Health Care Fraud and Abuse Control Program
Improvements Needed in Controls over Reporting Deposits and Expenditures Gao ID: GAO-11-446 May 10, 2011To help combat fraud and abuse in health care programs, including Medicare and Medicaid, Congress enacted the Health Care Fraud and Abuse Control (HCFAC) program as part of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). HIPAA requires that the Departments of Health and Human Services (HHS) and Justice (DOJ) issue a joint annual report to Congress on amounts deposited to and appropriated from the Federal Hospital Insurance (HI) Trust Fund for the HCFAC program. In April 2005, GAO reported on the results of its review of HCFAC program activities for fiscal years 2002 and 2003 and made recommendations to HHS and DOJ. The objectives of this requested review were to assess the extent to which HHS and DOJ (1) took actions to address the recommendations made in the 2005 report and (2) designed effective controls over reporting HCFAC deposits and expenditures for fiscal years 2008 and 2009. GAO reviewed HHS and DOJ documentation; selected nongeneralizable samples; and interviewed agency officials.
Although HHS and DOJ have taken action to address our previous recommendations aimed at improving procedures for recording HCFAC expenditures and issuing the annual HCFAC report, GAO found that controls are not sufficient to ensure that the report is accurate and supported. HHS and DOJ took action to address three of the four recommendations in GAO's 2005 report related to recording staff hours in agency workload tracking systems, using the appropriate account class to record HCFAC expenditure data, and expediting the review process for issuing the annual HCFAC report. Neither agency agreed with the remaining recommendation to notify Congress on delays in issuing the HCFAC report within 1 month after missing the mandated January 1 deadline and thus, did not take action. However, in June 2010, HHS and DOJ implemented an expedited review process for completing the HCFAC report. The fiscal year 2010 HCFAC report was issued on January 24, 2011, 23 days later than the mandated reporting date. According to DOJ officials responsible for preparing the HCFAC report, they intend to use this new expedited review process to meet the mandated deadline when preparing future year reports. Regarding the design of controls, while HHS and DOJ had designed polices and procedures for documentation that generally required the retention of documentation for 6 years, these did not provide sufficient controls to ensure adequate support of HCFAC deposits and expenditures, in accordance with internal control standards. (1) Components at both HHS and DOJ that manage HCFAC activities did not include in their respective policies and procedures controls that specified the person responsible for maintaining the records, the location of records, or a combination of both. (2) GAO found instances at HHS and DOJ where documentation could not be provided to support HCFAC expenditures, such as time and attendance reports. Also, both agencies did not have sufficient monitoring controls such as reconciliations, comparisons, and supervisory reviews, as outlined in internal control standards, to ensure accurate reporting of HCFAC deposits and expenditures. As a result, GAO found instances where data recorded in accounting and payroll systems were inconsistent with other sources such as the HI trust fund statements and agency workload tracking systems. GAO also identified presentation errors in the 2008 and 2009 annual HCFAC reports. For example, in reviewing the line item for restitution and compensatory damages, GAO found that $717 million (70 percent) of the $1.03 billion reported in the fiscal year 2009 HCFAC report was not transferred to the HI trust fund as stated in the report. These amounts, primarily related to Medicare Part B and Medicaid, were transferred to the Federal Supplementary Medical Insurance Trust Fund and the Medicaid appropriation account as required. These inaccuracies overstated the amount of funds transferred to the HI trust fund. GAO makes 11 recommendations to HHS and DOJ to revise or develop written procedures that include documentation and monitoring controls for HCFAC activities and reporting. DOJ agreed with all four of its recommendations. Of the seven recommendations to HHS, it generally agreed with five, disagreed with one, and did not address the remaining recommendation.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Kay L. Daly Team: Government Accountability Office: Financial Management and Assurance Phone: (202) 512-9312GAO-11-446, Health Care Fraud and Abuse Control Program: Improvements Needed in Controls over Reporting Deposits and Expenditures
This is the accessible text file for GAO report number GAO-11-446
entitled 'Health Care Fraud and Abuse Control Program: Improvements
Needed in Controls over Reporting Deposits and Expenditures' which was
released on June 9, 2011.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as
part of a longer term project to improve GAO products' accessibility.
Every attempt has been made to maintain the structural and data
integrity of the original printed product. Accessibility features,
such as text descriptions of tables, consecutively numbered footnotes
placed at the end of the file, and the text of agency comment letters,
are provided but may not exactly duplicate the presentation or format
of the printed version. The portable document format (PDF) file is an
exact electronic replica of the printed version. We welcome your
feedback. Please E-mail your comments regarding the contents or
accessibility features of this document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
United States Government Accountability Office:
GAO:
Report to the Ranking Member, Committee on the Judiciary, U.S. Senate:
May 2011:
Health Care Fraud and Abuse Control Program:
Improvements Needed in Controls over Reporting Deposits and
Expenditures:
GAO-11-446:
GAO Highlights:
Highlights of GAO-11-446, a report to the Ranking Member, Committee on
the Judiciary, U.S. Senate.
Why GAO Did This Study:
To help combat fraud and abuse in health care programs, including
Medicare and Medicaid, Congress enacted the Health Care Fraud and
Abuse Control (HCFAC) program as part of the Health Insurance
Portability and Accountability Act of 1996 (HIPAA). HIPAA requires
that the Departments of Health and Human Services (HHS) and Justice
(DOJ) issue a joint annual report to Congress on amounts deposited to
and appropriated from the Federal Hospital Insurance (HI) Trust Fund
for the HCFAC program. In April 2005, GAO reported on the results of
its review of HCFAC program activities for fiscal years 2002 and 2003
and made recommendations to HHS and DOJ. The objectives of this
requested review were to assess the extent to which HHS and DOJ (1)
took actions to address the recommendations made in the 2005 report
and (2) designed effective controls over reporting HCFAC deposits and
expenditures for fiscal years 2008 and 2009. GAO reviewed HHS and DOJ
documentation; selected nongeneralizable samples; and interviewed
agency officials.
What GAO Found:
Although HHS and DOJ have taken action to address our previous
recommendations aimed at improving procedures for recording HCFAC
expenditures and issuing the annual HCFAC report, GAO found that
controls are not sufficient to ensure that the report is accurate and
supported. HHS and DOJ took action to address three of the four
recommendations in GAO‘s 2005 report related to recording staff hours
in agency workload tracking systems, using the appropriate account
class to record HCFAC expenditure data, and expediting the review
process for issuing the annual HCFAC report. Neither agency agreed
with the remaining recommendation to notify Congress on delays in
issuing the HCFAC report within 1 month after missing the mandated
January 1 deadline and thus, did not take action. However, in June
2010, HHS and DOJ implemented an expedited review process for
completing the HCFAC report. The fiscal year 2010 HCFAC report was
issued on January 24, 2011, 23 days later than the mandated reporting
date. According to DOJ officials responsible for preparing the HCFAC
report, they intend to use this new expedited review process to meet
the mandated deadline when preparing future year reports.
Regarding the design of controls, while HHS and DOJ had designed
polices and procedures for documentation that generally required the
retention of documentation for 6 years, these did not provide
sufficient controls to ensure adequate support of HCFAC deposits and
expenditures, in accordance with internal control standards.
* Components at both HHS and DOJ that manage HCFAC activities did not
include in their respective policies and procedures controls that
specified the person responsible for maintaining the records, the
location of records, or a combination of both.
* GAO found instances at HHS and DOJ where documentation could not be
provided to support HCFAC expenditures, such as time and attendance
reports.
Also, both agencies did not have sufficient monitoring controls such
as reconciliations, comparisons, and supervisory reviews, as outlined
in internal control standards, to ensure accurate reporting of HCFAC
deposits and expenditures. As a result, GAO found instances where data
recorded in accounting and payroll systems were inconsistent with
other sources such as the HI trust fund statements and agency workload
tracking systems. GAO also identified presentation errors in the 2008
and 2009 annual HCFAC reports. For example, in reviewing the line item
for restitution and compensatory damages, GAO found that $717 million
(70 percent) of the $1.03 billion reported in the fiscal year 2009
HCFAC report was not transferred to the HI trust fund as stated in the
report. These amounts, primarily related to Medicare Part B and
Medicaid, were transferred to the Federal Supplementary Medical
Insurance Trust Fund and the Medicaid appropriation account as
required. These inaccuracies overstated the amount of funds
transferred to the HI trust fund.
What GAO Recommends:
GAO makes 11 recommendations to HHS and DOJ to revise or develop
written procedures that include documentation and monitoring controls
for HCFAC activities and reporting. DOJ agreed with all four of its
recommendations. Of the seven recommendations to HHS, it generally
agreed with five, disagreed with one, and did not address the
remaining recommendation.
View [hyperlink, http://www.gao.gov/products/GAO-11-446] or key
components. For more information, contact Kay L. Daly at (202) 512-
9312 or dalykl@gao.gov.
