GAO: CMS Erroneously Paid $16B to Medicare Advantage Orgs

July 20, 2017 - CMS incorrectly paid $16 billion to Medicare Advantage organizations (MAOs) as a result of insufficient oversight and mismanagement of data, says the Government Accountability Office (GAO) in a new report.

Almost 10 percent of all MA payments were paid incorrectly even though CMS relies on risk adjustment data validation (RADV) audits to ensure correct payments to MAOs. GAO examined the CMS estimates and found various shortcomings when it came to analysis, management, and necessary expansion for these audits.

RADV audits are crucial for ensuring payment compliance because they determine whether or not diagnosis data submitted by an MAO matches a beneficiary’s medical records.

In their report, GAO found that CMS did not adequately target RADV audits to MAO contracts with the highest potential for improper payments. CMS used a flawed method of calculating improper payment risk for each contract based on the medical reports of the contract’s beneficiaries. GAO also noted that CMS did not use other available data for selecting contracts with the greatest potential for improper payment recovery.  

In 2016, CMS experienced substantial delays with RADV audits in progress that jeopardized the agency’s goal of conducting audits annually. GAO found that CMS had RADV audits underway for payment years 2011, 2012, and 2013, which were well behind schedule.

Because CMS lacked (and currently lacks) an annual timetable and project management procedures for audit completion, GAO attributed the delays in RADV audits to poor management and oversight.

GAO also mentioned that it took MAOs several months to identify contracts under audit and additional months to identify specific beneficiaries under those contracts. Technology issues played a role in RADV delays.

Another major error included a lack of time and resources to expand the use of Recovery Audit Contractors (RACs) in the MA program.

CMS was required by law to expand the RAC program by the end of 2010, but has not yet done so. Instead, CMS uses RACs from other Medicare programs to recover improper payments for a contingency fee.

GAO believes that incorporating RACs into the MA program directly will help CMS conduct contract-level audits.

According to GAO, CMS also did not take enough measures to fully validate MA encounter data. Encounter data is a summation of all the data used to ensure proper MA payments and risk adjustment. Encounter data is validated by performing statistical analyses, reviewing medical records, and providing MAOs with summaries on CMS’s findings.

While CMS was able to use encounter data to review an MAO’s ability to collect/submit data and perform automated checks on an MAO’s data accuracy, CMS fell behind when it came to reviewing medical records, statistical analyses, and setting data requirements.

GAO provided recommendations to CMS for improving MA earlier this year, which the agency has not yet implemented. These include establishing benchmarks for completeness and accuracy of MA encounter data, using these benchmarks to improve statistical analyses, determining sample methodology for medical record review and obtaining medical records, and building summary analyses to highlight individual issues within MAOs.

GAO’s criticism of the MA program is based on the fact that CMS programs are extremely vulnerable to fraud. GAO believes that CMS must take more action to protect a public health program that serves roughly 19 million beneficiaries.

“In conclusion, Medicare remains inherently complex and susceptible to improper payments,” the GAO report says. “Therefore, actions CMS takes to ensure the integrity of the MA program by identifying, reducing, and recovering improper payments would be critical to safeguarding federal funds.”