On December 19, 2022, the U.S. Government Accountability Office (GAO) released a report titled, “Medicare: CMS Needs to Address Risks Posed by Provider Enrollment Waivers and Flexibilities” (GAO-23-105494). The report summarizes GAO’s analysis of the forty-seven (47) waivers and flexibilities that CMS issued to sustain Medicare’s provider workforce and ensure that Medicare beneficiaries had access to care during the COVID-19 pandemic. In its report, GAO makes several recommendations to CMS to address the risks posed by the waivers and flexibilities.

Under Section 1135 of the Social Security Act, the circumstances surrounding the COVID-19 pandemic in March 2020 triggered CMS’s temporary authority to waive or modify Medicare requirements in response to the COVID-19 pandemic to expedite application processing and maintain the provider workforce during the public health emergency. Under this authority, in March 2020, CMS waived or modified forty-seven (47) Medicare enrollment related requirements in response to COVID-19, such as waiving fingerprint-based criminal background checks for providers, postponing all revalidation actions, and postponing site visits at provider locations, among others. CMS also set up toll-free hotlines through the Medicare Administrative Contractors (MACs) to allow certain providers to enroll in Medicare and receive temporary billing privileges to expedite the enrollment process. CMS also amended Medicare regulations and sub-regulatory guidance throughout the COVID-19 pandemic under its non-emergency authorities. This resulted in some of the changes in Medicare requirements made during the COVID-19 pandemic applying temporarily and others permanently. According to GAO, about 222,000 Medicare enrollments occurred under the waivers and flexibilities between March 2020 and March 2022, of which 208 were revoked as of March 2022. Of these revocations, 83% involved durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) suppliers.

GAO’s report assesses CMS’s oversight activities to protect Medicare from fraud, waste, and abuse by mitigating the risks posed by provider enrollment waivers and flexibilities. According to GAO’s report, CMS has not fully addressed risks related to waiving fingerprint-based criminal background checks and postposing revalidations. GAO asserts that CMS has not developed a plan to evaluate the waivers and flexibilities to improve its response to future emergencies. According to the report, since ending the waiver of fingerprint-based criminal background checks, CMS has not conducted these checks on providers who had them waived, relying instead on monitoring of criminal records associated with providers based on the providers’ names rather than fingerprints. Additionally, GAO found that CMS may not complete all revalidations that were postponed via waiver within the established timeframes.

GAO’s report concludes that CMS has not planned an evaluation of the provider enrollment-related waivers and flexibilities. The report states that according to CMS’s Pandemic Plan, which provides a framework for CMS to respond to pandemics, the agency should conduct post-pandemic activities, including evaluations of its own performance to identify areas for improvement. According to GAO’s report, CMS has not planned any such evaluations, missing opportunities to improve its performance in areas such as preparing for revalidation backlogs and tracking and communicating waivers and flexibilities.

Based on its review of the implementation of the waivers and flexibilities by CMS during the COVID-19 pandemic and the associated risks of such waivers and flexibilities, GAO makes the following four recommendations to the Administrator of CMS:

• conduct fingerprint-based background checks for high-risk provider types who enrolled during the COVID-19 public health emergency, such as when CMS revalidates these providers’ information;
• develop policies and procedures to postpone rather than waive fingerprint-based criminal background checks during future emergencies;
• develop and implement a plan for conducting provider enrollment revalidations to ensure providers are revalidated prior to the end of their 3 to 5-year revalidation cycles, prioritizing moderate- and high-risk provider types; and
• evaluate waivers and flexibilities for provider enrollment, including related oversight challenges, and address any opportunities for improvement. This evaluation could consider targeting provider enrollment waivers and flexibilities to maintain requirements for provider types CMS considers high risk—including DMEPOS suppliers—and opportunities to track and communicate to program integrity contractors information about each waiver and flexibility providers enrolled under.

The GAO report includes a response from HHS, which concurs with all four recommendations and indicates its intention to explore ways to address these risks and assess the lessons learned from the waivers issued during the COVID-19 pandemic.

The GAO report is available here.