United States Government Accountability Office Report to the Honorable Charles E. Grassley, United States Senate ABUSE AND December 2022 NEGLECT CMS Should Strengthen Reporting Requirements to Better Protect Individuals Receiving Hospice Care GAO-23-105463 December 2022 ABUSE AND NEGLECT CMS Should Strengthen Reporting Requirements to Better Protect Individuals Receiving Hospice Care Highlights of GAO-23-105463, a report to the Honorable Charles E. Grassley, United States Senate Why GAO Did This Study What GAO Found Vulnerable populations receiving GAO's review of Centers for Medicare & Medicaid Services (CMS) requirements extended (non-acute) care from for reporting and responding to abuse and neglect allegations found two gaps in Medicare- or Medicaid-certified the requirements for hospices, compared with requirements for extended care hospitals, hospices, and nursing provided in hospitals and nursing homes. Hospices, which can provide care in a homes have the right to be free from patient's home or other settings, are required to report allegations to the state abuse and neglect, according to CMS's agencies responsible for monitoring them only if: (1) the alleged perpetrator is requirements. These requirements affiliated with the hospice; and (2) after the hospice has verified it as abuse or include actions Medicare and Medicaid neglect based on an internal investigation that could take up to 5 days. In providers should take to report and contrast, nursing homes and hospitals providing extended care are required to respond to abuse and neglect report all abuse and neglect allegations, regardless of whether the alleged allegations. CMS enters into agreements with state survey agencies perpetrator is affiliated with the hospice and prior to conducting an internal to monitor providers' compliance with investigation. these requirements and investigate incidents reported to them. GAO was asked to review CMS's Reporting Requirements for Allegations of Abuse and Neglect in Hospice abuse and neglect requirements. This Care report examines, among other issues, any differences in CMS's requirements for reporting and responding to abuse and neglect across these provider types. GAO reviewed relevant CMS requirements contained in regulations and guidance and interviewed CMS officials about any differences in the requirements for reporting and responding to abuse and neglect among these provider types. What GAO Recommends As a result of these gaps, hospice care providers' reporting may be less GAO recommends that CMS require complete or timely than that of nursing homes and hospitals providing extended hospice care providers to report all care. For example, hospices are not required to report allegations involving allegations of abuse and neglect alleged perpetrators not affiliated with the hospice even though research immediately to survey agencies, suggests that most abuse of older individuals is committed in the home by an regardless of whether the alleged individual's caregivers, such as family members. perpetrator is affiliated with the hospice. HHS neither agreed nor Immediately reporting all allegations to survey agencies before providers conduct disagreed with GAO's investigations is important because the agencies use abuse and neglect recommendation. allegations to inform decisions about the need to conduct their own unannounced on-site investigations of hospice providers. These investigations can ensure, for example, that the hospice has worked within the scope of its authority to protect individuals receiving care. Strengthening hospice reporting requirements to align with the requirements for nursing homes and hospitals providing extended care will provide CMS with the information necessary to ensure that hospice care View GAO-23-105463. For more information, contact John E. Dicken at (202) 512-7114 or providers are taking appropriate steps within the scope of their authority to dickenj@gao.gov. protect vulnerable individuals. United States Government Accountability Office Contents Letter 1 Background 4 CMS's Definitions of Abuse and Neglect for Hospitals, Nursing Homes, and Hospices Are Largely Consistent 8 Compared to Hospitals and Nursing Homes, Hospice Abuse and Neglect Reporting Requirements Contain Gaps 10 Conclusions 16 Recommendation for Executive Action 16 Agency Comments and Our Evaluation 16 Appendix I: Federal Requirements Related to Abuse and Neglect Allegations in Hospitals, Nursing Homes, and Hospices 19 Appendix II: Comments from the Department of Health and Human Services 21 Appendix III: GAO Contact and Staff Acknowledgments 25 Table Table 1: Summary of CMS Requirements for Initial Reporting and Verification of, and Response to, Allegations of Abuse or Neglect in Medicare- or Medicaid-Certified Hospitals, Nursing Homes, and Hospices 19 Figures Figure 1: General Steps in CMS Requirements for Providers to Identify, Report, and Respond to Abuse and Neglect 7 Figure 2: Reporting Requirements for Allegations of Abuse and Neglect in Hospice Care 11 Page i GAO-23-105463 Abuse and Neglect Abbreviations CMS Centers for Medicare & Medicaid Services HHS Department of Health and Human Services OIG Office of Inspector General SOM State Operations Manual This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Page ii GAO-23-105463 Abuse and Neglect Letter 441 G St. N.W. Washington, DC 20548 December 12, 2022 The Honorable Charles E. Grassley United States Senate Dear Senator Grassley: The Centers for Medicare & Medicaid Services (CMS), an agency within the Department of Health and Human Services (HHS), requires that all hospital, nursing home, and hospice providers that participate in the Medicare or Medicaid programs protect individuals' rights to be free from abuse and neglect. 1 Individuals with physical or cognitive limitations, such as some older adults or individuals with intellectual disabilities, may be particularly vulnerable to abuse and neglect. 2 These vulnerable populations may receive extended care from providers such as nursing homes and hospices. 3 Certain hospitals may also provide extended care 1See 42 C.F.R. §§ 418.52(c)(6), 482.13(c)(3), 482.58(b)(3), 483.12 (2021). Medicare, the federal health insurance program for people age 65 and older, individuals under age 65 with certain disabilities, and individuals diagnosed with end-stage renal disease, covers some short-term skilled nursing and rehabilitative care following an acute care hospital stay. Medicaid, a joint federal-state health program for low-income and medically needy individuals, is the nation's primary payer of long-term services and supports for children and adults with disabilities and aged individuals. 2See, for example, Willi Horner-Johnson and Charles E. Drum, "Prevalence of Maltreatment of People with Intellectual Disabilities: A Review of Recently Published Research," Developmental Disabilities Research Reviews vol. 12 (2006): 57-69; and Catherine Hawes, "Elder Abuse in Residential Long-Term Care Settings: What Is Known and What Information Is Needed?," in Elder Mistreatment: Abuse, Neglect, and Exploitation in an Aging America, eds. Richard J. Bonnie and Robert B. Wallace (Washington, D.C.: The National Academies Press, 2003), 446-500. 