Medicare Drug Plans Fraud & Abuse, Compliance Plans

Medicare Drug Plan Sponsors' Identification of Potential Fraud and Abuse (OEI-03-07-00380) Oversight of Prescription Drug Plan Sponsors' Compliance Plans (OEI-03-08-00230) Both the fraud and abuse report and the compliance plan report are part of OIG's continuing work focusing on oversight of the Part D program. Because prescription drug plan (PDP) sponsors are the first line of defense against Part D fraud and abuse, a crucial aspect of protecting Part D integrity is ensuring that PDP sponsors have comprehensive and effective compliance programs to detect and deter fraud, waste, and abuse. In two reviews, we examined PDP sponsors' identification of potential fraud and abuse incidents and CMS' oversight of PDP sponsors' compliance plans. We identified concerns related to both PDP sponsors' roles in protecting Part D integrity and CMS's limited oversight of PDP sponsors' implementation of Part D safeguards. We recommended several actions to strengthen the oversight of Part D integrity. In the fraud and abuse review, OIG found that 24 of 86 PDP sponsors did not identify any potential fraud and abuse incidents in the first 6 months of 2007. Seven PDP sponsors identified 90 percent of all incidents of potential fraud and abuse. Inappropriate billing was the most prevalent type of potential fraud and abuse incident identified. Also, not all of the sponsors that identified potential fraud and abuse incidents conducted inquiries, initiated corrective actions, or made referrals for further investigation. Therefore, OIG recommends that CMS: (1) review Part D plan sponsors to determine why certain sponsors have especially high or low volumes of potential fraud and abuse; (2) determine whether the Part D plan sponsors that identified potential fraud and abuse initiated inquiries and corrective actions as required by CMS, and made referrals for further investigation as recommended by CMS; (3) require Part D plan sponsors to maintain and routinely report information related to the results of sponsors' fraud and abuse programs; and (4) use this required information to help determine the effectiveness of sponsors' fraud and abuse programs. In response to our first recommendation, CMS described its intentions to follow up with its Medicare Drug Integrity Contractors, revise reporting requirements, and provide guidance to PDP sponsors on incident tracking. CMS also concurred with our second recommendation but did not indicate whether it concurred with our third or fourth recommendations. We reviewed CMS's oversight of PDP sponsors' compliance plans in followup to a 2006 OIG report and found that CMS conducted only one audit of a PDP sponsor's compliance plan in 2007. This was a focused audit; none of CMS's 17 routine audits included a compliance plan review. Although CMS originally planned to begin routine compliance plan audits in January 2007, as of early August 2008, CMS had not conducted any routine audits of PDP sponsors' compliance plans. Further, CMS instructed all PDP sponsors to complete a compliance plan self-assessment, but OIG found that CMS did not verify sponsors' responses. The self-assessment was based on requirements and recommendations in Chapter 9 of the "Prescription Drug Benefit Manual;" however, not all of the compliance plan requirements in Chapter 9 were included in the self-assessment. CMS followed up with 23 PDP sponsors that attested that they had not implemented one or more of the compliance plan requirements in the self-assessment. However, CMS did not request supporting documentation to confirm that these PDP sponsors corrected their compliance plans. OIG recommends that CMS conduct audits to verify that PDP sponsors' compliance plans meet requirements. Specifically, these audits should cover all compliance plan requirements contained in both regulations and Chapter 9 of the "Prescription Drug Benefit Manual." CMS may also want to assess implementation of its compliance plan recommendations. CMS concurred with our recommendation and stated that it will begin audits of Part D sponsors' compliance plans in the near future. These audits will consist of a limited number of desk audits; however, as more resources become available, CMS stated it would include more audits, onsite reviews, and other more comprehensive fraud prevention activities.