CMS Needs to Address Risks Posed by Provider Enrollment Waivers and Flexibilities (GAO-23-105494)
Summary
A GAO report to congressional committees, GAO-23-105494, dated December 2022, on Medicare provider enrollment. It notes that Medicare is on GAO's high-risk list because of its size, complexity and vulnerability to improper payments, estimated at $47 billion in 2022. GAO identified 47 waivers and flexibilities that the Centers for Medicare & Medicaid Services (CMS) issued to sustain provider workforce capacity and beneficiary access during the COVID-19 pandemic. These included changes to provider enrollment screening, such as waiving fingerprint-based criminal background checks. Its title states that CMS needs to address the risks these waivers and flexibilities pose.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Full text
United States Government Accountability Office
Report to Congressional Committees
MEDICARE
December 2022
CMS Needs to
Address Risks Posed
by Provider
Enrollment Waivers
and Flexibilities
GAO-23-105494
December 2022
MEDICARE
CMS Needs to Address Risks Posed by Provider
Enrollment Waivers and Flexibilities
Highlights of GAO-23-105494, a report to
congressional committees
Why GAO Did This Study What GAO Found
Medicare is on GAO’s high-risk list due GAO identified 47 waivers and flexibilities that the Centers for Medicare &
to its size, complexity, and vulnerability Medicaid Services (CMS) issued to sustain Medicare’s provider workforce
to improper payments, estimated at capacity and beneficiary access to services during the COVID-19 pandemic. This
$47 billion in 2022. Medicare waivers included changes to provider enrollment screening, such as waiving about 7,300
and flexibilities during emergencies fingerprint-based criminal background checks for provider types posing a high
can help maintain access to Medicare risk for fraud, waste, and abuse. It also included postponing site visits for high-
services but also pose risks by and moderate-risk provider types, and postponing revalidating provider eligibility
removing program safeguards. for all providers. In addition, CMS approved other waivers and flexibilities relating
The CARES Act directs GAO to to clinicians’ scope of practice and training, particularly for rural areas.
monitor the federal COVID-19
GAO found that about 220,000 providers enrolled under waivers and flexibilities
pandemic response. This report (1)
describes Medicare waivers and
from March 2020 through March 2022. Suppliers of durable medical equipment,
flexibilities in response to the prosthetics, orthotics, and supplies—a provider type CMS considers to pose a
pandemic, (2) describes changes in moderate or high risk for fraud, waste, and abuse—represented a small share (4
Medicare provider enrollment after percent) of these enrollments. However, they were a large majority (83 percent)
implementing waivers and flexibilities, of the 208 enrollments CMS later revoked after finding they were ineligible. While
and (3) examines CMS’s oversight of this is not a large share of enrollments, even a small number of providers can
waivers and flexibilities. cause significant financial harm if they commit fraud.
GAO reviewed relevant documents Percentage of Medicare Provider Enrollments and Revoked Enrollments under Waivers and
including CMS policies, such as Flexibilities, March 2020 through March 2022
waivers and flexibilities that it had
issued. GAO analyzed Medicare
provider enrollment data on the use of
waivers and flexibilities from March
2020 through March 2022 and
Medicare claims data from April 2020
through December 2021. GAO also
interviewed officials from CMS and five
Medicare contractors selected based
on the geographic region where they
operate, among other factors. CMS took steps to oversee providers who enrolled under waivers and flexibilities.
Steps included monitoring providers’ enrollment and billing information for
What GAO Recommends potential fraud; conducting investigations; and applying safeguards, such as
GAO is making four recommendations referring potential fraud to law enforcement. However, CMS has not fully
to CMS including conducting addressed risks from provider enrollment waivers and flexibilities:
fingerprint-based criminal background • Fingerprint-based criminal background checks: When waiving these
checks, increasing the pace of
checks, CMS officials intended to perform them later for providers enrolled
revalidating provider eligibility, and
under the waiver. However, CMS has not yet performed these checks.
evaluating opportunities for
improvement in planning for future • Revalidating provider eligibility: Without increasing pace and prioritization,
emergencies. CMS concurred with CMS may not complete all 237,000 postponed revalidations of providers’
GAO’s recommendations. eligibility before new revalidations are due, which occurs every 3 to 5 years.
There may be ways to improve the future use of provider enrollment waivers and
flexibilities, according to CMS officials and contractor representatives. For
View GAO-23-105494. For more information,
example, maintaining requirements for providers posing a high risk of fraud may
contact Leslie V. Gordon at (202) 512-7114 or be appropriate. However, CMS has not planned an evaluation of these waivers
gordonlv@gao.gov. and flexibilities, although the agency committed to do so in its Pandemic Plan.
United States Government Accountability Office
Contents
Letter 1
Background 6
CMS Issued 47 Waivers and Flexibilities Related to Provider
Enrollment, Clinicians’ Scope of Practice, and Training 9
Waivers and Flexibilities Helped Increase Provider Enrollments,
Including High-Risk Enrollments That CMS Later Revoked 14
CMS Oversight Has Not Fully Addressed Risks Posed by Provider
Enrollment Waivers and Flexibilities 19
Conclusions 28
Recommendations 29
Agency Comments and Our Evaluation 30
Appendix I Summary of Medicare Waivers and Flexibilities
CMS Issued to Sustain Workforce Capacity 34
Appendix II Summary of Physicians and Other Clinicians Who
Enrolled in Medicare under Waivers and Flexibilities 38
Appendix III Comments from the Department of Health and Human Services 40
Appendix IV GAO Contact and Staff Acknowledgments 45
Tables
Table 1: Provider Risk Levels for Fraud, Waste, and Abuse as
Defined by CMS and Examples of Provider Types and
Provider Screening Activities 7
Table 2: Medicare Provider Enrollment Waivers or Flexibilities
Issued to Sustain Workforce Capacity during the COVID-
19 Public Health Emergency by CMS’s Risk Categories
for Fraud, Waste, and Abuse 10
Table 3: Medicare Scope-of-Practice, Training, and Other Waivers
and Flexibilities Issued to Sustain Workforce Capacity
during the COVID-19 Public Health Emergency 13
Page i GAO-23-105494 Medicare Provider Waivers Due to COVID-19
Table 4: Medicare Specialty Categories of Providers Who Enrolled
under Waivers and Flexibilities and Associated
Expenditures, April 2020 through December 2021 18
Table 5: Medicare Waivers and Flexibilities to Sustain Provider
Workforce Capacity during the COVID-19 Public Health
Emergency (PHE) Implemented from March 2020 through
December 2021 34
Table 6: Medicare Physician Enrollments by Specialty, March
2020 through March 2022 38
Table 7: Medicare Enrollment for Clinicians Other than Physicians
by Specialty, March 2020 through March 2022 39
Figures
Figure 1: Percentage of Provider Enrollments and Revoked
Enrollments under Waivers and Flexibilities, March 2020
through March 2022 16
Figure 2: Outcomes of CMS Monitoring of Newly Enrolled
Medicare Providers during the COVID-19 Public Health
Emergency, March 2020 through January 2022 21
Figure 3: New Durable Medical Equipment, Prosthetics, Orthotics,
and Supplies (DMEPOS) Supplier Medicare Enrollments
and Changes in Enrollment Requirements by Month,
January 2019 to February 2022 22
Abbreviations
CMS Centers for Medicare & Medicaid Services
DMEPOS Durable Medical Equipment, Prosthetics,
Orthotics, and Supplies
HHS Department of Health and Human Services
MAC Medicare Administrative Contractors
This is a work of the U.S. government and is not subject to copyright protection in the
United States. The published product may be reproduced and distributed in its entirety
without further permission from GAO. However, because this work may contain
copyrighted images or other material, permission from the copyright holder may be
necessary if you wish to reproduce this material separately.
Page ii GAO-23-105494 Medicare Provider Waivers Due to COVID-19
Letter
441 G St. N.W.
Washington, DC 20548
December 19, 2022
Congressional Committees
Responding to the COVID-19 pandemic, the Centers for Medicare &
Medicaid Services (CMS), the federal agency responsible for overseeing
Medicare and more than 2 million enrolled health care providers across
all types, issued dozens of waivers and other flexibilities to change
provider requirements. 1 CMS intended for these waivers and flexibilities
to make it easier for certain providers to enroll in Medicare in order to
sustain provider workforce capacity to meet beneficiaries’ health care
needs. 2 The COVID-19 pandemic increased beneficiaries’ health care
needs by disproportionately affecting seniors and other populations
served by Medicare who rely on the program to pay for health care
services. Specifically, by August 2022, individuals ages 65 and older
represented 75 percent of COVID-19 deaths, even though that age group
constituted about 17 percent of the U.S. population. 3
Medicare providers affected by CMS’s actions include physicians, nurse
practitioners, and suppliers of durable medical equipment, prosthetics,
orthotics, and supplies (DMEPOS) among others. CMS establishes the
Medicare requirements providers must meet, such as upfront enrollment
requirements, and ongoing requirements, such as annual training. 4 These
1CMS is an agency within the Department of Health and Human Services (HHS). Section
1135 of the Social Security Act (hereafter “Section 1135”) authorizes the Secretary of
Health and Human Services to temporarily waive or modify certain federal health care
requirements, including in the Medicare program, to increase access to medical services
when both a public health emergency and a disaster or emergency have been declared.
See 42 U.S.C. § 1320b-5. For purposes of this report, we collectively refer to Section 1135
waivers and other changes to requirements made in response to COVID-19 as “waivers
and flexibilities.”
2For purposes of this report, providers include physicians and other clinicians or health
care workers; DMEPOS suppliers; home health agencies; hospice organizations; and non-
institutional providers such as ambulances or other free-standing facilities, such as clinical
laboratories, unless otherwise specified.
3Centers for Disease Control and Prevention, “Demographic trends of COVID-19 cases
and deaths in the US reported to the CDC,” COVID Data Tracker (Aug. 29, 2022),
accessed August 29, 2022, https://covid.cdc.gov/covid-data-tracker/#demographics.
4In addition to federal requirements, providers are also generally subject to state laws and
regulations, such as those governing licensing and scope of practice.
Page 1 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
requirements serve as program safeguards that promote program
integrity by reducing risks of fraud and that help ensure patient safety.
GAO has designated Medicare a high-risk program, due in part to its size,
complexity, and vulnerability to improper payments, including fraud,
waste, and abuse. 5 Although the extent of fraud in Medicare is unknown,
given the large size of the program, even a small percentage of fraud
poses significant risks to the integrity of the program. In 2022, the
Medicare program will spend an estimated $940 billion on health care
services for 65 million beneficiaries, and estimated improper payments
reported for the program were $47 billion. 6 In May 2021, we testified that
careful monitoring and oversight is warranted to prevent potential fraud,
waste, and abuse that can arise from waivers and flexibilities that CMS
issued in response to the pandemic. 7
Given the importance of maintaining provider workforce capacity and
safeguarding the Medicare program, especially during public health
emergencies, you asked us to review waivers and flexibilities that CMS
issued to respond to COVID-19 and the effects of those waivers and
flexibilities. In addition, the CARES Act includes a provision for GAO to
report on its ongoing monitoring and oversight efforts related to the
COVID-19 pandemic. 8 In this report, we
1. describe the Medicare waivers and flexibilities CMS issued to sustain
provider workforce capacity in response to the COVID-19 pandemic;
2. describe changes in Medicare provider enrollment after the
implementation of waivers and flexibilities; and
3. examine CMS’s oversight of the waivers and flexibilities it issued.
5See GAO, High-Risk Series: Dedicated Leadership Needed to Address Limited Progress
in Most High-Risk Areas, GAO-21-119SP (Washington, D.C.: Mar. 2, 2021). Improper
payments are those that should not have been made or were made in an incorrect
amount, including overpayments and underpayments under statutory, contractual,
administrative, or other legally applicable requirements.
6While not all improper payments are the result of fraud, all payments made as a result of
fraudulent activities are considered to be improper payments. Improper payment
estimates are not intended to measure fraud in a particular program.
7GAO, Medicare and Medicaid: COVID-19 Program Flexibilities and Considerations for
Their Continuation, GAO-21-575T (Washington, D.C.: May 19, 2021).
8Pub. L. No. 116-136, § 19010(b), 134 Stat. 281, 580 (2020).
Page 2 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
To describe the Medicare waivers and flexibilities issued to sustain
provider workforce capacity, we reviewed CMS descriptions of Section
1135 waivers, CMS rulemaking from March 2020 through December
2021, and relevant guidance documents provided to us by CMS officials.
We identified Medicare waivers and flexibilities to sustain provider
workforce capacity, and confirmed the waivers and flexibilities we
identified with agency officials to ensure their accuracy and
completeness. We did not include waivers or flexibilities expanding the
use of telehealth, which we have addressed in a separate report, or
waivers or flexibilities that applied only to individual providers who
requested waivers or flexibilities based on their specific circumstances. 9
We interviewed CMS officials and reviewed CMS’s rulemaking and
assessments of waivers and flexibilities to identify the factors the agency
considered when making decisions to issue, end, or continue the waivers
and flexibilities beyond the end of the COVID-19 public health
emergency.
To describe Medicare provider enrollment after the implementation of
selected waivers and flexibilities, we analyzed agency documentation and
Medicare data on provider enrollment and Medicare fee-for-service
claims, and we interviewed CMS officials. We reviewed the Department of
Health and Human Services’ (HHS) Agency Financial Report for fiscal
years 2019 through 2021 to determine historical trends in the total
number of provider enrollments that were active, across all provider
types. 10 In addition, we analyzed CMS data on Medicare providers’
enrollments under waivers and flexibilities from March 2020, when initial
9GAO, Medicare Telehealth: Actions Needed to Strengthen Oversight and Help Providers
Educate Patients on Privacy and Security Risks, GAO-22-104454 (Washington, D.C.:
Sept. 26, 2022).
10A provider enrollment represents a single Medicare enrollment for a provider. It might not
represent a unique provider because a provider can have multiple enrollments. For
example, a provider may have one enrollment record for a practice in one state and
another enrollment record for a practice in another state.
Page 3 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
waivers and flexibilities were issued, through March 2022. 11 We analyzed
Medicare fee-for-service claims data to identify expenditures associated
with providers who enrolled under waivers and flexibilities. 12 We analyzed
claims data from April 2020, the month after initial waivers and flexibilities
were issued, through calendar year 2021, the most recent year of data
available at the time of our review. In addition, we analyzed changes in
the utilization of certain Medicare services or by certain Medicare
providers associated with certain provider scope-of-practice waivers and
flexibilities, selected based on the availability of relevant claims data to
identify trends. 13
We assessed the reliability of CMS data on Medicare providers who
enrolled in the program under waivers or flexibilities by comparing these
data with data on these provider enrollments in the Provider Enrollment,
Chain, and Ownership System. 14 Medicare claims data are used by
Medicare as a record of payments to health care providers and are
closely monitored by both CMS and the Medicare contractors that
process, review, and pay claims. On this basis, we determined that these
data were sufficiently reliable for the purposes of our report.
To examine CMS’s oversight of the types of waivers and flexibilities it
issued, we reviewed relevant agency documentation and interviewed
11Data on Medicare provider enrollments under waivers and flexibilities describe all
enrollments across all provider and supplier types that were new or were changed under
certain waivers and flexibilities. For example, these data include enrollments under
waivers of site visits for new enrollments or enrollments with new practice locations added.
They also include new enrollments under waivers of fingerprint-based criminal background
checks. These data do not include enrollments that only used waivers postponing provider
enrollment revalidation or certain flexibilities applied to provider enrollment processing that
had little effect on provider enrollment screening or claims payment. Not all provider
enrollments that were new or changed during the time period covered by these data
occurred under waivers and flexibilities.
12Specifically, we analyzed claims from CMS’s carrier claims and durable medical
equipment claims files.
13Providers’ scope of practice defines the range of activities that different types of
providers are permitted to perform. These activities can include which types of providers
can order tests, make diagnoses, perform procedures, and prescribe medications.
Selected waivers and flexibilities include allowing physician assistants, nurse practitioners,
and clinical nurse specialists to begin home health certifications and allowing certain
resident physicians to conduct more complex patient visits to evaluate and manage
conditions.
14CMS’s Provider Enrollment, Chain, and Ownership System is the agency’s centralized
database for Medicare enrollment information.
Page 4 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
CMS officials and CMS contractor representatives. Specifically, we
reviewed documentation of CMS’s policies and activities to conduct
oversight of Medicare provider enrollment, scope-of-practice, and other
waivers and flexibilities. To examine these activities, we interviewed
agency officials and representatives from selected Medicare
Administrative Contractors (MAC) and unified program integrity
contractors. 15 We selected three of the seven MACs and two of the three
program integrity contractors to interview based on geographic variation
and, in the case of MACs, variation in the types of providers they screen
to ensure the selection covered all provider types. In addition, we
reviewed CMS analyses of the number of Medicare providers who
enrolled in the program under waivers or flexibilities and CMS’s
monitoring of these providers. We assessed CMS’s oversight activities to
protect Medicare from fraud, waste, and abuse, and act on opportunities
to improve the agency’s pandemic response against its Pandemic Plan,
which provides a framework for CMS’s response to pandemics. 16 In
addition, we assessed the agency’s activities against the risk
assessment, information and communication, and monitoring components
of federal internal control standards, including the underlying principle that
management should identify, analyze, and respond to risks related to
achieving the defined objectives. 17
We conducted this performance audit from October 2021 to December
2022 in accordance with generally accepted government auditing
standards. Those standards require that we plan and perform the audit to
obtain sufficient, appropriate evidence to provide a reasonable basis for
our findings and conclusions based on our audit objectives. We believe
15Seven MACs conduct provider enrollment screening and reach decisions on providers’
applications for enrollment. One of these MACs also serves as the National Supplier
Clearinghouse, which screens and enrolls DMEPOS suppliers. For the purposes of this
report, MAC refers to both MACs and the National Supplier Clearinghouse unless
otherwise noted. Three unified program integrity contractors—referred to as program
integrity contractors for the purposes of this report—detect and investigate aberrant
provider behavior and potential fraud in Medicare.
16Department of Health and Human Services, Centers for Medicare & Medicaid Services,
Pandemic Plan, V. 3.1. Public Release (updated Jan. 11, 2021).
17GAO, Standards for Internal Control in the Federal Government, GAO-14-704G
(Washington, D.C.: Sept. 2014). Internal control is a process effected by an entity’s
oversight body, management, and other personnel that provides reasonable assurance
that the objectives of an entity will be achieved.
Page 5 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objectives.
Background
Medicare Provider Since 2011, CMS has used authorities granted by the Patient Protection
Screening and Enrollment and Affordable Care Act to screen new and certain existing providers to
determine if they are eligible to enroll, or remain enrolled, in and bill
Medicare for items or services provided to beneficiaries. 18 Enrollments
can be either new, updated (for example, an existing enrollment that
added a new practice location), or reactivated from an inactive
enrollment. Providers face different enrollment requirements depending
on the level of risk CMS has assigned to their provider type. CMS places
all provider types into one of three risk categories: limited, moderate, or
high.
CMS contracts with MACs to screen providers in all risk categories to
verify that they meet Medicare requirements before enrolling providers
and periodically after enrollment. For example, MACs are responsible for
screening all providers, including ensuring they have current federal or
state licenses or accreditation. For moderate- and high-risk provider
types, Medicare regulations additionally require an onsite review, known
as a site visit. 19 The site visit is to determine whether the reported practice
locations are operational, meet requirements, and are appropriate for
billed procedures. In addition, for high-risk provider types, all individuals
who maintain a 5 percent or greater interest in the provider are required
to undergo a fingerprint-based criminal background check to identify any
criminal convictions for which the individual may or must be excluded
from participation in Medicare. 20 For example, CMS may deny enrollment
of a prospective provider (or revoke enrollment of an enrolled provider)
with a felony conviction in the preceding 10 years that CMS has
determined to be detrimental to the program and its beneficiaries, such as
insurance fraud or assault. 21 (See table 1.)
18Pub. L. No. 111-148, § 6401(a), 124 Stat. 119, 747 (codified as amended at 42 U.S.C.
§ 1395cc(j)).
1942 C.F.R. §§ 424.518(b)(2)(ii) (moderate-risk), 424.518(c)(2)(i) (high-risk) (2022).
2042 C.F.R. § 424.518(d) (2022).
21See 42 C.F.R. §§ 424.530(a)(3) (denial), 424.535(a)(3) (revocation) (2022).
Page 6 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
Table 1: Provider Risk Levels for Fraud, Waste, and Abuse as Defined by CMS and Examples of Provider Types and Provider
Screening Activities
Risk level for fraud,
waste, and abuse Examples of provider types Examples of provider screening activities
Limited • Physician practitioners • Confirmation of practice location addresses
• Other clinicians, including nurse practitioners, • Licensure verifications
physician assistants, and clinical nurse specialists • Federal database checks to ensure providers
meet the enrollment criteria for their provider
type
Moderate • Hospice organizations • All screening activities for limited-risk provider
• Independent clinical laboratories types
• Home health agencies revalidating enrollmenta • Provider site visits to verify the accuracy of
enrollment information
• Suppliers of durable medical equipment, prosthetics,
orthotics, and supplies (DMEPOS) revalidating • Verification of required accreditation for
enrollmenta DMEPOS suppliersb
High • Prospective (newly enrolling) home health agencies • All screening activities for limited- and
• Prospective (newly enrolling) DMEPOS moderate-risk provider types
• Fingerprint-based criminal background checks
Source: GAO analysis of Centers for Medicare & Medicaid Services (CMS) guidance. | GAO-23-105494
Note: For purposes of this report, we use the term “providers” to include physicians and other
clinicians or health care workers; DMEPOS suppliers; home health agencies; hospice organizations;
and non-institutional providers such as ambulances or other free-standing facilities, such as clinical
laboratories, unless otherwise specified.
a
Most providers must revalidate their Medicare enrollment every 5 years, while DMEPOS suppliers
must do so every 3 years. See 42 C.F.R. §§ 424.515, 424.57(g) (2022).
b
Accreditation is generally required for all DMEPOS suppliers regardless of risk level. See 42 C.F.R. §
424.57(c)(22) (2022).
After enrolling in Medicare, providers must generally report changes to
their enrollment information and, by law, periodically resubmit enrollment
information for revalidation to maintain their billing privileges. 22 MACs use
the enrollment screening process to revalidate provider enrollment
information and ensure that provider enrollment information on file
remains complete and up-to-date. Most providers must complete this
revalidation process every 5 years, while DMEPOS suppliers must do so
every 3 years under CMS regulations. 23
Federal and State Scope In general, Medicare providers must meet both federal and state scope-
of Practice Requirements of-practice requirements. Federal laws and regulations specify the types
of providers who may furnish and bill for covered Medicare items and
services—such as ordering tests, performing procedures, and prescribing
22See 42 U.S.C. § 1395cc(j)(2)(D)(iv).
23See 42 C.F.R. §§ 424.515, 424.57(g) (2022).
Page 7 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
medications—and the level of supervision required. For example,
Medicare regulations address what services resident physicians, who are
still completing their graduate medical education, can provide to Medicare
beneficiaries and the type of supervision that is required from a teaching
physician.
In addition, states commonly regulate health care providers by granting
licenses to qualified providers. In granting these licenses, states can
define minimum qualifications for each type of provider and regulate each
type of provider’s scope of practice. For example, some states permit
nurse practitioners to prescribe medication, diagnose patients, and
provide treatment without the presence of a physician. Other states
require nurse practitioners to obtain a physician’s authorization to
prescribe medication. 24
Medicare Waivers and Under Section 1135 of the Social Security Act, the circumstances
Flexibilities to Address surrounding the COVID-19 pandemic in March 2020 triggered temporary
authority for CMS to waive or modify Medicare requirements in response
Public Health to the COVID-19 public health emergency. 25 In March 2020, CMS issued
Emergencies initial guidance waiving or modifying various Medicare requirements in
response to COVID-19, including the need to sustain Medicare providers’
workforce capacity. Further, CMS also used its non-emergency
authorities to issue and amend Medicare regulations and sub-regulatory
guidance throughout the COVID-19 public health emergency. As a result,
some of the changes to Medicare requirements made during the COVID-
19 public health emergency apply temporarily, while others are
permanent, absent additional congressional or agency action. For
purposes of this report, we refer to these waivers, regulatory
amendments, and sub-regulatory changes as waivers and flexibilities.
24National Academies of Sciences, Engineering, and Medicine, The Future of Nursing
2020-2030: Charting a Path to Achieve Health Equity, (Washington, DC: The National
Academies Press, 2021).
25On January 31, 2020, the Secretary of Health and Human Services declared a public
health emergency for the United States, retroactive to January 27. Subsequently, on
March 13, 2020, the President declared COVID-19 a national emergency under the
National Emergencies Act and a nationwide emergency under section 501(b) of the
Robert T. Stafford Disaster Relief and Emergency Assistance Act (Stafford Act). See 50
U.S.C. § 1601 et seq. and 42 U.S.C. § 5121 et seq. These two actions triggered the
availability of authority under Section 1135 for the Secretary of Health and Human
Services to temporarily waive or modify Medicare program requirements, such as by
issuing a blanket waiver. See 42 U.S.C. § 1320b-5. The Administrator of CMS typically
implements Section 1135 waivers for Medicare.
Page 8 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
CMS’s Pandemic Plan describes the agency’s policies for responding to
pandemics, including Medicare oversight activities to protect the program
and beneficiaries. These oversight activities include reviewing waivers
and flexibilities to establish safeguards for fraud prevention, and
evaluating CMS’s pandemic response to identify areas for improvement.
We identified 47 Medicare waivers and flexibilities that CMS issued to
CMS Issued 47 sustain Medicare provider workforce capacity and thereby maintain
Waivers and beneficiary access to services during the COVID-19 public health
emergency. These changed various Medicare requirements, including
Flexibilities Related to those related to provider enrollment, clinicians’ scope of practice, and
Provider Enrollment, training.
Clinicians’ Scope of
Practice, and Training
CMS Issued Enrollment Our review of agency documentation shows that in March 2020, CMS
Waivers and Flexibilities issued seven provider enrollment waivers affecting enrollments across all
fraud risk levels. According to CMS’s Pandemic Plan, CMS made these
for Providers across All
changes to expedite provider enrollment in Medicare so that more
Risk Levels to Maintain providers could deliver services and receive payments. (See table 2 for a
Beneficiary Access list of provider enrollment waivers and flexibilities, and appendix I for a full
list of CMS workforce capacity waivers and flexibilities.) According to
representatives from three MACs, the provider enrollment waivers and
flexibilities reduced application processing times. In addition, two of the
three MACs said that these waivers and flexibilities expanded the
provider workforce, such as enabling licensed providers in retirement to
return to work to deliver services.
Page 9 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
Table 2: Medicare Provider Enrollment Waivers or Flexibilities Issued to Sustain Workforce Capacity during the COVID-19
Public Health Emergency by CMS’s Risk Categories for Fraud, Waste, and Abuse
Provider risk category
Title of provider enrollment
waiver or flexibilitya Effective date End date High Moderate Limited
Waives fingerprint-based criminal background March 1, 2020 October 31, 2021
✓ - -
checks
Postpones site visits March 1, 2020 July 6, 2020 ✓ ✓ -
Postpones accreditation for suppliers of durable March 1, 2020 July 6, 2020
medical equipment, prosthetics, orthotics, and ✓ ✓ -
supplies (DMEPOS)b
Allows certain providers who opted out of March 1, 2020 End of public health
Medicare to terminate their opt-out status early emergencyd ✓ - ✓
and enroll in Medicarec
Postpones provider enrollment revalidation March 1, 2020 October 31, 2021 ✓ ✓ ✓
Waives application fee March 1, 2020 October 2021 ✓ ✓ ✓
Expedites review of any pending or new March 1, 2020 End of public health
✓ ✓ ✓
applications from providers emergencyd
Legend:
✓ = provider enrollments in this risk category were subject to the waiver or flexibility.
- = provider enrollments in this risk category were not subject to the waiver or flexibility.
Source: GAO analysis of information from the Centers for Medicare & Medicaid Services (CMS). | GAO-23-105494
a
We use the term “providers” to include physicians and other clinicians or health care workers;
DMEPOS suppliers; home health agencies; hospice organizations; and non-institutional providers
such as ambulances or other free-standing facilities, such as clinical laboratories, unless otherwise
specified.
b
This accreditation waiver applies only to newly enrolling and expiring accreditations of current
DMEPOS suppliers for 90 days. CMS considers these provider types to be either a high- or
moderate-risk for fraud, waste, and abuse. In addition, CMS waived the requirements that DMEPOS
suppliers maintain a physical facility, a primary business telephone, and be open to the public a
minimum of 30 hours per week. CMS resumed these requirements effective July 6, 2020, consistent
with when CMS resumed site visits.
c
Providers may opt out of Medicare enrollment—generally for at least 2 years—to serve Medicare
beneficiaries based on a private contract rather than terms established by the Medicare program.
d
The Secretary of Health and Human Services first declared the COVID-19 public health emergency
on January 31, 2020, and renewed this determination 11 times. The public health emergency was
most recently renewed on October 13, 2022, and expires January 11, 2023. During the COVID-19
public health emergency, the Department of Health and Human Services made widespread use of
authority under section 1135 of the Social Security Act to waive or modify certain Medicare
requirements to maintain beneficiary access to care. See 42 U.S.C. § 1320b-5. For purposes of this
report, we collectively refer to these waivers and other changes to requirements made in response to
COVID-19 as “waivers and flexibilities.”
As table 2 shows, CMS changed some provider enrollment requirements
that only applied to high- or moderate-risk provider types.
• Fingerprint-based criminal background checks. CMS waived
these checks of high-risk provider types for 18 months, from March 1,
Page 10 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
2020, through October 31, 2021. CMS data show that during this
period, about 7,300 high-risk provider types enrolled in Medicare.
• Site visits at provider locations. CMS postponed onsite review of a
provider’s location, for approximately 14,800 enrollments of high- and
moderate-risk provider types for more than 4 months, from March 1,
2020, through July 6, 2020. 26 According to two MACs, changing this
requirement reduced application processing times because site visits
for new enrollments could normally take up to 15 days to complete.
• Accreditation for DMEPOS suppliers. CMS postponed accreditation
requirements allowing about 800 DMEPOS suppliers, who it considers
high- or moderate-risk, to enroll without accreditation from March 1,
2020, through July 6, 2020. Under normal circumstances, this
accreditation certifies that suppliers meet certain DMEPOS quality
standards set forth by law. 27 When CMS reinstated the DMEPOS
accreditation requirement in July 2020, it required all DMEPOS
suppliers that had enrolled without accreditation to obtain it.
In addition to changing some provider enrollment requirements for high-
and moderate-risk provider types, CMS directed MACs to establish toll-
free hotlines for certain providers, including physicians and other
clinicians, to enroll and receive temporary Medicare billing privileges.
According to agency documentation, these hotlines expedited the
enrollment process, allowing certain providers to enroll the same day.
These temporary enrollments will expire soon after the end of the public
health emergency, unless renewed. 28
When deciding to issue waivers soon after the public health emergency
was declared in March 2020, CMS used past experience from previous
emergencies, such as natural disasters, according to agency officials.
Agency officials and documentation showed CMS also engaged subject
26As of April 2022, CMS had completed approximately 11,200 of the site visits that were
postponed from March 1, 2020, through July 6, 2020.
27See 42 U.S.C. § 1395m(a)(20). CMS’s DMEPOS quality standards contain two sets of
requirements. The first, supplier business service requirements, contains standards for
suppliers’ administrative practices, including financial management and consumer
services. The second section, supplier product-specific service requirements, includes
requirements related to patient intake and assessment, equipment delivery and set up,
and follow-up services. The standards also have requirements for specific items and
services, such as respiratory equipment and manual wheelchairs.
28When the public health emergency ends, CMS will require providers with temporary
enrollments to submit complete applications for enrollment. Providers will have 30 days to
respond to the request for an application.
Page 11 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
matter experts, including senior clinicians, and agency leadership to
review and approve potential changes to Medicare requirements
throughout the public health emergency. CMS officials said they
considered the extent to which provider enrollment waivers and
flexibilities might create risks to program integrity and whether such risks
could be mitigated by other practices. For example, CMS monitored
databases for criminal records among high-risk providers whose
fingerprint-based criminal background checks were waived. Agency
officials said they decided to end certain changes early, such as the
waiver of in-person site visits, when declining COVID-19 risks enabled
them to do so. They added that they continually reassessed the need for
waivers or flexibilities.
CMS Issued Waivers and In addition to the provider enrollment waivers, CMS issued 40 other
Flexibilities for Scope-of- workforce capacity waivers and flexibilities during the COVID-19 public
health emergency, including 17 changes related to providers’ scope of
Practice, Training, and
practice, according to our review of agency documentation. Most of these
Other Requirements, waivers and flexibilities were effective March 1, 2020. The agency said
Particularly in Rural Areas these changes expanded the health care workforce by reducing burden
on physicians, expanding the care other clinicians can provide, and
postponing required training. In particular, the scope-of-practice waivers
and flexibilities removed certain federal Medicare requirements and
deferred to state requirements. For example, the agency allowed
physicians in long-term care and certain related facilities to delegate
required physician visits to nurse practitioners, among others, to the
extent this was allowed by states. See table 3 for an overview of waivers
and flexibilities related to scope-of-practice, training, and other
requirements and appendix I for a full list of waivers and flexibilities CMS
issued to sustain workforce capacity.
Page 12 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
Table 3: Medicare Scope-of-Practice, Training, and Other Waivers and Flexibilities Issued to Sustain Workforce Capacity
during the COVID-19 Public Health Emergency
Number of
waivers and
Category of waivers and flexibilities flexibilities Example of waiver or flexibility
Scope of practice: Supervision 11 Anesthesia services at hospitals, critical access hospitals, and
of clinicians or services performed by ambulatory surgical centers: Waives federal requirements that a
clinicians certified registered nurse anesthetist be under the supervision of a
physician.
Scope of practice: Delegation 5 Physician visits for long-term care facilities and skilled nursing facilities:
of duties from one type of clinician, Permits physicians in long-term care and certain related facilities to
such as a physician, to another, such delegate any required physician visit to certain other clinicians.
as a nurse practitioner
Scope of practice: 1 Modification to Medicare rules and Medicaid concerning certification and
Expansion of duties provision of home health services: Modifies which providers are allowed
to certify the need for home health services and order services.a
Training for clinicians or other 10 12-hour annual in-service training requirement for home health aides:
personnel providing patient care Postpones the deadline for requirement that each home health aide
receives 12 hours of in-service training in a 12-month period.
Other 13 Physician services at hospitals, psychiatric hospitals, and critical access
hospitals: Waives the requirement that Medicare patients be under the
care of a physician.
Source: GAO analysis of information from the Centers for Medicare & Medicaid Services. | GAO-23-105494
Note: The Secretary of Health and Human Services first declared the COVID-19 public health
emergency on January 31, 2020, and renewed this determination 11 times. The public health
emergency was most recently renewed on October 13, 2022, and expires January 11, 2023. During
the COVID-19 public health emergency, the Department of Health and Human Services made
widespread use of authority under section 1135 of the Social Security Act to waive or modify certain
Medicare requirements to maintain beneficiary access to care. See 42 U.S.C. § 1320b-5. For
purposes of this report, we collectively refer to these waivers and other changes to requirements
made in response to COVID-19 as “waivers and flexibilities.” Many waivers and flexibilities were
effective March 1, 2020 and end when the public health emergency ends. See appendix I for a full list
of Medicare workforce capacity waivers and flexibilities and information on when they are scheduled
to end.
a
Absent additional action, this change will continue indefinitely after the end of the public health
emergency under CMS regulations promulgated during the public health emergency. See 85 Fed.
Reg. 27,550, 27,551 (May 8, 2020) (codified as amended at 42 C.F.R. § 409.42(b) (physician or
allowed practitioner)).
Seven of CMS’s workforce capacity waivers and flexibilities applied
specifically to rural areas. (See appendix I.) For example, CMS waived
the requirement that a nurse practitioner, physician assistant, or certified
midwife be available at least 50 percent of the time in rural health clinics,
to increase staffing flexibility. In addition, the agency made two changes
related to residency training and supervision in rural areas that apply
indefinitely after the public health emergency ends:
Page 13 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
• Allowed teaching physicians to supervise residents virtually, rather
than in-person, for certain services.
• Expanded the type of services residents can perform without in-
person supervision.
The agency stated that the need to improve rural access to care and
training opportunities for physician residents overshadowed its concerns
about physicians’ ability to adequately supervise residents virtually.
According to CMS documentation, permitting the virtual presence of
teaching physicians could expand training opportunities for residents in
rural settings, which have historically been in limited supply. CMS also
determined that more data would be needed to determine whether to
expand or terminate this regulatory change and said it may conduct
further study. 29
Waivers and
Flexibilities Helped
Increase Provider
Enrollments,
Including High-Risk
Enrollments That
CMS Later Revoked
Active Provider The total number of provider enrollments that were active in the Medicare
Enrollments Increased program increased during the COVID-19 public health emergency. There
were 2.3 million enrollments across all provider types in fiscal year
while Waivers and
2019—before the public health emergency—and 2.6 million enrollments
Flexibilities Were in Effect in fiscal year 2021—after the waivers and flexibilities were implemented,
according to HHS. This represents a 13 percent increase in active
enrollments over the 2-year period. 30 Both enrollment increases from new
providers and the continued active status of current providers—which was
maintained in part by decreases in disenrollment, such as deactivated
29See 85 Fed. Reg. 84,472, 84,579-82 (Dec. 28, 2020).
30A provider enrollment represents a single Medicare enrollment for a provider. It might not
represent a unique provider because a provider can have multiple enrollments. For
example, a provider may have one enrollment record for a practice in one state and
another enrollment record for a practice in another state.
Page 14 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
and revoked provider enrollments—contributed to the overall increase in
active enrollments. 31
About 222,000 enrollments occurred under the waivers and flexibilities
Types of Physicians, Other Clinicians,
and Specialties That Enrolled under between March 2020 and March 2022, not including enrollments with
Waivers and Flexibilities postponed revalidation requirements (see sidebar for enrollments by type
Individual providers, such as physicians of provider). Of these enrollments,
and nurse practitioners, accounted for 69
percent of enrollments that occurred under
waivers and flexibilities. The individual • 64 percent were new enrollments,
provider population was split almost evenly
between physicians and other clinicians. • 31 percent were updated enrollments, 32 and
For physicians that were enrolled under
waivers and flexibilities, the top specialties • 5 percent were reactivated enrollments that had previously been
were internal medicine (17 percent), family
medicine (12 percent), and emergency deactivated or revoked.
medicine (8 percent). For other clinicians,
the top provider types were nurse In addition to waivers that affected requirements for providers’ initial
practitioners (39 percent), physician enrollment, the waiver postponing provider enrollment revalidations likely
assistants (20 percent), and physical
therapists in private practice (12 percent).
contributed to the overall increase in total active enrollments during the
See appendix II for a list of physicians, public health emergency. During revalidation, MACs are required to
other clinicians, and specialties of review enrolled providers for eligibility. If providers do not pass the
enrollments under waivers and flexibilities.
revalidation review, the providers can be deactivated or have their
Source: GAO analysis of data from the Centers for
Medicare & Medicaid Services. | GAO-23-105494 enrollment revoked, which decreases the number of enrollments. About
237,000 revalidations were postponed between March 2020 and October
2021. This coincided with fewer deactivated and revoked enrollments.
According to HHS, deactivations declined from about 151,000 to 123,000
from fiscal years 2019 to 2021, while revoked enrollments declined from
about 2,600 to 2,300.
High-Risk DMEPOS Of the 220,000 enrollments that occurred from March 2020 through
Supplier Types That March 2022, 208 enrollments were revoked as of March 2022. Most of
the revocations were for DMEPOS suppliers, particularly newly enrolling
Enrolled under Waivers
suppliers CMS considers to pose a high risk of fraud, waste, and abuse.
and Flexibilities Accounted Although all DMEPOS suppliers made up only 4 percent of the 220,000
for a Majority of provider enrollments under waivers and flexibilities, they accounted for 83
Revocations percent of the 208 enrollments that were later revoked. (See figure 1.) A
provider enrollment can be revoked for multiple reasons, including if a
provider fails to meet eligibility requirements, such as if they are convicted
31A deactivation can occur when a provider fails to submit required information, for
example. A revocation can occur, for example, if a provider fails to meet eligibility
requirements, such as if they are convicted of a felony CMS determines is detrimental to
the best interests of the Medicare program and its beneficiaries. See 42 C.F.R.
§§ 424.540, 424.535 (2022).
32An existing enrollment can be updated when a change occurs. For example, an existing
enrollment that added a new practice location would be an updated enrollment.
Page 15 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
of a felony CMS determines is detrimental to the best interests of the
Medicare program and its beneficiaries.
Figure 1: Percentage of Provider Enrollments and Revoked Enrollments under
Waivers and Flexibilities, March 2020 through March 2022
Note: We identified 47 Medicare waivers and flexibilities CMS issued to sustain Medicare workforce
capacity during the COVID-19 public health emergency. During the COVID-19 public health
emergency, the Department of Health and Human Services made widespread use of authority under
section 1135 of the Social Security Act to waive or modify certain Medicare requirements to maintain
beneficiary access to care. See 42 U.S.C. § 1320b-5. For purposes of this report, we collectively refer
to these waivers and other changes to requirements made in response to COVID-19 as “waivers and
flexibilities.” We use the term “providers” in this figure to include all types of Medicare providers and
suppliers.
Newly enrolled DMEPOS suppliers had the highest percentage of
revoked enrollments, compared to other providers. Specifically, from
March 2020 through March 2022, about 2.6 percent of the approximately
6,000 DMEPOS suppliers with new enrollments under waivers and
flexibilities had their enrollments later revoked. This percentage is
dramatically higher than the less than 0.1 percent of all other providers
who later had their enrollments revoked.
From March 2020 through March 2022, the percent of enrollments under
waivers and flexibilities that were later revoked was particularly high for
certain waivers and flexibilities and in certain states. This may indicate
certain waivers or geographic areas that posed heightened risk. For
example, DMEPOS suppliers that enrolled under the accreditation waiver
had a higher percentage of revoked enrollments (7.3 percent) than
DMEPOS enrollments without the accreditation waiver (1.4 percent) but
Page 16 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
with another waiver or flexibility. 33 Similarly, the percentage of these
DMEPOS supplier enrollments revoked varied by state. For example, the
three states with the largest number of DMEPOS supplier enrollments
under waivers and flexibilities that were revoked—Florida, California, and
Texas—ranged from 8.4 percent (Florida) to 1.9 percent (Texas) of
DMEPOS supplier enrollments under waivers and flexibilities that were
later revoked.
Agency officials said CMS monitored all new providers who enrolled
under waivers and flexibilities, but applied additional scrutiny to DMEPOS
supplier enrollments. For example, according to agency officials, program
integrity contractors took steps to verify ownership information for 2,425
new DMEPOS supplier enrollments under waivers and flexibilities,
leading to 1.6 percent of them being revoked. Agency officials said these
suppliers have posed a high risk of fraud, so CMS allocated resources to
identify ineligible DMEPOS enrollments. Both the high risk associated
with these suppliers and CMS’s additional scrutiny of them could
contribute to the high percentage of revoked DMEPOS supplier
enrollments.
While the total number of enrollments under waivers and flexibilities that
were revoked is small, even a limited number of providers could cause
significant financial harm if they engage in fraud. For example, in June
2022, a nurse practitioner pleaded guilty to conspiring in a DMEPOS
fraud scheme that defrauded Medicare of almost $15 million, and in July
2022, the Department of Justice announced criminal charges against 36
defendants for more than $1.2 billion in alleged fraud that included
DMEPOS fraud schemes. 34
33DMEPOS enrollments granted an accreditation exemption may have also used other
waivers or flexibilities.
34Department of Justice, “Nurse Practitioner Pleads Guilty To Conspiracy In $15 Million
Durable Medical Equipment Scheme,” (June 30, 2022), accessed August 4, 2022,
https://www.justice.gov/usao-wdnc/pr/nurse-practitioner-pleads-guilty-conspiracy-15-
million-durable-medical-equipment-scheme; “Justice Department Charges Dozens for
$1.2 Billion in Health Care Fraud,” (July 20, 2022), accessed August 4, 2022
https://www.justice.gov/opa/pr/justice-department-charges-dozens-12-billion-health-care-
fraud.
Page 17 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
Providers Who Enrolled Providers who enrolled under waivers and flexibilities from March 2020
under Waivers and through March 2022 accounted for about $19 billion in expenditures,
according to our analysis of CMS claims data for the period April 2020
Flexibilities Accounted for through December 2021. 35 During this time, these providers represented
8 Percent of Medicare about 8 percent of providers billing Medicare and about 8 percent of total
Expenditures expenditures for Medicare fee-for-service claims, according to our
analysis of CMS’s carrier claims and durable medical equipment supplier
claims files.
CMS data show that specialty categories for ambulance providers,
DMEPOS suppliers, and testing providers who enrolled under waivers
and flexibilities accounted for a greater share of Medicare expenditures
than other providers in various specialties. See table 4.
Table 4: Medicare Specialty Categories of Providers Who Enrolled under Waivers and Flexibilities and Associated
Expenditures, April 2020 through December 2021
Expenditures associated
Percentage of Percentage of with providers enrolled
providers in specialty expenditures in under waivers and
Specialty category category specialty category flexibilities ($ millions)
Ambulance 8% 21% 1,928
Durable medical equipment, prosthetics, 12% 18% 3,386
orthotics, and supplies (DMEPOS)
Testinga 9% 16% 3,686
Otherb 10% 12% 1,307
Other clinicianc 10% 9% 1,571
Behavioral health 7% 7% 295
Therapyd 7% 6% 474
Medicale 7% 4% 6,293
All specialties 8% 8% 18,938
Source: GAO analysis of data from the Centers for Medicare & Medicaid Services on provider enrollment as well as carrier claims and durable medical equipment claims files. | GAO-23-105494
Notes: During the COVID-19 public health emergency, the Department of Health and Human
Services made widespread use of authority under section 1135 of the Social Security Act to waive or
modify certain Medicare requirements to maintain beneficiary access to care. See 42 U.S.C. § 1320b-
5. For purposes of this report, we collectively refer to these waivers and other changes to
requirements made in response to COVID-19 as “waivers and flexibilities.” In addition, we use the
term “providers” in this table to include all types of Medicare providers and suppliers.
Table includes provider enrollments under waivers and flexibilities that occurred from March 2020 to
March 2022 and associated claims data for the period April 2020 through December 2021, the most
recently available calendar year of claims data at the time of our study.
a
Testing specialties include diagnostic radiology and clinical laboratories, for example.
35This was the most recently available calendar year of claims data at the time of our
study.
Page 18 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
b
Other provider specialties include mass immunization providers and ambulatory surgical centers, for
example.
c
Other clinicians include nurse practitioners and physician assistants, for example.
d
Therapy specialties include physical therapists and occupational therapists, for example.
e
Medical specialties include emergency medicine, primary care, and surgical specialties, for example.
Providers’ use of scope-of-practice waivers and flexibilities also varied.
Allowing physician assistants, nurse practitioners, and clinical nurse
specialists to begin home health certifications in May 2020 resulted in
these clinicians conducting 10 percent of certifications by the end of 2021.
In contrast, we found a less than 1 percent increase associated with a
change allowing certain resident physicians to conduct more complex
patient visits to evaluate and manage conditions. 36
CMS has taken steps to assess and mitigate risks posed by provider
CMS Oversight Has enrollment waivers and flexibilities. However, CMS has not fully
Not Fully Addressed addressed risks related to waiving fingerprint-based criminal background
checks and postponing revalidations. In addition, CMS has not developed
Risks Posed by a plan to evaluate waivers and flexibilities to improve its response to
Provider Enrollment future emergencies.
Waivers and
Flexibilities
CMS Assessed Risks CMS’s Center for Program Integrity identified program integrity
Posed by Waivers and vulnerabilities associated with provider screening and scope-of-practice
waivers and flexibilities and conducted oversight activities to mitigate
Flexibilities and Took
associated risks, according to our review of agency documentation. CMS
Steps to Address Them inventoried waivers and flexibilities after it had implemented them, and
identified associated program integrity vulnerabilities. It then determined
the vulnerabilities’ associated risks by analyzing the amount of payments
associated with vulnerabilities, the likelihood of improper payments, and
the vulnerabilities’ likely effect on patient safety.
36During the COVID-19 public health emergency, CMS allows resident physicians in
certain primary care facilities to provide all levels of evaluation and management services
in outpatient or office settings while under direct virtual or in-person supervision of the
teaching physician. See 42 C.F.R. § 415.172(a) (2022). From April 2020 through
December 2020, these resident physicians performed 38 percent fewer evaluation and
management services across all levels of complexity than they had during those months
the previous year, and they performed less than 1 percent of the more complex level 4
and 5 services performed by all physicians.
Page 19 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
CMS identified a medium-risk vulnerability for provider enrollment waivers
and flexibilities generally. Further, the agency identified three high-risk
vulnerabilities related to DMEPOS supplier enrollment. For scope-of-
practice waivers and flexibilities, CMS identified a medium-risk
vulnerability related to home-health services. It also monitored provider
enrollment and billing information across provider types to help mitigate
identified risks, according to agency documentation and officials. CMS
continued its ongoing monitoring of providers’ enrollment information and
associations with other individuals that may indicate potential fraud. In
addition, it continued its ongoing monitoring of billing information for
indicators of potential fraud, waste, and abuse, such as providers who are
outliers in terms of the home health services ordered.
CMS also identified provider enrollments warranting further investigation.
For example, CMS’s oversight of newly enrolled providers from March
2020 through January 2022 resulted in 94 leads for further investigation
that led to actions to protect Medicare program integrity. These actions
included referrals to law enforcement for potential fraud or revoking
enrollments for providers found ineligible. (See fig. 2.)
Page 20 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
Figure 2: Outcomes of CMS Monitoring of Newly Enrolled Medicare Providers during the COVID-19 Public Health Emergency,
March 2020 through January 2022
Note: Multiple outcomes, including outcomes not listed, can apply to a single investigation. We use
the term “providers” in this figure to include all types of Medicare providers and suppliers that CMS
monitored, which agency officials said included suppliers of durable medical equipment, laboratories,
Federally Qualified Health Centers, hospitals, hospices, skilled nursing facilities, home health
agencies, and immunization centers.
CMS identified an increase in DMEPOS enrollments after waivers and
flexibilities began in March 2020, and reintroduced requirements for site
visits and DMEPOS accreditation in July 2020. The rate of new DMEPOS
enrollments fell soon after. (See fig. 3.) In addition, CMS directed program
Page 21 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
integrity contractors to validate information about who owns DMEPOS
supplier organizations that enrolled under waivers and flexibilities. The
contractors did so using information collected by third parties, such as
information on businesses from states’ Secretary of State, to identify any
discrepancies.
Figure 3: New Durable Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS) Supplier Medicare Enrollments
and Changes in Enrollment Requirements by Month, January 2019 to February 2022
CMS continued to monitor patient safety metrics for long-term care
residents, although it did not analyze the effects of waivers and flexibilities
on patient safety. 37 For example, CMS collected data on nursing home
staffing during most of the public health emergency, but did not analyze
the potential effects of waiving required training and certification of
nursing aides employed by skilled nursing facilities on patient safety
37CMS took additional steps related to infection control in long-term care facilities. See
GAO, COVID-19 in Nursing Homes: CMS Needs to Continue to Strengthen Oversight of
Infection Prevention and Control, GAO-22-105133 (Washington, D.C.: Sept. 14, 2022).
CMS’s Pandemic Plan outlining its policies for responding to a pandemic establishes that
the agency will monitor the efficacy of the waivers CMS implements.
Page 22 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
metrics. CMS officials said it was not possible to measure the unique
effects of waivers and flexibilities, given other changes affecting long-term
care residents such as staffing absences due to COVID-19. Both CMS
and GAO found that performance on certain metrics fell, such as long-
term care residents experiencing increased pressure ulcers, weight loss,
and depression during the COVID-19 public health emergency. 38 CMS
stated that certain waivers and flexibilities—among other factors—might
have contributed to declines in patient safety metrics for long-term care
residents. To address this potential risk to patient safety, CMS
reintroduced certain minimum training and scope-of-practice
requirements when the agency found related waivers were no longer
needed, making the requirements effective May 2022 or June 2022. 39
In addition to monitoring providers and patient safety of long-term care
residents, CMS monitored MACs’ implementation of provider enrollment
waivers and flexibilities. During the COVID-19 public health emergency,
the agency continued its review of measures of the accuracy and
timeliness of MACs’ performance, such as the accuracy and timeliness of
provider enrollment application processing. Through this monitoring, CMS
was able to determine that one MAC did not always screen enrollments
that used waivers and flexibilities against lists of entities excluded from
receiving federal contracts, as required. The agency addressed this
deficiency in writing with the MAC and issued guidance advising other
MACs to continue performing this screening.
CMS Has Not Fully Since ending the waiver of fingerprint-based criminal background checks,
Addressed Risks from CMS has not conducted these checks on providers who had them
waived. Instead, it has relied on its monitoring of criminal records
Provider Enrollment
associated with providers based on the providers’ names rather than
Waivers and Flexibilities fingerprints, even though it previously indicated fingerprints were more
accurate and appropriate. In addition, CMS has begun conducting
provider enrollment revalidations that the agency postponed through a
38See CMS, Center for Clinical Standards and Quality/Quality, Safety & Oversight Group,
Update to COVID-19 Emergency Declaration Blanket Waivers for Specific Providers,
QSO-22-15-NH & NLTC & LSC (Baltimore, M.D., April 7, 2022), and, GAO-22-105133,
10-15.
39Specifically, CMS ended Section 1135 blanket waivers related to (1) required training for
feeding assistants in long-term care facilities, (2) required in-service training for nursing
aides in skilled nursing facilities and nursing homes, (3) required training and certification
of nursing aides employed by skilled nursing facilities and nursing homes, (4) physician
delegation of tasks in skilled nursing facilities, and (5) required physician visits in skilled
nursing facilities and nursing homes.
Page 23 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
waiver, but CMS may not complete all revalidations within established
time frames.
Waivers and Flexibilities When CMS waived fingerprint-based criminal background checks from
Precluded Fingerprint-Based March 2020 through October 2021, the agency intended to postpone
Criminal Background Checks checks and conduct them after resuming this requirement, according to
for High-Risk Providers officials. However, CMS officials said that because the agency only has
statutory authority to conduct these checks at enrollment, the agency was
precluded from conducting these checks later. 40 Although CMS
regulations authorize these checks for certain providers when CMS
revalidates provider information for re-enrollment, which occurs every 3
years for DMEPOS suppliers and every 5 years for other providers, CMS
officials indicated that only providers who have been elevated to the high-
risk screening level would be subject to the fingerprinting requirement at
revalidation. 41
As of August 2022, CMS has not taken steps to conduct the fingerprint-
based criminal background checks that it intended to postpone. Not
conducting fingerprint-based criminal background checks is counter to
CMS’s Pandemic Plan. This plan states that the agency will act to protect
its programs and beneficiaries from fraud, waste, and abuse, as well as
review policy changes to establish safeguards for fraud prevention.
Without fingerprint-based criminal background checks, CMS lacks
assurance that about 7,000 enrollments of high-risk provider types who
had these checks waived—including enrollments for home health
agencies and DMEPOS suppliers—did not include providers who would
be ineligible due to felony convictions. Conducting fingerprint-based
criminal background checks would offer greater assurance that CMS is
preventing ineligible providers from enrolling and billing for Medicare
services.
40Section 1866 of the Social Security Act authorizes HHS to establish Medicare provider
enrollment and revalidation procedures including criminal background checks as the
Secretary determines appropriate based on the risk of fraud, waste, and abuse with
respect to the category of provider. See 42 U.S.C. § 1395cc(j).
41HHS regulations generally require individuals with a 5 percent or greater interest in a
high-risk provider to submit to a fingerprint-based criminal history record check, among
other screening requirements, upon initial application and—for providers elevated to the
high-risk screening level—revalidation. See 42 C.F.R. § 424.518(c)(2) (2022). According
to CMS officials, providers at a moderate- or limited-risk screening level at the time of
revalidation are not subject to fingerprinting, even if the provider was high-risk at initial
enrollment and the applicable fingerprinting requirement was waived.
Page 24 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
CMS officials said that the agency mitigated risks by regularly monitoring
for criminal records that match enrolled providers’ names and thus
conducting fingerprint based criminal background checks would offer no
benefit while potentially adding provider burden. 42 This is inconsistent with
previous CMS statements on the benefits fingerprint-based criminal
background checks provide over name-based checks. Further, it is
contrary to the need for additional scrutiny of high-risk provider types, as
CMS explained in the preamble to rulemaking that implemented
procedures to screen Medicare providers. 43 CMS’s regular monitoring for
criminal records based on providers’ names could help with ongoing
oversight. However, it does not address the risk of providers avoiding
detection by falsifying their name, which CMS previously explained could
be reduced by conducting fingerprint-based criminal background checks.
CMS officials confirmed the agency had commonly approved waivers and
flexibilities for fingerprint-based criminal background check requirements
for previous natural disasters or public health emergencies and could do
so again. 44 Officials told us that using these waivers and flexibilities during
future emergencies could again result in the agency not conducting these
checks after the emergency ended. However, despite commonly waiving
these checks, CMS did not have plans to develop policies and
procedures to postpone rather than waive fingerprint-based criminal
background checks during future emergencies, as of August 2022. This is
inconsistent with CMS’s Pandemic Plan, which commits to reviewing
policy changes to establish safeguards for fraud prevention. Developing
policies and procedures to postpone rather than waive these checks will
42According to CMS officials, the agency’s advanced provider screening system monitors
felonies in the last 10 years and uses the same database used for fingerprint-based
criminal background checks.
43CMS cited reasons that fingerprint-based background checks are more accurate than
name-based checks, including that people (1) lie about their names, (2) obtain names
from false documents, (3) change their names, (4) have the same name, (5) misspell
names, (6) use different versions of their names, and (7) use aliases. Further, CMS stated
that provider types it considers high risk had not undergone sufficient scrutiny prior to the
implementation of fingerprint-based criminal background check. See 76 Fed. Reg. 5,862,
5,876 (Feb. 2, 2011).
44Between the COVID-19 public health emergency declaration and September 2022, CMS
has allowed providers to request Section 1135 waivers for at least five additional public
health emergencies declared in response to hurricanes, wildfires, and severe weather. In
addition, a national public health emergency was declared due to the monkeypox virus in
August 2022.
Page 25 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
enable CMS to maintain important safeguards against fraud during future
emergencies.
Postponed Provider Enrollment In January 2022, CMS resumed provider enrollment revalidations that the
Revalidations May Not Be agency postponed from March 2020 through October 2021, but the
Completed Within Established agency may not complete these revalidations within the established 3- to
Time Frames 5-year time frames. As of August 2022, about 16,000 of the 237,000
postponed revalidations were completed, according to CMS officials. At
the current rate, it would take until 2029—more than 9 years after CMS
issued related waivers and flexibilities—or later to catch up on the
revalidations that CMS postponed.
CMS has prioritized catching up on postponed revalidations for providers
who received accelerated or advanced payments in accordance with the
CARES Act, according to agency officials. 45 However, CMS has not
prioritized revalidations for provider types it considers moderate- or high-
risk of fraud, waste, and abuse—including DMEPOS suppliers, who we
also found to have higher rates of revoked enrollments under waivers and
flexibilities than other provider types.
CMS officials acknowledged that at the current rate it could take years to
complete these revalidations. As of August 2022, they said they did not
have a plan with target dates for completing revalidations as they are still
considering resource needs and time frames for completing these
revalidations. If CMS does not prioritize and complete postponed
revalidations within the established 5-year or—for DMEPOS suppliers—3-
year period since enrollment or the previous revalidation, CMS will have
effectively waived one or more cycles of revalidations. As CMS noted in
establishing such time frames, revalidations are intended to ensure
providers’ continued compliance with Medicare requirements, including
45Accelerated and advance payments provide eligible providers with necessary funds in
certain circumstances, such as due to a disruption in the submission or processing of
claims for payment, or to accelerate cash flow to affected providers during a national
emergency or disaster. The CARES Act expanded the existing program providing these
payments to give additional flexibilities during the COVID-19 public health emergency.
See Pub. L. No. 116-136, div. A, tit. III, pt. IV, subtit. D, § 3719, 134 Stat. 281, 426 (2020)
(codified as amended at 42 U.S.C. § 1395g(f)).
Page 26 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
that Medicare beneficiaries are receiving services furnished only by
legitimate providers. 46
Not developing and implementing a plan for conducting postponed
provider enrollment revalidations in a timely manner, including prioritizing
moderate- and high-risk provider types, is inconsistent with federal
internal control standards, which call for agencies to identify, analyze, and
respond to risks related to achieving the defined objectives. 47 In the
absence of such a plan and implementation activities, CMS might not
identify providers who do not continue to comply with program
requirements.
CMS Has Not Planned an According to CMS’s Pandemic Plan, following a return to normal
Evaluation of Waivers and operations after a pandemic, the agency should conduct appropriate post-
pandemic activities, including evaluations of the agency’s performance to
Flexibilities Related to identify areas for improvement. 48 Further, all opportunities for
Provider Enrollment improvement should be captured and synthesized into a continuity
corrective action plan.
However, CMS has not planned an evaluation of the agency’s
performance with respect to waivers and flexibilities for provider
enrollment, and CMS has not incorporated opportunities for improvement
in a corrective action plan as of August 2022. CMS officials told us they
were exploring options to evaluate waivers and flexibilities related to
provider enrollment, but did not provide documentation of planned
evaluation activities. Absent an evaluation, CMS will likely miss
opportunities to improve its response to future natural disasters and
public health emergencies. These missed opportunities likely include
improvements that address and limit risks to program integrity and patient
safety. For example, CMS officials and representatives from MACs and
program integrity contractors we spoke with identified potential
opportunities to improve future oversight of waivers and flexibilities for
provider enrollment:
• Targeting waivers and flexibilities. CMS officials said that they may
be able to better target waivers and flexibilities for provider enrollment
46See, e.g., 77 Fed. Reg. 20,754, 20,758 (Apr. 21, 2006) (establishing provider
revalidation requirements currently codified, as amended, at 42 C.F.R. §§ 424.515,
424.57(g)).
47GAO-14-704G.
48CMS’s Pandemic Plan does not set a deadline for this evaluation.
Page 27 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
during future emergencies. Representatives from one program
integrity contractor we spoke with identified provider enrollment
waivers and flexibilities for DMEPOS suppliers as an area for
improvement, explaining that issuing waivers and flexibilities for all
DMEPOS suppliers offered minimal benefits in responding to COVID-
19 and introduced program integrity risks that were potentially very
high. CMS officials explained that some DMEPOS suppliers may have
enrolled under provider enrollment waivers and flexibilities to deliver
important supplies, such as oxygen tanks.
• Preparing for revalidation backlogs. Representatives from each of
the three MACs we spoke with identified challenges or potential
improvements related to revalidation waivers and flexibilities. For
example, representatives from one MAC suggested that CMS could
have requested providers revalidate their enrollment on a voluntary
basis while waivers and flexibilities are in place, and representatives
from another MAC suggested more preparation before resuming
revalidations to mitigate the backlog of postponed revalidations.
• Tracking and communicating waivers and flexibilities. Each of the
MACs and program integrity contractors we spoke with said that
access to additional detail about the specific waivers and flexibilities
under which enrollment occurred would have helped their oversight
efforts. For example, representatives from one program integrity
contractor explained that additional detail could help them identify
which DMEPOS suppliers enrolled without accreditation requirements
and better monitor whether these suppliers delivered supplies they
were not qualified to offer. CMS took steps to track provider
enrollments that occurred under waivers and flexibilities and
communicate that to MACs and program integrity contractors, but this
did not include information on which waivers and flexibilities each
provider enrolled under, and CMS officials had not identified how
contractors’ inability to track that information limited contractors’
oversight activities. CMS officials also noted that an information
system redesign is underway that would enhance CMS’s ability to
provide this information. 49
In response to the COVID-19 public health emergency and the need to
Conclusions maintain beneficiary access to Medicare services, CMS acted quickly to
issue waivers and flexibilities related to provider enrollment, clinicians’
scope of practice, and training. These actions also helped sustain
provider workforce capacity to deliver services. As CMS transitions back
49Specifically, CMS officials said they were in the process of developing the Provider
Enrollment, Chain, and Ownership System 2.0.
Page 28 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
to normal operations, additional actions could help reduce risks of fraud,
waste, and abuse, and risks to patient safety. Fingerprint-based criminal
background checks for high-risk providers who enrolled without them
would help identify providers who may have falsified their enrollment
application. In addition, timely revalidations of provider enrollments,
particularly for provider types who the agency considers a high-risk or
moderate-risk, would help identify providers who are no longer eligible to
deliver Medicare services. Further, without plans to evaluate waivers and
flexibilities or related challenges, the agency will not have identified
important areas for improvement. Absent plans for improvement, CMS
may not avoid repeating mistakes it made responding to COVID-19 nor
tailor its actions to better safeguard the Medicare program and its
beneficiaries in future emergencies.
We are making the following four recommendations to CMS.
Recommendations
The Administrator of CMS should conduct fingerprint-based criminal
background checks for high-risk provider types who enrolled during the
COVID-19 public health emergency, such as when CMS revalidates
these providers’ information. (Recommendation 1)
The Administrator of CMS should develop policies and procedures to
postpone rather than waive fingerprint-based criminal background checks
during future emergencies. (Recommendation 2)
The Administrator of CMS should develop and implement a plan for
conducting provider enrollment revalidations to ensure providers are
revalidated prior to the end of their 3- to 5-year revalidation cycles,
prioritizing moderate- and high-risk provider types. (Recommendation 3)
The Administrator of CMS should evaluate waivers and flexibilities for
provider enrollment, including related oversight challenges, and address
any opportunities for improvement. This evaluation could consider
targeting provider enrollment waivers and flexibilities to maintain
requirements for provider types CMS considers high risk—including
DMEPOS suppliers—and opportunities to track and communicate to
program integrity contractors information about each waiver and flexibility
providers enrolled under. (Recommendation 4)
Page 29 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
We provided a draft of this report to HHS for review and comment. In its
Agency Comments written comments, printed in appendix III, CMS agreed with our
and Our Evaluation recommendations. HHS and CMS also provided technical comments,
which we incorporated as appropriate.
Regarding our first recommendation—to conduct fingerprint-based
criminal background checks for high-risk provider types who enrolled
during the COVID-19 public health emergency—CMS agreed to conduct
these checks for providers who have been elevated to the high-risk
category. CMS also agreed to explore options for provider types who
were high-risk at the time of enrollment, when these checks were waived,
but are subsequently considered a moderate risk, while noting this would
require notice and comment rulemaking. We maintain that conducting
these checks would offer greater assurance that CMS is preventing
ineligible providers from enrolling and billing for Medicare services.
Regarding our second recommendation—to develop policies and
procedures to postpone rather than waive fingerprint-based criminal
background checks during future emergencies—CMS agreed to explore
ways to effectively postpone these checks while noting that doing so
would require notice and comment rulemaking. We maintain that
developing these policies and procedures will enable CMS to sustain
important safeguards against fraud during future emergencies.
Regarding our third recommendation—to develop and implement a plan
for conducting provider enrollment revalidations to ensure providers are
revalidated prior to the end of their 3- to 5-year revalidation cycles,
prioritizing moderate- and high-risk provider types—CMS agreed to
develop and implement a plan for conducting these revalidations and
prioritizing higher risk provider types. CMS said that conducting these
revalidations requires additional resources and CMS is assessing the
resources needed to conduct them all within 1 to 3 years. We maintain
that conducting these revalidations in a timely manner that prioritizes
higher risk provider types would help identify providers who do not
continue to comply with program requirements.
Regarding our fourth recommendation—to evaluate waivers and
flexibilities for provider enrollment, including related oversight challenges,
and address any opportunities for improvement—CMS agreed with the
importance of such an evaluation. CMS said that it is undertaking an
agency-wide initiative to assess the lessons learned from the waivers
issued during the COVID-19 pandemic to inform decision making for
future emergencies.
Page 30 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
We are sending copies of this report to the appropriate congressional
committees, and the Secretary of Health and Human Services. In
addition, the report is available at no charge on the GAO website at
https://www.gao.gov.
If you or your staff have any questions about this report, please contact
me at (202) 512-7114 or GordonLV@gao.gov. Contact points for our
Offices of Congressional Relations and Public Affairs may be found on
the last page of this report. GAO staff who made key contributions to this
report are listed in appendix IV.
Leslie V. Gordon
Acting Director, Health Care
Page 31 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
List of Committees
The Honorable Patrick Leahy
Chairman
The Honorable Richard Shelby
Vice Chairman
Committee on Appropriations
United States Senate
The Honorable Ron Wyden
Chairman
The Honorable Mike Crapo
Ranking Member
Committee on Finance
United States Senate
The Honorable Patty Murray
Chair
The Honorable Richard Burr
Ranking Member
Committee on Health, Education, Labor, and Pensions
United States Senate
The Honorable Gary C. Peters
Chairman
The Honorable Rob Portman
Ranking Member
Committee on Homeland Security and Governmental Affairs
United States Senate
The Honorable Rosa L. DeLauro
Chair
The Honorable Kay Granger
Ranking Member
Committee on Appropriations
House of Representatives
The Honorable Frank Pallone, Jr.
Chairman
The Honorable Cathy McMorris Rodgers
Republican Leader
Committee on Energy and Commerce
House of Representatives
Page 32 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
The Honorable Bennie G. Thompson
Chairman
The Honorable John Katko
Ranking Member
Committee on Homeland Security
House of Representatives
The Honorable Carolyn B. Maloney
Chairwoman
The Honorable James Comer
Ranking Member
Committee on Oversight and Reform
House of Representatives
The Honorable Richard E. Neal
Chairman
The Honorable Kevin Brady
Republican Leader
Committee on Ways and Means
House of Representatives
Page 33 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
Appendix I: Summary of Medicare Waivers Appendix I: Summary of Medicare Waivers and
Flexibilities CMS Issued to Sustain Workforce
Capacity
and Flexibilities CMS Issued to Sustain
Workforce Capacity
Table 5: Medicare Waivers and Flexibilities to Sustain Provider Workforce Capacity during the COVID-19 Public Health
Emergency (PHE) Implemented from March 2020 through December 2021
Category of waiver Source of waiver Change targets
or flexibility Title of waiver or flexibility or flexibility End date rural areas
Provider enrollment Waive criminal background checks Section 1135 blanket 10/31/2021 -
associated with fingerprint-based criminal waiver guidance
background check
Postpone all revalidation actions Section 1135 blanket 10/31/2021 -
waiver guidance
Waive site visits Section 1135 blanket 7/6/2022 -
waiver guidance
Accreditation for suppliers of durable Section 1135 blanket 7/6/2022 -
medical equipment, prosthetics, orthotics, waiver guidance
and supplies (DMEPOS)
Waive application fee Section 1135 blanket October 2021 -
waiver guidance
Allow opted-out physicians and other Section 1135 blanket End of the COVID-19 -
practitioners to terminate their opt-out waiver guidance PHE declaration
status early and enroll in Medicare
Expedites review of any pending or new Section 1135 blanket End of the COVID-19 -
applications from providers waiver guidance PHE declaration
Scope of practice – Physician delegation of tasks in skilled Section 1135 blanket 5/7/2022 -
delegation of duties nursing facilities waiver guidance
Physician visits for long-term care Section 1135 blanket 5/7/2022 -
facilities waiver guidance
Allow occupational therapists, physical Section 1135 blanket End of the COVID-19 -
therapists, and speech language waiver guidance PHE declaration
pathologists to perform initial and
comprehensive assessment for all
patients
Modify requirements for ordering COVID- 85 Fed. Reg. 27550 End of the COVID-19 -
19 diagnostic laboratory tests (May 8, 2020) PHE declaration
85 Fed. Reg. 54820
(Sep. 2, 2020)
Therapy—therapy assistants furnishing 85 Fed. Reg. 27550 Not applicable; no end -
maintenance therapy (May 8, 2020) date specified
85 Fed. Reg. 84472
(Dec. 28, 2020)
Scope of practice – Modification to Medicare rules and 85 Fed. Reg. 27550 Not applicable; no end -
expansion of duties Medicaid concerning certification and (May 8, 2020) date specified
provision of home health services
Scope of practice – Waive onsite visits for home health Section 1135 blanket End of the COVID-19 -
supervision agency aide supervision waiver guidance PHE declaration
Page 34 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
Appendix I: Summary of Medicare Waivers and
Flexibilities CMS Issued to Sustain Workforce
Capacity
Category of waiver Source of waiver Change targets
or flexibility Title of waiver or flexibility or flexibility End date rural areas
Anesthesia services at hospitals, critical Section 1135 blanket End of the COVID-19 -
access hospitals, and ambulatory surgical waiver guidance PHE declaration
centers
Responsibilities of physicians in critical Section 1135 blanket End of the COVID-19 🗸🗸
access hospitals waiver guidance PHE declaration
Physician supervision of nurse Section 1135 blanket End of the calendar 🗸🗸
practitioners in rural health clinics and waiver guidance year in which the PHE
federally qualified health centers ends
Waive onsite visits for hospice aide Section 1135 blanket End of the COVID-19 -
supervision waiver guidance PHE declaration
Revisions to teaching physician 85 Fed. Reg. 19230 End of the COVID-19 🗸🗸
regulations (evaluation and management (Apr. 6, 2020) PHE declarationa
services) 85 Fed. Reg. 84472
(Dec. 28, 2020)
Revisions to teaching physician 85 Fed. Reg. 19230 End of the COVID-19 -
regulations (interpretation of diagnostics) (Apr. 6, 2020) PHE declaration
Direct supervision by interactive 85 Fed. Reg. 19230 End of the calendar 🗸🗸
telecommunications technology (Apr. 6, 2020) year in which the PHE
85 Fed. Reg. 84472 endsa
(Dec. 28, 2020)
85 Fed. Reg. 85866
(Dec. 29, 2020)
Requirements for consultations or 85 Fed. Reg. 19230 End of the COVID-19 -
services furnished by or with the (Apr. 6, 2020) PHE declaration
supervision of a particular medical
practitioner or specialist
Physician supervision flexibility for 85 Fed. Reg. 19230 Not applicable; no end -
outpatient hospitals—outpatient hospital (Apr. 6, 2020) date specified
therapeutic services assigned to the non- 85 Fed. Reg. 85866
surgical extended duration therapeutic (Dec. 29, 2020)
services level of supervision
Supervision of diagnostic tests by certain 85 Fed. Reg. 27550 Not applicable; no end -
practitioners (May 8, 2020) date specified
85 Fed. Reg. 84472
(Dec. 28, 2020)
Training Training and certification of nurse aides Section 1135 blanket 6/6/2022 -
waiver guidance
In-service training for long-term care Section 1135 blanket 6/6/2022 -
facilities and skilled nursing facilities waiver guidance
and/or nursing facilities
Paid feeding assistants for long-term care Section 1135 blanket 6/6/2022 -
facilities and skilled nursing facilities waiver guidance
and/or nursing facilities
Page 35 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
Appendix I: Summary of Medicare Waivers and
Flexibilities CMS Issued to Sustain Workforce
Capacity
Category of waiver Source of waiver Change targets
or flexibility Title of waiver or flexibility or flexibility End date rural areas
12-hour annual in-service training Section 1135 blanket End of the first full -
requirement for home health aides waiver guidance quarter after the PHE
concludes
Hospice aide competency testing allow Section 1135 blanket Not applicable; no end -
use of pseudo patients waiver guidance date specified
86 Fed. Reg. 42528
(Aug. 4, 2020)
12-hour annual in-service training Section 1135 blanket End of the COVID-19 -
requirement for hospice aides waiver guidance PHE declaration
Hospice annual training Section 1135 blanket End of the first full -
waiver guidance quarter after the PHE
concludes
Emergency preparedness for end-stage Section 1135 blanket End of the COVID-19 -
renal dialysis facilities waiver guidance PHE declaration
Director of food and nutrition services Section 1135 blanket End of the COVID-19 -
waiver guidance PHE declaration
Home Health Agencies and Hospice Section 1135 blanket End of the COVID-19 -
Training and Assessment of Aides waiver guidance PHE declaration
Other Critical access hospital staff licensure Section 1135 blanket End of the COVID-19 🗸🗸
waiver guidance PHE declaration
Dialysis patient care technician Section 1135 blanket End of the COVID-19 -
certification waiver guidance PHE declaration
Medical staff for hospitals, psychiatric Section 1135 blanket End of the COVID-19 -
hospitals, and critical access hospitals waiver guidance PHE declaration
Practitioner locations Section 1135 blanket Not applicable; no end -
waiver guidance date specified
Critical access hospital personnel Section 1135 blanket End of the COVID-19 🗸🗸
qualifications waiver guidance PHE declaration
Transferability of physician credentialing Section 1135 blanket End of the COVID-19 -
waiver guidance PHE declaration
Certain staffing requirements for rural Section 1135 blanket End of the COVID-19 🗸🗸
health clinics and federally qualified waiver guidance PHE declaration
health centers
Medical staff for ambulatory surgical Section 1135 blanket End of the COVID-19 -
centers waiver guidance PHE declaration
Physician services at hospitals, Section 1135 blanket End of the COVID-19 🗸🗸
psychiatric hospitals, and critical access waiver guidance PHE declaration
hospitals
Nursing services for ambulatory surgical Section 1135 blanket End of the COVID-19 -
centers waiver guidance PHE declaration
Waive requirement for hospices to use Section 1135 blanket End of the COVID-19 -
volunteers waiver guidance PHE declaration
Page 36 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
Appendix I: Summary of Medicare Waivers and
Flexibilities CMS Issued to Sustain Workforce
Capacity
Category of waiver Source of waiver Change targets
or flexibility Title of waiver or flexibility or flexibility End date rural areas
Revisions to moonlighting regulations 85 Fed. Reg. 19230 Not applicable; no end -
(Apr. 6, 2020) date specified
85 Fed. Reg. 84472
(Dec. 28, 2020)
Modification of 60-day limit for substitute Section 1135 blanket No more than 60 days -
billing arrangements waiver guidance after the COVID-19
PHE ends
Legend:
🗸🗸 = All or a portion of this flexibility applies specifically to providers in rural areas.
- = This flexibility does not apply specifically to providers in rural areas.
Source: GAO analysis of information from Centers for Medicare & Medicaid Services. | GAO-23-105494
Note: During the COVID-19 public health emergency, the Department of Health and Human Services
made widespread use of authority under section 1135 of the Social Security Act to waive or modify
certain Medicare requirements to maintain beneficiary access to care. See 42 U.S.C. § 1320b-5. For
purposes of this report, we collectively refer to these waivers and other changes to requirements
made in response to COVID-19 as “waivers and flexibilities.” In addition, we use the term “providers”
to include physicians and other clinicians or health care workers; DMEPOS suppliers; home health
agencies; hospice organizations; and non-institutional providers such as ambulances or other free-
standing facilities, such as clinical laboratories, unless otherwise specified. The Secretary of Health
and Human Services first declared the COVID-19 public health emergency on January 31, 2020, and
renewed this determination 11 times. The public health emergency was most recently renewed on
October 13, 2022, and expires January 11, 2023. Many of the waivers and flexibilities have an
effective date of March 1, 2020. Section 1135 blanket waiver guidance includes CMS, COVID-19
Emergency Declaration Blanket Waivers for Health Care Providers (Baltimore, M.D., March 30, 2020)
and CMS, Durable Medical Equipment, Prosthetics, Orthotics and Supplies: CMS Flexibilities to Fight
COVID-19 (Baltimore, M.D.).
a
This change was updated to keep portions of the change in place indefinitely.
Page 37 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
Appendix II: Summary of Physicians and
Appendix II: Summary of Physicians and Other
Clinicians Who Enrolled in Medicare under
Waivers and Flexibilities
Other Clinicians Who Enrolled in Medicare
under Waivers and Flexibilities
Table 6: Medicare Physician Enrollments by Specialty, March 2020 through March
2022
Specialty Number of enrollments
Internal medicine 13,196
Family medicine 9,510
Emergency medicine 6,555
Pediatric medicine 3,766
Anesthesiology 3,750
Diagnostic radiology 3,710
Psychiatry 3,114
Obstetrics/gynecology 2,787
General surgery 2,522
Hospitalist 2,296
Chiropractic 1,973
Optometry 1,921
Neurology 1,863
Orthopedic surgery 1,863
Cardiovascular disease (cardiology) 1,223
Dentist 1,197
All other specialties 16,376
Total 77,622
Source: GAO analysis of information from Centers for Medicare & Medicaid Services. | GAO-23-105494
Page 38 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
Appendix II: Summary of Physicians and Other
Clinicians Who Enrolled in Medicare under
Waivers and Flexibilities
Table 7: Medicare Enrollment for Clinicians Other than Physicians by Specialty,
March 2020 through March 2022
Clinician specialty Number of enrollments
Nurse practitioner 29,378
Physician assistant 14,921
Physical therapist in private practice 9,291
Clinical social worker 7,306
Certified registered nurse anesthetist 5,266
Clinical psychologist 2,604
Occupational therapist in private practice 2,223
Qualified speech language pathologist 1,346
Registered dietitian or nutrition professional 1,181
Qualified audiologist 601
All other clinicians 1,127
Total 75,244
Source: GAO analysis of information from Centers for Medicare & Medicaid Services. | GAO-23-105494
Page 39 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
Appendix III: Comments from the
Appendix III: Comments from the Department
of Health and Human Services
Department of Health and Human Services
Page 40 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
Appendix III: Comments from the Department
of Health and Human Services
Page 41 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
Appendix III: Comments from the Department
of Health and Human Services
Page 42 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
Appendix III: Comments from the Department
of Health and Human Services
Page 43 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
Appendix III: Comments from the Department
of Health and Human Services
Page 44 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
Appendix IV: GAO Contact and Staff
Appendix IV: GAO Contact and Staff
Acknowledgments
Acknowledgments
Leslie V. Gordon, (202) 512-7114 or GordonLV@gao.gov
GAO Contact
In addition to the contact named above, Iola D’Souza (Assistant Director),
Staff Russell Voth (Analyst in Charge), Gabrielle Crossnoe, Jack Knauer, and
Acknowledgments Dan Ries made key contributions to this report. Also contributing were
Sam Amrhein, Sandra George, Jennifer Rudisill, and Ethiene Salgado-
Rodriguez.
(105494)
Page 45 GAO-23-105494 Medicare Provider Waivers Due to COVID-19
The Government Accountability Office, the audit, evaluation, and investigative
GAO’s Mission arm of Congress, exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability of the
federal government for the American people. GAO examines the use of public
funds; evaluates federal programs and policies; and provides analyses,
recommendations, and other assistance to help Congress make informed
oversight, policy, and funding decisions. GAO’s commitment to good government
is reflected in its core values of accountability, integrity, and reliability.
The fastest and easiest way to obtain copies of GAO documents at no cost is
Obtaining Copies of through our website. Each weekday afternoon, GAO posts on its website newly
GAO Reports and released reports, testimony, and correspondence. You can also subscribe to
GAO’s email updates to receive notification of newly posted products.
Testimony
Order by Phone The price of each GAO publication reflects GAO’s actual cost of production and
distribution and depends on the number of pages in the publication and whether
the publication is printed in color or black and white. Pricing and ordering
information is posted on GAO’s website, https://www.gao.gov/ordering.htm.
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card, MasterCard,
Visa, check, or money order. Call for additional information.
Connect with GAO on Facebook, Flickr, Twitter, and YouTube.
Connect with GAO Subscribe to our RSS Feeds or Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.
Contact FraudNet:
To Report Fraud,
Website: https://www.gao.gov/about/what-gao-does/fraudnet
Waste, and Abuse in
Automated answering system: (800) 424-5454 or (202) 512-7700
Federal Programs
A. Nicole Clowers, Managing Director, ClowersA@gao.gov, (202) 512-4400, U.S.
Congressional Government Accountability Office, 441 G Street NW, Room 7125, Washington,
Relations DC 20548
Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800
Public Affairs U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, DC 20548
Stephen J. Sanford, Managing Director, spel@gao.gov, (202) 512-4707
Strategic Planning and U.S. Government Accountability Office, 441 G Street NW, Room 7814,
External Liaison Washington, DC 20548
Please Print on Recycled Paper.
File and source
- File
- gao-23-105494.pdf
- Size
- 1,159,025 bytes
- SHA-256
- 49fca6d9f6f00b8d2a4565dc3e2fba8fcc5e20b84c42b94b49e122746bb685a6
- Our copy
- gao-23-105494.pdf
- Original
- www.gao.gov