3Inthis report we use the term "extended care" to refer to services provided for a longer duration than care provided for a short-term illness or injury. The Social Security Act and its implementing regulations use the terms "skilled nursing facility" (Medicare) and "nursing facility" (Medicaid). For the purposes of this report, we use the term nursing home to refer to both skilled nursing facilities and nursing facilities. Hospice care is most often provided in private homes but can also be provided in hospitals, nursing homes, or other settings. Page 1 GAO-23-105463 Abuse and Neglect services through swing beds, in addition to their provision of acute care. 4 CMS establishes federal requirements that providers must meet to participate in CMS programs. These requirements, which may differ depending on the type of provider, define abuse and neglect and establish requirements for reporting and responding to abuse and neglect allegations. 5 We and the HHS Office of Inspector General (OIG) previously found that CMS needed to do more to protect individuals from abuse and neglect in extended care settings. For example, in 2019, we reported that CMS could not readily access information on abuse or perpetrator type in its data on nursing home abuse deficiencies and, therefore, lacked key information critical to taking appropriate actions. 6 Also in 2019, the HHS OIG published two reports detailing hospice care deficiencies that posed risks to individuals receiving care. The reports included several recommendations to strengthen safeguards to protect them from harm. 7 4Medicare permits certain small, rural hospitals to operate swing beds, which are beds that can be used to provide either acute or extended care services. Hospitals with swing bed agreements must meet several eligibility requirements, such as having fewer than 100 hospital beds, being located in a rural area, and being substantially in compliance with several skilled nursing facility requirements, including those ensuring patients' rights to be free from abuse, neglect, and exploitation. 5See 42 C.F.R. pts. 418, 482, and 483 (2021). 6See GAO, Nursing Homes: Improved Oversight Needed to Better Protect Residents from Abuse, GAO-19-433 (Washington D.C.: June 13, 2019). In this report, we made six recommendations, including that CMS require state survey agencies to submit data on abuse and perpetrator type in CMS databases. HHS concurred with this recommendation and updated guidance-effective October 2022-that included changes to how it oversees abuse investigations. As of November 2022, we have requested additional information from CMS regarding the October guidance and, when this information is received, we will update the recommendation status, as appropriate. 7Department of Health and Human Services Office of Inspector General, Hospice Deficiencies Pose Risks to Medicare Beneficiaries, OEI-02-17-00020 (Washington, D.C.: July 2019); Department of Health and Human Services Office of Inspector General, Safeguards Must Be Strengthened To Protect Medicare Hospice Beneficiaries From Harm, OEI-02-17-00021 (Washington, D.C.: July 2019). Page 2 GAO-23-105463 Abuse and Neglect You asked us to examine the definitions and requirements related to abuse and neglect among selected Medicare- and Medicaid-certified health care settings. 8 In this report, we 1. describe CMS's definitions of abuse and neglect for hospitals, nursing homes, and hospices, and 2. examine any differences in CMS requirements for reporting and responding to abuse and neglect in hospitals, nursing homes, and hospices. To describe CMS's definitions of abuse and neglect for hospitals, nursing homes, and hospices, we reviewed and analyzed relevant definitions of the terms abuse and neglect in CMS's requirements-specifically relevant federal regulations and the agency's State Operations Manual (SOM). 9 This also included definitions that apply to hospitals providing extended care through swing beds. We focused our review on definitions of abuse or neglect for Medicare- and Medicaid-certified providers and did not include in our scope other patient rights defined in CMS's requirements, such as those involving patients' freedom from seclusion or financial exploitation. We also interviewed CMS officials responsible for the applicable regulations and SOM for hospitals, nursing homes, and hospices to learn about their process, revisions, and rationale for the definitions of abuse and neglect. Finally, we interviewed representatives from 10 stakeholder groups to learn about their understanding and application of CMS's definitions of abuse and neglect. These groups included representatives from the hospital, nursing home, and hospice industries; consumer and health care provider organizations; a health care accrediting organization, and academic researchers who have conducted studies about abuse and neglect. To examine any differences in CMS requirements for reporting and responding to abuse and neglect in hospitals, nursing homes, and hospices, we reviewed relevant requirements as stated in the regulations 8SenatorGrassley's November 2020 request was in his role as Chairman of the Senate Committee on Finance in the 116th Congress. 9The CMS State Operations Manual sections we reviewed provide CMS policy regarding survey and certification activities. Centers for Medicare & Medicaid Services, State Operations Manual Appendix A – Regulations and Interpretive Guidelines for Hospitals, (Rev. 200, Feb. 21, 2020); State Operations Manual Appendix M - Guidance to Surveyors: Hospice, (Rev. 200, Feb. 21, 2020); and State Operations Manual Appendix PP - Guidance to Surveyors for Long Term Care Facilities, (Rev. 173, Nov. 22, 2017). Page 3 GAO-23-105463 Abuse and Neglect and SOM for the three provider types. 10 In our comparison of reporting requirements for hospitals, we focused on hospitals providing extended care through swing beds because they, like nursing homes and hospices, are providing extended care services for a longer duration than acute care. 11 We assessed the extent to which these requirements were consistent with CMS's requirement that Medicare- and Medicaid-certified providers protect individuals' right to be free from abuse and neglect, as well as with federal standards for internal control related to using quality information. 