TRICARE West Provider Roster Exclusions

Background: To address the pandemic, TRICARE, the Defense Health Agency (DHA) insurance plan, expanded their civilian provider network by 30.1%. In 2022, the DHA Annual Report stated that TRICARE provider directories are only 80% accurate. Unlike Medicare, the DHA does not release National Provider Identification (NPI) numbers on the roster. As a result, TRICARE’s 9.6 million beneficiaries have few means to verify their doctor's information. Since 2013, the Department of Health and Human Services' Office of the Inspector General (OIG) has excluded 17,706 physicians and other providers from federal health programs due to billing fraud, neglect, drug-related convictions and other offenses. These providers and their NPIs are listed on the OIG's Excluded Individuals and Entities (OIG-LEIE). Patients who receive care from excluded providers experience a higher risk of mortality rates.

Objective: We sought to evaluate if the TRICARE provider directory could be matched with government exclusion or sanction lists.

Methods: Between January 1-31, 2023, we used TRICARE West's provider directory to search providers within a 5-mile radius of 798 zip codes (38 per state, ≥10,000 residents each, randomly selected). We then copied and pasted first and last names, business names, address, phone, fax, degree type, practice specialty and active/closed status into a CSV. We cross-referenced the search results against US and state databases for medical and criminal misconduct, including the: the OIG-LEIE and GSA-SAM exclusion lists (GSA-SAM), the HHS OCR HIPAA Breach Report (HIPAA), 15/21 available State Medicaid Exclusion Lists (SME), the International Trade Administration’s Consolidated Screening List (CSL), 3 separate FDA Debarment Lists (FDA), the FBI List of January 6 Federal Defendants (FBI), and the OIG-HHS List of Fugitives (FUG).

Results: Our search yielded 111,619 raw results. 54 zip codes yielded no data. After removing 72,156 duplicate entries, closed offices and non-TRICARE West locations (64.65%), we yielded a baseline sample list of 39,463 active provider names. Within the sample group, there were 2,398 total matches (6.08%) against the exclusion and sanction databases, including 2,197 on the OIG List of Excluded Individuals and Entities (OIG-LEIE), 2,311 on the GSA-SAM, 2 on the HIPAA, 54 on the State, 69 on the CSL, 3 on the FDA, 53 on the FBI, and 10 on the FUG.

Conclusions: Thousands of TRICARE providers merit further scrutiny by law enforcement. In accordance with NIST 800, the DHA needs to implement a comprehensive Insider Threat Management Model, robust enforcement of the False Claims Act, and mandatory security risk assessments (SRA). These are the views of the author, not the Department of Defense or the US government.

The data have been mapped here:

https://www.google.com/maps/d/u/0/edit?mid=1K6rL2j2BUU6QJyhlwZZfD83YAGYsp-M&usp=sharing

背景：为应对疫情，美国国防部卫生机构（DHA）旗下的医疗保险计划TRICARE，将其民间医疗服务提供者网络扩大了30.1%。根据2022年的DHA年度报告，TRICARE的医疗服务提供者目录准确率仅为80%。与医疗保险不同，DHA并未在其名单上公布国家医疗服务提供者识别码（NPI）。因此，TRICARE的960万受益者难以核实其医生信息。自2013年以来，美国卫生与公众服务部监察长办公室（OIG）因账单欺诈、疏忽、与药物相关的定罪及其他违规行为，已将17,706名医生及其他提供者排除在联邦健康项目之外。这些提供者和他们的NPI已列入OIG的排除个人和实体名单（OIG-LEIE）。接受被排除提供者医疗服务的患者，其死亡率风险更高。
目标：本研究旨在评估TRICARE提供者目录是否可以与政府排除或制裁名单相匹配。
方法：在2023年1月1日至1月31日期间，我们使用TRICARE西部的提供者目录，在798个邮政编码（每个州38个，居民数量均超过10,000人，随机选取）5英里范围内搜索提供者。然后，我们将姓名、公司名称、地址、电话、传真、学位类型、专业实践和活跃/关闭状态复制粘贴到CSV文件中。我们将搜索结果与美国和各州数据库中的医疗和刑事不当行为进行交叉引用，包括OIG-LEIE和GSA-SAM排除名单（GSA-SAM）、HHS OCR HIPAA违规报告（HIPAA）、15/21个可用的州医疗补助排除名单（SME）、国际贸易管理局的统一筛查名单（CSL）、3个独立的FDA禁令名单（FDA）、FBI 1月6日联邦被告名单（FBI）以及OIG-HHS逃犯名单（FUG）。
结果：我们的搜索产生了111,619条原始结果。54个邮政编码没有数据。在删除72,156条重复条目、关闭的办公室和非TRICARE西部位置（64.65%）后，我们得到了一个基线样本名单，包含39,463个活跃提供者名称。在样本组中，共有2,398个（6.08%）与排除和制裁数据库匹配，包括2,197条在OIG排除个人和实体名单（OIG-LEIE）上，2,311条在GSA-SAM上，2条在HIPAA上，54条在州名单上，69条在CSL上，3条在FDA上，53条在FBI上，以及10条在FUG上。
结论：成千上万的TRICARE提供者需要执法部门进行进一步审查。根据NIST 800标准，DHA需要实施全面的内部威胁管理模型、强有力的虚假索赔法案执行以及强制性的安全风险评估（SRA）。这些观点仅代表作者个人观点，不代表国防部或美国政府。
数据已在此处映射：
https://www.google.com/maps/d/u/0/edit?mid=1K6rL2j2BUU6QJyhlwZZfD83YAGYsp-M&usp=sharing