This is the accessible text file for GAO report number GAO-11-446 entitled 'Health Care Fraud and Abuse Control Program: Improvements Needed in Controls over Reporting Deposits and Expenditures' which was released on June 9, 2011. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. United States Government Accountability Office: GAO: Report to the Ranking Member, Committee on the Judiciary, U.S. Senate: May 2011: Health Care Fraud and Abuse Control Program: Improvements Needed in Controls over Reporting Deposits and Expenditures: GAO-11-446: GAO Highlights: Highlights of GAO-11-446, a report to the Ranking Member, Committee on the Judiciary, U.S. Senate. Why GAO Did This Study: To help combat fraud and abuse in health care programs, including Medicare and Medicaid, Congress enacted the Health Care Fraud and Abuse Control (HCFAC) program as part of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). HIPAA requires that the Departments of Health and Human Services (HHS) and Justice (DOJ) issue a joint annual report to Congress on amounts deposited to and appropriated from the Federal Hospital Insurance (HI) Trust Fund for the HCFAC program. In April 2005, GAO reported on the results of its review of HCFAC program activities for fiscal years 2002 and 2003 and made recommendations to HHS and DOJ. The objectives of this requested review were to assess the extent to which HHS and DOJ (1) took actions to address the recommendations made in the 2005 report and (2) designed effective controls over reporting HCFAC deposits and expenditures for fiscal years 2008 and 2009. GAO reviewed HHS and DOJ documentation; selected nongeneralizable samples; and interviewed agency officials. What GAO Found: Although HHS and DOJ have taken action to address our previous recommendations aimed at improving procedures for recording HCFAC expenditures and issuing the annual HCFAC report, GAO found that controls are not sufficient to ensure that the report is accurate and supported. HHS and DOJ took action to address three of the four recommendations in GAO’s 2005 report related to recording staff hours in agency workload tracking systems, using the appropriate account class to record HCFAC expenditure data, and expediting the review process for issuing the annual HCFAC report. Neither agency agreed with the remaining recommendation to notify Congress on delays in issuing the HCFAC report within 1 month after missing the mandated January 1 deadline and thus, did not take action. However, in June 2010, HHS and DOJ implemented an expedited review process for completing the HCFAC report. The fiscal year 2010 HCFAC report was issued on January 24, 2011, 23 days later than the mandated reporting date. According to DOJ officials responsible for preparing the HCFAC report, they intend to use this new expedited review process to meet the mandated deadline when preparing future year reports. Regarding the design of controls, while HHS and DOJ had designed polices and procedures for documentation that generally required the retention of documentation for 6 years, these did not provide sufficient controls to ensure adequate support of HCFAC deposits and expenditures, in accordance with internal control standards. * Components at both HHS and DOJ that manage HCFAC activities did not include in their respective policies and procedures controls that specified the person responsible for maintaining the records, the location of records, or a combination of both. * GAO found instances at HHS and DOJ where documentation could not be provided to support HCFAC expenditures, such as time and attendance reports. Also, both agencies did not have sufficient monitoring controls such as reconciliations, comparisons, and supervisory reviews, as outlined in internal control standards, to ensure accurate reporting of HCFAC deposits and expenditures. As a result, GAO found instances where data recorded in accounting and payroll systems were inconsistent with other sources such as the HI trust fund statements and agency workload tracking systems. GAO also identified presentation errors in the 2008 and 2009 annual HCFAC reports. For example, in reviewing the line item for restitution and compensatory damages, GAO found that $717 million (70 percent) of the $1.03 billion reported in the fiscal year 2009 HCFAC report was not transferred to the HI trust fund as stated in the report. These amounts, primarily related to Medicare Part B and Medicaid, were transferred to the Federal Supplementary Medical Insurance Trust Fund and the Medicaid appropriation account as required. These inaccuracies overstated the amount of funds transferred to the HI trust fund. What GAO Recommends: GAO makes 11 recommendations to HHS and DOJ to revise or develop written procedures that include documentation and monitoring controls for HCFAC activities and reporting. DOJ agreed with all four of its recommendations. Of the seven recommendations to HHS, it generally agreed with five, disagreed with one, and did not address the remaining recommendation. View [hyperlink, http://www.gao.gov/products/GAO-11-446] or key components. For more information, contact Kay L. Daly at (202) 512- 9312 or dalykl@gao.gov. [End of section] Contents: Letter: Background: Agencies Took Action to Address Three of Four GAO Recommendations: HHS and DOJ Have Gaps in Documentation and Monitoring Controls over Reporting HCFAC Deposits and Expenditures: Conclusions: Recommendations for Executive Action: Agency Comments and Our Evaluation: Appendix I: Objectives, Scope, and Methodology: Appendix II: Information about the Universe of Transactions and Our Sampled Items: Appendix III: Comments from the Department of Health and Human Services: Appendix IV: GAO Contacts and Staff Acknowledgments: Tables: Table 1: Summary of Selected Deposit Transactions: Table 2: Summary of Selected Expenditures Transactions: Figures: Figure 1: Overview of HCFAC Funding Stream: Figure 2: Amounts Appropriated for HCFAC, Fiscal Years 1997 through 2009: Abbreviations: AEM: ASPEN Enforcement Manager: CMS: Centers for Medicare & Medicaid Services: CPI-U: consumer price index for all urban consumers: FACS: Financial Accounting and Control System: DOJ: Department of Justice: HCFAC: Health Care Fraud and Abuse Control program: HEAT: Health Care Fraud Prevention and Enforcement Action Team: HHS: Department of Health and Human Services: HI: Hospital Insurance: HIPAA: Health Insurance Portability and Accountability Act: IPAC: Intra-governmental Payment and Collection System: OIG: Office of Inspector General: OMB: Office of Management and Budget: SMI: Supplementary Medical Insurance: TRHCA: Tax Relief and Health Care Act: USAO: United States Attorneys Office: [End of section] United States Government Accountability Office: Washington, DC 20548: May 10, 2011: The Honorable Charles E. Grassley: Ranking Member: Committee on the Judiciary: United States Senate: Dear Senator Grassley: We have designated Medicare and Medicaid as high risk programs because they are particularly vulnerable to fraud, waste, and abuse and improper payments.[Footnote 1] Medicare is considered high risk in part because of its complexity and susceptibility to improper payments, and Medicaid because of concerns about the adequacy of its fiscal oversight to prevent inappropriate spending. In 2010, Medicare covered 47 million elderly and disabled beneficiaries and had estimated outlays of $509 billion. Medicaid, a federal-state program, covered over 69 million low-income people and consists of more than 50 distinct state-based programs that cost the federal government and states an estimated $408 billion in fiscal year 2010. For fiscal year 2010, the Department of Health and Human Services (HHS) estimated improper payments for the Medicare and Medicaid programs at about $70.4 billion,[Footnote 2] comprising 56 percent of the estimated $125.4 billion in governmentwide improper payments, as reported by federal agencies.[Footnote 3] To help combat fraud and abuse in health care programs such as Medicare and Medicaid, Congress enacted the Health Care Fraud and Abuse Control (HCFAC) program as part of the Health Insurance Portability and Accountability Act of 1996 (HIPAA).[Footnote 4] HHS and the Department of Justice (DOJ) jointly administer the HCFAC program. HIPAA requires that HHS and DOJ issue a joint annual report to Congress no later than January 1 of each year on (1) amounts deposited to the Federal Hospital Insurance Trust Fund (HI trust fund) pursuant to HIPAA (HCFAC deposits) for the previous fiscal year and the source of such amounts and (2) amounts appropriated from the HI trust fund for HCFAC activities each year and the justification for the expenditure of such amounts.[Footnote 5] In April 2005, we reported on the results of our review of HCFAC- related activities for fiscal years 2002 and 2003.[Footnote 6] In that report, we made recommendations to HHS and DOJ to improve procedures for recording HCFAC expenditures and issuing the annual HCFAC report. You requested that we provide an update on the status of the recommendations in our April 2005 report and review controls over the reporting process for amounts included in the fiscal years 2008 and 2009 HCFAC reports.[Footnote 7] As agreed with your office, the objectives of our review were to assess the extent to which HHS and DOJ (1) took actions to address the recommendations we made in 2005 and (2) designed effective controls over reporting HCFAC deposits and expenditures for fiscal years 2008 and 2009. To address the first objective, we reviewed supporting documentation provided by HHS and DOJ such as policies and procedures and interviewed officials at HHS and DOJ, including the HHS Acting Deputy Inspector General and the Assistant Director of the Executive Office for United States Attorneys, to obtain further information on actions taken. To address the second objective, we obtained and reviewed relevant HHS and DOJ policies and procedures for reporting deposits and expenditures within each agency and used criteria outlined in our Standards for Internal Control in the Federal Government to assess the effectiveness of the controls documented in these policies and procedures.