12 We also interviewed CMS officials responsible for the applicable regulations and SOM for hospitals, nursing homes, and hospices, to obtain their perspective on the differences among the requirements by provider type. We conducted this performance audit from September 2021 to December 2022 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Background Hospital, Nursing Home, The Medicare and Medicaid programs provide coverage for medical care and Hospice Participation provided in various settings. Eligible individuals may obtain care from hospitals, nursing homes, and hospices in their lifetime. in the Medicare and Medicaid Programs • Hospitals. Hospitals admit patients to treat acute illness or injury on a short-term basis. Additionally, Medicare permits certain small, rural 10The requirements for reporting abuse or neglect we reviewed pertain to the initial reporting of an allegation, such as reporting from a staff member to an administrator. The requirements for responding to abuse and neglect we reviewed pertain to actions the provider must take in response to the initial allegation. These actions include verifying the allegation, externally reporting information about the verified allegation with appropriate local and state authorities, including state survey agencies and CMS. 11For example, the average length of stay for Medicare patients admitted to acute care hospitals was about 10 days in 2019. In contrast, the average length of time that Medicare decedents spent in hospice care in 2019 was 93 days. 12See 42 C.F.R. §§ 418.52(c)(6), 482.13(c)(3), 482.58(b)(3), and 483.12 (2021); and GAO, Standards for Internal Control in the Federal Government. GAO-14-704G (Washington, D.C.: Sept. 10, 2014). Internal control comprises the plans, methods, policies, and procedures used to fulfill the mission, strategic plan, goals and objectives of the entity. Page 4 GAO-23-105463 Abuse and Neglect hospitals to operate swing beds, which are beds that can be used to provide either acute or extended care services, like the extended care provided in nursing homes. Both Medicare and Medicaid provide coverage for hospital care. In fiscal year 2019, 6,361 hospitals participated in Medicare, Medicaid, or both programs, according to CMS's Quality, Certification, and Oversight Reports. According to CMS, 745 Medicare-participating hospitals were approved for swing beds as of September 19, 2022. In fiscal year 2019, Medicare covered 8.7 million inpatient hospital stays. • Nursing homes. Nursing homes provide skilled nursing and rehabilitative care to elderly and disabled individuals. Medicare provides some short-term skilled nursing and rehabilitation care for beneficiaries following an acute care hospital stay. Medicaid is the nation's primary payer of long-term services and supports for children and adults with disabilities and aged individuals. Nationwide, more than 15,000 nursing homes participating in the Medicare and Medicaid programs provide care to over 1 million residents, according to CMS data. • Hospices. Hospice care addresses the physical and emotional needs of individuals with terminal illnesses. This care is most often provided in private homes but can also be provided in hospitals, nursing homes, or other settings. 13 Hospice care is an optional Medicaid benefit, so coverage details vary by state. 14 Under Medicare, an individual who is certified by a physician as having 6 or less months to live may qualify for hospice care. Medicaid and Medicare's hospice benefits are holistic, providing for an individual's physical, emotional, and spiritual needs. In 2019, over 1.6 million Medicare enrollees received hospice care services from 4,840 hospice care providers participating in Medicare. The share of Medicare decedents who used hospice rose from 50.6 percent to 51.6 percent from 2018 through 2019. 15 13About half (49 percent) of Medicare hospice care was provided in private homes to individuals who were decedents in 2019. The remainder was provided in a combination of nursing homes (21 percent), assisted living facilities (11 percent), hospice facilities (11 percent), and hospitals (7 percent), according to Medicare Payment Advisory Commission data. 14In 2021, 49 states included hospice as a Medicaid benefit, according to the National Hospice and Palliative Care Organization. 15Medicare Payment Advisory Commission, Report to the Congress: Medicare Payment Policy. (Washington, D.C.: March 15, 2021). Page 5 GAO-23-105463 Abuse and Neglect CMS Requirements for CMS's requirements for Medicaid- and Medicare-certified hospitals, Identifying, Reporting, and nursing homes, and hospices describe steps these providers should take to identify, report, and respond to an incident of abuse or neglect. Specific Responding to Abuse and requirements can vary by provider type, and CMS requires providers to Neglect comply with applicable state and local laws pertaining to patients' health and safety. Therefore, it is possible that reporting varies depending on provider and location. However, in general, CMS requirements state that possible incidents of abuse should be reported internally to the provider's designated leadership or responsible administrator. 16 At this time, the administrator may also externally report the allegation to other applicable authorities as required. 17 The administrator is then responsible for addressing the allegation to verify it and externally reporting a verified allegation to applicable authorities. Finally, the administrator or CMS may take corrective action in response to the verified allegation, which can include the administrator removing staff, or CMS imposing monetary penalties based on severity or possibly terminating the provider's participation in the Medicaid or Medicare programs. (See fig. 1.) In addition to CMS's requirements, every state also requires certain individuals, such as health professionals in various fields, to report suspected abuse or neglect to law enforcement or the state's adult protective services program. 18 16Reports of abuse can originate from multiple sources, including staff, individuals receiving care, or family members. 17Applicable authorities can include local or state agencies with oversight responsibilities, as required by state law, and state agencies that have agreements with CMS to oversee compliance with CMS requirements. If there is reasonable suspicion that a crime has occurred, reporting to law enforcement may be required under federal or state law. 18The adult protective services program in each state is generally responsible for identifying, investigating, resolving, and preventing abuse of older adults but in some states may not have jurisdiction over nursing homes. Page 6 GAO-23-105463 Abuse and Neglect Figure 1: General Steps in CMS Requirements for Providers to Identify, Report, and Respond to Abuse and Neglect Note: CMS requires providers to comply with applicable state and local laws pertaining to patients' health and safety, so reporting to state or local entities may vary by state. a Applicable authorities can include local or state agencies with oversight responsibilities, as required by state law, and state agencies that have agreements with CMS to oversee compliance with CMS requirements. If there is reasonable suspicion that a crime has occurred, reporting to law enforcement may be required under federal or state law. To monitor providers' compliance with these requirements, CMS enters into agreements with agencies in each state government-known as state survey agencies-and oversees their work. 19 The survey agencies conduct required evaluations of a provider-referred to as standard surveys-as well as investigating complaints from the public or from providers. The survey agency in a given state is required to conduct a standard on-site survey of all nursing homes approximately once each year. 20 Hospitals and hospices have different survey time frames and may be surveyed by state survey agencies or by CMS-approved accrediting 19Survey agencies are frequently housed in the human services department of state governments and may have different names in different states. 20Routine surveys must occur at least once every fifteen months, with a statewide average interval for surveys not to exceed 12 months. 42 U.S.C. §§ 1395i-3(g)(2)(A)(iii), 1396r(g)(2)(A)(iii). State survey agencies are also required to investigate allegations of neglect and abuse in nursing homes in response to complaints and facility-reported incidents filed with state survey agencies. 42 U.S.C. §§ 1395i-3(g)(1)(C), 1396r(g)(1)(C). Page 7 GAO-23-105463 Abuse and Neglect organizations, such as The Joint Commission. 21 In fiscal year 2019, 82 percent of hospitals and 49 percent of hospices used CMS-approved accrediting organizations for certification, according to CMS. 22 In addition to CMS actions, other state and local agencies may be involved in responding to allegations of abuse and neglect, such as adult protective services and local law enforcement. 23 Our review of relevant federal regulation and SOM definitions of "abuse" CMS's Definitions of and "neglect" found that the definitions are largely consistent for Abuse and Neglect Medicare- or Medicaid- certified hospitals, nursing homes, and hospices. 24 Across the three provider types, CMS requirements generally for Hospitals, Nursing define abuse and neglect as follows. Homes, and Hospices Abuse. The willful infliction of injury, unreasonable confinement, Are Largely • intimidation, or punishment with resulting physical harm, pain, or Consistent mental anguish. • Neglect. The failure to provide goods and services necessary to avoid physical harm or mental anguish. CMS's requirements for nursing homes and hospices further address specific types of abuse, including verbal, sexual, physical, and mental 21The Joint Commission is the nation's oldest and largest standards-setting and accrediting body in health care. The Joint Commission offers accreditation for hospitals, hospices, and other health care settings. Hospitals that are surveyed by the Joint Commission are reviewed every 36 months. Hospitals that are surveyed by state survey agencies are reviewed an average of every 36 months, with no more than 5 years elapsing between surveys. Hospices-both agency-surveyed and accredited-are reviewed every 36 months. CMS-approved accrediting organizations must demonstrate that their health and safety requirements and survey and oversight processes meet or exceed CMS requirements. 22Centers for Medicare & Medicaid Services, FY 2020 Report to Congress (RTC): Review of Medicare's Program Oversight of Accrediting Organizations (AOs) and the Clinical Laboratory Improvement Amendments of 1988 (CLIA) Validation Program, QSO-22-06- AO/CLIA (Baltimore, M.D.: Dec. 15, 2021). In this report, we use the phrase "state survey agencies and other applicable authorities" to represent the range of entities that providers in our review may report abuse and neglect allegations to, including accrediting organizations. 23GAO-19-433. 24In addition to definitions of abuse and neglect, CMS requirements for Medicare- and Medicaid-certified hospitals, nursing homes, and hospices include additional protections outside the scope of this review. For example, all three provider types must ensure that individuals are free from the use of restraints or seclusion, unless their use is required to treat medical symptoms or to ensure the immediate physical safety of the patient, staff, or others. 42 C.F.R. §§ 418.110(n), 482.13(e), 483.12 (2021). Page 8 GAO-23-105463 Abuse and Neglect abuse, as does guidance for hospitals issued by the Joint Commission. For example, sexual abuse is defined in the nursing home requirements as non-consensual sexual contact of any type with a resident and, in the hospice requirements, as including, but not limited to, sexual harassment, sexual coercion, or sexual assault. While CMS's requirements for hospitals do not specifically address these types of abuse, standards issued by the Joint Commission, which accredits hospitals, address how hospitals are to protect patients from physical, verbal, mental, and sexual abuse. Swing-beds in hospitals are subject to the definition of abuse and neglect that applies to nursing home providers, which, as noted above, includes verbal, sexual, physical, and mental abuse. 25 While the core definitions of abuse and neglect are generally consistent across the three provider types, some differences exist. For example, CMS's definition of neglect for Medicare- and Medicaid-certified hospitals includes the failure to provide goods and services necessary to avoid mental illness. For Medicare- and Medicaid-certified nursing homes, the definition of neglect includes failure to provide goods and services necessary to avoid pain or emotional distress. Further, CMS's requirements for nursing homes, which were updated in 2016, contain additional language related to abuse not included in the requirements for hospitals and hospices. Specifically, the nursing home requirements state that mental abuse includes abuse facilitated or enabled through the use of technology, which would include keeping or distributing demeaning photographs or recordings of a resident through social media. Mental abuse facilitated or enabled through the use of technology is not specified in the hospital and hospice requirements. Additionally, the nursing home requirements further define the term "willful" to mean that the individual acted deliberately, regardless of whether the individual intended to inflict injury or harm; this specificity is not included in the definitions for hospice care providers or hospitals. Representatives from the nursing home industry expressed concern about the additional language defining "willful." Specifically, they stated that a person's intent to cause harm is considered when determining whether an action constitutes abuse in hospitals, but it is not in nursing homes. As a result, in their view, the additional definition of "willful" could require nursing homes to report allegations of abuse that would not be considered abuse in other settings such as hospitals. However, CMS officials disagreed with this assertion and told us that the agency's 2542 C.F.R. § 482.58(b) (2021). Page 9 GAO-23-105463 Abuse and Neglect interpretation of "willful" does not differ across provider types. They noted further that the definition of willful makes it clear that abuse could occur even in the absence of an intent to harm an individual. CMS officials said that the agency tries to promote consistency in requirements across provider types and could not think of a specific incident that would be considered abuse in one setting but not in another. The officials said that the agency has not heard concerns from facilities, staff, or beneficiaries about any differences in the requirements for abuse and neglect across provider types. CMS officials said that when the agency updated its requirements for nursing homes in 2016, it did so in part to resolve confusion it was aware of about what types of actions could be considered abuse, such as abuse enabled through the use of technology. The officials said that CMS has not heard of confusion about the definitions of abuse or neglect from hospital or hospice care providers. Similarly, the majority of stakeholders we spoke with did not raise concerns about CMS's definitions of abuse or neglect across the provider types. In our review of CMS's requirements for reporting and responding to Compared to abuse and neglect, we found two gaps in reporting requirements for Hospitals and Nursing hospice care providers that do not exist in the requirements for nursing homes and hospital swing beds. 26 First, CMS does not require hospices Homes, Hospice to report abuse and neglect allegations to state survey agencies or the Abuse and Neglect hospice administrator when the alleged perpetrator is not affiliated with the hospice. Second, even when the alleged perpetrator is affiliated with Reporting the hospice, hospices are not required to report allegations of abuse or Requirements neglect externally until after the hospice has conducted an internal investigation. Then, only a subset of those allegations-those verified by Contain Gaps the investigation-are required to be reported. (See fig. 2.) 26In our comparison of reporting requirements for hospitals, we focused on hospitals providing extended care through swing beds because they, like nursing homes and hospices, are providing extended care services for a longer duration than acute care. Officials from a provider organization, industry representatives, and an academic researcher on abuse and neglect told us that that hospitals' abuse and neglect focus is on emergency room screening, rather than inpatient stays. This is because, as one researcher noted, inpatient stays are generally short and there are many people in and out of a patient's room to observe and report any suspicious behavior. Page 10 GAO-23-105463 Abuse and Neglect Figure 2: Reporting Requirements for Allegations of Abuse and Neglect in Hospice Care Note: CMS requires providers to comply with applicable state and local laws pertaining to patients' health and safety, so reporting to state or local entities may vary by state. a Applicable authorities can include local or state agencies with oversight responsibilities, as required by state law, and state agencies that have agreements with CMS to oversee compliance with CMS requirements. If there is reasonable suspicion that a crime has occurred, reporting to law enforcement may be required under federal or state law. Reporting gap for perpetrators not affiliated with the hospice. Hospices are only required to report to the hospice administrator or survey agencies when the alleged perpetrator is an individual furnishing services on behalf of the hospice. (See app. I for more information on CMS's reporting requirements for each provider type in our review.) Incidents in which the alleged perpetrator is not affiliated with the hospice-such as a family member of an individual receiving hospice care in their home-are not required to be reported to the hospice administrator or survey agency. In contrast, CMS requires that other providers of extended care-nursing homes and hospitals providing extended care services through swing beds-report all abuse and neglect allegations to survey agencies regardless of the perpetrator. This gap in hospice reporting requirements is concerning given previous research suggesting that most abuse of older individuals is committed in Page 11 GAO-23-105463 Abuse and Neglect the home by an individual's caregivers, such as family members. 27 The HHS OIG also examined this issue, and found that, among a representative sample of 94 Medicare claims related to potential abuse or neglect across inpatient and outpatient care settings from January 2015 through June 2017, eight incidents were perpetrated by medical providers, while 59 were perpetrated by family members, spouses, or significant others. 28 In a separate report on hospice care, the HHS OIG identified several cases from a review of survey reports in which hospices did not sufficiently protect individuals when they experienced abuse at the hands of caregivers or other individuals not affiliated with the hospice. 29 (See text box for a description of one of those cases.) Department of Health and Human Services (HHS) Office of Inspector General (OIG) Example: Hospice Failed to Recognize Signs of a Possible Sexual Assault "A beneficiary residing in an assisted living facility had blood clots and significant signs of injury to her pelvic area, right upper leg, and right forearm. Hospice staff failed to recognize these as signs and symptoms of possible sexual assault and did not report them to the hospice administrator or local law enforcement agency. Instead, the hospice obtained a physician's order for the insertion of a urinary catheter, an invasive procedure. The hospice tried and failed multiple times to insert a catheter, finally transferring the beneficiary to a hospital. The hospital staff recognized the signs of possible sexual assault and notified the police." "In this instance…the beneficiary showed signs of possible sexual assault and the hospice was cited for failing to investigate the allegation of abuse. In response, the hospice stated that it disagreed with the survey finding because it was never alleged that a hospice employee was responsible for abusing the beneficiary. In other words, the hospice claims that it had no obligation to investigate the possible sexual assault of a beneficiary in its care because an accusation had not been leveled at a hospice employee." Source: HHS OIG, OEI-02-17-00021. | GAO-23-105463 Reporting gap for allegations of abuse or neglect. CMS does not require hospice care providers to immediately report allegations of abuse or neglect to state survey agencies, requiring instead that hospice providers immediately initiate an internal investigation and 27K. M. Jayawardena and S. Liao, "Elder Abuse at End of Life," Journal of Palliative Medicine, vol. 9, no. 1 (2006): 127 28Department of Health and Human Services Office of Inspector General, CMS Could Use Medicare Data To Identify Instances of Potential Abuse or Neglect, A-01-17-00513 (Washington, D.C.: June 2019). 29Department of Health and Human Services Office of Inspector General, OEI-02-17- 00021. Page 12 GAO-23-105463 Abuse and Neglect report to law enforcement if required by law. 30 CMS requirements also state that hospice administrators have up to 5 working days (from the time the hospice becomes aware of the incident) to externally report only a subset of those investigated allegations-those that were verified by the internal investigation. 