Health Care Fraud and Abuse Control Program:

Improvements Needed in Controls over Reporting Deposits and Expenditures

GAO-11-446: Published: May 10, 2011. Publicly Released: Jun 9, 2011.

Additional Materials:

Contact:

Beryl H. Davis
(202) 512-9312
contact@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

To help combat fraud and abuse in health care programs, including Medicare and Medicaid, Congress enacted the Health Care Fraud and Abuse Control (HCFAC) program as part of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). HIPAA requires that the Departments of Health and Human Services (HHS) and Justice (DOJ) issue a joint annual report to Congress on amounts deposited to and appropriated from the Federal Hospital Insurance (HI) Trust Fund for the HCFAC program. In April 2005, GAO reported on the results of its review of HCFAC program activities for fiscal years 2002 and 2003 and made recommendations to HHS and DOJ. The objectives of this requested review were to assess the extent to which HHS and DOJ (1) took actions to address the recommendations made in the 2005 report and (2) designed effective controls over reporting HCFAC deposits and expenditures for fiscal years 2008 and 2009. GAO reviewed HHS and DOJ documentation; selected nongeneralizable samples; and interviewed agency officials.

Although HHS and DOJ have taken action to address our previous recommendations aimed at improving procedures for recording HCFAC expenditures and issuing the annual HCFAC report, GAO found that controls are not sufficient to ensure that the report is accurate and supported. HHS and DOJ took action to address three of the four recommendations in GAO's 2005 report related to recording staff hours in agency workload tracking systems, using the appropriate account class to record HCFAC expenditure data, and expediting the review process for issuing the annual HCFAC report. Neither agency agreed with the remaining recommendation to notify Congress on delays in issuing the HCFAC report within 1 month after missing the mandated January 1 deadline and thus, did not take action. However, in June 2010, HHS and DOJ implemented an expedited review process for completing the HCFAC report. The fiscal year 2010 HCFAC report was issued on January 24, 2011, 23 days later than the mandated reporting date. According to DOJ officials responsible for preparing the HCFAC report, they intend to use this new expedited review process to meet the mandated deadline when preparing future year reports. Regarding the design of controls, while HHS and DOJ had designed polices and procedures for documentation that generally required the retention of documentation for 6 years, these did not provide sufficient controls to ensure adequate support of HCFAC deposits and expenditures, in accordance with internal control standards. (1) Components at both HHS and DOJ that manage HCFAC activities did not include in their respective policies and procedures controls that specified the person responsible for maintaining the records, the location of records, or a combination of both. (2) GAO found instances at HHS and DOJ where documentation could not be provided to support HCFAC expenditures, such as time and attendance reports. Also, both agencies did not have sufficient monitoring controls such as reconciliations, comparisons, and supervisory reviews, as outlined in internal control standards, to ensure accurate reporting of HCFAC deposits and expenditures. As a result, GAO found instances where data recorded in accounting and payroll systems were inconsistent with other sources such as the HI trust fund statements and agency workload tracking systems. GAO also identified presentation errors in the 2008 and 2009 annual HCFAC reports. For example, in reviewing the line item for restitution and compensatory damages, GAO found that $717 million (70 percent) of the $1.03 billion reported in the fiscal year 2009 HCFAC report was not transferred to the HI trust fund as stated in the report. These amounts, primarily related to Medicare Part B and Medicaid, were transferred to the Federal Supplementary Medical Insurance Trust Fund and the Medicaid appropriation account as required. These inaccuracies overstated the amount of funds transferred to the HI trust fund. GAO makes 11 recommendations to HHS and DOJ to revise or develop written procedures that include documentation and monitoring controls for HCFAC activities and reporting. DOJ agreed with all four of its recommendations. Of the seven recommendations to HHS, it generally agreed with five, disagreed with one, and did not address the remaining recommendation.

Recommendations for Executive Action

  1. Status: Open

    Comments: The Center for Medicare and Medicaid Services (CMS) disagreed with GAO's recommendation, noting that the information it maintains is sufficient to ensure accountability and proper and consistent supporting documentation for Health Care Fraud and Abuse Control Program deposits and expenditures. However, GAO continues to believe that CMS's policies and procedures for documentation are insufficient, as they do not identify the staff responsible for maintaining documentation as required by National Archives and Records Administration regulations. We will follow-up with CMS in fiscal year 2015 to assess the status of this recommendation.

    Recommendation: To improve controls over the accounting and reporting of HCFAC activities, the Secretary of HHS should direct the Administrator of CMS to revise procedures for properly maintaining supporting documentation for HCFAC deposits and expenditures, to include specifying the titles of staff responsible for maintaining supporting documentation.