[Footnote 8] To further our understanding of these controls, we selected a nongeneralizable stratified random sample for deposits of 47 transactions for fiscal year 2008 and 55 transactions for fiscal year 2009. We also selected a nongeneralizable random sample for expenditures of 63 transactions for fiscal year 2008 and 62 transactions for fiscal year 2009. Expenditure samples were selected for each of the agency components that were allocated HCFAC appropriation funds as reported in the annual HCFAC reports for fiscal years 2008 and 2009. The sample selections were designed to provide additional details about the processing of those transactions and were not intended to be representative of the universe of HCFAC transactions. For the selected transactions, we reviewed supporting documentation such as check registers, time and attendance reports, and contracts to determine whether dollar amounts for these transactions were accurately reported and the use of funds were consistent with HIPAA. We also performed additional procedures for HHS Office of Inspector General (OIG) payroll transactions to determine if HCFAC projects were properly classified and workload tracking systems included hours for all staff. In addition, we conducted interviews with HHS and DOJ officials including budget analysts and financial specialists to obtain an understanding and clarification of the processes in place to report HCFAC deposits and expenditures. See appendix I for additional details on our objectives, scope, and methodology. We conducted our work from February 2010 through May 2011 in accordance with U.S. generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Background: HIPAA authorized the HCFAC program to consolidate and strengthen ongoing efforts to combat fraud and abuse in health care programs and increase resources for fighting health care fraud. The Secretary of HHS, through the HHS OIG, and the Attorney General, administer the HCFAC program. The HCFAC program goals are to: * coordinate federal, state, and local law enforcement efforts to control fraud and abuse associated with health plans; * conduct investigations, audits, and other studies of delivery and payment for health care for the United States; * facilitate the enforcement of the civil, criminal, and administrative statutes applicable to health care; * provide guidance to the health care industry, including the issuance of advisory opinions, safe harbor notices, and special fraud alerts; and: * establish a national database of adverse actions against health care providers. Figure 1 below provides an overview of the HCFAC funding stream, including the related deposits, the allocation of appropriated funds to carry out federal health care law enforcement activities, and the reporting mandate. Figure 1: Overview of HCFAC Funding Stream: [Refer to PDF for image: illustration] HI Trust Fund: HCFAC related deposits: * Criminal fines; * Civil monetary penalties; * Forfeitures of property; * Penalties and multiple damages; * Gifts and bequests. Appropriations[A]: HCFAC account: HHS Centers for Medicare & Medicaid Services[B]: Interagency agreement with HHS and DOJ: Receive bills from agency; reimburse agency. HHS: Office of Inspector General; Administration on Aging; Office of the General Counsel. DOJ: United States Attorneys Offices; Criminal Division; Civil Division; Civil Rights Division. Joint annual reporting mandate[C]: responsibility of HHS and DOJ. Source: GAO analysis of HIPAA legislation and HHS and DOJ data. [A] The annual appropriated amount is allocated between the various HHS and DOJ components based on statutory amounts and internal negotiations. An allocation is made when one or more agencies share the administration of the program for which appropriations are made to only one of the agencies or to the President. The agency receiving the allocation may obligate up to the amount included in the account. [B] HHS's Centers for Medicare & Medicaid Services (CMS), Division of Accounting Operations, performs the accounting for the HCFAC account. [C] HIPAA requires that HHS and DOJ issue a joint annual report to Congress no later than January 1 of each year that identifies the amounts appropriated to and from the HI trust fund during the prior fiscal year. [End of figure] The types of collections deposited to the HI trust fund and appropriations from this fund, including related expenditures are discussed below. Deposits to the HI Trust Fund: Criminal fines. DOJ prosecutes entities or persons that are involved in commission of a federal health care offense, such as mail fraud related to a health care program.[Footnote 9] Courts assess criminal fines upon which the criminal debtor is ordered to submit payment(s) to the United States District Court where the case was prosecuted. Each District Court coordinates with DOJ's local United States Attorneys Office (USAO)[Footnote 10] to communicate collections received.[Footnote 11] The Executive Office for United States Attorneys report collection data on a quarterly basis to the Bureau of the Public Debt for deposit into the HI trust fund.[Footnote 12] Civil monetary penalties. The Social Security Act authorizes the Secretary of HHS to impose civil monetary penalties for improper claims and other violations by health care providers, facilities, and other parties.[Footnote 13] Centers for Medicare & Medicaid Services (CMS) regional offices impose some civil monetary penalties. CMS's Office of Financial Management collects the civil monetary penalties imposed on behalf of the Secretary of HHS and allocates payments received based on information the regional offices record in their data collection system. The Office of Financial Management reports collections for civil monetary penalties on a daily basis to the Bureau of the Public Debt for deposit into the HI trust fund. Forfeitures of property. DOJ prosecutions of entities or persons that are involved in a federal health care offense can result in the forfeiture of property.[Footnote 14] HHS and DOJ reported no property forfeitures creditable to the HI trust fund under HIPAA in the HCFAC reports for fiscal years 2008 and 2009.[Footnote 15] Penalties and multiple damages. Courts can impose penalties and multiple damages as a result of HHS and DOJ civil suits against those who have knowingly made false health care claims against the government, such as submitting claims for medical services that were not provided.[Footnote 16] Of all civil debt collections received, DOJ is entitled to keep 3 percent in its Working Capital Fund for expenses incurred in processing and tracking civil and criminal debt collection litigations.[Footnote 17] Both CMS and DOJ report collections for penalties and multiple damages on a continuous basis to the Bureau of the Public Debt for deposit into the HI trust fund. Gifts and bequests. CMS occasionally receives gifts and bequests and equally splits the amount received between its Medicare Part A and Medicare Part B programs.[Footnote 18] Gifts and bequests are donations received from individuals or entities, usually in the form of checks. Upon receipt of a donation, CMS records the amount in its accounting system and reports it to the Bureau of the Public Debt for deposit into the HI trust fund. In addition to the types of deposits authorized by HIPAA and discussed above, HHS and DOJ report other types of collections in connection with health care fraud activities such as HHS OIG audit disallowances and court-awarded restitution and compensatory damages.[Footnote 19] These types of collections represent amounts recovered by HHS and DOJ as a result of health care enforcement activities. These amounts are returned to the HI trust fund to the extent that they represent repayments to Medicare.[Footnote 20] Appropriations from the HI Trust Fund and Related Expenditures: Funds for the HCFAC program are appropriated from the HI trust fund to an expenditure account, referred to as the Health Care Fraud and Abuse Control Account (HCFAC account) maintained within the HI trust fund. Annually, the HHS Secretary and the Attorney General jointly certify amounts appropriated from the HI trust fund to the HCFAC account as necessary to finance health care fraud and abuse control activities based on statutory limits. HIPAA, as amended, prescribes the maximum amount that may be certified in a given fiscal year.[Footnote 21] Any unexpended amounts are carried forward to the next fiscal year. Once HCFAC funds have been certified, CMS's Division of Accounting Operations performs the accounting for appropriations transferred to the HCFAC account. CMS makes funds available by creating allotments in its accounting system to fund related HCFAC expenditures.[Footnote 22] CMS provides funds to other HHS components and DOJ through intra-and interagency agreements, as shown in figure 1. This process requires HHS and DOJ to bill CMS through the Intra-governmental Payment and Collection (IPAC) System to obtain payment from their allocation of HCFAC funds.[Footnote 23] In addition to CMS's central accounting for HFCAC funds, both HHS and DOJ components have processes to separately manage their allotted HCFAC amounts. In general, these processes include authorizing HCFAC-related expenditures, recording applicable payroll and nonpayroll expenditures incurred to a designated HCFAC code, and reporting any unexpended amounts to be carried forward to the next fiscal year. For fiscal year 2009, the Secretary of HHS and the Attorney General certified $266.4 million in mandatory funding to be appropriated from the HI trust fund to the HCFAC account.[Footnote 24] Additionally, Congress appropriated $198 million in discretionary funding to that account in response to HHS's fiscal year 2009 budget request, to fund HCFAC program integrity activities. As such, the total appropriated amount to the HCFAC account for fiscal year 2009 was $464.4 million for that year.[Footnote 25] Figure 2 provides a historical trend of the amounts appropriated to the HCFAC account over the past 13 fiscal years. Figure 2: Amounts Appropriated for HCFAC, Fiscal Years 1997 through 2009: [Refer to PDF for image: vertical bar graph] Fiscal year: 1997; Mandatory funding: $104 million. Fiscal year: 1998; Mandatory funding: $119.6 million. Fiscal year: 1999; Mandatory funding: $137.5 million. Fiscal year: 2000; Mandatory funding: $158.2 million. Fiscal year: 2001; Mandatory funding: $181.9 million. Fiscal year: 2002; Mandatory funding: $209.2 million. Fiscal year: 2003; Mandatory funding: $240.6 million. Fiscal year: 2004; Mandatory funding: $240.6 million. Fiscal year: 2005; Mandatory funding: $240.6 million. Fiscal year: 2006; Mandatory funding: $240.6 million. Fiscal year: 2007; Mandatory funding: $249.5 million. Fiscal year: 2008; Mandatory funding: $255.2 million. Fiscal year: 2009[A]; Mandatory funding: $266.4 million; Discretionary funding: $198 million; Total funding: $464.4 million. Source: The annual joint HHS and DOJ HCFAC reports for fiscal years 1997 through 2009. [A] Fiscal year 2009 was the first year that Congress appropriated discretionary funding to the HCFAC account to support health care fraud and abuse activities. The Omnibus Appropriations Act of 2009 (Pub. L. No. 111-8) appropriated $198 million out of the HI and Federal Supplementary Medical Insurance (SMI) trust funds to HCFAC. [End of figure] Funds were first appropriated to HCFAC in fiscal year 1997. HIPAA limited the amounts appropriated for fiscal years 1998 through 2003 to an amount equal to the limit for the preceding fiscal year plus an additional 15 percent. For fiscal years 2004 through 2006, the amount made available was capped at the 2003 limit. The Tax Relief and Health Care Act (TRHCA) also allowed for yearly increases to the HCFAC account based on the change in the consumer price index for all urban consumers (CPI-U) over the previous fiscal year for fiscal years 2007 through 2010. In fiscal year 2006, TRHCA amended HIPAA so that funds allotted from the HCFAC account are available until expended.[Footnote 26] Beyond 2010, the Patient Protection and Affordable Care Act, [Footnote 27] as amended by the Health Care and Education Reconciliation Act of 2010,[Footnote 28] raised the limit on funds that may be certified for the HCFAC account by the Secretary of HHS and the Attorney General by an additional $350 million over the next 10 years, beginning in fiscal year 2011. The annual allocation of appropriation amounts to the HHS and DOJ components are intended to support a variety of anti-fraud and anti- abuse activities. For example, in May 2009, HHS and DOJ established a task force--the Health Care Fraud Prevention and Enforcement Action Team (HEAT)--comprised of top level law enforcement and professional staff from both agencies to prevent health care fraud and enforce current anti-fraud laws around the country. Other examples include HHS OIG investigations, audits, and evaluations that identify vulnerabilities for questionable or fraudulent financial practices related to Medicaid outpatient prescription drug expenditures and Medicare contractor costs. Similarly, DOJ's USAOs use HCFAC funding to support civil and criminal health care fraud and abuse litigation. HCFAC funds are also used to train attorneys, investigators, and auditors in the investigation and prosecution of health care fraud and abuse; prosecute health care matters through criminal, civil, and administrative proceedings; and conduct investigations, financial, and performance audits of health care programs, inspections, and other evaluations. Agencies Took Action to Address Three of Four GAO Recommendations: In our April 2005 report,[Footnote 29] we identified weaknesses related to not properly capturing certain expenditure data in agency information systems, non-adherence to accounting policy for select HCFAC expenditures, and lengthy HCFAC report review processes. We made recommendations to HHS and DOJ to improve procedures for recording HCFAC expenditures and issuing the annual HCFAC report.[Footnote 30] Based on our analysis of documentation, HHS and DOJ took actions that addressed three of the four recommendations. Both agencies disagreed with our recommendation to notify Congress on delays in issuing the HCFAC report by the mandated deadline and thus, did not take action. Each of the recommendations and applicable actions taken are described further below. Record staff hours in workload tracking systems. In our 2005 report, we found that two HHS OIG components--Office of Evaluations and Inspections and Office of Investigations--had not recorded all staff hours in their workload tracking systems, which are used to monitor actual hours spent on HCFAC activities. HHS OIG uses the workload tracking systems to monitor HCFAC payroll expenditures, and incomplete information could hinder those efforts. We recommended that the HHS Inspector General require all HHS OIG components to develop procedures for ensuring that all key staff hours spent on HCFAC activities are recorded in the HHS OIG workload tracking systems. In April 2006, the HHS OIG's Office of Evaluation and Inspections updated its procedures for entering information into its workload tracking system, including guidance related to the completion of timesheets. The procedures instruct employees to record time to specific inspection codes and instruct managers to review staff time recorded in the system. In addition, HHS OIG's Office of Investigations updated its procedures in October 2009, which require all Office of Investigations personnel to record time and attendance in its workload tracking system. We determined that HHS OIG components' actions substantially addressed the recommendation. Record expenditure data under the correct account class. In our 2005 report, we noted that only one of the four DOJ components receiving HCFAC funds properly recorded expenditures as required by DOJ policies and procedures. We recommended that the Attorney General develop monitoring procedures to ensure that DOJ components record key HCFAC program expenditure data under the appropriate HCFAC account class in DOJ's accounting system. In April 2005, DOJ updated its policies and procedures that require individual components to monitor obligations recorded in the accounting system on a quarterly basis. Further, in fiscal year 2009 the Executive Office for the United States Attorneys provided procedures to the USAOs, which receive the largest portion of the HCFAC allocation, on how to charge HCFAC expenditures using the proper program code. According to DOJ officials, component officials review system reports on a regular basis to verify that HCFAC obligations and expenditures are correctly reflected in the accounting system. We determined that DOJ's actions were sufficient to close the recommendation. Develop a more expedited review process. In our 2005 report, we noted that a lengthy review process within HHS and DOJ resulted in failure to meet the mandated annual January 1 deadline for reporting HCFAC activities. For example, the fiscal year 2003 HCFAC report, the most recent report at the time of that review, was issued 1 year after the mandated reporting date. We recommended that the Secretary of HHS and the Attorney General develop a more expedited review process for the joint annual HCFAC reports. In June 2010, DOJ issued a Report Completion Guide, an expedited review process that provides instructions and time frames for submitting information to complete the annual HCFAC report. The guide introduced a new process whereby DOJ and HHS components utilized a shared website to distribute documents for edit and review. The guide also established time frames for issuing the fiscal year 2010 HCFAC report by January 1, 2011. Using these new time frames, HHS and DOJ jointly issued the fiscal year 2010 HCFAC report on January 24, 2011, only 23 days later than the mandated reporting date. According to DOJ officials responsible for preparing the HCFAC report, they intend to use these time frames to meet the mandated deadline when preparing future year reports. We determined that HHS and DOJ's efforts meet the intent of our recommendation. However, as discussed later in this report, although timeliness is important, ensuring that the report is accurate and reliable remains a concern. Notify Congress of delays in report issuance. In our 2005 report, we noted that repeated delays in issuing the joint annual HCFAC report impact the relevance of the data being reported. We recommended that the Secretary of HHS and the Attorney General notify congressional oversight committees of delays in issuing the annual report within 1 month of missing the January 1 deadline. HHS and DOJ did not concur with this recommendation. However, as we stated above, both HHS and DOJ developed and implemented a new timeline of dates to edit and review the annual HCFAC report, which resulted in issuing the fiscal year 2010 annual HCFAC report within one month of the mandate. Continuing to take steps to meet these internal deadlines will be necessary to issue the HCFAC report by the mandated deadline to provide timely, relevant information to Congress. HHS and DOJ Have Gaps in Documentation and Monitoring Controls over Reporting HCFAC Deposits and Expenditures: Our review of HHS and DOJ policies and procedures showed that both agencies had not designed sufficient controls to help ensure that HCFAC deposits and expenditures were accurately reported. GAO's Standards for Internal Control in the Federal Government provides that management should establish control mechanisms and activities, and monitor and evaluate these controls. Specifically, during our review we found that HHS and DOJ did not have sufficient controls in their policies and procedures with respect to (1) maintaining and retaining supporting documentation for HCFAC deposits and expenditures and (2) monitoring HCFAC deposits and expenditures to help ensure accurate reporting. From our review of the underlying documentation to support HCFAC activities and nongeneralizable samples of deposits and expenditures, we identified instances in which these design deficiencies resulted in HHS's and DOJ's inability to support reported amounts for HCFAC expenditures. We also found errors in reported HCFAC amounts.[Footnote 31] Documentation Controls Insufficient to Fully Support HCFAC Deposits and Expenditures: While HHS and DOJ designed controls that were incorporated into its policies and procedures generally requiring the retention of documentation for 6 years, the policies and procedures for CMS, Administration on Aging, and DOJ did not provide sufficient details with respect to where these documents were to be filed, who should be responsible for maintaining them, or a combination of both, which would help ensure accountability and adequate support of HCFAC deposits and expenditures. Our review found that while the HHS OIG and the Office of the General Counsel policies and procedures for documentation contained sufficient controls as to the type of documentation to be retained, the retention period, the location of records, and the person responsible for maintaining the records, CMS and Administration on Aging policies and procedures were lacking some of these controls.[Footnote 32] Specifically, CMS policies and procedures for documentation of HCFAC deposits and expenditures, did not identify the person responsible for maintaining supporting documents. We found the same weakness with Administration on Aging policies and procedures for documentation of HCFAC expenditures. Further, Administration on Aging policies and procedures did not specify where those documents should be filed. Officials from the Administration on Aging told us that they are in the process of revising their policies and procedures to address these issues. In its comments, Administration on Aging indicated that it expects to incorporate these changes by summer 2011. We also reviewed DOJ's controls for retention of documents related to HCFAC deposits and expenditures.[Footnote 33] DOJ's procedures for deposits identified controls related to the type of documentation to be retained, the retention period, and the location of records, but they did not specify the person responsible for maintaining supporting documents. Although DOJ's departmentwide expenditure procedures identified controls related to the type of documentation and the retention period, and indicated that documents should be maintained in the obligation file, the procedures did not specify the location of the obligation file and the person responsible for maintaining the records within each office. During our review, we found instances at HHS and DOJ where documentation was not available to support expenditures. For example, we found that HHS's Administration on Aging did not maintain, and therefore could not provide, underlying documentation to support how the estimated payroll percentages for fiscal years 2008 and 2009 were derived, which are used to charge payroll expenditures against the HCFAC account on a biweekly basis. In fiscal year 2008, for example, the Administration on Aging charged approximately 29 percent of its total HCFAC allocation, or $879,607, to payroll expenses, an amount that could not be fully supported due to the lack of documentation. Therefore, we were unable to verify the justification of such expenditures. In addition, during our review, we found that DOJ could not provide sufficient documentation to support 12 nongeneralizable payroll sample items selected for fiscal years 2008 and 2009, such as time and attendance reports, workload tracking system reports, and records of actual payroll disbursements. Further, DOJ could not provide documentation to support unexpended amounts carried forward from fiscal year 2008 to fiscal year 2009, totaling $522,278. At the end of each fiscal year, DOJ communicates to HHS the amount of unused funds so that HHS can carry them forward to the following fiscal year via an interagency agreement. To report this amount, DOJ's Justice Management Division compiles obligation data provided by the different DOJ components. However, DOJ's Justice Management Division could not locate the documents that supported the amount of funds carried forward in the fiscal year 2009 interagency agreement. GAO's Standards for Internal Control in the Federal Government provides that internal control be designed to ensure that all transactions and other significant events be clearly documented and the documentation be readily available for examination.[Footnote 34] The standards also provide that records should be properly managed and maintained and documentation should appear in management directives, administrative policies, or operating manuals. Insufficient controls over documentation increase the risk of not having sufficient support to ensure reported HCFAC amounts are accurate and funds are spent as intended. Monitoring Controls Insufficient to Help Ensure Accurate Reporting of HCFAC Deposits and Expenditures: HHS's and DOJ's procedures did not incorporate sufficient monitoring controls to help ensure HCFAC deposits and expenditures were accurately reported. Monitoring of deposits. HHS and DOJ had not designed controls to require the reconciliation of HCFAC deposits recorded in their departmentwide accounting systems to data collection systems or to the HI trust fund statements.[Footnote 35] Specifically, CMS did not have written procedures that required the reconciliation of civil monetary penalty amounts in the CMS regional offices' data collection system to CMS's accounting system.[Footnote 36] We found two instances from our fiscal year 2009 nongeneralizable sample of deposits where CMS regional offices had made adjustments that were recorded in their data collection system, but not communicated to the Office of Financial Management for recording in CMS's accounting system, which is used as a source to compile the data for the HCFAC report. These two instances resulted in a $15,066 overstatement error in CMS's accounting system, which CMS officials corrected after we brought the errors to their attention. Although CMS officials stated that they reconcile the data maintained in both systems on a monthly basis, they were not able to provide us an example of these reconciliation reports. In February 2011, CMS officials told us that they were in the process of developing procedures for the Office of Financial Management to require these reconciliations. In addition, DOJ's Justice Management Division[Footnote 37] did not have written procedures that included controls to reconcile deposits of the 3 percent portion of penalties and multiple damages reported in the HI trust fund statements to the agency's accounting system records.[Footnote 38] For example, for fiscal year 2009 we identified an overstatement in the amount of $596,266 in the HI trust fund statements when comparing to DOJ's records. When we inquired about the difference, DOJ officials from the Justice Management Division confirmed that an overstatement had occurred because of adjusting entries that had been communicated to the Bureau of the Public Debt but not captured in the HI trust fund statements. In February 2011, DOJ officials told us that to avoid this from happening in the future, they were in the process of developing procedures that would include monitoring controls for reconciling on a quarterly basis penalties and multiple damages between DOJ records and the statements issued by the Bureau of the Public Debt to ensure reported amounts are accurate and consistent between both agencies. Monitoring of expenditures. Similarly, certain HHS components and DOJ did not have written procedures that incorporated controls for reconciling or comparing HCFAC staff hours to verify the accuracy of payroll expenditures charged against the HCFAC account. Specifically, HHS's Administration on Aging did not have controls for monitoring HCFAC actual payroll hours. HHS's Administration on Aging charges payroll expenditures based on estimates made prior to or after the beginning of the year. Because the Administration on Aging does not record hours at the HCFAC activity level, it cannot verify that the payroll expenditures charged against the HCFAC account throughout the year are reasonably accurate. According to officials at the Administration on Aging, they believe that tracking hours at the HCFAC activity level would not be cost effective nor provide better results to justify the costs. However, because the estimated percentage of time charged against the HCFAC account may not represent the actual time spent on HCFAC activities for a given pay period, it is critical that some type of monitoring procedures or verification procedures are designed to help ensure that the payroll expenditures charged to the HCFAC account are reasonable and supported. DOJ's Civil Rights Division also charges HCFAC payroll expenditures based on estimates. Although Civil Rights Division officials indicated that they track and record actual hours and make adjustments to payroll expenditures if differences are noted, these controls were not documented in DOJ's policies and procedures. In addition, HHS OIG and the Office of the General Counsel for HHS, as well as DOJ USAO and Civil Division, did not have written procedures that included controls for reconciling or comparing HCFAC hours recorded in workload tracking systems to departmentwide payroll or accounting systems. We found instances where staff hours captured in workload tracking systems did not agree with staff hours recorded in departmentwide payroll or accounting systems. For example, we found that the workload tracking system used by the Office of Counsel to the Inspector General included approximately 10 percent fewer hours for fiscal year 2008 and 7 percent fewer hours in fiscal year 2009 when compared to HHS's payroll system reports. Similarly, we found two instances from our fiscal year 2008 nongeneralizable sample of expenditures where USAO's workload tracking system included fewer hours than the HCFAC hours recorded and billed in DOJ's accounting system, which collectively accounted for a 40 percent difference between the two systems. Failure to complete these reconciliations or comparisons could lead to unsubstantiated payroll expenditures that should not be charged to the HCFAC account.[Footnote 39] HHS OIG and DOJ officials told us that they were aware of the differences. HHS OIG officials indicated that while they did not have procedures that specifically addressed the reconciliation of data captured in their workload tracking systems, they believed they had other compensating controls, such as periodic inspections of timesheets, to mitigate the risk of inconsistent data between systems. They also noted that they were considering taking actions to revise their policies and procedures to add new monitoring controls to address the need to reconcile data between the systems. Further, DOJ officials indicated that because they spend significantly more resources on HCFAC activities than the sum that is allocated to DOJ from the HCFAC account, it is not cost beneficial to require personnel to record their time consistently in both systems. Also, according to DOJ officials, although not formally documented, each component has processes to monitor HCFAC expenditures to ensure they do not over- bill the HCFAC account. For example, the officials stated that the Criminal Division performs quarterly reviews of percentages used to charge payroll expenditures against the HCFAC account. Not having policies and procedures to ensure that sufficient controls over HCFAC expenditures are in place could result in misstatements and ultimately hinder HHS and DOJ managers in preparing meaningful budgets to support future HCFAC funding requests. Monitoring of annual report compilation. Also, we found that although DOJ issued the Report Completion Guide in June 2010 that specified time frames for both HHS and DOJ for submitting information to complete the annual HCFAC report, the guide did not require that monitoring control activities, such as comparisons and supervisory reviews, be performed to help ensure that reported amounts were accurately presented. During our review of the HCFAC reports, we found presentation errors of $245.7 million and $717.5 million for fiscal years 2008 and 2009, respectively, of the total amounts reported as transferred to the HI trust fund. For example, for fiscal year 2009 we found that $716.8 million of the $1.0 billion reported in the restitution and compensatory damages line item was not transferred to the HI trust fund as stated in the report. Of the $716.8 million, $441.0 million related to Medicaid, $245.4 million related to Medicare Part B, and $30.4 million represented a double-counting error. The $30.4 million double-counting error related to civil monetary penalties and CMS's portion of penalties and multiple damages, which were already reported under separate line items. HHS and DOJ disclosed the double-counting error and the Medicaid presentation error in the fiscal year 2010 annual HCFAC report issued on January 24, 2011. Recoveries for Medicare Part B and Medicaid are not transferred to the HI trust fund, but instead are to be transferred to the Federal Supplementary Medical Insurance (SMI) Trust Fund and the Medicaid appropriation account within CMS, respectively. We found a similar issue in the fiscal year 2008 HCFAC report, where the total amount reported as transferred to the HI trust fund included Medicare Part B recoveries totaling $245.7 million. These inaccuracies overstated the amount of funds transferred to the HI trust fund. In addition, CMS officials told us that the amounts reported in the HHS OIG audit disallowances line item, totaling about $662.5 million and $360.2 million for fiscal years 2008 and 2009, respectively, included both Medicare and Medicaid recoveries. As stated above, Medicaid recoveries are to be transferred to the Medicaid appropriation account within CMS rather than the HI trust fund. However, these officials stated that the dollar amount associated with each type of recovery could not be determined because the current system does not readily distinguish between Medicare and Medicaid recoveries for amounts previously reported in the HCFAC report. Full disclosures had not been made in the report to inform readers that reported amounts included Medicare Part B and Medicaid, which are not transferred to the HI trust fund. In the fiscal years 2008 and 2009 HCFAC reports, HHS and DOJ incorrectly indicated in footnotes that reported amounts did not include Medicaid funds. CMS officials indicated they will separately report Medicare and Medicaid recoveries related to HHS OIG audit disallowances in future HCFAC reports. According to CMS officials, they plan to accomplish this by manually tracking Medicare and Medicaid recoveries. In addition, DOJ officials told us that they are in the process of developing written guidance on the preparation of the annual HCFAC report and anticipate issuance by June 2011. GAO's Standards for Internal Control in the Federal Government provides that internal control should generally be designed to assure that ongoing monitoring occurs in the course of normal operations, including regular management and supervisory activities, comparisons, reconciliations, and other actions people take in performing their duties.[Footnote 40] Having detailed written policies and procedures that incorporate these key monitoring controls decreases the risk of reporting inaccurate HCFAC data that could be misleading to Congress when judging the success of the program. Conclusions: Although HHS and DOJ have taken action to address our previous recommendations aimed at improving procedures for recording HCFAC expenditures and issuing the annual HCFAC report, we found that controls are not sufficient to ensure that the report is accurate and supported. As HHS and DOJ accelerate the reporting process in an attempt to complete the report by the January 1 mandated reporting deadline, it is important that they establish controls that are designed to provide complete, accurate, and reliable information in the annual HCFAC report. Based on our review of the fiscal years 2008 and 2009 HCFAC reports, HHS and DOJ do not have sufficient controls for maintaining and retaining documentation and performing monitoring such as reconciliation and review activities to ensure accurate and consistent reporting of HCFAC deposits and expenditures. These design weaknesses led to instances where documentation was not readily available and amounts included in the HCFAC reports contained errors. Until HHS and DOJ strengthen their controls for documenting and monitoring HCFAC reporting processes, their ability to provide Congress with an accurate and timely annual report of HCFAC activities will continue to be compromised. Inaccuracies in the mandated annual report limit its usefulness to congressional decision makers and other interested parties. Recommendations for Executive Action: We are making the following 11 recommendations to HHS and DOJ to improve controls over the accounting and reporting of HCFAC activities. We recommend that the Secretary of HHS, * direct the Administrator of CMS to: - revise procedures for properly maintaining supporting documentation for HCFAC deposits and expenditures, to include specifying the titles of staff responsible for maintaining supporting documentation; - develop written procedures that incorporate monitoring controls for HCFAC deposit information recorded in the departmentwide accounting system, including reconciling the deposit data in this system to the regional offices' data collection system; * direct the Assistant Secretary for Aging to: - revise the Administration on Aging's procedures for properly maintaining supporting documentation for HCFAC expenditures, to include specifying the titles of staff responsible for maintaining supporting documentation and the location of records; - develop written procedures that incorporate monitoring controls to verify that the payroll expenditures charged against HCFAC are reasonable and supported; and: * direct the Acting General Counsel to develop written procedures that incorporate monitoring controls for the Office of the General Counsel staff hours related to HCFAC activities captured in workload tracking systems, including the reconciliation to staff hours captured in the departmentwide payroll system; and: * develop written procedures in collaboration with DOJ that incorporate monitoring controls for preparing the joint annual HCFAC report to help ensure reported amounts are accurate. We recommend that the HHS Inspector General develop written procedures that incorporate monitoring controls for HHS OIG staff hours related to HCFAC activities captured in workload tracking systems, including the reconciliation to staff hours captured in the departmentwide payroll system. We recommend that the Attorney General direct the Deputy Assistant Attorney General/Controller to: * revise procedures for properly maintaining supporting documentation for HCFAC deposits and expenditures, to include specifying the titles of staff responsible for maintaining supporting documentation and the location of records; * develop written procedures that incorporate monitoring controls for reconciling HCFAC deposits of the 3 percent portion of penalties and multiple damages information recorded in the departmentwide accounting system to the HI trust fund statements; * develop written procedures that incorporate monitoring controls to verify that the payroll expenditures charged against HCFAC are reasonable and supported; and: * develop written procedures in collaboration with HHS that incorporate monitoring controls for preparing the joint annual HCFAC report to help ensure reported amounts are accurate. Agency Comments and Our Evaluation: We provided a draft of this report to HHS and DOJ for review and comment. Written comments from the HHS Assistant Secretary for Legislation are reproduced in appendix III. DOJ indicated via e-mail that it agreed with the findings and the four recommendations we made to revise or develop written procedures that include documentation and monitoring controls for HCFAC activities and reporting. While DOJ did not provide written comments, it provided technical comments, as did HHS, that we incorporated as appropriate. We made a total of 11 recommendations, 7 to HHS and 4 to DOJ. Of the seven recommendations we made, in its written comments, HHS generally agreed with five, disagreed with one, and did not address the remaining recommendation. Specifically, HHS agreed with our recommendation related to revising the Administration on Aging's procedures for properly maintaining supporting documentation for HCFAC expenditures and stated that it plans to incorporate these changes by summer 2011. Also, HHS agreed with our recommendation to develop written procedures for preparing the joint annual HCFAC report and indicated that it has begun to work with DOJ to improve the Report Completion Guide. In addition, HHS OIG agreed with our recommendation to develop written procedures that incorporate monitoring controls for staff hours related to HCFAC activities recorded in its workload tracking systems and stated that it will incorporate these procedures into its formal policies. Further, the Administration on Aging stated its view that addressing our recommendation to develop written procedures to verify that HCFAC payroll expenditures are reasonable and supported would not provide material results to justify the additional expense and workload. However, the Administration on Aging agreed to explore other options to refine its HCFAC payroll expenditures. The Office of the General Counsel agreed and stated that it had addressed our recommendation to develop written procedures that incorporate monitoring controls for staff hours recorded in the workload tracking system. It stated that on February 2, 2011, it provided us procedures for properly accounting for HCFAC expenditures. While we received procedures from the Office of the General Counsel, these procedures did not address our finding. Instead, the procedures discussed the transfer of payroll expenditures to the HCFAC account. Therefore, we determined that this recommendation has not been addressed. CMS disagreed with our recommendation to revise procedures for maintaining supporting documentation for HCFAC deposits and expenditures, which include specifying the titles of staff responsible for maintaining supporting documentation. CMS stated that the National Archives and Records Administration does not require staff titles on a standard form it prescribes for transferring records to approved records facilities (SF-135) and that CMS requires staff to take records retention training each year. CMS also stated it believes the information maintained is sufficient to ensure accountability and proper and consistent supporting documentation for HCFAC deposits and expenditures. However, we continue to believe that CMS's policies and procedures for documentation are insufficient, as they do not identify the staff responsible for maintaining documentation as required by the National Archives and Records Administration regulations.[Footnote 41] Also, CMS stated that the creation of a new records retention system for HCFAC records would be duplicative and unnecessary. We do not believe that a new records retention system exclusively for HCFAC records is necessary to achieve accountability for documentation responsibilities. Rather, a modification to CMS's existing procedures that identifies the responsible staff by title to show authority levels for properly maintaining supporting documentation, help provide continuity when staff change positions, and promote accountability would be sufficient to address this shortcoming. Lastly, in its comments, CMS did not address our remaining recommendation to develop written procedures that incorporate monitoring controls for HCFAC deposit information recorded in the departmentwide accounting system. However, as we stated in the report, CMS officials told us in February 2011 that they were in the process of developing procedures that require the reconciliation of HCFAC deposit information. As we agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution of it until 30 days from the report date. At that time, we will send copies to the Secretary of HHS, the Attorney General, and other interested parties. The report will also be available at no charge on GAO's Web site at [hyperlink, http://www.gao.gov]. If you or your staff have any questions about this report, please contact me at (202) 512-9312 or dalykl@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV. Sincerely yours, Signed by: Kay L. Daly: Director, Financial Management and Assurance: [End of section] Appendix I: Objectives, Scope, and Methodology: The objectives of this review were to determine to what extent the Department of Health and Human Services (HHS) and the Department of Justice (DOJ) (1) took action to address the recommendations we made in 2005 and (2) designed effective controls over reporting Health Care Fraud and Abuse Control (HCFAC) program deposits and expenditures for fiscal years 2008 and 2009[Footnote 42].: To address the extent to which HHS and DOJ took action to address the recommendations made in 2005, we: * Obtained and reviewed documentation provided by HHS and DOJ such as policies and procedures and the Report Completion Guide. * Interviewed officials at HHS and DOJ including the Acting Deputy Inspector General and the Assistant Director of the Executive Office for United States Attorneys to identify actions to improve HCFAC program operations. To address the extent to which HHS and DOJ designed effective controls over reporting HCFAC deposits and expenditures, we: * Obtained and reviewed relevant HHS and DOJ policies and procedures for reporting deposits and expenditures within each agency.[Footnote 43] * Used criteria outlined in our Standards for Internal Control in the Federal Government, specifically as it relates to control activities and monitoring, to assess the effectiveness of controls over the reporting of amounts related to deposits and expenditures. We applied these standards to assess whether the design of the controls documented in the policies and procedures reasonably assured accurate and consistent reporting of HCFAC amounts in the joint annual HCFAC report.[Footnote 44] We did not verify the validity or accuracy of the reported amounts. * Assessed the reliability of data used to select our nongeneralizable samples by: - tracing deposit control totals of the electronic databases to the corresponding deposit line item totals reported in the HCFAC reports and the Bureau of the Public Debt's Federal Hospital Insurance Trust Fund (HI trust fund) statements; - obtaining the funding decision memorandum detailing how the HCFAC funds would be distributed between HHS and DOJ for fiscal years 2008 and 2009 to verify the HCFAC funds certified by HHS and DOJ officials; - comparing amounts reported in the joint HCFAC reports to the approved funding decision memorandum and comparing amounts from the decision memorandum to the Office of Management and Budget (OMB) documentation (Apportionment Schedule SF-132) to verify that the amounts were made available; - tracing total expenditure amounts to supporting documentation, including electronic databases, billing packages, and intra-and interagency agreements; and: - reviewing existing information about the electronic data and the systems that produced them. We determined that the data were sufficiently reliable to select our samples. * Selected a nongeneralizable stratified random sample for each of the deposit types (gifts and bequests, criminal fines, civil monetary penalties, and penalties and multiple damages) that HHS and DOJ reported a dollar amount greater than zero in the fiscal years 2008 and 2009 annual HCFAC reports. We selected a total of 47 deposit transactions for fiscal year 2008 and 55 transactions for fiscal year 2009. Transaction selection criteria included various factors such as dollar amounts and transaction volume. For the selected transactions, we reviewed various sources of documentation depending on the type of deposit to determine whether dollar amounts were accurately reported. Examples of supporting documentation for deposits included check registers; electronic fedwires;[Footnote 45] health care tracking forms used to allocate deposit collections among the various health care programs; judgment orders and agency letters identifying applicable fines and penalties assessed; and collection system query reports. These randomly selected transactions were designed to provide additional details about the processing of those transactions and were not intended to be representative of the universe of HCFAC transactions. See appendix II for information about the universe of transactions and our sampled items. * Selected a nongeneralizable random sample of expenditures for each of the agency components that were allocated HCFAC appropriation funds as reported in the annual HCFAC reports for fiscal years 2008 and 2009.[Footnote 46] For the Centers for Medicare & Medicaid Services (CMS) and the United States Attorneys Office (USAO), we obtained electronic databases and selected a nongeneralizable stratified random sample for those agency components. We selected a total of 63 transactions for fiscal year 2008 and 62 transactions for fiscal year 2009 related to payroll and nonpayroll expenditures. Transaction selection criteria included various factors such as dollar amounts, transaction volume, and source of information. For these transactions, we reviewed various sources of documentation depending on the type of expenditure to determine whether dollar amounts were accurately reported and the use of funds were consistent with the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Examples of supporting documentation for expenditures included workload tracking system and payroll system query reports; time and attendance reports; salary forms; invoices; contracts; and travel vouchers. These randomly selected transactions were designed to provide additional details about the processing of those transactions and were not intended to be representative of the universe of HCFAC transactions. See appendix II for information about the universe of transactions and our sampled items. * Performed additional procedures for HHS Office of Inspector General (OIG) payroll transactions as this component received 67 percent and 42 percent of total HCFAC appropriations allocated for fiscal years 2008 and 2009, respectively. Specifically, we (1) obtained time reports from workload tracking systems for all four OIG components (Office of Audit Services, Office of Investigations, Office of Evaluations and Inspections, and Office of Counsel to the Inspector General) to determine if the projects identified as HCFAC were properly classified; and (2) compared the number of hours in the workload tracking systems to the number of hours in the HHS payroll system to determine if the components' systems included hours for all staff. * Interviewed agency officials from HHS and DOJ including budget analysts and financial specialists to obtain an understanding and clarification of the processes used to report deposits to the HI trust fund and appropriations from this fund, including related expenditures. We conducted our work from February 2010 through May 2011 in accordance with U.S. generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. [End of section] Appendix II: Information about the Universe of Transactions and Our Sampled Items: During our review of fiscal years 2008 and 2009 Health Care Fraud and Abuse Control (HCFAC) program activities, we selected nongeneralizable samples to further understand the Department of Health and Human Services (HHS) and the Department of Justice (DOJ) procedures for HCFAC deposits and expenditures. For deposits, we stratified the data and selected random transactions, as summarized in table 1 below, for each of the deposit types authorized by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) for which HHS and DOJ reported dollar amounts greater than zero in the fiscal years 2008 and 2009 HCFAC reports. Table 1: Summary of Selected Deposit Transactions: 2008: Line item: Criminal fines; Universe of transactions: 200; Total value of universe: $2,307,754; Number of selected transactions: 10; Total value of selected transactions: $1,650,768. Line item: Civil monetary penalties[A]; Universe of transactions: 2,568; Total value of universe: $13,613,590; Number of selected transactions: 23; Total value of selected transactions: $4,304,620. Line item: Penalties and multiple damages[A]; Universe of transactions: 273; Total value of universe: $559,988,531; Number of selected transactions: 11; Total value of selected transactions: $236,905,878. Line item: Gifts and bequests; Universe of transactions: 3; Total value of universe: $25,847; Number of selected transactions: 3; Total value of selected transactions: $25,847. Line item: Total; Universe of transactions: 3,044; Total value of universe: $575,935,722; Number of selected transactions: 47; Total value of selected transactions: $242,887,113. 2009: Line item: Criminal fines; Universe of transactions: 201; Total value of universe: $620,888,618; Number of selected transactions: 11; Total value of selected transactions: $620,113,917. Line item: Civil monetary penalties[A]; Universe of transactions: 2,610; Total value of universe: $18,080,194; Number of selected transactions: 25; Total value of selected transactions: $6,184,843. Line item: Penalties and multiple damages[A]; Universe of transactions: 260; Total value of universe: $498,671,480; Number of selected transactions: 12; Total value of selected transactions: $477,294,549. Line item: Gifts and bequests; Universe of transactions: 7; Total value of universe: $46,271; Number of selected transactions: 7; Total value of selected transactions: $46,271. Line item: Total; Universe of transactions: 3,078; Total value of universe: $1,137,686,563; Number of selected transactions: 55; Total value of selected transactions: $1,103,639,580. Source: GAO analysis of HHS and DOJ HCFAC data. [A] Total value of selected transactions for civil monetary penalties and penalties and multiple damages represent the absolute value for these line items. [End of table] For expenditures, we selected samples from object classes that in aggregate accounted for 50 percent or more of total obligations for each component that received HCFAC funds. Based on dollar amounts, we then selected random transactions, as summarized in table 2 below. Table 2: Summary of Selected Expenditures Transactions: 2008: Agency: Department of Health and Human Services: Agency Component: Office of Inspector General; Number of selected transactions: 5; Value of selected transactions: $8,570,351; Object classes selected: Other Contractual Services. Analytical procedures performed for personnel payroll hours, as described in appendix I. Agency Component: Office of the General Counsel; Number of selected transactions: 4; Value of selected transactions: $855,515; Object classes selected: Personnel Compensation and Other Contractual Services. Agency Component: Administration on Aging; Number of selected transactions: 1; Value of selected transactions: $909,997; Object classes selected: Grants, Subsidies, and Contributions. Agency Component: Centers for Medicare & Medicaid Services; Number of selected transactions: 14; Value of selected transactions: $11,906,880; Object classes selected: Personnel Compensation and Other Contractual Services. Agency: Department of Justice: Agency Component: United States Attorneys Office; Number of selected transactions: 7; Value of selected transactions: $3,635,898; Object classes selected: Personnel Compensation and Rent, Communications, and Utilities. Agency Component: Civil Division[A]; Number of selected transactions: 12; Value of selected transactions: $5,271,253; Object classes selected: Personnel Compensation and Other Contractual Services. Agency Component: Criminal Division; Number of selected transactions: 10; Value of selected transactions: $427,156; Object classes selected: Personnel Compensation; Rent, Communications, and Utilities; and Other Contractual Services. Agency Component: Civil Rights; Number of selected transactions: 10; Value of selected transactions: $79,423; Object classes selected: Personnel Compensation and Other Contractual Services. Total 2008: Number of selected transactions: 63; Value of selected transactions: $31,656,473. 2009: Agency: Department of Health and Human Services: Agency Component: Office of Inspector General; Number of selected transactions: 5; Value of selected transactions: $2,584,748; Object classes selected: Other Contractual Services. Analytical procedures performed for personnel payroll hours, as described in appendix I. Agency Component: Office of the General Counsel; Number of selected transactions: 1; Value of selected transactions: $6,695; Object classes selected: Personnel Compensation. Agency Component: Administration on Aging; Number of selected transactions: 1; Value of selected transactions: $646,773; Object classes selected: Grants, Subsidies, and Contributions. Agency Component: Centers for Medicare & Medicaid Services; Number of selected transactions: 18; Value of selected transactions: $72,241,840; Object classes selected: Personnel Compensation and Other Contractual Services. Agency: Department of Justice: Agency Component: United States Attorneys Office; Number of selected transactions: 7; Value of selected transactions: $3,642,137; Object classes selected: Personnel Compensation and Rent, Communications, and Utilities. Agency Component: Civil Division[A]; Number of selected transactions: 10; Value of selected transactions: $2,496,884; Object classes selected: Personnel Compensation and Other Contractual Services. Agency Component: Criminal Division; Number of selected transactions: 11; Value of selected transactions: $478,988; Object classes selected: Personnel Compensation; Rent, Communications, and Utilities; Other Contractual Services; and Supplies and Materials. Agency Component: Civil Rights; Number of selected transactions: 9; Value of selected transactions: $61,320; Object classes selected: Personnel Compensation and Other Contractual Services. Total 2009: Number of selected transactions: 62; Value of selected transactions: $82,159,385. Source: GAO analysis of HHS and DOJ HCFAC data. [A] Samples selected for Civil Division also include transactions for the Nursing Home and Elderly Justice Initiative. [End of table] [End of section] Appendix III: Comments from the Department of Health and Human Services: Department Of Health & Human Services: Office Of The Secretary: Assistant Secretary for Legislation: Washington, DC 20201: May 3, 2011: Kay L. Daly: Director, Financial Management and Assurance: U.S. Government Accountability Office: 441 G Street N.W. Washington, DC 20548: Dear Ms. Daly: Attached are comments on the U.S. Government Accountability Office's (GAO) draft report entitled: "Health Care Fraud And Abuse Control Program: Improvements Needed in Controls Over Reporting Deposits and Expenditures" (GAO 11-466). The Department appreciates the opportunity to review this draft report prior to publication. Sincerely, Signed by: Jim R. Esquea: Assistant Secretary for Legislation: Attachment: [End of letter] General Comments Of The Department Of Health And Human Services (HHS) On The Government Accountability Office's (GAO) Draft Report Entitled. "Health Care Fraud And Abuse Control Program: Improvements Needed In Controls Over Reporting Deposits And Expenditures" (GAO-11-446): The Department appreciates the opportunity to comment on this draft report. GAO Recommendation No. 1: We recommend that the Secretary of HHS direct the Administrator of CMS to: * revise procedures for properly maintaining supporting documentation for HCFAC deposits and expenditures, to include specifying the titles of staff responsible for maintaining supporting documentation; * develop written procedures that incorporate monitoring controls for HCFAC deposit information recorded in the departmentwide accounting system, including reconciling the deposit data in this system to the regional offices' data collection system. Centers for Medicare and Medicaid Services (CMS) Response: CMS disagrees with GAO's assertion that we have inadequate controls or procedures regarding retention of HCFAC related records because we do not explicitly identify the title of staff responsible for management of such records. Standard Form 135, Records Transmittal and Receipt, which is prescribed by the National Archives and Records Administration (NARA), accompanies all records stored in an approved facility, and includes the Agency contact name, office, and telephone number, but NARA does not require staff titles. Each CMS component is responsible for following all federal records retention policies for its HCFAC-related functions. Also, all CMS employees are required to take records retention training each year, and are responsible for appropriately and consistently applying CMS' Records Management guidelines. CMS believes the information it maintains is sufficient to ensure accountability and proper and consistent supporting documentation for HCFAC deposits and expenditures. CMS believes that specifying the titles of particular CMS staff is unwarranted and that creation of a new records retention system uniquely for HCFAC records would be duplicative and unnecessary. GAO Recommendation No. 2: We recommend that the Secretary of MS direct the Assistant Secretary for Aging to: * revise the Administration on Aging's procedures for properly maintaining supporting documentation for HCFAC expenditures, to include specifying the titles of staff responsible for maintaining supporting documentation and the location of records; * develop written procedures that incorporate monitoring controls to verify that the payroll expenditures charged against HCFAC are reasonable and supported. Administration on Aging (AoA) Response: We agree with the first part of the recommendation, on the maintenance of supporting documentation and will move forward to incorporate these changes into our filing system by Summer 2011, to the extent feasible. Concerning the second part of the recommendation, on developing written procedures incorporating monitoring controls, we have used the same approach to capture HCFAC payroll charges for more than a decade. At the beginning of each year, AoA surveys each of the approximately twenty-seven staff in Headquarters and the Regional Offices who work on HCFAC activities to determine the percentage of time each individual estimates that they will spend, on average, over the entire year on HCFAC. The Accounting for Pay System (AFPS) is then used to allocate the same estimated percentage of the person's pay to HCFAC funding each pay period, regardless of the number of hours the person actually works on HCFAC during those specific two weeks. The percentages allocated for most staff are small—no more than ten to twenty-five percent in most cases. In the aggregate this resulted in FY 2008 in approximately 29%, or $879,607, of AoA's $3.1 million FY 2008 HCFAC allocation being used for personnel costs, a reasonable percentage given that these dollars are used to provide administrative and related support for AoA's Senior Medicare Patrol anti-fraud education program. AoA uses the Department's ITAS system to track actual hours worked by employees, and this system does not have the ability to track hours spent on one type of activity versus another. To implement the type of controls that GAO recommends would therefore require the establishment of a completely new, wholly separate tracking system from that used by the Department for time and attendance purposes. Such a system would require employees to track and log hourly HCFAC activity, to cumulate and report that activity to a central tracking point of contact, and then require this information to periodically be used to adjust the labor distributions in the accounting system for each of those individuals. While this approach could result in a more accurate accounting, it would do so at a price of a very substantially increased workload at every level disproportionate to the amount of HCFAC funding received. Further, some time ago, AoA eliminated requirements that employees sign in and out and keep a written record of their time and attendance in connection with collective bargaining agreements. AoA does not believe that the penny-wise approach favored by GAO would have sufficiently material results as to justify the additional expense and workload. AoA is willing, however, to engage in exploratory discussions with other Operating Divisions within the Department who may be faced with similar situations—whether or not related to HCFAC dollars—to determine if there are other approaches which might allow it either to further refine the payroll charges or to further adjust a subsequent year's estimated percent of time spent on HCFAC. If a less resource intensive solution could be identified, AoA would be open to its implementation. GAO Recommendation No. 3: We recommend that the Secretary of FIRS direct the Acting General Counsel to: * develop written procedures that incorporate monitoring controls for the Office of the General Counsel staff hours related to HCFAC activities captured in workload tracking systems, including the reconciliation to staff hours captured in the departmentwide payroll system. Office of the General Counsel (OGC) Response: At the time of this review, OGC did not have written procedures in- place to clarify 1) its method of using Practice Manager (PM) workload reports to transfer pay between non-HCFAC and HCFAC specific Common Accounting Numbers (CANs) in the Department's Accounting For-Pay System (AFPS) and 2) its corresponding reconciliation process. Financial data reconciliation is common practice for government budget staff as part of their regular duties/responsibilities as budget analysts and thus routinely occurs in the absence of specific documented procedures. Nonetheless, prior to the issuance of this draft report, OGC developed such policy guidance in order to detail its procedures for properly accounting for its associated cost-of-work performed on behalf of HCFAC. OGC provided this HCFAC Account Expenditures Policy Guidance to GAO on February 2, 2011. GAO Recommendation No. 4: We recommend that the Secretary of FIRS develop written procedures in collaboration with DOJ that incorporate monitoring controls for preparing the joint annual HCFAC report to help ensure reported amounts are accurate. HHS Response: The Department agrees that having written procedures, or guidance, for the joint annual HCFAC report will work to ensure accurate reporting. To further this goal, HHS and DOJ developed the Department of Health and Human Services and Department of Justice Annual Report on the Health Care Fraud and Abuse Control Program: Report Completion Guide as part of the FY 2010 HCFAC Report process. DOJ shared this manual with GAO in the fall of 2010. However, in response to this GAO report, HHS and DOJ have been working collaboratively to improve the content of this manual, specifically to ensure the accuracy of the numbers included in the "Monetary Results" table of the annual HCFAC report. The updated manual will include a detailed matrix that describes each transfer or deposit figure included in the "Monetary Results" table of the HCFAC report, which agency is responsible for reporting that figure, the source of the data, and who is responsible for verifying the final numbers published in the Annual Report. This report, or guidance, will be distributed annually to all relevant FIRS Operating Divisions as well as all relevant components within DOJ. GAO Recommendation No. 5: We recommend that the FIRS Inspector General (OIG) develop written procedures that incorporate monitoring controls for FIRS OIG staff hours related to HCFAC activities captured in workload tracking systems, including the reconciliation to staff hours captured in the departmentwide payroll system. Office of Inspector General (OIG) Response: HHS OIG concurs with this recommendation. OIG continues to assert that our workload tracking accurately captures total staff hours and the staff hours allocable to HCFAC-related activities. Nevertheless, HHS OIG agrees to incorporate these implemented procedures into formal written policies that will include reconciliation of overall staff hours to the department-wide payroll system. [End of section] Appendix IV: GAO Contacts and Staff Acknowledgments: GAO Contact: Kay L. Daly, (202) 512-9312 or dalykl@gao.gov: Staff Acknowledgments: In addition to the contact listed above, Carla J. Lewis (Assistant Director), Maria C. Belaval, Sharon O. Byrd, William L. Evans, Maria Hasan, Christopher N. Howard, Jason S. Kirwan, Mitchell D. Owings, and Nina M. Rostro made significant contributions to this report. [End of section] Footnotes: [1] GAO, High-Risk Series: An Update, [hyperlink, http://www.gao.gov/products/GAO-11-278] (Washington, D.C.: February 2011). Fraud represents intentional acts of deception with knowledge that the action or representation could result in an inappropriate gain. Waste includes inaccurate payments for services, such as unintentional duplicate payments. Abuse represents actions inconsistent with acceptable business or medical practices. An improper payment is defined as any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements. It includes any payment to an ineligible recipient, any payment for an ineligible service, any duplicate payment, any payment for services not received, and any payment that does not account for credit for applicable discounts. The Office of Management and Budget (OMB) guidance also instructs agencies to report payments for which insufficient or no documentation was found as improper payments. [2] For fiscal year 2010, HHS reported improper payment estimates for the following programs: $34.3 billion for Medicare Fee-for-Service (FFS); $13.6 million for Medicare Advantage; and $22.5 billion (the estimated federal share) for Medicaid. [3] See appendix III of GAO's audit report included in the fiscal year 2010 Financial Report of the United States Government accessible at [hyperlink, http://www.fms.treas.gov/fr/index.html]. [4] Pub. L. No. 104-191, § 201, 110 Stat. 1936, 1992 (Aug. 21, 1996). [5] The HI trust fund was established on July 30, 1965, as a separate account in the U.S. Department of the Treasury. It is also known as the Medicare Trust Fund. The HI trust fund finances the Medicare Part A program, which helps pay for hospital, home health, skilled nursing facility, and hospice care for the aged and disabled. All of the HI financial operations are handled through this fund, including the revenues and expenditures related to the HCFAC program as authorized by HIPAA and other funding streams such as payroll taxes transferred to the HI trust fund and net benefit payments. [6] GAO, Health Care Fraud and Abuse Control Program: Results of Review of Annual Reports for Fiscal Years 2002 and 2003, GAO-05-134 (Washington, D.C.: Apr. 29, 2005). [7] HHS and DOJ, The Department of Health and Human Services and the Department of Justice Health Care Fraud and Abuse Control Program Annual Report For FY 2008 (Washington, D.C.: September 2009); and The Department of Health and Human Services and the Department of Justice Health Care Fraud and Abuse Control Program Annual Report For FY 2009 (Washington, D.C.: May 2010). [8] GAO, Internal Control: Standards for Internal Control in the Federal Government, [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1] (Washington, D.C.: November 1999). [9] See 18 U.S.C. §§ 24(a), 1341. [10] There are 94 offices throughout the United States, Puerto Rico, the Virgin Islands, Guam, and the Northern Mariana Islands. [11] The United States District Courts, which operate under the Judicial Branch, and DOJ's United States Attorneys Office (USAO), which operate under the Executive Branch, have different responsibilities for the management of criminal debt. The collection and management of criminal debt require the cooperation of both branches of government. USAOs are statutorily responsible for the enforcement of the collection of criminal debt, while the District Courts receive payments of fines. [12] The Executive Office for the United States Attorneys provides general executive assistance and supervision to the USAOs, among other functions. [13] See, e.g., 42 U.S.C. §§ 1320a-7a, 1395i-3, & 1396r(h). [14] 18 U.S.C. § 982(a)(7). [15] We did not independently assess whether the reported zero deposit amounts for asset forfeiture in the annual HCFAC reports for fiscal years 2008 and 2009 were accurate. [16] These suits can also be brought by private individuals, called relators, under the False Claims Act, 31 U.S.C. §§ 3729-33. Relators can be entitled to a portion of any court award or settlement, and this relator's share is not included in the amount credited to the HI trust fund. [17] Pub. L. No. 107-273, § 11013, 116 Stat. 1758, 1823 (Nov. 2, 2002). [18] Medicare Parts A and B are also known as Medicare fee-for-service (FFS). Medicare Part A covers hospital and other inpatient stays and Medicare Part B covers hospital outpatient, physician, and other services. The Federal Supplementary Medical Insurance (SMI) Trust Fund finances the Medicare Part B program. [19] In general, restitutions restore the aggrieved party to its prior state of well-being while compensatory damages reimburse the aggrieved party for losses incurred. [20] Collections such as these that represent a refund of erroneous expenditures are credited back to the appropriation that was originally charged for those expenditures. See, e.g., B-281064 (Feb. 14, 2000). [21] HHS and DOJ may also conduct other health care fraud enforcement activities using other annual appropriations. [22] An allotment is an authorization by either the agency head or another authorized employee to his/her subordinates to incur obligations within a specified amount. Each agency makes allotments pursuant to specific procedures it establishes in accordance with the Office of Management and Budget (OMB) general apportionment requirements. See OMB Circular No. A-11, Preparation, Submission, and Execution of the Budget, Part 4 (November 2010). [23] The IPAC System's primary purpose is to provide a standardized interagency fund transfer mechanism for federal agencies. IPAC facilitates the intra-governmental transfer of funds, with descriptive data from one federal agency to another. [24] Mandatory funding refers to budgetary resources that are controlled by laws other than appropriations acts. [25] Discretionary funding refers to budgetary resources that are provided in annual appropriation acts, other than those that fund mandatory programs. Discretionary funds appropriated to the HCFAC account were transferred from the HI and SMI trust funds. Omnibus Appropriations Act, 2009, Pub. L. No. 111-8, 123 Stat. 524, 773 (Mar. 11, 2009). [26] Pub. L. No. 109-432, div. b, § 303, 120 Stat. 2922, 2992 (Dec. 20, 2006). In fiscal year 2010, the Patient Protection and Affordable Care Act extended permanently the yearly increases to the HCFAC account based on the change in the CPI-U. [27] Pub. L. No. 111-148, § 6402(i), 124 Stat. 119, 760 (Mar. 23, 2010). [28] Pub. L. No. 111-152, § 1303(a), 124 Stat. 1029, 1057 (Mar. 30, 2010). [29] [hyperlink, http://www.gao.gov/products/GAO-05-134]. [30] In our 2005 report, we made a total of three recommendations. One of the three recommendations included two parts, which for purposes of this report, we identify as two separate recommendations, making a total of four. [31] The sample selections were not designed to be representative of the universe of HCFAC transactions, but rather to provide anecdotal information. For this purpose, we selected a total nongeneralizable sample of 102 HCFAC deposits for fiscal years 2008 and 2009 and a total nongeneralizable sample of 125 HCFAC expenditures for fiscal years 2008 and 2009. For additional information about our sampling methodology, see appendix II. [32] Policies and procedures reviewed for HHS included OIG and the Office of the General Counsel records management plans, and the Administration on Aging's retention policy for the Office of Budget and Finance. CMS policies and procedures reviewed included: CMS Records Schedule, General Records Schedule 6: Accountable Officers' Accounts Records, and policies for purging files issued by the Office of Strategic Operations and Regulatory Affairs. [33] DOJ policies and procedures reviewed included: USAP 3-11.310.001 Internal Controls for Processing Payments Received for Civil Debts and Criminal Impositions--Retention of Records and Financial Management Policies and Procedures Bulletin 00-15 Accounting for Financial Obligations Within the Offices, Boards and Divisions (OBDs). [34] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [35] HHS and DOJ transmit HCFAC collection information to the Bureau of the Public Debt, which has responsibility for administering the HI trust fund. The Bureau of the Public Debt transfers from the Treasury General Fund to the HI trust fund an amount equal to the sum of fines, penalties, and other designated monies collected from health care investigations. [36] The Office of Financial Management utilizes the ASPEN Enforcement Manager (AEM) and Financial Accounting Control System (FACS) to allocate and record payments received. AEM enables CMS regional offices to manage all tasks related to nursing home enforcement. FACS accumulates all of CMS's financial activities, both programmatic and administrative, in its general ledger. [37] Debt Collection Management Staff within the Justice Management Division is responsible for establishing policies related to federal debt collection efforts, operating the department's central intake facility for civil debt collections, and performing debt accounting operations. [38] DOJ collects payments for penalties and multiple damages from debtors and uses its financial system to record these collections. DOJ is entitled to keep 3 percent of all payments collected in its Working Capital Fund for paying the costs of processing and tracking civil and criminal debt collection litigations. [39] HIPAA does not specify how costs are to be charged against the HCFAC account. HHS and DOJ components use different processes for charging payroll costs against HCFAC funds. For example, some components within HHS and DOJ charged 100 percent of staff hours to HCFAC while others charged a percentage of total staff hours based on estimated or actual performance. To accomplish this, HHS and DOJ components calculated estimates based on prior year performance or used their workload tracking systems to monitor actual hours spent on HCFAC activities. [40] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [41] The National Archives and Records Administration regulations require each agency to develop internal policies and procedures to ensure proper maintenance of records. These regulations also indicate that agency programs must develop recordkeeping requirements that include identification of the location of the records and the staff responsible for maintaining the records. See 36 C.F.R. § 1220.34 and subpart 1222.B. [42] [hyperlink, http://www.gao.gov/products/GAO-05-134]. [43] HHS policies and procedures obtained and reviewed included the Office of Investigations Policies and Procedures Manual; collection procedures for civil monetary penalties; and policies for records management. DOJ policies and procedures obtained and reviewed included Financial Management Policies and Procedures Bulletins 08-02, 08-01, 05-15 and 00-15, and United States Attorneys Office Procedures 3- 11.120.001, 3-11.120.002, and 3-11.310.001. For both agencies, we also obtained and reviewed the different information system user manuals such as accounting systems, collection systems, and workload tracking systems. [44] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1]. [45] Fedwire is the Federal Reserve's real-time gross settlement system that enables participants to initiate large-value funds transfer that are immediate, final, and irrevocable once processed. [46] HHS components included the Office of Inspector General (OIG), Centers for Medicare & Medicaid Services (CMS), Office of the General Counsel, and Administration on Aging. DOJ components included United States Attorneys Office (USAO), Civil Division, Criminal Division, and Civil Rights Division. [End of section] GAO's Mission: The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to [hyperlink, http://www.gao.gov] and select "E-mail Updates." Order by Phone: The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s Web site, [hyperlink, http://www.gao.gov/ordering.htm]. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: E-mail: fraudnet@gao.gov: Automated answering system: (800) 424-5454 or (202) 512-7470: Congressional Relations: Ralph Dawn, Managing Director, dawnr@gao.gov: (202) 512-4400: U.S. Government Accountability Office: 441 G Street NW, Room 7125: Washington, D.C. 20548: Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov: (202) 512-4800: U.S. Government Accountability Office: 441 G Street NW, Room 7149: Washington, D.C. 20548: