and auditing procedures which should include the development 
and implementation of procedures that are intended to protect Part D 
from fraud, waste, and abuse, including monitoring and auditing of 
contractors.

7. A sponsor's compliance plan must include procedures for ensuring 
prompt responses to detected offenses and development of corrective 
action initiatives, including responses to potential offenses.

While Medicare Part D is now in its third year of operation, little is 
known about the extent to which Part D sponsors have implemented their 
fraud and abuse programs or the extent of CMS's oversight of Part D 
sponsors' programs. You asked us to examine the implementation and CMS 
oversight of Part D sponsors' programs to control fraud, waste, and 
abuse. Specifically, this report examines (1) the extent to which 
certain Part D sponsors implemented programs to control fraud, waste, 
and abuse and (2) the extent of CMS's oversight of Part D sponsors' 
programs to control fraud, waste, and abuse.

To conduct our work, we reviewed relevant laws, regulations, and CMS 
guidance to determine the required elements of a comprehensive 
compliance plan and recommended measures for a comprehensive fraud and 
abuse program. We also interviewed officials from CMS and HHS's Office 
of the Inspector General (OIG), and officials from the Department of 
Veterans Affair's (VA) Office of Compliance and Business Integrity. 
[Footnote 12] We also interviewed industry representatives who were 
subject-matter experts to learn more about fraud and abuse programs. In 
addition, to examine the extent to which certain Part D sponsors have 
implemented programs to control fraud, waste, and abuse, we conducted 
on-site reviews at five Part D sponsors. We selected these five 
sponsors for our review because they each offered a Part D prescription 
drug plan that provided nationwide coverage,[Footnote 13] varied in 
enrollment size, and the plans collectively provided coverage for a 
sizeable proportion of Part D beneficiaries. (The five national 
prescription drug plans selected for our review from these sponsors 
represented about 35 percent of total Medicare Part D enrollment as of 
April 2007.)[Footnote 14] Our sample is not generalizable to the entire 
Part D sponsor population. Four of the five sponsors we reviewed were 
private health insurance companies and one was a pharmacy benefit 
manager. During our on-site reviews, we reviewed these sponsors 
compliance plans and examined the extent to which the sponsors' 
implemented CMS's seven required compliance plan elements and selected 
recommended measures for detecting, correcting and preventing fraud, 
waste, and abuse in Part D. We selected recommended measures for our 
review based on a variety of factors, such as measures that we judged 
were the most helpful to fulfilling the purpose of the requirements. 
(See app. I for more-detailed information on our methodology for 
assessing the extent to which certain Part D sponsors implemented their 
fraud and abuse programs.)

To examine the extent to which CMS oversees Part D sponsors' programs 
to control fraud, waste, and abuse, we interviewed CMS officials from 
the Center for Beneficiary Choices (CBC),[Footnote 15] the lead office 
for operational oversight, and the Office of Financial Management 
(OFM), the lead office for program and fiscal integrity. We also 
reviewed documentation from CMS, including CMS's Part D oversight 
strategy, CBC's program audit strategies, contracts related to OFM's 
Part D program integrity efforts, and technical assistance provided by 
CMS that was specific to the fraud and abuse program requirement.

In conducting our work, we focused on the extent of implementation of 
fraud and abuse programs rather than the effectiveness of the programs 
in detecting, correcting, and preventing fraud, waste, and abuse. We 
did not investigate actual occurrences of fraud, waste, and abuse; 
however, we did ask for evidence of reported cases of potential fraud, 
waste, or abuse that had been investigated. We conducted this 
performance audit from October 2006 through June 2008 in accordance 
with generally accepted government auditing standards. Those standards 
require that we plan and perform the audit to obtain sufficient, 
appropriate evidence to provide a reasonable basis for our findings and 
conclusions based on our audit objectives. We believe that the evidence 
obtained provides a reasonable basis for our findings and conclusions 
based on our audit objectives.

Results in Brief:

The five Part D sponsors we reviewed had not completely implemented all 
of CMS's seven required compliance plan elements and selected 
recommended measures for Part D fraud and abuse programs. All five Part 
D sponsors implemented the required elements and selected recommended 
measures for written policies, procedures, and standards of conduct 
(element 1); effective lines of communication (element 4); and 
enforcement of standards through disciplinary guidelines (element 5). 
However, these Part D sponsors varied in their implementation of the 
remaining required elements and selected recommended measures. Four 
Part D sponsors completely met the requirements for having a compliance 
officer and compliance committee (element 2). Two sponsors completely 
met the requirements for effective training and education by providing 
general training to their employees (element 3). Three Part D sponsors 
completely met the requirements and selected recommended measures for 
internal monitoring and auditing (element 6). One sponsor conducted an 
audit that identified more than $1.2 million for possible repayment to 
Medicare. Four Part D sponsors completely met the requirements for 
prompt responses and corrective action initiatives (element 7). Four 
sponsors reported that they had identified cases that warranted 
corrective action. For example, one Part D sponsor reported terminating 
a pharmacy technician after the technician stole a beneficiary's 
prescription from the pharmacy refill center and attempted to sell it 
to the beneficiary at a discounted price.

CMS oversight of Part D sponsors' fraud and abuse programs has been 
limited. To date, CMS oversight activities have been limited to the 
review and approval of sponsors' fraud and abuse program plans 
submitted as part of sponsors' initial Part D applications. For 
example, CMS officials reported that they worked with sponsors to help 
them develop a compliance plan detailing their fraud and abuse program 
plans that met the agency's compliance plan requirements and 
recommendations specific to Medicare Part D fraud and abuse programs. 
Although CMS has conducted self-assessment surveys of sponsors' fraud 
and abuse programs, neither of the two offices within CMS with 
responsibility for overseeing sponsors' implementation of these 
programs has conducted an audit of sponsors' compliance with fraud, 
waste, and abuse program requirements. Officials from CMS's CBC stated 
that it had not audited fraud and abuse programs in 2007 and that CBC 
does not plan to audit these programs in 2008. Separately, CMS's OFM 
has contracted with Medicare Drug Integrity Contractors (MEDICs) to 
support its audit, oversight, and antifraud and abuse efforts in Part 
D. However, as of April 2008, these audits of Part D sponsors' fraud 
and abuse programs had not been conducted.

To help safeguard the Medicare Part D program from fraud, waste, and 
abuse, we recommend that the Administrator of CMS ensure that CMS 
conducts timely audits of Part D sponsors' fraud and abuse program 
implementation.

In its comments on a draft of this report, CMS disagreed with our 
finding that its oversight of Part D sponsors' fraud, waste, and abuse 
programs has been limited. However, CMS's comments did not provide 
additional evidence of audits of sponsors' fraud, waste, and abuse 
programs, or of oversight activities beyond those described in the 
draft report. CMS agreed with our finding regarding the extent to which 
Part D sponsors have implemented programs to control fraud, waste, and 
abuse. CMS also concurred with our recommendation and stated that the 
agency is prioritizing its oversight activities to ensure sponsors' 
compliance with CMS's policies.

Background:

In 2003, Congress passed the MMA, which created the Medicare Part D 
program. The MMA requires that all Part D sponsors have a program to 
control fraud, waste, and abuse. CMS is responsible for safeguarding 
the Part D program from fraud, waste, and abuse.

The Medicare Part D Program:

In 2003, Congress passed the MMA, which created a prescription drug 
benefit known as Medicare Part D. Voluntary enrollment in the Medicare 
Part D program began November 15, 2005, and the benefit went into 
effect January 1, 2006. Although the Medicare Part D program is 
overseen by CMS, Part D drug benefit plans are administered by private 
companies that apply to CMS to participate in the program. When 
approved, these private companies contract with the federal government 
to be Part D sponsors and market Part D drug plans directly to Medicare 
beneficiaries.

Control of Fraud, Waste, and Abuse in Medicare Part D:

The MMA includes a requirement that all Part D sponsors have a program 
to control fraud, waste, and abuse in Part D;[Footnote 16] CMS 
regulations establish the requirements for comprehensive compliance 
plans for Part D plan sponsors.[Footnote 17] To guide Part D sponsors 
in designing a fraud and abuse program that addressed Part D risks, in 
April 2006, CMS issued recommendations for Part D sponsors' fraud and 
abuse programs based on input from various sources, including law 
enforcement and industry representatives.[Footnote 18] The guidance, 
issued as chapter 9 in the Prescription Drug Benefit Manual, contains 
further interpretation and guidelines on the steps sponsors should take 
to detect, correct, and prevent fraud, waste, and abuse in Part D.

CMS required Part D sponsors to have fraud and abuse programs 
operational and in effect at the time their Part D contracts were 
awarded and expected sponsors to adopt the recommendations in chapter 9 
by January 1, 2007. Table 1 describes the required elements of a 
comprehensive compliance plan and selected recommended measures for 
addressing fraud, waste, and abuse specific to Part D in each of the 
required compliance plan elements.

Table 1: Required Elements of Comprehensive Compliance Plans and 
Selected Recommended Measures for Addressing Fraud, Waste, and Abuse in 
Part D:

Comprehensive compliance plan requirements: 
1. Written Policies, Procedures, and Standards of Conduct; 
* Must have written policies, procedures, and standards of conduct 
articulating the organization's commitment to comply with all 
applicable federal and state standards; 
* Contracts must specify that the contractor[B] must comply with all 
applicable federal laws, regulations, and CMS instructions[C]; 
Selected recommended measures[A]: 
* Should have written policies and procedures for detecting, 
correcting, and preventing Medicare Part D fraud, waste, and abuse; 
* Standards of conduct and applicable policies and procedures should be 
made available to employees at time of hire, when the standards are 
updated, and annually thereafter; 
* Should have employees certify that they received, read, and will 
comply with standards of conduct.