[End of section]
Contents:
Letter:
Background:
Agencies Took Action to Address Three of Four GAO Recommendations:
HHS and DOJ Have Gaps in Documentation and Monitoring Controls over
Reporting HCFAC Deposits and Expenditures:
Conclusions:
Recommendations for Executive Action:
Agency Comments and Our Evaluation:
Appendix I: Objectives, Scope, and Methodology:
Appendix II: Information about the Universe of Transactions and Our
Sampled Items:
Appendix III: Comments from the Department of Health and Human
Services:
Appendix IV: GAO Contacts and Staff Acknowledgments:
Tables:
Table 1: Summary of Selected Deposit Transactions:
Table 2: Summary of Selected Expenditures Transactions:
Figures:
Figure 1: Overview of HCFAC Funding Stream:
Figure 2: Amounts Appropriated for HCFAC, Fiscal Years 1997 through
2009:
Abbreviations:
AEM: ASPEN Enforcement Manager:
CMS: Centers for Medicare & Medicaid Services:
CPI-U: consumer price index for all urban consumers:
FACS: Financial Accounting and Control System:
DOJ: Department of Justice:
HCFAC: Health Care Fraud and Abuse Control program:
HEAT: Health Care Fraud Prevention and Enforcement Action Team:
HHS: Department of Health and Human Services:
HI: Hospital Insurance:
HIPAA: Health Insurance Portability and Accountability Act:
IPAC: Intra-governmental Payment and Collection System:
OIG: Office of Inspector General:
OMB: Office of Management and Budget:
SMI: Supplementary Medical Insurance:
TRHCA: Tax Relief and Health Care Act:
USAO: United States Attorneys Office:
[End of section]
United States Government Accountability Office:
Washington, DC 20548:
May 10, 2011:
The Honorable Charles E. Grassley:
Ranking Member:
Committee on the Judiciary:
United States Senate:
Dear Senator Grassley:
We have designated Medicare and Medicaid as high risk programs because
they are particularly vulnerable to fraud, waste, and abuse and
improper payments.[Footnote 1] Medicare is considered high risk in
part because of its complexity and susceptibility to improper
payments, and Medicaid because of concerns about the adequacy of its
fiscal oversight to prevent inappropriate spending. In 2010, Medicare
covered 47 million elderly and disabled beneficiaries and had
estimated outlays of $509 billion. Medicaid, a federal-state program,
covered over 69 million low-income people and consists of more than 50
distinct state-based programs that cost the federal government and
states an estimated $408 billion in fiscal year 2010. For fiscal year
2010, the Department of Health and Human Services (HHS) estimated
improper payments for the Medicare and Medicaid programs at about
$70.4 billion,[Footnote 2] comprising 56 percent of the estimated
$125.4 billion in governmentwide improper payments, as reported by
federal agencies.[Footnote 3]
To help combat fraud and abuse in health care programs such as
Medicare and Medicaid, Congress enacted the Health Care Fraud and
Abuse Control (HCFAC) program as part of the Health Insurance
Portability and Accountability Act of 1996 (HIPAA).[Footnote 4] HHS
and the Department of Justice (DOJ) jointly administer the HCFAC
program. HIPAA requires that HHS and DOJ issue a joint annual report
to Congress no later than January 1 of each year on (1) amounts
deposited to the Federal Hospital Insurance Trust Fund (HI trust fund)
pursuant to HIPAA (HCFAC deposits) for the previous fiscal year and
the source of such amounts and (2) amounts appropriated from the HI
trust fund for HCFAC activities each year and the justification for
the expenditure of such amounts.[Footnote 5]
In April 2005, we reported on the results of our review of HCFAC-
related activities for fiscal years 2002 and 2003.[Footnote 6] In that
report, we made recommendations to HHS and DOJ to improve procedures
for recording HCFAC expenditures and issuing the annual HCFAC report.
You requested that we provide an update on the status of the
recommendations in our April 2005 report and review controls over the
reporting process for amounts included in the fiscal years 2008 and
2009 HCFAC reports.[Footnote 7] As agreed with your office, the
objectives of our review were to assess the extent to which HHS and
DOJ (1) took actions to address the recommendations we made in 2005
and (2) designed effective controls over reporting HCFAC deposits and
expenditures for fiscal years 2008 and 2009.
To address the first objective, we reviewed supporting documentation
provided by HHS and DOJ such as policies and procedures and
interviewed officials at HHS and DOJ, including the HHS Acting Deputy
Inspector General and the Assistant Director of the Executive Office
for United States Attorneys, to obtain further information on actions
taken. To address the second objective, we obtained and reviewed
relevant HHS and DOJ policies and procedures for reporting deposits
and expenditures within each agency and used criteria outlined in our
Standards for Internal Control in the Federal Government to assess the
effectiveness of the controls documented in these policies and
procedures.[Footnote 8] To further our understanding of these
controls, we selected a nongeneralizable stratified random sample for
deposits of 47 transactions for fiscal year 2008 and 55 transactions
for fiscal year 2009. We also selected a nongeneralizable random
sample for expenditures of 63 transactions for fiscal year 2008 and 62
transactions for fiscal year 2009. Expenditure samples were selected
for each of the agency components that were allocated HCFAC
appropriation funds as reported in the annual HCFAC reports for fiscal
years 2008 and 2009. The sample selections were designed to provide
additional details about the processing of those transactions and were
not intended to be representative of the universe of HCFAC
transactions. For the selected transactions, we reviewed supporting
documentation such as check registers, time and attendance reports,
and contracts to determine whether dollar amounts for these
transactions were accurately reported and the use of funds were
consistent with HIPAA. We also performed additional procedures for HHS
Office of Inspector General (OIG) payroll transactions to determine if
HCFAC projects were properly classified and workload tracking systems
included hours for all staff. In addition, we conducted interviews
with HHS and DOJ officials including budget analysts and financial
specialists to obtain an understanding and clarification of the
processes in place to report HCFAC deposits and expenditures. See
appendix I for additional details on our objectives, scope, and
methodology.
We conducted our work from February 2010 through May 2011 in
accordance with U.S. generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objectives. We believe
that the evidence obtained provides a reasonable basis for our
findings and conclusions based on our audit objectives.
Background:
HIPAA authorized the HCFAC program to consolidate and strengthen
ongoing efforts to combat fraud and abuse in health care programs and
increase resources for fighting health care fraud. The Secretary of
HHS, through the HHS OIG, and the Attorney General, administer the
HCFAC program. The HCFAC program goals are to:
* coordinate federal, state, and local law enforcement efforts to
control fraud and abuse associated with health plans;
* conduct investigations, audits, and other studies of delivery and
payment for health care for the United States;
* facilitate the enforcement of the civil, criminal, and
administrative statutes applicable to health care;
* provide guidance to the health care industry, including the issuance
of advisory opinions, safe harbor notices, and special fraud alerts;
and:
* establish a national database of adverse actions against health care
providers.
Figure 1 below provides an overview of the HCFAC funding stream,
including the related deposits, the allocation of appropriated funds
to carry out federal health care law enforcement activities, and the
reporting mandate.
Figure 1: Overview of HCFAC Funding Stream:
[Refer to PDF for image: illustration]
HI Trust Fund:
HCFAC related deposits:
* Criminal fines;
* Civil monetary penalties;
* Forfeitures of property;
* Penalties and multiple damages;
* Gifts and bequests.
Appropriations[A]:
HCFAC account:
HHS Centers for Medicare & Medicaid Services[B]:
Interagency agreement with HHS and DOJ:
Receive bills from agency; reimburse agency.
HHS:
Office of Inspector General;
Administration on Aging;
Office of the General Counsel.
DOJ:
United States Attorneys Offices;
Criminal Division;
Civil Division;
Civil Rights Division.
Joint annual reporting mandate[C]: responsibility of HHS and DOJ.
Source: GAO analysis of HIPAA legislation and HHS and DOJ data.
[A] The annual appropriated amount is allocated between the various
HHS and DOJ components based on statutory amounts and internal
negotiations. An allocation is made when one or more agencies share
the administration of the program for which appropriations are made to
only one of the agencies or to the President. The agency receiving the
allocation may obligate up to the amount included in the account.
[B] HHS's Centers for Medicare & Medicaid Services (CMS), Division of
Accounting Operations, performs the accounting for the HCFAC account.
[C] HIPAA requires that HHS and DOJ issue a joint annual report to
Congress no later than January 1 of each year that identifies the
amounts appropriated to and from the HI trust fund during the prior
fiscal year.
[End of figure]
The types of collections deposited to the HI trust fund and
appropriations from this fund, including related expenditures are
discussed below.
Deposits to the HI Trust Fund:
Criminal fines. DOJ prosecutes entities or persons that are involved
in commission of a federal health care offense, such as mail fraud
related to a health care program.[Footnote 9] Courts assess criminal
fines upon which the criminal debtor is ordered to submit payment(s)
to the United States District Court where the case was prosecuted.
Each District Court coordinates with DOJ's local United States
Attorneys Office (USAO)[Footnote 10] to communicate collections
received.[Footnote 11] The Executive Office for United States
Attorneys report collection data on a quarterly basis to the Bureau of
the Public Debt for deposit into the HI trust fund.[Footnote 12]
Civil monetary penalties. The Social Security Act authorizes the
Secretary of HHS to impose civil monetary penalties for improper
claims and other violations by health care providers, facilities, and
other parties.[Footnote 13] Centers for Medicare & Medicaid Services
(CMS) regional offices impose some civil monetary penalties. CMS's
Office of Financial Management collects the civil monetary penalties
imposed on behalf of the Secretary of HHS and allocates payments
received based on information the regional offices record in their
data collection system. The Office of Financial Management reports
collections for civil monetary penalties on a daily basis to the
Bureau of the Public Debt for deposit into the HI trust fund.
Forfeitures of property. DOJ prosecutions of entities or persons that
are involved in a federal health care offense can result in the
forfeiture of property.[Footnote 14] HHS and DOJ reported no property
forfeitures creditable to the HI trust fund under HIPAA in the HCFAC
reports for fiscal years 2008 and 2009.[Footnote 15]
Penalties and multiple damages. Courts can impose penalties and
multiple damages as a result of HHS and DOJ civil suits against those
who have knowingly made false health care claims against the
government, such as submitting claims for medical services that were
not provided.[Footnote 16] Of all civil debt collections received, DOJ
is entitled to keep 3 percent in its Working Capital Fund for expenses
incurred in processing and tracking civil and criminal debt collection
litigations.[Footnote 17] Both CMS and DOJ report collections for
penalties and multiple damages on a continuous basis to the Bureau of
the Public Debt for deposit into the HI trust fund.
Gifts and bequests. CMS occasionally receives gifts and bequests and
equally splits the amount received between its Medicare Part A and
Medicare Part B programs.[Footnote 18] Gifts and bequests are
donations received from individuals or entities, usually in the form
of checks. Upon receipt of a donation, CMS records the amount in its
accounting system and reports it to the Bureau of the Public Debt for
deposit into the HI trust fund.
In addition to the types of deposits authorized by HIPAA and discussed
above, HHS and DOJ report other types of collections in connection
with health care fraud activities such as HHS OIG audit disallowances
and court-awarded restitution and compensatory damages.[Footnote 19]
These types of collections represent amounts recovered by HHS and DOJ
as a result of health care enforcement activities. These amounts are
returned to the HI trust fund to the extent that they represent
repayments to Medicare.[Footnote 20]
Appropriations from the HI Trust Fund and Related Expenditures:
Funds for the HCFAC program are appropriated from the HI trust fund to
an expenditure account, referred to as the Health Care Fraud and Abuse
Control Account (HCFAC account) maintained within the HI trust fund.
Annually, the HHS Secretary and the Attorney General jointly certify
amounts appropriated from the HI trust fund to the HCFAC account as
necessary to finance health care fraud and abuse control activities
based on statutory limits. HIPAA, as amended, prescribes the maximum
amount that may be certified in a given fiscal year.[Footnote 21] Any
unexpended amounts are carried forward to the next fiscal year. Once
HCFAC funds have been certified, CMS's Division of Accounting
Operations performs the accounting for appropriations transferred to
the HCFAC account. CMS makes funds available by creating allotments in
its accounting system to fund related HCFAC expenditures.[Footnote 22]
CMS provides funds to other HHS components and DOJ through intra-and
interagency agreements, as shown in figure 1. This process requires
HHS and DOJ to bill CMS through the Intra-governmental Payment and
Collection (IPAC) System to obtain payment from their allocation of
HCFAC funds.[Footnote 23] In addition to CMS's central accounting for
HFCAC funds, both HHS and DOJ components have processes to separately
manage their allotted HCFAC amounts. In general, these processes
include authorizing HCFAC-related expenditures, recording applicable
payroll and nonpayroll expenditures incurred to a designated HCFAC
code, and reporting any unexpended amounts to be carried forward to
the next fiscal year.
For fiscal year 2009, the Secretary of HHS and the Attorney General
certified $266.4 million in mandatory funding to be appropriated from
the HI trust fund to the HCFAC account.[Footnote 24] Additionally,
Congress appropriated $198 million in discretionary funding to that
account in response to HHS's fiscal year 2009 budget request, to fund
HCFAC program integrity activities. As such, the total appropriated
amount to the HCFAC account for fiscal year 2009 was $464.4 million
for that year.[Footnote 25] Figure 2 provides a historical trend of
the amounts appropriated to the HCFAC account over the past 13 fiscal
years.
Figure 2: Amounts Appropriated for HCFAC, Fiscal Years 1997 through
2009:
[Refer to PDF for image: vertical bar graph]
Fiscal year: 1997;
Mandatory funding: $104 million.
Fiscal year: 1998;
Mandatory funding: $119.6 million.
Fiscal year: 1999;
Mandatory funding: $137.5 million.
Fiscal year: 2000;
Mandatory funding: $158.2 million.
Fiscal year: 2001;
Mandatory funding: $181.9 million.
Fiscal year: 2002;
Mandatory funding: $209.2 million.
Fiscal year: 2003;
Mandatory funding: $240.6 million.
Fiscal year: 2004;
Mandatory funding: $240.6 million.
Fiscal year: 2005;
Mandatory funding: $240.6 million.
Fiscal year: 2006;
Mandatory funding: $240.6 million.
Fiscal year: 2007;
Mandatory funding: $249.5 million.
Fiscal year: 2008;
Mandatory funding: $255.2 million.
Fiscal year: 2009[A];
Mandatory funding: $266.4 million;
Discretionary funding: $198 million;
Total funding: $464.4 million.
Source: The annual joint HHS and DOJ HCFAC reports for fiscal years
1997 through 2009.
[A] Fiscal year 2009 was the first year that Congress appropriated
discretionary funding to the HCFAC account to support health care
fraud and abuse activities. The Omnibus Appropriations Act of 2009
(Pub. L. No. 111-8) appropriated $198 million out of the HI and
Federal Supplementary Medical Insurance (SMI) trust funds to HCFAC.
[End of figure]
Funds were first appropriated to HCFAC in fiscal year 1997. HIPAA
limited the amounts appropriated for fiscal years 1998 through 2003 to
an amount equal to the limit for the preceding fiscal year plus an
additional 15 percent. For fiscal years 2004 through 2006, the amount
made available was capped at the 2003 limit. The Tax Relief and Health
Care Act (TRHCA) also allowed for yearly increases to the HCFAC
account based on the change in the consumer price index for all urban
consumers (CPI-U) over the previous fiscal year for fiscal years 2007
through 2010. In fiscal year 2006, TRHCA amended HIPAA so that funds
allotted from the HCFAC account are available until expended.[Footnote
26] Beyond 2010, the Patient Protection and Affordable Care Act,
[Footnote 27] as amended by the Health Care and Education
Reconciliation Act of 2010,[Footnote 28] raised the limit on funds
that may be certified for the HCFAC account by the Secretary of HHS
and the Attorney General by an additional $350 million over the next
10 years, beginning in fiscal year 2011.
The annual allocation of appropriation amounts to the HHS and DOJ
components are intended to support a variety of anti-fraud and anti-
abuse activities. For example, in May 2009, HHS and DOJ established a
task force--the Health Care Fraud Prevention and Enforcement Action
Team (HEAT)--comprised of top level law enforcement and professional
staff from both agencies to prevent health care fraud and enforce
current anti-fraud laws around the country. Other examples include HHS
OIG investigations, audits, and evaluations that identify
vulnerabilities for questionable or fraudulent financial practices
related to Medicaid outpatient prescription drug expenditures and
Medicare contractor costs. Similarly, DOJ's USAOs use HCFAC funding to
support civil and criminal health care fraud and abuse litigation.
HCFAC funds are also used to train attorneys, investigators, and
auditors in the investigation and prosecution of health care fraud and
abuse; prosecute health care matters through criminal, civil, and
administrative proceedings; and conduct investigations, financial, and
performance audits of health care programs, inspections, and other
evaluations.
Agencies Took Action to Address Three of Four GAO Recommendations:
In our April 2005 report,[Footnote 29] we identified weaknesses
related to not properly capturing certain expenditure data in agency
information systems, non-adherence to accounting policy for select
HCFAC expenditures, and lengthy HCFAC report review processes. We made
recommendations to HHS and DOJ to improve procedures for recording
HCFAC expenditures and issuing the annual HCFAC report.[Footnote 30]
Based on our analysis of documentation, HHS and DOJ took actions that
addressed three of the four recommendations. Both agencies disagreed
with our recommendation to notify Congress on delays in issuing the
HCFAC report by the mandated deadline and thus, did not take action.
Each of the recommendations and applicable actions taken are described
further below.
Record staff hours in workload tracking systems. In our 2005 report,
we found that two HHS OIG components--Office of Evaluations and
Inspections and Office of Investigations--had not recorded all staff
hours in their workload tracking systems, which are used to monitor
actual hours spent on HCFAC activities. HHS OIG uses the workload
tracking systems to monitor HCFAC payroll expenditures, and incomplete
information could hinder those efforts. We recommended that the HHS
Inspector General require all HHS OIG components to develop procedures
for ensuring that all key staff hours spent on HCFAC activities are
recorded in the HHS OIG workload tracking systems. In April 2006, the
HHS OIG's Office of Evaluation and Inspections updated its procedures
for entering information into its workload tracking system, including
guidance related to the completion of timesheets. The procedures
instruct employees to record time to specific inspection codes and
instruct managers to review staff time recorded in the system. In
addition, HHS OIG's Office of Investigations updated its procedures in
October 2009, which require all Office of Investigations personnel to
record time and attendance in its workload tracking system. We
determined that HHS OIG components' actions substantially addressed
the recommendation.
Record expenditure data under the correct account class. In our 2005
report, we noted that only one of the four DOJ components receiving
HCFAC funds properly recorded expenditures as required by DOJ policies
and procedures. We recommended that the Attorney General develop
monitoring procedures to ensure that DOJ components record key HCFAC
program expenditure data under the appropriate HCFAC account class in
DOJ's accounting system. In April 2005, DOJ updated its policies and
procedures that require individual components to monitor obligations
recorded in the accounting system on a quarterly basis. Further, in
fiscal year 2009 the Executive Office for the United States Attorneys
provided procedures to the USAOs, which receive the largest portion of
the HCFAC allocation, on how to charge HCFAC expenditures using the
proper program code. According to DOJ officials, component officials
review system reports on a regular basis to verify that HCFAC
obligations and expenditures are correctly reflected in the accounting
system. We determined that DOJ's actions were sufficient to close the
recommendation.
Develop a more expedited review process. In our 2005 report, we noted
that a lengthy review process within HHS and DOJ resulted in failure
to meet the mandated annual January 1 deadline for reporting HCFAC
activities. For example, the fiscal year 2003 HCFAC report, the most
recent report at the time of that review, was issued 1 year after the
mandated reporting date. We recommended that the Secretary of HHS and
the Attorney General develop a more expedited review process for the
joint annual HCFAC reports. In June 2010, DOJ issued a Report
Completion Guide, an expedited review process that provides
instructions and time frames for submitting information to complete
the annual HCFAC report. The guide introduced a new process whereby
DOJ and HHS components utilized a shared website to distribute
documents for edit and review. The guide also established time frames
for issuing the fiscal year 2010 HCFAC report by January 1, 2011.
Using these new time frames, HHS and DOJ jointly issued the fiscal
year 2010 HCFAC report on January 24, 2011, only 23 days later than
the mandated reporting date. According to DOJ officials responsible
for preparing the HCFAC report, they intend to use these time frames
to meet the mandated deadline when preparing future year reports. We
determined that HHS and DOJ's efforts meet the intent of our
recommendation. However, as discussed later in this report, although
timeliness is important, ensuring that the report is accurate and
reliable remains a concern.
Notify Congress of delays in report issuance. In our 2005 report, we
noted that repeated delays in issuing the joint annual HCFAC report
impact the relevance of the data being reported. We recommended that
the Secretary of HHS and the Attorney General notify congressional
oversight committees of delays in issuing the annual report within 1
month of missing the January 1 deadline. HHS and DOJ did not concur
with this recommendation. However, as we stated above, both HHS and
DOJ developed and implemented a new timeline of dates to edit and
review the annual HCFAC report, which resulted in issuing the fiscal
year 2010 annual HCFAC report within one month of the mandate.
Continuing to take steps to meet these internal deadlines will be
necessary to issue the HCFAC report by the mandated deadline to
provide timely, relevant information to Congress.
HHS and DOJ Have Gaps in Documentation and Monitoring Controls over
Reporting HCFAC Deposits and Expenditures:
Our review of HHS and DOJ policies and procedures showed that both
agencies had not designed sufficient controls to help ensure that
HCFAC deposits and expenditures were accurately reported. GAO's
Standards for Internal Control in the Federal Government provides that
management should establish control mechanisms and activities, and
monitor and evaluate these controls. Specifically, during our review
we found that HHS and DOJ did not have sufficient controls in their
policies and procedures with respect to (1) maintaining and retaining
supporting documentation for HCFAC deposits and expenditures and (2)
monitoring HCFAC deposits and expenditures to help ensure accurate
reporting. From our review of the underlying documentation to support
HCFAC activities and nongeneralizable samples of deposits and
expenditures, we identified instances in which these design
deficiencies resulted in HHS's and DOJ's inability to support reported
amounts for HCFAC expenditures. We also found errors in reported HCFAC
amounts.[Footnote 31]
Documentation Controls Insufficient to Fully Support HCFAC Deposits
and Expenditures:
While HHS and DOJ designed controls that were incorporated into its
policies and procedures generally requiring the retention of
documentation for 6 years, the policies and procedures for CMS,
Administration on Aging, and DOJ did not provide sufficient details
with respect to where these documents were to be filed, who should be
responsible for maintaining them, or a combination of both, which
would help ensure accountability and adequate support of HCFAC
deposits and expenditures. Our review found that while the HHS OIG and
the Office of the General Counsel policies and procedures for
documentation contained sufficient controls as to the type of
documentation to be retained, the retention period, the location of
records, and the person responsible for maintaining the records, CMS
and Administration on Aging policies and procedures were lacking some
of these controls.[Footnote 32] Specifically, CMS policies and
procedures for documentation of HCFAC deposits and expenditures, did
not identify the person responsible for maintaining supporting
documents. We found the same weakness with Administration on Aging
policies and procedures for documentation of HCFAC expenditures.
Further, Administration on Aging policies and procedures did not
specify where those documents should be filed. Officials from the
Administration on Aging told us that they are in the process of
revising their policies and procedures to address these issues. In its
comments, Administration on Aging indicated that it expects to
incorporate these changes by summer 2011.
We also reviewed DOJ's controls for retention of documents related to
HCFAC deposits and expenditures.[Footnote 33] DOJ's procedures for
deposits identified controls related to the type of documentation to
be retained, the retention period, and the location of records, but
they did not specify the person responsible for maintaining supporting
documents. Although DOJ's departmentwide expenditure procedures
identified controls related to the type of documentation and the
retention period, and indicated that documents should be maintained in
the obligation file, the procedures did not specify the location of
the obligation file and the person responsible for maintaining the
records within each office.
During our review, we found instances at HHS and DOJ where
documentation was not available to support expenditures. For example,
we found that HHS's Administration on Aging did not maintain, and
therefore could not provide, underlying documentation to support how
the estimated payroll percentages for fiscal years 2008 and 2009 were
derived, which are used to charge payroll expenditures against the
HCFAC account on a biweekly basis. In fiscal year 2008, for example,
the Administration on Aging charged approximately 29 percent of its
total HCFAC allocation, or $879,607, to payroll expenses, an amount
that could not be fully supported due to the lack of documentation.
Therefore, we were unable to verify the justification of such
expenditures. In addition, during our review, we found that DOJ could
not provide sufficient documentation to support 12 nongeneralizable
payroll sample items selected for fiscal years 2008 and 2009, such as
time and attendance reports, workload tracking system reports, and
records of actual payroll disbursements.
Further, DOJ could not provide documentation to support unexpended
amounts carried forward from fiscal year 2008 to fiscal year 2009,
totaling $522,278. At the end of each fiscal year, DOJ communicates to
HHS the amount of unused funds so that HHS can carry them forward to
the following fiscal year via an interagency agreement. To report this
amount, DOJ's Justice Management Division compiles obligation data
provided by the different DOJ components. However, DOJ's Justice
Management Division could not locate the documents that supported the
amount of funds carried forward in the fiscal year 2009 interagency
agreement.
GAO's Standards for Internal Control in the Federal Government
provides that internal control be designed to ensure that all
transactions and other significant events be clearly documented and
the documentation be readily available for examination.[Footnote 34]
The standards also provide that records should be properly managed and
maintained and documentation should appear in management directives,
administrative policies, or operating manuals. Insufficient controls
over documentation increase the risk of not having sufficient support
to ensure reported HCFAC amounts are accurate and funds are spent as
intended.
Monitoring Controls Insufficient to Help Ensure Accurate Reporting of
HCFAC Deposits and Expenditures:
HHS's and DOJ's procedures did not incorporate sufficient monitoring
controls to help ensure HCFAC deposits and expenditures were
accurately reported.
Monitoring of deposits. HHS and DOJ had not designed controls to
require the reconciliation of HCFAC deposits recorded in their
departmentwide accounting systems to data collection systems or to the
HI trust fund statements.[Footnote 35] Specifically, CMS did not have
written procedures that required the reconciliation of civil monetary
penalty amounts in the CMS regional offices' data collection system to
CMS's accounting system.[Footnote 36] We found two instances from our
fiscal year 2009 nongeneralizable sample of deposits where CMS
regional offices had made adjustments that were recorded in their data
collection system, but not communicated to the Office of Financial
Management for recording in CMS's accounting system, which is used as
a source to compile the data for the HCFAC report. These two instances
resulted in a $15,066 overstatement error in CMS's accounting system,
which CMS officials corrected after we brought the errors to their
attention. Although CMS officials stated that they reconcile the data
maintained in both systems on a monthly basis, they were not able to
provide us an example of these reconciliation reports. In February
2011, CMS officials told us that they were in the process of
developing procedures for the Office of Financial Management to
require these reconciliations.
In addition, DOJ's Justice Management Division[Footnote 37] did not
have written procedures that included controls to reconcile deposits
of the 3 percent portion of penalties and multiple damages reported in
the HI trust fund statements to the agency's accounting system
records.[Footnote 38] For example, for fiscal year 2009 we identified
an overstatement in the amount of $596,266 in the HI trust fund
statements when comparing to DOJ's records. When we inquired about the
difference, DOJ officials from the Justice Management Division
confirmed that an overstatement had occurred because of adjusting
entries that had been communicated to the Bureau of the Public Debt
but not captured in the HI trust fund statements. In February 2011,
DOJ officials told us that to avoid this from happening in the future,
they were in the process of developing procedures that would include
monitoring controls for reconciling on a quarterly basis penalties and
multiple damages between DOJ records and the statements issued by the
Bureau of the Public Debt to ensure reported amounts are accurate and
consistent between both agencies.
Monitoring of expenditures. Similarly, certain HHS components and DOJ
did not have written procedures that incorporated controls for
reconciling or comparing HCFAC staff hours to verify the accuracy of
payroll expenditures charged against the HCFAC account. Specifically,
HHS's Administration on Aging did not have controls for monitoring
HCFAC actual payroll hours. HHS's Administration on Aging charges
payroll expenditures based on estimates made prior to or after the
beginning of the year. Because the Administration on Aging does not
record hours at the HCFAC activity level, it cannot verify that the
payroll expenditures charged against the HCFAC account throughout the
year are reasonably accurate. According to officials at the
Administration on Aging, they believe that tracking hours at the HCFAC
activity level would not be cost effective nor provide better results
to justify the costs. However, because the estimated percentage of
time charged against the HCFAC account may not represent the actual
time spent on HCFAC activities for a given pay period, it is critical
that some type of monitoring procedures or verification procedures are
designed to help ensure that the payroll expenditures charged to the
HCFAC account are reasonable and supported. DOJ's Civil Rights
Division also charges HCFAC payroll expenditures based on estimates.
Although Civil Rights Division officials indicated that they track and
record actual hours and make adjustments to payroll expenditures if
differences are noted, these controls were not documented in DOJ's
policies and procedures.
In addition, HHS OIG and the Office of the General Counsel for HHS, as
well as DOJ USAO and Civil Division, did not have written procedures
that included controls for reconciling or comparing HCFAC hours
recorded in workload tracking systems to departmentwide payroll or
accounting systems. We found instances where staff hours captured in
workload tracking systems did not agree with staff hours recorded in
departmentwide payroll or accounting systems. For example, we found
that the workload tracking system used by the Office of Counsel to the
Inspector General included approximately 10 percent fewer hours for
fiscal year 2008 and 7 percent fewer hours in fiscal year 2009 when
compared to HHS's payroll system reports. Similarly, we found two
instances from our fiscal year 2008 nongeneralizable sample of
expenditures where USAO's workload tracking system included fewer
hours than the HCFAC hours recorded and billed in DOJ's accounting
system, which collectively accounted for a 40 percent difference
between the two systems. Failure to complete these reconciliations or
comparisons could lead to unsubstantiated payroll expenditures that
should not be charged to the HCFAC account.[Footnote 39]
HHS OIG and DOJ officials told us that they were aware of the
differences. HHS OIG officials indicated that while they did not have
procedures that specifically addressed the reconciliation of data
captured in their workload tracking systems, they believed they had
other compensating controls, such as periodic inspections of
timesheets, to mitigate the risk of inconsistent data between systems.
They also noted that they were considering taking actions to revise
their policies and procedures to add new monitoring controls to
address the need to reconcile data between the systems. Further, DOJ
officials indicated that because they spend significantly more
resources on HCFAC activities than the sum that is allocated to DOJ
from the HCFAC account, it is not cost beneficial to require personnel
to record their time consistently in both systems. Also, according to
DOJ officials, although not formally documented, each component has
processes to monitor HCFAC expenditures to ensure they do not over-
bill the HCFAC account. For example, the officials stated that the
Criminal Division performs quarterly reviews of percentages used to
charge payroll expenditures against the HCFAC account. Not having
policies and procedures to ensure that sufficient controls over HCFAC
expenditures are in place could result in misstatements and ultimately
hinder HHS and DOJ managers in preparing meaningful budgets to support
future HCFAC funding requests.
Monitoring of annual report compilation. Also, we found that although
DOJ issued the Report Completion Guide in June 2010 that specified
time frames for both HHS and DOJ for submitting information to
complete the annual HCFAC report, the guide did not require that
monitoring control activities, such as comparisons and supervisory
reviews, be performed to help ensure that reported amounts were
accurately presented. During our review of the HCFAC reports, we found
presentation errors of $245.7 million and $717.5 million for fiscal
years 2008 and 2009, respectively, of the total amounts reported as
transferred to the HI trust fund. For example, for fiscal year 2009 we
found that $716.8 million of the $1.0 billion reported in the
restitution and compensatory damages line item was not transferred to
the HI trust fund as stated in the report. Of the $716.8 million,
$441.0 million related to Medicaid, $245.4 million related to Medicare
Part B, and $30.4 million represented a double-counting error. The
$30.4 million double-counting error related to civil monetary
penalties and CMS's portion of penalties and multiple damages, which
were already reported under separate line items. HHS and DOJ disclosed
the double-counting error and the Medicaid presentation error in the
fiscal year 2010 annual HCFAC report issued on January 24, 2011.
Recoveries for Medicare Part B and Medicaid are not transferred to the
HI trust fund, but instead are to be transferred to the Federal
Supplementary Medical Insurance (SMI) Trust Fund and the Medicaid
appropriation account within CMS, respectively. We found a similar
issue in the fiscal year 2008 HCFAC report, where the total amount
reported as transferred to the HI trust fund included Medicare Part B
recoveries totaling $245.7 million. These inaccuracies overstated the
amount of funds transferred to the HI trust fund.
In addition, CMS officials told us that the amounts reported in the
HHS OIG audit disallowances line item, totaling about $662.5 million
and $360.2 million for fiscal years 2008 and 2009, respectively,
included both Medicare and Medicaid recoveries. As stated above,
Medicaid recoveries are to be transferred to the Medicaid
appropriation account within CMS rather than the HI trust fund.
However, these officials stated that the dollar amount associated with
each type of recovery could not be determined because the current
system does not readily distinguish between Medicare and Medicaid
recoveries for amounts previously reported in the HCFAC report. Full
disclosures had not been made in the report to inform readers that
reported amounts included Medicare Part B and Medicaid, which are not
transferred to the HI trust fund. In the fiscal years 2008 and 2009
HCFAC reports, HHS and DOJ incorrectly indicated in footnotes that
reported amounts did not include Medicaid funds. CMS officials
indicated they will separately report Medicare and Medicaid recoveries
related to HHS OIG audit disallowances in future HCFAC reports.
According to CMS officials, they plan to accomplish this by manually
tracking Medicare and Medicaid recoveries. In addition, DOJ officials
told us that they are in the process of developing written guidance on
the preparation of the annual HCFAC report and anticipate issuance by
June 2011.
GAO's Standards for Internal Control in the Federal Government
provides that internal control should generally be designed to assure
that ongoing monitoring occurs in the course of normal operations,
including regular management and supervisory activities, comparisons,
reconciliations, and other actions people take in performing their
duties.[Footnote 40] Having detailed written policies and procedures
that incorporate these key monitoring controls decreases the risk of
reporting inaccurate HCFAC data that could be misleading to Congress
when judging the success of the program.
Conclusions:
Although HHS and DOJ have taken action to address our previous
recommendations aimed at improving procedures for recording HCFAC
expenditures and issuing the annual HCFAC report, we found that
controls are not sufficient to ensure that the report is accurate and
supported. As HHS and DOJ accelerate the reporting process in an
attempt to complete the report by the January 1 mandated reporting
deadline, it is important that they establish controls that are
designed to provide complete, accurate, and reliable information in
the annual HCFAC report. Based on our review of the fiscal years 2008
and 2009 HCFAC reports, HHS and DOJ do not have sufficient controls
for maintaining and retaining documentation and performing monitoring
such as reconciliation and review activities to ensure accurate and
consistent reporting of HCFAC deposits and expenditures. These design
weaknesses led to instances where documentation was not readily
available and amounts included in the HCFAC reports contained errors.
Until HHS and DOJ strengthen their controls for documenting and
monitoring HCFAC reporting processes, their ability to provide
Congress with an accurate and timely annual report of HCFAC activities
will continue to be compromised. Inaccuracies in the mandated annual
report limit its usefulness to congressional decision makers and other
interested parties.
Recommendations for Executive Action:
We are making the following 11 recommendations to HHS and DOJ to
improve controls over the accounting and reporting of HCFAC activities.
We recommend that the Secretary of HHS,
* direct the Administrator of CMS to:
- revise procedures for properly maintaining supporting documentation
for HCFAC deposits and expenditures, to include specifying the titles
of staff responsible for maintaining supporting documentation;
- develop written procedures that incorporate monitoring controls for
HCFAC deposit information recorded in the departmentwide accounting
system, including reconciling the deposit data in this system to the
regional offices' data collection system;
* direct the Assistant Secretary for Aging to:
- revise the Administration on Aging's procedures for properly
maintaining supporting documentation for HCFAC expenditures, to
include specifying the titles of staff responsible for maintaining
supporting documentation and the location of records;
- develop written procedures that incorporate monitoring controls to
verify that the payroll expenditures charged against HCFAC are
reasonable and supported; and:
* direct the Acting General Counsel to develop written procedures that
incorporate monitoring controls for the Office of the General Counsel
staff hours related to HCFAC activities captured in workload tracking
systems, including the reconciliation to staff hours captured in the
departmentwide payroll system; and:
* develop written procedures in collaboration with DOJ that
incorporate monitoring controls for preparing the joint annual HCFAC
report to help ensure reported amounts are accurate.
We recommend that the HHS Inspector General develop written procedures
that incorporate monitoring controls for HHS OIG staff hours related
to HCFAC activities captured in workload tracking systems, including
the reconciliation to staff hours captured in the departmentwide
payroll system.
We recommend that the Attorney General direct the Deputy Assistant
Attorney General/Controller to:
* revise procedures for properly maintaining supporting documentation
for HCFAC deposits and expenditures, to include specifying the titles
of staff responsible for maintaining supporting documentation and the
location of records;
* develop written procedures that incorporate monitoring controls for
reconciling HCFAC deposits of the 3 percent portion of penalties and
multiple damages information recorded in the departmentwide accounting
system to the HI trust fund statements;
* develop written procedures that incorporate monitoring controls to
verify that the payroll expenditures charged against HCFAC are
reasonable and supported; and:
* develop written procedures in collaboration with HHS that
incorporate monitoring controls for preparing the joint annual HCFAC
report to help ensure reported amounts are accurate.
Agency Comments and Our Evaluation:
We provided a draft of this report to HHS and DOJ for review and
comment. Written comments from the HHS Assistant Secretary for
Legislation are reproduced in appendix III. DOJ indicated via e-mail
that it agreed with the findings and the four recommendations we made
to revise or develop written procedures that include documentation and
monitoring controls for HCFAC activities and reporting. While DOJ did
not provide written comments, it provided technical comments, as did
HHS, that we incorporated as appropriate. We made a total of 11
recommendations, 7 to HHS and 4 to DOJ.
Of the seven recommendations we made, in its written comments, HHS
generally agreed with five, disagreed with one, and did not address
the remaining recommendation. Specifically, HHS agreed with our
recommendation related to revising the Administration on Aging's
procedures for properly maintaining supporting documentation for HCFAC
expenditures and stated that it plans to incorporate these changes by
summer 2011. Also, HHS agreed with our recommendation to develop
written procedures for preparing the joint annual HCFAC report and
indicated that it has begun to work with DOJ to improve the Report
Completion Guide. In addition, HHS OIG agreed with our recommendation
to develop written procedures that incorporate monitoring controls for
staff hours related to HCFAC activities recorded in its workload
tracking systems and stated that it will incorporate these procedures
into its formal policies. Further, the Administration on Aging stated
its view that addressing our recommendation to develop written
procedures to verify that HCFAC payroll expenditures are reasonable
and supported would not provide material results to justify the
additional expense and workload. However, the Administration on Aging
agreed to explore other options to refine its HCFAC payroll
expenditures.
The Office of the General Counsel agreed and stated that it had
addressed our recommendation to develop written procedures that
incorporate monitoring controls for staff hours recorded in the
workload tracking system. It stated that on February 2, 2011, it
provided us procedures for properly accounting for HCFAC expenditures.
While we received procedures from the Office of the General Counsel,
these procedures did not address our finding. Instead, the procedures
discussed the transfer of payroll expenditures to the HCFAC account.
Therefore, we determined that this recommendation has not been
addressed.
CMS disagreed with our recommendation to revise procedures for
maintaining supporting documentation for HCFAC deposits and
expenditures, which include specifying the titles of staff responsible
for maintaining supporting documentation. CMS stated that the National
Archives and Records Administration does not require staff titles on a
standard form it prescribes for transferring records to approved
records facilities (SF-135) and that CMS requires staff to take
records retention training each year. CMS also stated it believes the
information maintained is sufficient to ensure accountability and
proper and consistent supporting documentation for HCFAC deposits and
expenditures. However, we continue to believe that CMS's policies and
procedures for documentation are insufficient, as they do not identify
the staff responsible for maintaining documentation as required by the
National Archives and Records Administration regulations.[Footnote 41]
Also, CMS stated that the creation of a new records retention system
for HCFAC records would be duplicative and unnecessary. We do not
believe that a new records retention system exclusively for HCFAC
records is necessary to achieve accountability for documentation
responsibilities. Rather, a modification to CMS's existing procedures
that identifies the responsible staff by title to show authority
levels for properly maintaining supporting documentation, help provide
continuity when staff change positions, and promote accountability
would be sufficient to address this shortcoming.
Lastly, in its comments, CMS did not address our remaining
recommendation to develop written procedures that incorporate
monitoring controls for HCFAC deposit information recorded in the
departmentwide accounting system. However, as we stated in the report,
CMS officials told us in February 2011 that they were in the process
of developing procedures that require the reconciliation of HCFAC
deposit information.
As we agreed with your office, unless you publicly announce the
contents of this report earlier, we plan no further distribution of it
until 30 days from the report date. At that time, we will send copies
to the Secretary of HHS, the Attorney General, and other interested
parties. The report will also be available at no charge on GAO's Web
site at [hyperlink, http://www.gao.gov].
If you or your staff have any questions about this report, please
contact me at (202) 512-9312 or dalykl@gao.gov. Contact points for our
Offices of Congressional Relations and Public Affairs may be found on
the last page of this report. GAO staff who made major contributions
to this report are listed in appendix IV.
Sincerely yours,
Signed by:
Kay L. Daly:
Director, Financial Management and Assurance:
[End of section]
Appendix I: Objectives, Scope, and Methodology:
The objectives of this review were to determine to what extent the
Department of Health and Human Services (HHS) and the Department of
Justice (DOJ) (1) took action to address the recommendations we made
in 2005 and (2) designed effective controls over reporting Health Care
Fraud and Abuse Control (HCFAC) program deposits and expenditures for
fiscal years 2008 and 2009[Footnote 42].:
To address the extent to which HHS and DOJ took action to address the
recommendations made in 2005, we:
* Obtained and reviewed documentation provided by HHS and DOJ such as
policies and procedures and the Report Completion Guide.
* Interviewed officials at HHS and DOJ including the Acting Deputy
Inspector General and the Assistant Director of the Executive Office
for United States Attorneys to identify actions to improve HCFAC
program operations.
To address the extent to which HHS and DOJ designed effective controls
over reporting HCFAC deposits and expenditures, we:
* Obtained and reviewed relevant HHS and DOJ policies and procedures
for reporting deposits and expenditures within each agency.[Footnote
43]
* Used criteria outlined in our Standards for Internal Control in the
Federal Government, specifically as it relates to control activities
and monitoring, to assess the effectiveness of controls over the
reporting of amounts related to deposits and expenditures. We applied
these standards to assess whether the design of the controls
documented in the policies and procedures reasonably assured accurate
and consistent reporting of HCFAC amounts in the joint annual HCFAC
report.[Footnote 44] We did not verify the validity or accuracy of the
reported amounts.
* Assessed the reliability of data used to select our nongeneralizable
samples by:
- tracing deposit control totals of the electronic databases to the
corresponding deposit line item totals reported in the HCFAC reports
and the Bureau of the Public Debt's Federal Hospital Insurance Trust
Fund (HI trust fund) statements;
- obtaining the funding decision memorandum detailing how the HCFAC
funds would be distributed between HHS and DOJ for fiscal years 2008
and 2009 to verify the HCFAC funds certified by HHS and DOJ officials;
- comparing amounts reported in the joint HCFAC reports to the
approved funding decision memorandum and comparing amounts from the
decision memorandum to the Office of Management and Budget (OMB)
documentation (Apportionment Schedule SF-132) to verify that the
amounts were made available;
- tracing total expenditure amounts to supporting documentation,
including electronic databases, billing packages, and intra-and
interagency agreements; and:
- reviewing existing information about the electronic data and the
systems that produced them.
We determined that the data were sufficiently reliable to select our
samples.
* Selected a nongeneralizable stratified random sample for each of the
deposit types (gifts and bequests, criminal fines, civil monetary
penalties, and penalties and multiple damages) that HHS and DOJ
reported a dollar amount greater than zero in the fiscal years 2008
and 2009 annual HCFAC reports. We selected a total of 47 deposit
transactions for fiscal year 2008 and 55 transactions for fiscal year
2009. Transaction selection criteria included various factors such as
dollar amounts and transaction volume. For the selected transactions,
we reviewed various sources of documentation depending on the type of
deposit to determine whether dollar amounts were accurately reported.
Examples of supporting documentation for deposits included check
registers; electronic fedwires;[Footnote 45] health care tracking
forms used to allocate deposit collections among the various health
care programs; judgment orders and agency letters identifying
applicable fines and penalties assessed; and collection system query
reports. These randomly selected transactions were designed to provide
additional details about the processing of those transactions and were
not intended to be representative of the universe of HCFAC
transactions. See appendix II for information about the universe of
transactions and our sampled items.
* Selected a nongeneralizable random sample of expenditures for each
of the agency components that were allocated HCFAC appropriation funds
as reported in the annual HCFAC reports for fiscal years 2008 and
2009.[Footnote 46] For the Centers for Medicare & Medicaid Services
(CMS) and the United States Attorneys Office (USAO), we obtained
electronic databases and selected a nongeneralizable stratified random
sample for those agency components. We selected a total of 63
transactions for fiscal year 2008 and 62 transactions for fiscal year
2009 related to payroll and nonpayroll expenditures. Transaction
selection criteria included various factors such as dollar amounts,
transaction volume, and source of information. For these transactions,
we reviewed various sources of documentation depending on the type of
expenditure to determine whether dollar amounts were accurately
reported and the use of funds were consistent with the Health
Insurance Portability and Accountability Act of 1996 (HIPAA). Examples
of supporting documentation for expenditures included workload
tracking system and payroll system query reports; time and attendance
reports; salary forms; invoices; contracts; and travel vouchers. These
randomly selected transactions were designed to provide additional
details about the processing of those transactions and were not
intended to be representative of the universe of HCFAC transactions.
See appendix II for information about the universe of transactions and
our sampled items.
* Performed additional procedures for HHS Office of Inspector General
(OIG) payroll transactions as this component received 67 percent and
42 percent of total HCFAC appropriations allocated for fiscal years
2008 and 2009, respectively. Specifically, we (1) obtained time
reports from workload tracking systems for all four OIG components
(Office of Audit Services, Office of Investigations, Office of
Evaluations and Inspections, and Office of Counsel to the Inspector
General) to determine if the projects identified as HCFAC were
properly classified; and (2) compared the number of hours in the
workload tracking systems to the number of hours in the HHS payroll
system to determine if the components' systems included hours for all
staff.
* Interviewed agency officials from HHS and DOJ including budget
analysts and financial specialists to obtain an understanding and
clarification of the processes used to report deposits to the HI trust
fund and appropriations from this fund, including related expenditures.
We conducted our work from February 2010 through May 2011 in
accordance with U.S. generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objectives. We believe
that the evidence obtained provides a reasonable basis for our
findings and conclusions based on our audit objectives.
[End of section]
Appendix II: Information about the Universe of Transactions and Our
Sampled Items:
During our review of fiscal years 2008 and 2009 Health Care Fraud and
Abuse Control (HCFAC) program activities, we selected nongeneralizable
samples to further understand the Department of Health and Human
Services (HHS) and the Department of Justice (DOJ) procedures for
HCFAC deposits and expenditures. For deposits, we stratified the data
and selected random transactions, as summarized in table 1 below, for
each of the deposit types authorized by the Health Insurance
Portability and Accountability Act of 1996 (HIPAA) for which HHS and
DOJ reported dollar amounts greater than zero in the fiscal years 2008
and 2009 HCFAC reports.
Table 1: Summary of Selected Deposit Transactions:
2008:
Line item: Criminal fines;
Universe of transactions: 200;
Total value of universe: $2,307,754;
Number of selected transactions: 10;
Total value of selected transactions: $1,650,768.
Line item: Civil monetary penalties[A];
Universe of transactions: 2,568;
Total value of universe: $13,613,590;
Number of selected transactions: 23;
Total value of selected transactions: $4,304,620.
Line item: Penalties and multiple damages[A];
Universe of transactions: 273;
Total value of universe: $559,988,531;
Number of selected transactions: 11;
Total value of selected transactions: $236,905,878.
Line item: Gifts and bequests;
Universe of transactions: 3;
Total value of universe: $25,847;
Number of selected transactions: 3;
Total value of selected transactions: $25,847.
Line item: Total;
Universe of transactions: 3,044;
Total value of universe: $575,935,722;
Number of selected transactions: 47;
Total value of selected transactions: $242,887,113.
2009:
Line item: Criminal fines;
Universe of transactions: 201;
Total value of universe: $620,888,618;
Number of selected transactions: 11;
Total value of selected transactions: $620,113,917.
Line item: Civil monetary penalties[A];
Universe of transactions: 2,610;
Total value of universe: $18,080,194;
Number of selected transactions: 25;
Total value of selected transactions: $6,184,843.
Line item: Penalties and multiple damages[A];
Universe of transactions: 260;
Total value of universe: $498,671,480;
Number of selected transactions: 12;
Total value of selected transactions: $477,294,549.
Line item: Gifts and bequests;
Universe of transactions: 7;
Total value of universe: $46,271;
Number of selected transactions: 7;
Total value of selected transactions: $46,271.
Line item: Total;
Universe of transactions: 3,078;
Total value of universe: $1,137,686,563;
Number of selected transactions: 55;
Total value of selected transactions: $1,103,639,580.
Source: GAO analysis of HHS and DOJ HCFAC data.
[A] Total value of selected transactions for civil monetary penalties
and penalties and multiple damages represent the absolute value for
these line items.
[End of table]
For expenditures, we selected samples from object classes that in
aggregate accounted for 50 percent or more of total obligations for
each component that received HCFAC funds. Based on dollar amounts, we
then selected random transactions, as summarized in table 2 below.
Table 2: Summary of Selected Expenditures Transactions:
2008:
Agency: Department of Health and Human Services:
Agency Component: Office of Inspector General;
Number of selected transactions: 5;
Value of selected transactions: $8,570,351;
Object classes selected: Other Contractual Services. Analytical
procedures performed for personnel payroll hours, as described in
appendix I.
Agency Component: Office of the General Counsel;
Number of selected transactions: 4;
Value of selected transactions: $855,515;
Object classes selected: Personnel Compensation and Other Contractual
Services.
Agency Component: Administration on Aging;
Number of selected transactions: 1;
Value of selected transactions: $909,997;
Object classes selected: Grants, Subsidies, and Contributions.
Agency Component: Centers for Medicare & Medicaid Services;
Number of selected transactions: 14;
Value of selected transactions: $11,906,880;
Object classes selected: Personnel Compensation and Other Contractual
Services.
Agency: Department of Justice:
Agency Component: United States Attorneys Office;
Number of selected transactions: 7;
Value of selected transactions: $3,635,898;
Object classes selected: Personnel Compensation and Rent,
Communications, and Utilities.
Agency Component: Civil Division[A];
Number of selected transactions: 12;
Value of selected transactions: $5,271,253;
Object classes selected: Personnel Compensation and Other Contractual
Services.
Agency Component: Criminal Division;
Number of selected transactions: 10;
Value of selected transactions: $427,156;
Object classes selected: Personnel Compensation;
Rent, Communications, and Utilities;
and Other Contractual Services.
Agency Component: Civil Rights;
Number of selected transactions: 10;
Value of selected transactions: $79,423;
Object classes selected: Personnel Compensation and Other Contractual
Services.
Total 2008:
Number of selected transactions: 63;
Value of selected transactions: $31,656,473.
2009:
Agency: Department of Health and Human Services:
Agency Component: Office of Inspector General;
Number of selected transactions: 5;
Value of selected transactions: $2,584,748;
Object classes selected: Other Contractual Services. Analytical
procedures performed for personnel payroll hours, as described in
appendix I.
Agency Component: Office of the General Counsel;
Number of selected transactions: 1;
Value of selected transactions: $6,695;
Object classes selected: Personnel Compensation.
Agency Component: Administration on Aging;
Number of selected transactions: 1;
Value of selected transactions: $646,773;
Object classes selected: Grants, Subsidies, and Contributions.
Agency Component: Centers for Medicare & Medicaid Services;
Number of selected transactions: 18;
Value of selected transactions: $72,241,840;
Object classes selected: Personnel Compensation and Other Contractual
Services.
Agency: Department of Justice:
Agency Component: United States Attorneys Office;
Number of selected transactions: 7;
Value of selected transactions: $3,642,137;
Object classes selected: Personnel Compensation and Rent,
Communications, and Utilities.
Agency Component: Civil Division[A];
Number of selected transactions: 10;
Value of selected transactions: $2,496,884;
Object classes selected: Personnel Compensation and Other Contractual
Services.
Agency Component: Criminal Division;
Number of selected transactions: 11;
Value of selected transactions: $478,988;
Object classes selected: Personnel Compensation;
Rent, Communications, and Utilities;
Other Contractual Services;
and Supplies and Materials.
Agency Component: Civil Rights;
Number of selected transactions: 9;
Value of selected transactions: $61,320;
Object classes selected: Personnel Compensation and Other Contractual
Services.
Total 2009:
Number of selected transactions: 62;
Value of selected transactions: $82,159,385.
Source: GAO analysis of HHS and DOJ HCFAC data.
[A] Samples selected for Civil Division also include transactions for
the Nursing Home and Elderly Justice Initiative.
[End of table]
[End of section]
Appendix III: Comments from the Department of Health and Human
Services:
Department Of Health & Human Services:
Office Of The Secretary:
Assistant Secretary for Legislation:
Washington, DC 20201:
May 3, 2011:
Kay L. Daly:
Director, Financial Management and Assurance:
U.S. Government Accountability Office:
441 G Street N.W.
Washington, DC 20548:
Dear Ms. Daly:
Attached are comments on the U.S. Government Accountability Office's
(GAO) draft report entitled: "Health Care Fraud And Abuse Control
Program: Improvements Needed in Controls Over Reporting Deposits and
Expenditures" (GAO 11-466).
The Department appreciates the opportunity to review this draft report
prior to publication.
Sincerely,
Signed by:
Jim R. Esquea:
Assistant Secretary for Legislation:
Attachment:
[End of letter]
General Comments Of The Department Of Health And Human Services (HHS)
On The Government Accountability Office's (GAO) Draft Report Entitled.
"Health Care Fraud And Abuse Control Program: Improvements Needed In
Controls Over Reporting Deposits And Expenditures" (GAO-11-446):
The Department appreciates the opportunity to comment on this draft
report.
GAO Recommendation No. 1:
We recommend that the Secretary of HHS direct the Administrator of CMS
to:
* revise procedures for properly maintaining supporting documentation
for HCFAC deposits and expenditures, to include specifying the titles
of staff responsible for maintaining supporting documentation;
* develop written procedures that incorporate monitoring controls for
HCFAC deposit information recorded in the departmentwide accounting
system, including reconciling the deposit data in this system to the
regional offices' data collection system.
Centers for Medicare and Medicaid Services (CMS) Response:
CMS disagrees with GAO's assertion that we have inadequate controls or
procedures regarding retention of HCFAC related records because we do
not explicitly identify the title of staff responsible for management
of such records. Standard Form 135, Records Transmittal and Receipt,
which is prescribed by the National Archives and Records
Administration (NARA), accompanies all records stored in an approved
facility, and includes the Agency contact name, office, and telephone
number, but NARA does not require staff titles. Each CMS component is
responsible for following all federal records retention policies for
its HCFAC-related functions. Also, all CMS employees are required to
take records retention training each year, and are responsible for
appropriately and consistently applying CMS' Records Management
guidelines. CMS believes the information it maintains is sufficient to
ensure accountability and proper and consistent supporting
documentation for HCFAC deposits and expenditures. CMS believes that
specifying the titles of particular CMS staff is unwarranted and that
creation of a new records retention system uniquely for HCFAC records
would be duplicative and unnecessary.
GAO Recommendation No. 2:
We recommend that the Secretary of MS direct the Assistant Secretary
for Aging to:
* revise the Administration on Aging's procedures for properly
maintaining supporting documentation for HCFAC expenditures, to
include specifying the titles of staff responsible for maintaining
supporting documentation and the location of records;
* develop written procedures that incorporate monitoring controls to
verify that the payroll expenditures charged against HCFAC are
reasonable and supported.
Administration on Aging (AoA) Response:
We agree with the first part of the recommendation, on the maintenance
of supporting documentation and will move forward to incorporate these
changes into our filing system by Summer 2011, to the extent feasible.
Concerning the second part of the recommendation, on developing
written procedures incorporating monitoring controls, we have used the
same approach to capture HCFAC payroll charges for more than a decade.
At the beginning of each year, AoA surveys each of the approximately
twenty-seven staff in Headquarters and the Regional Offices who work
on HCFAC activities to determine the percentage of time each
individual estimates that they will spend, on average, over the entire
year on HCFAC. The Accounting for Pay System (AFPS) is then used to
allocate the same estimated percentage of the person's pay to HCFAC
funding each pay period, regardless of the number of hours the person
actually works on HCFAC during those specific two weeks. The
percentages allocated for most staff are small”no more than ten to
twenty-five percent in most cases. In the aggregate this resulted in
FY 2008 in approximately 29%, or $879,607, of AoA's $3.1 million FY
2008 HCFAC allocation being used for personnel costs, a reasonable
percentage given that these dollars are used to provide administrative
and related support for AoA's Senior Medicare Patrol anti-fraud
education program.
AoA uses the Department's ITAS system to track actual hours worked by
employees, and this system does not have the ability to track hours
spent on one type of activity versus another. To implement the type of
controls that GAO recommends would therefore require the establishment
of a completely new, wholly separate tracking system from that used by
the Department for time and attendance purposes. Such a system would
require employees to track and log hourly HCFAC activity, to cumulate
and report that activity to a central tracking point of contact, and
then require this information to periodically be used to adjust the
labor distributions in the accounting system for each of those
individuals. While this approach could result in a more accurate
accounting, it would do so at a price of a very substantially
increased workload at every level disproportionate to the amount of
HCFAC funding received. Further, some time ago, AoA eliminated
requirements that employees sign in and out and keep a written record
of their time and attendance in connection with collective bargaining
agreements. AoA does not believe that the penny-wise approach favored
by GAO would have sufficiently material results as to justify the
additional expense and workload.
AoA is willing, however, to engage in exploratory discussions with
other Operating Divisions within the Department who may be faced with
similar situations”whether or not related to HCFAC dollars”to
determine if there are other approaches which might allow it either to
further refine the payroll charges or to further adjust a subsequent
year's estimated percent of time spent on HCFAC. If a less resource
intensive solution could be identified, AoA would be open to its
implementation.
GAO Recommendation No. 3:
We recommend that the Secretary of FIRS direct the Acting General
Counsel to:
* develop written procedures that incorporate monitoring controls for
the Office of the General Counsel staff hours related to HCFAC
activities captured in workload tracking systems, including the
reconciliation to staff hours captured in the departmentwide payroll
system.
Office of the General Counsel (OGC) Response:
At the time of this review, OGC did not have written procedures in-
place to clarify 1) its method of using Practice Manager (PM) workload
reports to transfer pay between non-HCFAC and HCFAC specific Common
Accounting Numbers (CANs) in the Department's Accounting For-Pay
System (AFPS) and 2) its corresponding reconciliation process.
Financial data reconciliation is common practice for government budget
staff as part of their regular duties/responsibilities as budget
analysts and thus routinely occurs in the absence of specific
documented procedures.
Nonetheless, prior to the issuance of this draft report, OGC developed
such policy guidance in order to detail its procedures for properly
accounting for its associated cost-of-work performed on behalf of
HCFAC. OGC provided this HCFAC Account Expenditures Policy Guidance to
GAO on February 2, 2011.
GAO Recommendation No. 4:
We recommend that the Secretary of FIRS develop written procedures in
collaboration with DOJ that incorporate monitoring controls for
preparing the joint annual HCFAC report to help ensure reported
amounts are accurate.
HHS Response:
The Department agrees that having written procedures, or guidance, for
the joint annual HCFAC report will work to ensure accurate reporting.
To further this goal, HHS and DOJ developed the Department of Health
and Human Services and Department of Justice Annual Report on the
Health Care Fraud and Abuse Control Program: Report Completion Guide
as part of the FY 2010 HCFAC Report process. DOJ shared this manual
with GAO in the fall of 2010. However, in response to this GAO report,
HHS and DOJ have been working collaboratively to improve the content
of this manual, specifically to ensure the accuracy of the numbers
included in the "Monetary Results" table of the annual HCFAC report.
The updated manual will include a detailed matrix that describes each
transfer or deposit figure included in the "Monetary Results" table of
the HCFAC report, which agency is responsible for reporting that
figure, the source of the data, and who is responsible for verifying
the final numbers published in the Annual Report. This report, or
guidance, will be distributed annually to all relevant FIRS Operating
Divisions as well as all relevant components within DOJ.
GAO Recommendation No. 5:
We recommend that the FIRS Inspector General (OIG) develop written
procedures that incorporate monitoring controls for FIRS OIG staff
hours related to HCFAC activities captured in workload tracking
systems, including the reconciliation to staff hours captured in the
departmentwide payroll system.
Office of Inspector General (OIG) Response:
HHS OIG concurs with this recommendation. OIG continues to assert that
our workload tracking accurately captures total staff hours and the
staff hours allocable to HCFAC-related activities. Nevertheless, HHS
OIG agrees to incorporate these implemented procedures into formal
written policies that will include reconciliation of overall staff
hours to the department-wide payroll system.
[End of section]
Appendix IV: GAO Contacts and Staff Acknowledgments:
GAO Contact:
Kay L. Daly, (202) 512-9312 or dalykl@gao.gov:
Staff Acknowledgments:
In addition to the contact listed above, Carla J. Lewis (Assistant
Director), Maria C. Belaval, Sharon O. Byrd, William L. Evans, Maria
Hasan, Christopher N. Howard, Jason S. Kirwan, Mitchell D. Owings, and
Nina M. Rostro made significant contributions to this report.
[End of section]
Footnotes:
[1] GAO, High-Risk Series: An Update, [hyperlink,
http://www.gao.gov/products/GAO-11-278] (Washington, D.C.: February
2011). Fraud represents intentional acts of deception with knowledge
that the action or representation could result in an inappropriate
gain. Waste includes inaccurate payments for services, such as
unintentional duplicate payments. Abuse represents actions
inconsistent with acceptable business or medical practices. An
improper payment is defined as any payment that should not have been
made or that was made in an incorrect amount (including overpayments
and underpayments) under statutory, contractual, administrative, or
other legally applicable requirements. It includes any payment to an
ineligible recipient, any payment for an ineligible service, any
duplicate payment, any payment for services not received, and any
payment that does not account for credit for applicable discounts. The
Office of Management and Budget (OMB) guidance also instructs agencies
to report payments for which insufficient or no documentation was
found as improper payments.
[2] For fiscal year 2010, HHS reported improper payment estimates for
the following programs: $34.3 billion for Medicare Fee-for-Service
(FFS); $13.6 million for Medicare Advantage; and $22.5 billion (the
estimated federal share) for Medicaid.
[3] See appendix III of GAO's audit report included in the fiscal year
2010 Financial Report of the United States Government accessible at
[hyperlink, http://www.fms.treas.gov/fr/index.html].
[4] Pub. L. No. 104-191, § 201, 110 Stat. 1936, 1992 (Aug. 21, 1996).
[5] The HI trust fund was established on July 30, 1965, as a separate
account in the U.S. Department of the Treasury. It is also known as
the Medicare Trust Fund. The HI trust fund finances the Medicare Part
A program, which helps pay for hospital, home health, skilled nursing
facility, and hospice care for the aged and disabled. All of the HI
financial operations are handled through this fund, including the
revenues and expenditures related to the HCFAC program as authorized
by HIPAA and other funding streams such as payroll taxes transferred
to the HI trust fund and net benefit payments.
[6] GAO, Health Care Fraud and Abuse Control Program: Results of
Review of Annual Reports for Fiscal Years 2002 and 2003, GAO-05-134
(Washington, D.C.: Apr. 29, 2005).
[7] HHS and DOJ, The Department of Health and Human Services and the
Department of Justice Health Care Fraud and Abuse Control Program
Annual Report For FY 2008 (Washington, D.C.: September 2009); and The
Department of Health and Human Services and the Department of Justice
Health Care Fraud and Abuse Control Program Annual Report For FY 2009
(Washington, D.C.: May 2010).
[8] GAO, Internal Control: Standards for Internal Control in the
Federal Government, [hyperlink,
http://www.gao.gov/products/GAO/AIMD-00-21.3.1] (Washington, D.C.:
November 1999).
[9] See 18 U.S.C. §§ 24(a), 1341.
[10] There are 94 offices throughout the United States, Puerto Rico,
the Virgin Islands, Guam, and the Northern Mariana Islands.
[11] The United States District Courts, which operate under the
Judicial Branch, and DOJ's United States Attorneys Office (USAO),
which operate under the Executive Branch, have different
responsibilities for the management of criminal debt. The collection
and management of criminal debt require the cooperation of both
branches of government. USAOs are statutorily responsible for the
enforcement of the collection of criminal debt, while the District
Courts receive payments of fines.
[12] The Executive Office for the United States Attorneys provides
general executive assistance and supervision to the USAOs, among other
functions.
[13] See, e.g., 42 U.S.C. §§ 1320a-7a, 1395i-3, & 1396r(h).
[14] 18 U.S.C. § 982(a)(7).
[15] We did not independently assess whether the reported zero deposit
amounts for asset forfeiture in the annual HCFAC reports for fiscal
years 2008 and 2009 were accurate.
[16] These suits can also be brought by private individuals, called
relators, under the False Claims Act, 31 U.S.C. §§ 3729-33. Relators
can be entitled to a portion of any court award or settlement, and
this relator's share is not included in the amount credited to the HI
trust fund.
[17] Pub. L. No. 107-273, § 11013, 116 Stat. 1758, 1823 (Nov. 2, 2002).
[18] Medicare Parts A and B are also known as Medicare fee-for-service
(FFS). Medicare Part A covers hospital and other inpatient stays and
Medicare Part B covers hospital outpatient, physician, and other
services. The Federal Supplementary Medical Insurance (SMI) Trust Fund
finances the Medicare Part B program.
[19] In general, restitutions restore the aggrieved party to its prior
state of well-being while compensatory damages reimburse the aggrieved
party for losses incurred.
[20] Collections such as these that represent a refund of erroneous
expenditures are credited back to the appropriation that was
originally charged for those expenditures. See, e.g., B-281064 (Feb.
14, 2000).
[21] HHS and DOJ may also conduct other health care fraud enforcement
activities using other annual appropriations.
[22] An allotment is an authorization by either the agency head or
another authorized employee to his/her subordinates to incur
obligations within a specified amount. Each agency makes allotments
pursuant to specific procedures it establishes in accordance with the
Office of Management and Budget (OMB) general apportionment
requirements. See OMB Circular No. A-11, Preparation, Submission, and
Execution of the Budget, Part 4 (November 2010).
[23] The IPAC System's primary purpose is to provide a standardized
interagency fund transfer mechanism for federal agencies. IPAC
facilitates the intra-governmental transfer of funds, with descriptive
data from one federal agency to another.
[24] Mandatory funding refers to budgetary resources that are
controlled by laws other than appropriations acts.
[25] Discretionary funding refers to budgetary resources that are
provided in annual appropriation acts, other than those that fund
mandatory programs. Discretionary funds appropriated to the HCFAC
account were transferred from the HI and SMI trust funds. Omnibus
Appropriations Act, 2009, Pub. L. No. 111-8, 123 Stat. 524, 773 (Mar.
11, 2009).
[26] Pub. L. No. 109-432, div. b, § 303, 120 Stat. 2922, 2992 (Dec.
20, 2006). In fiscal year 2010, the Patient Protection and Affordable
Care Act extended permanently the yearly increases to the HCFAC
account based on the change in the CPI-U.
[27] Pub. L. No. 111-148, § 6402(i), 124 Stat. 119, 760 (Mar. 23,
2010).
[28] Pub. L. No. 111-152, § 1303(a), 124 Stat. 1029, 1057 (Mar. 30,
2010).
[29] [hyperlink, http://www.gao.gov/products/GAO-05-134].
[30] In our 2005 report, we made a total of three recommendations. One
of the three recommendations included two parts, which for purposes of
this report, we identify as two separate recommendations, making a
total of four.
[31] The sample selections were not designed to be representative of
the universe of HCFAC transactions, but rather to provide anecdotal
information. For this purpose, we selected a total nongeneralizable
sample of 102 HCFAC deposits for fiscal years 2008 and 2009 and a
total nongeneralizable sample of 125 HCFAC expenditures for fiscal
years 2008 and 2009. For additional information about our sampling
methodology, see appendix II.
[32] Policies and procedures reviewed for HHS included OIG and the
Office of the General Counsel records management plans, and the
Administration on Aging's retention policy for the Office of Budget
and Finance. CMS policies and procedures reviewed included: CMS
Records Schedule, General Records Schedule 6: Accountable Officers'
Accounts Records, and policies for purging files issued by the Office
of Strategic Operations and Regulatory Affairs.
[33] DOJ policies and procedures reviewed included: USAP 3-11.310.001
Internal Controls for Processing Payments Received for Civil Debts and
Criminal Impositions--Retention of Records and Financial Management
Policies and Procedures Bulletin 00-15 Accounting for Financial
Obligations Within the Offices, Boards and Divisions (OBDs).
[34] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1].
[35] HHS and DOJ transmit HCFAC collection information to the Bureau
of the Public Debt, which has responsibility for administering the HI
trust fund. The Bureau of the Public Debt transfers from the Treasury
General Fund to the HI trust fund an amount equal to the sum of fines,
penalties, and other designated monies collected from health care
investigations.
[36] The Office of Financial Management utilizes the ASPEN Enforcement
Manager (AEM) and Financial Accounting Control System (FACS) to
allocate and record payments received. AEM enables CMS regional
offices to manage all tasks related to nursing home enforcement. FACS
accumulates all of CMS's financial activities, both programmatic and
administrative, in its general ledger.
[37] Debt Collection Management Staff within the Justice Management
Division is responsible for establishing policies related to federal
debt collection efforts, operating the department's central intake
facility for civil debt collections, and performing debt accounting
operations.
[38] DOJ collects payments for penalties and multiple damages from
debtors and uses its financial system to record these collections. DOJ
is entitled to keep 3 percent of all payments collected in its Working
Capital Fund for paying the costs of processing and tracking civil and
criminal debt collection litigations.
[39] HIPAA does not specify how costs are to be charged against the
HCFAC account. HHS and DOJ components use different processes for
charging payroll costs against HCFAC funds. For example, some
components within HHS and DOJ charged 100 percent of staff hours to
HCFAC while others charged a percentage of total staff hours based on
estimated or actual performance. To accomplish this, HHS and DOJ
components calculated estimates based on prior year performance or
used their workload tracking systems to monitor actual hours spent on
HCFAC activities.
[40] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1].
[41] The National Archives and Records Administration regulations
require each agency to develop internal policies and procedures to
ensure proper maintenance of records. These regulations also indicate
that agency programs must develop recordkeeping requirements that
include identification of the location of the records and the staff
responsible for maintaining the records. See 36 C.F.R. § 1220.34 and
subpart 1222.B.
[42] [hyperlink, http://www.gao.gov/products/GAO-05-134].
[43] HHS policies and procedures obtained and reviewed included the
Office of Investigations Policies and Procedures Manual; collection
procedures for civil monetary penalties; and policies for records
management. DOJ policies and procedures obtained and reviewed included
Financial Management Policies and Procedures Bulletins 08-02, 08-01,
05-15 and 00-15, and United States Attorneys Office Procedures 3-
11.120.001, 3-11.120.002, and 3-11.310.001. For both agencies, we also
obtained and reviewed the different information system user manuals
such as accounting systems, collection systems, and workload tracking
systems.
[44] [hyperlink, http://www.gao.gov/products/GAO/AIMD-00-21.3.1].
[45] Fedwire is the Federal Reserve's real-time gross settlement
system that enables participants to initiate large-value funds
transfer that are immediate, final, and irrevocable once processed.
[46] HHS components included the Office of Inspector General (OIG),
Centers for Medicare & Medicaid Services (CMS), Office of the General
Counsel, and Administration on Aging. DOJ components included United
States Attorneys Office (USAO), Civil Division, Criminal Division, and
Civil Rights Division.
[End of section]
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of newly
posted products every afternoon, go to [hyperlink, http://www.gao.gov]
and select "E-mail Updates."
Order by Phone:
The price of each GAO publication reflects GAO‘s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO‘s Web site,
[hyperlink, http://www.gao.gov/ordering.htm].
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional
information.
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Ralph Dawn, Managing Director, dawnr@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548:
