CSA

Summary

California State Auditor · 2003-112 · 2003-01-01

Read the report at California State Auditor ↗

Department of Health Services: It Needs to Better Plan and Coordinate Its Medi-Cal Antifraud Activities December 2003 2003-112 rotiduA etatS ainrofilaC S T I D U A E T A T S F O U A E R U B The first five copies of each California State Auditor report are free. Additional copies are $3 each, payable by check or money order. You can obtain reports by contacting the Bureau of State Audits at the following address: California State Auditor Bureau of State Audits 555 Capitol Mall, Suite 300 Sacramento, California 95814 (916) 445-0255 or TTY (916) 445-0033 OR This report is also available on the World Wide Web http://www.bsa.ca.gov/bsa/ The California State Auditor is pleased to announce the availability of an on-line subscription service. For information on how to subscribe, please contact the Information Technology Unit at (916) 445-0255, ext. 456, or visit our Web site at www.bsa.ca.gov/bsa Alternate format reports available upon request. Permission is granted to reproduce reports. � � � �� December 22, 2003 2003-112 The Governor of California President pro Tempore of the Senate Speaker of the Assembly State Capitol Sacramento, California 95814 Dear Governor and Legislative Leaders: As requested by the Joint Legislative Audit Committee, the Bureau of State Audits presents its audit report concerning the Department of Health Services’ (Health Services) activities to address provider fraud in the California Medical Assistance Program (Medi-Cal). This report concludes that although Health Services performs a number of Medi-Cal fraud prevention and detection activities, it is missing some components of a comprehensive and coordinated strategy for addressing provider fraud. It is currently working to implement some of these missing components, such as estimating the extent of fraud in the program, but it has not yet completed its assessment. Without this information, it cannot know whether it is overinvesting or underinvesting in its antifraud activities or allocating antifraud resources in the right areas. Additionally, Health Services continues to experience delays in processing some provider enrollment applications, and this becomes critical as new legislation effective January 1, 2004, requires it to grant provisional provider status to applicants if its processing of provider enrollment applications does not meet certain time and notice requirements. Further, it does not ensure the consistent screening of providers before enrolling them in the Medi- Cal program and that all enrolled providers continue to meet eligibility requirements. Health Services could also achieve more effective results by expanding the use of one of its antifraud activities, and needs to complete its negotiations on a required agreement that could be structured to better coordinate its investigative efforts with the California Department of Justice. Although Health Services communicates and shares information during various meetings of its antifraud committees and task forces, because it lacks an individual or team with the responsibility and authority to ensure Medi-Cal fraud control issues are addressed and recommendations promptly implemented, some well-known problems, such as those we report on, may continue to go uncorrected. Finally, Health Services needs to better monitor the potential fraud unique to managed care. Respectfully submitted, ELAINE M. HOWLE State Auditor �� CONTENTS Summary 1 Introduction 5 Chapter 1 The Department of Health Services Could Expand Its Strategy for Addressing Fraud in the Medi-Cal Program 15 Recommendations 24 Chapter 2 The Department of Health Services’ Existing Management Practices Do Not Ensure Effective Antifraud Activities 27 Recommendations 51 Appendix A The Centers for Medicare and Medicaid Services Payment Accuracy Measurement Project 55 Appendix B Status of the Department of Health Services’ Implementation of the May 2002 Audit Recommendations to Improve the Provider Enrollment Process 59 Appendix C The Department of Health Services’ Fraud Referrals and the Actions Taken by the California Department of Justice 63 Response to the Audit Health and Human Services Agency, Department of Health Services 65 California State Auditor’s Comments on the Response From the Department of Health Services 75 Response to the Audit Office of the Attorney General, California Department of Justice 77 California State Auditor’s Comment on the Response From the California Department of Justice 81 California State Auditor Report 2003-112 11 SUMMARY RESULTS IN BRIEF The Department of Health Services (Health Services) administers the State’s Medicaid program, the California Medical Assistance Program (Medi-Cal). Medicaid is a Audit Highlights . . . federal program, funded and administered through a state and Our review of the Department federal partnership, to benefit certain low-income people who of Health Services’ (Health lack health insurance. Medi-Cal provides health coverage for Services) activities to identify eligible beneficiaries in California through either a managed and reduce provider fraud in the California Medical care plan or a fee-for-service program. As of April 2003, about Assistance Program (Medi-Cal) 50.3 percent of the 6.4 million Medi-Cal beneficiaries were revealed the following: participating in a managed care plan, and about 49.7 percent þ Because it has not yet were enrolled in the fee-for-service program. assessed the level of improper payments The principal funding sources for Medi-Cal are the State’s occurring in the Medi- General Fund and matching federal funds. For fiscal year Cal program and systematically evaluated 2002–03, the General Fund paid in excess of $10 billion of the the effectiveness of its more than $28 billion in Medi-Cal program expenditures. antifraud efforts, Health Services cannot know Fraud, abuse, and improper payments in the federal whether its antifraud efforts are at appropriate government’s Medicaid program have received much attention levels and focused in the in recent years. Academics and government officials have right areas. written about the size and nature of fraud and abuse in the þ Health Services has not program and recommended strategies for controlling the clearly communicated problem. Although Health Services has for many years operated roles and responsibilities programs to combat beneficiary fraud, before 1999 it dedicated and has not adequately little effort to identifying and preventing provider fraud. Over coordinated antifraud activities both within the last four years, however, Health Services has received Health Services and with budget augmentations and added more than 250 staff for other entities, which activities related to Medi-Cal provider fraud. Some of the key has contributed to some Health Services units involved in antifraud activities aimed unnecessary work or ineffective antifraud at Medi-Cal’s fee-for-service providers include the enrollment efforts. branch, the medical review branch, the investigations branch, þ An updated agreement and the Medi-Cal fraud prevention bureau. with the California Department of Justice Many of the concerns we discuss in this report point to the lack could help Health of certain components of a model fraud control strategy to guide Services better coordinate the various antifraud efforts for the Medi-Cal program. Health investigative efforts related to provider fraud. Services and several external entities conduct numerous fraud prevention, detection, and enforcement activities. However, continued on next page Health Services has not yet developed a complete strategy that coordinates these antifraud activities to ensure that they are performed effectively. Moreover, Health Services has not yet California State Auditor Report 2003-112 11 þ Because it lacks an comprehensively assessed the amount or nature of improper individual or team with payments occurring in the Medi-Cal program, nor has it the responsibility and systematically evaluated the effectiveness of its existing antifraud authority to ensure efforts. Without this information, Health Services cannot know fraud control issues and recommendations are whether it is overinvesting or underinvesting in its antifraud promptly addressed and efforts, or whether it is allocating resources in the right areas. implemented, some well- known problems may go uncorrected. Although Health Services performs a variety of ongoing fraud prevention and detection activities, its management practices þ Health Services does within the antifraud activities we reviewed do not always not obtain sufficient ensure effective efforts. Specifically, at least three divisions information to identify and control the potential and several branches within these divisions carry out each of fraud unique to managed these antifraud activities, ranging from screening providers care. before approving their enrollment in the Medi-Cal program to investigating and referring suspected cases of provider fraud to law enforcement agencies. However, because Health Services has not clearly communicated roles and responsibilities and has not adequately coordinated these antifraud activities, we observed some duplication of effort when processing provider applications and ineffective results in preventing the use of some provider numbers related to providers whose licenses were cancelled. Additionally, we observed that Health Services could achieve more effective results with its pre-checkwrite process. Further, an updated agreement could help it better coordinate its investigative efforts with the California Department of Justice (Justice). As a result, Health Services cannot assure that it is using existing resources effectively to control its Medi-Cal fraud problem. Further, because Health Services lacks an antifraud clearinghouse to track and document information about current fraud issues, proposed solutions, and ongoing projects from all entities responsible for addressing Medi-Cal fraud and because no one individual or team has been assigned the responsibility and corresponding authority to ensure fraud control issues are addressed and recommendations promptly implemented, some well-known problems in the program, such as those discussed in this report, may go uncorrected. Finally, fraud that is unique to managed care involves the unwarranted delay of, reduction in, or denial of care to beneficiaries by a managed care plan. However, because of incomplete survey results and its concerns about the reliability of encounter data, which are records of health care services provided, Health Services does not have sufficient information to identify managed care contractors who are not promptly 22 California State Auditor Report 2003-112 California State Auditor Report 2003-112 33 providing needed health care. In addition, although Health Services is now in the process of measuring the level of improper payments in its administration of the Medi-Cal program, it does not require a similar assessment of its managed care plans, even though potential fraud in the managed care provider networks could affect the calculation of future rates for Medi-Cal’s managed care plans. RECOMMENDATIONS Health Services should develop a complete strategy to address the Medi-Cal fraud problem. This includes adding missing components, such as an annual assessment of the extent of fraud in the Medi-Cal program; an outline of the roles, responsibilities, and coordination of the entities conducting antifraud activities; and a description of how it will measure the performance of its antifraud efforts in reducing fraud. Health Services should improve the processing of provider applications, subject all individual Medi-Cal providers to the same screening requirements, and ensure that enrolled providers continue to be eligible to participate in the program. Health Services should maximize the effectiveness of its pre-checkwrite process, consider working through the California Health and Human Services Agency to establish a clearinghouse to track antifraud issues and recommendations, and better monitor the potential fraud unique to managed care. Health Services and Justice should complete negotiations of their updated agreement that could assist both in coordinating their respective roles and responsibilities for investigating, referring, and prosecuting cases of suspected Medi-Cal provider fraud. The Legislature may wish to require Health Services and Justice to report the status of implementing their agreement during budget hearings. AGENCY COMMENTS Health Services agrees with the recommendations in our report and states that it is looking forward to working with the Health and Human Services Agency to improve the effectiveness of the Medi-Cal antifraud program. 22 California State Auditor Report 2003-112 California State Auditor Report 2003-112 33 Justice concurs with the recommendation in our report and indicates that it is working with Health Services to establish a memorandum of understanding that will serve to strengthen their partnership, thereby improving their effectiveness in combating Medi-Cal fraud. n 44 California State Auditor Report 2003-112 California State Auditor Report 2003-112 55 INTRODUCTION BACKGROUND The Department of Health Services (Health Services) administers the State’s Medicaid program, the California Medical Assistance Program (Medi-Cal). Medicaid is a federal program, funded and administered through a state and federal partnership, to benefit certain low-income people who lack health insurance, including low-income families with children and persons on Supplemental Security Income who are aged, blind, or disabled. Health Services directly administers Medi-Cal by formulating policy that conforms to federal and state requirements. The U.S. Department of Health and Human Services, Centers for Medicare and Medicaid Services (CMS), formerly named the Health Care Financing Administration, provides regulatory oversight of Medi-Cal by reviewing the state plan and approving and monitoring waivers of federal requirements. To qualify for Medi-Cal, beneficiaries must meet the program’s income and property criteria, as well as residence and citizenship requirements. Medi-Cal relies on local county welfare departments to make eligibility determinations. According to data submitted to Health Services by California’s counties, as of April 2003, nearly 6.4 million people were enrolled in the Medi-Cal program. FUNDING SOURCES FOR CALIFORNIA’S MEDI-CAL PROGRAM The principal funding sources for Medi-Cal are the State’s General Fund and matching federal funds. For matching purposes, the federal government separates direct service costs, which are the medical costs paid directly to doctors and other providers, from administrative costs, which are the nonmedical costs of managing the Medi-Cal program. Reimbursement of direct service costs is calculated using the federal medical assistance percentage, which determines how much of the State’s direct service costs the federal government will pay. The federal government calculates the federal medical assistance percentage annually, using a formula that compares a state’s average per-capita income level with the national average 44 California State Auditor Report 2003-112 California State Auditor Report 2003-112 55 per-capita income. Under this formula, the federal government reimburses states with a higher per-capita income level, such as California, for a smaller share of their direct costs than it does states with a lower per-capita income level. By law, the federal medical assistance percentage cannot be lower than 50 percent or higher than 83 percent of a state’s direct service costs. In fiscal year 2002–03, the federal medical assistance percentages for all states varied from 50 percent to 76.6 percent, with California’s percentage being 51.4 percent. The federal government also pays a share of each state’s costs of administering the Medicaid program. It matches most administrative costs at 50 percent, paying higher percentages for certain activities, such as developing mechanized claims processing systems. The General Fund pays the direct service and administrative program costs not covered by the federal government. As shown in Table 1, for fiscal year 2002–03, the General Fund paid an amount greater than $10 billion of the more than $28 billion in Medi-Cal program expenditures. TABLE 1 Medi-Cal Program Costs Fiscal Year 2002–03 (In Millions) General Fund Federal Funds Other Funds Totals Direct Service Costs Fee-for-service $ 7,286.3 $ 8,365.2 $ 940.9 $16,592.4 Managed care 2,295.9 2,341.3 2.7 4,639.9 Other programs* 306.9 4,128.8 860.3 5,296.0 Subtotals 9,889.1 14,835.3 1,803.9 26,528.3 Administrative Costs Local administration 543.9 1,022.5 0.9 1,567.3 State administration 112.6 166.0 278.6 Totals $10,545.6 $16,023.8 $1,804.8 $28,374.2 Source: Department of Health Services. *Includes the dental program and program services provided by the departments of Mental Health and Developmental Services. 66 California State Auditor Report 2003-112 California State Auditor Report 2003-112 77 BENEFITS PROVIDED BY CALIFORNIA’S MEDI-CAL PROGRAM Medi-Cal provides health coverage for eligible beneficiaries in California through either managed care plans or a fee-for-service program. As of April 2003, about 50.3 percent of the 6.4 million Medi-Cal beneficiaries were participating in a managed care plan, and about 49.7 percent were enrolled in the fee-for-service program. Participants of managed care plans are mostly children and families with lesser medical needs, whereas the elderly and disabled, who typically have greater health care needs at higher costs, are in the fee-for-service program. Each managed care plan receives a monthly fee, or capitation payment, from the State for every enrolled beneficiary, in return for providing all of the covered care needed by these beneficiaries. Under the fee-for-service program, beneficiaries may obtain services from any provider, such as physicians, nurses, pharmacists, medical suppliers, and hospitals that agree to accept Medi-Cal payments. Medi-Cal then reimburses these providers for each furnished examination, procedure, service, or item. Some of the other services Medi-Cal provides to eligible California residents include long-term care, hospital care, and pharmaceuticals. Another federal program—Medicare—provides health insurance to people who are 65 or older, some people under age 65 with disabilities, and people with permanent kidney failure requiring dialysis or a transplant. For beneficiaries eligible for both Medicare and Medi-Cal benefits, the Medi-Cal program covers the annual Medicare deductible of $100 and coinsurance of 20 percent, while Medicare covers 80 percent of the approved charges after payment of the $100 annual deductible. HEALTH SERVICES’ ROLE IN CONTROLLING FRAUD IN THE MEDI-CAL PROGRAM In general, Medi-Cal fraud consists of activities that cause the wrongful expenditure of Medi-Cal funds and can be committed by either Medi-Cal beneficiaries or providers. Beneficiary fraud generally happens when people provide false information on their Medi-Cal application or when they use benefits inappropriately. According to Health Services, for many years it has operated two statewide programs from its investigations branch to deal with beneficiary fraud. In one program staff investigates referrals that county welfare offices send at the time 66 California State Auditor Report 2003-112 California State Auditor Report 2003-112 77 beneficiaries apply for benefits and in the other program staff investigates allegations that beneficiaries have inappropriately received services paid for by the Medi-Cal program. Before 1999, Health Services dedicated little effort to identifying provider fraud activities. Over the last four years, however, Health Services has received budget augmentations that have allowed it to add more than 250 staff for activities relating to Medi-Cal provider fraud. Health Services’ antifraud program is conducted in conjunction with the governor’s Medi-Cal Fraud Taskforce, established in 1999, in cooperation with the California Department of Justice (Justice), the State Controller’s Office, the Federal Bureau of Investigation (FBI), the U.S. Attorney, the U.S. Department of Health and Human Services’ Office of Inspector General, the Los Angeles County Health Authority Law Enforcement Team program, and local law enforcement agencies and district attorneys. The Figure provides details of some of the provider fraud prevention and control activities that involve some functions spread across several units within Health Services and Justice. Some of the key Health Services units involved in provider fee-for-service antifraud activities include the enrollment branch, the fraud prevention bureau, and audits and investigations’ medical review and investigations branches. According to CMS, an effective antifraud program ideally begins with the ability to prevent abusive providers from entering a state’s Medicaid program. Thus, Health Services’ first line of defense against provider fraud is the provider enrollment branch, which enrolls and reenrolls fee-for-service health care providers into the Medi-Cal program. According to the enrollment branch, approximately 140,000 Medi-Cal providers are serving the medical needs of the Medi-Cal population. The enrollment branch reviews provider applications, disclosure statements, and agreements from individuals, groups, and companies requesting participation in the Medi-Cal fee-for-service program; it also manages the enrollment of different provider types and the data entry and maintenance of the Provider Master File—the electronic file that Health Services uses to verify that claims are from eligible providers. 88 California State Auditor Report 2003-112 California State Auditor Report 2003-112 99 FIGURE Functional Organizations Involved in California’s Medi-Cal Provider Fraud Prevention and Control Activities �� Sources: Department of Health Services and California Department of Justice. 88 California State Auditor Report 2003-112 California State Auditor Report 2003-112 99 The fraud prevention bureau became operational in October 1999. Its purpose is to identify and prevent fraudulent billing of the Medi-Cal program by conducting on-site fraud-risk assessment surveys of certain provider types to detect high-risk Medi-Cal providers. It assigns a fraud-risk level to each provider based on the presence of systemic and historic fraud indicators. High-risk providers receive an immediate follow-up review designed to document the actual evidence of fraud that is necessary to impose administrative sanctions and to make the appropriate criminal investigation referral. The fraud prevention bureau also reviews and analyzes Medi-Cal provider enrollment and billing statistics for indicators of fraudulent activity and disseminates this information to management. In addition, the fraud prevention bureau develops tracking processes and tracks case results and referrals by program type, type of fraudulent activity, and cost savings or deterrence factors. The fraud prevention bureau also works closely with the FBI under an initiative to investigate health care providers suspected of health care fraud. According to audits and investigations, it is the central coordination point for Health Services’ fraud control activities. It indicates that its focus has changed from the old “pay and chase” to a new proactive and preventive strategy. The medical review and investigations branches of audits and investigations collect fraud referrals; perform data analysis; coordinate with other agencies; audit, investigate, and apply sanctions; and track fraudulent providers and beneficiaries involved in various fraud schemes. The medical review branch is responsible for preventing and detecting provider fraud. It analyzes data and payment trends as a means of detecting fraud and performs other activities such as on-site reviews of providers, focused reviews of certain providers, pre-checkwrite claim reviews, audits of noninstitutional fee-for-service providers, education and outreach, and oversight activities for the audits performed by the State Controller’s Office on its behalf. The medical review branch uses multidisciplinary teams consisting of physicians, registered nurses, pharmacists, analysts, and auditors to conduct these reviews and audits. In addition, the medical review branch collaborates within audits and investigations and externally with other Health Services’ divisions, such as payment systems, legal services, lab field services, and others, focusing on fraud detection that results in increases in the number of on-site 1100 California State Auditor Report 2003-112 California State Auditor Report 2003-112 1111 reviews of suspicious providers. For example, certified law enforcement officers from the investigations branch assist the medical review branch with fraud reviews. The investigations branch is the investigative arm of audits and investigations, and it pursues both beneficiary fraud and provider fraud. This branch is the central point for referring cases of suspected Medi-Cal provider fraud to Justice and to the FBI. It also maintains a provider case tracking system that identifies all provider fraud complaints that it receives, investigator assignments, and the referrals it makes to Justice, the FBI, and all other allied agencies. The provider case tracking system further identifies the actions taken on all complaints received. The investigations branch also refers cases to professional licensing boards, such as the Medical Board and the Pharmacy Board. FRAUD CONTROL IN GOVERNMENT HEALTH CARE PROGRAMS Fraud, abuse, and improper payments in the federal government’s Medicaid program have received much attention in recent years. Academics and government officials have written about the size and nature of the problem and recommended strategies for controlling fraud and abuse. CMS, which oversees the Medicaid program at the federal level, has established the Medicaid Alliance for Program Safeguards to disseminate information to states about effective fraud control strategies. CMS issues fraud control guidance and best practices to states. It also reviews and reports on state efforts to ensure Medicaid program integrity. In addition, the Office of Inspector General in the U.S. Department of Health and Human Services conducts and reports on the annual performance of state Medicaid fraud control units—state law enforcement units responsible for investigating and prosecuting Medicaid provider fraud and abuse. Congress enacted the Health Insurance Portability and Accountability Act of 1996 (HIPAA), with the goal of improving the efficiency and effectiveness of the nation’s health care system. HIPAA includes various requirements to combat health care fraud and abuse. For example, as part of HIPAA, Congress gave the U.S. attorney general subpoena power to facilitate enforcement of certain federal statutes relating to health care 1100 California State Auditor Report 2003-112 California State Auditor Report 2003-112 1111 fraud and abuse. Additionally, HIPAA established a National Provider Identifi er that health care providers use to submit claims or conduct other transactions specifi ed by HIPAA. Further, HIPAA created the Healthcare Integrity and Protection Data Bank to combat fraud and abuse in health insurance and health care delivery. This Characteristics of a model fraud data bank is a national data collection program for control strategy: the reporting and disclosure of certain fi nal adverse 1. Commitment to routine, systematic actions taken against health care practitioners, measurement. providers, and suppliers. 2. Resource allocation for controls based upon an assessment of the seriousness of The issue of fraud control in government health the problem. care programs has been addressed at length 3. Clear designation of responsibility for by Malcolm Sparrow, a nationally recognized fraud control. expert on fraud and fraud control who teaches 4. Adoption of a problem-solving approach at Harvard University’s John F. Kennedy School to fraud control. of Government. In his noteworthy book, License 5. Deliberate focus on early detection of new to Steal: How Fraud Bleeds America’s Health Care types of fraud. System, Sparrow describes the characteristics of a 6. Prepayment, fraud-specifi c controls. model fraud control strategy. He also elaborates on detection systems, including the need to perform 7. Some risk of review for every claim. fraud control monitoring at several levels and how Source: Malcolm Sparrow, License to Steal: How electronic data and available technology provide Fraud Bleeds America’s Health Care System. opportunities for fraud control. SCOPE AND METHODOLOGY The Joint Legislative Audit Committee (audit committee) asked the Bureau of State Audits (bureau) to review Health Services’ reimbursement practices and the systems in place for identifying potential cases of fraud in the Medi-Cal program, with the aim of identifying gaps in California’s efforts to combat fraud. The audit committee also asked that we identify relevant data that quantify losses to the State resulting from Medi-Cal fraud and review and evaluate Health Services’ policies, procedures, and practices for preventing and detecting Medi-Cal fraud. Additionally, it asked that we review Health Services’ policies and procedures for referring Medi-Cal fraud cases to Justice for prosecution, and provide summary information on the number of cases Health Services referred and the resulting actions taken by Justice. Furthermore, the audit committee asked us to determine Health Services’ progress in implementing the recommendations from our May 2002 audit report titled Department of Health Services: It Needs to Signifi cantly Improve Its Management of the Medi-Cal Provider Enrollment Process, Report 2001-129. Finally, the audit 1122 California State Auditor Report 2003-112 California State Auditor Report 2003-112 1133 committee asked us to consider reports or information from fraud control experts to assist with identifying recommendations to reduce or prevent Medi-Cal fraud. To understand Health Services’ Medi-Cal policies as they relate to provider fraud, we reviewed relevant federal and state laws and regulations. We also interviewed Health Services’ staff and reviewed Medi-Cal policies and procedures to identify those Medi-Cal laws and regulations that are applicable. To identify relevant data that quantify losses to the State resulting from Medi-Cal fraud, we determined whether Health Services annually measured the amount of Medi-Cal program dollars lost to fraud. We also assessed the completeness of Health Services’ proposed error rate study by comparing it to the requirements of the CMS Payment Accuracy Measurement model under which it will be conducted. In addition, we obtained Health Services’ Medi-Cal savings and cost avoidance chart and reviewed supporting documents to assess the reasonableness of its savings estimates by evaluating its methodology and calculations. We also obtained the amount of restitution ordered that Justice tracked for fiscal years 1999–2000 through 2002–03. To assess the effectiveness of its current policies and procedures for preventing and detecting fraud, we reviewed selected Health Services divisions or branches that perform various antifraud activities for the Medi-Cal program. We observed staff, reviewed records, and interviewed managers and relevant staff to gain an understanding of their antifraud activities. We also assessed the completeness and adequacy of Health Services’ plan to combat Medi-Cal fraud. To analyze the effectiveness of Health Services’ policies and procedures for referring Medi-Cal fraud cases to Justice for prosecution, we reviewed information from both Health Services’ and Justice’s case-tracking database systems for the last four fiscal years. We also reviewed Health Services’ fraud investigation process and the criteria it uses to decide whether to continue or discontinue an investigation or to refer a case for criminal investigation and prosecution to Justice. We obtained data on the fraud referrals received by Justice during the last four fiscal years and the associated actions that Justice took. To review the completeness of the Justice fraud statistics, we compared the fraud 1122 California State Auditor Report 2003-112 California State Auditor Report 2003-112 1133 referrals that Justice indicated it received from Health Services with the fraud referrals Health Services indicated it sent to Justice, and obtained explanations for any differences. To determine the status of Health Services’ implementation of recommendations from the bureau’s May 2002 report, we performed follow-up work on 12 of the 15 recommendations with the most relevance to Medi-Cal fraud. The other three relate to discontinuing the use of an unnecessary inventory spreadsheet, discontinuing the use of fiscal intermediary staff to process provider enrollment applications, and adhering to state standards when hiring student assistants. To assist with identifying recommendations to reduce or prevent Medi-Cal fraud, we reviewed reports, information, and guidance from fraud control experts, such as CMS, the U.S. Department of Health and Human Services’ Office of Inspector General, the General Accounting Office, and Malcolm Sparrow, author of the book titled License to Steal: How Fraud Bleeds America’s Health Care System. We also reviewed, Controlling Improper Payments in the Medical Assistance Program, a report released by Minnesota’s legislative auditor in August 2003. n 1144 California State Auditor Report 2003-112 California State Auditor Report 2003-112 1155 CHAPTER 1 The Department of Health Services Could Expand Its Strategy for Addressing Fraud in the Medi-Cal Program CHAPTER SUMMARY The Department of Health Services (Health Services) and several external entities conduct a number of fraud prevention and detection activities for the federal Medicaid program, the California Medical Assistance Program (Medi-Cal). However, Health Services lacks some components of a comprehensive strategy to guide and coordinate the various antifraud activities to ensure that they are effective and efficient. Moreover, Health Services has not comprehensively assessed the amount or nature of improper payments occurring in the Medi-Cal program, nor has it systematically evaluated the effectiveness of its existing antifraud efforts. Without this information, Health Services does not know whether it is overinvesting or underinvesting in its antifraud efforts, or whether it is allocating resources in the right areas. Health Services’ existing antifraud activities aimed at Medi-Cal providers stem from its fiscal year 1999–2000 budget proposal. Health Services acknowledges that these activities need updating and proposes to begin this process by conducting a study to assess the amount of improper payments, including fraud, in the Medi-Cal program. Its fiscal year 2003–04 budget contains funds for conducting this study. HEALTH SERVICES LACKS SOME COMPONENTS OF A MODEL FRAUD CONTROL STRATEGY Health Services lacks some of the elements of a comprehensive and coordinated strategy to guide its antifraud efforts. According to guidelines issued by the U.S. Department of Health and Human Services’ Centers for Medicare and Medicaid Services (CMS) for addressing fraud and abuse, a state Medicaid agency should have a plan that outlines all of the state’s fraud and abuse prevention and detection activities, key partners and stakeholders, and roles and responsibilities. Such a plan, 1144 California State Auditor Report 2003-112 California State Auditor Report 2003-112 1155 encompassing both fee-for-service and managed care, should include goals for antifraud efforts, measurements to assess Without all the progress toward those goals, areas of vulnerability and ways components of an to address them, and milestones for the completion of key antifraud plan, activities. Without these elements, Health Services cannot Health Services cannot ensure its efforts are comprehensive and coordinated, and that ensure that its antifraud the increases in funding and positions it has received are at the efforts are at the appropriate levels and focused on the areas of greatest fraud risk. appropriate levels and focused on the areas of Over the last four years, Health Services has received many greatest fraud risk. additional staff positions and has established a variety of antifraud activities to combat Medi-Cal provider fraud. These activities are dispersed throughout Health Services and include an enhanced provider enrollment process, investigative resources that have been redirected to identifying provider fraud, and establishment of the Medi-Cal Fraud Prevention Bureau (fraud prevention bureau). Additionally, Health Services conducts its antifraud activities in cooperation with various federal, state, and local agencies, such as the Federal Bureau of Investigation, Los Angeles County Health Authority Law Enforcement Team program, and the California Department of Justice (Justice). According to Health Services, its Fraud Steering Committee meets monthly to facilitate communication and coordination among these agencies. Further, according to Health Services, two other entities ensure communication and a collaborative effort against fraud and abuse. The Governor’s Medi-Cal Fraud Task Force normally holds quarterly meetings to improve communication and coordination of antifraud activities at state and federal levels. The Medical Implications of Healthcare Fraud Task Force meets periodically to address health issues that could result in serious health care concerns for Medi-Cal beneficiaries. According to its fiscal year 2003–04 budget request (2003 budget proposal), Health Services, in cooperation with other state, local, and federal agencies, has achieved success in detecting and preventing Medi-Cal fraud. Health Services asserts that it has accomplished many of the goals it set in 1999 and that its research abilities have evolved to the point that it can identify emerging fraud schemes. For example, the fraud prevention bureau targeted potential fraud within certain provider types that it considers high risk. According to Health Services, it has also strengthened its provider enrollment process and denied initial enrollment or reenrollment to more than 2,000 providers, with an estimated cost avoidance and savings of $600 million. Further, Health Services stated that it applied administrative 1166 California State Auditor Report 2003-112 California State Auditor Report 2003-112 1177 sanctions to more than 1,700 providers through field reviews and preliminary investigations by Audits and Investigations (audits and investigations) and the fraud prevention bureau, resulting in savings of more than $406 million. Health Services also reported that its pre-checkwrite reviews, the purpose of which is to detect new fraud schemes or fraudulent providers and stop their payments as quickly as possible, saved approximately $96 million. Health Services informed us that its 2003 budget proposal outlines its antifraud activities but its other planning processes are informal. Although Health Services’ current antifraud efforts and its 2003 budget proposal, which was the basis of the Legislature’s approval of the latest staff increases, together Components missing contain certain components of a model antifraud strategy, from Health Services’ other components are missing or incomplete. Specifically, plan include an overall these components include an overall estimate of the extent of estimate of the extent of potential fraud, a list of the areas at highest risk for fraud and potential fraud and thus in need of targeted antifraud efforts, a clear designation of a clear designation of the responsibility for fraud control including an outline of the the responsibility for responsibilities and coordination between Health Services and fraud control. other agencies, metrics for evaluating the effectiveness of its antifraud activities, and a description of processes to ensure that every claim faces some risk of review. According to both CMS guidelines and the components of a model antifraud strategy discussed in the Introduction, these components are essential to a model antifraud strategy. For example, both emphasize the importance of using measurements to assess progress toward goals to determine whether antifraud measures are having a meaningful impact on the overall extent of fraud. Health Services has not yet developed an estimate of the overall extent of fraud in the Medi-Cal program and the associated areas in greatest need of its antifraud efforts. The Legislature has approved the funding requested in the 2003 budget proposal for an error rate study that will allow Health Services to assess the extent of improper payments. As we discuss more fully in the next section, Health Services is just beginning this assessment. Without such an assessment, Health Services cannot be sure it is targeting resources to the areas of greatest fraud risk. Further, Health Services has not clearly designated who is responsible for implementing the Medi-Cal fraud control program. A model antifraud strategy involves a clear designation of responsibility for fraud control, which in turn requires someone or a team with authority over the functional 1166 California State Auditor Report 2003-112 California State Auditor Report 2003-112 1177 components that implement the antifraud program. However, about half of the Medi-Cal provider types are approved by entities other than the Provider Enrollment Branch, but, as we discuss in Chapter 2, the branch has no authority to require that the enrollment procedures used by the other entities include steps to verify that these providers meet the specific requirements of the Medi-Cal program. Also in Chapter 2, we discuss the lack of an updated agreement that would help resolve coordination problems with provider fraud case referrals by Health Services to Justice. Although audits and investigations is the central coordination point for antifraud activities within Health Services and chairs internal committees and the Governor’s Medi-Cal Fraud Task Force, some antifraud efforts are located in other divisions and bureaus of Health Services or in other state departments over which audits and investigations has no authority. Therefore, audits and investigations’ designation as the central coordination point within Health Services does not completely fill the need for an individual or team that crosses departmental lines and is charged with the overall responsibility and authority for detecting and preventing Medi-Cal fraud. Additionally, rather than measuring the impact of its efforts by the amount of reduction in fraud, Health Services measures its success by reference to unreliable savings and cost avoidance estimates. The adoption of a problem-solving approach to fraud control, a component of a model antifraud strategy, requires evaluating the impact of antifraud measures on fraud both before and after implementation of the measure. However, Health Services measures its efforts by the achievement of goals established during the development of its savings and cost Although antifraud avoidance estimates. Although antifraud efforts offer savings, as efforts offer savings, they noted in a General Accounting Office report, they also need to be also need to be measured measured against their effect on the overall fraud problem to against their effect on the determine whether the control activities should be adjusted. overall level of fraud. Finally, Health Services does not currently have processes to ensure that each claim faces some risk of fraud review. According to Health Services, although its current claims processing system subjects each claim to certain edits and audits, it does not subject each claim to the potential for random selection and in-depth evaluation for the detection of potential fraud. Health Services stated that the reason for this is because of limited staff and because it found that the benefits of a random review were outweighed by the greater cost-effectiveness of more targeted reviews. However, Health Services acknowledges that the random 1188 California State Auditor Report 2003-112 California State Auditor Report 2003-112 1199 sampling of claims, in conjunction with the error rate study discussed more fully in the next section, will provide it with information it can use to modify its fraud deterrence program. The 2003 budget proposal includes establishing a systematic process to randomly select claims for in-depth evaluation and this is one of the components the Legislature approved. HEALTH SERVICES HAS NOT YET CONDUCTED ROUTINE AND SYSTEMATIC MEASUREMENTS OF THE EXTENT OF FRAUD IN THE MEDI-CAL PROGRAM Health Services has not systematically assessed the amount or nature of improper payments—payments that should not have been made or that were made in an incorrect amount (including overpayments and underpayments)—in the Medi-Cal program. Improper payments include any payment to an ineligible beneficiary, any payment for an ineligible service, any duplicate payment, payments for services not received, and any payment that does not account for credit for applicable discounts. Without this information, Health Services does not know whether it is overinvesting or underinvesting in its payment control system, or whether it is allocating resources in the appropriate areas. Despite Health Services’ ongoing efforts to prevent, detect, and control fraud, it has not undertaken, until recently, the For fiscal year 2003–04, research needed to establish the extent of provider fraud in Health Services submitted the Medi-Cal program. Although it did not participate in the a proposal to participate first two years, Health Services has submitted a proposal to in a federal pilot program participate in the third year of a federal pilot program aimed at aimed at determining developing methods of determining payment accuracy rates in payment accuracy rates the Medicaid program. in the Medicaid program. CMS recommends that states conduct studies to quantify the amount of fraud and abuse in their Medicaid programs. According to CMS, these studies establish a baseline that can be used to monitor progress in controlling fraud and abuse, and they identify areas where limited funds and staff can best be used for improvement. Because Health Services has not yet developed a measurement of the extent of fraud in the Medi-Cal program, it hinders executive management from obtaining the critical information it needs for making important decisions about where to allocate resources and how much it should allocate in those areas. To direct fraud detection and deterrence 1188 California State Auditor Report 2003-112 California State Auditor Report 2003-112 1199 resources in the most cost-effective manner, program managers must be able to measure the amount and type of fraud that exists in the program. According to an August 2003 report issued by Minnesota’s legislative auditor, the Internal Revenue Service (IRS) is an example of an organization that has used estimation techniques to help manage its efforts to control fraud, abuse, and other compliance problems. For many years, the IRS periodically reviewed a random sample of tax returns, which it used to arrive at a reporting compliance rate. It used the results to promote and enforce taxpayer compliance, as well as to allocate its resources and determine the effectiveness of its programs. Minnesota’s report noted that effectively targeting resources depends on understanding the specific problems that need to be addressed. Additionally, one component of a model fraud control strategy Without systematic is systematic measurement. Measuring the amount and nature of measurement of the improper payments, including those caused by fraud, occurring amount and nature of in the Medi-Cal program would enable Health Services to improper payments, implement a more strategic approach to controlling improper Health Services has no payments. Health Services has data on the improper payments it way to determine whether has detected through its current system, but it has not estimated the time and expense it is the magnitude of the improper payments that are slipping devoting to investigating through its system undetected. The best way to obtain this cases are producing a real type of information is to audit a representative sample of paid deterrent effect on fraud. claims. The results could provide valuable insight and direction. Without systematic measurement, Health Services’ fraud-control efforts may not be as effective as they could be because it has no way of determining whether the time and expense it is devoting to investigating cases are producing a real deterrent effect. The Legislature has approved portions of the 2003 budget proposal that Health Services submitted in May 2003 to request additional staff for its strategic antifraud proposals, two elements of which are an error rate study and random sampling of claims. In this proposal, Health Services stated that it would randomly select a statistically valid sample of beneficiaries and review services rendered to identify improper provider billing for the error rate study. It also estimated that it would review 100 claims per week for the random sampling component. According to Health Services, this design will permit program auditors and analysts to estimate all types of billing errors, recognizing various combinations of relationships among providers, pharmacies, and beneficiaries. 2200 California State Auditor Report 2003-112 California State Auditor Report 2003-112 2211 Building upon its authorization to conduct an error rate study, in August 2003 Health Services developed and submitted a proposal to participate in a CMS project to measure payment accuracy. As we discuss in more detail in Appendix A, in June 2003, CMS solicited states to participate in the third year of its Medicaid Payment Accuracy Measurement (PAM) Project, with the offer of 100 percent funding for the project costs. The overall purpose of the project is to develop methods to measure Medicaid payment accuracy on a state-specific basis, compare payment accuracy across states, and estimate payment accuracy nationally. According to Health Services, as this proposal is closely related in nature and scope to its error rate study, it has replaced the error rate study with the PAM project proposal for fiscal year 2003–04. Health Services’ proposal is generally consistent with the CMS requirements, which are focused on all improper payments and not just fraudulent payments. In its proposal for the PAM Project, Health Services states that it will develop an audit program to accomplish certain objectives, including identifying improper payments, and a questionnaire to confirm that a Health Services has yet beneficiary actually received the services claimed by the provider. to determine how, or the However, Health Services has yet to determine how it will use number of, beneficiaries it its questionnaire or the number of beneficiaries it will contact will contact to verify that to verify that services were rendered for the provider claims services were rendered; it reviews. According to Health Services, it is in the process of therefore, it is premature developing the audit program and procedures for identifying to conclude on the improper payments. Health Services states that its decision to adequacy of its approach visit the beneficiaries in person, however, will be on a cost-benefit to estimate the level of basis, as beneficiaries may be difficult to reach or may not be able fraudulent payments. to recall a specific provider visit. Until Health Services completes its audit program and procedures, it is premature to conclude on the adequacy of its approach to verify services with beneficiaries to estimate the level of fraudulent payments. Because it was designed to measure only payment accuracy, the CMS PAM model seems to be a good method of systematically measuring payment accuracy rates but not necessarily of determining the nature and extent of fraud that exists in the Medi-Cal program. Therefore, participating in the third year of the PAM Project is a good starting point for Health Services to begin measuring the improper payments that exist in its program. However, Health Services will need to ensure its review procedures include appropriate steps, such as verifying services rendered, to identify fraudulent or excessive payments to providers. Once Health Services has determined the magnitude 2200 California State Auditor Report 2003-112 California State Auditor Report 2003-112 2211 of the fraud problem, program managers will have the information they need to develop more precise fraud deterrence and detection efforts. HEALTH SERVICES DOES NOT EVALUATE THE EFFECT ON THE EXTENT OF FRAUD OF ITS ANTIFRAUD ACTIVITIES AND USES UNRELIABLE SAVINGS ESTIMATES Health Services does not perform a cost-benefit analysis for each of its antifraud activities, nor does it use reliable savings estimates to justify its requests for additional antifraud positions. According to Strategies to Manage Improper Payments, an October 2001 General Accounting Office report, agencies should weigh the costs and benefits of internal control activities to allow them to tailor control activities to fit their special needs. The report also states that based on an analysis of the specified risks facing the organization and the environment in which it operates, it should determine which types of control activities would be most effective in addressing the identified risks. Furthermore, the report states that the agency should perform cost-benefit analyses of potential control activities before implementation to ensure that the cost of conducting those activities is not greater than the potential benefit gained. When we asked Health Services if it performs cost-benefit analyses of the actual costs versus the associated effectiveness of its antifraud activities in reducing the level of fraud in the Medi-Cal program, it informed us that it continually modifies and improves its analysis of each of its antifraud activities. Health Services employs According to Health Services, it first uses a form of cost- a form of cost-benefit benefit analysis, using estimated savings or cost avoidance as analysis, which uses the benefit, to make decisions regarding resource allocations. estimated savings or cost Health Services indicated that it looks at the costs and savings avoidance as the benefit, of its antifraud activities in the aggregate and not by specific to decide how to allocate activity because not all the fraud positions it received are directly its resources. involved in savings and cost avoidance activities. According to Health Services, the savings and cost avoidance associated with its antifraud activities have always exceeded the additional funds it receives to expand its antifraud program. When drawing up its savings estimate and production planning or goals each year, Health Services determines what it actually achieved in the prior year and then makes decisions regarding where to focus its resources in the coming year. According to Health Services, the purpose of this process is to make sure that it is maximizing its resources and saving more than the antifraud program costs in the aggregate. 2222 California State Auditor Report 2003-112 California State Auditor Report 2003-112 2233 As it gains more information about ongoing projects, Health Services continues to evaluate them and make changes or reallocate resources to alternative uses. Although it acknowledged that it does not use a formal cost-benefit assessment, Health Services asserts that it does perform an intuitive type of assessment. For example, it had a project in which it worked with its fiscal intermediary to send out midyear payment summaries to doctors’ homes rather than to their business addresses, with hopes of identifying possible victims of identity theft. Through monitoring, Health Services determined that this particular project did not achieve significant results, so it decided not to add the project to its antifraud activity process. According to Health Services, it did not do a specific cost-benefit analysis, but it did review the results of the project and decided that its efforts were better used in other areas. Health Services stated that for another project, through evaluations and investigative work, it discovered that unscrupulous providers were using beneficiary identification cards to create fictitious Medi-Cal claims and receive fraudulent payments. To prevent such schemes, Health Services reissued the beneficiary identification cards with new numbers to certain beneficiaries who appeared to incur an unusually high level of health care services. Health Services’ cost-benefit analysis initially estimated between $9 million and $13 million in annual program cost savings after evaluating the change in costs before and after reissuing the new beneficiary identification cards. Health Services performed similar analyses throughout the project and after 18 months of evaluation determined that the project actually saved roughly $8 million annually. Although Health Services performed a cost-benefit analysis that measured the costs and effect on fraud for its beneficiary identification cards project, it does not perform the same type Although Health Services of analysis for all of its other antifraud activities. Instead, it measured the costs and computes a savings and cost avoidance chart (savings chart), effect on fraud for its which it uses to estimate the savings it expects to achieve from its beneficiary identification antifraud activities in the current and budget year. Health Services cards project, it does not also uses the savings chart to quantify the achievements of each perform the same type of of its antifraud activities in the prior year and as a management analysis for all of its other tool to allocate resources. For instance, Health Services used antifraud activities. the savings chart it created in November 2002 to support its request for 315 new positions for antifraud activities in its budget proposal dated May 2003, of which 161.5 positions were ultimately approved by the Legislature. 2222 California State Auditor Report 2003-112 California State Auditor Report 2003-112 2233 However, Health Services’ November 2002 savings chart When estimating potentially overstates its estimated savings because of a flaw in savings from its the methodology it uses to calculate the savings. Health Services antifraud activities, calculates its savings and cost avoidance estimates for some in some cases Health categories by using the average 12-month paid claims history Services simply assumes of providers who have been placed on administrative sanctions, that 100 percent of a such as having payments withheld, being placed on temporary sanctioned provider’s suspension, undergoing special claims review, or needing prior claims were improper authorization of services. Health Services bases its estimates on rather than determining the assumption that 100 percent of the claims it paid during what proportion was the prior 12-month period to those providers sanctioned in the actually improper. As a current year should be counted as savings in the budget year. result, Health Services However, it does not perform any additional analysis to determine potentially overstates what proportion of the sanctioned providers’ paid claims was its actual savings or actually improper. We question the soundness of Health Services’ cost avoidance. methodology of simply assuming that 100 percent of the claims from sanctioned providers were improper. Even though the improper portion of the claim history would be potential savings, any legitimate claims submitted by the sanctioned provider could continue as a program cost because beneficiaries would presumably receive health care services from another provider who would bill the program. Thus, Health Services’ methodology may potentially overstate the actual savings or cost avoidance achieved from its antifraud activities. RECOMMENDATIONS Health Services should develop a complete strategy to address the Medi-Cal fraud problem and guide its antifraud efforts. This should include adding the currently missing components of a model fraud control strategy, such as an annual assessment of the extent of fraud in the Medi-Cal program, an outline of the roles and responsibilities of and the coordination between Health Services and other entities, and a description of how Health Services will measure the performance of its antifraud efforts and evaluate whether adjustments are needed. To ensure that it will have the information it needs to determine whether it is investing an appropriate level of resources to combat fraud in the Medi-Cal program, Health Services should do the following: • Establish appropriate claim review steps, such as verifying with beneficiaries the actual services rendered, to allow it to estimate the amount of fraud in the Medi-Cal program as part of its PAM study. 2244 California State Auditor Report 2003-112 California State Auditor Report 2003-112 2255 • Ensure that the benchmark developed by the PAM model is reassessed by annually monitoring and updating its measurement methodologies. To allocate available resources to the most cost-effective antifraud efforts, Health Services should perform cost-benefit analyses that measure the effect its antifraud activities have on reducing fraud. Additionally, it should continuously monitor the performance of these activities to ensure that they remain cost-effective. n 2244 California State Auditor Report 2003-112 California State Auditor Report 2003-112 2255 Blank page inserted for reproduction purposes only. 2266 California State Auditor Report 2003-112 California State Auditor Report 2003-112 2277 CHAPTER 2 The Department of Health Services’ Existing Management Practices Do Not Ensure Effective Antifraud Activities CHAPTER SUMMARY The Department of Health Services (Health Services) has established a variety of ongoing fraud prevention and detection activities (antifraud activities). However, weak management practices within the antifraud activities we reviewed have contributed to unnecessary work or ineffective antifraud efforts. At least three divisions within Health Services are responsible for performing one or more antifraud activities. In addition, various branches within these divisions carry out certain of the antifraud activities, from screening providers before approving their enrollment into the California Medical Assistance Program (Medi-Cal) to investigating and referring suspected cases of provider fraud to law enforcement agencies. It is important that Health Services coordinate its antifraud activities among these various branches and clearly communicate their roles and responsibilities. However, we observed that Health Services performs duplicate work in some cases and may not be effective in preventing ineligible providers from participating in the Medi-Cal program in other cases. Further, it could achieve more effective results in preventing improper payments for one of its antifraud activities and could also coordinate its investigative efforts better with another state agency. As a result, Health Services cannot assure that it is using existing resources efficiently and that its fraud controls are effective. THE PROVIDER ENROLLMENT PROCESS CONTINUES TO NEED IMPROVEMENT Health Services’ Provider Enrollment Branch (enrollment branch) screens applications to ensure that the providers it enrolls are eligible to participate in the Medi-Cal program. This includes ensuring that all Medi-Cal providers have completed applications, disclosure statements, and agreements on file, in compliance with federal and state regulations, to help it 2266 California State Auditor Report 2003-112 California State Auditor Report 2003-112 2277 determine whether providers have any related financial and ownership interests that may give them the incentive to commit fraud or were previously convicted of health care fraud. It also must suspend those Medi-Cal providers whose licenses and certifications are not current or active, in compliance with state regulations. Although these activities are important first lines of defense in preventing fraudulent providers from participating in the Medi-Cal program, the enrollment branch is not fully performing either of these activities. In our May 2002 report, Department of Health Services: It Needs to Significantly Improve Its Management of the Medi-Cal Provider Enrollment Process, Report 2001-129, we made a number of recommendations, including that the enrollment branch improve its coordination with other Health Services units, improve its ability to track cases and ensure that cases are processed within the time frame required by regulation, more The enrollment branch effectively use its Provider Enrollment Tracking System (PETS), has not established and ensure that certain providers have current disclosure important management statements on file. However, the enrollment branch has not practices to ensure that fully implemented many of our May 2002 recommendations. it processes provider For example, it has not established important management applications within the practices, such as using its tracking system to monitor the required time frame. progress of application processing and formally coordinating departmental enrollment efforts, to ensure that it processes provider applications within the required time frame. Moreover, enrollment branch management has not taken sufficient action to ensure that only eligible providers continue to participate in the Medi-Cal program. Appendix B examines in detail the status of Health Services’ implementation of these recommendations. Health Services May Be Required to Enroll Some Applicants Even Though It Has Not Yet Completed Its Review With some exceptions, current state regulations require Health Services to process an application and notify a provider of its decision within 180 days of receiving an application. If an application is incomplete or deficient and is sent back to the applicant to correct the deficiencies, or if the application is sent to Health Services’ Audits and Investigations (audits and investigations) for an on-site visit (secondary review), the time period allowed for processing the application may be longer. However, under any of these conditions, within 120 days of receipt of its application package, the enrollment branch must notify the applicant in writing that the application is either 2288 California State Auditor Report 2003-112 California State Auditor Report 2003-112 2299 complete and accepted for processing, denied, or incomplete. Additionally, if it forwards the application to audits and investigations for secondary review, the enrollment branch must notify the applicant of this additional action. In our May 2002 report, one of our recommendations to the enrollment branch was to use PETS to ensure that it sends notifications to applicants at proper intervals. As we note in more detail in Appendix B, the enrollment branch still does not track whether it sends notifications to applicants within 120 days, nor does it notify a provider when an application is sent to audits and investigations for secondary review. The enrollment branch acknowledges, in fact, that it currently has no way to ensure that notifications are sent and that PETS is unable to track when notifications are sent. New legislation that takes effect on January 1, 2004, increases the importance of sending these notifications because it allows an applicant into the Medi-Cal program if the enrollment branch does not take action within a specified period. Specifically, the enrollment branch must notify applicants, within 180 days of receiving their applications, that they have been granted provisional provider status for 12 months, that their application has been denied or is incomplete, or that a secondary review is being conducted. If the enrollment branch does not send the notification before the 181st day, it must grant the applicant provisional provider status for up to 12 months. Moreover, New legislation increases this new legislation specifically requires these notifications for the importance of timely applications the enrollment branch received before May 1, 2003. application processing If the enrollment branch does not notify these applicants and notification of of its decision on or before January 1, 2004, it must grant applicants because it them provisional provider status. Therefore, it is vital that the allows applicants into the enrollment branch ensure that it sends notifications at the proper Medi-Cal program if the time and that it processes applications in a timely manner. enrollment branch does not complete these actions As Table 2 on the following page illustrates, the enrollment within a specified period. branch processed the majority of applications it received in fiscal year 2002–03 within 180 days; however, it continues to take longer than 180 days to approve, close, or deny applications in some cases. For example, it took longer than 180 days to close or deny 371 applications in fiscal year 2002–03. Under the new legislation, these applicants would have been granted provisional provider status because the enrollment branch also does not ensure it sends the required notifications. More importantly, as of September 29, 2003, the enrollment branch had 1,058 applications still open that it received before 2288 California State Auditor Report 2003-112 California State Auditor Report 2003-112 2299 May 1, 2003. If the enrollment branch does not send these applicants a written notification before January 1, 2004, it must grant them provisional provider status regardless of any ongoing review. Of the 1,058 applications still open, the enrollment branch forwarded 319 to audits and investigations for secondary review without sending written notice to the applicants. The enrollment branch must now send a written notification to each of these applicants before January 1, 2004, indicating that their applications have been forwarded for secondary review to avoid having to grant them provisional provider status. For the remaining 739 applications, the enrollment branch will need to complete its review of the applications and notify these applicants in writing, before January 1, 2004, that their applications are either approved, denied, incomplete, deficient, or being forwarded to audits and investigations for secondary review, to avoid granting provisional provider status to these applicants that the enrollment branch has not yet ensured meet all the requirements for participating in the Medi-Cal program. TABLE 2 Number of Provider Applications Received in Fiscal Year 2002–03 and Their Status* Applications Applications Applications Approved in Closed or Applications Applications Closed or Applications More Than Denied in More Month Received Approved Denied Still Open† 180 Days Than 180 Days July 2,825 1,416 1,370 39 50 72 August 2,933 1,471 1,388 74 85 30 September 2,939 1,336 1,511 92 187 61 October 3,274 1,651 1,567 56 98 69 November 3,194 1,813 1,322 59 167 63 December 2,702 1,493 1,154 55 372 30 January 3,168 1,941 1,161 66 104 27 February 1,790 873 853 64 8 9 March 2,325 1,132 1,112 81 0 10 April 3,012 1,314 1,226 472 0 0 May 2,824 599 687 1,538 0 0 June 3,082 759 529 1,794 0 0 Totals 34,068 15,798 13,880 4,390 1,071 371 Source: Department of Health Services, Provider Enrollment Tracking System. *For provider types processed by the enrollment branch as identified in Table 3 on page 34. Status is as of September 29, 2003. † Applications received in fiscal year 2002–03 and before May 1, 2003, total 1,058 and are shown in bold. 3300 California State Auditor Report 2003-112 California State Auditor Report 2003-112 3311 According to the enrollment branch, it continues to lack the resources needed to properly screen provider applications and ensure that notifications are sent within the required 180 days. However, it indicates that it is in the process of developing a plan to implement all aspects of the new legislation. The enrollment branch is planning to monitor the status of all applications received before May 1, 2003, and to ensure they are sent appropriate notifications by the end of the calendar year. It is also planning to implement a system in which enrollment branch analysts are notified of applications nearing the 180-day mark and after which applicants would be granted provisional provider status. When the enrollment branch refers applications to audits and investigations for secondary review, the processing time typically extends well beyond 180 days. Neither the current regulations nor the new legislation state a time limit for when Health Services must complete its secondary review. For applications the enrollment branch referred for secondary review in fiscal year 2002–03, the average length of time an application remained at audits and investigations was 141 days, not including the time it was under review at the enrollment branch. Audits and investigations currently has about a six-month backlog. We observed, in September 2003, that audits and investigations had referrals from the enrollment branch dating back to January 2003 that were still unassigned. New applicants In September 2003, sometimes waited up to a year to hear whether their applications audits and investigations were approved or denied. Because of this backlog, the first thing an had referrals dating back analyst does when performing a preliminary desk review is contact to January 2003 that the applicant to verify the current address and continued interest were still unassigned; new in applying to the program. The analyst also redoes some of the applicants sometimes screening previously performed by the enrollment branch, such as waited up to a year checking to confirm that the applicant’s license is valid. This is not to hear whether their only an inefficient use of scarce resources, but it further extends applications were the time applicants are left waiting. Furthermore, beginning approved or denied. January 1, 2004, unless the enrollment branch assures that appropriate notifications are sent to applicants within 180 days of receiving their applications, applicants must be granted provisional provider status and may begin billing the program even though the enrollment branch may not have approved their participation in the Medi-Cal program. 3300 California State Auditor Report 2003-112 California State Auditor Report 2003-112 3311 Health Services Does Not Ensure That All Applications Are Processed Consistently and Meet the Same Screening Standards In addition to not processing some applications within 180 days, Health Services is unable to ensure that all provider applications are processed consistently and in conformity with federal and state program requirements. According to the Code of Federal Regulations, Title 42, Section 455.106, and California Welfare and Institutions Code, Section 14123, to be enrolled or continue enrollment in the Medi-Cal program, a provider or anyone owning all or part of a provider business or facility must not have been convicted of a criminal offense related to Medicare or Medi-Cal and must not be on suspension from participating in Medicare or Medicaid programs. A list of providers excluded from the Medicare program is available to the public and maintained by the U.S. Department of Health and Human Services’ Office of Inspector General. In addition to the federal list of excluded providers, Health Services maintains a list of providers who have been excluded from the Medi-Cal program. However, Health Services is not consistently using these lists as tools for screening new providers enrolling in the program. The enrollment branch reviews applications for certain provider types, such as physicians, pharmacies, clinical labs, suppliers of durable medical equipment, and nonemergency medical transportation. Within the enrollment branch, applications for each of these provider types are processed and screened by different units. Analysts in each unit use similar checklists to guide the application review process. In reviewing new provider applications, the enrollment branch checks a variety of sources to confirm licensure, verify the information provided on the application, and confirm that the applicant has not been placed on the Medicare list of excluded providers. The enrollment branch also probes further into the background of potential providers by researching the history The enrollment branch of each provider’s associations and the addresses affiliated with probes further into the the individual, as well as validating phone numbers, current background of potential addresses, and federal tax identification numbers. In addition, providers than do other the enrollment branch refers many applications to audits and divisions within Health investigations for further review. Services that also process provider applications. In comparison, other divisions within Health Services and other departments responsible for reviewing certain types of provider applications and recommending provider enrollment do not conduct a similar review. For example, the Licensing and Certification Division (certification division) of Health Services, which processes provider applications for institutions and 3322 California State Auditor Report 2003-112 California State Auditor Report 2003-112 3333 facilities, such as hospitals and skilled nursing facilities, does not subject the owners to a background screening comparable to the screening that the enrollment branch performs for its providers. The certification division’s review process generally entails compiling a compliance history of the provider and referring to the company’s or the Secretary of State’s Web site to confirm that it is a registered business. The certification division does this for each individual listed on the disclosure form. A facility that is applying to be certified for both Medicare and Medi-Cal forwards its application packet to the U.S. Health and Human Services’ Centers for Medicare and Medicaid Services (CMS), its fiscal intermediary, or its carrier. A carrier is a private company that contracts with Medicare to pay Medicare bills. For applications that go to the CMS carrier, we found that the carrier screens for prior financial history and checks against the list of Medicare-excluded providers. For providers applying only for Medi-Cal certification, however, the certification division acknowledged that it does not forward these applications to CMS, nor does it check the owners or business names of the facilities against the list of Medicare-excluded providers. Health Services’ enrollment branch indicated that it does not do this checking either. According to the enrollment branch, its only role in enrolling Medi-Cal facilities and institutions is to add to or change the Provider Master File based on written communication, in the form of a certification and transmittal form, from the certification division. In other words, once the certification division certifies a facility, it sends a certification and transmittal form to the enrollment branch, and the enrollment branch enrolls the provider into the Medi-Cal system. When asked about the background screening of providers, certification division staff told us they believed this was the enrollment branch’s responsibility. Moreover, the enrollment branch was unaware of the review process, if any, that takes place in departments, such as the Department of Mental Health, that are responsible for approving the enrollment of other provider types. Table 3 on the following page lists the various types of providers enrolled in the Medi-Cal program and the entities that are responsible for processing their respective applications. As shown in the table, the enrollment branch accounts for the majority of the providers enrolled in the program, 83 percent, with other Health Services’ divisions or programs accounting for another 15.3 percent. 3322 California State Auditor Report 2003-112 California State Auditor Report 2003-112 3333 TABLE 3 Medi-Cal Provider Types Grouped According to the Entity Approving Enrollment in the Medi-Cal Program Number of Percent of Entity Approving Enrollment of Providers Provider Type Providers Total Health Services’ Provider Enrollment Branch Physician 90,040 Physician group 7,942 Pharmacy 5,827 Optometrist 3,279 Psychologist 2,896 Podiatrist 1,626 Certified acupuncturist 1,285 Chiropractor 1,172 Others 8,636 Subtotal 122,703 83.0% Health Services’ Licensing and Certification Long-term care facility 2,610 Division Community hospital—inpatient 2,194 Community hospital—outpatient 1,857 Others 2,198 Subtotal 8,859 6.0 Health Services’ Children’s Medical Services Institutional and non-institutional genetically handicapped person program 13,298 9.0 Health Services’ Breast Cancer Program Breast cancer early detection program 399 0.3 Department of Education Local education agency 513 0.4 Department of Aging Adult day care center and multipurpose senior services 362 0.2 Department of Mental Health Mental health inpatient 180 0.1 Others Various 1,472 1.0 Total 147,786 100.0% Source: Department of Health Services’ Provider Master File. Because the enrollment branch does not perform any oversight of or coordination with other units or departments that approve the enrollment of certain providers, the screening standards for all applications are not the same. For example, the certification division recommends Medi-Cal enrollment based on a facility’s standard of care and services provided, but the enrollment branch recommends enrollment based on a background screening of the individual performing the service. According to the certification division, it does not conduct extensive background screenings of the owners of facilities because its 3344 California State Auditor Report 2003-112 California State Auditor Report 2003-112 3355 primary objective is to license or certify facilities and institutions based on their compliance with health and safety codes and quality of care standards. To prevent potential fraudulent providers from enrolling in the Inconsistent screening Medi-Cal program, it is necessary to screen the individuals with may result in Health the most to gain from committing fraud. This includes not only Services allowing the individuals actually providing services but also anyone with ineligible individuals to a financial interest in the provider’s operations. If some provider participate as providers in types are checked in this way but others are not, Health Services the Medi-Cal program. cannot assure that all providers have met the same criteria for eligibility. Therefore, since different units and departments screen providers against different criteria, Health Services may be allowing ineligible individuals to participate as providers in the Medi-Cal program. Health Services Does Not Always Ensure the Continuing Eligibility of Enrolled Providers Health Services’ procedures are not always effective to ensure that enrolled providers remain eligible to participate in the Medi-Cal program. To determine whether the enrollment branch complies with laws and regulations designed to ensure that enrolled providers continue to be eligible Medi-Cal providers, we tested a sample of enrolled providers that Health Services paid in fiscal year 2002–03. Our review of 30 existing Medi-Cal providers disclosed two with canceled licenses. As of August 2003, one provider’s license had been canceled effective March 2002 and the other provider’s license had been canceled effective March 2003. Even though the Welfare and Institutions Code, Section 14043.6, requires providers whose license, certificate, or approval has been revoked or is pending revocation to be automatically suspended from the Medi-Cal program effective on the same date the license was revoked or lost, as of August 2003, the provider numbers for both of these providers were being used to continue billing and receiving payment from the Medi-Cal program every month since the cancellations occurred. In the first case involving a canceled license, the Provider Master File indicated that Health Services paid more than $3 million in claims under the old provider number after the March 2002 cancellation of that provider’s license. Further analysis revealed that Health Services received a change of ownership application for this provider in June 2002, but as of August 2003, it had not been completely reviewed. Therefore, the enrollment branch has permitted a new owner, not yet approved as an eligible Medi-Cal 3344 California State Auditor Report 2003-112 California State Auditor Report 2003-112 3355 provider, to continue to bill and receive payment from the Medi-Cal program using the old owner’s provider number. The enrollment branch acknowledges that its practice of allowing a new owner to use a prior owner’s provider number is in direct conflict with state regulations. Specifically, the regulations state that no provider shall submit claims to the Medi-Cal program using any provider number other than the one Health Services issued to that provider. In the second case involving a canceled provider license, the Provider Master File indicated payment of more than $140,000 in claims after March 2003, the month the license was canceled. As of August 2003, the enrollment branch had not received any notification about the provider, including the provider’s canceled license, because it does not check with professional licensing boards on a periodic basis. According to the enrollment branch, the provider number has not been targeted for reenrollment but would be deactivated in November 2003 because of a change in ownership. Our review of 30 selected providers also found that the enrollment Although they provide branch did not always have the required agreements and disclosures information that can on file. State and federal regulations require Health Services to be used to determine maintain complete disclosure statements and provider agreements whether a provider on file for all enrolled and active providers. Federal regulations has been convicted of also require Health Services to terminate an existing agreement or has an incentive to if the provider fails to disclose certain ownership information. commit health care The disclosure statements provide Health Services with relevant fraud, the enrollment information to ensure that the provider has not been convicted branch did not always of a crime related to Medicare, Medi-Cal, or other health care have the required fraud, and to ensure that the provider does not have an incentive provider agreements and to commit fraud based on the financial and ownership interests disclosures on file. disclosed. Of the 30 provider files we reviewed, two did not contain disclosure statements. Additionally, Health Services could not locate agreements for 24 of these providers. According to the enrollment branch, enrollment as a Medi-Cal provider does not have an expiration date; therefore, new information from the provider is only requested when instigating action triggers it, such as when the provider is selected for reenrollment. Nevertheless, the provider agreements give Health Services a certification, under penalty of perjury, that the provider will abide by federal and state laws and regulations, will disclose all financial and ownership interests and criminal background, will agree to a background check and unannounced visit, and will agree not to commit fraud or abuse. Despite the fraud prevention capabilities these required disclosures 3366 California State Auditor Report 2003-112 California State Auditor Report 2003-112 3377 and agreements provide, Health Services does not maintain complete provider disclosures and agreements on file, nor does it always deactivate or suspend providers when required by law. As a solution to this ongoing problem, we recommended in our May 2002 audit that the enrollment branch consider reenrolling all provider types. Reenrollment would improve the enrollment branch’s ability to ensure that all providers have current licenses, disclosure statements, and agreements on file. Although the enrollment branch has begun the process of reenrolling certain provider types it has identified as high risk, it has not developed a strategy to reenroll all providers to The enrollment branch update its existing records, nor does it have a process in place has begun reenrolling to periodically check the licensure of existing providers with certain providers, but it state professional boards. According to the enrollment branch, lacks a strategy to update the primary barriers to developing a strategy for reenrolling its records by reenrolling all providers are a lack of adequate time, staff, and resources, all providers and a along with pressure not to do so from the provider community. process to periodically The enrollment branch also asserted that, historically, it has no check the licensure of formal system of communication with state licensing boards and existing providers. that it does not have the resources to check the license status of all providers currently in the Provider Master File. However, it also has not conducted an analysis to determine what resources it would need to achieve this goal, even though this was a recommendation in our May 2002 audit. THE PRE-CHECKWRITE PROCESS COULD ACHIEVE MORE EFFECTIVE RESULTS According to a June 2001 federal report on state efforts to control improper payments in the Medicaid program, performing reviews before paying Medicaid claims can help prevent improper payments. A recognized prepayment control measure for preventing improper payments is to analyze past billing patterns to identify suspicious claims so they can be reviewed before they are paid. Furthermore, fraud-specific prepayment controls are an essential component of the model fraud control strategy discussed in the Introduction. Health Services has established a prepayment review process it calls pre-checkwrite. This process identifies and selects certain suspicious provider claims for further review from the weekly batch of claims approved for payment. Staff at audits and investigations field offices (field office) complete the pre-checkwrite reviews. Although the pre-checkwrite 3366 California State Auditor Report 2003-112 California State Auditor Report 2003-112 3377 process appears effective in identifying suspicious providers, Although the Health Services does not review all of the providers flagged pre-checkwrite process as suspicious. Moreover, Health Services does not delay the appears effective, payments associated with suspect provider claims pending Health Services does completion of the field office review. Several months may not review all providers elapse between the selection of a suspicious provider and when flagged as suspicious Health Services initially visits the provider and completes its and does not delay the review. Although a pre-checkwrite review may result in the payments associated identification of an improper payment, recovery of this payment with suspect claims would be unnecessary if the original payment had been delayed while it reviews them. or suspended. We reviewed 10 weekly pre-checkwrites, which identified a total of 88 providers with suspicious claims. Of these 88 providers, Health Services selected 47 for further review. At the time of our audit, 42 provider reviews had been completed, and 31, or 74 percent, of these had resulted in an administrative sanction and referral to audits and investigations’ Investigations Branch (investigations branch) or to law enforcement agencies. According to Health Services, limited staffing precludes it from reviewing all suspicious providers. Based on our sample of pre-checkwrite reports, the field offices visit the providers, on average, about 40 days after the initial selection of a provider with suspicious claims. Health Services does not delay payment of the suspicious provider claims selected for review while a pre-checkwrite review is under way. According to Health Services, the term “pre-checkwrite” as it is used today is really a misnomer. The process was originally designed to quickly review providers and halt payments before they were disbursed. According to Health Services, this was easier to accomplish when abuse and fraud were obvious, such as cases in which the provider service address was a post office box or a vacant lot, or when a real business simply did not exist. According to Health Services, these types of clearly erroneous claims have largely been replaced by more sophisticated and complex cases in which the provider operates in what appears to be a real place of business. Health Services asserts that the amount of time its staff spends on reviews has increased because abuse and fraud are now more sophisticated and harder to detect. Health Services asserts that, as a result, it cannot postpone the payments associated with the selected provider claims because the methodologies used to select providers for review are risk assessments indicating potential abuse or fraud and are not a 3388 California State Auditor Report 2003-112 California State Auditor Report 2003-112 3399 confirmation of abuse or fraud. Health Services states that it must perform additional analysis to develop sufficient evidence and a basis for placing sanctions, including withholding a payment or placing utilization controls on providers. However, the turnaround time for completing the reviews is dependent The pre-checkwrite on field office workload. Based on a sample of pre-checkwrite process loses its reports, an average of 118 days elapses between the initial potential effectiveness selection of the suspicious provider and the completion of as a preventive measure the case. The elapsed time from the selection of a suspicious when Health Services provider to the completion of the case ranged from 25 days does not suspend to 255 days. Two of the 42 completed pre-checkwrite reviews payments of suspicious were completed more than 150 days after the selection of provider claims. the suspicious provider claims. When Health Services does not promptly complete its reviews and suspend payment of suspicious provider claims until it completes its on-site review, its pre-checkwrite process loses its potential effectiveness as a preventive fraud control measure. Health Services could suspend payments for claims that its risk assessment process identifies as potentially fraudulent or abusive and release them once a pre-checkwrite review verifies the legitimacy of the claim. Although federal and state laws generally require prompt payment, they make an exception for claims suspected of fraud or abuse and for claims that require additional evidence to establish their validity. For example, under the Code of Federal Regulations, Title 42, Section 447.45, Health Services must pay 90 percent of “clean claims” within 30 days of receipt and 99 percent within 90 days. The regulation defines a clean claim as one that can be processed without obtaining additional information from the provider or a third party. However, clean claims do not include those under investigation for fraud or abuse or claims that are under review for medical necessity. The California Welfare and Institutions Code, Section 14104.3, has a similar timing requirement for claims payment. California Government Code, Section 927.5, a portion of the California Prompt Payment Act, requires payment of claims within 30 days if the Medi-Cal provider is a small business or nonprofit organization. However, this does not include claims subject to special prepayment fraud and abuse controls. Under these laws and regulations, a claim under review is no longer a clean claim and is no longer subject to the general requirement for payment within certain time frames. 3388 California State Auditor Report 2003-112 California State Auditor Report 2003-112 3399 HEALTH SERVICES AND THE CALIFORNIA DEPARTMENT OF JUSTICE HAVE YET TO FULLY COORDINATE THEIR INVESTIGATIVE EFFORTS Although a federal requirement, Health Services and the California Department of Justice (Justice) have not completed negotiations for a current agreement that could assist both agencies in defining and coordinating their respective roles and responsibilities for investigating and prosecuting cases of suspected Medi-Cal provider fraud (suspected provider fraud). Federal regulations require Health Services, as the State’s Medicaid agency, to conduct a preliminary investigation of Medi-Cal fraud or abuse complaints to determine whether there is sufficient basis to warrant a full investigation. If the findings of the preliminary investigation give it reason to believe that an incident of fraud has occurred, the regulations require Health Services to refer all cases of suspected provider fraud or abuse to Justice, the State’s Medicaid fraud control unit, for full investigation and to refer suspected beneficiary fraud cases to an appropriate law enforcement agency. If Health Services has reason to believe that a beneficiary has abused the program, federal regulations require it to conduct a full investigation of the abuse. On the other hand, federal regulations require Justice to conduct a statewide program for investigating and prosecuting, or referring for prosecution, violations of all applicable laws pertaining to fraud in the administration of the Medi-Cal program, the provision of medical assistance, or the activities of providers of medical assistance. Federal regulations require that a full investigation continue until legal action is initiated, the case is closed or dropped, or the matter is resolved. Appendix C provides statistics on the fraud referrals made to Justice and the actions taken by Justice on fraud cases in fiscal years 1999–2000 through 2002–03. Although Health Services is responsible for performing a Lack of a current preliminary investigation and referring all cases of suspected agreement between provider fraud to Justice for full investigation and prosecution, Health Services and it does not refer cases as required. Moreover, Health Services Justice has contributed and Justice have been slow in updating their agreement to the communication even though the agreement is required by federal regulations and coordination and could be structured to clarify and coordinate their roles problems we noted. and responsibilities and, thus, help prevent many of the communication and coordination problems we noted with the current investigations and referral processes. 4400 California State Auditor Report 2003-112 California State Auditor Report 2003-112 4411 Health Services Makes Late or Incomplete Referrals to Justice Our comparison of fi scal year 2002–03 referrals of suspected provider fraud cases from Health Services’ case-tracking system database to similar records from Justice’s case-tracking system database revealed that 63 (41 percent) of the 152 Health Services case referrals to Justice were late, incomplete, or never received. Consequently, Justice did not record these cases in its database. According to its supervising deputy attorney general, Justice did not include 60 of the 63 referrals that it did not have in its records either because they were incomplete when Justice received them or it received them close to the date of indictment by an assistant U.S. Attorney for the Eastern District of California (U.S. Attorney). Health Services’ Problematic Referrals Justice stated that because these referrals were not to Justice in Fiscal Year 2002–03 intended for its investigation, it did not record them in its database as referrals. For the remaining Incomplete or late referrals from the Investigations Branch 26 three cases, although Health Services asserts Incomplete referrals that it referred them to Justice, Health Services from the Medi-Cal Fraud could not provide documentation that clearly Prevention Bureau 34 demonstrates its referral of these three cases to Referrals that Justice Justice. Health Services provided us with a copy did not receive 3 of its September 2002 memorandum to Justice Total problematic Health Services that, in part, lists these three cases as part of a referrals in fi scal year 2002–03 63 group of six cases it would be submitting to the U.S. Attorney and a copy of the overnight mail slip that it asserts demonstrates its mailing of the referral package to Justice. However, the overnight mail slip does not itemize the contents of the package. Therefore, it is unclear to us whether Health Services referred these three cases to Justice. Justice asserted that similar discrepancies occurred in prior years. Our review of a sample of its investigation cases corroborated that Health Services’ investigations branch referred cases to Justice late. Of the 14 cases we reviewed that resulted in a referral to Justice, Health Services referred 12 an average of nearly fi ve months after the date it had evidence of suspected fraud. For example, Health Services referred one case to Justice nearly 17 months after it had suspected provider fraud and only days before indictment by the U.S. Attorney in March 2003. For another case, Health Services only sent to Justice a copy of its complaint intake form more than three months after it had discovered suspected fraud. Another case showed that Health Services referred the case to the U.S. Attorney in February 2003 for prosecution; however, Health Services did not refer the case 4400 California State Auditor Report 2003-112 California State Auditor Report 2003-112 4411 to Justice until March 2003—two weeks before the date the U.S. Attorney indicted the provider. For one other case, Health Services implemented administrative sanctions in July 2002 and referred the case to Justice (at Justice’s request) in January 2003. Although Health Services acknowledged that referring cases to Justice after indictment by the U.S. Attorney is no longer its practice, according to the investigations branch, it investigates and refers cases to the U.S. Attorney because the U.S. Attorney indicts suspected providers and settles cases quickly. Justice, on the other hand, typically focuses on developing cases for trial to pursue sentences that it believes reflect the seriousness of the defendant’s conduct. For example, Justice’s criminal investigation and prosecution of a provider responsible for defrauding California’s Medi-Cal program of more than $20 million Health Services and resulted in the conviction and recent sentencing of the provider Justice have not reached to 16 years in prison. Although both approaches have merit, an agreement on depending on the particular case, Health Services and Justice have which cases should not come to an agreement on when each approach is appropriate be prosecuted by the and who should make that determination. U.S. Attorney or Justice, and who should make It is also noteworthy that when Health Services does not that determination. promptly refer cases to Justice but instead makes referrals directly to an assistant U.S. Attorney for the Eastern District of California, this U.S. Attorney’s application of certain federal rules could preclude Justice from obtaining information on those cases. The U.S. Attorney relies on the federal grand jury process to bring indictments, and the federal rules of procedure governing those proceedings give the U.S. Attorney certain discretion to determine who has access to the information under investigation by the grand jury and may prevent Health Services from providing information to Justice regarding the status of those cases. For example, according to Health Services, it sends to Justice only those supporting documents that are not bound by federal grand jury limitations. Nonetheless, the federal Medicaid regulations require Health Services to refer all cases of suspected provider fraud to Justice. Further, the regulations allow Justice to refer cases to other appropriate criminal investigative or prosecutive authorities. These problems concerning case referral result, in part, because the investigations branch’s understanding of the laws surrounding the referral of suspected provider fraud cases to Justice is that they do not specifically define what constitutes suspected fraud. Federal law requires Health Services to refer a case to Justice when, after its preliminary investigation, it 4422 California State Auditor Report 2003-112 California State Auditor Report 2003-112 4433 suspects provider fraud, but it does not define exactly what constitutes suspected fraud. Justice considers this standard to be met when Health Services has found reliable evidence, such as that needed to withhold a payment. However, according to Health Services’ investigations branch chief, because neither federal nor state laws provide a clear definition of what constitutes suspected fraud, the investigations branch can refer cases to Justice at varying points in the process, including before, during, or after it has met the reliable evidence standard. Admittedly, the law does not clearly define what constitutes suspected fraud, but Health Services and Justice should reach a clear agreement on what standard must be met to assist both agencies in coordinating their respective provider fraud investigation and prosecution efforts. Health Services and Justice Could Use CMS Guidelines to Develop the Required Agreement The agreement between Health Services and Justice that is required by federal regulations could help alleviate many of the current problems about when Health Services should refer cases to Justice. However, these two entities have yet to complete negotiations for an update of this agreement or to define and coordinate their respective roles and responsibilities for Over the last several investigating and prosecuting suspected cases of Medi-Cal years, Health Services and provider fraud. Over the last several years, Health Services and Justice have intermittently Justice have intermittently discussed an update of the existing discussed an update 1988 agreement. Documents show that in March 2000 Justice of the existing 1988 transmitted modifications to Health Services on a 1999 proposed agreement, but have yet agreement. The transmittal was followed by approximately to complete negotiations. 18 months of periodic communication between Health Services and Justice until December 2001 when Health Services’ assigned negotiator notified Justice of her reassignment to another area. In April 2002, Justice sent Health Services a letter that describes the protocol that both agencies had agreed to work under. Although Health Services acknowledges that a definition of preliminary investigation would help eliminate the case referral problems, neither the proposed agreement nor the letter define what a preliminary investigation entails to clearly establish when Health Services should refer cases to Justice for full investigation and prosecution, as required by law. Furthermore, neither the proposed agreement nor the letter provide the criteria Health Services should use to determine when it has enough evidence to suspect fraud, or how both agencies will coordinate their investigative efforts to ensure the efficient and effective use of their resources. 4422 California State Auditor Report 2003-112 California State Auditor Report 2003-112 4433 Although federal regulations do not specifically define what a preliminary investigation entails or when a case of suspected fraud is ready for referral, Health Services and Justice could use CMS’s Medicare program integrity manual (CMS manual) as guidance when developing these definitions for their agreement. Although intended for Medicare, the CMS manual provides requirements for identifying and verifying potential fraud and taking corrective actions. These requirements could presumably be used as guidance for similar governmental health care programs, such as Medi-Cal. The manual states, for example, that fiscal intermediaries have a duty to identify cases of suspected fraud and make referrals to the designated agency, regardless of dollar thresholds or subject matter, when they have a reasonable basis to suspect that the provider (1) intentionally engaged in improper billing, (2) submitted improper claims with actual knowledge of their falsity, or (3) submitted improper claims with reckless disregard or deliberate ignorance of their truth or falsity. Further, the CMS manual defines the development of complaints as establishing the factual basis for substantiating an allegation, such as when improper claims are found. Substantiation does not imply the need to be able to prove the accuracy of the information in a court of law. Rather, staff must be satisfied that an allegation is likely to be true and that a referral to law enforcement is required. The manual also states that evidence of fraud at any time should result in a referral to the fraud control unit for development, accompanied by the information necessary to develop a quality case. Additionally, according to the CMS manual, in every instance, whether or not the case is a potential law enforcement referral, the first priority is to minimize the potential loss to program funds and to protect beneficiaries from any potential adverse effect. The CMS manual states that sanctions represent the full range of administrative remedies and actions available to deal with questionable, improper, or abusive practices by practitioners, providers, and suppliers under any health care program. The sanctions are designed to protect the programs by ensuring that improper payments are identified and recovered and that future improper payments are not made. The CMS manual provides that less severe administrative remedies, such as withholding of payments, may precede the more punitive sanctions affecting participation in the programs. 4444 California State Auditor Report 2003-112 California State Auditor Report 2003-112 4455 The CMS manual also explains that if the designated agency declines a case, the case may be referred to other law enforcement agencies, such as the Federal Bureau of Investigation, but the designated agency must be informed of the intent to do so. Although federal regulations do not provide similar guidance for the Medicaid program, the CMS manual, for example, allows designated agencies only 90 days to either accept or reject the fraud referral and requires the referring agency to follow up with the designated agency to determine and document the status of the referral. The designated agency may conduct a criminal or civil investigation, refer the case for administrative action, or refer the case to another law enforcement agency for investigation. A MORE EFFECTIVE FEEDBACK PROCESS COULD STRENGTHEN HEALTH SERVICES’ ANTIFRAUD EFFORTS Although Health Services acknowledges that one could be Although it has some useful, it lacks an antifraud clearinghouse to track and document mechanisms for sharing information about current fraud issues, proposed solutions, and information and ongoing projects from all entities responsible for addressing coordinating actions Medi-Cal fraud. Without a process to ensure their resolution, for individual projects, some well-known problems may go uncorrected for long periods Health Services lacks of time. Although Health Services has some mechanisms for an effective feedback sharing information and coordinating actions for individual process and the staff to projects, it lacks an effective feedback process and staff dedicated track fraud issues and to tracking the various issues raised by all entities responsible worthwhile antifraud for addressing fraud and ensuring that worthwhile antifraud recommendations. recommendations are tracked to implementation. An Effective Feedback Process Starts With an Antifraud Clearinghouse A national fraud control expert has pointed out that larger organizations have more sharply defined functional boundaries between subunits and less of a need for frequent contact between these subdivisions. However, decreased contact can discourage sharing of information between subunits, even if they are all involved in the common mission of addressing fraud. Consequently, this arrangement may impair the development of a coherent fraud control strategy, which includes the clear designation of responsibility for fraud control. As noted throughout this report, several units within Health Services, as well as external agencies, conduct antifraud activities, yet there is no central clearinghouse to coordinate 4444 California State Auditor Report 2003-112 California State Auditor Report 2003-112 4455 their efforts and ensure that recommendations for improving Although audits the Medi-Cal antifraud efforts are carried out. Although audits and investigations and investigations is responsible for coordinating the various is responsible for antifraud activities within Health Services, its line of authority coordinating the various does not extend beyond audits and investigations. antifraud activities within Health Services, its line of The deputy director for audits and investigations indicated that authority does not extend a central clearinghouse to track topics of concern, antifraud beyond audits ideas, and identified trends, and to help ensure that needed and investigations. changes are made, is desirable but may not be possible due to a lack of staff. Nevertheless, the deputy director asserted that an active review process exists because the constantly changing nature of fraud requires continuous assessment and adjustments. The deputy director also indicated that Health Services works on issues as they come up, addressing each area of concern and following up on a case-by-case basis. Moreover, the deputy director said that Health Services’ management is involved in many issues, resulting in meetings and communications at many levels within Health Services. For example, according to Health Services, its Fraud Steering Committee facilitates communication and coordination within the department, and the Governor’s Medi-Cal Fraud Task Force and the Medical Implications of Healthcare Fraud Task Force perform similar functions among Health Services and other state, federal, and local entities. Although meeting minutes of the committees and task forces that Health Services chairs do show a level of internal and external communication, they also point out that many things are going on simultaneously in the area of Medi-Cal fraud. What is lacking is an individual or team with the responsibility and corresponding authority to ensure that worthwhile antifraud recommendations are tracked, followed up, and implemented. Such an individual or team would provide Health Services management with information about the status of the various projects and measures that are under way, to ensure that antifraud proposals, including those involving external entities, are addressed promptly. Without a Responsible Individual or Team to Ensure Their Resolution, Well-Known Problems May Continue to Adversely Affect Medi-Cal Without an individual or team with the responsibility and corresponding authority to follow up and act on recommendations for strengthening its antifraud efforts, 4466 California State Auditor Report 2003-112 California State Auditor Report 2003-112 4477 some antifraud coordination issues or detected fraud control vulnerabilities may continue to go uncorrected. For example, Without an individual although Health Services’ provider enrollment process is the first or team with the line of defense to prevent abusive providers from entering the responsibility and authority Medi-Cal program, as we discussed earlier in this chapter, the to act on antifraud provider enrollment process continues to need improvement. recommendations, some Specifically, other divisions within Health Services and other coordination issues or departments recommend the enrollment of certain providers fraud control vulnerabilities into the Medi-Cal program, but they and the enrollment branch may continue to do not coordinate their efforts to ensure that provider eligibility go uncorrected. reviews are complete before the providers are enrolled. The enrollment branch also does not always ensure that enrolled providers continue to be eligible to participate in the Medi-Cal program. Although audits from previous years have reported similar issues with the provider enrollment process, these issues remain uncorrected. Similarly, another fraud control coordination issue that has remained unresolved is the lack of an updated agreement between Health Services and Justice related to the investigation and referral of suspected provider fraud cases. As discussed earlier in this chapter, although laws make each of these state agencies responsible for certain aspects of investigating and prosecuting cases of suspected provider fraud, the current case referral practices result in a fragmented rather than a cohesive and coordinated antifraud effort. Both agencies indicate that they have made some efforts to update their 1988 agreement over the last few years. However, they have yet to complete negotiations for a current agreement that spells out each agency’s respective roles and responsibilities and that would assist each in meeting its respective legal obligations and overall missions. HEALTH SERVICES NEEDS TO GIVE PROPER ATTENTION TO POTENTIAL FRAUD UNIQUE TO MANAGED CARE In addition to its fee-for-service program, Health Services also provides Medi-Cal services through a managed care system. Under this system, the State pays managed care plans monthly fees, called capitation payments, to provide beneficiaries with health care services. Although fraud perpetrated by providers and beneficiaries, similar to what occurs under the fee-for-service system, can also occur, another type of fraud is unique to managed care. This type of fraud involves the unwarranted delay in, reduction in, or denial of care to beneficiaries by a managed care plan. Because of the nature of fixed payments in a capitated 4466 California State Auditor Report 2003-112 California State Auditor Report 2003-112 4477 environment, providers have a financial incentive to furnish minimal care in order to maximize returns to the managed care plan. Therefore, when managed care plans intentionally delay, reduce, or deny beneficiaries the health care they need and that Health Services expects will be provided for the capitation payments it makes, fraud may have been committed. However, because of incomplete survey results and its concerns about the reliability of encounter data, which are records of services provided, Health Services does not have sufficient information to identify managed care contractors that do not promptly provide needed health care. In addition, Health Services does not require its managed care plans to estimate the level of improper payments within their provider networks to assure they are appropriately controlling their fraud problems and not significantly affecting the calculation of future capitated rates. Beneficiary Surveys Do Not Identify Plans With Low Ratings Without scores for individual plans that assess beneficiaries’ access to health care, Health Services lacks a monitoring tool to identify signs of potential fraud. Health Services contracted Without scores for with an external quality review organization to administer the individual managed Consumer Assessment of Health Plans 2.0H survey (survey) of care plans that assess Medi-Cal managed care beneficiaries. The aggregate response to beneficiaries’ access the 1999 survey, the most recent results available, indicated that to health care, Health California’s overall score ranked below the 50th percentile of the Services lacks a national benchmark for all sections of the survey, including the monitoring tool to identify areas for obtaining needed care and getting that care quickly. signs of potential fraud. However, because of an insufficient response rate, nearly all of the managed care plans lacked enough respondents to these sections to warrant a score. Consequently, Health Services does not know whether the low overall score for these survey sections are caused by a few of the managed care plans or if the problem is more widespread. The National Committee for Quality Assurance (NCQA) developed the survey as a standardized instrument to assess members’ satisfaction and experiences with managed care and to compare the results of the health plans. Federal laws and regulations require this assessment annually as part of the State’s quality strategy regarding quality outcomes, timeliness, and access to the services covered by managed care plans. According to Health Services, it relies on its external quality review organization to perform a survey in compliance with the NCQA methodology. After our inquiries, Health Services contacted NCQA to determine why, for the same survey, enough responses 4488 California State Auditor Report 2003-112 California State Auditor Report 2003-112 4499 existed to provide scores for individual managed care plans for some sections of the survey and not enough for others. NCQA informed Health Services that certain questions on the survey, by directing respondents to other sections of the survey, could have an effect on the response rate for other questions. NCQA also informed Health Services that it could require its external quality review organization to oversample so that it can obtain a sufficient number of valid responses from which to report results from all sections of the survey for individual managed care plans. Accuracy and Reliability Concerns Prevent the Use of Encounter Data for Monitoring According to federal guidelines for addressing fraud and abuse in Medicaid managed care, accurate and complete Accurate and complete encounter data—the records of health care services provided encounter data—the to beneficiaries that managed care plans are required to report records of health care to Health Services—can also be used to monitor utilization of services provided to health care, access to care, and the quality of care. Additionally, beneficiaries—can encounter data can be analyzed and used as a management tool be used to monitor to monitor and enforce the terms of contracts with managed utilization of health care, care plans and their provider networks. For example, a review of access to care, and the encounter data could indicate whether the managed care plan is quality of care. shifting costs of care that ordinarily fall within its contract with Health Services to the fee-for-service Medi-Cal program. However, Health Services does not use encounter data to monitor the performance of its managed care plans. According to Health Services, the encounter data received from its managed care plans is neither complete nor reliable enough to use as a monitoring tool from which to draw conclusions about their performance. Health Services stated that it is working to improve the quality and quantity of encounter data. For example, it indicated that it is compiling quarterly utilization reports based on the submitted encounter data and sending them to the managed care plans to determine whether its encounter data matches the managed care plans’ information. Health Services also reported that although a lack of resources limits its ability to improve the quality of the data submitted by the managed care plans, it is examining ways to use this data to assess how a managed care plan is doing in certain areas and targeting its monitoring based on that assessment. 4488 California State Auditor Report 2003-112 California State Auditor Report 2003-112 4499 An Estimate of Improper Payments Is Needed if Rates Are Based on Plan Costs Although it is currently in the process of conducting a study to estimate the level of improper payments in the fee-for-service component of its Medi-Cal program, Health Services does not Health Services could require its managed care plans to also estimate the level of unknowingly pay an improper payments within their provider networks. With a excessive fraud component recent change to base capitation rates on a managed care plan’s in its capitated rates if costs, Health Services could unknowingly pay an excessive fraud it does not have an component if it does not have an estimate of the proportion of estimate of the error, inadvertent error, abuse, or potential fraud within a managed abuse, or potential fraud care plan’s cost data. An estimate would allow Health Services to within a managed care monitor the effect improper payments have on the calculation plan’s cost data. of capitation rates and encourage managed care plans to manage the level of improper payments. Without such an estimate, Health Services and the federal government could possibly shoulder increased costs in the form of higher capitation rates. Federal regulations require state Medicaid agencies to pay actuarially sound capitation rates that are appropriate for the populations and services covered by managed care plans. Currently, Health Services bases some of its capitation rates on costs derived from the fee-for-service segment of Medi-Cal. However, Health Services stated that because the fee-for-service segment of Medi-Cal has eroded due to the impact of managed care expansion, the pool of fee-for-service claims is insufficient for actuaries to certify that continuing to use these claims is actuarially sound and appropriate for the Medi-Cal managed care population. In other words, the population served by the Medi-Cal fee-for-service program is now significantly different in demographic makeup from the population served by the Medi-Cal managed care system. Therefore, Health Services has decided to use managed care plan cost data to determine capitation rates. Health Services acknowledges that any errors, abuse, or fraud included within the claims paid by managed care plans to their providers could be carried forward into the capitation rates if the rates are based on plan costs. However, it believes that provisions in its contracts with the managed care plans mitigate this. According to Health Services, the managed care plans are required to present a full and accurate report of their expenses to Health Services and to develop and implement antifraud procedures to reduce their exposure and, by extension, the State’s exposure to overstated costs. Although expense reports and antifraud procedures may provide Health Services some level of assurance, without an estimate of improper payments, 5500 California State Auditor Report 2003-112 California State Auditor Report 2003-112 5511 Health Services cannot monitor the level of improper payments made by its managed care plans and thus cannot measure the effect on the capitation rates it pays. RECOMMENDATIONS To improve the processing of provider applications, Health Services should do the following: • Complete its plan and related policies and procedures to process all applications or send appropriate notifications within 180 days. • Complete the workload analysis we recommended in our May 2002 audit report to assess the staffing needed to accommodate its application processing workload. • Improve its coordination of efforts between the enrollment branch and audits and investigations to ensure that applications, as well as any appropriate notices, are processed within the timelines specified in laws and regulations. To ensure that all provider applications are processed consistently within its divisions and branches and within other state departments, Health Services should ensure that all individual providers are subjected to the same screening process, regardless of which division within Health Services is responsible for initially processing the application. In addition, Health Services should work through the California Health and Human Services Agency to reach similar agreements with the other state departments approving Medi-Cal providers for participation in the program. To ensure that all providers enrolled in the Medi-Cal program continue to be eligible to participate, Health Services should do the following: • Develop a plan for reenrolling all providers on a continuing basis, as recommended in our May 2002 audit report. Such a plan should enable Health Services to ensure that all provider files meet federal and state laws and regulations requiring agreements and disclosure statements on file. • Enforce laws permitting the deactivation of providers with canceled licenses or incomplete disclosures. Similarly, it should enforce its legal responsibility to deactivate provider numbers, such as when there is a known change of ownership. 5500 California State Auditor Report 2003-112 California State Auditor Report 2003-112 5511 • Establish agreements with state professional licensing boards so that any changes in license status can be communicated to the enrollment branch for prompt updating of the Provider Master File. To maximize the effectiveness of the pre-checkwrite process, Health Services should consider expanding the number of suspicious providers it subjects to this process, prioritize field office reviews to focus on those claims or providers with the highest risk of abuse and fraud, and use the clean claim laws to suspend payments for suspicious claims undergoing field office review until it determines the legitimacy of the claim. To promote an effective referral process for cases of suspected provider fraud, Health Services should do the following: • Complete its negotiations for a current agreement with Justice as required by law. The agreement should clearly communicate each agency’s respective roles and responsibilities to coordinate their efforts, provide definitions of what a preliminary investigation entails and when a case of suspected provider fraud would be considered ready for referral to Justice. • Promptly refer all cases of suspected provider fraud to Justice, as required by law. To provide an effective feedback process for strengthening its antifraud efforts, Health Services should consider working through the California Health and Human Services Agency to establish and maintain an antifraud clearinghouse with staff dedicated to documenting and tracking information about current statewide fraud issues, proposed solutions, and ongoing projects, including assigning an individual or team with the responsibility and corresponding authority to follow up and promptly act on recommendations to strengthen Medi-Cal fraud control weaknesses. To improve its antifraud efforts in the managed care system, Health Services should do the following: • Work with its external quality review organization to determine what additional measures are needed to obtain individual scores for managed care plans in the areas of getting needed care and getting that care promptly. 5522 California State Auditor Report 2003-112 California State Auditor Report 2003-112 5533 • Complete its assessment on how it can use encounter data from the managed care plans to monitor plan performance and identify areas where it should conduct more focused studies to investigate potential plan deficiencies. • Consider requiring each managed care plan to estimate the level of improper payments within its Medi-Cal expenditure data. To ensure it promotes an effective provider fraud investigation and prosecution process, Justice should complete its negotiations for a current agreement with Health Services, as required by law. The agreement should clearly communicate each agency’s respective roles and responsibilities to coordinate their efforts, provide definitions of what a preliminary investigation entails, and when a case of suspected provider fraud would be considered ready for referral to Justice. To ensure that Health Services and Justice promptly complete their negotiations for a current agreement that would assist both in communicating and coordinating their respective roles and responsibilities for investigating, referring, and prosecuting cases of suspected Medi-Cal provider fraud, the Legislature may wish to require both agencies to report the status of the required agreement during budget hearings. We conducted this review under the authority vested in the California State Auditor by Section 8543 et seq. of the California Government Code and according to generally accepted government auditing standards. We limited our review to those areas specified in the audit scope section of this report. Respectfully submitted, ELAINE M. HOWLE State Auditor Date: December 22, 2003 Staff: Nancy C. Woodward, CPA, Audit Principal Robert C. Cabral, CPA, CIA, CISA Nasir Ahmadi, CPA Ken Louie Alysha M. Loumakis Katrina Williams 5522 California State Auditor Report 2003-112 California State Auditor Report 2003-112 5533 Blank page inserted for reproduction purposes only. 5544 California State Auditor Report 2003-112 California State Auditor Report 2003-112 5555 APPENDIX A The Centers for Medicare and Medicaid Services Payment Accuracy Measurement Project At the urging of Congress, the General Accounting Office, the Office of Management and Budget, and others, the U.S. Health and Human Services’ Centers for Medicare and Medicaid Services (CMS) embarked on a project to establish a method to measure the accuracy of Medicaid payments. Building upon earlier state-specific Medicaid studies by Illinois, Texas, and Kansas, as well as the annual claims review of the Medicare program conducted by the Office of Inspector General, CMS established a work group to help develop a Medicaid payment accuracy study. Essentially, CMS believes that measuring payment accuracy will enable the government to identify the extent of problems in the Medicaid payment system, study the causes of those problems, and develop methods to strengthen the internal controls in those problem areas. In July 2001, CMS formally solicited states to participate in the first year of the project. Before the first year of the Medicaid Payment Accuracy Measurement (PAM) Project, only three states had attempted to estimate payment accuracy for the Medicaid program at the state level, and no model had been developed to estimate payment accuracy at the national level. CMS required states to participate as part of the demonstration project team, and each received reimbursement for 100 percent of the total first year PAM Project costs. The purpose of the demonstration project is to develop methods to measure the accuracy of state Medicaid payments, to compare payment accuracy rates among states, and to estimate payment accuracy nationally. CMS defines payment accuracy as the ratio of the dollar value of payments paid accurately to the dollar value of total payments made. The basic steps of payment accuracy measurement consist of drawing a random sample of claims from the universe of paid Medicaid claims in the state, reviewing and auditing them to determine the validity of payments made, and computing an accuracy rate based on the sample results. In December 2002, CMS published Medicaid Payment Accuracy Measurement Project: Year 1 Pilot Results and Assessment. As of mid-December 2002, CMS had received Year 1 final reports from 5544 California State Auditor Report 2003-112 California State Auditor Report 2003-112 5555 only five of the nine pilot states. Another two states submitted preliminary reports, and the final two states experienced significant delays and did not plan to complete their Year 1 projects until June 2003. The individual state payment accuracy rates are displayed in Table A.1. According to CMS, when interpreting these figures it is important to remember that states could choose how claims were sampled, what claims were included in the study, how they were stratified, and how they were reviewed for errors. In addition, CMS warned that although this variability was useful in identifying best practices for CMS’s Year 2 PAM model, it also means that the differences in Year 1 payment accuracy rates must be interpreted with caution. TABLE A.1 Summary of State Payment Accuracy Rates for the Centers for Medicare and Medicaid Services’ Year 1 Payment Accuracy Measurement Project Payment Accuracy Error Sample State Rate Rate Size Sampling Approach Verification of Services* Louisiana 97.8% 2.2% 600 Stratified, random sample of No. denied and paid claims. Mississippi 92.8 7.2 3,559 All claims paid for a random Yes, telephone interviews with sample of 370 beneficiaries. beneficiaries. North Carolina 99.7 0.3 300 Stratified, random sample of paid Yes, interviewed only a subset claims based on dollar range. of beneficiaries due to resource constraints. North Dakota 93.9 6.1 403 Weighted sample of claims, No. with 50 percent based on claims volume and 50 percent on expenditures. Texas 86.5 13.5 2,122 Stratified, random sample of Yes, telephone interviews with 800 beneficiaries. beneficiaries. Washington 98.4 1.6 500 Stratified, random sample of Yes, telephone interviews with claims based on seven service beneficiaries. categories. Wyoming 97.7 2.3 600 Stratified, random sample of Yes, interviewed only a subset 600 claims from the sample of beneficiaries due to resource period. constraints. Source: Centers for Medicare and Medicaid Services’ December 2002 Medicaid Payment Accuracy Measurement Project: Year 1 Pilot Results and Assessment. *States that interviewed beneficiaries to verify services did not use the interviews to discount or establish the validity of any claims reviewed and simply considered them as supplementary information. 5566 California State Auditor Report 2003-112 California State Auditor Report 2003-112 5577 Based on the results of the Year 1 work, CMS developed a model approach to be tested in Year 2. The goals of the Year 2 demonstration project team were to pilot-test the CMS PAM model in at least 10 states, pilot-test innovative alternative methodologies in up to five states, pilot-test optional strategies and practices that will improve the PAM Project, and help CMS effectively identify and resolve the various impediments and challenges to implementing methodologies for measuring Medicaid payment accuracy at state and national levels. For the second year of the PAM Project, CMS awarded grants to 12 states to test the CMS PAM model in their respective Medicaid programs for the 2002–03 federal fiscal year. Notably, eight of these 12 states also participated in the first year of the project. CMS also modified the PAM model, to comply with the requirements of the Improper Payments Information Act of 2002, by including improper payments attributable to underpayments and payments made on behalf of ineligible beneficiaries. The estimate of improper payments will be the gross total of both overpayments and underpayments. In addition, independent verification of eligibility will be incorporated into the model through case reviews. The states participating in the project selected a random subsample of cases from the sample of paid claims or line items and reviewed the cases to verify that the beneficiary was eligible for program services on the date of service or most recent determination. We were not able to review the Year 2 project results because CMS does not expect to publish the results until January 2004. The purpose of the third year is to further refine and pilot-test the CMS PAM model. In the third year of the PAM Project, CMS awarded grants to 27 states to test the model during the 2003–04 federal fiscal year. To accommodate the diversity among states, provide maximum flexibility, and expand participation, CMS is allowing states to participate in any or all aspects of the project that are relevant to the state. Therefore, states may choose to pilot-test the model in either their Medicaid or State Children’s Health Insurance programs, or in both programs. Furthermore, within the Medicaid program, states may choose to test the model in the fee-for-service, managed care, or both components of their program. CMS intends to produce the final specifications for the CMS PAM model during the third year of the pilot project and expects to implement the model nationwide thereafter. As a result, CMS is requiring third-year participants to adhere to the required procedures and guidelines as detailed 5566 California State Auditor Report 2003-112 California State Auditor Report 2003-112 5577 in the model. As we discussed in Chapter 1, the Department of Health Services submitted a proposal to participate in this third year of the PAM Project. 5588 California State Auditor Report 2003-112 California State Auditor Report 2003-112 5599 APPENDIX B Status of the Department of Health Services’ Implementation of the May 2002 Audit Recommendations to Improve the Provider Enrollment Process In our May 2002 audit report titled Department of Health Services: It Needs to Significantly Improve Its Management of the Medi-Cal Provider Enrollment Process, Report 2001-129, we made a variety of recommendations to the Department of Health Services (Health Services) to improve its provider enrollment process for California’s Medical Assistance Program, which is known as Medi-Cal. We found that the Provider Enrollment Branch (enrollment branch) was not effectively using its resources to process provider applications, nor was it effectively coordinating its efforts with Health Services’ audits and investigations, which conducts further reviews of some providers applying to enroll in the program. Additionally, the enrollment branch did not ensure that certain enrolled providers had current and completed disclosure statements on file, as required by federal regulations. We recommended that the enrollment branch use its Provider Enrollment Tracking System (PETS) more effectively; that it create strategies to ensure that all providers have current applications, disclosure statements, and agreements on file; and that applications referred to audits and investigations be tracked. Although the enrollment branch has implemented some of our recommendations pertaining to the use of PETS and improving effectiveness, it has not fully implemented 10 of the 12 recommendations we reviewed. As Table B.1 on the following pages illustrates, the enrollment branch implemented the recommendation to develop a strategic plan; however, its implementation of most of the other recommendations dealing with its management of the provider enrollment process are incomplete or partially implemented at best. For example, the enrollment branch has not fully implemented our recommendation to ensure that all notifications are sent to providers at proper intervals and that applications are reviewed within regulatory time frames. This becomes even more important as new legislation, effective January 1, 2004, may 5588 California State Auditor Report 2003-112 California State Auditor Report 2003-112 5599 require the enrollment branch to grant applicants provisional provider status in the Medi-Cal program if it does not meet certain application review deadlines. Additionally, the enrollment branch has not fully implemented our recommendation to develop a plan for reenrolling all provider types to ensure that it updates and reviews all provider applications, disclosures, and agreements. Chapter 2 of this report provides further discussion on the status of Health Services’ implementation of our audit recommendations and on how many of the conditions observed during the prior audit continue to exist more than a year later. TABLE B.1 Status of Health Services’ Implementation of Our May 2002 Audit Recommendations Recommendation Status of Implementation The enrollment branch should take these actions to improve its management of the Medi-Cal provider enrollment process: Use PETS more effectively to track how long an Partially implemented: The enrollment branch generates PETS application has been in a certain step of the enrollment reports twice a month that illustrate which applications are aging and process, making sure that notification is sent to the which applications it has referred to audits and investigations. applicant at proper intervals; modify PETS so it can PETS can generate reports tracking the application status of high- or track the status of high- or low-risk provider types and low-risk providers. However, the enrollment branch indicates that this determine whether the average processing times vary; recommendation is no longer relevant because it is combining the and use PETS to track applications it refers to audits high- and low-risk units. and investigations for on-site reviews. The branch also should identify all applications that, according to PETS, In addition, the enrollment branch does not currently track whether are still in progress, determine their actual status, and notifications are sent to applicants at the appropriate times. In fact, update PETS, if necessary. it acknowledges that it is not sending the notification that is required 120 days after the date it receives an application. New legislation, effective January 1, 2004, will make the sending and tracking of notifications by the enrollment branch particularly important because if notifications are not sent within 180 days, the applicant will be granted provisional provider status for up to 12 months. Review PETS-generated reports at least monthly and Partially implemented: PETS is used to report the status of perform analyses to determine whether staff are applications twice a month. Enrollment branch management admits, entering data accurately and consistently. Further, it however, that staff may still not enter the required or correct data. should fully use the capabilities of PETS for developing Further, the enrollment branch could not demonstrate its use of these reports on a variety of productivity indicators, reports for managing its work. including, for example, aging reports and reports showing the number of applications approved, denied, and in progress. 6600 California State Auditor Report 2003-112 California State Auditor Report 2003-112 6611 Recommendation Status of Implementation Work closely with audits and investigations to Partially implemented: The enrollment branch asserts that the clock monitor the status of its referrals to ensure that the stops once it refers applications to audits and investigations, per total review time for applications does not exceed California Code of Regulations, Title 22, Section 51000.50. regulatory requirements. Although the enrollment branch has increased communications with audits and investigations through monthly meetings, these meetings have not resulted in applications being processed within required time frames. Fiscal year 2002–03 applications that the enrollment branch referred to audits and investigations took on average two to seven months to be returned. The enrollment branch now enters referrals directly into the audits and investigations case-tracking system. Some enrollment branch staff are trained to access the case- tracking system, although more training in the use of the system is scheduled. According to audits and investigations, the enrollment branch can view the status of any application in the case-tracking system at any time. Periodically perform an analysis to justify its existing Partially implemented: According to the enrollment branch, risk assessments for high- and low-risk provider types. audits and investigations provides it with information on high- and Submit its analysis for department approval. Upon low-risk providers. Audits and investigations provided documentation approval of the analysis, issue a policy memo to staff. that demonstrates its formal process for identifying existing high-risk providers. Further, although we did not fully analyze its proposal, the enrollment branch provided us with its October 2003 proposal for revising its provider application processing, including its identification and processing of high-risk provider applications. Develop a written policy that clearly defines Partially implemented: The enrollment branch developed policies appropriate procedures for safeguarding the electronic and procedures, including addition and review processes, for the new spreadsheet it uses to verify certain information in the database it calls Gatekeeper. However, information from the electronic application package. Establish an adequate supervisory spreadsheet is still being converted to the Gatekeeper database. The review process for reviewing all changes made to the enrollment branch is still working on system problems. According to spreadsheet. Consider replacing the spreadsheet with the enrollment branch, due to a lack of resources and the need for the software capable of providing a transaction log to alert design of additional elements to the database, it does not expect the management to any changes. Gatekeeper database to be operational any time soon. Identify all physician providers who were enrolled Not implemented: The enrollment branch has not implemented between October 2000 and September 2001 and the recommendation. The enrollment branch does, however, review their disclosure statements in accordance review the disclosure statements included in new provider applications. with federal requirements. The branch should direct staff to continue to review disclosure statements for all providers. Complete current reenrollment efforts and consider Partially implemented: According to the enrollment branch, it began expanding these efforts to include all provider types to reenrolling pharmacies and physicians in February 2003. Audits and ensure provider integrity in the Medi-Cal program. investigations suggests providers to target for reenrollment. Although the enrollment branch indicates that its “ideal” goal is to reenroll all providers, it is currently targeting only high-risk providers identified by audits and investigations. Additionally, the enrollment branch has not established a long-term strategy for reenrolling all providers. The enrollment branch indicated that the budget proposal for fiscal year 2002–03 provided a strategy for the reenrollment of providers with a focus on those that are high risk. Develop a strategic plan to identify key responsibilities Implemented: The enrollment branch has developed a strategic and establish priorities. This plan should clearly plan that identifies key goals and objectives. These include, but describe how the organization would address its many are not limited to, ensuring that the most qualified and competent short- and long-term responsibilities, particularly those providers are enrolled and improving and streamlining the application that we observed it has not sufficiently accomplished. review process. However, the plan does not include milestones or the steps the enrollment branch will take to monitor its progress in implementing its goals. continued on next page 6600 California State Auditor Report 2003-112 California State Auditor Report 2003-112 6611 Recommendation Status of Implementation Conduct a study to determine how long it takes staff, Partially implemented: The enrollment branch conducted a workload on average, to process applications for the various analysis. However, the analysis does not specifically address staffing provider types. Using results from the study and or the resources needed to accommodate the enrollment branch accurate workload standards, the enrollment workload. Instead, the workload analysis recommends various work branch should assess whether it has the appropriate streamlining procedures to reduce its inventory and accelerate the staffing levels. application review process. To improve the effectiveness of the Medi-Cal provider enrollment process, Health Services should: Establish policies and procedures for the enrollment Not implemented: New legislation, effective January 1, 2004, will branch and audits and investigations to coordinate their supersede prior regulatory requirements. The enrollment branch will review processes to meet regulatory requirements. be required to notify all providers of the status of their applications within 180 days or risk having to automatically enroll them as provisional providers for 12 months. The new legislation continues to not specify a time frame in which cases have to be reviewed once an application is sent to audits and investigations. The burden, therefore, is on the enrollment branch to send the proper notifications to avoid enrolling providers whose applications have not completed the review process and to ensure that providers meet all requirements to participate in the Medi-Cal program. Ensure that audits and investigations implements its Implemented: Audits and investigations implemented its new case- new case-tracking system by late 2002. tracking system, and the enrollment branch is able to enter referrals directly into the system. Formalize its process for determining which provider Partially implemented: Meetings are held monthly between the types should be subject to increased scrutiny and enrollment branch and audits and investigations. Additionally, the when, based upon the most recent antifraud trend enrollment branch provided us with its October 2003 proposal to information available. For example, Health Services revise its processing of provider applications, including the processing should consider establishing a subgroup of its fraud of high-risk provider applications. However, we did not fully analyze and abuse steering committee to document the the enrollment branch proposal. decision-making process. The subgroup should meet periodically to decide whether modification to the provider enrollment process is necessary and can be accomplished without imposing undue delays in processing applications. 6622 California State Auditor Report 2003-112 California State Auditor Report 2003-112 6633 APPENDIX C The Department of Health Services’ Fraud Referrals and the Actions Taken by the California Department of Justice The Department of Health Services (Health Services) and the California Department of Justice (Justice) both receive complaints of Medi-Cal fraud from various sources, such as through the mail, the Internet, and their hotlines. Health Services is the State’s Medicaid agency, and Justice is certified as the State’s Medicaid fraud control unit. Federal regulations require Health Services to perform a preliminary investigation of complaints related to Medi-Cal fraud and refer the provider cases to Justice upon discovery of suspected fraud. Health Services forwards referrals to Justice by mail. It also prepares and sends a monthly log of the case referrals to Justice for Justice’s use in reconciling referred cases. Recently, Justice and Health Services agreed that Justice would confirm the receipt of case referrals via e-mail notice to Health Services. We discuss the detail of issues related to Health Services’ fraud referral process in Chapter 2 of this report. All referrals to Justice arrive in its support services unit (intake unit). The intake unit performs an initial screening of the referral, gathers additional background information, and assigns the case to the appropriate Justice field office. Within 30 days of the assignment to the Justice field office, a team consisting of an agent, auditor, and attorney conducts a case progress review to establish a plan for developing the case for possible prosecution. Case referrals to Justice can be awaiting assignment, undergoing an investigation, closed for various reasons such as lack of evidence, or result in the filing of a complaint with the court against the suspect provider. Justice provided us with performance statistics that detail the referrals it received and the actions it took during fiscal years 1999–2000 through 2002–03. Table C.1 on the following page presents Justice’s statistics, including referrals from Health Services and others. The other sources of referrals include private citizens, counties, local law enforcement, and other state agencies. The table also enumerates the actions taken by Justice—the complaints filed, convictions, acquittals, and restitution ordered. 6622 California State Auditor Report 2003-112 California State Auditor Report 2003-112 6633 TABLE C.1 Fraud Referrals Received and Actions Taken by Justice Fiscal Year Fiscal Year Fiscal Year Fiscal Year 1999–2000 2000–01 2001–02 2002–03 Referrals Received From Health Services 358 260 84 118 Other 373 192 223 258 Totals 731 452 307 376 Actions Taken* Complaints filed 122 149 117 121 Convictions 84 90 85 87 Acquittals 0 0 0 1 Restitution ordered (in millions) $27.4 $6.9 $10.0 $6.9 Source: California Department of Justice case-tracking system. Note: Justice’s statistics are as of October 2003. * Actions taken by Justice during each fiscal year do not necessarily relate to the referrals shown for the respective fiscal years. In addition, as of October 2003 Justice indicates that for fiscal years 1999–2000 through 2002–03 it had filed 15 civil complaints and recovered $36.3 million. 6644 California State Auditor Report 2003-112 California State Auditor Report 2003-112 6655 Agency’s comments provided as text only. Health and Human Services Agency 1600 Ninth Street, Room 460 Sacramento, CA 95814 December 4, 2003 Elaine M. Howle, State Auditor* Bureau of State Audits 555 Capitol Mall, Suite 300 Sacramento, CA 95814 Dear Ms. Howle: Thank you for forwarding a draft copy of the Bureau of State Audits’ report titled, “Department of Health Services: It Needs to Better Plan and Coordinate Its Medi-Cal Antifraud Activities.” I am forwarding to you the Department of Health Services’ (DHS) response to the review findings and understand that DHS has begun taking steps to address the issues raised in the Bureau’s report. The work and recommendations provided by the BSA to ensure the State has maximized Medi-Cal anti-fraud efforts is appreciated. The California Health and Human Services Agency will work with the DHS on implementation of the recommendations presented in your report. If you have any questions, please call Ms. Diana Ducay, Deputy Director, DHS Audits and Investigations, at 440-7550. Sincerely, (Signed by: Kimberly Belshé) Kimberly Belshé, Secretary Health and Human Services Agency 1600 Ninth Street, Room 460 Sacramento, CA 95814 Enclosure * California State Auditor’s comments appear on page 75. 6644 California State Auditor Report 2003-112 California State Auditor Report 2003-112 6655 Department of Health Services P.O. Box 942732, MS 0000 Sacramento, CA 94234-7320 Ms. S. Kimberly Belshé, Secretary Health and Human Services Agency 1600 Ninth Street, Room 460 Sacramento, Ca 95814 Dear Ms. Belshé: We appreciate the Bureau of State Audits (BSA) providing the California Department of Health Services (DHS) the opportunity to respond to its draft report entitled, “Department of Health Services: It Needs to Better Plan and Coordinate Its Medi-Cal Antifraud Activities.” The DHS continually strives to improve its operations, and the Medi-Cal antifraud program is a priority. The DHS appreciates BSA’s acknowledgement of our efforts to identify and prevent waste, fraud, and abuse, and ensure that funds are properly spent for legitimate services. The DHS appreciated working with BSA on this audit and agrees with the recommendations made in the draft report. The DHS intends to implement the recommendations as described in our response. The DHS is looking forward to working with the California Health and Human Services Agency to identify fraud, waste, and abuse issues and improving the effectiveness of the Medi-Cal antifraud program. If you have any questions, please call Ms. Diana L. Ducay, Deputy Director, Audits and Investigations at (916) 440-7550. Sincerely, (Signed by: Diana M. Bontá) Diana M. Bontá Director Enclosure 6666 California State Auditor Report 2003-112 California State Auditor Report 2003-112 6677 Department of Health Services Response to the Bureau of State Audit Report Department of Health Services: It Needs to Better Plan and Coordinate Its Medi-Cal Antifraud Activities Introduction Fraud, waste, and abuse in the Medi-Cal program harms everyone, including the citizens of California and the beneficiaries who obtain care from Medi-Cal. Fraud and abuse in the Medi-Cal program will not be tolerated. The Department of Health Services (DHS) is committed to continuing its development of an antifraud program that ensures the fiscal integrity of the program, while balancing the needs of the vast majority of the honest providers and the beneficiaries they serve. DHS appreciates the Bureau of State Audits’ (BSA) recognition of the Medi-Cal antifraud program accomplishments and confirmation that the proposed expansions are valid. As the BSA points out, there is more to be done. DHS takes the observations made by the BSA seriously and the recommendations made in the audit report will provide a direction for further improvements. The following are the DHS responses to the specific findings and recommendations: Recommendation 1: Health Services should develop a complete strategy to address the Medi-Cal fraud problem and guide its antifraud efforts. This should include adding the currently missing components of a model fraud control strategy, such as an annual assessment of the extent of fraud in the Medi-Cal program, an outline of the roles and responsibilities of and the coordination between Health Services and other entities, and a description of how Health Services will measure the performance of its antifraud efforts and evaluate whether adjustments are needed. The DHS agrees with the recommendations proposed in Chapter 1 of the BSA report. Developing a strategic antifraud program is both complex and fluid. Like the BSA, the DHS Audits and Investigations (A&I) has reviewed and evaluated the works of academics, as well as other governmental organizations in its efforts to design, develop, and implement an effective and efficient fraud control strategy. We believe that implementing best practices will enable the DHS to achieve its goals. The DHS’ 2003-2004 Finance Letter was crafted after reviewing many of the same sources cited in the BSA report. For example, Malcolm Sparrow’s 7 Characteristics of a Model Fraud Control Strategy, as outlined in License To Steal, was utilized to develop the antifraud strategic foundation. With the approval of the Finance Letter, the DHS is in the process of implementing the model fraud control strategies outlined by Professor Sparrow. Many of the elements are in the development phase. For example, included in the approved Finance Letter was funding and positions to perform an annual payment accuracy assessment. To save general funds, DHS requested and was awarded the, federally funded, Payment Accuracy Measurement (PAM) grant from the Center for Medicare and Medicaid Services (CMS) in November 2003. The award of the grant represents the first step in the process for evaluating and measuring payment accuracy, as well as, some components of fraud and or abuse. After completion of the PAM study, DHS will develop its plans for the annual payment accuracy study. Both the PAM study and the on-going annual studies will aid program managers in allocating resources as well as evaluating fraud deterrence and detection efforts. 6666 California State Auditor Report 2003-112 California State Auditor Report 2003-112 6677 The DHS agrees that further refinement and documentation of the roles, responsibilities both within DHS and with our external fraud control partners will help develop the needed coordination for achieving success. DHS will work internally to document the roles and responsibilities of the various programs participating in antifraud efforts. DHS will also work with the Health and Human Services Agency (Agency) on improving the coordination of antifraud activities with other Departments under its authority. Recommendation 2: To ensure that it will have the information it needs to determine whether it is investing an appropriate level of resources to combat fraud in the Medi-Cal program, Health Services should: a. Establish an appropriate claim review step, such as verifying with beneficiaries the actual services rendered, to allow it to estimate the amount of fraud in the Medi-Cal program as part of its Payment Accuracy Measurement study. The DHS agrees with the recommendation. DHS is in the planning stages of the PAM project. As discussed in the PAM grant, submitted by the Department, it intends to adhere to Generally Accepted Auditing Standards. As such, DHS will ensure that there is an appropriate claim review step to verify with the beneficiary that actual services were rendered. b. Ensure that the benchmark developed by the PAM model is re-assessed by annually monitoring and updating its measurement methodologies. The DHS agrees with the recommendation. As stated in the response to Recommendation 1, DHS requested and received the funding and staffing in FY 2003/04 for an annual payment accuracy study. The plan is to re-assess monitoring and measurement methodologies annually. Recommendation 3: To allocate available resources to the most cost-effective antifraud efforts, Health Services should perform cost-benefit analyses that measure the effect its antifraud activities have on reducing fraud. Additionally, it should continuously monitor the performance of these activities to ensure that they remain cost-effective. The DHS agrees that cost-benefit analysis should be performed relative to each antifraud proposal. As mentioned in the BSA report, A&I research staff performed a pre and post evaluation of the Beneficiary Identification Card project that enabled A&I to evaluate the effectiveness of its efforts. Consistent with this process, A&I intends to continue to expand its efforts relative to cost-benefit analysis. Through the use of enhanced data analysis software and relationships with contractors such as Medstat, A&I will develop a standard cost benefit analysis methodology for each antifraud proposal. 6688 California State Auditor Report 2003-112 California State Auditor Report 2003-112 6699 Recommendation 4: To improve the processing of provider applications, Health Services should: a. Complete its plan and related policies and procedures to process all applications or send appropriate notifications within 180 days. DHS agrees with the recommendation. Processes and procedures need to be designed to keep as many fraudulent providers from entering the program as possible. Upfront reviews are necessary to avoid an increase in fraud and costs to the Medi-Cal program. The vast majority of providers are legitimate, and we are working to balance the need to be able to more expeditiously enroll legitimate providers into the Medi-Cal program with the need to keep out providers who want to defraud the program. We believe that the priorities developed, will streamline application processing time with minimal increase in risk of enrolling providers intent on defrauding the program. While these actions will improve processing, the passage of Senate Bill (SB) 857 requires that applications be either approved, returned as incomplete, referred for secondary reviews, denied or granted provisional provider status on the 181st day. It was not anticipated that DHS would be able to process all applications in 180 days and that there would be providers that would automatically be granted provisional provider status. To a large extent, the DHS’s ability to process applications within 180 days is a function of how many applications we receive and how many staff we have processing applications. With the passage of SB 857, Provider Enrollment Branch (PEB), within the Payment System Division (PSD) has made considerable changes to the existing procedures in the PEB in order to more efficiently process incoming provider applications. Under the new procedures the majority of applications (those determined to have a lower risk of fraud) are reviewed using a streamlined process. This gives PEB more time to fully scrutinize those applications that are associated with a higher risk of fraud. The DHS’s current review protocol, along with priority setting, elimination of certain steps, and streamlined processing of certain applications will allow PEB to better meet the legislatively-mandated processing requirements of SB 857, and allow PEB to better manage the incoming workload. A letter acknowledging receipt of the provider application has been created and is automatically generated to all providers within 30 days of receipt of their application. Additionally, Pharmacy and Durable Medical Equipment provider application prescreening has been implemented to notify applicants that they are subject to current moratoriums. Applications are prescreened to identify critical components that may be missing that will delay the processing. Applicants are notified immediately that those necessary components to a complete application package must be addressed before the Department is able to accept the application package for processing. A work group has been created, which meets on a weekly basis to establish and implement a complete work plan to fit within the parameters of SB 857. The work plan will include notification guidelines and template letters, and in so doing conform to the notification guidelines within regulations (T22, CCR 51000.50). Specific tasks have been assigned throughout PEB, and are being developed to meet the deadline of December 31, 2003. Included in these tasks are significant system changes that will monitor and track the applications received by PEB. “Ticklers” will be implemented to alert staff of critical dates that are approaching to ensure that all requirements are met. 6688 California State Auditor Report 2003-112 California State Auditor Report 2003-112 6699 b. Complete the workload analysis we recommended in our May 2002 audit report to assess the staffing needed to accommodate its application processing workload. The DHS agrees with this recommendation. An internal workload study was initially started in November 2002 and completed in February 2003. The final version of the workload study was submitted and presented to management in March 2003. DHS will evaluate what has been completed to date and finalize the analysis as recommended. c. Improve its coordination of efforts between the enrollment branch and audits and investigations to ensure that applications, as well as any appropriate notices, are processed within the timelines specified in laws and regulations. The DHS agrees with this recommendation. With the addition of new staff in the Fiscal Year 2002/03 and Fiscal Year 2003/04 budgets to enhance antifraud efforts and address the re-enrollment of all provider types, PEB and Audits and Investigations (A&I) began to develop closer working relationships because of increasing and interrelated workload. PEB and A&I developed a workgroup consisting of staff and managers to address all provider enrollment issues and concerns on a monthly basis, including the process of tracking and referring provider applications for secondary review. Additionally, PEB developed a high-level plan and close working relationship with A&I to identify pharmacies and physicians earmarked for the first phase of re-enrollment. To date, 1,400 providers are going through the re- enrollment process. In August 2002, A&I implemented a new web-based case tracking system which allows PEB staff to enter and track referrals to A&I. Prior to implementation of the new database, PEB and A&I did not have a common tracking system and it was difficult to locate case files or check a referral status. PEB staff relied on telephone inquires to A&I to monitor referral status. PEB continues to work with A&I to reconcile referrals made prior to the implementation of the new case tracking system with the referrals entered in Provider Enrollment Tracking System (PETS) to ensure an accurate accounting of information. A&I case files originate when PEB enters new referrals directly into A&I’s new tracking system. At the request of PEB, A&I has added a data field to the A&I tracking system to identify the document number assigned to the application by PETS. The new data field allows PEB staff to easily monitor the status of the onsite referral. Additionally, PEB has created a PETS data system management report that shows all cases referred, including cases more than 120 days old that is shared with A&I on a bi-monthly basis. The report allows PEB and A&I to focus on older cases and ensure regulatory timelines are met when possible. All PEB staff has been trained in the use of the A&I tracking system and have direct access to check the status of pending referrals. Also, to ensure that critical issues are addressed timely, the senior management of A&I and PSD meet on a monthly basis. 7700 California State Auditor Report 2003-112 California State Auditor Report 2003-112 7711 Recommendation 5: To ensure that all provider applications are processed consistently within its divisions and branches and within other state departments, Health Services should ensure that all individual providers are subjected to the same screening process, regardless of which division within Health Services is responsible for initially processing the application. In addition, Health Services should work through the Health and Human Services Agency to reach similar agreements with the other state departments approving Medi-Cal providers for participation in the program. The DHS agrees with this recommendation. Payment Systems Division will participate and coordinate with the programs within DHS, such as Licensing and Certification, as well as, other Departments, programs, entities that perform similar enrollment functions , to review existing enrollment processes and share best practices, with the end result being that all enrollment processes use consistent processing procedures. Recommendation 6: To ensure that all providers enrolled in the Medi-Cal program continue to be eligible to participate, Health services should: a. Develop a plan for re-enrolling all providers on a continuing basis, as recommended in our May 2002 audit report. Such a plan should enable Health Services to ensure that all provider files meet federal and state laws and regulations requiring agreements and disclosure statements on file. DHS agrees with this recommendation. To ensure that all providers enrolled in the Medi-Cal program continue to be eligible to participate, PEB is in the process of developing a plan for re-enrolling all providers. The plan will be based on existing staffing levels. PEB will continue to work with A&I to implement this plan. b. Enforce laws permitting the deactivation of providers with cancelled licenses or incomplete disclosures. Similarly, it should enforce its legal responsibility to deactivate provider numbers, such as when there is a change of ownership. The DHS agrees with this recommendation. PSD will work with Office of Legal Services (OLS) and A&I to improve its current processes and procedures to ensure that provider numbers are properly deactivated. c. Establish agreements with the state professional licensing boards so that any changes in license status can be communicated to the enrollment branch for prompt updating of the Provider Master File. PSD is currently working with professional licensing boards to obtain permit/licensing information on a timely basis and in a format that is readily usable to ensure providers without proper licensing credentials are not enrolled in the Medi-Cal program. 7700 California State Auditor Report 2003-112 California State Auditor Report 2003-112 7711 PSD will work to establish formal agreements with professional licensing boards that will allow PSD to obtain permits/licensing information in an automated format. The preferred design would be an electronic/automated format from licensing boards that allows the matching of licensing/permit and enrollment data on the Provider Master File. Recommendation 7: To maximize the effectiveness of the pre-checkwrite process, Health Services should consider expanding the number of providers it subjects to this process, prioritize field office reviews to focus on those claims of providers with the highest risk of abuse and fraud, and use the clean claim laws to suspend payments for suspicious claims undergoing field office review until a determination is made as to the legitimacy of the claim. The DHS agrees with this recommendation. A&I received additional staffing in the FY 2003/04 to expand the number and timeliness of pre- checkwrite reviews. A&I will also work with the legal and PSD staff to maximize the pre-checkwrite activities within the requirements of statute and regulation and develop program criteria to suspend specific claims and hold the checks until the review is complete. Recommendation 8: To promote an effective referral process for cases of suspected provider fraud, Health Services should: a. Complete its negotiations for a current agreement with Justice as required by law. The agreement should clearly communicate each agency’s respective roles and responsibilities to coordinate their efforts, provide definitions of what a preliminary investigation entails and when a case of suspected provider fraud would be considered ready for referral to Justice. DHS agrees with this recommendation and has been meeting with the California Department of Justice (DOJ) and has a draft agreement that will be finalized in the next few months. b. Promptly refer all cases of suspected provider fraud to Justice, as required by law. DHS agrees with the recommendation that prompt referrals should be made to the DOJ. However, we believe that the number of cases that BSA identified as being late or incomplete may be overstated. DHS was aware that there were cases that a timely referral had not been made to the DOJ, and this has already been clarified in our policy and procedures. Case referrals will also be addressed in the MOU. We would like to provide the following clarification relating to the 64 cases that the BSA identified 1 as late or incomplete: (1) seven of these cases were requests for assistance by, either the Federal Bureau of Investigation, Office of Inspector General, Los Angeles County Health Authority Law Enforcement Team, local District Attorney, CA Department of Insurance or Drug Enforcement Administration. When DHS provides assistance to other entities we use a “referral” as an attempt to keep DOJ informed that other agencies are looking into Medi-Cal Fraud issues. We will address 7722 California State Auditor Report 2003-112 California State Auditor Report 2003-112 7733 a better process in the revised MOU between DOJ and DHS; (2) three cases indicted by the U.S. Attorney’s office were not referred to DOJ until or near the time of the indictment. DHS changed its procedures in March 2003 to ensure prompt referral to DOJ when fraud is suspected. We will 2 also address prompt referrals in the new MOU; (3) 36 cases were generated by the Medi-Cal Fraud Prevention Bureau (MCFPB) and referred to both the DOJ and the FBI. The Department of Justice had previously agreed to a modified referral process for Medi-Cal Fraud Prevention Bureau cases, since these cases are conducted differently than the preliminary investigations conducted 3 by A&I. We will address the MCFPB in the new MOU to avoid miscommunication and (4) DHS has provided referral documentation deemed “unclear” for the three cases the BSA categorized as not received by DOJ. Recommendation 9: To provide an effective feedback process for strengthening its antifraud efforts, Health Services should consider working through the Health and Human Services Agency to establish and maintain an antifraud clearinghouse with staff dedicated to documenting and tracking information about current statewide fraud issues, proposed solutions, and ongoing projects, including assigning an individual or team with the responsibility and corresponding authority to follow up and promptly act on recommendations to strengthen Medi-Cal fraud control weaknesses. The DHS recognizes the contribution a clearinghouse can potentially make in improved coordination and effectiveness of antifraud activities. The Department will work with the new Health and Human Services Secretary to more fully explore this recommendation and different approaches for its implementation. Recommendation 10: To improve its antifraud efforts in the managed care system, Health Services should: a. Work with its external quality review organization to determine what additional measures are needed to obtain individual scores for managed care plans in the areas of getting needed care and getting that care promptly. DHS agrees with this recommendation. As a result of the Department’s newly procured External Quality Review Organization (EQRO) contract, pending final approval by the Department of General Services, our new EQRO vendor should be able to gather data in a manner that addresses the inadequacies found in the surveys referenced by the auditors. b. Complete its assessment on how it can use encounter data from the managed care plans to monitor plan performance and identify areas where it should conduct more focused studies to investigate potential plan deficiencies. DHS agrees with this recommendation. 7722 California State Auditor Report 2003-112 California State Auditor Report 2003-112 7733 As a result of ongoing efforts by Medi-Cal Managed Care Division (MMCD) staff in working with the plans to improve the quantity and quality of plan submitted data, we are currently assessing how we can use existing data to help target areas for focused monitoring. The MMCD staff is reviewing a variety of reports that can be developed with the data for use as one of several tools in our monitoring program, and that assessment should be completed in the coming months. c. Consider requiring each managed care plan to estimate the level of improper payments within its Medi-Cal expenditure data. The DHS agrees with this recommendation. The MMCD will consult with A & I, the DHS Office of Legal Services, and outside entities on the feasibility of implementing such requirements through appropriate contract language. 7744 California State Auditor Report 2003-112 California State Auditor Report 2003-112 7755 COMMENTS California State Auditor’s Comments on the Response From the Department of Health Services To provide clarity and perspective, we are commenting on the response to our audit from the Department of Health Services (Health Services). The numbers correspond with the numbers we have placed in Health Services’ response. 1 Health Services is mistaken. Only one of these seven cases was a request for assistance, and once this was brought to our attention, we subtracted it from the case counts we report on page 41. The remaining six, according to the documents Health Services provided to us, were not requests for assistance as Health Services asserts; therefore, we stand by our conclusion. 2 Subsequent to Health Services’ response to the draft report, we discovered that two of the cases in the Medi-Cal Fraud Prevention Bureau (fraud prevention bureau) category should have been included in the Investigations Branch category, resulting in a total of 34 incomplete referrals from the fraud prevention bureau. This change is reflected on page 41. 3 As we report on page 41, the documents Health Services provided to us do not clearly demonstrate its referral of these three cases to the California Department of Justice (Justice). These documents included Health Services’ September 2002 memorandum to Justice and an overnight mail slip addressed to Justice. However, the memorandum indicates these three cases are part of a group of six it was submitting to an assistant U.S. Attorney for the Eastern District of California and the mail slip does not itemize the contents of the overnight package. 7744 California State Auditor Report 2003-112 California State Auditor Report 2003-112 7755 Blank page inserted for reproduction purposes only. 7766 California State Auditor Report 2003-112 California State Auditor Report 2003-112 7777 Agency’s comments provided as text only. Office of the Attorney General 1300 I Street, Suite 1730 Sacramento, CA 95814 December 3, 2003 Via Hand Delivery and U.S. Mail Ms. Elaine M. Howle* State Auditor Bureau of State Audits 555 Capitol Mall, Suite 300 Sacramento, CA 95814 RE: BSA Audit 2003-112 Dear Ms. Howle: The Department of Justice (DOJ) has reviewed Chapter 2 and Appendix C of the Bureau of State Audit’s (BSA) draft report, entitled “Department of Health Services: It Needs to Better Plan and Coordinate Its Medi-Cal Fraud Activities.” On behalf of Attorney General Bill Lockyer, I am responding to your draft report as it applies to DOJ and its investigation and prosecution of Medi- Cal fraud referrals received from the Department of Health Services (DHS). Recommendation: • Health Services and Justice should complete negotiations of their updated agreement that could assist both in coordinating their respective roles and responsibilities for investigating, referring, and prosecuting cases of suspected Medi-Cal provider fraud. Response: DOJ concurs with this recommendation and has already initiated efforts with DHS to establish a memorandum of understanding (MOU) that will serve to strengthen the working partnership between our two agencies, thereby improving our effectiveness in combating Medi-Cal fraud. As discussed during the initial meeting with your office, federal regulations requiring the MOU had not been satisfied, and DOJ has long held that such an agreement is an essential component to a successful working relationship. Please note, however, that our desire to contemporize the outmoded 1988 agreement is not so much driven by legal compulsion as it is by the desire to have meaningful guidelines in place to direct the affairs of two agencies that must succeed in their collaboration if they are to achieve their joint mission of protecting the state’s $29 billion Medi-Cal program. * California State Auditor’s comment appears on page 81. 7766 California State Auditor Report 2003-112 California State Auditor Report 2003-112 7777 Ms. Elaine M. Howle December 3, 2003 Page Two I am pleased to report that both agencies are working as quickly as possible and in good faith. Barring unforseen circumstances, the MOU should be completed within the next 30 days. DOJ is confident that better coordination with DHS, coupled with our continual commitment to organizational, investigative, and prosecutorial innovation will allow us to build upon our recent successes, some of which include the following: • When comparing the productivity of DOJ’s Bureau of Medi-Cal Fraud and Elder Abuse (BMFEA) over the past five years with the previous five*: • Medi-Cal fraud criminal filings have improved by 194%; • Medi-Cal fraud convictions have improved by 132%; and • Restitution has increased by 396%. * See attachment for the BMFEA’s latest performance statistics (as of 12/02/03) • A recent BMFEA prosecution led to a 16 year sentence, the longest for Medi-Cal fraud in California history. • Of the 48 Medicaid Fraud Control Units (MFCU) throughout the United States, California’s MFCU (i.e., BMFEA) finished first in the number of criminal convictions produced for each of the past three years. • The United States Department of Health and Human Services, Office of the Inspector General recently recognized DOJ for having the nation’s premier state prosecutorial agency in the battle against Medicaid fraud. Thank you for this opportunity to comment on the BSA report. If you or your staff have any questions about this audit response, please contract Georgia Fong, Director, Office of Program Review and Audits, at (916) 324-8010. If you have any further program questions, please contact Collin Wong, Director, Bureau of Medi-Cal Fraud and Elder Abuse, at (916) 274-2994. Sincerely, (Signed by: Steve Coony) STEVE COONY Chief Deputy Attorney General Administration and Policy Attachment 7788 California State Auditor Report 2003-112 California State Auditor Report 2003-112 7799 1 BMFEA Performance Statistics FY 93/94 thru FY 02/03 Medi-Cal Fraud (Criminal Prosecutions)¹ 93/94 94/95 95/96 96/97 97/98 98/99 99/00 00/01 01/02 02/03 Referrals Received 306 450 266 785 984 818 731 454 306 407 Complaints Filed 41 29 37 40 54 82 124 149 116 121 Convictions 44 28 21 31 46 42 85 91 85 92 Acquittals 0 1 1 0 0 2 0 0 0 1 Restitution $852,286 $645,420 $2,725,777 $3,191,229 $5,657,088 $5,851,715 $27,393,473 $6,862,624 $9,908,366 $14,838,532 Medi-Cal Fraud (Civil Prosecutions) 93/94² 94/95² 95/96² 96/97 97/98 98/99 99/00 00/01 01/02 02/03 Referrals Received N/A N/A N/A 10 21 29 22 19 20 20 Complaints Filed N/A N/A N/A 1 0 4 11 1 0 4 Judgments N/A N/A N/A 1 1 2 9 2 1 1 Negotiated Settlements N/A N/A N/A 11 8 7 4 9 12 8 Dismissals N/A N/A N/A 0 0 4 0 1 1 0 Monetary Recovery N/A N/A N/A $7,986,607 $1,153,405 $826,887 $6,365,059 $2,870,110 $6,784,348 $20,264,828 Elder Abuse (Criminal and Civil Prosecutions) 93/94 94/95 95/96 96/97 97/98 98/99 99/00 00/01 01/02 02/03 Referrals Received 477 563 869 862 1088 1025 1384 1550 1940 2297 Criminal Complaints Filed 1 2 4 16 20 47 37³ 61 120 100 Criminal Convictions 2 3 0 8 22 25 23 40 77 71 Acquittals 0 0 0 1 0 1 1 2 1 1 Civil Complaints Filed 0 0 0 0 0 0 0 2ª 29 1 Civil Judgments 0 0 0 0 0 0 0 0 27 1 Civil Dismissals 0 0 0 0 0 0 0 0 0 0 Restitution & Penalties (Criminal and Civil) $0 $0 $0 $0 $3,508 $62,906 $14,093 $40,663 $457,927 $2,174,254 Operation Guardians Inspections º N/A N/A N/A N/A N/A N/A 1 68 80 67 ¹ These statistics do not include results stemming from the BMFEA’s aid to other law enforcement agencies. ² The Civil Prosecutions Unit did not exist prior to the 1996/97 Fiscal Year. ³ Includes State of California’s first-ever criminal prosecution of a skilled nursing facility (SNF) and its owner. ª Includes State of California’s first-ever civil lawsuit against a nusring home chain and its corporate owner. º Established April 2000. Highlights (when comparing the productivity of the first five years of the Lockyer administration with the five previous years): Medi-Cal Fraud Criminal filings have increased by 194% Convictions have increased by 132% Restitution has increased by 396% Elder Abuse Criminal filings have increased by 749% Convictions have increased by 574% Restitution has increased by 78,288% 7788 California State Auditor Report 2003-112 California State Auditor Report 2003-112 7799 Blank page inserted for reproduction purposes only. 8800 California State Auditor Report 2003-112 California State Auditor Report 2003-112 8811 COMMENT California State Auditor’s Comment on the Response From the California Department of Justice To provide clarity and perspective, we are commenting on the response to our audit from the California Department of Justice (Justice). The number corresponds with the number we have placed in Justice’s response. 1 These updated Justice statistics are as of December 2003 and do not agree with those presented in Table C.1 on page 64 because, as we state in the footnote, the statistics presented in Table C.1 are as of October 2003. 8800 California State Auditor Report 2003-112 California State Auditor Report 2003-112 8811 cc: Members of the Legislature Office of the Lieutenant Governor Milton Marks Commission on California State Government Organization and Economy Department of Finance Attorney General State Controller State Treasurer Legislative Analyst Senate Office of Research California Research Bureau Capitol Press 8822 California State Auditor Report 2003-112