Health Care Fraud and Abuse Control Program: Improvements Needed in Controls over Reporting Deposits and Expenditures
Published: 2011-05-10T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: To help combat fraud and abuse in health care programs, including Medicare and Medicaid, Congress enacted the Health Care Fraud and Abuse Control (HCFAC) program as part of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). HIPAA requires that the Departments of Health and Human Services (HHS) and Justice (DOJ) issue a joint annual report to Congress on amounts deposited to and appropriated from the Federal Hospital Insurance (HI) Trust Fund for the HCFAC program. In April 2005, GAO reported on the results of its review of HCFAC program activities for fiscal years 2002 and 2003 and made recommendations to HHS and DOJ. The objectives of this requested review were to assess the extent to which HHS and DOJ (1) took actions to address the recommendations made in the 2005 report and (2) designed effective controls over reporting HCFAC deposits and expenditures for fiscal years 2008 and 2009. GAO reviewed HHS and DOJ documentation; selected nongeneralizable samples; and interviewed agency officials.
section_title: What GAO Found
paragraphs: Although HHS and DOJ have taken action to address our previous recommendations aimed at improving procedures for recording HCFAC expenditures and issuing the annual HCFAC report, GAO found that controls are not sufficient to ensure that the report is accurate and supported. HHS and DOJ took action to address three of the four recommendations in GAO's 2005 report related to recording staff hours in agency workload tracking systems, using the appropriate account class to record HCFAC expenditure data, and expediting the review process for issuing the annual HCFAC report. Neither agency agreed with the remaining recommendation to notify Congress on delays in issuing the HCFAC report within 1 month after missing the mandated January 1 deadline and thus, did not take action. However, in June 2010, HHS and DOJ implemented an expedited review process for completing the HCFAC report. The fiscal year 2010 HCFAC report was issued on January 24, 2011, 23 days later than the mandated reporting date. According to DOJ officials responsible for preparing the HCFAC report, they intend to use this new expedited review process to meet the mandated deadline when preparing future year reports. Regarding the design of controls, while HHS and DOJ had designed polices and procedures for documentation that generally required the retention of documentation for 6 years, these did not provide sufficient controls to ensure adequate support of HCFAC deposits and expenditures, in accordance with internal control standards. (1) Components at both HHS and DOJ that manage HCFAC activities did not include in their respective policies and procedures controls that specified the person responsible for maintaining the records, the location of records, or a combination of both. (2) GAO found instances at HHS and DOJ where documentation could not be provided to support HCFAC expenditures, such as time and attendance reports. Also, both agencies did not have sufficient monitoring controls such as reconciliations, comparisons, and supervisory reviews, as outlined in internal control standards, to ensure accurate reporting of HCFAC deposits and expenditures. As a result, GAO found instances where data recorded in accounting and payroll systems were inconsistent with other sources such as the HI trust fund statements and agency workload tracking systems. GAO also identified presentation errors in the 2008 and 2009 annual HCFAC reports. For example, in reviewing the line item for restitution and compensatory damages, GAO found that $717 million (70 percent) of the $1.03 billion reported in the fiscal year 2009 HCFAC report was not transferred to the HI trust fund as stated in the report. These amounts, primarily related to Medicare Part B and Medicaid, were transferred to the Federal Supplementary Medical Insurance Trust Fund and the Medicaid appropriation account as required. These inaccuracies overstated the amount of funds transferred to the HI trust fund.
section_title: What GAO Recommends
paragraphs: GAO makes 11 recommendations to HHS and DOJ to revise or develop written procedures that include documentation and monitoring controls for HCFAC activities and reporting. DOJ agreed with all four of its recommendations. Of the seven recommendations to HHS, it generally agreed with five, disagreed with one, and did not address the remaining recommendation.

section_title: Letter
paragraphs: We have designated Medicare and Medicaid as high risk programs because  they are particularly vulnerable to fraud, waste, and abuse and improper  payments. Medicare is considered high risk in part because of its  complexity and susceptibility to improper payments, and Medicaid  because of concerns about the adequacy of its fiscal oversight to prevent  inappropriate spending. In 2010, Medicare covered 47 million elderly and  disabled beneficiaries and had estimated outlays of $509 billion. Medicaid,  a federal-state program, covered over 69 million low-income people and  consists of more than 50 distinct state-based programs that cost the  federal government and states an estimated $408 billion in fiscal year 2010.  For fiscal year 2010, the Department of Health and Human Services (HHS)  estimated improper payments for the Medicare and Medicaid programs at  about $70.4 billion, comprising 56 percent of the estimated $125.4 billion  in governmentwide improper payments, as reported by federal agencies.
To help combat fraud and abuse in health care programs such as Medicare  and Medicaid, Congress enacted the Health Care Fraud and Abuse Control  (HCFAC) program as part of the Health Insurance Portability and  Accountability Act of 1996 (HIPAA). HHS and the Department of Justice  (DOJ) jointly administer the HCFAC program. HIPAA requires that HHS  and DOJ issue a joint annual report to Congress no later than January 1 of  each year on (1) amounts deposited to the Federal Hospital Insurance  Trust Fund (HI trust fund) pursuant to HIPAA (HCFAC deposits) for the  previous fiscal year and the source of such amounts and (2) amounts  appropriated from the HI trust fund for HCFAC activities each year and  the justification for the expenditure of such amounts.
