Summary: In fiscal year 2006, the Centers for Medicare & Medicaid Services (CMS) spent over $51 billion on the Medicare Advantage program, which serves as an alternative to the traditional fee-for-service program. Under the Medicare Advantage program, companies wishing to participate must annually submit bids (effective with contract year 2006) that identify the health services the company will provide to Medicare members and the estimated cost and revenue requirements for providing those services. For 2001 through 2005, the submissions were called Adjusted Community Rate (ACR) Proposals. The Balanced Budget Act (BBA) of 1997 requires CMS to annually audit the financial records supporting the submissions of at least one-third of participating organizations. BBA also requires that GAO monitor the audits. In this report, GAO examined (1) whether CMS met the one-third requirement for 2001 through 2006, (2) what information the ACR audits provided and how CMS used it, and (3) what information the bid audits provided and how CMS used it.
CMS did not document its process to determine whether it met the requirement for auditing ACRs for one-third of the participating Medicare Advantage organizations for contract years 2001-2005. CMS is planning to conduct other financial reviews of organizations to meet the audit requirement for contract year 2006, but by the end of our fieldwork in June 2007, CMS had not finalized its plans. Further, CMS does not plan to complete the financial reviews until almost 3 years after the bid submission date each contract year. This will affect its ability to address deficiencies in a timely manner. CMS did not consistently ensure that the audit process for contract years 2001-2005 provided information to assess the impact on beneficiaries. After contract year 2003 audits were completed, CMS took steps to determine such impact and identified about $34 million from those audits that beneficiaries could have received in additional benefits. However, in late May 2007, CMS officials told us they were planning to close out the audits without pursuing financial recoveries because the agency does not have the legal authority to do so. According to our assessment of the statutes, CMS had the authority to pursue financial recoveries, but its rights under contracts for 2001-2005 are limited because its implementing regulations did not require that each contract include provisions to inform organizations about the audits and about the steps that CMS would take to address identified deficiencies, including pursuit of financial recoveries. CMS audited contract year 2006 bids for 80 organizations, and 18 had a material finding that affected amounts in approved bids. CMS officials said that they will use the audit results to help improve bids in subsequent years but took limited action to follow-up on contract year 2006 findings. CMS will not pursue financial recoveries based on audit results because it maintains that it does not have the legal authority to do so. However, according to our assessment of the statutes, CMS has the authority to include terms in bid contracts that would allow it to pursue financial recoveries. CMS also has the authority to sanction organizations but has not identified instances where sanctions are warranted. We also noted that CMS did not document steps taken to mitigate conflicts of interest for the firms performing audits.
