HHS-OIG Urges CMS & MA Organziations Increase Efforts to Prevent Durable Medical Equipment Fraud

Posted by Steve Alder

Each year, millions of taxpayers’ dollars are lost to Medicare and Medicaid fraud, with fraud related to durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) a major problem. In one case alone, the largest ever healthcare fraud loss charged by the Department of Justice, an 11-person, Russia-based transnational network attempted to defraud Medicare out of $10.6 billion through fraudulent DMEPOS billings.

DMEPOS-related healthcare fraud is a longstanding problem for the Original Medicare program; however, HHS-OIG has identified fraud schemes targeting Medicare Advantage and warns that DMEPOS fraud could put the program at risk. Currently, more than half of all Medicare recipients, around 34 million individuals, are enrolled in the Medicare Advantage (MA) program. The MA program involves the government paying private health insurance companies – MA organizations – to provide coverage to Medicare enrollees. MA organizations may create networks of providers and DMEPOS suppliers, and contract with those organizations. Other suppliers can provide DMEPOS that do not contract with MA organizations – out-of-network suppliers. The responsibility for preventing fraudulent DMEPOS Medicare Advantage billing by in-network and out-of-network DMEPOS suppliers is shared by the CMS and MA organizations.

An HHS-OIG investigation looked at six MA organizations to examine fraud risk and the steps the CMS and MA organizations are taking to prevent DMEPOS-related healthcare fraud. The investigation identified several gaps in screening, which could allow fraudulent suppliers to bill the MA program. The six MA organizations provide coverage for around two-thirds of all MA enrollees and manage more than 21,000 DMEPOS suppliers. Around 8,000 suppliers billed in-network, and the remaining 13,000 always billed out-of-network.

While the Original Medicare program required all suppliers to be enrolled in Medicare, under the MA program, MA organizations can allow some DMEPOS suppliers that are not enrolled in Medicare to bill them. MA organizations conduct some checks of all in-network suppliers; however, fewer checks are conducted of out-of-network suppliers, and with limited scrutiny of out-of-network DMEPOS suppliers, there is an increased risk of fraudulent billing.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

For instance, some checks are required of all in-network DMEPOS suppliers, such as verifying that a supplier has a state license, should one be required; verifying that a supplier has been reviewed and approved by an accrediting body or meets the standards of the MA organization; and confirming that a supplier is not on the CMS Preclusion List and has not been excluded from participation in healthcare programs by HHS-OIG. Some MA organizations require additional checks on in-network suppliers.

The required checks for out-of-network DMEPOS suppliers are far less stringent. While checks must be made to ensure that they are not on the CMS Preclusion List, out-of-network suppliers are not required to be checked to ensure that they meet State licensure requirements or that the suppliers are accredited. Only three of the six MA organizations said they check to ensure that suppliers have appropriate State licenses.

Screening gaps were also identified at the CMS. Unlike Original Medicare, the CMS does not screen all DMEPOS suppliers that bill Medicare Advantage, because not all DMEPOS suppliers are enrolled in Medicare. In order to enrol in Medicare, screening checks must be successfully completed. Without that screening process, there is an increased risk of fraud. CMS relies on the Preclusion List for preventing fraud; however, HHS-OIG warned that using the Preclusion List is only effective at reactively stopping suppliers from fraudulently billing. Fraudulent billing can be stopped once it has been identified, but it does not proactively prevent fraudulent billing. Further, CMS was not using the Preclusion List to its full extent.

According to HHS-OIG, the average amount billed per enrollee for orthotics by in-network suppliers was $210, whereas the average amount billed by out-of-network non-enrolled suppliers was $1,399 – seven times more than in-network suppliers. In HHS-OIG interviews with MA organizations, three said DMEPOS fraud schemes impacting their plans often involved out-of-network suppliers, and two said out-of-network suppliers accounted for almost all MA fraud schemes.

Further, out-of-network suppliers can rapidly start submitting claims without the required checks involved in enrolling in Medicare. CMS staff reported that “bad actors can incorporate a DMEPOS company and get a National Provider Identifier within a few days, which allows them to start billing MAOs almost immediately.” In some cases, “suppliers pop up relatively quickly, bill fast, and then exit.”

HHS-OIG said the most effective way of combating DMEPOS-related fraud is to prevent bad actors from billing in the first place, and as such, preventative efforts need to be stepped up by both the CMS and MA organizations. HHS-OIG recommends that MA organizations strengthen checks of out-of-network DMEPOS suppliers, and strengthen the use of the Preclusion List to prevent fraudulent DMEPOS suppliers from billing the MA program. HHS-OIG recommended that the CMS require all DMEPOS suppliers that bill Medicare Advantage to be enrolled in Medicare, and if not permitted under current law, to seek statutory authority to do so. The CMS concurred with all recommendations.

The post HHS-OIG Urges CMS & MA Organziations Increase Efforts to Prevent Durable Medical Equipment Fraud appeared first on The HIPAA Journal.

Democratic Senators Reintroduce the Health Infrastructure Security and Accountability Act

Posted by Steve Alder

On September 17, 2026, two Democratic Senators reintroduced the Health Infrastructure Security and Accountability Act, which seeks to improve cybersecurity standards for the U.S. healthcare system and make funds available to help rural and underserved hospitals invest in essential cybersecurity measures.

The bill was reintroduced by Sens. Mark R. Warner (D-VA) and Ron Wyden (D-OR), following its initial introduction in the 118th Congress 2D Session on September 25, 2024. When the bill was first introduced, 394 large hacking-related healthcare data breaches had been reported to the Department of Health and Human Services Office for Civil Rights (OCR), involving the protected health information of 43 million Americans.

At the time, the senators explained that cyberattacks are delaying and disrupting patient care, harming patient health and national security, and putting Americans at risk of identity theft and fraud. “These hacks are entirely preventable and are the direct result of lax cybersecurity practices by health care providers and their business partners,” explained the Senators.

The situation has only worsened in the two years since the bill was first introduced. The OCR breach portal lists year-to-date figures (Jan 1 – Aug 31) of 426 hacking-related breaches, involving the protected health information of 73 million Americans. That’s an 8% increase in hacking-related data breaches and a 70% increase in affected individuals.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

On January 24, 2024, OCR published two sets of voluntary cybersecurity performance goals (CPGs) for the healthcare and public health (HPH) sector – Essential and Enhanced – that consist of high-impact measures that should be adopted by healthcare organizations to strengthen and mature their cybersecurity programs. As predicted by OCR at the time, voluntary goals alone would not be enough to drive the behavioral changes needed across the sector to improve cybersecurity.

The CPGs were followed by a proposed update to the HIPAA Security Rule, which mandates significant additional cybersecurity requirements. The proposed update has proven hugely unpopular, with industry groups and health systems calling for the proposed rule to be scrapped. A final rule has been delayed until July 2027, although a final decision about whether a final rule will actually be released has yet to be made by the Trump administration. Part of the problem, especially for rural and other low-resource healthcare providers, is a lack of funding to make the necessary cybersecurity improvements, which is something that the Health Infrastructure Security and Accountability Act seeks to address.

“As cybercriminals ramp up their attacks on hospitals and health care providers, it’s becoming increasingly clear that voluntary standards are not enough to protect Americans’ health, safety, and privacy,” explained Sen. Warner. “This legislation would establish strong, commonsense cybersecurity protocols for health care entities, while also getting resources to rural and underserved hospitals to strengthen their defenses and protect the patients who depend on them.”

As the Senators explained, the U.S. health care system is particularly at risk for cyberattacks due to its size, technological dependence, collection of sensitive personal information, and unique vulnerability to disruptions. Healthcare organizations are viewed as low-hanging fruit, and attacks can be highly profitable for cybercriminals. “The frequency and sophistication of cyberattacks has dramatically increased in every part of the health care system, and will only grow,” said Sen. Wyden. “Our bill creates national cybersecurity standards for health care providers and devotes resources, especially in rural and underserved areas, to ensure every American’s medical information is secure. Congress cannot wait to act until another catastrophic cyberattack compromises the safety and privacy of American families’ most personal information.”

The 2026 Health Infrastructure Security and Accountability Act remains largely unchanged from the 2024 version, other than shifting the timeline forward by two years. The key requirements of the bill are:

  • Mandatory minimum cybersecurity standards for covered entities and business associates, established, enforced, and updated by the HHS. Updates are required at least every two years.
  • Heightened cybersecurity standards for systemically important entities and entities critical to national security.
  • Continuity/recovery plans for all covered entities for technical failures, disruptive cyber events, and natural disasters, and stress tests to evaluate whether the entity has the capabilities to recover essential functions.
  • Written annual statements signed by the chief executive officer and chief information security officer attesting that the company is compliant with applicable security standards.
  • Mandatory annual security risk analyses, including specific assessments of the extent to which the entity is exposed to risk through its business associates.
  • Independent audits of covered entities’ security measures to assess compliance with the HHS’s CPGs.
  • Annual HHS audits of at least 20 HIPAA-regulated entities to assess data security practices, focused on those of systemic importance.
  • Increased financial penalties under HIPAA for failing to meet security requirements – A minimum $500 penalty for no knowledge; $5,000 for reasonable cause; $50,000 for willful neglect (corrected); and $250,000 for willful neglect (uncorrected).
  • A government investment of $1.3 billion to help hospitals strengthen cybersecurity: $800 million in up-front investment for hospitals in rural and underserved urban communities to adopt the essential cybersecurity goals, and $500 million in incentives available to all hospitals to adopt the enhanced CPGs.
  • Medicare accelerated and advanced payments in response to cybersecurity incidents.

The post Democratic Senators Reintroduce the Health Infrastructure Security and Accountability Act appeared first on The HIPAA Journal.