    Agency Affected: Department of Health and Human Services

  2. Status: Closed - Implemented

    Comments: The Center for Medicaid and Medicare Services (CMS) neither agreed nor disagreed with our recommendation. In our original report, GAO found instances where CMS regional offices made adjustments to the civilian monetary penalty (CMP) amounts in their data collection systems that were not recorded in CMS's accounting system. In February 2014, CMS finalized written procedures describing CMS's revised process for ensuring that adjustments made to civil monetary penalty receivable allocations in the regional offices' system are adequately reflected in CMS's accounting system. Specifically, if the regional offices adjust the CMP in their accounting system, an e-mail notification is sent that an adjustment to the CMP amounts is needed in CMS's accounting system.

    Recommendation: To improve controls over the accounting and reporting of HCFAC activities, the Secretary of HHS should direct the Administrator of CMS to develop written procedures that incorporate monitoring controls for HCFAC deposit information recorded in the departmentwide accounting system, including reconciling the deposit data in this system to the regional offices' data collection system.

    Agency Affected: Department of Health and Human Services

  3. Status: Closed - Implemented

    Comments: The Department of Health and Human Services agreed with our recommendation. Specifically, in March 2012 the Administration on Aging, now a part of the Administration for Community Living, revised its HCFAC records retention procedures to specify that the analyst assigned to the HCFAC account is responsible for maintaining supporting documentation for HCFAC expenditures and to specify the location of the electronic and hardcopy supporting documentation.

    Recommendation: To improve controls over the accounting and reporting of HCFAC activities, the Secretary of HHS should direct the Assistant Secretary for Aging to revise the Administration on Aging's procedures for properly maintaining supporting documentation for HCFAC expenditures, to include specifying the titles of staff responsible for maintaining supporting documentation and the location of records.

    Agency Affected: Department of Health and Human Services

  4. Status: Closed - Implemented

    Comments: The Department of Health and Human Services' (HHS) Administration on Aging (AoA), now a part of the Administration for Community Living (ACL), agreed with our recommendation and took corrective action. Specifically, ACL revised its estimation model to include specific standards for calculating the estimates of time spent by ACL regional staff on the Health Care Fraud and Abuse Control Program (HCFAC) and developed a policy--dated July, 2013--that requires ACL to continually review the results of the estimation model for reasonableness.

    Recommendation: To improve controls over the accounting and reporting of HCFAC activities, the Secretary of HHS should direct the Assistant Secretary for Aging to develop written procedures that incorporate monitoring controls to verify that the payroll expenditures charged against HCFAC are reasonable and supported.

    Agency Affected: Department of Health and Human Services

  5. Status: Open

    Comments: The Office of General Counsel (OGC) agreed with our recommendation. Although we received updated procedures from OGC in fiscal year 2011, these procedures did not address our finding but rather discussed the transfer of payroll expenditures to the HCFAC account. As stated in our recommendation, we expect OGC to develop written procedures that incorporate monitoring controls of the reconciliation process of HCFAC hours recorded in the workload tracking system to the departmentwide payroll system. We will follow-up with HHS in fiscal year 2015 to assess their progress in responding to our recommendation.

    Recommendation: To improve controls over the accounting and reporting of HCFAC activities, the Secretary of HHS should direct the Acting General Counsel to develop written procedures that incorporate monitoring controls for the Office of the General Counsel staff hours related to HCFAC activities captured in workload tracking systems, including the reconciliation to staff hours captured in the departmentwide payroll system.

    Agency Affected: Department of Health and Human Services

  6. Status: Closed - Implemented

    Comments: The Department of Health and Human Services (HHS) agreed with our recommendation and took corrective action. In response to our recommendation, HHS collaborated with the Department of Justice (DOJ) to revise and strengthen the Health Care Fraud and Abuse Control Program (HCFAC) Report Completion Guide by including monitoring controls to ensure that the financial data presented to Congress in the joint annual HCFAC report is complete and accurate. In June 2011, HHS and DOJ signed a Memorandum of Understanding, effective July 1, 2011, whereby both entities agreed to use the revised HCFAC Report Completion Guide as the framework for completing the fiscal year 2011 HCFAC annual report.

    Recommendation: To improve controls over the accounting and reporting of HCFAC activities, the Secretary of HHS should develop written procedures in collaboration with DOJ that incorporate monitoring controls for preparing the joint annual HCFAC report to help ensure reported amounts are accurate.

    Agency Affected: Department of Health and Human Services

  7. Status: Closed - Implemented

    Comments: The Department of Health and Human Services' (HHS) Office of Inspector General (OIG) agreed with our recommendation and took corrective action. In response to our recommendation, HHS OIG developed and implemented written procedures during the beginning of fiscal year 2013 to include monitoring controls for OIG staff hours related to Health Care Fraud and Abuse Control Program (HCFAC) activities. Specifically, the OIG's component offices, with assistance from HHS OIG's Office of Management and Policy (OMP), are now responsible for reconciling staff hours recorded in their time-keeping systems with those in the department-wide payroll system.

    Recommendation: To improve controls over the accounting and reporting of HCFAC activities, the HHS Inspector General should develop written procedures that incorporate monitoring controls for HHS OIG staff hours related to HCFAC activities captured in workload tracking systems, including the reconciliation to staff hours captured in the departmentwide payroll system.

    Agency Affected: Department of Health and Human Services: Office of Inspector General

  8. Status: Open

    Comments: The Department of Justice (DOJ) agreed with our recommendation. However, we have been unable to determine whether DOJ has implemented corrective action. We will follow-up with DOJ in fiscal year 2015 to assess its progress in responding to our recommendation.

    Recommendation: To improve controls over the accounting and reporting of HCFAC activities, the Attorney General should direct the Deputy Assistant Attorney General / Controller to revise procedures for properly maintaining supporting documentation for HCFAC deposits and expenditures, to include specifying the titles of staff responsible for maintaining supporting documentation and the location of records.

    Agency Affected: Department of Justice

  9. Status: Closed - Implemented

    Comments: The Department of Justice (DOJ) agreed with our recommendation and took corrective action. Prior to the report's release--and in response to our forthcoming recommendation--the Justice Management Division developed written procedures, dated April 20, 2011, to reconcile the 3 percent portion of penalties and multiple damages recorded in the department-wide accounting system to BPD's Hospital Insurance (HI) trust fund statements. The procedures establish that at the end of each quarter and fiscal year both organizations will reconcile--verbally and in writing--the amount of Health Care Fraud and Abuse Control (HCFAC) program collections transmitted to BPD and that DOJ provide BPD a memo at the end of each quarter with a summary report including both the gross and net disbursements to the HI trust fund.

    Recommendation: To improve controls over the accounting and reporting of HCFAC activities, the Attorney General should direct the Deputy Assistant Attorney General / Controller to develop written procedures that incorporate monitoring controls for reconciling HCFAC deposits of the 3 percent portion of penalties and multiple damages information recorded in the departmentwide accounting system to the HI trust fund statements.

    Agency Affected: Department of Justice

  10. Status: Open

    Comments: The Department of Justice (DOJ) agreed with our recommendation. However, we have been unable to determine whether DOJ has implemented corrective action. We will follow-up with DOJ in fiscal year 2015 to assess its progress in responding to our recommendation.

    Recommendation: To improve controls over the accounting and reporting of HCFAC activities, the Attorney General should direct the Deputy Assistant Attorney General / Controller to develop written procedures that incorporate monitoring controls to verify that the payroll expenditures charged against HCFAC are reasonable and supported.

    Agency Affected: Department of Justice

  11. Status: Closed - Implemented

    Comments: The Department of Justice (DOJ) agreed with our recommendation and took corrective action. In response to our recommendation, DOJ collaborated with the Department of Health and Human Services (HHS) to revise and strengthen the Health Care Fraud and Abuse Control Program (HCFAC) Report Completion Guide by including monitoring controls to ensure that the financial data presented to Congress in the joint annual HCFAC report is complete and accurate. In June 2011, HHS and DOJ signed a Memorandum of Understanding, effective July 1, 2011, whereby both entities agreed to use the revised HCFAC Report Completion Guide as the framework for completing the fiscal year 2011 HCFAC annual report.

    Recommendation: To improve controls over the accounting and reporting of HCFAC activities, the Attorney General should direct the Deputy Assistant Attorney General / Controller to develop written procedures in collaboration with HHS that incorporate monitoring controls for preparing the joint annual HCFAC report to help ensure reported amounts are accurate.

    Agency Affected: Department of Justice

 

Explore the full database of GAO's Open Recommendations »

Dec 11, 2014

Dec 10, 2014

Nov 18, 2014

Nov 13, 2014

Oct 10, 2014

Sep 30, 2014

Sep 22, 2014

Jul 9, 2014

May 14, 2014

Looking for more? Browse all our products here