In April 2005, we reported on the results of our review of HCFAC-related  activities for fiscal years 2002 and 2003. In that report, we made  recommendations to HHS and DOJ to improve procedures for recording  HCFAC expenditures and issuing the annual HCFAC report. You requested  that we provide an update on the status of the recommendations in our  April 2005 report and review controls over the reporting process for  amounts included in the fiscal years 2008 and 2009 HCFAC reports. As  agreed with your office, the objectives of our review were to assess the  extent to which HHS and DOJ (1) took actions to address the  recommendations we made in 2005 and (2) designed effective controls  over reporting HCFAC deposits and expenditures for fiscal years 2008 and  2009.
To address the first objective, we reviewed supporting documentation  provided by HHS and DOJ such as policies and procedures and  interviewed officials at HHS and DOJ, including the HHS Acting Deputy  Inspector General and the Assistant Director of the Executive Office for  United States Attorneys, to obtain further information on actions taken. To  address the second objective, we obtained and reviewed relevant HHS and  DOJ policies and procedures for reporting deposits and expenditures  within each agency and used criteria outlined in our Standards for  Internal Control in the Federal Government to assess the effectiveness of  the controls documented in these policies and procedures. To further our  understanding of these controls, we selected a nongeneralizable stratified  random sample for deposits of 47 transactions for fiscal year 2008 and 55  transactions for fiscal year 2009. We also selected a nongeneralizable  random sample for expenditures of 63 transactions for fiscal year 2008 and  62 transactions for fiscal year 2009. Expenditure samples were selected for  each of the agency components that were allocated HCFAC appropriation  funds as reported in the annual HCFAC reports for fiscal years 2008 and  2009. The sample selections were designed to provide additional details  about the processing of those transactions and were not intended to be  representative of the universe of HCFAC transactions. For the selected  transactions, we reviewed supporting documentation such as check  registers, time and attendance reports, and contracts to determine  whether dollar amounts for these transactions were accurately reported  and the use of funds were consistent with HIPAA. We also performed  additional procedures for HHS Office of Inspector General (OIG) payroll  transactions to determine if HCFAC projects were properly classified and  workload tracking systems included hours for all staff. In addition, we  conducted interviews with HHS and DOJ officials including budget  analysts and financial specialists to obtain an understanding and  clarification of the processes in place to report HCFAC deposits and  expenditures. See appendix I for additional details on our objectives,  scope, and methodology.
We conducted our work from February 2010 through May 2011 in  accordance with U.S. generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: HIPAA authorized the HCFAC program to consolidate and strengthen  ongoing efforts to combat fraud and abuse in health care programs and  increase resources for fighting health care fraud. The Secretary of HHS,  through the HHS OIG, and the Attorney General, administer the HCFAC  program. The HCFAC program goals are to:  coordinate federal, state, and local law enforcement efforts to control  fraud and abuse associated with health plans; conduct investigations, audits, and other studies of delivery and  payment for health care for the United States; facilitate the enforcement of the civil, criminal, and administrative  statutes applicable to health care;   provide guidance to the health care industry, including the issuance of  advisory opinions, safe harbor notices, and special fraud alerts; and establish a national database of adverse actions against health care  providers.
Figure 1 below provides an overview of the HCFAC funding stream,  including the related deposits, the allocation of appropriated funds to  carry out federal health care law enforcement activities, and the reporting  mandate.
The types of collections deposited to the HI trust fund and appropriations  from this fund, including related expenditures are discussed below.
subsections: section_title: Deposits to the HI Trust Fund
paragraphs: Criminal fines. DOJ prosecutes entities or persons that are involved in  commission of a federal health care offense, such as mail fraud related to a  health care program. Courts assess criminal fines upon which the  criminal debtor is ordered to submit payment(s) to the United States  District Court where the case was prosecuted. Each District Court  coordinates with DOJ’s local United States Attorneys Office (USAO)  to  communicate collections received. The Executive Office for United  States Attorneys report collection data on a quarterly basis to the Bureau  of the Public Debt for deposit into the HI trust fund.
Civil monetary penalties. The Social Security Act authorizes the  Secretary of HHS to impose civil monetary penalties for improper claims  and other violations by health care providers, facilities, and other parties.  Centers for Medicare & Medicaid Services (CMS) regional offices impose  some civil monetary penalties. CMS’s Office of Financial Management  collects the civil monetary penalties imposed on behalf of the Secretary of  HHS and allocates payments received based on information the regional  offices record in their data collection system. The Office of Financial  Management reports collections for civil monetary penalties on a daily  basis to the Bureau of the Public Debt for deposit into the HI trust fund.
Forfeitures of property. DOJ prosecutions of entities or persons that  are involved in a federal health care offense can result in the forfeiture of  property. HHS and DOJ reported no property forfeitures creditable to the  HI trust fund under HIPAA in the HCFAC reports for fiscal years 2008 and  2009.
Penalties and multiple damages. Courts can impose penalties and  multiple damages as a result of HHS and DOJ civil suits against those who  have knowingly made false health care claims against the government,  such as submitting claims for medical services that were not provided. Of  all civil debt collections received, DOJ is entitled to keep 3 percent in its  Working Capital Fund for expenses incurred in processing and tracking  civil and criminal debt collection litigations. Both CMS and DOJ report  collections for penalties and multiple damages on a continuous basis to  the Bureau of the Public Debt for deposit into the HI trust fund.
Gifts and bequests. CMS occasionally receives gifts and bequests and  equally splits the amount received between its Medicare Part A and  Medicare Part B programs. Gifts and bequests are donations received  from individuals or entities, usually in the form of checks. Upon receipt of  a donation, CMS records the amount in its accounting system and reports  it to the Bureau of the Public Debt for deposit into the HI trust fund.
In addition to the types of deposits authorized by HIPAA and discussed  above, HHS and DOJ report other types of collections in connection with  health care fraud activities such as HHS OIG audit disallowances and  court-awarded restitution and compensatory damages. These types of  collections represent amounts recovered by HHS and DOJ as a result of  health care enforcement activities. These amounts are returned to the HI  trust fund to the extent that they represent repayments to Medicare.
section_title: Appropriations from the HI Trust Fund and Related Expenditures
paragraphs: Funds for the HCFAC program are appropriated from the HI trust fund to  an expenditure account, referred to as the Health Care Fraud and Abuse  Control Account (HCFAC account) maintained within the HI trust fund.  Annually, the HHS Secretary and the Attorney General jointly certify  amounts appropriated from the HI trust fund to the HCFAC account as  necessary to finance health care fraud and abuse control activities based  on statutory limits. HIPAA, as amended, prescribes the maximum amount  that may be certified in a given fiscal year. Any unexpended amounts are  carried forward to the next fiscal year. Once HCFAC funds have been  certified, CMS’s Division of Accounting Operations performs the  accounting for appropriations transferred to the HCFAC account. CMS  makes funds available by creating allotments in its accounting system to  fund related HCFAC expenditures. CMS provides funds to other HHS  components and DOJ through intra- and interagency agreements, as  shown in figure 1. This process requires HHS and DOJ to bill CMS through  the Intra-governmental Payment and Collection (IPAC) System to obtain  payment from their allocation of HCFAC funds. In addition to CMS’s  central accounting for HFCAC funds, both HHS and DOJ components have  processes to separately manage their allotted HCFAC amounts. In general,  these processes include authorizing HCFAC-related expenditures,  recording applicable payroll and nonpayroll expenditures incurred to a  designated HCFAC code, and reporting any unexpended amounts to be  carried forward to the next fiscal year.
For fiscal year 2009, the Secretary of HHS and the Attorney General  certified $266.4 million in mandatory funding to be appropriated from the  HI trust fund to the HCFAC account. Additionally, Congress appropriated  $198 million in discretionary funding to that account in response to HHS’s  fiscal year 2009 budget request, to fund HCFAC program integrity  activities. As such, the total appropriated amount to the HCFAC account  for fiscal year 2009 was $464.4 million for that year. Figure 2 provides a  historical trend of the amounts appropriated to the HCFAC account over  the past 13 fiscal years.
Funds were first appropriated to HCFAC in fiscal year 1997. HIPAA limited  the amounts appropriated for fiscal years 1998 through 2003 to an amount  equal to the limit for the preceding fiscal year plus an additional 15  percent. For fiscal years 2004 through 2006, the amount made available  was capped at the 2003 limit. The Tax Relief and Health Care Act (TRHCA)  also allowed for yearly increases to the HCFAC account based on the  change in the consumer price index for all urban consumers (CPI-U) over  the previous fiscal year for fiscal years 2007 through 2010. In fiscal year  2006, TRHCA amended HIPAA so that funds allotted from the HCFAC  account are available until expended. Beyond 2010, the Patient  Protection and Affordable Care Act, as amended by the Health Care and  Education Reconciliation Act of 2010, raised the limit on funds that may  be certified for the HCFAC account by the Secretary of HHS and the  Attorney General by an additional $350 million over the next 10 years,  beginning in fiscal year 2011.
The annual allocation of appropriation amounts to the HHS and DOJ  components are intended to support a variety of anti-fraud and anti-abuse  activities. For example, in May 2009, HHS and DOJ established a task  force—the Health Care Fraud Prevention and Enforcement Action Team  (HEAT)—comprised of top level law enforcement and professional staff  from both agencies to prevent health care fraud and enforce current anti- fraud laws around the country. Other examples include HHS OIG  investigations, audits, and evaluations that identify vulnerabilities for  questionable or fraudulent financial practices related to Medicaid  outpatient prescription drug expenditures and Medicare contractor costs.  Similarly, DOJ’s USAOs use HCFAC funding to support civil and criminal  health care fraud and abuse litigation. HCFAC funds are also used to train  attorneys, investigators, and auditors in the investigation and prosecution  of health care fraud and abuse; prosecute health care matters through  criminal, civil, and administrative proceedings; and conduct investigations,  financial, and performance audits of health care programs, inspections,  and other evaluations.
section_title: Agencies Took Action to Address Three of Four GAO Recommendations
paragraphs: In our April 2005 report, we identified weaknesses related to not properly  capturing certain expenditure data in agency information systems, non- adherence to accounting policy for select HCFAC expenditures, and  lengthy HCFAC report review processes. We made recommendations to  HHS and DOJ to improve procedures for recording HCFAC expenditures  and issuing the annual HCFAC report. Based on our analysis of  documentation, HHS and DOJ took actions that addressed three of the  four recommendations. Both agencies disagreed with our  recommendation to notify Congress on delays in issuing the HCFAC report  by the mandated deadline and thus, did not take action. Each of the  recommendations and applicable actions taken are described further  below.
Record staff hours in workload tracking systems. In our 2005 report,  we found that two HHS OIG components—Office of Evaluations and  Inspections and Office of Investigations—had not recorded all staff hours  in their workload tracking systems, which are used to monitor actual  hours spent on HCFAC activities. HHS OIG uses the workload tracking  systems to monitor HCFAC payroll expenditures, and incomplete  information could hinder those efforts. We recommended that the HHS  Inspector General require all HHS OIG components to develop procedures  for ensuring that all key staff hours spent on HCFAC activities are  recorded in the HHS OIG workload tracking systems. In April 2006, the  HHS OIG’s Office of Evaluation and Inspections updated its procedures for  entering information into its workload tracking system, including guidance  related to the completion of timesheets. The procedures instruct  employees to record time to specific inspection codes and instruct  managers to review staff time recorded in the system. In addition, HHS  OIG’s Office of Investigations updated its procedures in October 2009,  which require all Office of Investigations personnel to record time and  attendance in its workload tracking system. We determined that HHS OIG  components’ actions substantially addressed the recommendation.
Record expenditure data under the correct account class. In our  2005 report, we noted that only one of the four DOJ components receiving  HCFAC funds properly recorded expenditures as required by DOJ policies  and procedures. We recommended that the Attorney General develop  monitoring procedures to ensure that DOJ components record key HCFAC  program expenditure data under the appropriate HCFAC account class in  DOJ’s accounting system. In April 2005, DOJ updated its policies and  procedures that require individual components to monitor obligations  recorded in the accounting system on a quarterly basis. Further, in fiscal  year 2009 the Executive Office for the United States Attorneys provided  procedures to the USAOs, which receive the largest portion of the HCFAC  allocation, on how to charge HCFAC expenditures using the proper  program code. According to DOJ officials, component officials review  system reports on a regular basis to verify that HCFAC obligations and  expenditures are correctly reflected in the accounting system. We  determined that DOJ’s actions were sufficient to close the  recommendation.
Develop a more expedited review process. In our 2005 report, we  noted that a lengthy review process within HHS and DOJ resulted in  failure to meet the mandated annual January 1 deadline for reporting  HCFAC activities. For example, the fiscal year 2003 HCFAC report, the  most recent report at the time of that review, was issued 1 year after the  mandated reporting date. We recommended that the Secretary of HHS and  the Attorney General develop a more expedited review process for the  joint annual HCFAC reports. In June 2010, DOJ issued a Report  Completion Guide, an expedited review process that provides instructions  and time frames for submitting information to complete the annual  HCFAC report. The guide introduced a new process whereby DOJ and  HHS components utilized a shared website to distribute documents for  edit and review. The guide also established time frames for issuing the  fiscal year 2010 HCFAC report by January 1, 2011. Using these new time  frames, HHS and DOJ jointly issued the fiscal year 2010 HCFAC report on  January 24, 2011, only 23 days later than the mandated reporting date.  According to DOJ officials responsible for preparing the HCFAC report,  they intend to use these time frames to meet the mandated deadline when  preparing future year reports. We determined that HHS and DOJ’s efforts  meet the intent of our recommendation. However, as discussed later in  this report, although timeliness is important, ensuring that the report is  accurate and reliable remains a concern.
Notify Congress of delays in report issuance. In our 2005 report, we  noted that repeated delays in issuing the joint annual HCFAC report  impact the relevance of the data being reported. We recommended that the  Secretary of HHS and the Attorney General notify congressional oversight  committees of delays in issuing the annual report within 1 month of  missing the January 1 deadline. HHS and DOJ did not concur with this  recommendation. However, as we stated above, both HHS and DOJ  developed and implemented a new timeline of dates to edit and review the  annual HCFAC report, which resulted in issuing the fiscal year 2010 annual  HCFAC report within one month of the mandate. Continuing to take steps  to meet these internal deadlines will be necessary to issue the HCFAC  report by the mandated deadline to provide timely, relevant information to  Congress.
section_title: HHS and DOJ Have Gaps in Documentation and Monitoring Controls over Reporting HCFAC Deposits and Expenditures
paragraphs: Our review of HHS and DOJ policies and procedures showed that both  agencies had not designed sufficient controls to help ensure that HCFAC  deposits and expenditures were accurately reported. GAO’s Standards for  Internal Control in the Federal Government provides that management  should establish control mechanisms and activities, and monitor and  evaluate these controls. Specifically, during our review we found that HHS  and DOJ did not have sufficient controls in their policies and procedures  with respect to (1) maintaining and retaining supporting documentation  for HCFAC deposits and expenditures and (2) monitoring HCFAC deposits  and expenditures to help ensure accurate reporting. From our review of  the underlying documentation to support HCFAC activities and  nongeneralizable samples of deposits and expenditures, we identified  instances in which these design deficiencies resulted in HHS’s and DOJ’s  inability to support reported amounts for HCFAC expenditures. We also  found errors in reported HCFAC amounts.
subsections: section_title: Documentation Controls Insufficient to Fully Support HCFAC Deposits and Expenditures
paragraphs: While HHS and DOJ designed controls that were incorporated into its  policies and procedures generally requiring the retention of  documentation for 6 years, the policies and procedures for CMS,  Administration on Aging, and DOJ did not provide sufficient details with  respect to where these documents were to be filed, who should be  responsible for maintaining them, or a combination of both, which would  help ensure accountability and adequate support of HCFAC deposits and  expenditures. Our review found that while the HHS OIG and the Office of  the General Counsel policies and procedures for documentation contained  sufficient controls as to the type of documentation to be retained, the  retention period, the location of records, and the person responsible for  maintaining the records, CMS and Administration on Aging policies and  procedures were lacking some of these controls. Specifically, CMS  policies and procedures for documentation of HCFAC deposits and  expenditures, did not identify the person responsible for maintaining  supporting documents. We found the same weakness with Administration  on Aging policies and procedures for documentation of HCFAC  expenditures. Further, Administration on Aging policies and procedures  did not specify where those documents should be filed. Officials from the  Administration on Aging told us that they are in the process of revising  their policies and procedures to address these issues. In its comments,  Administration on Aging indicated that it expects to incorporate these  changes by summer 2011.
We also reviewed DOJ’s controls for retention of documents related to  HCFAC deposits and expenditures. DOJ’s procedures for deposits  identified controls related to the type of documentation to be retained, the  retention period, and the location of records, but they did not specify the  person responsible for maintaining supporting documents. Although DOJ’s  departmentwide expenditure procedures identified controls related to the  type of documentation and the retention period, and indicated that  documents should be maintained in the obligation file, the procedures did  not specify the location of the obligation file and the person responsible  for maintaining the records within each office.
During our review, we found instances at HHS and DOJ where  documentation was not available to support expenditures. For example,  we found that HHS’s Administration on Aging did not maintain, and  therefore could not provide, underlying documentation to support how the  estimated payroll percentages for fiscal years 2008 and 2009 were derived,  which are used to charge payroll expenditures against the HCFAC account  on a biweekly basis. In fiscal year 2008, for example, the Administration on  Aging charged approximately 29 percent of its total HCFAC allocation, or  $879,607, to payroll expenses, an amount that could not be fully supported  due to the lack of documentation. Therefore, we were unable to verify the  justification of such expenditures. In addition, during our review, we  found that DOJ could not provide sufficient documentation to support 12  nongeneralizable payroll sample items selected for fiscal years 2008 and  2009, such as time and attendance reports, workload tracking system  reports, and records of actual payroll disbursements.
Further, DOJ could not provide documentation to support unexpended  amounts carried forward from fiscal year 2008 to fiscal year 2009, totaling  $522,278. At the end of each fiscal year, DOJ communicates to HHS the  amount of unused funds so that HHS can carry them forward to the  following fiscal year via an interagency agreement. To report this amount,  DOJ’s Justice Management Division compiles obligation data provided by  the different DOJ components. However, DOJ’s Justice Management  Division could not locate the documents that supported the amount of  funds carried forward in the fiscal year 2009 interagency agreement.
GAO’s Standards for Internal Control in the Federal Government  provides that internal control be designed to ensure that all transactions  and other significant events be clearly documented and the documentation  be readily available for examination. The standards also provide that  records should be properly managed and maintained and documentation  should appear in management directives, administrative policies, or  operating manuals. Insufficient controls over documentation increase the  risk of not having sufficient support to ensure reported HCFAC amounts  are accurate and funds are spent as intended.
section_title: Monitoring Controls Insufficient to Help Ensure Accurate Reporting of HCFAC Deposits and Expenditures
paragraphs: HHS’s and DOJ’s procedures did not incorporate sufficient monitoring  controls to help ensure HCFAC deposits and expenditures were accurately  reported.
Monitoring of deposits. HHS and DOJ had not designed controls to  require the reconciliation of HCFAC deposits recorded in their  departmentwide accounting systems to data collection systems or to the  HI trust fund statements. Specifically, CMS did not have written  procedures that required the reconciliation of civil monetary penalty  amounts in the CMS regional offices’ data collection system to CMS’s  accounting system. We found two instances from our fiscal year 2009  nongeneralizable sample of deposits where CMS regional offices had made  adjustments that were recorded in their data collection system, but not  communicated to the Office of Financial Management for recording in  CMS’s accounting system, which is used as a source to compile the data  for the HCFAC report. These two instances resulted in a $15,066  overstatement error in CMS’s accounting system, which CMS officials  corrected after we brought the errors to their attention. Although CMS  officials stated that they reconcile the data maintained in both systems on  a monthly basis, they were not able to provide us an example of these  reconciliation reports. In February 2011, CMS officials told us that they  were in the process of developing procedures for the Office of Financial  Management to require these reconciliations.
In addition, DOJ’s Justice Management Division did not have written  procedures that included controls to reconcile deposits of the 3 percent  portion of penalties and multiple damages reported in the HI trust fund  statements to the agency’s accounting system records. For example, for  fiscal year 2009 we identified an overstatement in the amount of $596,266  in the HI trust fund statements when comparing to DOJ’s records. When  we inquired about the difference, DOJ officials from the Justice  Management Division confirmed that an overstatement had occurred  because of adjusting entries that had been communicated to the Bureau of  the Public Debt but not captured in the HI trust fund statements. In  February 2011, DOJ officials told us that to avoid this from happening in  the future, they were in the process of developing procedures that would  include monitoring controls for reconciling on a quarterly basis penalties  and multiple damages between DOJ records and the statements issued by  the Bureau of the Public Debt to ensure reported amounts are accurate  and consistent between both agencies.
Monitoring of expenditures. Similarly, certain HHS components and  DOJ did not have written procedures that incorporated controls for  reconciling or comparing HCFAC staff hours to verify the accuracy of  payroll expenditures charged against the HCFAC account. Specifically,  HHS’s Administration on Aging did not have controls for monitoring  HCFAC actual payroll hours. HHS’s Administration on Aging charges  payroll expenditures based on estimates made prior to or after the  beginning of the year. Because the Administration on Aging does not  record hours at the HCFAC activity level, it cannot verify that the payroll  expenditures charged against the HCFAC account throughout the year are  reasonably accurate. According to officials at the Administration on Aging,  they believe that tracking hours at the HCFAC activity level would not be  cost effective nor provide better results to justify the costs. However,  because the estimated percentage of time charged against the HCFAC  account may not represent the actual time spent on HCFAC activities for a  given pay period, it is critical that some type of monitoring procedures or  verification procedures are designed to help ensure that the payroll  expenditures charged to the HCFAC account are reasonable and  supported. DOJ’s Civil Rights Division also charges HCFAC payroll  expenditures based on estimates. Although Civil Rights Division officials  indicated that they track and record actual hours and make adjustments to  payroll expenditures if differences are noted, these controls were not  documented in DOJ’s policies and procedures.
In addition, HHS OIG and the Office of the General Counsel for HHS, as  well as DOJ USAO and Civil Division, did not have written procedures that  included controls for reconciling or comparing HCFAC hours recorded in  workload tracking systems to departmentwide payroll or accounting  systems. We found instances where staff hours captured in workload  tracking systems did not agree with staff hours recorded in  departmentwide payroll or accounting systems. For example, we found  that the workload tracking system used by the Office of Counsel to the  Inspector General included approximately 10 percent fewer hours for  fiscal year 2008 and 7 percent fewer hours in fiscal year 2009 when  compared to HHS’s payroll system reports. Similarly, we found two  instances from our fiscal year 2008 nongeneralizable sample of  expenditures where USAO’s workload tracking system included fewer  hours than the HCFAC hours recorded and billed in DOJ’s accounting  system, which collectively accounted for a 40 percent difference between  the two systems. Failure to complete these reconciliations or comparisons  could lead to unsubstantiated payroll expenditures that should not be  charged to the HCFAC account.
HHS OIG and DOJ officials told us that they were aware of the differences.  HHS OIG officials indicated that while they did not have procedures that  specifically addressed the reconciliation of data captured in their  workload tracking systems, they believed they had other compensating  controls, such as periodic inspections of timesheets, to mitigate the risk of  inconsistent data between systems. They also noted that they were  considering taking actions to revise their policies and procedures to add  new monitoring controls to address the need to reconcile data between  the systems. Further, DOJ officials indicated that because they spend  significantly more resources on HCFAC activities than the sum that is  allocated to DOJ from the HCFAC account, it is not cost beneficial to  require personnel to record their time consistently in both systems. Also,  according to DOJ officials, although not formally documented, each  component has processes to monitor HCFAC expenditures to ensure they  do not over-bill the HCFAC account. For example, the officials stated that  the Criminal Division performs quarterly reviews of percentages used to  charge payroll expenditures against the HCFAC account. Not having  policies and procedures to ensure that sufficient controls over HCFAC  expenditures are in place could result in misstatements and ultimately  hinder HHS and DOJ managers in preparing meaningful budgets to  support future HCFAC funding requests.
Monitoring of annual report compilation. Also, we found that although  DOJ issued the Report Completion Guide in June 2010 that specified time  frames for both HHS and DOJ for submitting information to complete the  annual HCFAC report, the guide did not require that monitoring control  activities, such as comparisons and supervisory reviews, be performed to  help ensure that reported amounts were accurately presented. During our  review of the HCFAC reports, we found presentation errors of $245.7  million and $717.5 million for fiscal years 2008 and 2009, respectively, of  the total amounts reported as transferred to the HI trust fund. For  example, for fiscal year 2009 we found that $716.8 million of the $1.0  billion reported in the restitution and compensatory damages line item  was not transferred to the HI trust fund as stated in the report. Of the  $716.8 million, $441.0 million related to Medicaid, $245.4 million related to  Medicare Part B, and $30.4 million represented a double-counting error.  The $30.4 million double-counting error related to civil monetary penalties  and CMS’s portion of penalties and multiple damages, which were already  reported under separate line items. HHS and DOJ disclosed the double- counting error and the Medicaid presentation error in the fiscal year 2010  annual HCFAC report issued on January 24, 2011. Recoveries for Medicare  Part B and Medicaid are not transferred to the HI trust fund, but instead  are to be transferred to the Federal Supplementary Medical Insurance  (SMI) Trust Fund and the Medicaid appropriation account within CMS,  respectively. We found a similar issue in the fiscal year 2008 HCFAC  report, where the total amount reported as transferred to the HI trust fund  included Medicare Part B recoveries totaling $245.7 million. These  inaccuracies overstated the amount of funds transferred to the HI trust  fund.
In addition, CMS officials told us that the amounts reported in the HHS  OIG audit disallowances line item, totaling about $662.5 million and $360.2  million for fiscal years 2008 and 2009, respectively, included both  Medicare and Medicaid recoveries. As stated above, Medicaid recoveries  are to be transferred to the Medicaid appropriation account within CMS  rather than the HI trust fund. However, these officials stated that the dollar  amount associated with each type of recovery could not be determined  because the current system does not readily distinguish between Medicare  and Medicaid recoveries for amounts previously reported in the HCFAC  report. Full disclosures had not been made in the report to inform readers  that reported amounts included Medicare Part B and Medicaid, which are  not transferred to the HI trust fund. In the fiscal years 2008 and 2009  HCFAC reports, HHS and DOJ incorrectly indicated in footnotes that  reported amounts did not include Medicaid funds. CMS officials indicated  they will separately report Medicare and Medicaid recoveries related to  HHS OIG audit disallowances in future HCFAC reports. According to CMS  officials, they plan to accomplish this by manually tracking Medicare and  Medicaid recoveries. In addition, DOJ officials told us that they are in the  process of developing written guidance on the preparation of the annual  HCFAC report and anticipate issuance by June 2011.
GAO’s Standards for Internal Control in the Federal Government  provides that internal control should generally be designed to assure that  ongoing monitoring occurs in the course of normal operations, including  regular management and supervisory activities, comparisons,  reconciliations, and other actions people take in performing their duties.  Having detailed written policies and procedures that incorporate these key  monitoring controls decreases the risk of reporting inaccurate HCFAC  data that could be misleading to Congress when judging the success of the  program.
section_title: Conclusions
paragraphs: Although HHS and DOJ have taken action to address our previous  recommendations aimed at improving procedures for recording HCFAC  expenditures and issuing the annual HCFAC report, we found that controls  are not sufficient to ensure that the report is accurate and supported. As  HHS and DOJ accelerate the reporting process in an attempt to complete  the report by the January 1 mandated reporting deadline, it is important  that they establish controls that are designed to provide complete,  accurate, and reliable information in the annual HCFAC report. Based on  our review of the fiscal years 2008 and 2009 HCFAC reports, HHS and DOJ  do not have sufficient controls for maintaining and retaining  documentation and performing monitoring such as reconciliation and  review activities to ensure accurate and consistent reporting of HCFAC  deposits and expenditures. These design weaknesses led to instances  where documentation was not readily available and amounts included in  the HCFAC reports contained errors. Until HHS and DOJ strengthen their  controls for documenting and monitoring HCFAC reporting processes,  their ability to provide Congress with an accurate and timely annual report  of HCFAC activities will continue to be compromised. Inaccuracies in the  mandated annual report limit its usefulness to congressional decision  makers and other interested parties.
section_title: Recommendations for Executive Action
paragraphs: We are making the following 11 recommendations to HHS and DOJ to  improve controls over the accounting and reporting of HCFAC activities.
