Audit of the Office of Medicaid (MassHealth)—Review of Durable Medical Equipment Providers Objectives, Scope, and Methodology

An overview of the purpose and process of auditing the Office of Medicaid (MassHealth)—Review of Durable Medical Equipment Providers.

Overview

In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor (OSA) has conducted a performance audit of certain activities of MassHealth for the period January 1, 2021 through December 31, 2023.

We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Below is a list of our audit objectives, indicating each question we intended our audit to answer; the conclusion we reached regarding each objective; and, if applicable, where each objective is discussed in the audit findings.

Objective	Conclusion
Did MassHealth ensure that durable medical equipment (DME) was not ordered for its members by providers who are excluded from participating in the Medicaid program?	No; see Findings 1 and 2
Did MassHealth ensure that it did not pay for DME for deceased members?	No; see Finding 3

To achieve our audit objectives, we gained an understanding of the internal control environment related to the objectives by reviewing applicable MassHealth policies and procedures related to ensuring that billing providers and ordering providers are not excluded from participating in Medicaid, as well as ensuring that DME is not ordered for MassHealth members who are deceased. In addition, we performed the procedures described below to obtain sufficient, appropriate audit evidence to address the audit objective.

DME Ordering by Excluded Providers

To determine whether MassHealth ensured that DME was not ordered for members by providers excluded from participating in the Medicaid program, we obtained data from the Medicaid Management Information System (MMIS) regarding all 2,282,131 paid claims for DME during the audit period. We filtered the data to identify 152,592 DME claims that did not have an associated ordering provider name and national provider identifier (NPI). We targeted the top five DME providers who did not include the ordering provider’s name and NPI on their associated DME claims. We then stratified the targeted population from these five DME providers into two strata, which consisted of paid claims under $1,000 (Stratum 1) and paid claims of $1,000 or more (Stratum 2). We selected a random, statistical¹ sample of 131 out of 152,592 claims in Stratum 1 and a nonstatistical² sample of 60 out of 975 claims in Stratum 2. For our statistical sample in Stratum 1, we used a 90% confidence level,³ a 50% expected error rate,⁴ and a 15% desired precision range.⁵ We projected an error for the sampled claims in Stratum 1 to the 152,592 claims in the population for Stratum 1 to estimate a potential overpayment. We did not project an error rate for claims in the sample for Stratum 2 because we used nonstatistical sampling.

For the claims selected from both strata, we inspected order forms for DME to determine whether they were signed by a MassHealth provider and included the provider’s NPI. We also inspected the associated MassHealth claim forms to determine whether the ordering provider’s NPI was included on the MassHealth claim. We cross-referenced the ordering provider’s NPI to the US Department of Health and Human Services Office of Inspector General’s (HHS OIG’s) List of Excluded Individuals and Entities (LEIE) and MassHealth’s Excluded Provider List to determine whether the ordering providers for the sampled claims were eligible to order DME for MassHealth members. See Finding 1 for more information.

For the remaining 2,071,727 DME claims that included the ordering providers’ names and NPIs, we matched MMIS data to HHS OIG’s LEIE and MassHealth’s Excluded Provider List and determined whether the ordering providers were excluded on or before the date of service by examining exclusion letters sent by MassHealth to the ordering provider. See Finding 2 for more information. 

DME for Deceased Members

To determine whether MassHealth ensured that it did not pay for DME ordered for members who were deceased, we provided the US Department of the Treasury’s Do Not Pay (DNP) service with an MMIS data extract of 2,282,131 DME claims paid by MassHealth during the audit period. DNP matched these claims to the following databases to determine whether any of the claims were paid by MassHealth after the member’s date of death, according to its website:

Database Name		Description of Data Source
American InfoSource (AIS) Obituary & Probate – Commercial	Contains obituary and probate information on deceased individuals obtained from over 3,000 funeral homes, thousands of newspapers, and county-level probate records
Death Master File Full (DMF-Full)	Contains records of deaths reported to the Social Security Administration (SSA). The deaths reported to SSA come from many sources, including family members, funeral homes, financial institutions, postal authorities, state information, and other federal agencies
Department of Defense Death Data (DOD) – Public	Contains information on active-duty U.S. military and Reserves regarding confirmed or presumed deaths
Department of State Death Data (DOS) – Public	Contains records of American Citizens who are deceased or presumed deceased while abroad, as reported by US embassies or consulates upon its receipt of a foreign death certificate or finding of death by a local competent authority
Electronic Verification of Vital Events Fact of Death (EVVE FOD)  Commercial	Contains information about death certificates contained within the vital records databases of participating states and jurisdictions

Source: DNP (https://fiscal.treasury.gov/dnp/search.html)

DNP’s death matching identified 11,332 MassHealth members in our population with dates of death. We filtered this result to identify 211 MassHealth members with two or more DME claims paid after their dates of death. We then verified the dates of death provided by DNP for 211 MassHealth members by performing internet searches to cross-reference these dates of death with obituary records from newspapers and funeral homes. We cross-referenced four data points (the names, dates of birth, and places of residence that we obtained from MMIS, as well as the dates of death provided by DNP) with obituary records that we found online. See Finding 3 for more information.

Data Reliability Assessment

To test the reliability of the MMIS data, we relied on the work performed by OSA in a separate project completed in 2023 that tested certain information system controls in MMIS. As part of this work, OSA reviewed existing information, tested selected system controls, and interviewed agency officials who were knowledgeable about the data. Additionally, we performed validity and integrity tests on all claim data from the audit period, including (1) testing for blank fields, (2) scanning for duplicate records, and (3) looking for dates outside the audit period. We also matched a judgmental sample of 40 paid DME claims to their corresponding hardcopy claim forms.

Based on the results of the data reliability assessment procedures described above, we determined that the information we obtained during the course of our audit was sufficiently reliable for the purposes of our audit.

1.    Auditors use statistical sampling to select items for audit testing when a population is large (usually over 1,000) and contains similar items. Auditors generally use a statistics software program to choose a random sample when statistical sampling is used. The results of testing using statistical sampling, unlike those from judgmental sampling, can usually be used to make conclusions or projections about entire populations.

2.    Auditors use nonstatistical sampling to select items for audit testing when a population is very small, the population items are not similar enough, or there are specific items in the population that the auditors want to review.

3.    Confidence level is a mathematically based measure of the auditor’s assurance that the sample results (statistic) are representative of the population (parameter), expressed as a percentage.

4.    Expected error rate is the number of errors that are expected in the population, expressed as a percentage. It is based on the auditor’s knowledge of factors such as prior year results, the understanding of controls gained in planning, or a probe sample.

5.    Desired precision range is the range of likely values within which the true population value should lie; also called confidence interval. For example, if the interval is 90%, the auditor will set an upper confidence limit and a lower confidence where 90% of transactions fall within those limits.

Date published:	October 30, 2025