Federal Bureau of Investigation
Accountability over the HIPAA Funding of Health Care Fraud Investigations Is Inadequate Gao ID: GAO-05-388 April 22, 2005The Health Insurance Portability and Accountability Act of 1996 (HIPAA) provided, among other things, funding by transfer to the Federal Bureau of Investigation (FBI) to carry out specific purposes of the Health Care Fraud and Abuse Control Program. Congress expressed concern about a shift in FBI resources from health care fraud investigations to counterterrorism activities after September 11, 2001. Congress asked GAO to review FBI's accountability for the funds transferred under HIPAA for fiscal years 2000 through 2003. GAO determined (1) whether FBI had an adequate approach for ensuring the proper use of the HIPAA transfers and (2) the extent to which FBI had expended these transferred funds on health care fraud investigations in fiscal years 2000 through 2003.
FBI used a limited approach to monitoring its use of HIPAA transfers, which might have been sufficient during times when it clearly used more agent full time equivalents (FTEs) for health care fraud investigations than budgeted but was insufficient when some of the agent FTEs previously devoted to health care fraud investigations were shifted to counterterrorism activities. FBI's budgeted FTEs (agent and other personnel) and related costs (such as rent and utilities) were equivalent to the amount of the HIPAA transfers. However, FBI's approach to monitoring the use of HIPAA transfers considered only agent FTEs, which made up about 42 percent of the budgeted health care fraud costs, but did not consider other personnel FTEs or related costs. According to FBI officials, they did not monitor these other budgeted amounts to determine compliance with HIPAA because the actual agent FTEs were historically far in excess of those budgeted. However, once FBI began to shift agent resources away from health care fraud investigations, agent FTEs charged to health care fraud investigations fell below the budgeted amounts, and FBI could no longer rely on this limited approach to ensure that the transferred HIPAA funds were properly used. Furthermore, FBI did not have a system in place to capture its overall health care fraud investigation costs, and therefore, was not in a position to determine whether or not all transferred HIPAA funds were properly expended. In response to GAO's review, FBI engaged in extensive manual efforts to develop cost estimates related to health care fraud investigations for fiscal years 2000 through 2003. The final estimate provided to GAO showed that FBI spent more on health care fraud investigations than was funded by transfers for each of the 4 years. However, GAO found that, overall, FBI's estimates of its health care fraud investigation costs were based on data that had not been or could not be fully validated. Therefore, even though FBI made a good-faith effort to estimate these costs, because of data limitations, neither GAO nor FBI could reliably determine whether all of the HIPAA transfers were spent solely for health care fraud investigations and related activities for the 4-year period. DOJ is currently planning the implementation of a new DOJ-wide UFMS, but it has yet to develop the specific systems requirements that would enable FBI to accurately capture all of its health care fraud-related costs and therefore to help monitor compliance with HIPAA and other relevant laws and regulations.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-05-388, Federal Bureau of Investigation: Accountability over the HIPAA Funding of Health Care Fraud Investigations Is Inadequate
This is the accessible text file for GAO report number GAO-05-388
entitled 'Federal Bureau of Investigation: Accountability over the
HIPAA Funding of Health Care Fraud Investigations Is Inadequate' which
was released on May 16, 2005.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Report to the Chairman, Committee on Finance, U.S. Senate:
April 2005:
Federal Bureau of Investigation:
Accountability over the HIPAA Funding of Health Care Fraud
Investigations Is Inadequate:
GAO-05-388:
GAO Highlights:
Highlights of GAO-05-388, a report to the Chairman, Committee on
Finance, U.S. Senate:
Why GAO Did This Study:
The Health Insurance Portability and Accountability Act of 1996 (HIPAA)
provided, among other things, funding by transfer to the Federal Bureau
of Investigation (FBI) to carry out specific purposes of the Health
Care Fraud and Abuse Control Program. The Committee expressed concern
about a shift in FBI resources from health care fraud investigations to
counterterrorism activities after September 11, 2001. The Committee
asked GAO to review FBI‘s accountability for the funds transferred
under HIPAA for fiscal years 2000 through 2003. GAO determined (1)
whether FBI had an adequate approach for ensuring the proper use of the
HIPAA transfers and (2) the extent to which FBI had expended these
transferred funds on health care fraud investigations in fiscal years
2000 through 2003.
What GAO Found:
FBI used a limited approach to monitoring its use of HIPAA transfers,
which might have been sufficient during times when it clearly used more
agent full time equivalents (FTEs) for health care fraud investigations
than budgeted but was insufficient when some of the agent FTEs
previously devoted to health care fraud investigations were shifted to
counterterrorism activities. FBI‘s budgeted FTEs (agent and other
personnel) and related costs (such as rent and utilities) were
equivalent to the amount of the HIPAA transfers. However, FBI‘s
approach to monitoring the use of HIPAA transfers considered only agent
FTEs, which made up about 42 percent of the budgeted health care fraud
costs, but did not consider other personnel FTEs or related costs.
According to FBI officials, they did not monitor these other budgeted
amounts to determine compliance with HIPAA because the actual agent
FTEs were historically far in excess of those budgeted. However, once
FBI began to shift agent resources away from health care fraud
investigations, agent FTEs charged to health care fraud investigations
fell below the budgeted amounts, and FBI could no longer rely on this
limited approach to ensure that the transferred HIPAA funds were
properly used. Furthermore, FBI did not have a system in place to
capture its overall health care fraud investigation costs, and
therefore, was not in a position to determine whether or not all
transferred HIPAA funds were properly expended.
In response to GAO‘s review, FBI engaged in extensive manual efforts to
develop cost estimates related to health care fraud investigations for
fiscal years 2000 through 2003. The final estimate provided to GAO
showed that FBI spent more on health care fraud investigations than was
funded by transfers for each of the 4 years. However, GAO found that,
overall, FBI‘s estimates of its health care fraud investigation costs
were based on data that had not been or could not be fully validated.
