GAO Tells CMS to Tighten Up on Waivers

WASHINGTON (December 20, 2022)—Most of the providers who were enrolled in Medicare under COVID-19-related waivers and then had their enrollments revoked were durable medical equipment, prosthetics and orthotics (DMEPOS) suppliers, according to a new report from the Government Accountability Office (GAO).

As a result, the GAO recommend that the Centers for Medicare & Medicaid Services (CMS) institute fingerprint-based criminal background checks, increase the pace of revalidating provider eligibility, and evaluate opportunities for improvement in planning for future emergencies. CMS concurred with GAO’s recommendations.

The GAO looked at 47 waivers and flexibilities that CMS issued to sustain Medicare’s provider workforce capacity and beneficiary access to services during the pandemic. This included changes to provider enrollment screening, such as waiving about 7,300 fingerprint-based criminal background checks for provider types posing a high risk for fraud, waste, and abuse. It also included postponing site visits for high- and moderate-risk provider types, and postponing revalidating provider eligibility for all providers. In addition, CMS approved other waivers and flexibilities relating to clinicians’ scope of practice and training, particularly for rural areas.

GAO found that about 220,000 providers enrolled under waivers and flexibilities from March 2020 through March 2022. DME providers made up a small amount—just 4%. But they were 83% of the 208 enrollments CMS later revoked after finding they were ineligible.

“While this is not a large share of enrollments, even a small number of providers can cause significant financial harm if they commit fraud,” the GAO said.

CMS took steps to oversee providers who enrolled under waivers and flexibilities. Steps included monitoring providers’ enrollment and billing information for potential fraud; conducting investigations; and applying safeguards, such as referring potential fraud to law enforcement. However, CMS has not fully addressed risks from provider enrollment waivers and flexibilities:

• Fingerprint-based criminal background checks: When waiving these checks, CMS officials intended to perform them later for providers enrolled under the waiver. However, CMS has not yet performed these checks.
• Revalidating provider eligibility: Without increasing pace and prioritization, CMS may not complete all 237,000 postponed revalidations of providers’ eligibility before new revalidations are due, which occurs every 3 to 5 years. 

There may be ways to improve the future use of provider enrollment waivers and flexibilities, according to CMS officials and contractor representatives. For example, maintaining requirements for providers posing a high risk of fraud may be appropriate. However, CMS has not planned an evaluation of these waivers and flexibilities, although the agency committed to do so in its Pandemic Plan.

GAO reviewed relevant documents including CMS policies, such as waivers and flexibilities that it had issued. GAO analyzed Medicare provider enrollment data on the use of waivers and flexibilities from March 2020 through March 2022 and Medicare claims data from April 2020 through December 2021. GAO also interviewed officials from CMS and five Medicare contractors selected based on the geographic region where they operate, among other factors.