Background Medicare is one of four principal health-insurance programs administered  by CMS; it provides health insurance for persons aged 65 and over,  certain individuals with disabilities, and individuals with end-stage renal  disease. See table 1 for information about Medicare’s component  programs. Medicare is the largest CMS program, at $702 billion in fiscal year 2017.  As discussed earlier, according to CBO, Medicare outlays are projected  to rise to $1.5 trillion in 2028 (see fig. 1). Fraud Vulnerabilities and  Improper Payments in  Medicare Fraud involves obtaining something of value through willful  misrepresentation. There are no reliable estimates of the extent of fraud  in the Medicare program, or in the health-care industry as a whole. By its  very nature, fraud is difficult to detect, as those involved are engaged in  intentional deception. Further, potential fraud cases must be identified,  investigated, prosecuted, and adjudicated—resulting in a conviction— before fraud can be established. As I mentioned earlier, we designated Medicare as a high-risk program in  1990 because its size, scope, and complexity make it vulnerable to fraud,  waste, and abuse. Similarly, the Office of Management and Budget  (OMB) designated all parts of Medicare a “high priority” program because  they each report $750 million or more in improper payments in a given  year. We also highlighted challenges associated with duplicative  payments in Medicare in our annual report on duplication and  opportunities for cost savings in federal programs. Improper payments are a significant risk to the Medicare program and  may include payments made as a result of fraud. However, I would note  that improper payments are not a proxy for the amount of fraud or extent  of fraud risk in a particular program as improper payment measurement  does not specifically identify or estimate such payments due to fraud.  Improper payments are those that are either made in an incorrect amount  (overpayments and underpayments) or those that should not have been  made at all. CMS’s Fraud Risk  Management Approach Our December 2017 report found that CMS manages its fraud risks as  part of a broader program-integrity approach working with a broad array  of stakeholders. CMS’s program-integrity approach includes efforts to  address waste, abuse, and improper payments as well as fraud across its  four principal programs. In Medicare, CMS collaborates with contractors,  health-insurance plans, and law-enforcement and other agencies to carry  out its program-integrity responsibilities. According to CMS officials, this  broader program-integrity approach can help the agency develop control  activities to address multiple sources of improper payments, including  fraud. Fraud Risk Management  Standards and Guidance According to federal standards and guidance, executive-branch agency  managers are responsible for managing fraud risks and implementing  practices for combating those risks. Federal internal control standards call  for agency management officials to assess the internal and external risks  their entities face as they seek to achieve their objectives. The standards  state that as part of this overall assessment, management should  consider the potential for fraud when identifying, analyzing, and  responding to risks. Risk management is a formal and disciplined  practice for addressing risk and reducing it to an acceptable level. In July 2015, GAO issued the Fraud Risk Framework, which provides a  comprehensive set of key components and leading practices that serve  as a guide for agency managers to use when developing efforts to  combat fraud in a strategic, risk-based way. The Fraud Risk Framework  describes leading practices in four components: commit, assess, design  and implement, and evaluate and adapt, as depicted in figure 2. The Fraud Reduction and Data Analytics Act of 2015, enacted in June  2016, requires OMB to establish guidelines for federal agencies to create  controls to identify and assess fraud risks and design and implement  antifraud control activities. The act further requires OMB to incorporate  the leading practices from the Fraud Risk Framework in the guidelines. In  July 2016, OMB published guidance about enterprise risk management  and internal controls in federal executive departments and agencies.  Among other things, this guidance affirms that managers should adhere  to the leading practices identified in the Fraud Risk Framework. Further,  the act requires federal agencies to submit to Congress a progress report  each year for 3 consecutive years on the implementation of the controls  established under OMB guidelines, among other things. CMS’s Efforts  Managing Fraud  Risks in Medicare  Were Partially Aligned  with the Fraud Risk  Framework CMS’s antifraud efforts partially aligned with the Fraud Risk Framework.  Consistent with the framework, CMS has demonstrated commitment to  combating fraud by creating a dedicated entity to lead antifraud efforts. It  has also taken steps to establish a culture conducive to fraud risk  management, although it could expand its antifraud training to include all  employees. CMS has taken some steps to identify fraud risks in  Medicare; however, it has not conducted a fraud risk assessment or  developed a risk-based antifraud strategy for Medicare as defined in the  Fraud Risk Framework. CMS has established monitoring and evaluation  mechanisms for its program-integrity control activities that, if aligned with  a risk-based antifraud strategy, could enhance the effectiveness of fraud  risk management in Medicare. CMS’s Organizational  Structure Includes a  Dedicated Entity for  Program-Integrity and  Antifraud Efforts The commit component of the Fraud Risk Framework calls for an agency  to commit to combating fraud by creating an organizational culture and  structure conducive to fraud risk management. This component includes  establishing a dedicated entity to lead fraud risk management activities. Within CMS, the Center for Program Integrity (CPI) serves as the  dedicated entity for fraud, waste, and abuse issues in Medicare, which is  consistent with the Fraud Risk Framework. CPI was established in 2010,  in response to a November 2009 Executive Order on reducing improper  payments and eliminating waste in federal programs. This formalized  role, according to CMS officials, elevated the status of program-integrity  efforts, which previously were carried out by other parts of CMS. As an executive-level Center—on the same level with five other  executive-level Centers at CMS, such as the Center for Medicare—CPI  has a direct reporting line to executive-level management at CMS. The  Fraud Risk Framework identifies a direct reporting line to senior-level  managers within the agency as a leading practice. According to CMS  officials, this elevated organizational status offers CPI heightened visibility  across CMS, attention by CMS executive leadership, and involvement in  executive-level conversations. CMS Has Taken Steps to  Create a Culture  Conducive to Fraud Risk  Management but Could  Enhance Antifraud  Training for Employees The commit component of the Fraud Risk Framework also includes  creating an organizational culture to combat fraud at all levels of the  agency. Consistent with the Fraud Risk Framework, CMS has promoted  an antifraud culture by, for example, coordinating with internal and  external stakeholders. Consistent with leading practices in the Fraud Risk Framework to involve  all levels of the agency in setting an antifraud tone, CPI has worked  collaboratively with other CMS Centers. In addition to engaging  executive-level officials of other CMS Centers through the Program  Integrity Board, CPI has worked collaboratively with other Centers within  CMS to incorporate antifraud features into new program design or policy  development and established regular communication at the staff level.  For example: Center for Medicare and Medicaid Innovation (CMMI). When  developing the Medicare Diabetes Prevention Program, CMMI  officials told us they worked with CPI’s Provider Enrollment and  Oversight Group and Governance Management Group to develop  risk-based screening procedures for entities that would enroll in  Medicare to provide diabetes-prevention services, among other  activities. The program was expanded nationally in 2016, and CMS  determined that an entity may enroll in Medicare as a program  supplier if it satisfies enrollment requirements, including that the  supplier must pass existing high categorical risk-level screening  requirements. Center for Medicare (CM). In addition to building safeguards into  programs and developing policies, CM officials told us that there are  several standing meetings, on monthly, biweekly, and weekly bases,  between groups within CM and CPI that discuss issues related to  provider enrollment, FFS operations, and contractor management. A  senior CM official also told us that there are ad hoc meetings taking  place between CM and CPI: “We interact multiple times daily at  different levels of the organization. Working closely is just a regular  part of our business.” CMS has also demonstrated its commitment to addressing fraud, waste,  and abuse to its stakeholders. Representatives of CMS’s extensive  stakeholder network whom we interviewed—contractors and officials from  public and private entities—generally recognized the agency’s  commitment to combating fraud. In our interviews with stakeholders,  officials observed CMS’s increased commitment over time to address  fraud, waste, and abuse and cited examples of specific CMS actions.  CMS contractors told us that CMS’s commitment to combating fraud is  incorporated into contractual requirements, such as requiring (1) data  analysis for potential fraud leads and (2) fraud-awareness training for  providers. Officials from entities that are members of the Healthcare  Fraud Prevention Partnership (HFPP), specifically, a health-insurance  plan and the National Health Care Anti-Fraud Association, added that  CMS’s effort to establish the HFPP and its ongoing collaboration and  information sharing reflect CMS’s commitment to combat fraud in  Medicare. The Fraud Risk Framework identifies training as one way of  demonstrating an agency’s commitment to combating fraud. Training and education intended to increase fraud awareness among stakeholders,  managers, and employees serve as a preventive measure to help create  a culture of integrity and compliance within the agency. The Fraud Risk  Framework discusses requiring all employees to attend training upon  hiring and on an ongoing basis thereafter. To increase awareness of fraud risks in Medicare, CMS offers and  requires training for stakeholder groups such as providers, beneficiaries,  and health-insurance plans. Specifically, through its National Training  Program and Medicare Learning Network, CMS makes available training  materials on combating Medicare fraud, waste, and abuse. These  materials help to identify and report fraud, waste, and abuse in CMS  programs and are geared toward providers, beneficiaries, as well as  trainers and other stakeholders. Separately, CMS requires health- insurance plans working with CMS to provide annual fraud, waste, and  abuse training to their employees. However, CMS does not offer or require similar fraud-awareness training  for the majority of its workforce. For a relatively small portion of its overall  workforce—specifically, contracting officer representatives who are  responsible for certain aspects of the acquisition function—CMS requires  completion of fraud and abuse prevention training every 2 years.  According to CMS, 638 of its contracting officer representatives (or about  10 percent of its overall workforce) completed such training in 2016 and  2017. Although CMS offers fraud-awareness training to others, the  agency does not require fraud-awareness training for new hires or on a  regular basis for all employees because the agency has focused on  providing process-based internal controls training for its employees. While fraud-awareness training for contracting officer representatives is  an important step in helping to promote fraud risk management, fraud- awareness training specific to CMS programs would be beneficial for all  employees. Such training would not only be consistent with what CMS  offers to or requires of its stakeholders and some of its employees, but  would also help to keep the agency’s entire workforce continuously aware  of fraud risks and examples of known fraud schemes, such as those  identified in successful HHS OIG investigations. Such training would also  keep employees informed as they administer CMS programs or develop  agency policies and procedures. Considering the vulnerability of Medicare  and Medicaid programs to fraud, waste, and abuse, without regular  required training CMS cannot be assured that its workforce of over 6,000  employees is continuously aware of risks facing its programs. In our December 2017 report, we recommended that the Administrator of  CMS provide fraud-awareness training relevant to risks facing CMS  programs and require new hires to undergo such training and all  employees to undergo training on a recurring basis. In its March 2018  letter to GAO, HHS stated that CMS is in the process of developing  Fraud, Waste, and Abuse Training for all new employees, to be presented  at CMS New Employee Orientations. Additionally, CMS is also developing  training to be completed by current CMS employees on an annual basis.  As of July 2018, this recommendation remains open. CMS Has Taken Steps to  Identify Fraud Risks but  Has Not Conducted a  Fraud Risk Assessment  for Medicare The assess component of the Fraud Risk Framework calls for federal  managers to plan regular fraud risk assessments and to assess risks to  determine a fraud risk profile. Identifying fraud risks is one of the steps  included in the Fraud Risk Framework for assessing risks to determine a  fraud risk profile. In our December 2017 report, we discussed several examples of steps  CMS has taken to identify fraud risks as well as control activities that  target areas the agency has designated as higher risk within Medicare,  including specific provider types and specific geographic locations. These  examples include data analytics to assist investigations in Medicare FFS, including  Medicare’s Fraud Prevention System (FPS ), prior authorization for Medicare FFS services or supplies,  revised provider screening and enrollment processes for Medicare  FFS, and  temporary provider enrollment moratoriums for certain providers and  geographic areas for Medicare FFS. CMS officials told us that CPI initially focused on developing control  activities for Medicare FFS and consider these activities to be the most  mature of all CPI efforts to address fraud risks. CMS Has Not Conducted a Fraud Risk Assessment for Medicare  The assess component of the Fraud Risk Framework calls for federal  managers to plan regular fraud risk assessments and assess risks to  determine a fraud risk profile. Furthermore, federal internal control  standards call for agency management to assess the internal and  external risks their entities face as they seek to achieve their objectives.  The standards state that, as part of this overall assessment, management  should consider the potential for fraud when identifying, analyzing, and  responding to risks. The Fraud Risk Framework states that, in planning the fraud risk  assessment, effective managers tailor the fraud risk assessment to the  program by, among other things, identifying appropriate tools, methods,  and sources for gathering information about fraud risks and involving  relevant stakeholders in the assessment process. Fraud risk  assessments that align with the Fraud Risk Framework involve (1)  identifying inherent fraud risks affecting the program, (2) assessing the  likelihood and impact of those fraud risks, (3) determining fraud risk  tolerance, (4) examining the suitability of existing fraud controls and  prioritizing residual fraud risks, and (5) documenting the results (see fig.  3). Although CMS had identified some fraud risks posed by providers in  Medicare FFS, the agency had not conducted a fraud risk assessment for  the Medicare program as a whole. Such a risk assessment would provide  the detailed information and insights needed to create a fraud risk profile,  which, in turn, is the basis for creating an antifraud strategy. According to CMS officials, CMS had not conducted a fraud risk  assessment for Medicare because, within CPI’s broader approach of  preventing and eliminating improper payments, its focus has been on  addressing specific vulnerabilities among provider groups that have  shown themselves particularly prone to fraud, waste, and abuse. With this  approach, however, it is unlikely that CMS will be able to design and  implement the most-appropriate control activities to respond to the full  portfolio of fraud risks. A fraud risk assessment consists of discrete activities that build upon  each other. Specifically:  Identifying inherent fraud risks affecting the program. As  discussed earlier, CMS took steps to identify fraud risks. However,  CMS has not used a process to identify inherent fraud risks from the  universe of potential vulnerabilities facing Medicare, including threats  from various sources. According to CPI officials, most of the agency’s  fraud control activities are focused on fraud risks posed by providers.  The Fraud Risk Framework discusses fully considering inherent fraud  risks from internal and external sources in light of fraud risk factors  such as incentives, opportunities, and rationalization to commit fraud.  For example, according to CMS officials, the inherent design of the  Medicare Part C program may pose fraud risks that are challenging to  detect. A fraud risk assessment would help CMS identify all sources  of fraudulent behaviors, beyond threats posed by providers, such as  those posed by health-insurance plans, contractors, or employees. Assessing the likelihood and impact of fraud risks and  determining fraud risk tolerance. CMS has taken steps to prioritize  fraud risks in some areas, but it had not assessed the likelihood or  impact of fraud risks or determined fraud risk tolerance across all  parts of Medicare. Assessing the likelihood and impact of inherent  fraud risks would involve consideration of the impact of fraud risks on  program finances, reputation, and compliance. Without assessing the  likelihood and impact of risks in Medicare or internally determining  which fraud risks may fall under the tolerance threshold, CMS cannot  be certain that it is aware of the most-significant fraud risks facing this  program and what risks it is willing to tolerate based on the program’s  size and complexity. Examining the suitability of existing fraud controls and  prioritizing residual fraud risks. CMS had not assessed existing  control activities or prioritized residual fraud risks. According to the  Fraud Risk Framework, managers may consider the extent to which  existing control activities—whether focused on prevention, detection,  or response—mitigate the likelihood and impact of inherent risks and  whether the remaining risks exceed managers’ tolerance. This  analysis would help CMS to prioritize residual risks and to determine  mitigation approaches. For example, CMS had not established  preventive fraud control activities in Medicare Part C. Using a fraud  risk assessment for Medicare Part C and closely examining existing  fraud control activities and residual risks, CMS could be better  positioned to address fraud risks facing this growing program and  develop preventive control activities. Furthermore, without assessing  existing fraud control activities and prioritizing residual fraud risks,  CMS cannot be assured that its current control activities are  addressing the most-significant risks. Such analysis would also help  CMS determine whether additional, preferably preventive, fraud  controls are needed to mitigate residual risks, make adjustments to  existing control activities, and potentially scale back or remove control  activities that are addressing tolerable fraud risks. Documenting the risk-assessment results in a fraud risk profile. CMS had not developed a fraud risk profile that documents key  findings and conclusions of the fraud risk assessment. According to  the Fraud Risk Framework, the risk profile can also help agencies  decide how to allocate resources to respond to residual fraud risks.  Given the large size and complexity of Medicare, a documented fraud  risk profile could support CMS’s resource-allocation decisions as well  as facilitate the transfer of knowledge and continuity across CMS staff  and changing administrations. Senior CPI officials told us that the agency plans to start a fraud risk  assessment for Medicare after it completes a separate fraud risk  assessment of the federally facilitated marketplace. This fraud risk  assessment for the federally facilitated marketplace eligibility and  enrollment process is being conducted in response to a recommendation  we made in February 2016. In April 2017, CPI officials told us that this  fraud risk assessment was largely completed, although in September  2017 CPI officials told us that the assessment was undergoing agency  review. CPI officials told us that they have informed CM officials that there  will be future fraud risk assessments for Medicare; however, they could  not provide estimated timelines or plans for conducting such  assessments, such as the order or programmatic scope of the  assessments. Once completed, CMS could use the federally facilitated marketplace  fraud risk assessment and apply any lessons learned when planning for  and designing fraud risk assessments for Medicare. According to the  Fraud Risk Framework, factors such as size, resources, maturity of the  agency or program, and experience in managing risks can influence how  the entity plans the fraud risk assessment. Additionally, effective  managers tailor the fraud risk assessment to the program when planning  for it. The large scale and complexity of Medicare as well as time and  resources involved in conducting a fraud risk assessment underscore the  importance of a well-planned and tailored approach to identifying the  assessment’s programmatic scope. Planning and tailoring may involve  decisions to conduct a fraud risk assessment for Medicare as a whole or  divided into several subassessments to reflect their various component  parts (e.g., Medicare Part C). CMS’s existing fraud risk identification efforts as well as communication  channels with stakeholders could serve as a foundation for developing a  fraud risk assessment for Medicare. The leading practices identified in the  Fraud Risk Framework discuss the importance of identifying appropriate  tools, methods, and sources for gathering information about fraud risks  and involving relevant stakeholders in the assessment process. CMS’s  fraud risk identification efforts discussed earlier could provide key  information about fraud risks and their likelihood and impact.  Furthermore, existing relationships and communication channels across  CMS and its extensive network of stakeholders could support building a  comprehensive understanding of known and potential fraud risks for the  purposes of a fraud risk assessment. For example, the fraud  vulnerabilities identified through data analysis and information sharing  with health-insurance plans, law-enforcement organizations, and  contractors could inform a fraud risk assessment. CPI’s Command Center  missions—facilitated collaboration sessions that bring together experts  from various disciplines to improve the processes for fraud prevention in  Medicare—could bring together experts to identify potential or emerging  fraud vulnerabilities or to brainstorm approaches to mitigate residual fraud  risks. As CMS makes plans to move forward with a fraud risk assessment for  Medicare, it will be important to consider the frequency with which the  fraud risk assessment would need to be updated. While, according to the  Fraud Risk Framework, the time intervals between updates can vary  based on the programmatic and operating environment, assessing fraud  risks on an ongoing basis is important to ensure that control activities are  continuously addressing fraud risks. The constantly evolving fraud  schemes, the size of the programs in terms of beneficiaries and  expenditures, as well as continual changes in Medicare—such as  development of innovative payment models and increasing managed- care enrollment—call for constant vigilance and regular updates to the  fraud risk assessment. In our December 2017 report we recommended that the Administrator of  CMS conduct fraud risk assessments for Medicare and Medicaid to  include respective fraud risk profiles and plans for regularly updating the  assessments and profiles. In its March 2018 letter to GAO, HHS stated  that it is currently evaluating its options with regards to implementing this  recommendation. As of July 2018, the recommendation remains open. CMS Needs to Develop a  Risk-Based Antifraud  Strategy for Medicare,  Which Would Include  Plans for Monitoring and  Evaluation The design and implement component of the Fraud Risk Framework calls  for federal managers to design and implement a strategy with specific  control activities to mitigate assessed fraud risks and collaborate to help  ensure effective implementation. According to the Fraud Risk Framework, effective managers develop and  document an antifraud strategy that describes the program’s approach for  addressing the prioritized fraud risks identified during the fraud risk  assessment, also referred to as a risk-based antifraud strategy. A risk- based antifraud strategy describes existing fraud control activities as well  as any new fraud control activities a program may adopt to address  residual fraud risks. In developing a strategy and antifraud control  activities, effective managers focus on fraud prevention over detection,  develop a plan for responding to identified instances of fraud, establish  collaborative relationships with stakeholders, and create incentives to  help effectively implement the strategy. Additionally, as part of a  documented strategy, management identifies roles and responsibilities of  those involved in fraud risk management activities; describes control  activities as well as plans for monitoring and evaluation; creates timelines;  and communicates the antifraud strategy to employees and stakeholders,  among other things. As discussed earlier, CMS had some control activities in place to identify  fraud risk in Medicare, particularly in the FFS program. However, CMS  had not developed and documented a risk-based antifraud strategy to  guide its design and implementation of new antifraud activities and to  better align and coordinate its existing activities to ensure it is targeting  and mitigating the most-significant fraud risks. Antifraud strategy. CMS officials told us that CPI does not have a  documented risk-based antifraud strategy. Although CMS has developed  several documents that describe efforts to address fraud, the agency  had not developed a risk-based antifraud strategy for Medicare because,  as discussed earlier, it had not conducted a fraud risk assessment that  would serve as a foundation for such strategy. In 2016, CPI identified five strategic objectives for program integrity,  which include antifraud elements and an emphasis on prevention.  However, according to CMS officials, these objectives were identified  from discussions with CMS leadership and various stakeholders and not  through a fraud risk assessment process to identify inherent fraud risks  from the universe of potential vulnerabilities, as described earlier and  called for in the leading practices. These strategic objectives were  presented at an antifraud conference in 2016, but were not announced  publicly until the release of the Annual Report to Congress on the  Medicare and Medicaid Integrity Programs for Fiscal Year 2015 in June  2017. Stakeholder relationships and communication. CMS has established  relationships and communicated with stakeholders, but, without an  antifraud strategy, stakeholders we spoke with lacked a common  understanding of CMS’s strategic approach. Prior work on practices that  can help federal agencies collaborate effectively calls for a strategy that is  shared with stakeholders to promote trust and understanding. Once an  antifraud strategy is developed, the Fraud Risk Framework calls for  managers to collaborate to ensure effective implementation. Although  some CMS stakeholders were able to describe various CMS program- integrity priorities and activities, such as home health being a fraud risk  priority, the stakeholders could not communicate, articulate, or cite a  common CMS strategic approach to address fraud risks in its programs. Incentives. The Fraud Risk Framework discusses creating incentives to  help ensure effective implementation of the antifraud strategy once it is  developed. Currently, some incentives within stakeholder relationships  may complicate CMS’s antifraud efforts. Among contractors, CMS  encourages information sharing through conferences and workshops;  however, competition for CMS business among contractors can be a  disincentive to information sharing. CMS officials acknowledged this  concern and said that they expect contractors to share information related  to fraud schemes, outcomes of investigations, and tips for addressing  fraud, but not proprietary information such as algorithms to risk-score  providers. Without  developing  and  documenting  an  antifraud  strategy  based  on  a  fraud  risk  assessment,  as  called  for  in  the  design  and  implement  component of the Fraud Risk Framework, CMS cannot ensure that it has  a  coordinated  approach  to  address  the  range  of  fraud  risks  and  to  appropriately target and allocate resources for the most-significant risks.  Considering fraud risks to which Medicare is most vulnerable, in light of  the malicious intent of those who aim to exploit the programs, would help  CMS to examine its current control activities and potentially design new  ones with recognition of fraudulent behavior it aims to prevent. This focus  on fraud is distinct from a broader view of program integrity and improper  payments by considering the intentions and incentives of those who aim  to  deceive  rather  than  well-intentioned  providers  who  make  mistakes.  Also, continued growth of the program, such as growth of Medicare Part  C, calls for consideration of preventive fraud control activities across the  entire network of entities involved. Furthermore, considering the large size and complexity of Medicare and  the extensive stakeholder network involved in managing fraud in the  program, a strategic approach to managing fraud risks within the  programs is essential to ensure that a number of existing control activities  and numerous stakeholder relationships and incentives are being aligned  to produce desired results. Once developed, an antifraud strategy that is  clearly articulated to various CMS stakeholders would help CMS to  address fraud risks in a more coordinated and deliberate fashion.  Thinking strategically about existing control activities, resources, tools,  and information systems could help CMS to leverage resources while  continuing to integrate Medicare program-integrity efforts along functional  lines. A strategic approach grounded in a comprehensive assessment of  fraud risks could also help CMS to identify future enhancements for  existing control activities, such as new preventive capabilities for its Fraud  Prevention System (FPS) or additional fraud factors in provider  enrollment and revalidation, such as provider risk-scoring, to stay in step  with evolving fraud risks. CMS Has Established Monitoring and Evaluation Mechanisms That  Could Inform a Risk-Based Antifraud Strategy for Medicare  The evaluate and adapt component of the Fraud Risk Framework calls for  federal managers to evaluate outcomes using a risk-based approach and  adapt activities to improve fraud risk management. Furthermore,  according to federal internal control standards, managers should  establish and operate monitoring activities to monitor the internal control  system and evaluate the results, which may be compared against an  established baseline. Ongoing monitoring and periodic evaluations  provide assurances to managers that they are effectively preventing,  detecting, and responding to potential fraud. CMS has established monitoring and evaluation mechanisms for its  program-integrity activities that it could incorporate into an antifraud  strategy. As described in the Fraud Risk Framework, agencies can gather  information on the short-term or intermediate outcomes of some antifraud  initiatives, which may be more readily measured. For example, CMS has  developed some performance measures to provide a basis for monitoring  its progress towards meeting the program-integrity goals set in the HHS  Strategic Plan and Annual Performance Plan. Specifically, CMS  measures whether it is meeting its goal of “increasing the percentage of  Medicare FFS providers and suppliers identified as high risk that receive  an administrative action.” CMS does not set specific antifraud goals for  other parts of Medicare; other CMS performance measures relate to  measuring or reducing improper payments in the various parts of  Medicare. CMS uses return-on-investment and savings estimates to measure the  effectiveness of its Medicare program-integrity activities and FPS. For  example, CMS uses return-on-investment to measure the effectiveness of  FPS and, in response to a recommendation we made in 2012, CMS  developed outcome-based performance targets and milestones for FPS.  CMS has also conducted individual evaluations of its program-integrity  activities, such as an interim evaluation of the prior-authorization  demonstration for power mobility devices that began in 2012 and is  currently implemented in 19 states. Commensurate with greater maturity of control activities in Medicare FFS  compared to other parts of Medicare and Medicaid, monitoring and  evaluation activities for Medicare Parts C and D and Medicaid are more  limited. For example, CMS calculates savings for its program-integrity  activities in Medicare Parts C and D, but not a full return-on-investment.  CMS officials told us that calculating costs for specific activities is  challenging because of overlapping activities among contractors. CMS  officials said they continue to refine methods and develop new savings  estimates for additional program-integrity activities. According to the Fraud Risk Framework, effective managers develop a  strategy and evaluate outcomes using a risk-based approach. In  developing an effective strategy and antifraud activities, managers  consider the benefits and costs of control activities. Ongoing monitoring  and periodic evaluations provide reasonable assurance to managers that  they are effectively preventing, detecting, and responding to potential  fraud. Monitoring and evaluation activities can also support managers’  decisions about allocating resources, and help them to demonstrate their  continued commitment to effectively managing fraud risks. As CMS takes steps to develop an antifraud strategy, it could include  plans for refining and building on existing methods such as return-on- investment or savings measures, and setting appropriate targets to  evaluate the effectiveness of all of CMS’s antifraud efforts. Such a  strategy would help CMS to efficiently allocate program-integrity  resources and to ensure that the agency is effectively preventing,  detecting, and responding to potential fraud. For example, while doing so  would involve challenges, CMS’s strategy could detail plans to advance  efforts to measure a potential fraud rate through baseline and periodic  measures. Fraud-rate measurement efforts could also inform risk  assessment activities, identify currently unknown fraud risks, align  resources to priority risks, and develop effective outcome metrics for  antifraud controls. Such a strategy would also help CMS ensure that it  has effective performance measures in place to assess its antifraud  efforts beyond those related to providers in Medicare FFS, and establish  appropriate targets to measure the agency’s progress in addressing fraud  risks. In our December 2017 report we recommended that the Administrator of  CMS should, using the results of the fraud risk assessments for Medicare,  create, document, implement, and communicate an antifraud strategy that  is aligned with and responsive to regularly assessed fraud risks. This  strategy should include an approach for monitoring and evaluation. In its  March 2018 letter to GAO, HHS stated that it is currently evaluating its  options with regards to implementing this recommendation. As of July  2018, the recommendation remains open. Chairman Jenkins and Ranking Member Lewis, this concludes my  prepared statement. I look forward to the subcommittee’s questions. GAO Contacts and  Staff  Acknowledgments If you or your staff have any questions concerning this testimony, please  contact Seto J. Bagdoyan, who may be reached at (202) 512-6722 or  bagdoyans@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this  statement. Other individuals who made key contributions to this testimony  include Tonita Gillich (Assistant Director), Irina Carnevale (Analyst-in- Charge), Colin Fallon, Scott Hiromoto, and Maria McMullen. Related GAO Reports Improper Payments: Actions and Guidance Could Help Address Issues  and Inconsistencies in Estimation Processes. GAO-18-377. Washington,  D.C.: May 31, 2018. Medicare: CMS Should Take Actions to Continue Prior Authorization  Efforts to Reduce Spending. GAO-18-341. Washington, D.C.: April 20,  2018. Medicare and Medicaid: CMS Needs to Fully Align Its Antifraud Efforts  with the Fraud Risk Framework. GAO-18-88. Washington, D.C.:  December 5, 2017. Medicare: CMS Fraud Prevention System Uses Claims Analysis to  Address Fraud. GAO-17-710. Washington, D.C.: August 30, 2017. Medicare Advantage Program Integrity: CMS’s Efforts to Ensure Proper  Payments and Identify and Recover Improper Payments. GAO-17-761T.  Washington, D.C.: July 19, 2017. Medicare Provider Education: Oversight of Efforts to Reduce Improper  Billing Needs Improvement. GAO-17-290. Washington, D.C.: March 10,  2017. High-Risk Series: Progress on Many High-Risk Areas, While Substantial  Efforts Needed on Others. GAO-17-317. Washington, D.C.: February 15,  2017. Medicare Advantage: Limited Progress Made to Validate Encounter Data  Used to Ensure Proper Payments. GAO-17-223. Washington, D.C.:  January 17, 2017. Medicare: Initial Results of Revised Process to Screen Providers and  Suppliers, and Need for Objectives and Performance Measures.  GAO-17-42. Washington, D.C.: November 15, 2016. Medicare: Claim Review Programs Could Be Improved with Additional  Prepayment Reviews and Better Data. GAO-16-394. Washington, D.C.:  April 13, 2016. Medicare Advantage: Fundamental Improvements Needed in CMS’s  Effort to Recover Substantial Amounts of Improper Payments. GAO-16- 76. Washington, D.C.: April 8, 2016. Health Care Fraud: Information on Most Common Schemes and the  Likely Effect of Smart Cards. GAO-16-216. Washington, D.C.: January  22, 2016. A Framework for Managing Fraud Risks in Federal Programs.  GAO-15-593SP. Washington, D.C.: July 28, 2015. Medicare Program Integrity: Increased Oversight and Guidance Could  Improve Effectiveness and Efficiency of Postpayment Claims Reviews.  GAO-14-474. Washington, D.C.: July 18, 2014. Medicare Fraud Prevention: CMS Has Implemented a Predictive  Analytics System, but Needs to Define Measures to Determine Its  Effectiveness. GAO-13-104. Washington, D.C.: October 15, 2012. This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.
Medicare covered over 58 million people in 2017 and has wide-ranging impact on the health-care sector and the overall U.S. economy. However, the billions of dollars in Medicare outlays as well as program complexity make it susceptible to improper payments, including fraud. Although there are no reliable estimates of fraud in Medicare, in fiscal year 2017 improper payments for Medicare were estimated at about $52 billion. Further, about $1.4 billion was returned to Medicare Trust Funds in fiscal year 2017 as a result of recoveries, fines, and asset forfeitures. In December 2017, GAO issued a report examining how CMS managed its fraud risks overall and particularly the extent to which its efforts in the Medicare and Medicaid programs aligned with GAO's Framework. This testimony, based on that report, discusses the extent to which CMS's management of fraud risks in Medicare aligns with the Framework. For the report, GAO reviewed CMS policies and interviewed officials and external stakeholders. In its December 2017 report, GAO found that the Centers for Medicare & Medicaid Services' (CMS) antifraud efforts for Medicare partially align with GAO's 2015 A Framework for Managing Fraud Risks in Federal Programs (Framework). The Fraud Reduction and Data Analytics Act of 2015 required OMB to incorporate leading practices identified in this Framework in its guidance to agencies on addressing fraud risks. Consistent with the Framework, GAO determined that CMS had demonstrated commitment to combating fraud by creating a dedicated entity to lead antifraud efforts; the Center for Program Integrity (CPI) serves as this entity for fraud, waste, and abuse issues in Medicare. CMS also promoted an antifraud culture by, for example, coordinating with internal stakeholders to incorporate antifraud features into new program design. To increase awareness of fraud risks in Medicare, CMS offered and required training for stakeholder groups such as providers of medical services, but it did not offer or require similar fraud-awareness training for most of its workforce. CMS took some steps to identify fraud risks in Medicare; however, it had not conducted a fraud risk assessment or designed and implemented a risk-based antifraud strategy for Medicare as defined in the Framework. CMS identified fraud risks through control activities that target areas the agency designated as higher risk within Medicare, including specific provider types, such as home health agencies. Building on earlier steps and conducting a fraud risk assessment, consistent with the Framework, would provide the detailed information and insights needed to create a fraud risk profile, which, in turn, is the basis for creating an antifraud strategy. CMS established monitoring and evaluation mechanisms for its program-integrity control activities that, if aligned with an antifraud strategy, could enhance the effectiveness of fraud risk management in Medicare. For example, CMS used return-on-investment and savings estimates to measure the effectiveness of its Medicare program-integrity activities. In developing an antifraud strategy, consistent with the Framework, CMS could include plans for refining and building on existing methods such as return-on-investment, to evaluate the effectiveness of all of its antifraud efforts.