Health Care Fraud and Abuse Control Program: Improvements Needed in Controls over Reporting Deposits and Expenditures
GAO-11-446
Published: May 10, 2011. Publicly Released: Jun 09, 2011.
Skip to Highlights
Highlights
To help combat fraud and abuse in health care programs, including Medicare and Medicaid, Congress enacted the Health Care Fraud and Abuse Control (HCFAC) program as part of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). HIPAA requires that the Departments of Health and Human Services (HHS) and Justice (DOJ) issue a joint annual report to Congress on amounts deposited to and appropriated from the Federal Hospital Insurance (HI) Trust Fund for the HCFAC program. In April 2005, GAO reported on the results of its review of HCFAC program activities for fiscal years 2002 and 2003 and made recommendations to HHS and DOJ. The objectives of this requested review were to assess the extent to which HHS and DOJ (1) took actions to address the recommendations made in the 2005 report and (2) designed effective controls over reporting HCFAC deposits and expenditures for fiscal years 2008 and 2009. GAO reviewed HHS and DOJ documentation; selected nongeneralizable samples; and interviewed agency officials.
Recommendations
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Department of Health and Human Services | To improve controls over the accounting and reporting of HCFAC activities, the Secretary of HHS should direct the Administrator of CMS to revise procedures for properly maintaining supporting documentation for HCFAC deposits and expenditures, to include specifying the titles of staff responsible for maintaining supporting documentation. |
The Center for Medicare and Medicaid Services (CMS) disagreed with GAO's recommendation, noting that the information it maintains is sufficient to ensure accountability and proper and consistent supporting documentation for Health Care Fraud and Abuse Control Program deposits and expenditures. However, GAO continues to believe that CMS's policies and procedures for documentation are insufficient, as they do not identify the staff responsible for maintaining documentation as required by National Archives and Records Administration regulations. In fiscal year 2015, CMS's position had not changed. As such and in consultation with GAO management, we are closing the recommendation as not implemented.
|
| Department of Health and Human Services | To improve controls over the accounting and reporting of HCFAC activities, the Secretary of HHS should direct the Administrator of CMS to develop written procedures that incorporate monitoring controls for HCFAC deposit information recorded in the departmentwide accounting system, including reconciling the deposit data in this system to the regional offices' data collection system. |
The Center for Medicaid and Medicare Services (CMS) neither agreed nor disagreed with our recommendation. In our original report, GAO found instances where CMS regional offices made adjustments to the civilian monetary penalty (CMP) amounts in their data collection systems that were not recorded in CMS's accounting system. In February 2014, CMS finalized written procedures describing CMS's revised process for ensuring that adjustments made to civil monetary penalty receivable allocations in the regional offices' system are adequately reflected in CMS's accounting system. Specifically, if the regional offices adjust the CMP in their accounting system, an e-mail notification is sent that an adjustment to the CMP amounts is needed in CMS's accounting system.
|
| Department of Health and Human Services | To improve controls over the accounting and reporting of HCFAC activities, the Secretary of HHS should direct the Assistant Secretary for Aging to revise the Administration on Aging's procedures for properly maintaining supporting documentation for HCFAC expenditures, to include specifying the titles of staff responsible for maintaining supporting documentation and the location of records. |
The Department of Health and Human Services agreed with our recommendation. Specifically, in March 2012 the Administration on Aging, now a part of the Administration for Community Living, revised its HCFAC records retention procedures to specify that the analyst assigned to the HCFAC account is responsible for maintaining supporting documentation for HCFAC expenditures and to specify the location of the electronic and hardcopy supporting documentation.
|
| Department of Health and Human Services | To improve controls over the accounting and reporting of HCFAC activities, the Secretary of HHS should direct the Assistant Secretary for Aging to develop written procedures that incorporate monitoring controls to verify that the payroll expenditures charged against HCFAC are reasonable and supported. |
The Department of Health and Human Services' (HHS) Administration on Aging (AoA), now a part of the Administration for Community Living (ACL), agreed with our recommendation and took corrective action. Specifically, ACL revised its estimation model to include specific standards for calculating the estimates of time spent by ACL regional staff on the Health Care Fraud and Abuse Control Program (HCFAC) and developed a policy--dated July, 2013--that requires ACL to continually review the results of the estimation model for reasonableness.
|
| Department of Health and Human Services | To improve controls over the accounting and reporting of HCFAC activities, the Secretary of HHS should direct the Acting General Counsel to develop written procedures that incorporate monitoring controls for the Office of the General Counsel staff hours related to HCFAC activities captured in workload tracking systems, including the reconciliation to staff hours captured in the departmentwide payroll system. |
HHS' Office of General Counsel (OGC) agreed with our recommendation. Although we received updated procedures from OGC in fiscal year 2011, these procedures did not address our finding but rather discussed the transfer of payroll expenditures to the Health Care Fraud and Abuse Control Program (HCFAC) account. As stated in our recommendation, we expect OGC to develop written procedures that incorporate monitoring controls of the reconciliation process of HCFAC hours recorded in the workload tracking system to the departmentwide payroll system. In fiscal year 2015, HHS' position had not changed and HHS requested that the recommendation be closed as not implemented. In response to HHS' request and in consultation with GAO management, we are closing this recommendation as not implemented.
|
| Department of Health and Human Services | To improve controls over the accounting and reporting of HCFAC activities, the Secretary of HHS should develop written procedures in collaboration with DOJ that incorporate monitoring controls for preparing the joint annual HCFAC report to help ensure reported amounts are accurate. |
The Department of Health and Human Services (HHS) agreed with our recommendation and took corrective action. In response to our recommendation, HHS collaborated with the Department of Justice (DOJ) to revise and strengthen the Health Care Fraud and Abuse Control Program (HCFAC) Report Completion Guide by including monitoring controls to ensure that the financial data presented to Congress in the joint annual HCFAC report is complete and accurate. In June 2011, HHS and DOJ signed a Memorandum of Understanding, effective July 1, 2011, whereby both entities agreed to use the revised HCFAC Report Completion Guide as the framework for completing the fiscal year 2011 HCFAC annual report.
|
| HHS Office of Inspector General | To improve controls over the accounting and reporting of HCFAC activities, the HHS Inspector General should develop written procedures that incorporate monitoring controls for HHS OIG staff hours related to HCFAC activities captured in workload tracking systems, including the reconciliation to staff hours captured in the departmentwide payroll system. |
The Department of Health and Human Services' (HHS) Office of Inspector General (OIG) agreed with our recommendation and took corrective action. In response to our recommendation, HHS OIG developed and implemented written procedures during the beginning of fiscal year 2013 to include monitoring controls for OIG staff hours related to Health Care Fraud and Abuse Control Program (HCFAC) activities. Specifically, the OIG's component offices, with assistance from HHS OIG's Office of Management and Policy (OMP), are now responsible for reconciling staff hours recorded in their time-keeping systems with those in the department-wide payroll system.
|
| Department of Justice | To improve controls over the accounting and reporting of HCFAC activities, the Attorney General should direct the Deputy Assistant Attorney General / Controller to revise procedures for properly maintaining supporting documentation for HCFAC deposits and expenditures, to include specifying the titles of staff responsible for maintaining supporting documentation and the location of records. |
DOJ provided supporting documentation that beginning with the production of the FY 2011 Annual Health Care Fraud and Abuse Control (HCFAC) report, the Department of Justice (DOJ) and the Department of Health and Human Services developed a joint HCFAC Report Completion Guide for compiling the annual HCFAC report. In fiscal year 2013 the HCFAC report guide was revised to require documentation on the sources of the HCFAC deposit numbers, explanations of what the data represents, the parties and entities responsible for producing the data, and where thee data can be sourced. DOJ has also saved the information internally, allowing DOJ staff to access the information whenever it is needed. The revised procedures should improve DOJ's controls over HCFAC deposits and expenditures.
|
| Department of Justice | To improve controls over the accounting and reporting of HCFAC activities, the Attorney General should direct the Deputy Assistant Attorney General / Controller to develop written procedures that incorporate monitoring controls for reconciling HCFAC deposits of the 3 percent portion of penalties and multiple damages information recorded in the departmentwide accounting system to the HI trust fund statements. |
The Department of Justice (DOJ) agreed with our recommendation and took corrective action. Prior to the report's release--and in response to our forthcoming recommendation--the Justice Management Division developed written procedures, dated April 20, 2011, to reconcile the 3 percent portion of penalties and multiple damages recorded in the department-wide accounting system to BPD's Hospital Insurance (HI) trust fund statements. The procedures establish that at the end of each quarter and fiscal year both organizations will reconcile--verbally and in writing--the amount of Health Care Fraud and Abuse Control (HCFAC) program collections transmitted to BPD and that DOJ provide BPD a memo at the end of each quarter with a summary report including both the gross and net disbursements to the HI trust fund.
|
| Department of Justice | To improve controls over the accounting and reporting of HCFAC activities, the Attorney General should direct the Deputy Assistant Attorney General / Controller to develop written procedures that incorporate monitoring controls to verify that the payroll expenditures charged against HCFAC are reasonable and supported. |
The Department of Justice (DOJ) Office of General Counsel developed guidance that requires Health Care Fraud and Abuse Control (HCFAC) program components to submit all HCFAC bills to DOJ Budget for review and clearance prior to sending the bills to DOJ Finance for processing. This allows HCFAC budget analysts to perform a secondary review of all expenses, including payroll, to ensure that they match against DOJ's Quarterly Status Report and the components' allocation memos. In addition, as part of the HCFAC allocation process, HCFAC components provide the DOJ Budget staff with estimates of the funding that is needed to support their HCFAC programs which includes full time equivalent staffing data. Once funding is allocated, each HCFAC component is required to report on its obligations on a quarterly basis. This DOJ action is responsive to GAO's recommendation and should improve DOJ's controls over HCFAC program component funding.
|
| Department of Justice | To improve controls over the accounting and reporting of HCFAC activities, the Attorney General should direct the Deputy Assistant Attorney General / Controller to develop written procedures in collaboration with HHS that incorporate monitoring controls for preparing the joint annual HCFAC report to help ensure reported amounts are accurate. |
The Department of Justice (DOJ) agreed with our recommendation and took corrective action. In response to our recommendation, DOJ collaborated with the Department of Health and Human Services (HHS) to revise and strengthen the Health Care Fraud and Abuse Control Program (HCFAC) Report Completion Guide by including monitoring controls to ensure that the financial data presented to Congress in the joint annual HCFAC report is complete and accurate. In June 2011, HHS and DOJ signed a Memorandum of Understanding, effective July 1, 2011, whereby both entities agreed to use the revised HCFAC Report Completion Guide as the framework for completing the fiscal year 2011 HCFAC annual report.
|
Full Report
GAO Contacts
Topics
AccountabilityAppropriated fundsDeposit fundsDocumentationHealth care fraudHealth care programsInternal controlsMonitoringProgram abusesProgram evaluationReporting requirementsReports managementTrust fundsFinancial reportingPolicies and procedures