Comprehensive compliance plan requirements:
2. Compliance Officer and Compliance Committee; 
* Must have a compliance officer who is accountable to senior 
management; 
* Must have a compliance committee that is accountable to senior 
management; 
Selected recommended measures[A]:
* Compliance officer should report at least on a quarterly basis to the 
sponsor's senior management; 
* Compliance officer should be responsible for developing, operating, 
and monitoring the fraud and abuse program; 
* Compliance committee should meet at least on a quarterly basis or 
more frequently.

Comprehensive compliance plan requirements: 
3. Effective Training and Education; 
* Must provide effective training and education between the compliance 
officer and organization employees, contractors,[B] and directors; 
Selected recommended measures[A]: 
* Should address pertinent laws related to fraud and abuse and include 
a discussion of Part D vulnerabilities and common fraudulent schemes; 
* Should provide its employees and contractors[B] who have specific 
responsibilities for Part D business areas with any specialized 
training on the compliance risks posed by their job function; 
* Should verify contractor[B] training at least annually.

Comprehensive compliance plan requirements: 
47. Effective Lines of Communication; 
* Must have effective lines of communication between the compliance 
officer and the organization's employees, contractors,[B] directors, 
and members of the compliance committee; 
Selected recommended measures[A]: 
* Should have a confidential or anonymous mechanism, such as a hotline, 
to receive compliance questions or reports of fraud, waste, or abuse 
from internal and external parties; 
* Should publicize the mechanisms for reporting noncompliance or fraud, 
waste, or abuse, or both, to its employees, beneficiaries, and 
contractors[B]; 
* Should establish procedures for responding to reports of suspected 
compliance issues received through the reporting mechanism(s) in a 
timely manner; 
* Should have a complaint tracking system with an explicit process for 
handing reports of fraud, waste, or abuse; 
* Should initiate investigations of any concerns about Part D received 
through its internal and external mechanisms within 2 weeks.

Comprehensive compliance plan requirements: 
5. Enforcement of Standards through Disciplinary Guidelines; 
* Must enforce standards through well-publicized disciplinary 
guidelines; 
Selected recommended measures[A]: 
* Should publicize its disciplinary guidelines to encourage the 
reporting of unethical or noncompliant behavior.

Comprehensive compliance plan requirements: 
6. Procedures for Effective Internal Monitoring and Auditing; 
* Must have procedures for effective internal monitoring and auditing; 
* Must have procedures to monitor and audit contractors[B] and related 
entities with respect to the drug benefit[C]; 
Selected recommended measures[A]: 
* Should implement internal monitoring and auditing to protect the 
Medicare Trust Fund from Part D fraud and abuse and to mitigate the 
potential for fraud, waste, and abuse within their organization; 
* Should implement monitoring and auditing of contractors[B] with 
respect to the drug benefit to identify fraud, waste, and abuse; 
* Should conduct data analysis to detect fraud, waste, and abuse at the 
sponsor and contractor[B] levels; 
* Should conduct a risk assessment to identify the sponsor's risks 
related to Part D fraud, waste, and abuse and prioritize the monitoring 
and auditing strategy accordingly.

Comprehensive compliance plan requirements: 
7. Prompt Responses to Detected Offenses; 
* Must have procedures for ensuring prompt responses to detected 
offenses and must develop corrective action initiatives; 
* Must--upon discovery of misconduct related to Part D-- conduct a 
timely, reasonable inquiry into that conduct and must initiate 
appropriate corrective actions in response to potential violations, 
such as repayment of any overpayment received or disciplinary action 
against responsible individuals; 
Selected recommended measures[A]: 
* Inquiry should be immediate, but no later than two weeks from the 
date the potential misconduct is identified; 
* Should have procedures to voluntarily self-report potential fraud or 
misconduct related to the Part D program to CMS or an appropriate 
government authority[D]; 
* Should self-report to CMS or the Medicare Drug Integrity Contractors 
(MEDICs) any findings of potential fraud discovered at the sponsor and 
contractor levels.

Source: GAO summary of regulations and CMS data[E]. 

[A] CMS's chapter 9 guidance provided several recommendations for how 
sponsors should implement a program to control fraud, waste, and abuse 
as part of an effective Part D compliance plan. Our data collection 
instrument did not include all of CMS's recommended measures. We 
selected recommended measures for inclusion in our data collection 
instrument based on a variety of factors, such as measures that we 
judged were the most helpful to fulfilling the purpose of the 
requirements.

[B] For the purposes of this report, the term contractor includes first-
tier, downstream, and related entities.

[C] These are requirements in regulations other than the compliance 
plan requirements. See 42 C.F.R. § 423.505 concerning contracts or 
written arrangements between Part D plan sponsors and contractors.

[D] Though voluntary in nature, procedures for self-reporting potential 
fraud or misconduct related to Part D also appear in regulatory 
compliance plan requirements.

[E] Data are from select provisions within 42 C.F.R. §§ 423.504 and 
423.505, and CMS, Prescription Drug Benefit Manual, chapter 9: Part D 
Program to Control Fraud, Waste, and Abuse (April 2006). 

[End of table]

In the chapter 9 guidance, CMS recommends that Part D sponsors design 
their fraud, waste, and abuse programs to safeguard against identified 
risk areas and identifies examples of fraud, waste, and abuse risks 
associated with Part D stakeholders, including internal and external 
parties. Internal parties include Part D sponsors and their employees; 
external parties include physicians, pharmacies, and Medicare 
beneficiaries. Chapter 9 also states that sponsors' preexisting fraud 
and abuse programs should be focused on controlling fraud by external 
parties submitting claims to the sponsor, and stated that Part D 
sponsors are to identify and address internal fraud, waste, and abuse 
by the sponsor and its employees as well. In chapter 9, CMS also 
identified examples of potential fraud, waste, and abuse by Part D 
sponsors, such as marketing schemes to improperly enroll Medicare 
beneficiaries in Part D plans or deliberately using inaccurate data to 
receive improper payments from CMS. CMS identified examples of 
potential fraud, waste, and abuse by Medicare beneficiaries, such as 
beneficiaries misrepresenting their identity to illegally obtain the 
drug benefit or engaging in doctor shopping, where a patient seeks 
prescriptions from multiple physicians with the intent to abuse or sell 
drugs. CMS identified potential examples of fraud, waste, and abuse by 
pharmacies, citing improper billing practices, such as billing for 
nonexistent prescriptions.

Regulations and the chapter 9 guidance recognize that contractors can 
be significant stakeholders in sponsors' Part D operations.[Footnote 
19] CMS permits Part D sponsors to use contractors to perform various 
Part D functions.[Footnote 20] However, CMS regulations and chapter 9 
state that the Part D sponsor is ultimately responsible for fulfilling 
the terms and conditions set out in the sponsor's contract with CMS, 
even if the sponsor delegates a Part D function to a contractor. In 
addition, Part D rules establish contractual obligations for Part D 
sponsors that delegate tasks to contractors.

CMS's Oversight Responsibilities:

CMS is responsible for safeguarding the Part D program from fraud, 
waste, and abuse, including ensuring sponsors' compliance with 
applicable requirements. While many groups within CMS are responsible 
for overseeing different aspects of the Part D program, two divisions 
provide oversight of Part D sponsors' fraud and abuse programs. OFM is 
the lead office for program integrity and financial oversight, 
including responsibility related to oversight of fraud, waste, and 
abuse in the Part D program. OFM developed the chapter 9 guidance for 
sponsors' fraud and abuse programs and is responsible for reviewing and 
approving fraud and abuse program plans when organizations first apply 
to become Part D sponsors. CBC is the lead office for operational 
oversight of Part D, including sponsor management, program audits, and 
enforcement actions.

OFM and CBC are responsible for conducting audits of Part D sponsors' 
compliance with fraud and abuse program requirements. CBC is 
responsible for conducting broad Part D program audits that include, 
but are not limited to, Part D sponsors' implementation of their 
compliance plans, including fraud and abuse programs. In contrast, OFM 
is responsible for financial audits and audits of Part D sponsors' 
fraud and abuse programs.[Footnote 21] CMS contracted with the MEDICs 
to support OFM's audit, oversight, and antifraud and abuse efforts in 
Part D.[Footnote 22]

In October 2005, CMS issued its Oversight Strategy for overseeing Part 
D sponsors, particularly with regard to mitigating fraud, waste, and 
abuse. In the strategy, CMS noted that in conducting oversight of Part 
D sponsors CBC would rely on self-reported, unaudited data provided to 
CMS by Part D sponsors. However, in the strategy, CMS also acknowledged 
that program audits conducted by CBC would be necessary to ensure 
compliance and to document that CMS has fulfilled its program oversight 
responsibilities. According to the Oversight Strategy, CBC would follow 
a 3-year audit cycle that would include both desk audits--reviews of 
documents requested from Part D sponsors--and on-site audits covering 
all aspects of the Prescription Drug Benefit Manual over the 3 
years.[Footnote 23] In December 2006, HHS's OIG conducted a review of 
Part D sponsors' compliance plans that found that many Part D sponsors' 
compliance plans did not address all of CMS's compliance plan 
requirements, including fraud and abuse program plans. In response, CMS 
reported that "CMS will begin these compliance plan audits in 2007, and 
sponsors will be accountable for meeting all requirements."[Footnote 24]

OFM's oversight of Part D sponsors relies on the MEDICs to audit 
Medicare Part D fraud and abuse programs. CMS has entered into 
contracts under which task orders were issued to three MEDICs to 
conduct various activities related to Part D. The first MEDIC began its 
work in November 2005, and the other two MEDICs began work in December 
2006. At that time, OFM estimated that the MEDICs would conduct audits 
of Part D sponsors' fraud and abuse programs in the first years of Part 
D. In 2005 and 2006, CMS estimated that at least 10 audits of fraud and 
abuse programs would be conducted by each of the MEDICs each year under 
task orders to be issued under the contract. Specifically, CMS 
estimated that the first MEDIC would complete 10 of these audits during 
the 2005--2006 contract year and that the three MEDICs would complete 
35 of these audits during the 2006--2007 contract year.

The Part D Sponsors We Reviewed Had Not Completely Implemented CMS's 
Required Elements and Selected Recommended Measures for Part D Fraud 
and Abuse Programs:

The five Part D sponsors we reviewed had not completely implemented all 
of CMS's seven required compliance plan elements and selected 
recommended measures for Part D fraud and abuse programs.[Footnote 25] 
All Part D sponsors had the required elements and recommended measures 
for written policies, procedures, and standards of conduct (element 1); 
effective lines of communication (element 4); and enforcement of 
standards through disciplinary guidelines (element 5). However, Part D 
sponsors varied in their implementation of the remaining required 
elements and selected recommend measures. Table 2 illustrates the 
variation in the extent to which the five Part D sponsors implemented 
the required elements and selected recommended measures for their fraud 
and abuse programs.

Table 2: Summary of Five Part D Sponsors' Implementation of the 
Required Compliance Plan Elements and Selected Recommended Measures for 
Fraud and Abuse Programs:

Required compliance plan elements and selected recommended measures[A]: 
1. Written policies, procedures, and standards of conduct; Required 
elements; Extent of Part D sponsors' implementation[B]: A[C]: The 
sponsor met all of the requirements or selected recommended measures in 
our review; Extent of Part D sponsors' implementation[B]: B[C]: The 
sponsor met all of the requirements or selected recommended measures in 
our review; Extent of Part D sponsors' implementation[B]: C[C]: The 
sponsor met all of the requirements or selected recommended measures in 
our review; Extent of Part D sponsors' implementation[B]: D: The 
sponsor met all of the requirements or selected recommended measures in 
our review; Extent of Part D sponsors' implementation[B]: E: The 
sponsor met all of the requirements or selected recommended measures in 
our review.

Required compliance plan elements and selected recommended measures[A]: 
1. Written policies, procedures, and standards of conduct; Recommended 
measures; Extent of Part D sponsors' implementation[B]: A[C]: The 
sponsor met all of the requirements or selected recommended measures in 
our review; Extent of Part D sponsors' implementation[B]: B[C]: The 
sponsor met all of the requirements or selected recommended measures in 
our review; Extent of Part D sponsors' implementation[B]: C[C]: The 
sponsor met all of the requirements or selected recommended measures in 
our review; Extent of Part D sponsors' implementation[B]: D: The 
sponsor met all of the requirements or selected recommended measures in 
our review; Extent of Part D sponsors' implementation[B]: E: The 
sponsor met all of the requirements or selected recommended measures in 
our review.

Required compliance plan elements and selected recommended measures[A]: 
2. Compliance officer and compliance committee; Required elements; 
Extent of Part D sponsors' implementation[B]: A[C]: The sponsor met all 
of the requirements or selected recommended measures in our review; 
Extent of Part D sponsors' implementation[B]: B[C]: The sponsor met all 
of the requirements or selected recommended measures in our review; 
Extent of Part D sponsors' implementation[B]: C[C]: The sponsor 
partially met the requirements or selected recommended measures if they 
met some but not all of the requirements or recommendations in our 
review; Extent of Part D sponsors' implementation[B]: D: The sponsor 
met all of the requirements or selected recommended measures in our 
review; Extent of Part D sponsors' implementation[B]: E: The sponsor 
met all of the requirements or selected recommended measures in our 
review.

Required compliance plan elements and selected recommended measures[A]: 
2. Compliance officer and compliance committee; Recommended measures; 
Extent of Part D sponsors' implementation[B]: A[C]: The sponsor 
partially met the requirements or selected recommended measures if they 
met some but not all of the requirements or recommendations in our 
review; Extent of Part D sponsors' implementation[B]: B[C]: The sponsor 
met all of the requirements or selected recommended measures in our 
review; Extent of Part D sponsors' implementation[B]: C[C]: The sponsor 
partially met the requirements or selected recommended measures if they 
met some but not all of the requirements or recommendations in our 
review; Extent of Part D sponsors' implementation[B]: D: The sponsor 
met all of the requirements or selected recommended measures in our 
review; Extent of Part D sponsors' implementation[B]: E: The sponsor 
met all of the requirements or selected recommended measures in our 
review.

Required compliance plan elements and selected recommended measures[A]: 
3. Effective training and education; Required elements; Extent of Part 
D sponsors' implementation[B]: A[C]: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation[B]: B[C]: The sponsor partially met the 
requirements or selected recommended measures if they met some but not 
all of the requirements or recommendations in our review; Extent of 
Part D sponsors' implementation[B]: C[C]: The sponsor partially met the 
requirements or selected recommended measures if they met some but not 
all of the requirements or recommendations in our review; Extent of 
Part D sponsors' implementation[B]: D: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation[B]: E: The sponsor did not meet any of 
the requirements or selected recommended measures in our review. 

Required compliance plan elements and selected recommended measures[A]: 
3. Effective training and education; Recommended measures; Extent of 
Part D sponsors' implementation[B]: A[C]: The sponsor partially met the 
requirements or selected recommended measures if they met some but not 
all of the requirements or recommendations in our review; Extent of 
Part D sponsors' implementation[B]: B[C]: The sponsor partially met the 
requirements or selected recommended measures if they met some but not 
all of the requirements or recommendations in our review; Extent of 
Part D sponsors' implementation[B]: C[C]: The sponsor partially met the 
requirements or selected recommended measures if they met some but not 
all of the requirements or recommendations in our review; Extent of 
Part D sponsors' implementation[B]: D: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation[B]: E: The sponsor did not meet any of 
the requirements or selected recommended measures in our review. 

Required compliance plan elements and selected recommended measures[A]: 
4. Effective lines of communication; Required elements; Extent of Part 
D sponsors' implementation[B]: A[C]: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation[B]: B[C]: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation[B]: C[C]: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation[B]: D: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation[B]: E: The sponsor met all of the 
requirements or selected recommended measures in our review.

Required compliance plan elements and selected recommended measures[A]: 
4. Effective lines of communication; Recommended measures; Extent of 
Part D sponsors' implementation[B]: A[C]: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation[B]: B[C]: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation[B]: C[C]: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation[B]: D: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation[B]: E: The sponsor met all of the 
requirements or selected recommended measures in our review.

Required compliance plan elements and selected recommended measures[A]: 
5. Enforcement of standards through disciplinary guidelines; Required 
elements; Extent of Part D sponsors' implementation[B]: A[C]: The 
sponsor met all of the requirements or selected recommended measures in 
our review; Extent of Part D sponsors' implementation[B]: B[C]: The 
sponsor met all of the requirements or selected recommended measures in 
our review; Extent of Part D sponsors' implementation[B]: C[C]: The 
sponsor met all of the requirements or selected recommended measures in 
our review; Extent of Part D sponsors' implementation[B]: D: The 
sponsor met all of the requirements or selected recommended measures in 
our review; Extent of Part D sponsors' implementation[B]: E: The 
sponsor met all of the requirements or selected recommended measures in 
our review.

Required compliance plan elements and selected recommended measures[A]: 
5. Enforcement of standards through disciplinary guidelines; 
Recommended measures; Extent of Part D sponsors' implementation[B]: 
A[C]: The sponsor met all of the requirements or selected recommended 
measures in our review; Extent of Part D sponsors' implementation[B]: 
B[C]: The sponsor met all of the requirements or selected recommended 
measures in our review; Extent of Part D sponsors' implementation[B]: 
C[C]: The sponsor met all of the requirements or selected recommended 
measures in our review; Extent of Part D sponsors' implementation[B]: 
D: The sponsor met all of the requirements or selected recommended 
measures in our review; Extent of Part D sponsors' implementation[B]: 
E: The sponsor met all of the requirements or selected recommended 
measures in our review.

Required compliance plan elements and selected recommended measures[A]: 
6. Internal monitoring and auditing; Required elements; Extent of Part 
D sponsors' implementation[B]: A[C]: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation[B]: B[C]: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation[B]: C[C]: The sponsor partially met the 
requirements or selected recommended measures if they met some but not 
all of the requirements or recommendations in our review; Extent of 
Part D sponsors' implementation[B]: D: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation[B]: E: The sponsor did not meet any of 
the requirements or selected recommended measures in our review.

Required compliance plan elements and selected recommended measures[A]: 
6. Internal monitoring and auditing; Recommended measures; Extent of 
Part D sponsors' implementation[B]: A[C]: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation[B]: B[C]: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation[B]: C[C]: The sponsor partially met the 
requirements or selected recommended measures if they met some but not 
all of the requirements or recommendations in our review; Extent of 
Part D sponsors' implementation[B]: D: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation[B]: E: The sponsor did not meet any of 
the requirements or selected recommended measures in our review.

Required compliance plan elements and selected recommended measures[A]: 
7. Prompt responses to detected offenses; Required elements; Extent of 
Part D sponsors' implementation[B]: A[C]: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation[B]: B[C]: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation[B]: C[C]: The sponsor partially met the 
requirements or selected recommended measures if they met some but not 
all of the requirements or recommendations in our review; Extent of 
Part D sponsors' implementation[B]: D: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation[B]: E: The sponsor met all of the 
requirements or selected recommended measures in our review.

Required compliance plan elements and selected recommended measures[A]: 
7. Prompt responses to detected offenses; Recommended measures; Extent 
of Part D sponsors' implementation[B]: A[C]: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation[B]: B[C]: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation[B]: C[C]: The sponsor partially met the 
requirements or selected recommended measures if they met some but not 
all of the requirements or recommendations in our review; Extent of 
Part D sponsors' implementation[B]: D: The sponsor met all of the 
requirements or selected recommended measures in our review; Extent of 
Part D sponsors' implementation[B]: E: The sponsor met all of the 
requirements or selected recommended measures in our review.

Source: GAO analysis of documentation collected from the five Part D 
sponsors reviewed.

[A] CMS's chapter 9 guidance provided several recommendations for how 
sponsors should implement a program to control fraud, waste, and abuse 
as part of an effective Part D compliance plan. Our data collection 
instrument did not include all of CMS's recommended measures. We 
selected recommended measures for inclusion in our data collection 
instrument based on a variety of factors, such as measures that were 
the most helpful to fulfilling the purpose of the requirements.

[B] The five sponsors we reviewed are labeled A through E.

[C] For our analyses of requirements and recommendations related to 
Part D sponsors' contractors, we limited our review to first-tier 
entities. This Part D sponsor had a first-tier entity. First-tier 
entities are parties that contract with a Part D sponsor to provide 
administrative services or health care services for a Medicare eligible 
individual under Part D. One example of a first-tier entity is a 
pharmacy benefit manager under contract to a Part D sponsor. 

[End of table] 

The specific required compliance plan elements and recommended fraud 
and abuse measures implemented by the five Part D sponsors we reviewed 
were as follows:

Written Policies, Procedures, and Standards of Conduct:

Requirements:

All five Part D sponsors we reviewed completely met the requirements 
for written policies, procedures, and standards of conduct. All five 
had the required written policies, procedures, or the standards of 
conduct that articulated a commitment to comply with all applicable 
federal and state standards. All three Part D sponsors that relied on a 
first-tier entity in carrying out its Part D responsibilities had 
included provisions in their contract with the entity requiring 
compliance with all applicable federal laws, regulations, and CMS 
instructions.[Footnote 26]

Recommended Measures:

All five Part D sponsors completely met the selected recommended 
measures by having written policies, procedures, or standards of 
conduct that applied to detecting, correcting, and preventing fraud, 
waste, and abuse. All five had standards of conduct that were available 
to employees on the Part D sponsors' internal Web sites. In addition, 
Part D sponsors reported that information regarding written policies, 
procedures, or standards of conduct was disseminated through training 
or employees had to sign attestations that they had reviewed and 
understood the policies, or both.

Compliance Officer and Compliance Committee:

Requirements:

Four of the five Part D sponsors completely met the requirements for 
having both a compliance officer and compliance committee accountable 
to senior management. The remaining Part D sponsor only partially met 
the requirement because it did not have a compliance committee. Of the 
five Part D sponsors' compliance officers, three of the compliance 
officers had been in that role since the Part D benefit was implemented 
in January 2006. The other two compliance officers started in their 
roles during 2007.

All of the Part D compliance committees that existed were overseen by 
the compliance officer, were accountable to senior management, and were 
responsible for advising the compliance officer on various issues, 
ranging from implementing compliance plans to developing their Part D 
operations. For example, one Part D compliance committee was involved 
in monitoring the implementation of the activities outlined in the 
compliance plan, providing regular reports to senior management, and 
providing input on training. Another Part D sponsor used its corporate 
compliance committee instead of a separate Part D compliance committee 
to address Part D issues; a formal Part D compliance committee had not 
been implemented. The corporate compliance committee meetings included 
senior executives and the Part D compliance officer.

Recommended Measures:

Three Part D sponsors completely met the selected recommended measures 
for a compliance officer and committee. Two Part D sponsors partially 
met the recommended measures. Of these, one sponsor's compliance 
officer did not report to senior management on at least a quarterly 
basis.[Footnote 27] The compliance officer from this Part D sponsor 
stated that he or she did not report regularly to senior management 
because the Part D sponsor had yet to have any cases that were 
determined to be fraud, waste, or abuse. The remaining Part D sponsor's 
compliance committee did not meet on at least a quarterly basis.

All five Part D compliance officers were responsible for overseeing and 
monitoring the implementation and maintenance of fraud and abuse 
programs, as recommended. The range of activities and responsibilities 
for the Part D compliance officers varied. Two compliance officers were 
directly involved in fraud and abuse program activities, while the 
other three delegated those responsibilities to other staff, or some 
components of their role were a function of another department or were 
delegated to a contractor. For example, one compliance officer was 
involved in decisions regarding fraud, waste, and abuse investigations 
and corrective actions, while another compliance officer delegated this 
responsibility.

Effective Training and Education:

Requirements:

We found that four of the five Part D sponsors provided their Part D 
employees with general fraud, waste, and abuse training that covered 
Part D. Two of these sponsors completely met the requirements for 
education and training by also providing or ensuring that their Part D 
employees and first-tier entity, if applicable, received general fraud, 
waste, and abuse training.[Footnote 28] Two other sponsors partially 
met the requirements--they provided general fraud, waste, and abuse 
training to Part D employees, but they did not provide this training to 
their first-tier entity or ensure that the entity's employees received 
it. One Part D sponsor did not meet the requirements because it did not 
provide a general training that covered Part D fraud, waste, and abuse 
to its employees. However, this sponsor reported that a general fraud, 
waste, and abuse training module on Part D was in development.

The training curriculums of the Part D sponsors covered common fraud 
risks and vulnerabilities; federal laws related to fraud, waste, and 
abuse; and the sponsors' protocols for detection and referral to 
government authorities. However, the extent of information about 
detecting, correcting, and preventing fraud in Part D varied among the 
curriculums.[Footnote 29] For example, one sponsor's corporate-wide 
Ethics and Compliance training course contained a section on health- 
care fraud that had one reference to Part D. Similarly, another sponsor 
added a section to its preexisting healthcare fraud and abuse training 
curriculum for identifying Part D violations, such as enrolling a 
Medicare beneficiary in a plan different than the one the beneficiary 
selected. In contrast, one sponsor developed a fraud and abuse training 
that was entirely devoted to Part D and that discussed in detail CMS's 
requirements and recommendations for an effective Part D fraud and 
abuse program and how the sponsor was meeting those standards. In 
addition, this sponsor's curriculum was the only one that identified 
the potential for misconduct at the sponsor level. Specifically, this 
sponsor's curriculum provided hypothetical scenarios of risks that 
employees may encounter on the job--such as a supervisor asking an 
employee to falsify Part D data submitted to the government to inflate 
enrollment.

Recommended Measures:

Only one Part D sponsor completely met the selected recommended 
measures for education and training by providing general training that 
covered Part D fraud, waste, and abuse to its employees on at least an 
annual basis and providing specialized training to its employees whose 
responsibilities or departments, such as marketing, put them at greater 
risk of encountering fraud, waste, or abuse.[Footnote 30] This sponsor 
provided employees in its pharmacy benefit management department with a 
specialized training on the government's guidelines for preventing 
fraud, waste, and abuse in Part D. Three sponsors partially met the 
recommended measures; two did not provide specialized training to their 
Part D employees and three did not ensure that this training was 
provided to first-tier entities. One Part D sponsor did not meet any of 
the selected recommended measures for effective training and education. 
Additionally, we found that one sponsor's interpretation of CMS's 
recommendation for specialized training differed from CMS's 
expectations. An official from this sponsor considered that operational 
training in a particular job function met this recommendation, even 
though the training did not include a reference to fraud, waste, and 
abuse.

Effective Lines of Communication:

Requirements:

All five Part D sponsors completely met the requirements for effective 
lines of communication by having lines of communication between the 
compliance officer and the organization's management, employees, and 
contractors. While the lines of communications may not have been 
directed to the compliance officers, all of these officers had access 
to information received on these lines.

Recommended Measures:

In addition, all five Part D sponsors met the selected recommended 
measures. Specifically, all five Part D sponsors used reporting 
mechanisms to receive reports of potential fraud, waste, and abuse and 
had investigated these reports within two weeks, as recommended. All 
five had confidential or anonymous mechanisms, such as hotlines, for 
receiving compliance questions, reports of potential risks, and reports 
of potential fraud, waste, or abuse from internal and external parties. 
All five sponsors we reviewed had separate reporting mechanisms for 
internal parties, including employees, and for external parties, 
including beneficiaries, to report potential offenses.

All five Part D sponsors made information about the methods for 
reporting potential offenses available to internal and external 
parties, as recommended. For internal parties, all five Part D sponsors 
provided information to employees regarding the methods for reporting 
potential offenses on their companies' internal Web sites. In addition, 
four Part D sponsors provided information regarding the hotline number 
and other methods for reporting to employees during their Medicare Part 
D fraud and abuse training. For external parties, two of the compliance 
officers for the Part D sponsors in our review reported that 
beneficiaries were typically informed of the methods for reporting 
potential fraud and abuse on their explanation of benefits. One Part D 
sponsor provided promotional material to one of their first-tier 
entities with the hotline number for reporting potential fraud, waste, 
or abuse.

All five Part D sponsors had investigated concerns and reports of 
potential offenses received through the internal or external reporting 
mechanisms, as recommended. One Part D sponsor delegated investigation 
activities to a first-tier entity. Only two of the five Part D sponsors 
had received Part D fraud reports through the internal reporting 
mechanism. One Part D sponsor stated that Part D concerns may not have 
been reported through the internal mechanism because employees were 
bypassing the internal hotline and using other mechanisms for 
reporting, such as directly reporting a potential case of fraud, waste, 
or abuse to the special investigations unit. An official from another 
Part D sponsor reported that it had yet to receive any calls related to 
Medicare Part D on its internal reporting mechanism.

All five Part D sponsors in our review had addressed or responded to 
reports of potential offenses received through their external reporting 
mechanism, including reports of potential offenses by beneficiaries and 
pharmacy providers. For example, one Part D sponsor received a report 
from a pharmacy that a family member of one of the sponsor's 
beneficiaries was filling prescriptions for a drug for his own use and 
paying for them with the beneficiary's Medicare Part D benefit. Other 
Part D sponsors received reports that beneficiaries were doctor 
shopping or selling their prescription drugs.

Enforcement of Standards through Disciplinary Guidelines:

Requirements:

The requirements for the enforcement through disciplinary guidelines 
were completely met by all five Part D sponsors. All five of the Part D 
sponsors in our review enforced standards through well-publicized 
disciplinary guidelines for individuals, as required. Most sponsors' 
disciplinary guidelines were corporate policies that applied to all 
company products, including the Part D prescription drug plan.

Recommended Measures:

All five Part D sponsors promoted the disciplinary guidelines to 
encourage reporting of potential offenses, as recommended. Officials 
for all five Part D sponsors reported that disciplinary guidelines were 
incorporated into training courses or were available on the sponsor's 
internal Web sites, or both. To publicize enforcement of disciplinary 
standards, one sponsor used its Ethics and Compliance Newsletter to 
communicate that disciplinary actions had been taken.

Internal Monitoring and Auditing:

Requirements:

Three Part D sponsors completely met the requirements by having 
procedures for internal monitoring and auditing at the sponsor and 
first-tier entity level, when applicable. One Part D sponsor partially 
met the requirements because, although it had procedures for internal 
monitoring and auditing, this sponsor did not have the monitoring and 
auditing procedures for its first-tier entity. One Part D sponsor did 
not meet the requirements because it did not provide us with internal 
monitoring and auditing procedures that met the criteria.

Sponsors' monitoring procedures were often broadly-focused departmental 
manuals that generally did not specifically refer to Part D. Auditing 
procedures included work plans with time frames for completion or 
processes for responding to auditing results.

Recommended Measures:

Three Part D sponsors completely met the recommended measures for 
internal auditing and monitoring because they implemented procedures 
for monitoring and auditing at the sponsor and first-tier entity, when 
applicable, and conducted data analysis and risk assessments. One Part 
D sponsor partially met the recommended measures because it had not 
monitored or audited its first-tier entity. One Part D sponsor did not 
meet any of the recommended measures.

The data-monitoring activities of the sponsors in our review typically 
focused on protecting corporate assets against fraudulent claims by 
third parties, rather than detecting fraud, waste, or abuse at the 
sponsor level as well, as recommended to protect the Medicare program 
and its beneficiaries. Sponsors' data monitoring for Part D typically 
focused on the conduct of external parties, such as monitoring 
pharmacies' dispensing patterns, beneficiaries' drug utilization, and 
physicians' prescribing patterns, and did not monitor internal 
practices by the sponsor or its employees that also posed risks for 
Medicare, such as double billing of Medicare.

Similarly, sponsors' monitoring activities for Part D often reflected 
activities in place before Part D for their other lines of business, 
such as regular analyses of prescriptions claims data from pharmacies 
in their network, and did not generate a separate analysis of Part D 
claims. In our review, we found that only one sponsor targeted its 
monitoring efforts specifically to detect fraud, waste, and abuse in a 
Part D risk area. This sponsor mined Part D claims for irregular 
activities, such as signs of doctor shopping among beneficiaries 
prescribed narcotics. The sponsor's compliance officer also noted that 
the special investigations unit sometimes engaged in additional Part D 
data monitoring if prompted by a suspected case of fraud, waste, or 
abuse.

We found that four of the five sponsors conducted internal audits for 
Part D, as recommended. The audits generally focused on Part D 
operations and did not specifically audit for fraud, waste, or abuse. 
In general, sponsors' Part D audit subjects related to operational 
issues or risks to company assets, such as the accuracy and 
completeness of the Part D membership process, Part D disenrollment 
issues, and the completeness and accuracy of pharmacy claims data. For 
example, one Part D sponsor's audit identified administrative issues in 
collecting unpaid premiums from Part D beneficiaries and lack of timely 
processing of beneficiary applications. A Part D audit by another 
sponsor identified inaccurate pharmacy claims as potentially leading to 
overpayments of claims by the sponsor as opposed to Medicare. Only one 
sponsor's audit specifically cited detection of possible fraud, waste, 
and abuse in Medicare Part D as the purpose of the audit. This audit of 
20,000 pharmacy claims identified more than $1.2 million in Part D 
overpayments for recovery from pharmacies. This was the only example 
provided to us that identified funds for possible repayment to Medicare.

Of the three sponsors that had a first-tier entity for Part D--such as 
a pharmacy benefit manager--two monitored and audited their first-tier 
entity, as recommended. One sponsor official said that because billing 
was a high-risk area for fraud, they check for billing irregularities 
in audits of their first-tier entity.

Four sponsors conducted risk assessments to identify risk areas 
associated with their Part D programs. Sponsors' risk assessments cited 
internal issues that pose risks for fraud, waste, and abuse in Part D-
-such as proper reporting of overpayments to CMS, accuracy and 
truthfulness of the data submitted to CMS for the purpose of federal 
reimbursement, and sales conduct that may mislead or confuse 
beneficiaries, or misrepresent the product. One Part D sponsor had 
undertaken internal audits that reflected the internal Part D fraud, 
waste, and abuse risks cited in its risk assessment, as recommended.

Prompt Responses to Detected Offenses and Corrective Action:

Requirements:

Four sponsors completely met the requirements for prompt responses and 
corrective action initiatives by developing the respective procedures 
and conducting timely and reasonable inquiry into potential offenses. 
One sponsor only partially met the requirements because this sponsor 
had not developed corrective action procedures in the event that fraud, 
waste, or abuse was detected. The corrective action procedures provided 
by Part D sponsors varied in the level of detail and information 
provided. For example, one sponsor cited its employee disciplinary 
guidelines as its corrective action procedures, while another sponsor's 
corrective action procedures addressed various stakeholders--pharmacy 
providers and beneficiaries--and the possible actions to be taken in 
the event of a compliance violation or detected offense.

All Part D sponsors reported initiating inquiries into reported 
potential offenses as required. Four Part D sponsors reported that they 
had cases that warranted corrective action. Only one sponsor reported 
the need to take disciplinary action against one of its employees. This 
Part D sponsor reported terminating an employee for being involved in 
an identity-theft scheme using the personal identification information 
of beneficiaries. This Part D sponsor also reported terminating a 
pharmacy technician after the technician stole a beneficiary's 
prescription from the pharmacy refill center and attempted to sell it 
to the beneficiary at a discounted price. As a result of criminal 
proceedings, this individual was sentenced to 2 years of probation, and 
ordered to pay restitution for the cost of the drug. Finally, three 
sponsors reported repaying CMS an overpayment, as required.

The four sponsors that reported taking disciplinary or corrective 
actions varied in their understanding and use of such actions. One Part 
D sponsor reported that instead of taking corrective or disciplinary 
action itself, most often cases were turned over to the MEDICs or local 
law enforcement to determine the necessary course of action. Another 
Part D sponsor reported that its understanding of taking a corrective 
action was reporting the case to the MEDIC.

Recommended Measures:

Three of the Part D sponsors completely met the selected recommended 
measures in our review by: (1) having procedures that specified that an 
investigation into a detected offense would begin within two weeks 
after it was reported; (2) having procedures to voluntarily self-report 
any findings of potential fraud or misconduct to CMS or the appropriate 
government authority; and (3) self-reporting any findings of potential 
fraud or misconduct to CMS or the appropriate government authority, if 
warranted. Two Part D sponsors only partially met the recommended 
measures because they did not have procedures specifying that an 
investigation into a detected offense would begin within 2 weeks after 
it was reported.

All five Part D sponsors we reviewed had procedures in place for 
voluntarily self-reporting fraud or misconduct to the MEDICs or CMS, as 
recommended. All five sponsors had also self-reported potential Part D 
fraud or misconduct to the MEDICs. For example, an official from a Part 
D sponsor reported that the sponsor referred a case to the MEDIC after 
conducting an investigation that identified a "phantom pharmacy" 
billing over $2 million in false claims.

CMS's Oversight of Part D Sponsors' Fraud and Abuse Programs Has Been 
Limited:

CMS's oversight of Part D sponsors' fraud and abuse programs has been 
limited. CMS's oversight activities to date have included the review 
and approval of fraud and abuse program plans that Part D sponsors 
submit as part of their initial Part D sponsor applications. Although 
CMS indicated that it planned to conduct audits to monitor Part D 
sponsors' implementation of fraud and abuse programs, CMS has not yet 
conducted these audits.

CMS's Activities Have Been Limited to the Initial Review and Approval 
of the Plans for Part D Sponsors' Fraud and Abuse Programs:

CMS's oversight activities to date have been limited to review and 
approval of Part D sponsors' compliance plans detailing their fraud and 
abuse program plans submitted as part of their initial Part D sponsor 
applications. A CMS official reported that in 2005, the first year 
program plans were reviewed, some sponsors submitted plans that did not 
meet the agency's requirements and recommendations specific to fraud, 
waste, and abuse in Part D. When starting the Part D program, a CMS 
official reported that CMS expected that sponsors would understand the 
regulations and that sponsors would articulate clearly how their 
compliance plans addressed fraud, waste, and abuse specific to Part D. 
However, this official told us that after reviewing the components of 
sponsors' compliance plans that were included in their Part D 
applications, CMS officials realized that sponsors needed more 
guidance. For example, a CMS official told us that some sponsors' 
applications needed follow-up on all of the components of their fraud 
and abuse programs. According to CMS officials, in many cases, Part D 
sponsors initially submitted corporate-wide compliance plans that did 
not address fraud, waste, and abuse specific to Part D, as CMS 
expected. Rather than disapproving these sponsors' fraud and abuse 
program plans, CMS officials reported that they worked with the 
sponsors to help them develop fraud and abuse program plans that would 
be approved in that first year.

CMS's review of fraud and abuse program plans was limited to the 
initial contract-application process. CMS officials reported that 
sponsors with approved fraud and abuse program plans prior to the 
issuance of chapter 9 in April 2006 were not required to resubmit 
program plans in order for CMS to verify that sponsors' plans were in 
accordance with the new guidance. In addition, CMS officials told us 
that CMS did not require Part D sponsors to submit new or updated fraud 
and abuse program plans during the contract renewal process for program 
year 2007 or 2008, which limited CMS's ability to ensure that existing 
Part D sponsors continued to maintain compliance with this requirement.

CMS also provided technical assistance, such as guidance and 
information sessions to Part D sponsors to help them understand the 
agency's expectations regarding the development and implementation of 
fraud and abuse programs. CMS also clarified its expectations regarding 
sponsors' fraud and abuse programs by issuing a final rule in December 
2007. In addition, CMS provided information sessions, such as the 
Compliance Conference in August 2006 that included Part D and an Open 
Door Forum in May 2006, to discuss the guidance for Part D sponsors 
regarding the development and implementation of fraud and abuse 
programs.

CMS Has Not Conducted Oversight Activities to Monitor Part D Sponsors' 
Implementation of Fraud and Abuse Programs:

CMS has not conducted oversight activities of Part D sponsors' program 
implementation, such as audit and enforcement actions, to ensure 
compliance with fraud and abuse program requirements. CMS has taken a 
collaborative rather than an enforcement approach with Part D sponsors 
to implement the Part D program and safeguard it from fraud, waste, and 
abuse. In its Part D Oversight Strategy, issued in 2005, CMS stated 
that it would reserve enforcement activities to large, repeated, or 
extreme Part D program violations.[Footnote 31]

Part D oversight responsibilities are shared between two CMS offices. 
First, the CBC has responsibility for Part D operational oversight, 
including sponsor compliance with all Part D program rules. In April 
2006, CMS's CBC issued a Part D Audit Protocol identifying 14 program 
areas for its audits of Part D sponsors, such as sponsors' 
implementation of CMS's fraud and abuse program requirements.[Footnote 
32] However, in November 2006, CBC issued a short-term audit strategy 
stating that it had limited resources for auditing Part D programs due 
to the increasing number of organizations contracting with CMS to offer 
Medicare products. CBC noted that it did not have the resources to 
audit every plan, across every program attribute, every 3 years as 
originally stated in its 2005 Oversight Strategy. CBC reported that it 
would identify the minimal level of effort needed to meet its oversight 
responsibilities and ensure that Medicare stakeholders remained 
confident in the program. CBC stated that to conserve resources it 
would be conducting desk audits as much as possible, which would 
consist of reviews of documents requested from Part D sponsors.

In 2007, the CBC initiated program audits based upon the short-term 
audit strategy it issued in November 2006. In 2007, these CBC program 
audits assessed Part D sponsors' compliance with selected program 
areas, but the CBC audits did not assess sponsors' implementation of 
fraud and abuse programs. Moreover, CBC does not plan to audit 
sponsors' implementation of fraud and abuse programs in 2008. In June 
2007, CBC conducted a self-assessment survey of Part D sponsors 
regarding the implementation of their fraud and abuse programs. A CBC 
official reported that the purpose of the survey was to help CMS 
identify the degree to which sponsors implemented compliance plan 
requirements and recommended measures. In a follow up survey conducted 
in March and April 2008, CBC found that nearly all prescription drug 
plans (PDP) reported that they fully met CMS's compliance plan 
requirements.

Secondly, CMS's OFM has a targeted role in oversight that focuses on 
financial oversight and program integrity, such as Part D fraud 
prevention and detection. CMS contracted with the MEDICs, which are 
overseen by OFM, to assist with OFM's program integrity efforts for 
Part D. Audits of Part D sponsors' compliance plans are part of the 
current MEDIC statement of work. However, no task orders specific to 
auditing sponsors' fraud and abuse programs have been issued. 
Accordingly, no audits of sponsors' fraud and abuse programs have been 
initiated since the Part D program began. In comments on a draft of 
this report, CMS stated that each MEDIC will begin audits of Part D 
sponsors' compliance plans by the end of summer 2008. The MEDICs will 
use the Compliance Plan Audit Chapter of the Part D Audit Guide to 
perform this work.

An OFM official told us that OFM has limited funding for the MEDICs' 
fraud and abuse program audits. OFM explained that under funding levels 
as of April 2008, the MEDICs receive and investigate reports of fraud, 
but the MEDICs did not have the staff to conduct audits of sponsors' 
programs to control fraud, waste, and abuse.[Footnote 33]

Conclusions:

We have designated the overall Medicare program as high risk, and the 
size, nature, and complexity of the Part D program make it a particular 
risk for fraud, waste, and abuse. In spite of this risk and 3 years 
after the start of the Part D program, CMS has not conducted oversight 
activities to monitor sponsors' implementation of fraud and abuse 
programs. CMS has acknowledged that program compliance and integrity 
audits conducted by CMS are necessary to ensure compliance and document 
CMS's program oversight responsibilities. In particular, the agency 
reported that it would conduct audits of fraud and abuse programs in 
2007. However, although both offices have the responsibility to do so, 
CBC has not conducted these audits, and OFM has not initiated MEDIC 
audits of fraud and abuse programs as it had planned.

Our review of five Medicare Part D sponsors' implementation of fraud, 
waste, and abuse programs supports the need for such oversight. We 
found that none of these five sponsors, which cover more than a third 
of Part D enrollees, completely implemented all of the required 
compliance plan elements and selected recommended measures for their 
fraud and abuse programs. Lack of CMS oversight of Medicare Part D 
sponsors' implementation of programs to prevent fraud, waste, and abuse 
risks significant misuse of funds in this $39 billion program. We 
believe that CMS oversight of Medicare Part D sponsors' programs could 
increase the completeness of sponsors' implementation of required 
compliance plan elements and selected recommended measures and, as a 
result, reduce the risk to Medicare.

Recommendation for Executive Action:

To help safeguard the Medicare Part D program from fraud, waste, and 
abuse, we recommend the Administrator of CMS ensure that CMS conducts 
timely audits of Part D fraud and abuse programs to monitor sponsors' 
implementation of these programs.

Agency Comments and Our Evaluation:

CMS provided written comments on a draft of this report. CMS stated 
that it concurred with our recommendation and that it is prioritizing 
its oversight activities to ensure sponsors' compliance with CMS's 
policies. CMS also agreed with our finding regarding the extent to 
which Part D sponsors have implemented programs to control fraud, 
waste, and abuse. CMS disagreed with our finding that the agency's 
oversight has been limited. However, CMS's comments did not provide 
additional evidence of audits of sponsors' fraud, waste, and abuse 
programs, or of oversight activities beyond those described in the 
report. We believe that such audits are necessary to ensure sponsors' 
compliance.

In addition, CMS stated that insufficient resources have been one of 
the primary impediments to its implementation of a robust oversight 
strategy. CMS noted that Congress did not respond to its request for 
additional program integrity funds in fiscal year 2006 through fiscal 
year 2008. However, we believe that program integrity will remain at 
risk until CMS conducts timely audits to monitor Part D sponsors' 
implementation of fraud and abuse programs. CMS's written comments are 
reprinted in appendix II. CMS also provided technical comments, which 
we incorporated as appropriate.

As agreed with your office, unless you publicly announce the contents 
of this report earlier, we plan no further distribution of it until 30 
days from the date of this report. We will then send copies to the 
Administrator of CMS, appropriate congressional committees, and other 
interested parties. We will also make copies available to others upon 
request. This report is also available at no charge on GAO's Web site 
at [hyperlink, http://www.gao.gov].

If you or your staff have questions about this report, please contact 
me at (202) 512-7114 or at kingk@gao.gov. Contact points for our Office 
of Congressional Relations and Public Affairs may be found on the last 
page of this report. GAO staff who made major contributions to this 
report are listed in appendix III.

Sincerely yours, 

Signed by: 

Kathleen M. King: 
Director, Health Care:

[End of section]

Appendix I: Methodology for Examining Certain Sponsors' Implementation 
of Fraud and Abuse Programs for Part D:

To examine the extent to which certain Part D sponsors implemented 
programs to control fraud, waste, and abuse, we conducted on-site 
reviews at five Part D sponsors. We selected these five sponsors for 
our review because they each offered a stand-alone Part D prescription 
drug plan that provided nationwide coverage,[Footnote 34] varied in 
enrollment size, and collectively provided coverage for a sizeable 
proportion of Part D beneficiaries.[Footnote 35] These five national 
prescription drug plans (PDP) selected for our review from these five 
sponsors represented about 35 percent of total Medicare Part D 
enrollment as of April 2007. Our sample is not generalizable to the 
entire Part D sponsor population. Four of the five sponsors we reviewed 
were private health insurance companies and one was a pharmacy benefit 
manager.

For these on-site reviews, we developed a data collection instrument 
based on: (1) the required compliance plan elements and certain 
recommended measures for fraud and abuse programs outlined in 
regulations[Footnote 36] and chapter 9 of the Part D Prescription Drug 
Benefit Manual and (2) additional input provided by the Centers for 
Medicare & Medicaid Services (CMS).[Footnote 37] CMS's regulations 
provided the core required elements of a compliance plan and 
established a framework for fraud and abuse programs. CMS's chapter 9 
guidance provided several recommendations for how sponsors should 
implement a program within that framework to control fraud, waste, and 
abuse as part of an effective Part D compliance plan. Our data 
collection instrument did not include all of CMS's recommended 
measures. We selected recommended measures for inclusion in our data 
collection instrument based on a variety of factors, such as measures 
that we judged were the most helpful to fulfilling the purpose of the 
requirements, measures that were recommended by the OIG and subject- 
matter experts for compliance program evaluations, including government 
officials from Veterans' Affairs (VA) and an industry representative, 
measures that helped tailor a fraud and abuse program to Part D, and 
measures that indicated that a required component or procedure had been 
implemented. For example, CMS required procedures for internal 
monitoring and auditing, but provided a variety of recommendations on 
the types of internal monitoring and auditing that could be 
implemented. We selected the recommendations we considered to be the 
most helpful to fulfilling the requirements, such as the recommendation 
to conduct an audit, rather than the recommendation regarding the size, 
scope, and structure of the internal audit department.

This study extends beyond a previous report from the Office of the 
Inspector General (OIG), which reviewed Part D sponsors' compliance 
plans to assess whether the plans addressed all of the requirements and 
selected recommendations.[Footnote 38] The OIG limited its assessment 
to a document review of the compliance plans submitted to CMS and did 
not assess the extent to which the compliance plans had been 
implemented. However, we assessed the implementation of the compliance 
plans by reviewing documentary evidence on-site to examine how sponsors 
addressed fraud, waste, and abuse specific to Medicare Part D for each 
of the required elements of each Part D sponsor's compliance plan. This 
included the compliance plan and any additional documents, such as 
procedures, that were referenced in the compliance plan.

To complete our data collection instrument, we used documentary 
evidence to verify implementation of each element. We requested at 
least one document pertaining to each of the required elements and 
selected recommended measures. For example, we asked the sponsors to 
provide a copy of the required auditing procedures and evidence that 
the Part D sponsor had implemented the auditing procedures as 
recommended by providing a copy of the findings from at least one audit 
related to Part D that had been conducted. Our determination of whether 
sponsors met the criteria for a requirement or recommendation was based 
on the document's applicability to Part D and the specific element 
under review, not the extensiveness of the document's content. For 
example, some evidence we accepted contained one section referencing 
the requirement or recommendation, while other documents were more 
detailed. All the policies and procedures in the documents we reviewed 
were implemented by sponsors and in use at the time of our on-site 
reviews. In addition, we determined that the sponsors' met the 
requirements or selected recommendations if they implemented the 
required element or selected recommended measures in their compliance 
plan.

We also conducted interviews with Part D sponsor senior administrators, 
and compliance and other staff, including contractors' employees. 
[Footnote 39] To gain a comprehensive picture of the sponsor's fraud 
and abuse activities, in some cases, we also interviewed additional 
staff members involved in Part D functions, including staff from 
departments such as special investigations, monitoring and auditing, 
ethics, and pharmacy benefit management.

[End of section]

Appendix II: Comments from the Centers for Medicare & Medicaid Services:

Department Of Health & Human Services: 
Office Of The Secretary: 
Assistant Secretary for Legislation: 
Washington, DC 20201: 

July 8, 2008: 

Kathleen M. King: 
Director, Health Care: 
441 G Street NW: 
U.S. Government Accountability Office: 
Washington, D.C. 20548: 

Dear Ms. King: 

Enclosed are the Department's comments on the U.S. Government 
Accountability Office's (GAO) draft report entitled, "Medicare D: Some 
Plan Sponsors Have Not Completely Implemented Fraud and Abuse Programs, 
and CMS Oversight Has Been Limited" (GAO 08-760). 

The Department appreciates the opportunity to comment on this draft 
before its publication. 

Sincerely, 

Signed by: 
Jennifer R. Luong, for: 
Vincent J. Ventimiglia, Jr. 
Assistant Secretary for Legislation: 

Attachment: 

Department Of Health & Human Services: 
Centers for Medicare and Medicaid Services: 
Office of the Administrator: 
Washington, DC 20201: 

Date: July 3, 2008: 

To: Vincent J. Ventimiglia, Jr. 
Assistant Secretary for Legislation: 

From: [Signed by] Kerry Weems: 
Acting Administrator: 

Subject: Government Accountability Office (GAO) Draft Report - 
"Medicare Part D: Some Plan Sponsors Have Not Completely Implemented 
Fraud and Abuse Programs, and CMS Oversight Has Been Limited" (GAO-08-
760): 

The Centers for Medicare & Medicaid Services (CMS) appreciates the 
opportunity to review and comment on the GAO draft report entitled 
"Medicare Part D: Some Plan Sponsors Have Not Completely Implemented 
Fraud and Abuse Programs, and CMS Oversight Has Been Limited" (GAO-08-
760). This report specifically examined the extent to which Part D plan 
sponsors had implemented programs to control fraud, waste, and abuse 
and CMS' oversight of those programs. We agree with GAO's findings 
regarding the extent to which Part D plan sponsors have implemented 
programs to control fraud, waste, and abuse. However, we disagree with 
GAO's finding that CMS' oversight has been limited. 

The CMS takes its responsibility to combat fraud, waste, and abuse 
seriously. and despite considerable budget constraints has seized many 
opportunities to provide oversight of plans' fraud and abuse program 
efforts. Through the use of the Medicare Part D Integrity Contractors 
(MEDICs), CMS has been monitoring fraud and abuse complaints in the 
Part D program since October 2005, and has taken appropriate action in 
response to those complaints as needed. One of CMS' first priorities 
was to provide detailed guidance to plan sponsors on CMS' expectations 
for internal fraud and abuse oversight. As the report indicated, we 
issued preliminary guidance in June 2005 and the final guidance in 
April 2006. This guidance is contained in Chapter 9, the Part D Program 
to Control Fraud. Waste and Abuse, of the Prescription Drug Benefit 
Manual and articulates the specific required and recommended fraud and 
abuse program elements sponsors should have in place. While we have not 
yet conducted onsite fraud and abuse program audits, in June 2007, we 
asked plan sponsors to complete a self-assessment survey and several 
months later a follow-up survey. These results have helped us identify 
the extent to which plan sponsors have implemented their fraud and 
abuse programs. We have conducted several training sessions for Part D 
plans on the role of the MEDICs and Chapter 9. 

MEDIC Funding: 

One of the primary impediments to CMS' successful implementation of a 
robust oversight strategy has been insufficient resources. Funding for 
the Medicare Integrity Program (MIP) budget was capped in 2003 at $720 
million. Since then. CMS has sustained a $90 million inflationary loss 
to its MIP purchasing power that has seriously degraded CMS' ability to 
meet its responsibilities in combating fraud and abuse. This loss, 
combined with the addition of the Medicare prescription drug benefit 
and the many changes in the Medicare Prescription Drug, Improvement, 
and Modernization At of 2003, has created funding challenges for CMS 
oversight. 

To preserve its commitment to program integrity, and to provide 
adequate resources for Part C and Part D oversight, CMS has requested 
additional MIP funding in each of the past 4 years. As shown in the 
chart below, these additional funds would have been made available 
through a discretionary cap adjustment for the Health Care Fraud and 
Abuse Control (HCFAC) account. Although no action has been taken to 
date on our fiscal year (FY) 2009 request, Congress did not provide any 
funding relief in FY 2006, FY 2007, or FY 2008. 

Table: 

Discretionary Cap Adjustment: 2006; 
Additional HCFAC Funding Requested: $80; 
MIP Portion: $75; 
Congressional Action: 0. 

Discretionary Cap Adjustment: 2007; 
Additional HCFAC Funding Requested: $118; 
MIP Portion: $86; 
Congressional Action: 0. 

Discretionary Cap Adjustment: 2008; 
Additional HCFAC Funding Requested: $183; 
MIP Portion: $138; 
Congressional Action: 0. 

Discretionary Cap Adjustment: 2009; 
Additional HCFAC Funding Requested: $198; 
MIP Portion: $147; 
Congressional Action: TBD. 

[End of table] 

Though the volume of fraud and abuse complaints has decreased since the 
beginning of the Part D program, the volume continues to require 
extensive MEDIC resources to thoroughly investigate and respond to all 
of those complaints. As such, there have not been sufficient additional 
resources to allow the MEDICs to engage in the types of audit oversight 
activities originally envisioned at the onset of the program.

GAO Recommendation: 

To help safeguard the Medicare Part D program from fraud, waste and 
abuse, we recommend the Administrator of CMS ensure that CMS conducts 
timely audits of Part D fraud and abuse programs to monitor sponsors' 
implementation of these programs. 

CMS Response: 

We concur with the recommendation. Within the confines of our existing 
resources due to budget constraints, we will continue to prioritize our 
oversight efforts to the maximum extent possible. CMS already conduct 
audits to assess sponsor's compliance with their contract requirements 
and is required by Congress to audit one-third of the sponsors each 
year to ensure the accuracy of their financial information. CMS will 
continue to be aggressive with Part D sponsors that are non-compliant 
with our policies. As always, we stand ready to take appropriate action 
against any Part D sponsor that fails to meet our requirements. We 
share the GAO's goal of ensuring appropriate oversight of the Part D 
plan sponsors and numerous efforts are currently in place at CMS to 
further that goal, We look forward to working with the GAO as we 
proceed to address this issue. 

[End of section]

Appendix III: GAO Contact and Staff Acknowledgments:

GAO Contact:

Kathleen M. King at (202) 512-7114 or kingk@gao.gov:

Acknowledgments:

In addition to the contact named above, Martin T. Gahart, Assistant 
Director; Jennifer Apter; Catina Bradley; Jawaria Gilani; Jennel 
Harvey; Joy Kraybill; Amy Shefrin; and Jennifer Whitworth made key 
contributions to this report. 

[End of section] 

Footnotes: 

[1] Medicare beneficiaries who are enrolled in fee-for-service Medicare 
may obtain Part D drug coverage through stand-alone prescription drug 
plans (PDP), which offer only a prescription drug benefit. Medicare 
beneficiaries enrolled in Medicare's managed care program may obtain 
Part D drug coverage through Medicare Advantage prescription drug plans 
(MA-PD). A majority of Part D enrollees are enrolled in stand-alone 
PDPs.

[2] Enrollment in Medicare PDPs and MA-PDs is as of January 2007. 

[3] According to CMS, these expenditures are for PDP and MA-PD 
contracts only, and are subject to change due to CMS's reconciliation 
process.

[4] GAO, Prescription Drugs: Oversight of Drug Pricing in Federal 
Programs, [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-481T] 
(Washington, D.C.: Feb. 9, 2007). U.S. House of Representatives Ways 
and Means Subcommittees on Health and Oversight, 110th Cong., March 8, 
2007 (testimony of Daniel R. Levinson, HHS Inspector General) and U.S. 
House of Representatives Oversight and Government Reform Committee, 
110th Cong., February 9, 2007 (testimony of Lewis Morris, Chief Counsel 
to the HHS Inspector General). 

[5] GAO's audits and evaluations identify federal programs and 
operations that we determine are high risk due to their greater 
vulnerabilities to fraud, waste, abuse, and mismanagement. See GAO, 
High-Risk Series: An Update, [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-05-207] (Washington, D.C.: January 2005).

[6] Pub. L. No. 108-173 § 101, 117 Stat. 2066, 2086 (adding Social 
Security Act §1860D-4(c)(1)(D)) (codified at 42 U.S.C. § 1395w- 
104(c)(1)(D)).

[7] 72 Fed. Reg. 4,194, 4,555. The requirement for comprehensive 
compliance plans for Part D sponsors, including sponsors of PDPs and MA-
PDs, is located at 42 C.F.R § 423.504.

[8] In general, a compliance program is the internal set of policies, 
processes, and procedures that a provider organization implements to 
help it act ethically and lawfully. In this context, compliance plans 
help provider organizations prevent and detect violations of Medicare 
laws and regulations. See GAO, Medicare: Early Evidence of Compliance 
Program Effectiveness Is Inconclusive, GAO/HEHS-99-59 (Washington, 
D.C.: April 15, 1999). 

[9] Hereafter, we refer to programs to control fraud, waste, and abuse 
as fraud and abuse programs.

[10] The Prescription Drug Benefit Manual consists of multiple chapters 
related to various Part D program areas and outlines Part D program 
requirements and CMS guidance. The chapter in the Manual entitled 
"Chapter 9--Part D Program to Control Fraud, Waste and Abuse" addresses 
fraud, waste, and abuse in Part D.

[11] For the purposes of this report, the term contractor includes 
first-tier, downstream, and related entities. First-tier entities are 
parties that enter into written arrangements with a Part D sponsor to 
provide administrative services or health care services for a Medicare 
eligible individual under Part D. One example of a first-tier entity is 
a pharmacy benefit manager under contract to a Part D sponsor to 
provide pharmacy benefit management services such as contracting with a 
network of pharmacies on behalf of the Part D sponsor. Downstream 
entities are those below the level of a first-tier entity, such as a 
pharmacy. Related entities are entities that are related to the sponsor 
by common ownership or control and meet certain other criteria, such as 
performing some of the Part D sponsor's management functions under 
contract or delegation. For example, a Part D sponsor may be the parent 
company of an entity that the sponsor contracts with to provide 
services to Part D enrollees. 42 C.F.R. §§ 422.500(b), 423.501. 

[12] At the suggestion of CMS, we spoke with officials from the VA 
Office of Compliance and Business Integrity to learn more about the 
processes and tools that the VA uses to evaluate compliance and 
business integrity programs in the VA.

[13] One of the sponsors selected for the study had two stand-alone 
plans that, in combination, provided nationwide coverage. We chose the 
largest of these two for our study. 

[14] We limited our sample to sponsors' national stand-alone PDPs that 
contained greater than one percent of the total Part D enrollment. We 
then stratified the sample by enrollment size, selecting two sponsors 
from the top tier, two sponsors from the middle tier, and one sponsor 
from the bottom tier.

[15] On June 8, 2008, the Center for Beneficiary Choices (CBC) was 
reorganized and has been renamed the Center for Drug and Health Plan 
Choice (CPC). This reorganization did not affect the responsibilities 
of the center as detailed in this report.

[16] Social Security Act § 1860D-4(c)(1)(D).

[17] 42 C.F.R § 423.504(b)(4)(vi). CMS's January 2005 regulation 
required Part D sponsors to have a program to detect, correct, and 
prevent fraud, waste, and abuse as a specific element of the compliance 
plan. 70 Fed. Reg. 4,194, 4,555 (Jan. 28, 2005). CMS later determined 
that this element was redundant and issued amended regulations in 
December 2007 that removed this element. See 72 Fed. Reg. 68,700, 
68,705 (Dec. 5, 2007). In doing so, CMS clarified that each sponsor 
must include "measures to detect, correct, and prevent fraud, waste and 
abuse" in carrying out the remaining compliance plan elements. For the 
purposes of this report, all references to requirements are to the 
January 2005 regulations, as amended in December 2007. 

[18] In June 2005, CMS issued a summary document, "Review of Sponsors' 
Fraud, Waste, and Abuse Responsibilities," which served as a precursor 
to its comprehensive guidance for Part D sponsors' fraud and abuse 
programs.

[19] Part D sponsors hire contractors to handle a range of activities 
in Part D, such as claims processing; pharmacy benefit management; 
monitoring and auditing; or fraud, waste, and abuse detection and 
investigation.

[20] Certain Part D activities, such as the role of the Compliance 
Officer, cannot be delegated to a contractor. 72 Fed. Reg. 68,706. 

[21] The MMA requires CMS to annually audit at least one-third of all 
Part D organizations' financial records. OFM is responsible for these 
audits; however, these audits are outside the scope of our review.

[22] In addition to audits, MEDICs have been engaged to detect fraud, 
waste, and abuse in Part D and investigate reports from beneficiaries, 
sponsors, and other sources; conduct enrollment, eligibility, and 
marketing surveillance; and identify high-risk sponsors requiring 
further investigations. These tasks are outside of the scope of our 
report.

[23] According to CMS's Part D Audit Protocol, the program audits are 
expected to cover 14 broad subjects of program requirements, such as 
Enrollment and Disenrollment; Marketing and Beneficiary Information; 
Coordination of Benefits/True-Out-of-Pocket Costs; and Grievances, 
Coverage Determinations, and Appeals. Under one of those subject areas 
for program audits--Compliance Plan--CBC would audit sponsors' 
implementation of the compliance plan requirements, including a fraud 
and abuse program for Part D. 

[24] Department of Health and Human Services, Office of Inspector 
General, Prescription Drug Plan Sponsors' Compliance Plans, OEI-03-06- 
00100 (December 2006).

[25] Four of the five sponsors we reviewed had fraud and abuse programs 
in place prior to Part D, including established investigation units and 
internal auditing and monitoring to detect fraud, waste, and abuse 
across their corporate entities. These four sponsors, which were 
private health insurance companies, reported that they adapted and made 
relevant additions to their existing programs to address fraud, waste, 
and abuse specific to Part D. 

[26] For our analyses of requirements and selected recommendations 
related to Part D sponsors' contractors, we limited our review to first-
tier entities. While all five Part D sponsors in our review had 
contractors, only three had first-tier entities.

[27] This Part D sponsor also did not have a compliance committee, as 
required.

[28] One Part D sponsor that provided the required training to its 
employees did not have a first-tier entity; therefore, all of the 
required elements and selected recommended measures that applied to 
this sponsor were completely met. 

[29] In December 2007, CMS reported that it will consider developing a 
standardized training program accessible to all Part D stakeholders for 
the purpose of the effective training and education requirement.

[30] This sponsor did not have a Part D first-tier entity. Therefore, 
the recommendation to provide specialized training to a first-tier 
entity was not applicable for our review.

[31] CMS, Part D Oversight Strategy for Contractors/Industry, (Oct. 24, 
2005). 

[32] This includes program areas such as Compliance Plans; Enrollment 
and Disenrollment; Marketing and Beneficiary Information; Coordination 
of Benefits/True-Out-of-Pocket Costs; and Grievances, Coverage 
Determinations, and Appeals. 

[33] In its comments on a draft of this report, CMS stated that 
insufficient resources have been one of the primary impediments to its 
implementation of a robust oversight strategy. 

[34] One of the sponsors selected for the study had two stand-alone 
plans that, in combination, provided nationwide coverage. We chose the 
largest of these two for our study. 

[35] We limited our sample to sponsors' national stand-alone PDPs that 
contained greater than 1 percent of the total Part D enrollment. We 
then stratified the sample by enrollment size, selecting two sponsors 
from the top tier, two sponsors from the middle tier, and one sponsor 
from the bottom tier.

[36] 42 C.F.R. § 423.504.

[37] We also conducted a pilot site visit at one Part D sponsor to test 
our data collection instrument.

[38] Department of Health and Human Services, Office of Inspector 
General, Prescription Drug Plan Sponsors' Compliance Plans, OEI-03-06- 
00100 (December 2006).

[39] For our analyses of requirements and selected recommendations of 
Part D sponsors' contractors, we limited our review to first-tier 
entities. While all five Part D sponsors in our review had contractors, 
only three had first-tier entities.

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "E-mail Updates." 

Order by Mail or Phone: 

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to: 

U.S. Government Accountability Office: 
441 G Street NW, Room LM: 
Washington, D.C. 20548: 

To order by Phone: 
Voice: (202) 512-6000: 
TDD: (202) 512-2537: 
Fax: (202) 512-6061: 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: fraudnet@gao.gov: 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Ralph Dawn, Managing Director, dawnr@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, D.C. 20548: 

Public Affairs: 

Chuck Young, Managing Director, youngc1@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: