Testimony on the CFO Audit by June Gibbs Brown
Inspector General
U.S. Department of Health and Human Services

Before the Committee on Commerce, Subcommittee on Health and Environment & Subcommittee on Oversight and Investigations; and also before the Committee on Government Reform and Oversight, Subcommittee on Government Management, Information and Technology
April 24, 1998

Good Morning, Mr. Chairman. I am June Gibbs Brown, Inspector General of the Department of Health and Human Services (HHS), and I am pleased to report to you on our audit of the Health Care Financing Administration's (HCFA) Fiscal Year (FY) 1997 financial statements. With me today is Joseph E. Vengrin, Assistant Inspector General for Audit Operations and Financial Statement Activities.

This year marks our second comprehensive financial statement audit of HCFA. We undertook this audit as part of our implementation of the Government Management Reform Act of 1994 which requires audited financial statements. The purpose of financial statements is to provide a complete picture of agencies' financial operations, including what they own (assets), what they owe (liabilities), and how they spend taxpayer dollars. The purpose of our audit was to independently evaluate HCFA's statements. The full results of this year's audit are provided in our report which is being released at this hearing. My testimony today will highlight the significant findings.

I would like to begin by acknowledging the cooperation and support we received from the Department, HCFA, and the General Accounting Office (GAO). A review of this magnitude and complexity would not have been possible without HCFA's assistance in making available medical review staff at the Medicare contractors and the peer review organizations. Also, I want to point out that we worked closely with GAO, which is responsible for auditing the consolidated financial statements of the Federal Government. The HCFA is one of the most significant agencies included in these Government wide statements.

Let me also add that the financial statement audit process, in and of itself, has been extremely valuable in identifying control weaknesses that directly affect the Government's ability to protect our tax dollars. I intend to continue our collaboration with GAO and the Department to ensure that identified weaknesses are corrected.

My testimony today will focus first on our Medicare claim testing and then on HCFA's financial reporting.

Medicare Claim Testing Overview

The HCFA is the largest single payer of charges for health care goods and services in the world. Like other insurers, Medicare makes payments based on a standard claim form. Providers typically bill Medicare using standard procedure codes without submitting detailed supporting medical records. However, Medicare regulations specifically require providers to retain supporting documentation and to make it available upon request. Because of the high risk in Medicare payments and the dollar impact on the financial statements (i.e., $177.4 billion in fee-for-service claims in FY 1997), we made a comprehensive review of claim expenditures and supporting medical records.

Our primary objective was to determine whether Medicare benefit payments were made in accordance with Title XVIII of the Social Security Act (Medicare) and implementing regulations. Specifically, we examined whether services were (1) furnished by certified Medicare providers to eligible beneficiaries; (2) reimbursed by Medicare contractors in accordance with Medicare laws and regulations; and (3) medically necessary, accurately coded, and sufficiently documented in the beneficiaries' medical records.

Sample Results

Through detailed medical and audit review of a statistical selection of 600 beneficiaries nationwide with 8,048 fee-for-service claims processed for payment during FY 1997, we found that 1,907 claims did not comply with Medicare laws and regulations. By projecting these sample results, we estimated that FY 1997 net improper payments totaled about $20.3 billion nationwide, or about 11 percent of total Medicare fee-for-service benefit payments. This is the mid-point of the estimated range, at the 95 percent confidence level, of $12.1 billion to $28.4 billion, or about 7 percent to 16 percent.

While this year's point estimate is $3 billion less than last year's point estimate of $23.2 billion, we cannot conclude that the current error rate is statistically different. However, there is persuasive evidence that more medical documentation was obtained this year, which had a substantial effect on reducing the mid-point estimate. There is also evidence that some of the drop is due to sampling variability. Sampling variability means that this year's results could differ from last year's simply because selecting different claims with different dollar values and errors will inevitably produce a different estimate of improper payments.

Payment errors primarily resulted from provider billings for services that were insufficiently documented, medically unnecessary, incorrectly coded, or noncovered. As was the case last year, the improper payments could range from inadvertent mistakes to outright fraud and abuse. We cannot quantify what portion of the error rate is attributable to fraud.

Through medical record reviews which we coordinated, medical personnel detected almost all of the improper payments in our sample. When these claims were submitted for payment to Medicare contractors, they contained no visible errors. It should be noted that the HCFA contractors' claim processing controls were generally adequate for (1) ensuring beneficiary and provider Medicare eligibility, (2) pricing claims based on information submitted, and (3) ensuring the services as billed were allowable under Medicare rules and regulations. However, these controls were not effective in detecting the types of errors we found.

In view of Medicare's 38 million beneficiaries, 853 million claims processed and paid annually, decentralized operations, and the current estimate of $213 billion in improper payments, we have concluded that the Medicare program remains inherently at high risk for payment errors.

Sampling Methodology

To accomplish our objective, we used a stratified, multistage sample design. The first stage consisted of a selection of 12 contractor quarters during FY 1997 (10 from the first, second, and third quarters and 2 from the fourth quarter). The selection of the contractor quarters was based on probabilities proportional to the FY 1996 Medicare fee-for-service benefit payments. The second stage consisted of a stratified random sample of 50 beneficiaries from each contractor quarter. The resulting sample of 600 beneficiaries produced 8,048 claims valued at $5.4 million for review. The population from which the sample was drawn represented $177.4 billion in fee-for-service payments.

We reviewed all claims processed for payment for each selected beneficiary during the 3-month period. Specifically, we used medical review personnel from HCFA's Medicare contractors (fiscal intermediaries and carriers) and peer review organizations (PRO)) to assess the medical records and to determine whether the services billed were reasonable, medically necessary, adequately documented, and coded in accordance with Medicare reimbursement rules and regulations.

We contacted each provider in our sample by letter requesting copies of all medical records supporting services billed. In the event that we did not receive a response, we made numerous follow-up contacts by letter, telephone calls, and/or onsite visits. Concurrent with the medical review, we made additional detailed claim reviews, focusing on previously identified improper billing practices, to determine whether (1) the contractor paid, recorded, and reported the claim correctly; (2) the beneficiary and the provider met all Medicare eligibility requirements; (3) the contractor did not make duplicate payments or payments for which another primary insurer should have been responsible (Medicare secondary payer); and (4) all services were subjected to applicable deductible and co-insurance amounts and were priced in accordance with Medicare payment regulations.

Problem-Areas

This year's sample results confirm our FY 1996 results. As noted in the chart on the next page, substantial Medicare improper payments continue to be prevalent in four types of health care providers: physician, inpatient prospective payment system (PPS) hospital, home health agency, and outpatient hospital. Specifically, these providers:

• Did not adequately document the basis for their claims or, in some cases, provided no documentation;
  
  
• Billed for services that were not medically necessary;
  
  
• Billed for higher priced procedure codes than supported by the beneficiaries' medical records; and
  
  
• Billed for services that were not allowable by Medicare.

The next chart shows the types of errors found as a percentage of the total improper payments.

Estimated Improper Payments by Type of Error in FY 1997
No Documentation	4%
No Documentation Due to Investigations	14%
Insufficient Documentation	26%
Subtotal: Documentation errors	44%
Lack of Medical Necessity	37%
Incorrect Coding	15%
Noncovered or Unallowable Services	3%
Other	1%
Total	100%

Further details on these error categories follow.

Documentation Problems. Two types of providers, physicians and outpatient services, consistently had the most documentation problems; they accounted for 52 percent of this error category in FY 1997 and 47 percent in FY 1996. Medicare regulation, 42 CFR 482.24(c), specifically requires providers to maintain medical records that contain sufficient documentation to justify diagnoses, admissions, treatments, and continued care. However, documentation problems represented the most pervasive error category in both years' samples.

The overall error category of documentation includes three components: (1) no documentation provided after repeated attempts, (2) no documentation due to extenuating circumstances (under investigation), and (3) insufficient documentation. These three components accounted for about $9 billion, or 44 percent of the $20.3 billion in improper payments.

The "no documentation" category dropped from $3.25 billion for FY 1996 to $850 million for FY 1997. This reduction, we believe, was attributable to the OIG and HCFA outreach efforts to inform providers of our FY 1996 audit results and aggressive action to obtain requested medical records. In fact, we obtained almost 98 percent of the medical records requested for sample claims for providers that were not under investigation.

With respect to the providers that were under investigation, we were prohibited from requesting medical records. Our sample included 151 claims being investigated by the OIG Office of Investigations and 16 claims being investigated by the Medicare contractors' fraud and abuse units. Because we could not test the validity of these claims, we considered them invalid for determining whether total fee-for-service expenditures were fairly presented. It should be noted that these claims could be valid or erroneous (including fraudulent).

Some examples of documentation problems follow:

• A hospital outpatient department was paid $785 for eight outpatient physical therapy services. Because the hospital's medical records supported only three of the eight visits, the medical reviewers concluded that Medicare had overpaid $491.
  
  
• A durable medical equipment supplier received almost $3,000 for renting an electric hospital bed with pressure pad, as well as wound care supplies. The supplier did not respond to our requests for medical records, and we found that its office, which had a current lease, had been vacated. As a result, we referred the supplier to our Office of Investigations and notified the contractor of our actions.
  
  
• A skilled nursing facility received $1167 for a beneficiary's 19-day stay, but the medical records contained no indication that skilled nursing care had been provided. As a result, the entire payment was denied.

Lack of Medical Necessity. In both years, errors in inpatient hospital and home health agency claims accounted for over 60 percent of this error category. A lack of medical necessity was the second highest error category for both FYs 1996 and 1997.

Decisions on medical necessity were made by the contractor or PRO medical staff using Medicare reimbursement rules and regulations. They followed their normal claim review procedures to determine whether the medical records supported the claims, as illustrated in the examples below:

• A beneficiary who had been hospitalized 5 years earlier was admitted to a hospital to increase her strength. Rehabilitation therapies included occupational, physical, and speech therapies, as well as continuation of routine medications. Based on a review of the medical records, the PRO concluded that the documentation did not support the medical necessity for 37 days ($38,672) of inpatient hospital care.
  
• A $2,915 home health agency claim for home care visits, including skilled nursing services, was denied because the skilled services were medically unnecessary. Our interview with the beneficiary determined that he left home daily and therefore did not meet the definition of "homebound" necessary for Medicare coverage of home health services.
  
  
• Although an ambulance service billed $7,844 for transporting a beneficiary from a nursing home to a dialysis center, the medical reviewer determined that the beneficiary could have traveled safely by far less expensive means.

Incorrect Coding

Incorrect coding is the third highest error category this year, representing 15 percent of the total improper payments. Over 90 percent of these errors pertained to inpatient hospital and physician claims for both FYs 1996 and 1997.

The medical industry uses a standard coding system to bill Medicare for services provided. For most of the coding errors, the medical review staff determined that the documentation submitted by the providers supported a lower reimbursement code. However, we did find a few instances of downcoding which were offset against identified upcoding situations.

Some examples of incorrect coding follow:

• A physician was paid $162 for providing critical care of an unstable, critically ill patient requiring the constant attendance of the physician in a hospital inpatient setting. According to the medical reviewer, the records submitted by the provider did not support this level of care but rather a noncritical, high-complexity hospital visit valued at $60. This resulted in a $102 overpayment.
  
  
• A hospital was paid $22,229 for an inpatient's surgical procedure based on the principal and secondary diagnosis codes on the claim. The PRO found that the secondary diagnosis code, which indicated complications, was not supported. The PRO's deletion of this code produced a lesser valued diagnosis related group of $10,151, resulting in a $12,078 overpayment.
  
• An equipment supplier was paid $535 for a gel pressure pad for a beneficiary's mattress. Based on the medical records, the medical reviewer concluded that the supplier had actually provided a pressure pad for a wheelchair, which is reimbursed at $123. This error resulted in an overpayment of $412.

Noncovered/Unallowable Services

"Medicare unallowable services" are defined as those that Medicare will not reimburse because the services do not meet Medicare reimbursement rules and regulations. About 73 percent of the errors in this category were attributable to physician claims in FY 1997.

Following are some examples of noncovered or unallowable services:

• A physician was paid $114 for a beneficiary's office visit, electrocardiogram, and various other laboratory tests. Based on the medical records, the reviewer determined that payment should be denied because the services were performed as part of a routine physical examination, which is not covered by Medicare.
  
  
• A podiatrist was paid a total of $57 for two claims for providing routine foot care (clipping of toenails). Medicare pays for routine foot care only under limited circumstances, such as for the treatment of infected nails. The medical reviewer concluded that the care provided ,was routine preventive care, which is not covered, and the claim was denied.

Conclusions and Recommendations: Claim Testing

To obtain Medicare reimbursement, providers are required to retain supporting documentation and make it available upon request. As with last year's results, the majority of the improper claims in our sample did not contain any visible errors. However, a significant portion of the errors we found were attributable to insufficient documentation on the part of providers that claimed payments. We also identified numerous errors for services that were not medically necessary, upcoded to obtain higher Medicare payment than the appropriate code would permit, or noncovered or unallowable.

We acknowledge that too little time has elapsed for HCFA to fully implement our prior year's recommendations and to significantly reduce the error rate. Specifically, we recommended last year that HCFA:

1. Develop a system that objectively and periodically estimates improper payments and disclose the range of such improper payments in its financial statements.
   
   
2. Develop a national error rate to focus corrective actions and measure performance in reducing improper payments.
   
   
3. Enhance prepayment and postpayment controls by updating computer systems to better detect improper Medicare claims.
   
   
4. Direct contractors to expand provider training to further emphasize the need to maintain medical records that contain sufficient documentation and the penalties for not doing so.
   
   
5. Direct contractors to make follow-up evaluations of specific procedure codes we identified with high error rates and consider whether identified providers should be placed on prepayment medical review.
   
   
6. Ensure that contractors adjust their Medicare accounts for improper payments we identified, initiate recovery from the identified providers, and follow up with the providers to correct deficiencies and to determine whether other systemic problems need to be corrected.

The HCFA generally concurred with these recommendations and has developed a corrective action plan to reduce the Medicare payment error rate to 10 percent by the year 2002. Accordingly, we offer no additional recommendations. We expect that HCFA's testimony today will address the specific corrective actions being taken.

Fiscal Year 1996 Disclaimer Issues

Before discussing HCFA's FY 1997 financial statements, I would like to touch on two pivotal issues resulting in our disclaimer of opinion on the FY 1996 financial statements. Specifically, we were not able to gather sufficient evidence on the validity or reasonableness of:

• Medicare Accounts Payable. As of September 30, 1996, reported Medicare accounts payable totaled $301 billion and comprised 71 percent of total liabilities. These payables represented HCFA's estimate of actual or potential claims for services provided to beneficiaries but not paid at the end of the FY. The HCFA did not provide adequate support for this estimate. Additionally, we were unable to determine, through alternative audit procedures, if the September 30, 1996, Medicare accounts payable balance was fairly presented.
  
  
• Supplementary Medical Insurance (SMI) Revenue (Part B Medicare). The Social Security Administration (SSA) is responsible for withholding premiums from SMI beneficiaries' Social Security checks and for transferring these funds to the SMI trust fund each month. Because the SMI revenue was not audited by SSA and because we lack statutory authority to do this work, we were unable to determine the validity and completeness of the SMI revenue account of $18.9 billion. Therefore, we could not determine whether the corresponding Federal match of $61.7 billion was appropriate.

Fiscal Year 1997 Qualification Issues

This year, we are pleased to report that HCFA has revised its methodology for estimating Medicare accounts payable, and our auditors were satisfied as to the reasonableness of the resulting estimate. With respect to the SMI issue, we were able to audit this revenue for FY 1997 by working in coordination with GAO and the SSA's OIG. As a result, our overall opinion on HCFA's financial statements has advanced from a disclaimer for FY 1996 to a qualification for FY 1997. In accounting terms, a disclaimer of opinion means that we were not able to determine whether the financial statements were fairly presented because the documentation was not adequate or available to support the reported amounts. A qualification indicates that we still found documentation problems, as discussed below, but not to the extent that would necessitate a disclaimer:

Medicare/Medicaid Accounts Receivable. Medicare contractors did not maintain adequate documentation to support reported accounts receivable activity and to provide adequate audit trails. As a result, we could not determine if the reported $2.5 billion Medicare accounts receivable balance was fairly presented. For instance:

• We could not obtain reasonable assurance of the completeness and support for $266 million in accounts receivable that a contractor reported as transferred to other Medicare contractors during its transition from the Medicare program. In addition, HCFA has been unable to reconcile, through its quarterly contractor financial reports, the $266 million to the acquiring contractors. Based on our review, procedures were either not established or not followed among HCFA and the contractors to confirm and reconcile the transferred accounts receivable.
  
  
• At 9 of the 11 contractors reviewed, we were unable to obtain assurance of the completeness of account receivable balances because detailed subsidiary ledgers could not support the balances reported to HCFA. For example, one contractor could not provide subsidiary ledgers for $21 million of the $86 million balance reported to HCFA. Another contractor "plugged" the "reclassified/adjusted" amount by almost $758,000 to reconcile the ending subsidiary balance to the balances reported to HCFA but was unable to explain the variance.

In addition, we were unable to perform sufficient procedures to satisfy ourselves as to the reasonableness of the $450 million Medicaid accounts receivable balance.

Cost Report Settlements. In FY 1997, of 35,079 provider cost reports received, 33,000 were subjected to desk review. Of that total, just over 5,000 providers were selected for audit. Although HCFA has a cost report audit process, the provider audit function is limited to specific issue areas or cost report line items and covers only a limited number of providers. Due to the limited scope of the contractors' provider audit function, there is little assurance that amounts eventually paid to providers through the final cost report settlement process meet Medicare guidelines for reasonableness and appropriateness. We were unable to extend our procedures to determine what adjustments, if any, were necessary to the FY 1997 cost settlement payments of $2.4 billion recorded by HCFA or to determine the potential impact of such adjustments on the approximately $5 billion year end cost settlement estimate included in Medicare other governmental liabilities.

Conclusion

I appreciate the opportunity to appear before you today and to share our report with you. As demonstrated in our review, unnecessary or improper benefit payments continue to plague the Medicare program. Existing risks are sharply increased by the significant growth in Medicare claims and expenditures. Our review has also demonstrated the need for stronger oversight by HCFA to ensure provider compliance with Medicare reimbursement rules and regulations and the necessity of subjecting additional claims to prepayment and postpayment medical review. I am pleased that HCFA and the Department's Chief Financial Officer are aggressively pursuing a corrective action plan addressing our concerns.

Finally, I would like to note that we have already started our audit work on HCFA's FY 1998 financial statements. As we did in the last 2 years, we will conduct comprehensive fee-for-service claim testing. In addition, we will place a high priority on ensuring that HCFA has established an adequate internal control structure for Medicare accounts receivable activity.