OIG: Flaws in CMS databases threatens integrity of Medicare

The inaccuracy, incompleteness, and inconsistency of provider data maintained by the Centers for Medicare & Medicaid Services (CMS) could put the integrity of the Medicare program at risk, according to findings from the Office of Inspector General (OIG).

The office with the Department of Health & Human Services (HHS) reviewed information of Medicare providers stored in the National Plan and Provider Enumeration System (NPPES) and Provider Enrollment, Chain and Ownership System (PECOS). As the OIG notes, providers are required to supply CMS with their National Provider Identifiers (NPIs), which are maintained in NPPES, in order to enroll in PECOS. Programs such as the EHR Incentive Programs require that eligible professionals and hospitals to have active NPIs to qualify and participate.

So what did OIG find?

First, nearly half of all records (48%) in NPPES contained inaccuracies with close to one-tenth (9%) of records being incomplete. The most common inaccuracies were found to be the provider’s or practice’s mailing address (34.1% and 33.3%, respectively). Based on a survey of 126 providers, most indicated that their mailing addresses were outdated (51; 53%), followed by those indicating that information was never correct at all (27; 28%) or only partially correct (18; 19%).

Second, PECOS was also plagued by inaccuracies, mostly in the area of address data with less than four percent of provider records missing data. Fifty-percent of Medicare-enrolled providers in PECOS had records that were inaccurate, with the most common inaccurate variable being their primary mailing address (46.8%). Similar to findings for NPPES, the largest number of the 126 providers surveyed reported that this information was outdated (60; 57%), followed by those reporting that their information was partially correct (25; 24%) and never once correct (21; 20%).

These findings in particular pose a significant threat to Medicare’s integrity. “Addresses, which are essential for contacting providers and identifying trends in fraud, waste, and abuse, were the source of most inaccuracies and inconsistencies,” writes the OIG.

Third, the OIG found that provider data between NPPES and PECOS were inaccurate for nearly all records, a whopping 97 percent:

Of the 987,266 records for providers listed in both NPPES and PECOS, 961,634 contained at least 1 variable that did not match. Only 11,682 records (1.2 percent of the mismatches) could potentially be attributed to the timelag between updates of the databases. Only 3 percent of records contained information that matched across all selected provider variables. More than half of the records were inconsistent between the databases for provider contact information, such as practice location address (89 percent), telephone number (59 percent), and mailing address (51 percent).

Fourth, the OIG is reporting that CMS fell short of properly verifying provider information in both NPPES and PECOS although the federal agency has processes in place to do so. “CMS had processes in place to verify the accuracy of provider data in NPPES and PECOS; however, the manner in which CMS implemented these processes impeded efforts to ensure that the databases contained accurate information,” states the report.

The OIG is recommending that CMS work closely with its Medicare Administrative Contractors to implement program integrity safeguards and require greater verification of NPPES enumeration data and PECOS enrollment data. Additionally, the federal agency should review and correct data for new and established records. CMS agreed with all the OIG’s recommendations.