31 The requirement that hospice care providers externally report only provider-verified allegations also means that some allegations-those that the hospice administrator determines were not verified by an investigation-may not be reported to survey agencies. This prevents survey agencies from making their own assessments about the need to conduct an independent investigation. In contrast, CMS requires nursing home and hospital swing-bed administrators to immediately report (within 2 hours) all allegations of abuse or neglect that result in serious bodily injury-to survey agencies and other applicable authorities such as law enforcement-and to report within 24 hours in all other cases. 32 This reporting is required before the hospital swing bed or nursing home administrator investigates the allegation. When hospice care is provided in nursing homes, which comprised 21 percent of Medicare hospice care provided in 2019, CMS requires the hospice care provider and nursing home to enter into a written agreement requiring the hospice care provider to report all allegations of abuse or neglect, as is the case for nursing homes. 33 Immediately reporting all allegations to survey agencies before providers conduct investigations is important because the agencies use abuse and neglect allegations to inform decisions about the need to conduct their own unannounced on-site investigations. During a nursing home investigation, for example, surveyors assess available evidence to independently verify the allegation. These investigations offer the state survey agency a unique opportunity to identify and correct care problems, as they can provide a timely alert of acute issues that otherwise might not be addressed until a standard survey takes place. According to CMS, increased attention to safety is warranted given the risk of harm over the course of individuals' lives in the nursing home setting. A delay of up to 5 30CMS requires providers to comply with applicable state and local laws pertaining to patients' health and safety, so reporting to state or local entities may vary by state. If there is reasonable suspicion that a crime has occurred, reporting to law enforcement may be required under federal or state law. 3142 C.F.R. § 418.52(b)(4)(iv) (2021). 3242 C.F.R. §§ 482.58(b)(3), 483.12(c)(1) (2021). 3342 C.F.R. § 483.70(o)(2)(ii)(J) and 42 C.F.R. § 418.112(c)(8) (2021). Page 13 GAO-23-105463 Abuse and Neglect days for a hospice to report an allegation could impair survey agencies' ability to gather critical evidence to conduct their own independent investigations. CMS requires that Medicare- and Medicaid-certified hospital, nursing home, and hospice care providers protect individuals' rights to be free from abuse and neglect. 34 The less timely and complete reporting of allegations from hospices-when compared to hospital swing beds and nursing homes-is inconsistent with this goal. The gaps in hospice reporting for all allegations of abuse and neglect from all perpetrators could impair survey agencies' ability to conduct investigations that could help address past incidents and prevent future ones. Further, this less timely and complete information is also not aligned with federal standards for internal control related to using quality information. 35 These standards state that management should use quality information to achieve the entity's objectives-such as ensuring that individuals are free from abuse and neglect. These standards further state that information should be received in a timely manner. CMS officials provided two reasons for not requiring hospices to report all allegations of abuse or neglect, including when the alleged perpetrator is someone unaffiliated with the hospice. One reason CMS officials gave is that hospice care providers are not responsible for the actions of individuals in a setting that is beyond the provider's control. For example, in private homes, where about half (49 percent) of Medicare hospice care was provided in 2019, officials said that hospice care providers cannot control what other caregivers, such as family members, do in the home. Officials stated that hospice care providers must work together with family members or caregivers to implement the individual's specific plan of care. They added that if the individual receiving care is not in a safe environment, the hospice can take action with agreement from the individual and family, such as helping the family obtain other caregivers. However, the scope of what hospice care providers can control in a private home does not preclude the hospice from taking certain actions to protect individuals-such as providing a lockbox for pain medications that a caregiver may be diverting. A survey agency may also determine that a hospice could have done more within the scope of its authority to protect 34See 42 C.F.R. §§ 418.52(c)(6), 482.13(c)(3), 483.12 (2021). 35GAO-14-704G. Page 14 GAO-23-105463 Abuse and Neglect an individual, but cannot do so if allegations are not being reported to the survey agency. Another reason CMS officials shared is that hospice care staff and administrators are typically required, under state and local laws, to report to other entities like law enforcement and adult protective services. However, relying on state and local laws may not ensure that more complete and timely reporting takes place. For example, the HHS OIG's analysis of a representative sample of 94 Medicare claims related to potential abuse or neglect across inpatient and outpatient care settings from January 2015 through June 2017 found that 17 were not reported to law enforcement even though all states require certain individuals to be mandatory reporters of suspected abuse or neglect of vulnerable adults. 36 CMS officials told us that although not all allegations of abuse or neglect in hospices are reported to survey agencies, they should be documented and available for a surveyor to review. CMS hospice survey requirements include reviewing the hospice's documented complaints from individuals receiving hospice care or from their families. Surveyors should review the previous 12 months of logged complaints and can request older records as well, which CMS officials said is one way that survey agencies can review allegations that are not otherwise reported externally. However, routine hospice surveys occur every 36 months. Thus, a review of the previous year's complaints in a routine survey that occurs once every 36 months leaves an unchecked gap of up to 2 years of complaints depending on what the surveyor decides to review. CMS's intent for hospice care provided through Medicaid and Medicare is to provide a holistic means of addressing the emotional and physical pain of individuals in their final months of life. If hospice care providers immediately reported all allegations of abuse and neglect, CMS and survey agencies would have more complete and timely information to use in their response. This response can include such actions as initiating unannounced investigations to ensure that (1) hospice care providers responded as required to reported incidents; (2) the hospice has worked within the scope of its authority to protect individuals receiving care; or (3) state and local authorities have been notified as appropriate. If the survey agency decides not to investigate further, it could still ensure, during the next scheduled standard survey, that the hospice care provider appropriately responded to reported allegations, as survey agencies do 36HHS OIG, A-01-17-00513. Page 15 GAO-23-105463 Abuse and Neglect for nursing homes. Doing so would provide additional assurance that all allegations of abuse and neglect incidents in hospice care are thoroughly investigated by appropriate authorities. Individuals receiving extended care services from Medicare- and Conclusions Medicaid-certified hospital, nursing home, and hospice care providers are vulnerable to abuse and neglect across these settings of care. CMS requires providers to protect individuals' right to be free from abuse and neglect. However, due to gaps we found in reporting requirements for hospice care, CMS and survey agencies may be limited in their ability to ensure that providers are protecting individuals receiving hospice care. Strengthening hospice reporting requirements to align with the requirements for nursing homes and hospital extended care through swing beds will provide CMS with more complete and timely information about allegations of abuse and neglect, including allegations involving perpetrators not affiliated with the hospice. CMS and survey agencies can use this information to ensure that hospice care providers are taking appropriate steps within the scope of their authority to protect vulnerable individuals. We are making the following recommendation to CMS: Recommendation for Executive Action The CMS administrator should require, for individuals in hospice care, immediate reporting of all abuse and neglect allegations involving all perpetrators-including those not affiliated with the hospice-to the hospice administrator, a state survey agency, and other appropriate authorities. (Recommendation 1) We provided a draft of this report to HHS for review and comment. HHS' Agency Comments written comments are printed in appendix II; HHS also provided technical and Our Evaluation comments that we incorporated as appropriate. In its comments, HHS did not state whether the department agreed or disagreed with our recommendation. HHS stated that abuse and neglect should never be tolerated, and CMS takes seriously the reporting of any allegations. HHS stated that CMS would review its interpretive guidance for opportunities to clarify existing guidance on reporting allegations to appropriate authorities, which may be state and local authorities. In addition, HHS noted that CMS provided educational materials to hospices for use in trainings about recognizing signs of abuse, neglect, or other harm. HHS also stated that CMS is working to provide additional guidance on reporting suspected crimes (including abuse and neglect) discovered during a survey to appropriate authorities or law enforcement. Page 16 GAO-23-105463 Abuse and Neglect Additional guidance could be helpful for ensuring that hospice care providers identify and report abuse and neglect to the appropriate authorities. However, clarifying guidance alone is unlikely to be sufficient to address the gaps in underlying reporting requirements for hospices, which we described in our report. CMS emphasized the agency's perspective that hospice care is intermittent or of short duration and often provided in a home environment that is not under constant control by the hospice care provider. As such, CMS noted that state requirements should be the primary vehicle for reporting abuse and neglect. Further, CMS noted the agency's requirement that hospices comply with all federal, state, and local laws related to patient health and safety, which can include state requirements to report allegations of abuse and neglect. However, because hospices (unlike other extended care in nursing homes and hospital swing beds) are not required to immediately report allegations involving all perpetrators to survey agencies, those agencies may be limited in their ability to ensure that hospice care providers are reporting to appropriate authorities. As stated in our report, the HHS OIG found that hospice care providers did not always report abuse to appropriate authorities even though all states require certain individuals to be mandatory reporters of suspected abuse or neglect of vulnerable adults. These findings underscore the need for CMS and survey agencies to have the information necessary to ensure that hospice care providers are complying with CMS's requirements. CMS also stated that adding reporting requirements could create confusion for individuals required to report, hospice programs, and the state agencies and officials responsible for taking action and investigating allegations of abuse and neglect. However, as detailed in our report, hospice reporting requirements currently differ depending on whether hospice care is provided in a nursing home-where the hospice care provider must report all allegations of abuse and neglect, like nursing homes do-or other settings such as a patient's home. Aligning hospice reporting requirements with those for nursing homes and hospital extended care through swing beds could create more consistency for the hospice providers responsible for reporting allegations, and would provide CMS with more complete and timely information about allegations of abuse and neglect. We maintain the importance of strengthening abuse and neglect reporting requirements for hospice care to help CMS ensure that providers are taking action to protect vulnerable individuals in their final months of life. Page 17 GAO-23-105463 Abuse and Neglect As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution of it until 30 days from the report date. At that time, we will send copies to the appropriate congressional committees, the Secretary of Health and Human Services, the Administrator of the Centers for Medicare & Medicaid Services, and other interested parties. In addition, the report is available at no charge on the GAO website at https://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7114 or DickenJ@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. John E. Dicken Director, Health Care Page 18 GAO-23-105463 Abuse and Neglect Appendix I: Federal Requirements Related Appendix I: Federal Requirements Related to Abuse and Neglect Allegations in Hospitals, Nursing Homes, and Hospices to Abuse and Neglect Allegations in Hospitals, Nursing Homes, and Hospices Table 1: Summary of CMS Requirements for Initial Reporting and Verification of, and Response to, Allegations of Abuse or Neglect in Medicare- or Medicaid-Certified Hospitals, Nursing Homes, and Hospices Hospitals Nursing homesa Hospices Initial reporting Patient grievances must be reported Allegations must be reported Allegations involving anyone to the hospital's governing body, or immediately (not later than 2 hours furnishing services on behalf of grievance committee, if delegated.b after the allegation) if the events the hospice must be reported Grievances about situations that involve serious bodily injury; if not, immediately to the hospice endanger the patient, such as within 24 hours, to the nursing administrator (as soon as neglect and abuse, must be home administrator and to other possible, up to 24 hours after the reviewed immediately. officials, including the state survey allegation in absence of shorter Swing beds: Allegations must be agency, in accordance with state state requirement) reported immediately (not later than law. 2 hours after the allegation) if the events involve abuse or results in serious bodily injury; if not, within 24 hours, to the hospital administrator and to other officials, including the state survey agency, in accordance with state law.c . Verification and All allegations of abuse and neglect All allegations must be thoroughly Allegations involving anyone response must be investigated in a timely and investigated. Results of all furnishing services on behalf of thorough manner. Incidents of abuse investigations must be reported to the hospice must be investigated or neglect must be reported and the administrator or representative, immediately in accordance with appropriate corrective, remedial, or and to other officials, in accordance established procedures. Verified disciplinary action occurs, in with state law, including the state allegations must be reported to accordance with local, state or survey agency, within 5 working state and local officials having federal law. days of the incident, and if the jurisdiction, including the state Swing beds: All allegations must be alleged violation is verified survey agency, within 5 working thoroughly investigated. Results of appropriate corrective action taken. days of the hospice administrator all investigations must be reported to becoming aware of the violation. the administrator or representative, and to other officials, in accordance with state law, including the state survey agency, within 5 working days of the incident, and if the alleged violation is verified appropriate corrective action must be taken. Source: GAO analysis of federal regulations and Centers for Medicare & Medicaid Services' (CMS) State Operations Manual. | GAO-23-105463 Notes: Medicare- and Medicaid-certified hospital, nursing home, and hospice providers must also be in compliance with other applicable federal, state, and local laws related to the health and safety of patients, which are not shown in the table. CMS enters into agreements with state survey agencies- agencies in each state government-and oversees their work to monitor providers' compliance with Medicare and Medicaid requirements. a For the purposes of this report, we use "nursing homes" to refer to both "skilled nursing facilities" (the term used by Medicare) and "nursing facilities" (the term used by Medicaid.) b A "patient grievance" is a formal or informal written or verbal complaint that is made to the hospital by a patient, or the patient's representative, regarding the patient's care (when the complaint is not resolved at the time of the complaint by staff present), abuse or neglect, issues related to the hospital's compliance with the CMS Hospital Conditions of Participation, or a Medicare beneficiary Page 19 GAO-23-105463 Abuse and Neglect Appendix I: Federal Requirements Related to Abuse and Neglect Allegations in Hospitals, Nursing Homes, and Hospices billing complaint related to rights and limitations provided by 42 CFR Part 489. All verbal or written complaints regarding abuse, neglect, patient harm, or hospital compliance with CMS requirements are considered grievances. c Medicare permits certain small, rural hospitals to operate swing beds, which are beds that can be used to provide either acute or extended care services. Hospitals with swing bed agreements must meet several eligibility requirements, such as having fewer than 100 hospital beds, be located in a rural area, and be substantially in compliance with several skilled nursing facility requirements, including those ensuring patients' rights to be free from abuse, neglect, and exploitation. Page 20 GAO-23-105463 Abuse and Neglect Appendix II: Comments from the Department Appendix II: Comments from the Department of Health and Human Services of Health and Human Services Page 21 GAO-23-105463 Abuse and Neglect Appendix II: Comments from the Department of Health and Human Services Page 22 GAO-23-105463 Abuse and Neglect Appendix II: Comments from the Department of Health and Human Services Page 23 GAO-23-105463 Abuse and Neglect Appendix II: Comments from the Department of Health and Human Services Page 24 GAO-23-105463 Abuse and Neglect Appendix III: GAO Contact and Staff Appendix III: GAO Contact and Staff Acknowledgments Acknowledgments John E. Dicken, (202) 512-7114 or DickenJ@gao.gov GAO contact In addition to the contact named above, William Black (Assistant Staff Director), Malissa Winograd (Analyst-in-Charge), Maya Dru, Linda acknowledgments McIver, and Miranda Richard may key contributions to this report. Also contributing were Laurie Pachter, Vikki Porter, and Jennifer Whitworth (105463) Page 25 GAO-23-105463 Abuse and Neglect The Government Accountability Office, the audit, evaluation, and investigative GAO's Mission arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is Obtaining Copies of through our website. Each weekday afternoon, GAO posts on its website newly GAO Reports and released reports, testimony, and correspondence. You can also subscribe to GAO's email updates to receive notification of newly posted products. Testimony Order by Phone The price of each GAO publication reflects GAO's actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO's website, https://www.gao.gov/ordering.htm. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. Connect with GAO on Facebook, Flickr, Twitter, and YouTube. Connect with GAO Subscribe to our RSS Feeds or Email Updates. Listen to our Podcasts. Visit GAO on the web at https://www.gao.gov. Contact FraudNet: To Report Fraud, Website: https://www.gao.gov/about/what-gao-does/fraudnet Waste, and Abuse in Automated answering system: (800) 424-5454 or (202) 512-7700 Federal Programs A. Nicole Clowers, Managing Director, ClowersA@gao.gov, (202) 512-4400, U.S. Congressional Government Accountability Office, 441 G Street NW, Room 7125, Washington, Relations DC 20548 Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 Public Affairs U.S. Government Accountability Office, 441 G Street NW, Room 7149 Washington, DC 20548 Stephen J. Sanford, Managing Director, spel@gao.gov, (202) 512-4707 Strategic Planning and U.S. Government Accountability Office, 441 G Street NW, Room 7814, External Liaison Washington, DC 20548 Please Print on Recycled Paper.