Therefore, even though FBI made a good-faith effort to estimate these
costs, because of data limitations, neither GAO nor FBI could reliably
determine whether all of the HIPAA transfers were spent solely for
health care fraud investigations and related activities for the 4-year
period. DOJ is currently planning the implementation of a new DOJ-wide
UFMS, but it has yet to develop the specific systems requirements that
would enable FBI to accurately capture all of its health care fraud-
related costs and therefore to help monitor compliance with HIPAA and
other relevant laws and regulations.
What GAO Recommends:
To enhance accountability for the HIPAA transfers and the costs related
to health care fraud investigations, GAO recommends that the FBI
Director augment the cost-tracking capabilities of the new Unified
Financial Management System (UFMS) and, in the interim, establish
formal policies and procedures to report and adequately support the
costs of health care fraud investigations and validate the underlying
data used. The Department of Justice (DOJ) and FBI agreed with these
recommendations and indicated that FBI has already taken action to
implement them.
www.gao.gov/cgi-bin/getrpt?GAO-05-388.
To view the full product, including the scope and methodology, click on
the link above. For more information, contact Linda Calbom at (202) 512-
9508 or calboml@gao.gov.
[End of section]
Contents:
Letter:
Results in Brief:
Background:
FBI's Monitoring Approach for HIPAA Transfers Provided Little Assurance
of Transfers' Proper Use:
FBI's Cost Estimates of Health Care Fraud Investigations Were Not
Adequately Supported:
Conclusions:
Recommendations for Executive Action:
Agency Comments and Our Evaluation:
Appendixes:
Appendix I: Scope and Methodology:
Appendix II: Comments from the Department of Justice and the Federal
Bureau of Investigation:
Appendix III: GAO Contacts and Staff Acknowledgments:
Abbreviations:
DOJ: Department of Justice:
FBI: Federal Bureau of Investigation:
FMS: Financial Management System:
FTE: full time equivalent:
GAO: Government Accountability Office:
HCFU: Health Care Fraud Unit:
HHS: Department of Health and Human Services:
HIPAA: Health Insurance Portability and Accountability Act:
NFC: National Finance Center:
S&E: Salaries and Expenses:
TURK: Time Utilization and Record Keeping:
UFMS: Unified Financial Management System:
Letter April 22, 2005:
The Honorable Charles E. Grassley:
Chairman:
Committee on Finance:
United States Senate:
Dear Mr. Chairman:
In 1996 the Congress passed the Health Insurance Portability and
Accountability Act (HIPAA) to, among other things, provide funding
through transfers to the Federal Bureau of Investigation (FBI) to carry
out specific purposes of the Health Care Fraud and Abuse Control
Program.[Footnote 1] In response to a request from you, the Department
of Justice (DOJ) notified the Committee in October 2003 that after the
terrorist attacks of September 11, 2001, and as a result of FBI's
reprioritization of investigations, FBI shifted some agent resources
from health care fraud investigations to counterterrorism matters.
FBI's notification was based on reports from its time utilization
system showing that fewer full time equivalents (FTEs) representing
agents had been used for health care fraud investigations than had been
budgeted for fiscal years 2002 and 2003.[Footnote 2]
The Committee expressed concern that this shift in agent resources
might have resulted in FBI's not spending dedicated health care fraud
investigation funds in accordance with HIPAA. You asked us to review
FBI's accountability for the HIPAA transfers for fiscal years 2000
through 2003. We determined (1) whether FBI had an adequate approach
for ensuring the proper use of the HIPAA transfers and (2) the extent
to which FBI expended these transferred funds on health care fraud
investigations in fiscal years 2000 through 2003.
To address these objectives, we compared the design of FBI's existing
financial internal controls and processes related to the HIPAA
transfers and the administration of the funds on health care fraud
investigations with our Standards for Internal Control in the Federal
Government.[Footnote 3] We also evaluated schedules of health care
fraud cost estimates prepared by FBI. We performed our work in
accordance with generally accepted government auditing standards from
February 2004 to January 2005. Our scope and methodology are discussed
in greater detail in appendix I. We requested comments on a draft of
this report from the Director of FBI or his designee. The joint letter
with comments from DOJ and FBI is reprinted in appendix II.
Results in Brief:
FBI used a limited approach to monitor its use of HIPAA transfers,
which might have been sufficient when it clearly used more agent FTEs
for health care fraud investigations than budgeted but was insufficient
when some agent FTEs previously devoted to health care fraud
investigations were shifted to counterterrorism activities. As annually
budgeted, FBI committed FTEs (agents and other personnel) and assigned
related costs (such as rent and utilities) equivalent to the amount of
the HIPAA transfers. However, FBI's approach to monitoring the use of
HIPAA transfers considered only agent FTEs, which made up about 42
percent of budgeted health care fraud costs but did not consider other
personnel and related costs that contributed to the health care fraud
investigations.[Footnote 4] FBI officials told us they did not monitor
these other budgeted amounts in determining compliance with HIPAA
because the actual agent FTEs were historically far in excess of those
budgeted. However, once FBI began to shift agent resources away from
health care fraud investigations, the agent FTEs charged to health care
fraud investigations fell below the budgeted amounts, and FBI could no
longer reasonably rely on this limited approach to assure the proper
use of the HIPAA transfers. At the time of our review, FBI's Financial
Management System was not capable of tracking the overall costs of its
health care fraud investigations, and therefore, FBI was not in a
position to determine whether or not all transferred funds were spent
for the purpose provided. DOJ is currently planning to implement a new
DOJ-wide Unified Financial Management System (UFMS) but has yet to
develop the specific systems requirements that would enable FBI to
accurately capture all of its health care fraud-related costs and
therefore to help monitor compliance with HIPAA and other relevant laws
and regulations.
In response to our review, FBI engaged in extensive manual efforts to
estimate its costs related to health care fraud investigations for
fiscal years 2000 through 2003. The original estimates, based on the
type of costs budgeted, showed that FBI spent more on its health care
fraud investigations than was funded by the transfers for fiscal years
2000 and 2001 but less than was funded by transfers for fiscal years
2002 and 2003. A subsequent FBI estimate adding additional appropriate
indirect costs such as training and forensic laboratory services showed
that FBI spent more on health care fraud investigations than was funded
by transfers for each of the 4 years. All of the components of these
estimates, however, were based on data that had not been or could not
be fully validated. For example, data in FBI's agent time utilization
system, which is the primary element of agent costs and a key basis for
all other costs, has never been properly tested or validated. Because
of the data limitations, neither we nor the FBI could reliably
determine whether all of the HIPAA transfers were used solely for
health care fraud investigations and related activities for the 4-year
period.
We are making four recommendations to enhance FBI's accountability over
the HIPAA transfers and the cost of its health care fraud
investigations. In the long term, we recommend that FBI augment the
cost-tracking capabilities of the new UFMS for both payroll and other
costs. In the interim, we recommend that FBI establish formal policies
and procedures that would specify how costs are to be reported and
adequately supported and take steps to assure the reliability of the
underlying data. FBI's Chief Financial Officer stated that DOJ and FBI
agreed with our four recommendations and that FBI has already begun
actions devoted to ensuring that its execution of HIPAA fully meets
Congress's intent.
Background:
The Health Insurance Portability and Accountability Act of 1996 amended
the Social Security Act (the act) to, among other things, (1) establish
a Health Care Fraud and Abuse Control Program[Footnote 5] and (2)
establish an expenditure account, designated as the Health Care Fraud
and Abuse Control Account (Account) within the Federal Hospital
Insurance Trust Fund (Trust Fund).[Footnote 6] The Account is
administered by Department of Health and Human Services' (HHS) Office
of Inspector General and DOJ. The amendment also makes appropriations
for the Account from the general fund of the U.S. Treasury. The
appropriations are in specified amounts for each fiscal year beginning
with fiscal year 1997 for transfer to FBI to carry out its health care
fraud investigations.[Footnote 7]
In 1997 HHS and FBI entered into an interagency agreement to facilitate
the required annual transfer of funds from the Account to FBI solely
for its health care fraud investigations. FBI receives the transferred
funds and records the funds in its Salaries and Expenses (S&E)
appropriation account at the beginning of each fiscal year. FBI then
incurs obligations for health care fraud investigations and makes
payments from the S&E account, which is also used to make payments for
other FBI mission-related and support activities. The amounts that were
transferred to FBI as required by the act for the years of our review
were as follows:
* fiscal year 2000: $76 million,
* fiscal year 2001: $88 million,
* fiscal year 2002: $101 million, and:
* fiscal year 2003: $114 million (and each subsequent year).
The amendment requires that these funds be used solely to cover the
costs (including equipment, salaries and benefits, and travel and
training) of the administration and operation of the health care fraud
and abuse control program, including the costs of prosecuting health
care matters, investigations, financial and performance audits of
health care programs, and inspections and other evaluations. These
health care fraud investigations are managed nationally by FBI's Health
Care Fraud Unit (HCFU), which was created in 1992 within the Financial
Crimes Section of the FBI's Criminal Investigative Division. Health
care fraud investigations include those for fraud against government
programs and private insurance, as well as medical privacy law
violations. HCFU is responsible for health care fraud investigations
that are conducted by FBI's field offices and, for management and
reporting purposes, both HCFU and the related field investigations are
considered a part of its White Collar Crime decision unit.
FBI's Monitoring Approach for HIPAA Transfers Provided Little Assurance
of Transfers' Proper Use:
FBI used a limited approach to monitoring its use of HIPAA transfers,
which might have been sufficient when it clearly used more agent FTEs
for health care fraud investigations than it had budgeted. But this
approach was insufficient when some of the agent FTEs previously
devoted to health care fraud investigations were shifted to
counterterrorism activities, causing actual FTEs to fall below budgeted
FTEs. At the time of our review, FBI's Financial Management System
(FMS) was unable to track overall costs related to health care fraud
investigations. As a result, FBI had minimal assurance that all of the
transferred HIPAA funds were properly spent. DOJ is currently planning
to implement the new DOJ-wide Unified Financial Management System, but
it has yet to develop the specific systems requirements to enable it to
accurately capture all of the costs of its health care fraud
investigations and therefore to help monitor compliance with HIPAA and
other relevant laws and regulations.
FBI's budget for health care fraud investigations was equivalent to the
amount of the HIPAA transfers and included only the direct program
costs. These direct costs consisted of payroll and benefits for agents
and certain other personnel involved in health care fraud
investigations,[Footnote 8] plus related costs such as rent and
supplies. FBI used an approach to monitoring the use of HIPAA transfers
that considered agent FTEs only without considering the other direct
program costs. For the 4 years we reviewed, the agent FTEs represented
about 42 percent of the budgeted amounts for work on health care fraud
investigations, while the other direct program costs represented about
58 percent of the budgeted amounts. FBI obtained agent FTEs from
reports generated by its time utilization system, which records the
percentage of time that agents worked on each investigative
classification and, if applicable, major cases. FBI officials told us
that prior to September 11, 2001, reported agent FTEs charged to the
health care fraud investigations were historically far in excess of
those budgeted and they were satisfied that the resources expended on
health care fraud investigations exceeded the HIPPA transfers.[Footnote
9] For example, in fiscal year 2000, FBI reported that health care
fraud agent FTEs exceeded the number budgeted that year by about 19
percent.
However, this limited approach to monitoring the use of the HIPAA
transfers was insufficient when agent FTEs were shifted to
counterterrorism activities after September 11, 2001, because it lacked
the specificity of cost information for both direct and indirect
costs.[Footnote 10] Furthermore, FBI's FMS was not capable of providing
this specific cost information. Therefore, in years when reported agent
FTEs were close to or below budgeted FTE amounts, FBI had no effective
mechanism in place to monitor compliance with HIPAA. This was the case
when reported agent FTEs approximated the budgeted amounts in fiscal
year 2001 and fell below budgeted FTEs in fiscal years 2002 and 2003 by
31 percent and 26 percent, respectively.
Reliable information on the costs of federal programs and activities is
crucial for the effective management of government operations and
assists internal and external users in assessing the budget integrity,
operating performance, stewardship, and systems and control of program
activities. In this regard, the Chief Financial Officers Act of 1990
expressly calls on agencies to provide for the systematic measurement
of performance and the development of cost information.[Footnote 11] In
addition, "Statement of Federal Financial Accounting Standards Number
4" established for all federal agencies cost accounting concepts and
standards aimed at providing reliable and timely information on the
full cost of federal programs, their activities, and outputs.[Footnote
12] Cost information for program activities is especially crucial in
order to properly manage and account for funds that have been
appropriated, or in this case, transferred for certain authorized
purposes.
FBI's FMS has minimal capability to track health care fraud
investigation and other specific program costs necessary to meet
federal guidance. FMS tracks costs by cost center, of which only
headquarters costs are separately identifiable by program.[Footnote 13]
However, substantially all of the direct costs for health care fraud
investigations are incurred at the individual field offices, each of
which is considered separate cost centers. The specific program costs
within each field location, therefore, are not individually tracked or
separately identifiable. As a result, FBI cannot use FMS to track and
report all health care fraud investigation costs.
DOJ is currently in the process of implementing a new financial
management system. The new UFMS is likely to have the capability to
capture nonpersonnel costs on a program or subprogram basis, if design
specifications are set to do so. However, according to FBI finance
officials, specifications have not been set up for UFMS to capture
total payroll costs at the program level. These costs amounted to about
55 percent of the budgeted health care fraud investigation costs. Under
UFMS as currently planned, payroll costs are to be processed by the
U.S. Department of Agriculture's National Finance Center (NFC)[Footnote
14] starting in 2006 and recorded at the summary level. As a result,
they will be combined with the payroll costs of other programs and will
not be separately identifiable.
NFC officials told us that they recommend that all customers receive
summary and detailed-level data. NFC uses a 27-digit accounting code,
of which 24 digits are available to agencies to establish an account
structure for detailed payroll information such as program, subprogram,
and job code levels. NFC officials also stated that they met informally
with FBI personnel and explained how the accounting codes could be used
to support FBI's needs. An FBI official told us that because of
security concerns, FBI would have to give consideration to using such
codes. The absence of accounting codes for programs and subprograms or
other control mechanisms for monitoring payroll and other costs will
continue to impede FBI's ability to assess compliance with HIPAA and
other relevant laws and regulations.
FBI's Cost Estimates of Health Care Fraud Investigations Were Not
Adequately Supported:
In the absence of system-generated program costs and upon our request
for cost schedules, FBI began developing an estimate of its health care
fraud investigation costs incurred for fiscal years 2000 through 2003
in an attempt to determine the propriety of its use of the HIPAA
transfers. FBI engaged in extensive manual efforts and developed cost
estimates that, in their final form, appropriately considered both
direct program costs and the portion of indirect, FBI-wide support unit
costs that related to the health care fraud program. However, we found
that the estimates were either directly or indirectly based on data
from FBI's time utilization system, which had not been properly
validated, and various other data that were not adequately supported.
As a result, despite a good-faith effort by FBI to estimate these
costs, neither we nor FBI could reliably determine whether the HIPAA
transfers were spent solely on health care fraud investigations for the
4-year period.
FBI officials told us at the start of our review that they were unable
to provide us with a report of actual costs and had not previously
estimated the costs associated with the transfers for fiscal years 2000
through 2003 primarily because of the financial systems' weaknesses
that we previously discussed. As an alternative, they proposed to
provide us with an estimate of health care fraud investigation costs
and subsequently developed an estimation methodology. Because cost
estimates for this program had never before been attempted, FBI tried
different approaches and revised the estimates several times during our
review. The first three estimates for the 4-year period were revised to
reflect slight changes in the methodology and to correct an error in
the estimates but were quite similar to each other in method and in
results. In essence, FBI estimated the direct costs for each budgeted
line item of the health care fraud program. These were categorized into
four groups: (1) headquarters payroll and benefits; (2) agent payroll
and benefits; (3) other field personnel's payroll and benefits; and (4)
related nonpersonnel costs such as utilities, equipment, and supplies.
The method for estimating each group is as follows:
* Headquarters payroll and benefits, as previously discussed, were
predominantly tracked in FMS.
* The agent payroll and benefits costs, accounting for approximately 46
percent of FBI's estimated program costs for the 4 years,[Footnote 15]
were estimated directly on the basis of agent FTEs reported in FBI's
Time Utilization and Record Keeping (TURK) system and average FBI-wide
salaries and benefits for General Schedule 10-13 field agents.
* The other field personnel's payroll and benefits, which represented
about 29 percent of FBI's estimated program costs for the 4
years,[Footnote 16] were estimated from a combination of sources,
including investigative support staff FTEs from its TURK system, that
were summarized in two manual spreadsheets. The spreadsheets were
prepared by two staff members, one of whom no longer works at FBI. The
methodology for this staff member's spreadsheet is uncertain, and the
results could not be verified.
* FBI's related nonpersonnel cost estimates were generally
proportionate to the budgeted amount on the basis of a ratio of
budgeted FTEs versus the FTEs reported in the TURK system. For example,
for fiscal year 2003, the nonpersonnel costs line-item amounts were
estimated at about 79 percent of the budgeted amount, since only 664
total FTEs were reportedly charged to health care fraud investigations,
while a total of 844 FTEs were budgeted.[Footnote 17] However, the
budgeted and estimated amounts for these costs were not subsequently
compared with actual costs for any of the years presented in order to
verify the reasonableness of the amounts.
We determined that the primary source data used either directly or
indirectly to estimate the health care fraud costs, as reported from
the TURK system, had not been properly tested to determine the reliance
that could be placed on the information. Prior to fiscal year 2002, the
work time percentages and related investigative classification
information in the TURK system, which has been operational in its
current form since 1991 and is used by FBI for a variety of budgetary
and program management decision making, had never been properly
validated. We found that for fiscal years 2002 and 2003, FBI conducted
limited internal testing, including tests on whether the work hours
recorded in the system were correctly charged to the appropriate
investigative case. The tests were performed at all of the field office
locations and produced error rates that varied from year to year and
across field locations but were not conducted on statistically valid
samples. Therefore, the results cannot be applied to the population
beyond the specific items tested. Nonetheless, the identified errors
raise questions about the reliability of the data in TURK and
demonstrate the need for additional data validation work by FBI. In
addition, a key financial official indicated that at least one of the
tests might not have been properly designed to validate the data.
In addition to the lack of validation of the TURK data, certain other
supporting documentation could not be verified or was not adequate.
Examples include the following:
* The health care fraud equipment account, approximately 5 percent of
budgeted amounts for the 4 years, funded purchases other than equipment
such as travel and training expenses and was used much like a
discretionary account. FBI officials told us that at year's end, these
nonequipment costs were adjusted by moving them out of the equipment
account and into the appropriate line item on the basis of the amounts
recorded in a detailed listing of purchases prepared by HCFU. We were
unable to reconcile the amount of purchases recorded in the detailed
equipment listings or the amount of interaccount adjustments to the FBI
cost estimates, and no such reconciliation was provided by FBI. The
amount of interaccount adjustments ranged from $424,000 to $7.5 million
a year for the 4 years under review.
* FBI used average salaries of support personnel at year's end that
might not have accurately represented the mix of salaries of the staff
supporting health care fraud investigations whose duties ranged from
administrative to professional (e.g., medical experts).
* FBI surveyed field office managers in an effort to capture other FTEs
that were related to health care fraud investigations. Field managers
estimated the portion of hours or FTEs spent investigating health care
fraud cases that were recorded in TURK under other investigative
classifications. For example, a case dealing with an Internet pharmacy
that was investigated by a Cyber Crimes squad could be considered a
health care fraud investigation and included in the estimate of health
care fraud costs. These other agent FTEs are difficult to verify and,
in some cases, were reported from memory.
On average, the first three FBI cost estimates showed that FBI spent
$33 million more on health care fraud investigations than the amount of
the HIPAA transfers for fiscal years 2000 and 2001 and about $29
million less than the HIPAA transfers for fiscal years 2002 and 2003.
When we were provided with these cost estimates, FBI officials stated
that this shift in resources away from health care fraud investigations
in the latter 2 years was a result of the increase in the
counterterrorism investigative activity after the September 11 attacks.
FBI management prepared a fourth and final cost estimate that included
an allocation of the additional costs of other FBI units, such as
forensic laboratory services and mandatory training that support
various FBI programs, including the health care fraud program. While it
is generally appropriate to include such indirect costs when
determining total program costs, these additional costs were not
previously considered when budgeting the funds transferred by the
Congress to FBI for its health care fraud investigations.[Footnote 18]
Furthermore, these additional items were not included in DOJ's October
2003 response to the Senate Finance Committee regarding FBI's use of
the HIPAA transfers.
FBI estimated the portion of costs for each of the six support units--
training, forensics, information management, technical field support,
criminal justice services, and management and administration--that
related to health care fraud investigations and added them to the
estimates of direct costs previously provided to us in the third
version. While FBI put forth a good-faith effort to devise a way to
allocate the indirect support unit costs to health care fraud
investigations, its methodology relied, in part, on layers of
unvalidated data. For example, FBI allocated FBI-wide support unit
costs as reported in its audited financial statements first to the DOJ
Strategic Goal that included health care fraud investigations.[Footnote
19] The percentages used in this calculation were the same used to
allocate costs for FBI's Statement of Net Cost; however, FBI's auditors
said they did not validate the methodology or documentation supporting
the allocation percentages. After FBI allocated the specific support
unit costs to the DOJ Strategic Goals, FBI allocated those costs to
health care fraud investigations using FTE data based primarily on
TURK, which, as previously discussed, has not been validated.
On average, the additional indirect costs represented approximately $34
million, or 27 percent of total health care fraud costs per year. With
the addition of these indirect costs, FBI ultimately estimated that it
spent more on health care fraud investigations than was funded by the
HIPAA transfers for all 4 years. However, with the magnitude of
unverified and inadequately supported data, neither we nor FBI could
reliably determine whether the HIPAA transfers were spent solely on
health care fraud investigations for the 4-year period.
Conclusions:
FBI's monitoring approach for determining the proper use of HIPAA
funding was limited and did not provide the level of assurance needed
when agent FTEs devoted to health care fraud investigations were close
to or below budgeted amounts. Absent a financial management system that
could capture the costs of its health care fraud investigations, FBI
had to resort to extensive manual efforts to estimate the costs but did
not have the data needed to do so reliably. Until FBI improves its data
reliability and either develops a financial management system capable
of tracking and reporting health care fraud investigation cost
information or some other effective monitoring approach, it will
continue to lack sufficient accountability over the use of the HIPAA
transfers. Inadequate accountability hinders efforts to budget, manage,
and account for program funds appropriately and will leave FBI at an
increased risk of violating HIPAA and other laws.
Recommendations for Executive Action:
We are making four total recommendations--two enhancing FBI's
accountability over the HIPAA transfers and the costs related to health
care fraud investigations in the short term and two augmenting the new
Unified Financial Management System's cost-tracking capabilities in the
long term. We recommend that the Director of the FBI take the following
actions:
* Develop formal, interim policies and procedures for reporting health
care fraud investigation costs that specify (1) the costs to be
estimated and/or allocated, (2) the supporting documentation to be
maintained, and (3) the method to validate those data used.
* Periodically conduct statistically valid testing of the data in the
Time Utilization and Record Keeping system, in particular, the work
time percentages and related investigative classification information
to ensure the TURK system's reliability. In addition, require field
office managers to follow up on any issues identified in the testing.
* Either specify that the UFMS have the capability to allocate payroll
costs provided by the NFC payroll system to specific programs or
develop cost accounting codes at the program and subprogram levels to
enable NFC to provide the necessary detailed payroll reports.
* Ensure that the UFMS has the capability and design specifications to
track nonpersonnel costs related to health care fraud investigations.
Agency Comments and Our Evaluation:
In a joint letter with written comments on a draft of this report
(reprinted in appendix II), DOJ and FBI agreed with the four
recommendations in this report and said they have begun to address the
two short-term recommendations. Specifically, FBI is expecting to
complete reviews of its procedures used to track health care fraud
investigation costs and the collection and validation procedures for
data entered into the TURK system by May 31, 2005. Concerning the long-
term solution through financial management system enhancements, FBI
acknowledged the need to establish control mechanisms to monitor both
personnel and nonpersonnel costs related to health care fraud
investigations to ensure the transparent allocation of FBI resources
while maintaining appropriate levels of security. FBI notes that health
care fraud investigations funded by HIPAA have contributed to a number
of significant, high-profile case accomplishments as a result of the
FBI's dedication of HIPAA resources. FBI and DOJ officials provided
oral comments on technical matters, which we have incorporated as
appropriate.
As agreed with your office, unless you publicly announce its contents
earlier, we plan no further distribution of this report until 30 days
from its issue date. At that time, we will send copies of this report
to the Ranking Minority Member, Senate Committee on Finance; the
Attorney General of the United States; the Director, FBI; the Director,
Office of Management and Budget; and other interested parties. We will
make copies available to others upon request. In addition, the report
will be available at no charge on the GAO Web site at [Hyperlink,
http://www.gao.gov].
Should you or your staff have any questions on the matters discussed in
this report, please contact me on (202) 512-9508 or by e-mail at
[Hyperlink, calboml@gao.gov] or contact Steven R. Haughton, Assistant
Director, at (202) 512-5999 or [Hyperlink, haughtons@gao.gov]. Major
contributors to this report are included in appendix III.
Sincerely yours,
Signed by:
Linda M. Calbom:
Director, Financial Management and Assurance:
[End of section]
Appendixes:
Appendix I: Scope and Methodology:
We reviewed the internal controls related to the use of the Health
Insurance Portability and Accountability Act (HIPAA) transfers and the
cost estimates of health care fraud investigations for fiscal years
2000 through 2003.
We requested available documentation of the policies, procedures, and
guidelines relating to the HIPAA transfers and the health care fraud
program. We conducted interviews with Federal Bureau of Investigation
(FBI) officials to obtain an understanding of the internal controls,
including fund controls, in place over transferred funds. We reviewed
the sufficiency of those internal controls in light of GAO's Standards
for Internal Control in the Federal Government.
Because of the inability of FBI's existing Financial Management System
to produce program-level cost information as described in this report,
FBI developed an estimate of the costs of health care fraud
investigations. FBI provided us with a schedule of cost estimates for
its health care fraud investigations for each of the 4 fiscal years, a
description of the cost-estimation methodology, and various
documentation that supported some of the headquarters and field office
costs. During the course of our work, FBI modified its original
schedule of cost estimates twice because of slight changes to the cost-
estimation methodology. For all three schedules of costs, we evaluated
the overall method of cost estimation to determine the method's
reasonableness and ability to assure that applicable laws and
regulations were followed. Additionally, we (1) identified the sources
of information used in the methodology; (2) verified, where possible,
the underlying data flow and formulas; and (3) compared the cost
estimates with the amount of funds transferred to FBI for each of the 4
years. FBI provided us with a fourth and final schedule of cost
estimates on January 5, 2005, which included allocations of FBI-wide
administrative and support costs not originally considered part of
health care fraud costs. We requested supporting documentation for
these additional allocations and reviewed the limited documentation
that was available.
FBI's cost-estimation methodology was based significantly on
information derived from the Time Utilization and Record Keeping
system. We were unable to rely on this system's data for the purpose of
our review because the data for fiscal years 2000 and 2001 had not been
validated and a limited internal review reported varying error rates
for the data for fiscal years 2002 and 2003. The internal review,
however, was not statistically valid. We did not attempt to
independently validate the system.
We performed our work from February 2004 through January 2005 in
accordance with generally accepted government auditing standards. We
requested written comments on this report from the Director of the FBI
or his designee. A joint letter with comments from DOJ and FBI was
received and is reprinted in appendix II.
[End of section]
Appendix II: Comments from the Department of Justice and the Federal
Bureau of Investigation:
U.S. Department of Justice:
Federal Bureau of Investigation:
Washington, D. C. 20535-0001:
April 13, 2005:
Ms. Linda M. Calbom:
Director, Financial Management and Assurance:
United States Government Accountability Office:
Washington, DC 20548:
Re: GAO-05-388:
Dear Ms. Calbom,
Thank you for the opportunity to review the Government Accountability
Office (GAO) draft report entitled "Federal Bureau of Investigation:
Accountability over HIPAA Funding of Health Care Fraud Investigations
is Inadequate." The draft report has been reviewed by various
components of the Department of Justice (DOJ), including the FBI's
Finance Division. This letter constitutes the formal Department of
Justice comments to the draft report and it is requested that it be
included in the GAO's final report.
The FBI is devoted to ensuring that its execution of the Health
Insurance Portability and Accountability Act of 1996 (HIPAA) fully
meets the intent of the Congress. Since the FBI first started receiving
HIPAA resources in Fiscal Year (FY) 1997, the FBI has made health care
fraud investigations one of its top white collar criminal investigative
priorities. In communications to FBI field offices, program managers at
FBI Headquarters have made it very clear that the Bureau's HIPAA-funded
resources are to be dedicated as the Congress intended. As a direct
result, the FBI's investigations into health care fraud have yielded a
significant return on the public's investment through the HIPAA.
FBI health care fraud investigations funded by the HIPAA have
contributed to a number of significant, high-profile case
accomplishments, including, but not limited to, the following:
-In 2003, the federal government resolved its litigation against the
nation's largest for-profit hospital company, HCA (formerly known as
Columbia/HCA). After an investigation that was a model of cooperation
among federal and state investigative authorities, HCA paid the United
States $631 million to resolve liability for false claims resulting
from a variety of allegedly unlawful practices, including cost report
fraud and the payment of kickbacks to physicians. Previously, in 2000,
HCA subsidiaries pled guilty to substantial criminal conduct in
multiple districts and paid more than $840 million in criminal fines,
civil damages, and penalties. Combined with a separate administrative
settlement with the Centers for Medicare & Medicaid Services, under
which HCA paid an additional $250 million to resolve overpayment claims
arising from certain of its cost reporting practices, the government
recovered $1.7 billion from HCA, by far the largest recovery ever
reached by the government in a health care fraud investigation.
-In coordination with the Department of Health and Human Services,
Office of the Inspector General (HHS-OIG), the FBI launched the
National Initiative on Ambulance and Medical Transportation Fraud.
After conducting specialized training, 37 FBI field offices
investigated 101 cases pertaining to ambulance or medical
transportation fraud from FY 2000 to FY 2003. These cases resulted in
55 convictions, 34 plea agreements or settlements, and total
restitution ordered of $65 million.
-In FY 2003, following an FBI/FDA investigation into allegations of
dilution of chemotherapy medications, pharmacist Robert Courtney
entered a guilty plea, was sentenced to 30 years imprisonment, and was
ordered to pay restitution in the approximate amount of $10.6 million.
Subsequent findings in the case identified approximately 4,200 victims
and 98,000 potentially adulterated prescriptions dating back as far as
1985. As a result of investigating the source of the chemotherapy drugs
that Courtney purchased, six other convictions were obtained against
defendants who were diverting prescription drugs from appropriate
distribution channels.
-Operation Headwaters was an investigation which began in FY 1999 and
targeted durable medical equipment manufacturers across the U.S. in the
area of enteral feeding, diabetic footwear, and wound care products. To
date, this investigation has resulted in four corporate pleas, seven
convictions of individuals, criminal fines in excess of $216 million,
and civil restitution and fines of approximately $454.5 million.
The foreign terrorist attacks upon the U.S. on September 11, 2001
demanded an instant 100% commitment from the FBI towards
counterterrorism. In the days and weeks that followed the attacks,
almost every FBI Agent in the world worked diligently on one of the
most massive investigations in the FBI's history. Nonetheless, the
months that followed the attacks showed that the FBI was able to
regroup, refocus, and balance the urgent priority of counterterrorism
investigations with its commitments towards other criminal
investigations, including health care fraud. FBI Headquarters program
managers ensured that field offices planned for and undertook the steps
necessary to eventually return to staffing levels planned for these
other investigations, including health care fraud investigations.
The FBI is in agreement with the GAO concerning all four of its
recommendations. The FBI recognizes the necessity of having a full and
accurate reporting of its financial data to track resources received as
a result of the HIPAA. The FBI believes that the health care fraud
investigation cost data provided to the GAO are accurate. Nonetheless,
the FBI also recognizes the necessity of having these cost data
properly validated. In acknowledgement of the need to develop formal,
interim policies and procedures for reporting health care fraud
investigation costs, the FBI is currently in the process of conducting
a review of the methods used to estimate, document, and validate these
costs. The goal of this review is to establish an interim process that
will fully meet the expectations of the Congress in the reliability and
validity of the FBI's reporting of health care fraud investigation
costs.
The FBI currently relies upon its Time Utilization Record Keeping
(TURK) system to track the hundreds of different types of investigative
classifications worked by FBI Field Agents. The FBI acknowledges the
need to conduct statistically valid testing of data entered into the
TURK system, and thus plans to update testing and controls surrounding
all aspects of TURK data collection. In addition, any future FBI
resource utilization tracking systems will be designed to interact with
UFMS and/or payroll data systems in order to provide cost information
down to the program and subprogram level. Although the FBI is concerned
with overburdening its field agents with increased administrative
matters, nonetheless field agents are expected to record this program
deployment information completely and accurately.
In acknowledgement of its long-term need to update its cost-tracking
capabilities, the FBI has provided full-time staff resources to
participate in the DOJ's Unified Financial Management System (UFMS)
project. As part of its transition plan, the DOJ plans on interfacing
the UFMS with the National Finance Center's (NFC) payroll system. The
DOJ has not yet determined which specific NFC data elements will be
interfaced with the UFMS. Once the DOJ has completed defining its
standard codes, the FBI will define its codes in accordance with the
Department's plan. Due to the sensitivity of FBI program information,
the FBI does not expect development of cost accounting codes at the
program and subprogram level for sending payroll data to the NFC.
However, the FBI recognizes that it must have the capability to
allocate payroll costs provided by the NFC program to specific
programs. Therefore, the FBI expects that it will use payroll output
data from the NFC to port into a system, managed by the FBI, that will
establish control mechanisms for monitoring costs of FBI programs and
subprograms, most notably the FBI's Health Care Fraud Program.
The FBI acknowledges the need to track non-personnel costs related to
health care fraud investigations. In the development of a future cost
accounting system, the FBI will establish control mechanisms to monitor
all aspects of FBI operations, including both investigative and support
programs. These controls will track both personnel and non-personnel
resources devoted to these programs. Any future system used to track
these costs will be designed to meet the expectations of the Congress
in transparency of allocation of FBI resources, while maintaining the
level of security that is absolutely required for the continued
operation of FBI programs.
To summarize, the FBI is taking the following actions as an immediate
response to the recommendations offered by the GAO:
1. The FBI is conducting a full review of the cost accounting systems
and procedures currently in place used to track health care fraud
investigation costs. This review will be required to include
recommendations for near-term policies and procedures to ensure valid,
reliable, and fully documented data on health care fraud investigation
costs, until implementation of new, permanent cost tracking mechanisms
can be put in place. This review is due for completion and report to
the FBI's Chief Financial Officer by May 31, 2005.
2. The FBI is conducting a full review of the collection and validation
procedures for data entered into the TURK system. This review will be
required to include recommendations for near and long-term policies and
procedures that will ensure valid statistical sampling in audits of the
TURK database, as well as proper oversight of TURK data entry at the
field office level. This review is due for completion and report to the
FBI's Chief Financial Officer by May 31, 2005.
Thank you for the opportunity to comment on your report.
Signed by:
Joseph L. Ford:
Chief Financial Officer:
Assistant Director, Finance Division:
[End of section]
Appendix III: GAO Contacts and Staff Acknowledgments:
GAO Contacts:
Linda M. Calbom, (202) 512-9508;
Steven R. Haughton, (202) 512-5999:
Acknowledgments:
In addition to those named above, Sharon O. Byrd, Richard T. Cambosos,
Tyshawn A. Davis, Lori B. Ryza, and Ruth S. Walk made key contributions
to this report.
(190116):
FOOTNOTES
[1] Public Law No. 104-191, title II, subtitle A, §201(a)(b), 110 Stat.
1936, 1992-93 (Aug. 21, 1996) (codified at 42 U.S.C. §§ 1320a-7c,
1395i(k)(1), (3)(B)).
[2] An FTE is a workforce measure equal to 1 work year--2,600 hours for
agents and 2,080 hours for nonagents.
[3] GAO, Standards for Internal Control in the Federal Government, GAO/
AIMD-00-21.3.1. (Washington, D.C.: November 1999).
[4] FBI budgeted direct costs (such as agent and other personnel
compensation and benefits, rent, and utilities costs) for the health
care fraud program. Indirect costs contributing to health care fraud
investigations, such as FBI-wide training and forensic laboratory
services, were budgeted under other programs or units.
[5] See, 42 U.S.C. §1320a-7c(a).
[6] See, 42 U.S.C. §1395i(k)(1). The Account also serves as a pass-
through account for amounts deposited to and appropriated from the
Trust Fund in support of the Health Care Fraud and Abuse Control
Program administered by HHS and DOJ and the Medicare Integrity Program,
which is administered by HHS. See, 42 U.S.C. §1395i(k)(2), (3)(A), (4).
We have also audited other amounts deposited to and appropriated from
the Trust Fund every 2 years, starting in 1998. The last required audit
is in process. For the most recent report, see GAO, Medicare: Health
Care Fraud and Abuse Control Program for Fiscal Years 2000 and 2001,
GAO-02-731 (Washington, D.C.: June 3, 2002).
[7] See, 42 U.S.C. §1395i(k)(3)(B). Since their inception, the
authorized transfers have increased incrementally, beginning with $47
million in fiscal year 1997.
[8] Other personnel include supervisory agents and both administrative
and investigative support staff.
[9] In years that FBI agents engaged in more health care fraud
investigations than were covered by the transferred amounts, FBI funded
the difference with its S&E appropriation.
[10] These indirect costs included FBI-wide training and forensic
laboratory services as further described in the next section.
[11] See, 31 U.S.C. §902(a)(3)(D).
[12] Federal Accounting Standards Advisory Board, "Statement of Federal
Financial Accounting Standards Number 4" Managerial Cost Accounting
Concepts and Standards for the Federal Government (Washington, D.C.:
July 31, 1995).
[13] Headquarters costs are less than 1 percent of total reported
health care fraud investigation costs. These costs tracked in FMS
include personnel-type costs only, such as regular compensation and
benefits and incentive awards.
[14] NFC develops and operates administrative and financial systems,
including payroll/personnel, administrative payments, and accounts
receivable for both the U.S. Department of Agriculture and more than 60
other federal organizations under cross-servicing or franchising
agreements.
[15] FBI estimated its actual agent payroll and benefits costs to be 46
percent of total health care fraud costs. This was subsequently revised
to 34 percent with the addition of indirect costs in the fourth version
of its costs estimates, as described later.
[16] FBI estimated its other personnel's payroll and benefits costs to
be 29 percent of total health care fraud costs. This was subsequently
revised to 21 percent with the addition of indirect costs in the fourth
version of its cost estimates, as described later.
[17] Various immaterial nonpersonnel cost line items, such as automated
data-processing services and special operations, were reported at
budgeted amounts. The health care fraud equipment line item was
adjusted at year's end in an attempt to reflect actual equipment costs
only.
[18] As stated in "Statement of Federal Financial Accounting Standards
Number 4," it is appropriate to include both direct and indirect costs
when reporting the full costs of program activities.
[19] FBI officials excluded from this allocation certain costs that
were not associated with health care fraud investigations, such as
international training.
GAO's Mission:
The Government Accountability Office, the investigative arm of
Congress, exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability
of the federal government for the American people. GAO examines the use
of public funds; evaluates federal programs and policies; and provides
analyses, recommendations, and other assistance to help Congress make
informed oversight, policy, and funding decisions. GAO's commitment to
good government is reflected in its core values of accountability,
integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through the Internet. GAO's Web site ( www.gao.gov ) contains
abstracts and full-text files of current reports and testimony and an
expanding archive of older products. The Web site features a search
engine to help you locate documents using key words and phrases. You
can print these documents in their entirety, including charts and other
graphics.
Each day, GAO issues a list of newly released reports, testimony, and
correspondence. GAO posts this list, known as "Today's Reports," on its
Web site daily. The list contains links to the full-text document
files. To have GAO e-mail this list to you every afternoon, go to
www.gao.gov and select "Subscribe to e-mail alerts" under the "Order
GAO Products" heading.
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. Government Accountability Office
441 G Street NW, Room LM
Washington, D.C. 20548:
To order by Phone:
Voice: (202) 512-6000:
TDD: (202) 512-2537:
Fax: (202) 512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: www.gao.gov/fraudnet/fraudnet.htm
E-mail: fraudnet@gao.gov
Automated answering system: (800) 424-5454 or (202) 512-7470:
Public Affairs:
Jeff Nelligan, managing director,
NelliganJ@gao.gov
(202) 512-4800
U.S. Government Accountability Office,
441 G Street NW, Room 7149
Washington, D.C. 20548:
