OIG to CMS: Stronger fraud efforts are needed for DMEPOS

WASHINGTON – A new Office of Inspector General (OIG) white paper warns that durable medical equipment, prosthetics, orthotics and supplies (DMEPOS) fraud continues to cost Medicare and taxpayers millions of dollars annually despite increased oversight efforts.

The paper, “The Nation’s Challenge to Combat Durable Medical Equipment Fraud in Medicare,” focuses on three elements that bad actors need to commit fraud: a Medicare-enrolled supplier, a physician order and an enrollee identification number.

Strengthening supplier enrollment

According to the OIG, fraud often begins when bad actors gain access to Medicare billing privileges. They may establish new DMEPOS businesses or purchase existing enrolled suppliers, often concealing ownership through straw owners.

The OIG said current safeguards, including site inspections, surety bonds and background checks, have not fully prevented fraud. Inspectors found that predictable site visits can allow suppliers to temporarily appear compliant, while unreported ownership changes remain difficult to detect. The report also notes that suppliers serving only Medicare Advantage beneficiaries are not required to enroll in traditional Medicare, creating a potential oversight gap.

To address these vulnerabilities, the OIG recommends:

• Stronger and more frequent inspections
• Increased scrutiny of newly enrolled suppliers
• Mandatory electronic enrollment applications
• Enhanced monitoring of ownership changes
• Reconsideration of surety bond requirements that have remained largely unchanged since 2009

The agency also suggests requiring all suppliers billing Medicare Advantage plans to undergo Medicare enrollment screening.

Addressing fraudulent physician orders

According to the OIG, fraudulent physician orders are another critical component of DMEPOS schemes. Inspectors identified several common tactics, including forged documentation, kickbacks paid to physicians, deceptive pre-filled orders and use of stolen provider identification numbers.

The OIG noted that physicians often do not know when their names are used on fraudulent claims. Meanwhile, fraudsters increasingly adapt their billing patterns to evade traditional claims analysis. The agency said the emergence of artificial intelligence presents another challenge, enabling the production of realistic but fraudulent documentation.

To combat these issues, the OIG recommends:

• Involving physicians more directly in fraud detection. Suggested approaches include electronic verification of orders before claims are paid and providing physicians with reports showing DMEPOS claims submitted under their names
• Expand the use of advanced analytics and AI tools
• Broaden medical review efforts beyond billing education
• Strengthen payment suspension practices when fraud is suspected
• Requiring Medicare Advantage organizations to submit ordering provider identification numbers, which it says are key data points for fraud detection but are often missing from encounter data

Protecting beneficiary information

According to the OIG, another vulnerability involves Medicare beneficiary identification numbers. The agency said fraudsters obtain these numbers through cyberattacks, purchases on illicit marketplaces, social engineering scams and misuse of Medicare lookup tools.

The OIG cited cases where stolen beneficiary information was used to bill Medicare for unnecessary or nonexistent equipment. It also raises concerns about online tools that allow authorized users to look up beneficiary identifiers, arguing that these systems can be exploited to harvest large quantities of enrollee data.

The OIG recommends:

• Either discontinue or significantly restrict access to lookup tools
• Work with social media companies to prevent the sale of Medicare information
• Expand restrictions on unsolicited marketing contacts beyond phone calls to include texts, emails and other digital communications
• Create more opportunities for beneficiaries to verify claims and explore entirely new methods of protecting Medicare identifiers, similar to fraud protections used in the credit card industry

CMS response

CMS largely agreed with the concerns raised in the report and highlighted actions already underway. These include the launch of its Fraud Defense Operations Center, or "Medicare War Room," which the agency says has suspended more than $2.1 billion in potentially fraudulent payments during its first year, including $1.9 billion related to DMEPOS billing.

The agency also pointed to a six-month enrollment moratorium for certain DMEPOS suppliers, increased use of artificial intelligence and data analytics, enhanced monitoring of beneficiary lookup tools and an ongoing requests for information seeking ideas for additional anti-fraud measures.