Medicare Provider Enrollment Eligibility Verification

Providers and suppliers enrolled in the Medicare program are required to submit a physical practice location address on the initial provider enrollment application, and are required to report any changes of address to Medicare within 30 days.

Recently the GAO examined the implementation of four screening procedures that Medicare Administrative Contractors (MACs) are required to evaluate all provider enrollment applications against, 1) the authenticity of the applicant’s practice address, 2) the validity of the licensure information that applicants provide, 3) that applicants are not listed as deceased in the Social Security Administrations full death master file, and 4) that applicants are not listed on the federal excluded parties lists. During the evaluation, GAO identified two areas of weakness that potentially expose the program to fraud: Verification of provider practice location address and physician licensure status.

Practice Location Address

In order to meet eligibility requirements, providers and suppliers must have an “operational” practice location. Federal regulations define “operational” as “having a qualified physical practice location, being open to the public for the purpose of providing healthcare—related services, being prepared to submit valid Medicare claims, and being properly staff, equipped, and stocked to furnish these items or services”. Addresses that would not be considered a valid practice location include vacant or invalid addresses, PO Boxes, certain types of Commercial Mail Receiving Agency (CMRA) such as a UPS store, and also virtual offices that are advertised as mailboxes, telephone answering services, and dedicated workspaces.

All applicants are required to list a physical practice location in the enrollment application regardless of their provider or supplier type. The typical outpatient clinic physician submits an address where he or she sees patients face to face. The table below describes other types of practice locations based on the type of provider or supplier.

Practice locations allowed based on the type of services rendered
Type of services provider or supplier renders	Practice location address allowed*
Practitioners rendering services only in patients’ homes	Home address if no office is available
Practitioners rending services only in retirement or assisted-living communities	Address of the communities where services are rendered
Mobile facilities and portable units (e.g., independent diagnostic testing facilities, portable X-ray suppliers, and mobile clinics)	Address where personnel are dispatched, where mobile or portable equipment is stored, and, when applicable, vehicles are parked when not in use
Medicare durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) suppliers	Address where suppliers furnish services or supplies

*Post office boxes and drop boxes are not acceptable except where providers are located in rural areas.

Address verification

Prior to March 2014, CMS required MACs to verify practice location addresses on each provider enrollment application using various techniques including internet search of sites like 411.com and USPS.com, calling the phone number listed on the application for the location, and using software built into the PECOS system called “Finalist”. Changes to those verifications were issued in March 2014 that required MACs to verify locations by contacting the person listed on the application to verify the address and to use the Finalist software that is integrated with PECOS. The additional verification methods used prior to March 2014 are not required unless the Finalist program cannot standardize the actual address.

Findings

GAO undertook a detailed evaluation of the address records in PECOS and found an estimated 105,234 records with potentially invalid practice location addresses. After detailed investigation of a stratified random sample of addresses, they determined that 22% of the addresses are potentially ineligible for Medicare providers; 38% were potentially valid; and 40% require additional investigation to determine validity. Of the 23,400 addresses determined to be ineligible 300 were CMRAs, 3,200 were vacant addresses, and 19,900 were invalid addresses.

CMRA addresses tend to be the largest source of ineligible addresses. These addresses use a suite number instead of a box number so it appears as a physical address. These addresses are typically from a UPS store or a virtual office.

In evaluating the current address verification procedures, GAO found providers who were revalidated in 2014 and the new verification rules were used to verify the address by calling the contact on the revalidation application. Providers with invalid addresses at a UPS store were found to be revalidated and their enrollment record approved. These and other situations reveal the potential for fraud based on inaccurate reporting of practice location addresses.

GAO recommended to HHS to strengthen the address verification requirements, specifically suggesting reverting to procedures used prior to March 2014. HHS declined to implement changes citing the additional hurdles would cause delays in provider enrollment. It did however agree to improve the address verification system in PECOS to flag CMRAs, vacant addresses, and invalid addresses.

Providers and Suppliers Requirement to Report Changes

Providers and suppliers enrolled in the Medicare program are required to report changes in address information to CMS within 30 days of the change. Providers and suppliers found to not have reported changes are out of compliance with Medicare regulations and could potentially have billing privileges revoked or previous payments recouped. Typically a MAC will advise a provider via letter if it finds an incorrect address record in its file and provide a timeline for submitting corrections. However, it is the responsibility of every provider to maintain their own records in accordance with all regulations.

Applicants Licensure Information

All physicians enrolling in the Medicare program are required to hold an active license in the state that their practice is located and report that license information on their enrollment application. Physicians are not, however, required to report licensures held or previously held in other states. In addition to reporting the state license information on the provider enrollment application, physicians are required to self-report any final adverse actions against them by any state licensing authority. An adverse action does not necessarily prohibit a provider from enrolling with Medicare, but must be evaluated during the application processing to determine eligibility.

CMS does not require MACs to independently verify licensure in states other than the one in which the provider is enrolling. Furthermore there is not independent review or verification of whether or not an applicant has any final adverse actions. A review of enrollment records identified 147 physicians with final adverse actions that would make them ineligible to enroll as a Medicare provider. These adverse actions were not reported by the provider and the enrolling MAC had no obligation to investigate for adverse actions.

GAO recommended to HHS that all healthcare providers be required to report all licenses held including those held in states other than the one enrolling. Furthermore, that monthly reporting provided to all MACs identify status changes and/or adverse actions for all licenses held by a provider. HHS, however, does not have the authority to require providers to report licenses for states other than the one in which the provider is enrolling. There is no current expectation to see changes to this area of the application process in the near future.