FEDERAL EMPLOYEES HEALTH BENEFITS PROGRAM:

Report to Congressional Requesters

April 2026

GAO-26-108139

United States Government Accountability Office

A report to congressional requesters

Contact: Seto J. Bagdoyan at bagdoyans@gao.gov

What GAO Found

Limitations in control activities allowed potentially ineligible providers to participate in the Federal Employees Health Benefits (FEHB) program. The Office of Personnel Management (OPM) and its Office of the Inspector General (OIG) have a variety of control activities for identifying ineligible providers. However, GAO found limitations in these control activities. GAO’s data analyses identified FEHB claims from approximately 400 providers who were deceased and over 2,000 additional claims from providers who were excluded from federal programs. While such claims are a small proportion of annual FEHB claims, they represent a risk the agency could mitigate. Taking additional steps to identify providers who are deceased or excluded from other federal programs would help OPM and OPM OIG prevent fraud and improper payments in the FEHB program. For example, comparing death data with FEHB claims could help prevent improper payments or fraud in FEHB claims payments.

Selected FEHB carriers do not always comply with requirements for identifying and excluding suspended or debarred providers. GAO found that selected FEHB carriers—which operate health benefit plans—do not always notify patients that their providers are suspended or debarred, as required. Carriers also did not notify OPM OIG when providers may warrant suspension or debarment, as required by OPM OIG policy. Clarifying requirements would help OPM and OPM OIG ensure that patients are not exposed to risks related to suspended or debarred providers.

Why GAO Did This Study

The FEHB program is the largest employer-sponsored health insurance program in the United Sates. OPM is responsible for managing fraud and improper payment risks in the FEHB program, including risks associated with ineligible health care providers. Ineligible providers can increase costs and may pose safety risks to patients.

GAO was asked to review OPM’s efforts to manage provider-related fraud risks in the FEHB program. This report examines the extent to which (1) program control activities allow potentially ineligible providers to participate in the FEHB program; and (2) selected FEHB carriers comply with requirements for identifying and excluding suspended or debarred providers, among other objectives.

GAO performed analyses comparing FEHB claims data with various data sets indicating that providers may be ineligible, such as data on deceased providers or providers excluded from other federal programs. GAO also reviewed documents and interviewed officials from OPM, OPM OIG, and FEHB carriers. GAO compared this information with applicable regulations, guidelines, and federal standards for internal control.

What GAO Recommends

GAO is making 15 recommendations to OPM and OPM OIG, including that OPM improve control activities for identifying deceased providers and clarify requirements for notifying patients who have seen a suspended or debarred provider. OPM and OPM OIG concurred with all our recommendations.

 

 

 

 

 

CMS                Centers for Medicare & Medicaid Services

DMF                Death Master File

DNP                Do Not Pay

EIN                  Employer Identification Number

FEHB              Federal Employees Health Benefits

GSA                General Services Administration

HHS                Department of Health and Human Services

IDR                  Integrated Data Repository

IRS                  Internal Revenue Service

LEIE                List of Excluded Entities and Individuals

NPI                  National Provider Identifier

NTIS                National Technical Information Service

OIG                 Office of Inspector General

OMB                Office of Management and Budget

OPM                Office of Personnel Management

SAM                System for Award Management

SSA                 Social Security Administration

SSN                Social Security number

TIN                  Taxpayer Identification Number

April 29, 2026

The Honorable Ron Johnson
Chairman
Permanent Subcommittee on Investigations
Committee on Homeland Security and Governmental Affairs
United States Senate

The Honorable Rick Scott
United States Senate

The Federal Employees Health Benefits (FEHB) program is the largest employer-sponsored health insurance program in the United States. The FEHB program provided health care benefits to more than 8.2 million members—federal employees, eligible family members, retired federal employees, and other eligible individuals. The cost to the federal government and members was about $70 billion in fiscal year 2025. The Office of Personnel Management (OPM) administers the FEHB program and contracts with qualified health insurance carriers to provide health care coverage to FEHB members.

According to OPM, there were over 2 million providers contracted to provide services with FEHB carriers as of August 2025. This includes doctors, health care facilities, durable medical equipment suppliers, and others. Federal law, regulations, and OPM’s contracts with insurance carriers establish certain requirements related to provider eligibility, such as not being suspended or debarred from participating in the FEHB program.[1] OPM has delegated responsibility for enforcement of the FEHB suspension and debarment program to the OPM Office of the Inspector General (OIG).

In July 2025, we found that OPM’s fraud risk assessment did not include fraud risks related to ineligible providers in the FEHB program.[2] We recommended that the agency design and conduct a robust fraud risk assessment that will identify inherent fraud risks facing the FEHB program, including the risk of ineligible providers. Fraud in the FEHB program can affect the government, members, and health insurance carriers by increasing program costs and posing a risk to member health. As of January 2026, all six recommendations we made to OPM remain open. Furthermore, in December 2022, we also found that OPM estimated improper payments associated with ineligible family members could cost the FEHB program up to approximately $1 billion per year. We made four recommendations to improve OPM’s monitoring and assessment of fraud and improper payment risks. As of January 2026, OPM has implemented two of the four recommendations we made in 2022.

You asked us to review OPM’s efforts to manage provider-related fraud risks in the FEHB program. This report examines the extent to which (1) program control activities allow potentially ineligible providers to participate in the FEHB program;[3] (2) OPM OIG information-sharing practices comply with certain federal regulations, so that suspended or debarred providers do not participate in other federal programs; (3) selected FEHB carriers comply with requirements for identifying and excluding suspended or debarred providers; and (4) FEHB program rules and guidelines create opportunities for fraud and abuse.

To examine the extent to which program control activities allow potentially ineligible providers to participate in the FEHB program, we obtained FEHB claims data for 2022—the most recent available data when we began our work—and compared it with various data sets indicating that providers may be ineligible. Specifically, we compared FEHB claims data from selected carriers with data on deceased individuals, incarcerated individuals, and providers that are excluded from other federal programs.[4] We obtained the list of providers that are excluded from other federal programs on the Department of Health and Human Services (HHS) OIG List of Excluded Individuals and Entities (LEIE) and the list of providers suspended or debarred from participating in the FEHB program from OPM OIG. We compared the FEHB claims data and OPM OIG’s suspension and debarment list with LEIE to examine OPM OIG’s policies and practices for identifying providers excluded from other federal programs and including them on their suspension and debarment list. We also analyzed these data to determine whether information, such as Taxpayer Identification Numbers (TIN), could be used to identify and exclude potentially ineligible providers.[5] We also compared the information we gathered on FEHB claims data and the systems that house the data with Standards for Internal Control in the Federal Government.[6]

Further, we analyzed a selection of four nongeneralizable claims involving deceased providers at one FEHB carrier to provide illustrative examples of the extent to which program control activities allowed potentially ineligible providers to participate in the FEHB program.

To examine the extent to which OPM OIG information-sharing practices comply with certain federal regulations so that suspended or debarred providers do not participate in other federal programs, we obtained the list of providers suspended or debarred from participating in the FEHB program from OPM OIG. We also obtained data from the General Service Administration’s (GSA) System for Award Management (SAM) on providers excluded from other federal programs.[7] We compared these data sets to identify OPM OIG suspension and debarment records that were not accurately reflected on the SAM exclusions list. We also obtained documents and interviewed OPM OIG officials to determine whether OPM OIG implemented a process to share information on these suspended or debarred providers with GSA’s SAM, in accordance with federal regulations.

To examine the extent to which selected FEHB carriers comply with requirements for identifying and excluding suspended or debarred providers, and the extent to which FEHB program rules and guidelines create opportunities for fraud and abuse, we reviewed documentation and interviewed officials from OPM, OPM OIG, and a selection of four FEHB health insurance carriers about their policies and processes for excluding providers from participating in the FEHB program and health insurance plans.[8]

As part of this work, we also reviewed a nongeneralizable selection of 13 claims at one FEHB carrier to identify illustrative examples of carrier compliance with FEHB regulations and guidelines, as well as an example of how FEHB program rules and guidelines create opportunities for fraud and abuse. We selected these nongeneralizable claims to include variation in whether the claim was paid or denied, as well as whether the FEHB carrier’s claims data indicated there was an exception or waiver related to the claim. For claims that were paid, we selected claims with payment amounts greater than, or equal to, $100 that were made to providers.[9]

As part of our examination of the extent to which FEHB program rules and policies create opportunities for fraud and abuse, we also posed as new FEHB patients and conducted covert calls to suspended or debarred providers with a history of billing the FEHB program to ask if they accepted FEHB insurance. The results of our 26 covert calls are illustrative and not generalizable to the population of providers excluded from participation in the FEHB program.

For the third and fourth objectives, we also compared the information we gathered with program rules, policy, and guidance, as well as a leading practice for managing fraud risks from A Framework for Managing Fraud Risks in Federal Programs (Fraud Risk Framework).[10] We also compared the information we gathered with Standards for Internal Control in the Federal Government.[11] Additional details on our scope and methodology appear in appendix I.

We assessed the reliability of all the data sources used in our analysis by performing electronic testing, reviewing relevant documentation, and interviewing knowledgeable OPM OIG and FEHB carrier officials. We determined that the data sources we analyzed were sufficiently reliable for the purposes of our audit objectives.

We conducted this performance audit from June 2023 to April 2026 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We conducted our related investigative work in accordance with investigation standards prescribed by the Council of the Inspectors General on Integrity and Efficiency. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Background

FEHB Program and Health Insurance Carriers

Established in 1960, the FEHB program provides health insurance benefits to federal employees, retired federal employees, other eligible individuals, and their eligible family members. OPM administers the FEHB program and contracts with qualified health insurance carriers to provide health care coverage to FEHB members, among other responsibilities. These carriers operate health benefit plans that process insurance claims for health care goods and services provided to FEHB members. For the 2024 plan year, the FEHB program had 67 contracts with 52 carriers offering a total of 157 plan choices, according to OPM. In August 2025, OPM officials told us that there are over 2 million providers contracted to provide services with FEHB carriers.

FEHB Program Provider Eligibility

Federal law, regulations, and OPM’s contracts with insurance carriers establish specific requirements to ensure provider eligibility for providing health care goods and services to FEHB program members. For example, to be eligible as a provider to submit claims under the FEHB program, providers may not be actively suspended or debarred by OPM. Federal law establishes a list of reasons for which suspension and debarment must be, or may be, imposed. Reasons include, but are not limited to, a provider having certain convictions, a provider losing a license to provide health care services or supplies, or an entity being owned or controlled by a sanctioned individual.[12] Additionally, OPM OIG officials told us that claims should not be paid to a provider who is deceased or incarcerated at the time of service because these providers cannot provide health care to FEHB program members.

Debarring or suspending certain health care providers protects the integrity of the FEHB program, as well as the health care interests of FEHB program members, according to OPM. OPM suspends or debars health care providers from participating in the FEHB program under various authorities.[13] For example, federal statute stipulates that OPM must debar a health care provider if they have been convicted of certain crimes in connection with the delivery of a health care service or supply, such as fraud or other financial misconduct and abuse of patients, among other things.[14]

OPM may exercise discretion to debar providers in other circumstances, such as when a provider’s license to provide health care services or supplies has been revoked or suspended for certain reasons.[15] In doing so, OPM and OPM OIG may consider information from, and share information with, other exclusionary lists, including HHS OIG’s LEIE and GSA’s SAM exclusions list.

·       LEIE contains a record of those individuals and entities who are prohibited from participating in federal health care programs, such as Medicare, Medicaid, and any other federally funded health care program, other than the FEHB program.[16] Generally, OPM is required to debar a provider that has been excluded by another agency.[17] However, according to OPM, the agency has the discretion not to debar a provider excluded by HHS OIG, if the action is not pertinent to the FEHB program.

·       The SAM exclusions list is a centralized list of individuals and entities excluded or debarred from doing business with the federal government.[18] Each agency, including OPM, is responsible for ensuring that any entity suspended or debarred by the agency is reflected in the SAM exclusions list.[19] OPM OIG’s suspension and debarment list is available to the public through the SAM exclusions list.

Appendix II contains additional information on grounds for suspension and debarment from the FEHB program.

According to OPM, the agency delegated responsibility for enforcement of its suspension and debarment program to OPM OIG. In carrying out these responsibilities, OPM OIG suspends and debars ineligible providers and maintains a list of suspended or debarred providers.[20] OPM OIG shares its list of suspended or debarred providers with FEHB health insurance carriers and directs carriers to use the list to identify suspended or debarred providers in the carriers’ information systems. Once a provider is suspended or debarred, federal laws and regulations require insurance carriers to notify the FEHB program members who have obtained items or services from the suspended or debarred provider within 1 year of the date of the suspension or debarment.[21]

Carriers may not pay suspended or debarred providers, unless the providers meet the conditions for an exception or waiver. For example, a suspended or debarred provider may receive FEHB program payments for certain emergency services or when a patient is unaware of the provider’s suspension or debarment at the time of service.[22] Similarly, OPM may grant a waiver for providers who are the sole source of essential specialized services in a community, among other conditions.[23]

Figure 1 contains additional information on entities that participate in the FEHB program, including the suspension and debarment program.

Improper Payments and Fraud Risk Management

While improper payments and fraud are related concepts, they do not mean the same thing.[24]

·       Improper payments are payments that should not have been made or were made in the incorrect amount—that is, an overpayment or underpayment—under a statutory, contractual, administrative, or other legally applicable requirement.[25] While all fraudulent payments are considered improper, not all improper payments are due to fraud, as they can also be a result of mismanagement, error, or abuse.[26] Within the FEHB program, improper payments include payments for premiums or claims for ineligible members and providers, according to OPM officials.[27]

·       Fraud is obtaining something of value through willful misrepresentation. Fraud can have impacts other than direct financial loss to the government. In the context of the FEHB program, the nonfinancial impact of fraud includes health and safety risks to patients who receive services from ineligible providers.

GAO’s Fraud Risk Framework provides a comprehensive set of key components, overarching concepts, and leading practices that guide agency managers when developing activities to combat fraud in a strategic, risk-based manner.[28] One of the leading practices highlighted in the Fraud Risk Framework is to design and implement specific control activities to prevent and detect fraud. In doing so, agencies should focus on fraud prevention, over detection and response, to avoid a “pay-and-chase” model, to the extent possible.[29]

Limitations in Control Activities Allowed Potentially Ineligible Providers to Participate in FEHB

We found that OPM faces fraud and improper payment risks to the government’s significant investment in the FEHB program due to limitations in control activities that allowed potentially ineligible providers to participate in FEHB. Specifically, we found limitations pertaining to

·       identifying deceased or incarcerated providers,

·       identifying providers excluded from other federal programs, and

·       providing information to FEHB carriers on provider identities.

Limitations in Control Activities for Identifying Deceased or Incarcerated Providers Allowed Potentially Ineligible Providers to Participate in the FEHB Program

Our analysis of calendar year 2022 FEHB claims data identified approximately 400 deceased providers who purportedly provided a service in the FEHB program at least 50 days after their reported date of death and received payment for that service. While not conclusive, this data analysis indicates a heightened risk of fraud and improper payments.

Our case studies also identified instances where a carrier paid FEHB claims supposedly after providers died. This carrier told us it did not routinely access death information, such as the Social Security Administration’s (SSA) publicly available Death Master File (DMF), to identify deceased providers.[30] Instead, the carrier relies on information from OPM OIG about suspended and debarred providers who become deceased, not eligible providers who become deceased.[31]

 

Case Study: FEHB Carrier Made Payments for Services Supposedly Rendered More than 300 Days After Provider’s Death A provider who specialized in family medicine died in February 2022. However, a carrier continued paying Federal Employees Health Benefits (FEHB) funds for services that were supposedly rendered at least 50 days after the provider’s death. This included 58 claims attributed to the deceased provider involving services rendered up to 324 days after the provider’s death. At the time of GAO’s documentation request in January 2025, the carrier appeared to be unaware of the provider’s death.

Sources: GAO analysis of Department of the Treasury Do Not Pay death data, Centers for Medicare and Medicaid Services data, and carrier claims data and documentation. | GAO‑26‑108139

 

Case Study: Deceased Provider Received Payment for Services Supposedly Rendered More than 100 Days After Death A provider who specialized in cardiovascular disease died in August 2022. However, a person or entity continued submitting claims for services that were supposedly rendered by the provider at least 50 days after their death. A carrier then paid Federal Employees Health Benefits (FEHB) funds for these claims. Specifically, the carrier continued paying FEHB funds to the deceased provider 14 times for services that were rendered up to 128 days after the provider died. At the time of GAO’s documentation request in January 2025, the carrier appeared to be unaware of the provider’s death. In addition, a state licensing board website indicates the provider updated or submitted their profile more than 1 year after the provider died, indicating a heightened risk of fraud.

Sources: GAO analysis of Department of the Treasury Do Not Pay death data, Centers for Medicare and Medicaid Services data, and carrier claims data and documentation. | GAO‑26‑108139

Similarly, our analysis of calendar year 2022 FEHB claims data identified two incarcerated providers who purportedly provided a health care service to an FEHB member during their incarceration and received payment for that service.[32] While not conclusive, this data analysis indicates a heightened risk of fraud and improper payments associated with incarcerated providers.

We are referring these, and other potentially ineligible providers identified in our data analysis, to OPM and OPM OIG for action, as appropriate. During this review, we asked OPM and the Department of the Treasury whether OPM could access and share with the FEHB carriers death and incarceration information in Treasury’s DNP portal—the same data source we used for our analysis.[33] However, OPM and Treasury officials told us that while OPM could use this information for its own oversight purposes, OPM does not have the authority to make this information available to FEHB carriers.[34] While OPM and OPM OIG may not be able to share this information with carriers, OPM OIG could compare the deceased and incarceration information with the claims data the OIG receives, as we did as part of this review.

Further, OPM officials indicated that the agency does not have mechanisms for identifying deceased or incarcerated providers in the FEHB program nor does the agency have mechanisms for providing information on deceased or incarcerated providers to FEHB carriers. Instead, OPM officials told us the agency relies on the carriers’ control activities—such as carrier credentialing and accreditation processes—to identify deceased or incarcerated providers.[35]

Officials from the four selected carriers we spoke with during this review told us they access death and incarceration information in different ways. For example, two carriers told us they use SSA’s publicly available DMF to identify deceased providers, but the other two carriers we spoke with do not do so.[36] Similarly, one carrier told us that it receives alerts from an industry group that may indicate when a provider has become incarcerated, but the carrier does not conduct a check against incarceration data otherwise.[37] Also, OPM OIG officials said they alert carriers when a provider on OPM OIG’s suspension and debarment list dies. However, these alerts do not include information on providers who die but are not suspended or debarred.

Standards for Internal Control in the Federal Government states that management should design control activities to achieve objectives and respond to risks.[38] In doing so, management designs control activities for appropriate coverage of objectives and risks in operations. These can include entity-level control activities, transaction control activities, or both, depending on the level of precision needed so that the entity meets its objectives and addresses related risks.

As discussed, OPM relies on FEHB carriers’ control activities to identify deceased or incarcerated providers. While these control activities may help the carriers identify deceased or ineligible providers in some instances, our analysis indicates that these control activities did not identify deceased or incarcerated providers that billed the FEHB program for services purportedly rendered after their death or during their period of incarceration. We identified at least two options that OPM and OPM OIG might use for improving its control activities in this area. First, OPM could direct FEHB carriers to regularly obtain and use death information – such as SSA’s public file of death information – to identify deceased providers, prevent payments to deceased providers, and engage in related recovery efforts. Second, OPM OIG could access incarceration data available through Treasury’s DNP portal and compare it with claims data to identify deceased or incarcerated providers billing the FEHB program. Other options might also exist. By exploring options to enhance control activities in this area, OPM can reduce vulnerabilities to the FEHB program from fraud and improper payments associated with these providers.

Limitations in Control Activities for Identifying Providers Excluded from Other Federal Programs Allowed Potentially Ineligible Providers to Participate in the FEHB Program

We also found that providers excluded from other programs were able to participate in the FEHB program due to limitations in OPM OIG’s control activities for identifying providers excluded from other federal programs. Specifically, we found limitations pertaining to

·       the use of provider role information in LEIE to determine if the provider should be on OPM OIG’s suspension and debarment list,

·       the completeness of OPM OIG’s suspension and debarment list – specifically including all providers from LEIE with roles that OPM OIG indicates they debar, and

·       the documentation of which providers from LEIE should be included on OPM OIG’s suspension and debarment list.

OPM OIG has control activities for identifying providers suspended or debarred from other federal programs when determining which providers it should suspend or debar. Specifically, according to OPM OIG officials, they consider information about providers excluded from other federal programs on HHS OIG’s LEIE.[39] While being on LEIE does not automatically exclude a provider from participating in the FEHB program, OPM OIG officials told us they consider information about providers on LEIE and include those providers on their suspension and debarment list, as appropriate.

OPM OIG officials told us this process includes reviewing providers’ roles on LEIE and determining whether those roles can bill FEHB carriers. Providers on LEIE with roles that do not bill FEHB carriers, such as a nurse’s aide or home health care aide, are not included on OPM OIG’s suspension and debarment list, according to these officials. Therefore, an OPM OIG written procedure we reviewed instructs staff not to include on their suspension and debarment list providers with non-FEHB relevant specialty roles from LEIE.

However, our analysis of FEHB claims data identified some examples of providers on LEIE billing FEHB carriers, even though they have roles that OPM OIG said do not bill.[40] For example, we identified examples of nurses aides who were listed on LEIE that billed two FEHB carriers. Our analysis suggests that the provider role descriptions on LEIE may not be a reliable indicator of whether the provider is likely to bill FEHB carriers. Consequently, the provider roles on LEIE may also be unreliable for determining whether to include certain providers on OPM OIG’s suspension and debarment list.

Further, during our review, HHS OIG officials expressed caution about using the provider’s role on LEIE to determine whether providers can bill, or otherwise be ineligible to participate in, the FEHB program. Specifically, HHS OIG officials explained to us that an excluded provider may have multiple roles, but HHS OIG selects only one general or specialty role to appear on LEIE at the time of the provider’s exclusion.

For example, if HHS OIG excluded a physician who also owned a business, the provider’s general role in LEIE might be listed as a business owner, rather than a physician. As a result, LEIE might not mention that the excluded individual was also a physician. Thus, relying on the provider’s role in LEIE could lead OPM OIG to erroneously determine that some providers are unable to bill FEHB. In turn, not including these providers on OPM OIG’s suspension and debarment list could increase the risk of potential improper payments. It could also increase risks to the health and safety of FEHB patients.

Standards for Internal Control in the Federal Government states that management should establish and operate monitoring activities to monitor the internal control system and evaluate the results.[41] In doing so, management monitors the internal control system through ongoing monitoring and separate evaluations. Ongoing monitoring is built into the entity’s operations, performed continually, and responsive to change. Separate evaluations are performed periodically and may provide feedback on the effectiveness of ongoing monitoring. In this context, monitoring might include checking FEHB claims data to determine whether providers on LEIE are billing the FEHB program, regardless of the provider’s role on LEIE.

Relying on providers’ roles on LEIE to determine whether providers are billing FEHB carriers may leave the FEHB program vulnerable to fraud and improper payments. Developing a monitoring mechanism to identify providers on LEIE with roles they do not consider for debarment that are submitting claims to FEHB carriers, and suspending or debarring those providers, as appropriate, would help OPM OIG ensure that its suspension and debarment list is more complete. Doing so would also help FEHB carriers prevent improper payments associated with these providers participating in the FEHB program.

In addition, during this review, we identified at least 1,200 entries on LEIE that do not appear on OPM OIG’s suspension and debarment list, but the provider’s specialty role is listed as one that should be debarred in OPM OIG guidance documentation.[42] We were not able to identify the precise number of entries from LEIE that do not appear—but likely should be included—on OPM OIG’s suspension and debarment list. This is because OPM OIG’s documentation includes lists of roles they debar and roles they do not debar but does not include every provider role that we identified in the LEIE data, as described later in this report.

Examples of entries on LEIE where the provider’s specialty role is included in OPM OIG’s list of roles that should be debarred but are not on OPM OIG’s suspension and debarment list include

·       more than 300 entries whose specialty role is “Pharmacy Technician,”

·       more than 250 entries whose specialty role is “Home Health Agency,” and

·       more than 70 entries whose specialty role is “Physician Assistant.”

In response to our inquiries, OPM OIG officials could not explain why providers on LEIE with roles that are listed on their guidance document as roles they debar are not included on their suspension and debarment list. They, however, suggested there could be many reasons. We are referring providers from LEIE identified in our data analysis to OPM OIG to take action, as appropriate.

Standards for Internal Control in the Federal Government states that management should use quality information to achieve the entity’s objectives.[43] As part of this responsibility, management obtains relevant data from reliable external sources in a timely manner based on the identified information requirements. Management also processes relevant data into quality information within the entity’s information system. However, OPM OIG’s current process for including relevant LEIE entries on the OPM OIG suspension and debarment list does not ensure that all potentially relevant entries are added, in part because this process involves information that may not be reliable for achieving this objective.

By reviewing the entries we identified on LEIE that are missing from OPM OIG’s suspension and debarment list and (1) determining if the excluded providers should be included on its list; (2) investigating why they were not added from the LEIE files; and (3) updating its suspension and debarment list with providers on LEIE in a timely manner, as appropriate, OPM OIG might keep these providers from participating in FEHB. Doing so would help decrease the risk of potential improper payments, as well as risks to the health and safety of FEHB patients.

We also determined that the OPM OIG documentation on including providers from LEIE on OPM OIG’s suspension and debarment list is incomplete in two different ways. First, OPM OIG’s document on which roles to debar does not include every provider role that we identified in the LEIE data. For example, we identified approximately 2,900 LEIE entries with specialty roles such as “Emergency Medicine,” “Chiropractic,” and “Business Manager” that are not listed on OPM OIG’s guidance document.[44] OPM OIG officials stated that for roles not listed in the document, they research the providers to determine if the providers meet the criteria for debarment. However, this step in their process is not included in their written procedures for adding providers from LEIE that we reviewed.

Second, OPM OIG officials provided us information indicating they do not consider certain roles for debarment in practice but acknowledged that this action is not supported by process documentation. For example, OPM OIG officials indicated that they treat providers with a specialty of “Assisted Living Facility” the same as “Nursing” and would not debar these providers, but this does not appear in process documentation.

Standards for Internal Control in the Federal Government states that management should develop and maintain documentation of its internal control system.[45] Effective documentation assists in management’s design of internal control by establishing and communicating to personnel the who, what, when, where, and why of internal control execution. Documentation also provides a means to retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel and to communicate that knowledge, as needed, to external parties, such as external auditors. However, OPM OIG does not have complete documentation of its process of evaluating whether debarred providers on LEIE should be included on OPM OIG’s suspension and debarment list.

Updating its documentation on which LEIE roles to debar, to include all possible roles that appear in LEIE, would better position OPM OIG to ensure that it suspends or debars all ineligible providers from participating in the FEHB program. Further, OPM OIG would help retain organizational knowledge and mitigate the risk of having that knowledge limited to a few personnel, if it updated guidance documentation. Specifically, OPM OIG would benefit by clarifying when staff adding providers from LEIE must conduct additional research on providers to determine if they meet the criteria for debarment. Taking these steps to improve its suspension and debarment process would help ensure that its suspension and debarment list is complete and accurate, which can also help FEHB carriers use this list to prevent improper payments to ineligible providers.

Limitations in Information on Provider Identities Allowed Potentially Ineligible Providers to Participate in FEHB

To identify whether a claim for services is from a suspended or debarred provider, FEHB carriers and OPM OIG compare the provider’s identifying information—such as a provider’s TIN or National Provider Identifier (NPI)—on the OPM OIG suspension and debarment list with similar information on a claim. Thus, if the OIG’s suspension and debarment list is missing TIN and NPI information for providers, then FEHB carriers and OPM OIG may be unable to identify ineligible providers attempting to bill the FEHB program. Not identifying claims from ineligible providers can result in improper payments and pose health and safety risks to FEHB members who receive health care from suspended and debarred providers.

As part of its control activities to identify ineligible providers, OPM OIG directs carriers to use all available data elements, such as provider TIN and NPI, from its suspension and debarment list to identify potentially ineligible providers in carriers’ information systems. However, we found that OPM OIG’s suspension and debarment list does not consistently provide these data elements for each ineligible provider, making it difficult for carriers to do so. For example, we found that more than 30,000 records (more than 85 percent) on OPM OIG’s suspension and debarment list did not have an NPI. We also found that more than 2,000 records (about 6 percent) were missing both the TIN and NPI.

OPM OIG’s suspension and debarment list does not contain more complete TIN and NPI information because neither OPM OIG nor OPM obtain complete TIN and NPI information for all providers in the FEHB program. During this review, OPM officials told us that each month FEHB carriers submit provider files that include providers’ NPIs to OPM. However, according to OPM OIG officials, OPM does not collect TINs and NPIs for these providers. Similarly, OPM OIG officials said they do not obtain TIN and NPI information from carriers for all providers in the FEHB program. According to OPM OIG officials, OPM OIG obtains provider TIN and NPI from a variety of sources, including other agencies’ exclusion lists, when it is available; through the use of investigative tools; and in the course of developing suspension and debarment cases.

To demonstrate how more complete provider information can assist in identifying claims from suspended and debarred providers, we obtained additional TIN information from CMS for those providers that did not have a TIN in the FEHB claims data we obtained from OPM OIG and the FEHB carriers. Specifically, we identified more than 2,000 additional claims from providers who were on OPM OIG’s suspension or debarment list, LEIE, or the SAM exclusions list. Some of these more than 2,000 claims may have matched to more than one list (e.g., both OPM OIG’s suspension and debarment list and LEIE).[46] These examples illustrate how obtaining additional TIN information could help OPM, OPM OIG, and the carriers identify potentially ineligible providers in the FEHB program.

Standards for Internal Control in the Federal Government states that management should use quality information to achieve the entity’s objectives.[47] As part of this responsibility, management obtains relevant data from reliable external sources in a timely manner based on the identified information requirements. Further, these standards also state that management should externally communicate the necessary quality information to achieve the entity’s objectives.[48]

OPM officials we spoke to during this review were unable to explain why they did not collect TINs for providers in the FEHB program. When we asked OPM OIG officials why they did not obtain more comprehensive TIN and NPI information for providers, the officials told us they direct FEHB carriers to submit complete and accurate information, including TIN and NPI information, but not all carriers do so. OPM OIG officials also stated that they are working with carriers to improve the completeness and accuracy of the data supplied. However, these efforts are in the beginning stages, and OPM OIG officials were unable to estimate when this effort would be completed.

During this review, FEHB carrier officials told us that having more complete information for identifying ineligible providers, such as the TIN and NPI for each provider, would help them prevent these providers from billing the FEHB program. These carriers also told us that not having this information created challenges to identifying and removing ineligible providers in their systems. If an FEHB carrier cannot identify a provider as suspended or debarred – due to incomplete information – then the FEHB program is at an increased risk of fraud and improper payments and puts FEHB members at increased risk of receiving continued health care from suspended and debarred providers.

Not obtaining TIN and NPI information for all providers in the FEHB program hampers OPM and OPM OIG’s ability to identify ineligible providers as part of their monitoring and oversight of the FEHB program. Obtaining additional identifying information, such as TIN and NPI, for providers, and communicating such information on the OIG’s suspension and debarment list could help OPM, OPM OIG, and the FEHB carriers improve their efforts to identify ineligible providers and prevent associated improper payments and fraud in the FEHB program.

FEHB Program Information-Sharing Practices on Suspended or Debarred Providers Did Not Always Comply with Certain Federal Regulations

OPM OIG did not add all providers on its suspension and debarment list to the SAM exclusions list, as required. In addition, OPM OIG did not remove all providers who were reinstated from the SAM exclusions list after these providers were reinstated, as required. By not making these changes, OPM OIG risks potential improper payments and risks to the health and safety of patients in other federal health care programs. It also risks improperly excluding a provider from eligibility for other types of government awards beyond the period that was determined appropriate by the debarment official.

OPM OIG Did Not Add All Providers on Its Suspension and Debarment List to the SAM Exclusions List

OPM OIG has a process in place for sharing information on suspended or debarred providers with other federal entities, in accordance with federal regulation, but OPM OIG officials reported that technical and other issues prevented the process from fully complying with relevant regulations. Specifically, federal regulation states that when OPM suspends or debars a provider, OPM should notify GSA for publication on the SAM exclusions list.[49] OPM OIG officials explained to us that they upload suspension and debarment records to the SAM exclusions list at least monthly.

However, this process did not result in all suspended and debarred providers being added to the SAM exclusions list. Specifically, we found over 1,600 entries on OPM OIG’s suspension and debarment list that we could not readily identify on the SAM exclusions list with OPM as the excluding agency.[50]

According to OPM OIG officials, suspended or debarred providers may be missing from the SAM exclusions list due to a range of data entry, technical, or administrative issues. For example, documentation we reviewed indicates that OPM OIG uploads suspension and debarment data to SAM via monthly batch uploads, but sometimes records fail to upload due to system errors. In these cases, OPM OIG manually adds the suspended or debarred providers to SAM. OPM OIG officials stated that manual entry mistakes or discrepancies in how information is recorded may explain why some suspended or debarred providers do not appear on the SAM exclusions list.

Further, OPM OIG officials stated that they have experienced issues with their information systems and SAM, such as the systems freezing, closing prematurely, and the records not saving. Consequently, OPM OIG officials told us that in September 2025, they implemented a process to ensure they are updating SAM with information on suspended or debarred providers, as appropriate. However, it is too early for us to determine if this process is effective in doing so.

During this review, OPM OIG officials told us they were able to identify and add a limited number of their suspension and debarment records to the SAM exclusions list based on examples we provided from our preliminary data analysis. However, OPM OIG officials told us that without the more than 1,600 suspension and debarment records we identified, OPM OIG officials are unable to determine the specific reasons that these records were not added to the SAM exclusions list and add the records, as appropriate. We are referring the more than 1,600 entries identified in our analysis to OPM OIG to take action, as appropriate.

By reviewing providers on OPM OIG’s suspension and debarment list that are not readily identified on the SAM exclusions list and (1) determining if the excluded providers should be included on the SAM exclusions list; (2) investigating why they were not added to the SAM exclusions list; and (3) updating SAM with information on suspended or debarred providers in a timely manner, as appropriate, OPM OIG may be able to keep these providers from participating in other federal health care programs. Such action might decrease the risk of potential improper payments, as well as risks to the health and safety of patients in other federal health care programs, such as veterans.

OPM OIG Did Not Remove All Providers Who Were Reinstated from the SAM Exclusions List, as Required

Federal regulations require OPM to inform FEHB program carriers and government agencies when a provider is reinstated.[51] Doing so is important for ensuring that eligible providers can participate in the FEHB program and other federal programs. During this review, OPM OIG officials stated that they remove entries from SAM immediately after reinstating the provider from their suspension and debarment list.

However, we found over 500 entries on the SAM exclusions list with OPM as the excluding agency that we could not readily identify on OPM OIG’s suspension and debarment list.[52] Our analysis suggests that OPM OIG did not remove these entries from the SAM exclusions list, as required, when the providers were reinstated.

According to OPM OIG officials, human error or system errors could explain why these providers were removed from OPM OIG’s suspension and debarment list but not from the SAM exclusions list. For example, OPM OIG stated they previously created multiple entries on the SAM exclusions list for providers with aliases, and when those providers were reinstated, OPM OIG may not have removed each of the providers’ entries from SAM.

OPM OIG officials told us they were able to identify and remove a limited number of their suspension and debarment entries from the SAM exclusions list based on examples we provided from our preliminary data analysis. However, OPM OIG officials told us that without the over 500 suspension and debarment records we identified, OPM OIG officials are unable to address this discrepancy. We are referring these SAM exclusions list entries identified in our data analysis to OPM OIG to take action, as appropriate.[53]

Removing providers from the SAM exclusions list after OPM OIG reinstates them in a timely manner would help OPM OIG avoid risks of improperly extending the period of debarment. When reinstated providers are not removed from the SAM exclusions list, OPM OIG is effectively excluding providers from participating in federal programs when those providers are, in fact, eligible to do so, because a provider that is no longer debarred would be presented as debarred in SAM and ineligible for federal awards.

Selected FEHB Carriers Do Not Always Comply with Requirements for Identifying and Excluding Suspended or Debarred Providers

Selected FEHB Carriers Do Not Notify Patients Who Received Services from Suspended or Debarred Providers When Claims Are Denied for Certain Reasons

Federal regulations require carriers to notify patients who have obtained items or services from suspended or debarred providers within 1 year of the date of the suspension or debarment.[54] Also, OPM OIG’s 2004 guidelines include suspension and debarment requirements for all FEHB carriers and specify the circumstances under which carriers must notify patients.[55] For example, according to the guidelines, carriers must notify patients who are associated with a suspended or debarred provider through payments that were made for a claim.

OPM OIG officials told us that carriers must also notify patients, even if their claims were denied. Consistent with this expectation, officials from two of four FEHB carriers we reviewed said they would notify patients that their provider is suspended or debarred, even if the carrier denies the provider’s claim.

However, OPM OIG’s guidelines do not specify that carriers must also notify patients if claims are denied. Officials from two other FEHB carriers said that they did not notify patients that their provider is suspended or debarred if the patient’s claim is denied for reasons other than the provider’s suspension or debarment. For example, if a patient’s claim is denied because their insurance plan does not cover the specific service they received, these two carriers would not notify the patient that their provider is suspended or debarred. One of our nongeneralizable case studies illustrates an example of an FEHB carrier that did not notify a patient of their provider’s debarment because the carrier denied a claim, leaving the patient unaware of their provider’s debarment.

Case Study: FEHB Patient Remains Unaware of Their Provider’s Debarment for More than 500 Days A Federal Employees Health Benefits (FEHB) patient remained unaware of their provider’s debarment for at least 510 days because the carrier’s system denied initial claims without checking the provider’s sanction status. The provider was debarred by the Office of Personnel Management (OPM) after being convicted for accepting bribes in exchange for test referrals. The carrier denied a claim for services that the debarred provider rendered in March 2021, but the denial was not due to OPM’s debarment. Instead, the claim was denied because the provider was out-of-network and rendered services that were not covered by the patient’s insurance plan. According to carrier officials, their claims system did not check the provider’s sanction status because the claim was denied due to a lack of coverage. When the carrier received a claim that was covered by the patient’s insurance plan in June 2022, the carrier’s system identified the provider’s debarment and later notified the patient. However, the patient had seen the debarred provider at least four times for medical care, plus diagnostic testing and pathology, in the meantime.

Sources: GAO analysis of OPM Office of the Inspector General data, Department of Justice press release, and carrier claims data and documentation. | GAO‑26‑108139

Officials from both carriers told us they would not notify patients in these cases because their claims systems do not generate patient notifications when a claim is denied. Further, officials from one carrier told us their procedures—which do not notify patients in these cases—were consistent with their understanding of OPM OIG’s guidelines for carriers.

Standards for Internal Control in the Federal Government states that management should design the entity’s information system and related control activities to achieve objectives and respond to risks.[56]

As mentioned, two of the carriers we reviewed had claims systems that are not designed to notify patients about suspended and debarred providers when a claim is denied, which is inconsistent with OPM OIG’s expectations.

Standards for Internal Control in the Federal Government also states that management should externally communicate the necessary quality information to achieve the entity’s objectives. This includes communicating quality information so that external parties can help the entity achieve its objectives and address related risks.[57]

OPM OIG and OPM communicate requirements related to suspension and debarment through various methods, but these communications do not specify that carriers must notify patients that their provider is suspended or debarred, even if the patient’s claim is denied for reasons other than the provider’s suspension or debarment. As mentioned, OPM OIG communicates suspension and debarment requirements to all FEHB carriers through its guidelines, but they do not include clear requirements regarding denied claims. Similarly, OPM has issued FEHB program carrier letters to the carriers and communicated general legal requirements through carrier contracts.[58] However, these carrier letters and contracts did not specify that carriers must notify patients that their provider is suspended or debarred, if the patient’s claim is denied for reasons other than the provider’s suspension or debarment.[59]

During our review, OPM OIG officials indicated they were drafting updates to their suspension and debarment guidelines for carriers and, as of December 2025, were unsure when they would finalize these guidelines. A senior OPM OIG official said they anticipated so issuing the updated guidelines after incorporating potential changes based on our review. Specifically, the officials said they would explore potential language to clarify that carriers must notify patients, regardless of whether claims are denied for reasons other than a provider’s suspension or debarment.

By clarifying the type of claims that require carriers to notify patients and taking action to ensure that carriers’ claims systems are designed and operating effectively to notify patients that a provider is suspended or debarred when a claim is denied, OPM and OPM OIG will better ensure that FEHB patients whose claims are denied are not exposed to health, safety, and financial risks for prolonged periods.

Selected FEHB Carriers Did Not Notify OPM OIG About Providers Who May Warrant Suspension or Debarment

Officials from all four FEHB carriers we spoke to indicated they do not always notify OPM OIG when they identify providers who may warrant OPM suspension or debarment, as required by OPM OIG policy. Specifically, OPM OIG policy requires carriers to notify OPM OIG when they become aware of a provider who has committed a sanctionable action or who appears to meet the qualifications for debarment or suspension.[60]

Officials from all four FEHB carriers told us they would not notify OPM OIG of providers who may warrant OPM suspension and debarment. For three carriers, these included providers that carriers become aware of through sources such as LEIE, the SAM exclusions list, and state licensing board websites. Officials from the fourth of four carriers indicated they would not take any action if they received information about providers who may warrant OPM suspension or debarment from other sources.

OPM OIG policy also indicates that the OPM OIG Debarring Official has the authority to suspend and debar providers from receiving payments from the FEHB program. However, officials from three carriers indicated that they do not always consult OPM OIG before excluding providers. Specifically, carrier officials said that—under certain circumstances—they excluded providers from receiving FEHB payments based on non-OPM sources and did so without sending referrals to OPM OIG for suspension or debarment.

For example, officials from one carrier misunderstood their authority to independently exclude FEHB payments to providers based on LEIE. Specifically, officials told us they could exclude providers found on LEIE from receiving FEHB payments without consulting OPM OIG because providers on that list “are legally prohibited from participating in federal healthcare programs, including FEHB.” However, this appears to be a misunderstanding, as being on LEIE does not legally prohibit a provider from participating in FEHB.

While FEHB carriers should not exclude providers from receiving FEHB payments without consulting OPM OIG, OPM and OPM OIG officials informed us that carriers are not prohibited from searching for such providers in other sources. However, officials from one carrier said they believe their contracts with OPM prohibited them from searching sources—such as LEIE and the SAM exclusions list—for providers who could be excluded from the FEHB program.

As part of this review, we informed OPM and OPM OIG of these carrier practices and the potential confusion that may contribute to these practices. We asked OPM OIG officials—who lead suspension and debarment enforcement efforts for the FEHB program—about efforts to ensure that carriers understand requirements related to providers who may warrant suspension or debarment. Specifically, we asked how the agency clarified that

1.     carriers are permitted to search sources such as LEIE and the SAM exclusions list to identify providers who warrant suspension or debarment,

2.     carriers must notify OPM OIG of providers who may warrant OPM suspension or debarment, and

3.     only the OPM OIG Debarring Official is authorized to exclude providers from receiving FEHB payments.

In response, OPM OIG officials informed us they would consider clarifying these requirements in their updated suspension and debarment guidelines for carriers. OPM OIG officials told us they were unsure when they would finalize these guidelines but anticipated doing so after incorporating potential changes based on our review.

Standards for Internal Control in the Federal Government states that management should externally communicate the necessary quality information to achieve the entity’s objectives.[61] This includes communicating quality information externally so that external parties can help the entity achieve its objectives and address related risks.

As mentioned, OPM and OPM OIG use various methods to communicate suspension and debarment requirements with carriers, including OPM’s contracts with carriers, OPM carrier letters, and OPM OIG’s guidelines. However, our review indicates that FEHB carriers may misunderstand these communications. As a result, certain carrier practices are not consistent with OPM and OPM OIG’s requirements for suspended and debarred providers.

Clarifying that FEHB carriers are permitted to search sources such as LEIE and the SAM exclusions list to identify providers who may warrant suspension or debarment would enhance the carriers’ and OPM OIG’s ability to identify ineligible providers. Further, clarifying that carriers must notify OPM OIG of providers who may warrant OPM suspension or debarment would help OPM and OPM OIG ensure that these providers are appropriately excluded from the FEHB program and help prevent related improper payments and fraud in the FEHB program. Similarly, clarifying that only the OPM OIG Debarring Official is authorized to exclude providers from receiving FEHB payments would help improve payment integrity by ensuring that eligible providers are not inadvertently excluded from the FEHB program.

One FEHB Carrier Manually Overrode Controls to Allow Debarred Providers to Participate in the FEHB Program

At one of the four FEHB carriers we contacted, we found that carrier employees can manually override controls to allow payments to suspended and debarred providers. Officials with this larger carrier told us that employees can override a provider’s debarment status after the carrier initially flags the provider as debarred based on OPM OIG’s suspension and debarment list.[62] Officials indicated that employees can override controls if they believe they have information showing that a provider on OPM OIG’s suspension and debarment list should not be debarred. Carrier officials added that this practice was supported by the carrier’s internal process for overriding controls.

However, OPM OIG guidelines require carriers to contact OPM OIG if carriers do not have sufficient information to make an authoritative match against OPM OIG’s suspension and debarment list.

Our nongeneralizable file reviews of claims documentation from this carrier found instances where carrier staff overrode debarment flags in their claims adjudication system to allow payments to debarred providers. Specifically, our file reviews for six out of 13 nongeneralizable claims involved instances where carrier staff overrode a provider’s debarment status in their system to pay FEHB funds to the debarred provider.[63] For all six of these claims, OPM OIG officials confirmed that carrier staff did not contact OPM OIG for approval before overriding providers’ debarment status and paying FEHB funds, as required.[64] Carrier staff did not override providers’ debarments for the remaining seven claims.

Case Study: Carrier Overrode Controls to Pay a Debarred Provider A Federal Employees Health Benefits patient remained unaware of their provider’s debarment for nearly 5 months because carrier staff overrode the provider’s debarment flag in the carrier’s claims adjudication system. The provider was debarred after being convicted for conspiracy to accept bribes from employees at a laboratory company, among other charges. The Office of Personnel Management (OPM) debarred the provider in 2019, and the patient began receiving services from the provider in July 2021. In December 2021, the carrier notified the patient about the provider’s debarment. However, the carrier continued to pay the provider for services rendered in June 2023 and January 2025. At the time of our documentation request in January 2025, the patient received services from this debarred provider 25 times for office visits, medical care, and diagnostic testing; and the provider’s debarment flag was still marked as “No” in the carrier’s system.

Sources: GAO analysis of OPM Office of the Inspector General data, Department of Justice press release, and carrier claims data and documentation. | GAO‑26‑108139

This carrier’s internal process that allows employees to manually override controls to pay suspended and debarred providers does not comply with OPM OIG’s guidelines. According to carrier officials, as of January 1, 2025, this carrier began requiring supervisors to approve their staff’s changes to providers’ suspension and debarment statuses in the carrier’s system. Carrier officials also said supervisors would take steps to seek clarification from OPM OIG if they had questions after the supervisory review. However, this process enables staff and supervisors to override suspension and debarment flags without OPM OIG’s approval if they believe their assessment is correct at the supervisory stage.

Employee override of controls may leave patients unaware that their provider is suspended or debarred, exposing patients to health, safety, and financial risks. Overriding controls without OPM OIG’s approval may also lead to improper payments and heighten the risk of fraud involving FEHB program funds. Ensuring that carrier processes comply with requirements to consult with OPM OIG about provider matches before manually overriding controls can help reduce the risk of fraud and improper payments to ineligible providers in the FEHB program.

FEHB Program Rules and Guidelines Create Opportunities for Fraud and Abuse

FEHB Program Rules Create Opportunities for Suspended and Debarred Providers to Bill for Unknowing FEHB Patients, as Illustrated Through Covert Calls

FEHB program rules create opportunities for fraud and abuse by suspended and debarred providers. To protect patients, FEHB program rules include exceptions that allow carriers to pay FEHB funds to suspended and debarred providers under certain exceptions, such as if an FEHB patient is unaware of their provider’s sanction at the time they received care.[65] According to federal regulations, the exception related to an unaware patient is intended solely to protect the interests of FEHB members who obtain services from a debarred or suspended provider in good faith and without knowledge that the provider has been sanctioned. It does not authorize debarred or suspended providers to submit claims for payment to FEHB carriers and, thus, does not authorize these providers to submit claims for new or existing patients who are unaware.[66]

However, suspended and debarred providers can abuse this exception to bill and receive payment from the FEHB program for unknowing patients.[67] Specifically, providers can continue accepting and billing for services to new or existing patients under FEHB program rules as long as the patient is unaware of the provider’s suspension or debarment. New and existing patients may be unaware that their provider is suspended or debarred because carriers generally do not inform these patients about their providers’ sanctions until after the carrier receives a claim for the items or services rendered. In addition, federal regulations require carriers to notify existing patients who obtained items or services from these providers within 1 year of their debarment or suspension. Consequently, existing patients may be unaware of their provider’s suspension and debarment, and these providers may continue to bill the FEHB program for services rendered to their patients. Further, neither OPM nor OPM OIG make OPM OIG’s suspension and debarment list available to the public, such as through FEHB program-related websites that FEHB members might access.

As part of our work, in April 2025, we posed as new FEHB patients and conducted covert calls to debarred providers with a history of billing the FEHB program to ask if they accepted FEHB insurance.[68] Of the 26 debarred providers with whom we made contact

·       three debarred providers told us they do take FEHB insurance;

·       two debarred providers indicated they would likely take FEHB insurance but also said that information needed to be verified before it is known if FEHB would be accepted;

·       one debarred provider told us they do not take insurance and are not a provider for our FEHB carrier, but we could pay them out-of-pocket and they would give us a receipt to file;[69]

·       15 debarred providers indicated they do not take FEHB insurance; and

·       For five debarred providers, we could not determine whether they would accept FEHB insurance.[70]

While the covert calls are not generalizable to the population of debarred providers, they nonetheless illustrate examples of the heightened risk of fraud and improper payments stemming from debarred providers who may be willing to knowingly accept new FEHB program patients.

During this review, OPM officials told us they rely on audits performed by OPM OIG to identify providers who repeatedly bill for new patients and to help prevent them from billing the FEHB program. However, OPM OIG officials told us they do not conduct claims audits to identify ineligible providers who repeatedly bill FEHB for unknowing patients.[71]

As an additional control activity, OPM OIG officials told us they send “shock and alarm” notices to suspended and debarred providers who continue submitting claims for patients. However, OPM OIG officials acknowledged that these notices may be limited in their effectiveness at deterring these providers from billing for unknowing patients.

We asked OPM what mechanisms OPM and carriers use to disincentivize suspended and debarred providers from continuing to submit claims for unknowing FEHB patients. OPM officials told us their contracts with carriers include a section wherein the carriers agree not to pay suspended or debarred providers, which they believe is a disincentive for carriers to pay these providers.

However, billing patterns from FEHB carriers suggest these control activities may be limited in their effectiveness at preventing ineligible providers from billing FEHB. For example, our analysis of FEHB claims data from calendar year 2022 identified over 2,500 claims from providers that were suspended or debarred by OPM and rendered services to patients after their sanctions became active.[72]

As mentioned earlier, Standards for Internal Control in the Federal Government states that management should externally communicate the necessary quality information to achieve the entity’s objectives.[73] Effective managers select appropriate methods to communicate externally and consider a variety of factors, such as ensuring that information is readily available to the audience, when needed. As mentioned, carriers generally do not inform unknowing patients that their provider is suspended or debarred until after the patients receive care. Further, neither OPM nor OPM OIG make OPM OIG’s suspension and debarment list available to the public, such as through FEHB program-related websites that FEHB members might access.

During our review, OPM OIG officials said they would consider new methods of communication, such as coordinating with OPM and carriers to make OPM suspension and debarment information more readily available to the public, such as by flagging suspended and debarred providers on carriers’ public websites.[74] OPM OIG officials agreed that more readily available information could be beneficial for unknowing patients but noted that OPM OIG’s resource constraints could create challenges to communicating this information.

Without improving methods of communication to ensure that information about suspended and debarred providers is readily available to unknowing patients, the FEHB program may be vulnerable to fraud and improper payments to suspended and debarred providers for years after a provider has been excluded from the FEHB program. Further, unknowing FEHB patients may be exposed to health, safety, and financial risks by obtaining medical services from suspended or debarred providers.

FEHB Guidelines Create Opportunities for Suspended and Debarred Providers to Bill FEHB for Multiple Services by Delaying Claim Submissions

FEHB carrier guidelines require providers to submit claims within certain time frames.[75] Specifically, these guidelines require providers to submit claims by December 31 of the following calendar year. For example, if a provider renders services on January 1 and December 31, 2025, the provider must submit both claims by December 31, 2026. Thus, suspended and debarred providers could wait to submit claims for unknowing patients for up to 729 days (see fig. 2). According to OPM officials, the submission deadline for eligible providers does not differ from suspended and debarred providers.

When a suspended or debarred provider submits a claim for an unknowing patient, carriers can pay the first claim received. Carriers are then required to notify the patient about the provider’s suspension or debarment. After notifying the patient, the carrier can pay any subsequent claims with service dates up to 15 days after the patient was notified. This is called the “15-day grace period.” After the 15-day grace period, per OPM regulations, carriers must not pay additional claims to the ineligible provider for that patient unless another exception or waiver is applied.[76]

However, ineligible providers can abuse these guidelines and program rules by waiting to submit one or more claims for multiple service dates for unknowing patients, effectively undermining the 15-day grace period and allowing them to be paid for multiple services over time.[77] See figure 3 for a hypothetical example of how a suspended or debarred provider could delay submitting claims for an unknowing patient to be paid for more services. Our nongeneralizable case study also illustrates an example of this potentially abusive practice.

Case Study: Debarred Provider Was Paid FEHB Funds for Multiple Services by Delaying Claims Submission for Over 6 Months A debarred provider billed the Federal Employees Health Benefits (FEHB) program for multiple service dates by waiting over 6 months to submit a claim. The provider was debarred by the Office of Personnel Management (OPM) after being convicted for falsifying business records related to counseling services provided under the Medicaid program. The patient received therapeutic care from the debarred provider six times between January and April 2022, but the debarred provider waited until July 2022 to submit one claim for all six service dates. In August 2022, the carrier paid the provider for all six service dates, because the patient was unaware of the provider’s debarment at those times. The carrier also sent a notification to the patient in August 2022 to inform them of their provider’s debarment, which started the 15-day grace period over 7 months after the debarred provider began rendering services to the patient.

Sources: GAO analysis of OPM Office of the Inspector General data, Department of Health and Human Services documentation, and carrier claims data and documentation. | GAO‑26‑108139

OPM officials told us that OPM has the discretion to change claim submission deadlines, but they had not previously considered doing so. OPM officials also told us they would consider it to be potentially fraudulent when suspended and debarred providers delay submitting claims for unknowing patients who received care over multiple service dates. Further, the officials said they would expect carriers to investigate and recover payments in these situations. However, this approach leaves carriers in a “pay-and-chase” situation with potentially fraudulent transactions.

Leading practices for fraud risk management state that managers should focus on fraud prevention over detection and response to avoid a “pay-and-chase” model, to the extent possible.[78] Additionally, Standards for Internal Control in the Federal Government states that management should design control activities to achieve objectives and respond to risks.[79] In this regard, effective managers ensure the accurate and timely recording of transactions, which are promptly recorded to maintain their relevance and value to management in controlling operations and making decisions.

When suspended and debarred providers do not submit claims for unknowing FEHB patients in a timely manner, carriers cannot promptly notify unknowing patients about their providers’ sanctions. If OPM does not develop and implement controls that reduce the amount of time suspended and debarred providers can wait to submit claims and receive FEHB payments, while taking carrier filing policies into consideration, unknowing patients may remain unaware and be repeatedly exposed to health, safety, and financial risks through multiple encounters with these providers. Further, suspended and debarred providers may continue to abuse filing timelines, leaving the FEHB program vulnerable to fraud and improper payments.

Conclusions

Given that the FEHB program is the country’s largest employer-sponsored health insurance program, effective fraud risk management and provider eligibility verification is critical to help safeguard the FEHB program’s billions in federal funding and to help ensure that the program fulfills its intended purpose.

OPM and OPM OIG have taken some steps to manage fraud risks and limit ineligible providers from submitting claims to FEHB. For example, OPM communicates suspension and debarment requirements to carriers via the FEHB contracts and carrier letters. Additionally, OPM OIG also provides guidance to FEHB carriers on how to assess provider eligibility.

Regardless, these steps are insufficient, and additional actions are needed to reduce the risk of ineligible providers submitting claims to the FEHB program and to reduce the risk of fraud in the program. In this regard, OPM has yet to fully implement the remaining two recommendations from our December 2022 report or the six recommendations from our July 2025 report. Fully and timely implementing these recommendations pertaining to fraud risk management would help to ensure that OPM effectively mitigates the risk of fraud and improper payments in the FEHB program.

Further, without taking additional action to improve control activities and obtain complete and accurate information for identifying ineligible providers in the FEHB program—including deceased or incarcerated providers, those excluded from other federal programs, and those suspended or debarred from the FEHB program—OPM continues to face fraud and improper payment risks to the government’s significant investment in the FEHB program. As a result, it risks that providers who should be excluded from the FEHB program are continuing to participate in the FEHB program—whereby they provide care to members and receive FEHB payments—which heightens patient safety and improper payment risks.

Additionally, improved guidance to FEHB carriers regarding their responsibilities for informing FEHB patients that they are receiving care from suspended or debarred providers could help patients make more informed decisions about the providers from whom they seek care.

Similarly, without improved guidance on information sources that FEHB carriers can use to identify potentially ineligible providers and what FEHB carriers should do if they identify such providers, FEHB carriers may fail to identify and communicate to OPM OIG those providers who likely should be suspended or debarred from the FEHB program.

Lastly, absent additional action to address suspended or debarred providers who may abuse program rules and guidelines to continue seeing new or unknowing patients, the FEHB program will remain at increased risk of fraud and improper payments, and FEHB patients will continue to be at an increased risk of receiving care from a suspended or debarred provider.

Recommendations for Executive Action

We are making a total of 15 recommendations to OPM and OPM OIG. Of these, nine are to OPM (Recommendations 1, 6, 9, 10, 11, 12, 13, 14, and 15), and six are to OPM OIG (Recommendations 2, 3, 4, 5, 7, and 8).

The Director of OPM should improve its control activities for identifying deceased or incarcerated providers. At a minimum, this should include OPM directing FEHB carriers to regularly obtain and use death information to identify deceased providers, prevent payments to deceased providers, and engage in related recovery efforts. This might also include OPM OIG comparing death and incarceration data from DNP with the claims data they receive, as we did. (Recommendation 1)

The OPM Inspector General should develop a monitoring mechanism to identify providers on LEIE with roles they do not consider for debarment that are submitting claims to FEHB carriers and suspend or debar them, as appropriate. (Recommendation 2)

The OPM Inspector General should review the exclusions we identified on LEIE that are missing from its suspension and debarment list and (1) determine if the excluded providers should be included on its list; (2) investigate why they were not added from the LEIE files; and (3) update its suspension and debarment list with providers on LEIE in a timely manner, as appropriate. (Recommendation 3)

The OPM Inspector General should update its guidance documentation about which roles from the Department of Health and Human Services OIG List of Excluded Individuals and Entities (LEIE) that OPM OIG considers for debarment to include all possible roles that appear on LEIE. (Recommendation 4)

The OPM Inspector General should update its guidance documentation and its written procedures to clarify when OPM OIG must conduct additional research on providers on LEIE to determine if the provider meets the criteria for debarment. (Recommendation 5)

The Director of OPM should obtain additional identifying information for providers, including providers’ Tax Identification Number and National Provider Identifier. To the extent appropriate, the Director of OPM should coordinate this effort with the OPM Inspector General. (Recommendation 6)

The OPM Inspector General should review providers on its suspension and debarment list that we could not readily identify on the SAM exclusions list and (1) determine if the excluded providers should be included on the SAM exclusions list; (2) investigate why they were not added to the SAM exclusions list; and (3) update SAM with information on suspended and debarred providers in a timely manner, as appropriate. (Recommendation 7)

The OPM Inspector General should review providers on the SAM exclusions list with OPM as the excluding agency that we could not readily identify on OPM OIG’s suspension and debarment list and (1) determine if the excluded providers should be removed from the SAM exclusions list, (2) investigate why they were not removed from the SAM exclusions list, and (3) remove providers from the SAM exclusions list after OPM OIG reinstates them in a timely manner. (Recommendation 8)

The Director of OPM, in coordination with the OPM Inspector General, should clarify to carriers when they must notify patients whose claims from suspended or debarred providers are denied, such as through FEHB Program Carrier Letters, OPM contracts, and OPM OIG’s suspension and debarment guidelines. (Recommendation 9)

The Director of OPM, in consultation with the OPM Inspector General, should take action to ensure that carriers’ claims systems are designed and operating effectively to notify patients that a provider is suspended or debarred, when a claim is denied. (Recommendation 10)

The Director of OPM, in coordination with the OPM Inspector General, should clarify to FEHB carriers – such as through FEHB Program Carrier Letters, OPM contracts, and OPM OIG’s suspension and debarment guidelines – that carriers are permitted to search other sources, such as LEIE and the SAM exclusions list, for providers who may warrant suspension or debarment, and that carriers must notify OPM OIG when they identify such providers. (Recommendation 11)

The Director of OPM, in coordination with the OPM Inspector General, should clarify to FEHB carriers – such as through FEHB Program Carrier Letters, OPM contracts, and OPM OIG’s suspension and debarment guidelines – that only the OPM OIG Debarring Official is authorized to exclude providers from receiving FEHB payments. (Recommendation 12)

The Director of OPM, in coordination with the OPM Inspector General, should ensure that FEHB carrier processes comply with requirements to consult with OPM OIG about provider matches from the OPM OIG suspension and debarment list before manually overriding controls to change a provider’s suspension or debarment status. (Recommendation 13)

The Director of OPM, in coordination with the OPM Inspector General, should improve methods of communication to ensure that information about suspended and debarred providers is more readily available to new and unknowing patients, such as by flagging suspended or debarred providers on carriers’ public websites. (Recommendation 14)

The Director of OPM, in consultation with the OPM Inspector General, should coordinate with FEHB carriers to develop and implement controls that reduce the amount of time that suspended and debarred providers can wait to submit claims and receive FEHB payments, while taking carrier filing policies into consideration. (Recommendation 15)

Agency Comments and Our Evaluation

We provided a draft of this report to OPM and OPM OIG for review and comment. OPM provided comments via email, which we summarize below. OPM and OPM OIG concurred with our recommendations and identified planned actions to address our recommendations. OPM OIG provided written comments, which are reproduced in appendix III and summarized below.

OPM

OPM provided comments on a draft of this report via email describing its preliminary responses and action plans to address the nine recommendations we made to it. OPM’s preliminary responses agreed with our recommendations. OPM stated it will provide definitive responses in accordance with the requirements of 31 U.S.C. § 720 and OMB Circular A-50, which requires agencies to submit a written statement to Congress and GAO within 180 days of the issuance of a GAO report on action taken or planned to address GAO’s recommendations.

Specifically, in response to our first recommendation, OPM stated it agrees that FEHB carriers could regularly obtain and use death information to identify deceased providers. OPM explained it will review its guidance to identify how best to communicate any updates to FEHB carriers.

In response to our sixth recommendation, OPM stated that it will review its procedures to coordinate with OPM OIG regarding the sharing of NPI and TIN data that OPM currently collects from FEHB carriers and CMS.

In response to our ninth recommendation, OPM noted an existing regulation for carriers to notify patients who have obtained items or services from a suspended or debarred provider within one year of the date of suspension or debarment. OPM added that it will consider revisions to the applicable regulations for an earlier notification. However, as discussed in the report, the issue we found was not about the timeliness of the notification. Rather, we found that two FEHB carriers do not notify patients that their provider is suspended or debarred if the patient’s claim is denied for reasons other than the provider’s suspension or debarment. Therefore, as we recommended, OPM should specifically clarify whether carriers must notify patients whose claims are denied.

In response to our tenth recommendation, OPM stated it agreed with the goal of the recommendation. OPM noted that it deferred to the OPM OIG regarding performing system reviews consistent with its information systems audit roles but that OPM would ensure that carriers implement required system improvements. OPM explained that, in coordination with OPM OIG, it will develop guidance and communications to notify carriers regarding when and how carriers should notify FEHB members when providers are suspended or debarred.

In response to our eleventh recommendation, OPM stated that, in coordination with OPM OIG, it will develop guidance and communications to notify carriers that they are permitted to search other sources, such as LEIE and the SAM exclusions list, for providers who may warrant suspension and debarment and that they must notify OPM OIG when they identify such providers.

In response to our twelfth recommendation, OPM stated that, in coordination with OPM OIG, it will develop guidance and communications to notify carriers that OPM OIG is the only debarring official authorized to exclude providers from receiving FEHB payments.

In response to our thirteenth recommendation, OPM stated that, in coordination with the OPM OIG, it will develop guidance and communications to notify carriers that they must consult with OPM OIG before overriding controls to change a provider’s suspension or debarment status.

In response to our fourteenth recommendation, OPM stated it agrees that methods of communication should result in information about suspended or debarred providers being more readily available to enrollees. OPM explained it will perform a review to identify how carriers may most effectively notify FEHB members when providers are debarred or suspended.

Finally, in response to our fifteenth recommendation, OPM stated it agrees that reducing the time a debarred provider can wait to submit claims would be beneficial. OPM explained it will perform additional research and analysis to determine the feasibility of developing and implementing controls to reduce the filing deadline while still ensuring that enrollees have adequate protections.

OPM OIG

OPM OIG provided written comments to a draft of this report, which are reproduced in appendix III. OPM OIG concurred with the six recommendations we made to it and identified planned actions to address those recommendations.

Additionally, OPM OIG stated in its comments that the detailed provider-level data underlying several of our findings and recommendations were not made available to OPM OIG for review in advance of responding to the draft report. As a result, OPM OIG explained that it was unable to independently assess the specific “potentially ineligible” provider risks we identified. However, during this review, we shared samples of the detailed, provider-level data with OPM OIG in an attempt to clarify if these potentially ineligible providers should be on OPM OIG’s suspension and debarment list. In response, OPM OIG provided us preliminary explanations, but we found the explanations were incorrect in some cases. For example, as discussed in the report, OPM OIG officials could not explain why providers on LEIE with roles that are listed on their guidance document as roles they debar are not included on their suspension and debarment list. As mentioned in our report, we are referring the detailed, provider-level data on these potentially ineligible providers to OPM OIG to take action, as appropriate.

We are sending copies of this report to the appropriate congressional committees, the Director of OPM, and the OPM Inspector General. In addition, this report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at BagdoyanS@gao.gov. Contact points for our Offices of Congressional Relations and Media Relations may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV.

Seto J. Bagdoyan
Director, Forensic Audits and Investigative Service

This report examines the extent to which (1) program control activities allow potentially ineligible providers to participate in the Federal Employees Health Benefits (FEHB) program; (2) the Office of Personnel Management (OPM) Office of the Inspector General’s (OIG) information-sharing practices comply with certain federal regulations, so that suspended or debarred providers do not participate in other federal programs; (3) selected FEHB carriers comply with requirements for identifying and excluding suspended or debarred providers; and (4) FEHB program rules and guidelines create opportunities for fraud and abuse.

For each objective, we assessed the reliability of all the data sources used in our analysis by performing electronic testing, reviewing relevant documentation, and interviewing knowledgeable OPM OIG and FEHB carrier officials, as appropriate. We determined that the data sources we analyzed were sufficiently reliable for the purposes of our audit objectives.

Analysis to Identify the Extent to Which Program Control Activities Allow Potentially Ineligible Providers to Participate in FEHB

To identify the extent to which program control activities allow potentially ineligible providers to participate in the FEHB program, we compared provider data from OPM OIG and selected FEHB insurance carriers with data sets with information on potentially ineligible providers, as described in additional detail below.[80]

To do this, we requested claims data from OPM OIG and selected FEHB carriers for services provided in 2022, the most recently available data when we began our work. The FEHB claims in our analysis were from multiple carriers, selected to encompass a mix of both large and small carriers. We made our selections based on the carrier-type and the proportion of FEHB members covered.[81] These carriers collectively represent over 90 percent of FEHB members.

After receiving the data from the carriers and OIGs, we matched providers in these data sets using unique identifiers, such as Tax Identification Number (TIN) or National Provider Identifier (NPI).[82] For those providers that did not have a TIN in the FEHB claims data we obtained from OPM OIG and the FEHB carriers, we obtained additional TIN information from the Centers for Medicare and Medicaid Services’s (CMS) Integrated Data Repository (IDR). We then compared the FEHB claims data with various data sets indicating that providers may be ineligible. Specifically, we compared these data to identify the following:

Deceased providers. To do this, we matched the providers from FEHB claims data using the identifying information we obtained from the CMS IDR with death data from the U.S. Department of the Treasury’s Do-Not-Pay (DNP) portal. The DNP portal is a service maintained by Treasury that allows federal agencies and select other entities to match data in order to reduce fraud and improper payments. Data submitted to DNP is matched by Treasury to other information sources, and any results are returned to the submitting agency. Specifically, we submitted the providers’ TIN and name in the data sources to obtain what Treasury refers to as “conclusive matches,” which are results where both the TIN and the full name match exactly. We conducted further analysis and identified providers whose date of death was at least 50 days before the date of service indicated on their paid claim.

We also analyzed a selection of four nongeneralizable claims involving deceased providers at one FEHB carrier to provide illustrative examples of the extent to which program control activities allowed potentially ineligible providers to participate in the FEHB program.[83] We selected claims for deceased providers who received payments for multiple claims with service dates at least 50 days after the providers’ dates of death. For this selection, we considered claims with the highest payment amounts and claims from deceased providers with the highest number of claims submitted. To develop case studies for selected claims from our file reviews, we analyzed FEHB carrier claims documentation and interviewed knowledgeable FEHB carrier officials to interpret the claims documentation. We also obtained information from OPM and OPM OIG about policies and procedures related to deceased providers.

Incarcerated providers. To do this, we matched the providers from FEHB claims data using identifying information we obtained from the CMS’s IDR with federal incarceration data from Treasury’s DNP portal. Specifically, we matched the providers’ TIN and full name in the data sources to obtain conclusive matches. Our analysis of the results identified providers who were incarcerated at the time of the date of service on their paid claim.

Providers excluded from other federal programs. To do this, we matched OPM OIG’s suspension and debarment list with the Department of Health and Human Services (HHS) OIG List of Excluded Individuals and Entities (LEIE) to identify providers on LEIE that are not on OPM OIG’s suspension and debarment list.[84] We also compared LEIE data to FEHB carrier claims data to identify providers on LEIE that submitted claims to FEHB carriers. In addition, we reviewed OPM OIG guidance documents on which provider roles on LEIE that OPM OIG would debar and consequently include on OPM OIG’s suspension and debarment list. As part of this work, we also interviewed OPM OIG and HHS OIG officials about the information on LEIE and how it is used to determine whether to suspend or debar providers from participating in the FEHB program.

We also analyzed these data to examine OPM OIG’s control activities for identifying providers excluded from other federal programs. To do this, we matched records from the OPM OIG suspension and debarment list to LEIE using TIN, NPI, and name information, as available. If a record on one list matched to the other list on any one of these criteria, we considered it a match. Consequently, the matches resulting from this data analysis may be overstated to the extent that matching data elements misidentify an individual or entity. Similarly, the matches resulting from this analysis may be understated to the extent that the matching did not identify individuals or entities, such as when missing TIN or NPI information in one data source prevented a match with another data source.

We further analyzed these data to examine OPM and OPM OIG’s control activities for using information such as TIN to identify and exclude potentially ineligible providers. Using the additional TIN information we obtained from CMS, we identified additional claims submitted by providers who were on OPM OIG’s suspension or debarment list, LEIE, or the General Service Administration’s (GSA) System for Award Management (SAM) exclusions list and who provided a service after the date of their debarment.[85] The claims data we obtained did not have the detail necessary to determine whether any of these claims may have fallen under an exception allowing an ineligible provider to perform services, such as the exception for providing emergency services.

We identified some limitations to the claims data that may yield understated results for our analyses. Specifically, the provider’s TIN or NPI were not always included in the insurance claims data we obtained from the OPM OIG or the selected FEHB carriers. To address this limitation and to facilitate data matching, we obtained additional provider TIN information from the CMS’s IDR, as described above. Specifically, we used provider NPI in the claims data to obtain provider TIN information from CMS’s IDR. However, not all of the claims in our population had an NPI, which limited our ability to obtain TINs from the CMS’s IDR for all of the providers in our claims data. Consequently, the results of our analysis are understated to the extent that we were unable to obtain provider TINs to facilitate matching. Figure 4 depicts examples of the data analysis that we performed for the first objective of this review.

For our first objective, we compared the information on FEHB claims and providers excluded from the FEHB program that we gathered from OPM OIG and FEHB carriers with Standards for Internal Control in the Federal Government.[86] In doing so, we determined that the control activities component of internal control was significant to the objective, along with the underlying principle that management should design control activities to mitigate risks to achieving the entity’s objectives to acceptable levels. We also determined that the information and communication component of internal control was significant to the objective, along with the underlying principles that management should use quality information to achieve the entity’s objectives and that management should externally communicate the necessary quality information to achieve the entity’s objectives. We also determined that the monitoring component of internal control was significant to the objective, along with the underlying principle that management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. We compared FEHB program control activities for preventing potentially ineligible providers from participating in FEHB with these principles.

Analysis to Identify the Extent to Which FEHB Program Information-Sharing Practices on Suspended or Debarred Providers Comply with Federal Regulations

To examine the extent to which OPM OIG information-sharing practices comply with certain federal regulations so that suspended or debarred providers do not participate in other federal programs, we obtained OPM OIG’s suspension and debarment list and the SAM exclusions list. We compared these data sets to identify OPM OIG suspension and debarment records that were not accurately reflected on the SAM exclusions list. We also obtained documents and interviewed OPM OIG officials to determine whether OPM OIG implemented a process to share information on these suspended or debarred providers, in accordance with federal regulations.

Specifically, we matched records from OPM OIG’s suspension and debarment list to the SAM exclusions list using TIN, NPI, and name information, as available. If a record on one list matched to the other list on any one of these criteria, we considered it a match. Consequently, the matches resulting from this data analysis may be overstated to the extent that matching data elements misidentify an individual or entity. Similarly, the matches resulting from this analysis may be understated to the extent that the matching did not identify individuals or entities, such as when missing TIN or NPI information in one data source prevented a match with another data source.

The SAM exclusions list includes exclusions from OPM, HHS, and other federal agencies; our analysis includes primarily those exclusion records where OPM is the excluding agency. We compared these data sources to identify providers that appeared on OPM OIG’s suspension and debarment list but did not appear on the SAM exclusions list with OPM as the excluding agency.[87] Similarly, we compared these data sources to identify providers on the SAM exclusions list that were excluded by OPM but did not appear on OPM OIG’s suspension and debarment list. For both data sources, we considered exclusions active as of December 31, 2022, for comparison. This population includes providers suspended or debarred on December 31, 2022, and earlier who were never reinstated or who were reinstated after December 31, 2022.

Analysis of Selected FEHB Carrier Practices, Program Rules, and Guidelines to Determine the Extent of Carrier Compliance and Identify Opportunities for Fraud and Abuse

To examine the extent to which selected FEHB carriers comply with requirements for identifying and excluding suspended and debarred providers, and the extent to which FEHB program rules and guidelines create opportunities for fraud and abuse, we reviewed documentation and interviewed officials from OPM, OPM OIG, and a selection of four FEHB health insurance carriers about their policies and processes for excluding providers from participating in the FEHB program and health insurance plans. Specifically, we selected Blue Cross Blue Shield, Government Employees Health Association, Aetna, and Kaiser Permanente for interviews and reviews of relevant carrier documentation. We selected these carriers for variation in how they operate and to encompass FEHB carriers that worked on both the national and regional level.

As part of this work, we also reviewed a nongeneralizable selection of 13 claims at one FEHB carrier to provide illustrative examples of carrier compliance with FEHB regulations and guidelines, as well as an example of how FEHB program rules and guidelines create opportunities for fraud and abuse. To do this, we first matched the selected FEHB carrier’s claims information against the OPM OIG suspension and debarment list and the SAM exclusions list. We selected 13 nongeneralizable claims to include variation in whether the claim was paid or denied, as well as whether the FEHB carrier’s claims data indicated there was an exception or waiver related to the claim. For claims that were paid, we selected claims with payment amounts greater than, or equal to, $100 that were made to providers.[88] To develop case studies for selected claims from our file reviews, we analyzed FEHB carrier claims documentation and interviewed knowledgeable FEHB carrier and OPM OIG officials to interpret the claims documentation. We also reviewed FEHB carrier; OPM; and OPM OIG guidelines, policies, and procedures related to these claims.

As part of our examination of the extent to which FEHB program rules and policies create opportunities for fraud and abuse, we also posed as new FEHB patients and conducted covert calls to suspended or debarred providers with a history of billing the FEHB program to ask if they accepted FEHB insurance. Specifically, in April 2025, we attempted to contact 59 debarred providers we identified through our data matching who had previously submitted claims to the FEHB program and were listed on OPM OIG’s suspension and debarment list. We conducted covert calls to only debarred individuals. We did not conduct covert calls to debarred facilities because an eligible provider working within a debarred facility may be permitted to submit claims to the FEHB program.

We contacted 26 of the 59 providers by speaking to the debarred provider directly, the provider’s current office, or the provider’s last known practice who confirmed the provider is no longer practicing. For the remaining 33 providers, we were unable to make contact with the debarred provider. The results of our covert calls are illustrative only of the health care providers we interacted with during the calls and are not generalizable to all providers excluded from the FEHB program.

For the third and fourth objectives, we compared the information we gathered with program rules, policy, and guidance, as well as a leading practice for managing fraud risks from A Framework for Managing Fraud Risks in Federal Programs.[89] We also compared the information we gathered with Standards for Internal Control in the Federal Government.[90] Specifically, for the third objective, we determined that the control activities component of internal control was significant to this objective, along with the underlying principles that management should design control activities and design activities for information systems. For the third and fourth objectives, we determined that the information and communication component of internal control was significant to the objective, along with the underlying principle that management should externally communicate the necessary quality information to achieve the entity’s objectives. We compared selected FEHB carriers’ activities, as well as FEHB program rules and policy, with these principles, as appropriate.

We conducted this performance audit from June 2023 to April 2026 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We conducted our related investigative work in accordance with investigation standards prescribed by the Council of the Inspectors General on Integrity and Efficiency. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

The Office of Personnel Management (OPM) has statutory and regulatory authority to prohibit health care providers from receiving Federal Employees Health Benefits (FEHB) program funds through suspension and debarment.[91] OPM has delegated these suspension and debarment authorities to the OPM Office of the Inspector General (OIG).[92] According to OPM OIG policy, the OPM OIG Debarring Official has the authority to debar or suspend providers of health care services from participating in the FEHB program.[93]

If a provider commits a sanctionable action or meets the qualifications for suspension or debarment, OPM OIG will consider the provider for an OPM mandatory debarment, permissive debarment, or suspension.[94] The OPM OIG Debarring Official must debar providers who meet the grounds for mandatory debarment described in table 1 (below) and uses discretion to debar providers who meet the grounds for permissive debarment described in table 2 (below). The OPM OIG Debarring Official similarly uses discretion to suspend providers who meet the grounds for suspension described in table 3 (below).

Basis for mandatory debarment	Legal authority
·        Any provider that has been convicted, under federal or state law, of a criminal offense relating to fraud, corruption, breach of fiduciary responsibility, or other financial misconduct in connection with the delivery of a health care service or supply.	5 U.S.C. § 8902a(b)(1)
·        Any provider that has been convicted, under federal or state law, of a criminal offense relating to neglect or abuse of patients in connection with the delivery of a health care service or supply.	5 U.S.C. § 8902a(b)(2)
·        Any provider that has been convicted, under federal or state law, in connection with the interference with, or obstruction of, an investigation or prosecution of a criminal offense described in §§ 8902a(b)(1) or (2).	5 U.S.C. § 8902a(b)(3)
·        Any provider that has been convicted, under federal or state law, of a criminal offense relating to the unlawful manufacture, distribution, prescription, or dispensing of a controlled substance.	5 U.S.C. § 8902a(b)(4)
·        Any provider that is currently debarred, suspended, or otherwise excluded from any procurement or nonprocurement activity (within the meaning of the Federal Acquisition Streamlining Act of 1994, Pub. L. No. 103-355, Title II, Subtitle E, § 2455, 108 Stat. 3243, 3327).	5 U.S.C. § 8902a(b)(5)

Source: GAO summary of 5 U.S.C. § 8902a(b). | GAO‑26‑108139

Basis for permissive debarment	Legal authority
·        Any provider whose license to provide health care services or supplies has been revoked, suspended, restricted, or not renewed by a state licensing authority for reasons relating to the provider’s professional competence, professional performance, or financial integrity.	5 U.S.C. § 8902a(c)(1)(A)
·        Any provider that surrendered a license to provide health care services or supplies while a formal disciplinary proceeding was pending before such an authority, if the proceeding concerned the provider’s professional competence, professional performance, or financial integrity.	5 U.S.C. § 8902a(c)(1)(B)
·        Any provider that is an entity directly or indirectly owned, or with a control interest of 5 percent or more held, by an individual who has been convicted of any offense described in § 8902a(b), against whom a civil monetary penalty has been assessed under § 8902a(d), or who has been debarred from participation under §§ 8901 - 8914.	5 U.S.C. § 8902a(c)(2)
·        Any individual who directly or indirectly owns, or has a control interest in, a sanctioned entity and who knows, or should know, of the action constituting the basis for the entity’s conviction of any offense described in § 8902a(b), assessment with a civil monetary penalty under § 8902a(d), or debarment from participation under §§ 8901 - 8914.	5 U.S.C. § 8902a(c)(3)
·        Any provider that the Office of Personnel Management (OPM) determines, in connection with claims presented under §§ 8901 - 8914, has charged for health care services or supplies in an amount substantially in excess of such provider’s customary charge for such services or supplies (unless OPM finds there is good cause for such charge), or charged for health care services or supplies that are substantially in excess of the needs of the covered individual, or that are of a quality that fails to meet professionally recognized standards for such services or supplies.	5 U.S.C. § 8902a(c)(4)
·        Whenever OPM determines, in connection with claims presented under §§ 8901 - 8914, that a provider has charged for a health care service or supply that the provider knows, or should have known, involves an item or service not provided as claimed.	5 U.S.C. §§ 8902a(c)(5) and (d)(1)(A)
·        Whenever OPM determines, in connection with claims presented under §§ 8901 - 8914, that a provider has charged for a health care service or supply that the provider knows, or should have known, involves charges in violation of applicable charge limitations under § 8904(b).	5 U.S.C. §§ 8902a(c)(5) and (d)(1)(B)
·        Whenever OPM determines, in connection with claims presented under §§ 8901 - 8914, that a provider has charged for a health care service or supply that the provider knows, or should have known, involves an item or service furnished during a period in which the provider was debarred from participation under §§ 8901 – 8914 pursuant to a determination by OPM under § 8902a, other than as permitted under § 8902a(g)(2)(B).	5 U.S.C. §§ 8902a(c)(5) and (d)(1)(C)
·        Whenever OPM determines that a provider of health care services or supplies has knowingly made, or caused to be made, any false statement or misrepresentation of a material fact that is reflected in a claim presented under §§ 8901 - 8914.	5 U.S.C. §§ 8902a(c)(5) and (d)(2)
·        Whenever OPM determines that a provider of health care services or supplies has knowingly failed to provide any information required by a carrier, or by OPM, to determine whether a payment or reimbursement is payable under §§ 8901 – 8914, or the amount of any such payment or reimbursement.	5 U.S.C. §§ 8902a(c)(5) and (d)(3)

Source: GAO summary of 5 U.S.C. §§ 8902a(c) and (d). | GAO‑26‑108139

Basis for suspension	Legal authority
The Office of Personnel Management obtains reliable evidence indicating that one of the grounds for suspension listed in 5 C.F.R. § 890.1031(b) applies to the provider and the suspending official determines under § 890.1031(c) that immediate action to suspend the provider is necessary to protect the health and safety of persons covered by the FEHB program.	5 C.F.R. § 890.1031(a)
Grounds for suspension	Legal authority
·        Reliable evidence of an indictment or conviction of a provider for a criminal offense that is a basis for mandatory debarment under 5 C.F.R. Part 890 Subpart J.	5 C.F.R. § 890.1031(b)(1)
·        Reliable evidence of an indictment or conviction of a provider for a criminal offense that reflects a risk to the health, safety, or well-being of FEHB program-covered individuals.	5 C.F.R. § 890.1031(b)(2)
·        Other credible evidence indicating, in the judgment of the suspending official, that a provider has committed a violation that would warrant debarment under 5 C.F.R. Part 890 Subpart J. This may include, but is not limited to ·        civil judgments; ·        notice that a federal, state, or local government agency has debarred, suspended, or excluded a provider from participating in a program or revoked or declined to renew a professional license; or ·        other official findings by federal, state, or local bodies that determine factual or legal matters.	5 C.F.R. § 890.1031(b)(3)
Determining need for immediate action	Legal authority
Suspension is intended to protect the public interest, including the health and safety of covered individuals or the integrity of FEHB program funds. The suspending official has wide discretion to decide whether to suspend a provider. A specific finding of immediacy or necessity is not required to issue a suspension. The suspending official may draw reasonable inferences from the nature of the alleged misconduct and from a provider’s actual or potential transactions with the FEHB program.	5 C.F.R. § 890.1031(c)

Source: GAO summary of 5 C.F.R. § 890.1031. | GAO‑26‑108139

GAO Contact

Seto J. Bagdoyan, BagdoyanS@gao.gov

Staff Acknowledgments

In addition to the contact named above, Jonathon Oldmixon (Assistant Director), Mari Calderón (Assistant Director), Brenda Mittelbuscher (Analyst in Charge), Garrick Donnelly, Amber D. Gray, Melissa Hart, Megan Huberty, Haley Klosky, Mark MacPherson, Tina Paek, Anna Pechenina, and Erin McLaughlin Villas made key contributions to this report. Other contributors include Jim Ashley, Colin Fallon, Chris Klemmer, Barbara Lewis, Maria McMullen, Michelle Munn, James Murphy, Lisa Rogers, Andrew Stavisky, and Margaret Weber.

GAO’s Mission

The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost is through our website. Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. You can also subscribe to GAO’s email updates to receive notification of newly posted products.

Order by Phone

The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, https://www.gao.gov/ordering.htm.

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO

Connect with GAO on X, LinkedIn, Instagram, and YouTube.
Subscribe to our Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.

To Report Fraud, Waste, and Abuse in Federal Programs

Contact FraudNet:

Website: https://www.gao.gov/about/what-gao-does/fraudnet

Automated answering system: (800) 424-5454

Media Relations

Sarah Kaczmarek, Managing Director, Media@gao.gov

Congressional Relations

David A. Powner, Acting Managing Director, CongRel@gao.gov

General Inquiries

https://www.gao.gov/about/contact-us