We recommend that the Secretary of HHS,    direct the Administrator of CMS to:  revise procedures for properly maintaining supporting  documentation for HCFAC deposits and expenditures, to include  specifying the titles of staff responsible for maintaining supporting  documentation;   develop written procedures that incorporate monitoring controls  for HCFAC deposit information recorded in the departmentwide  accounting system, including reconciling the deposit data in this  system to the regional offices’ data collection system;    direct the Assistant Secretary for Aging to:  revise the Administration on Aging’s procedures for properly  maintaining supporting documentation for HCFAC expenditures,  to include specifying the titles of staff responsible for maintaining  supporting documentation and the location of records;   develop written procedures that incorporate monitoring controls  to verify that the payroll expenditures charged against HCFAC are  reasonable and supported; and   direct the Acting General Counsel to develop written procedures that  incorporate monitoring controls for the Office of the General Counsel  staff hours related to HCFAC activities captured in workload tracking  systems, including the reconciliation to staff hours captured in the  departmentwide payroll system; and   develop written procedures in collaboration with DOJ that incorporate  monitoring controls for preparing the joint annual HCFAC report to  help ensure reported amounts are accurate.
We recommend that the HHS Inspector General develop written  procedures that incorporate monitoring controls for HHS OIG staff hours  related to HCFAC activities captured in workload tracking systems,  including the reconciliation to staff hours captured in the departmentwide  payroll system.
We recommend that the Attorney General direct the Deputy Assistant  Attorney General / Controller to:  revise procedures for properly maintaining supporting documentation  for HCFAC deposits and expenditures, to include specifying the titles  of staff responsible for maintaining supporting documentation and the  location of records;   develop written procedures that incorporate monitoring controls for  reconciling HCFAC deposits of the 3 percent portion of penalties and  multiple damages information recorded in the departmentwide  accounting system to the HI trust fund statements;    develop written procedures that incorporate monitoring controls to  verify that the payroll expenditures charged against HCFAC are  reasonable and supported; and   develop written procedures in collaboration with HHS that incorporate  monitoring controls for preparing the joint annual HCFAC report to  help ensure reported amounts are accurate.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to HHS and DOJ for review and  comment. Written comments from the HHS Assistant Secretary for  Legislation are reproduced in appendix III. DOJ indicated via e-mail that it  agreed with the findings and the four recommendations we made to revise  or develop written procedures that include documentation and monitoring  controls for HCFAC activities and reporting. While DOJ did not provide  written comments, it provided technical comments, as did HHS, that we  incorporated as appropriate. We made a total of 11 recommendations, 7 to  HHS and 4 to DOJ.
Of the seven recommendations we made, in its written comments, HHS  generally agreed with five, disagreed with one, and did not address the  remaining recommendation. Specifically, HHS agreed with our  recommendation related to revising the Administration on Aging’s  procedures for properly maintaining supporting documentation for  HCFAC expenditures and stated that it plans to incorporate these changes  by summer 2011. Also, HHS agreed with our recommendation to develop  written procedures for preparing the joint annual HCFAC report and  indicated that it has begun to work with DOJ to improve the Report  Completion Guide. In addition, HHS OIG agreed with our  recommendation to develop written procedures that incorporate  monitoring controls for staff hours related to HCFAC activities recorded in  its workload tracking systems and stated that it will incorporate these  procedures into its formal policies. Further, the Administration on Aging  stated its view that addressing our recommendation to develop written  procedures to verify that HCFAC payroll expenditures are reasonable and  supported would not provide material results to justify the additional  expense and workload. However, the Administration on Aging agreed to  explore other options to refine its HCFAC payroll expenditures.
The Office of the General Counsel agreed and stated that it had addressed  our recommendation to develop written procedures that incorporate  monitoring controls for staff hours recorded in the workload tracking  system. It stated that on February 2, 2011, it provided us procedures for  properly accounting for HCFAC expenditures. While we received  procedures from the Office of the General Counsel, these procedures did  not address our finding. Instead, the procedures discussed the transfer of  payroll expenditures to the HCFAC account. Therefore, we determined  that this recommendation has not been addressed.
CMS disagreed with our recommendation to revise procedures for  maintaining supporting documentation for HCFAC deposits and  expenditures, which include specifying the titles of staff responsible for  maintaining supporting documentation. CMS stated that the National  Archives and Records Administration does not require staff titles on a  standard form it prescribes for transferring records to approved records  facilities (SF-135) and that CMS requires staff to take records retention  training each year. CMS also stated it believes the information maintained  is sufficient to ensure accountability and proper and consistent supporting  documentation for HCFAC deposits and expenditures. However, we  continue to believe that CMS’s policies and procedures for documentation  are insufficient, as they do not identify the staff responsible for  maintaining documentation as required by the National Archives and  Records Administration regulations. Also, CMS stated that the creation of  a new records retention system for HCFAC records would be duplicative  and unnecessary. We do not believe that a new records retention system  exclusively for HCFAC records is necessary to achieve accountability for  documentation responsibilities. Rather, a modification to CMS’s existing  procedures that identifies the responsible staff by title to show authority  levels for properly maintaining supporting documentation, help provide  continuity when staff change positions, and promote accountability would  be sufficient to address this shortcoming.
Lastly, in its comments, CMS did not address our remaining  recommendation to develop written procedures that incorporate  monitoring controls for HCFAC deposit information recorded in the  departmentwide accounting system. However, as we stated in the report,  CMS officials told us in February 2011 that they were in the process of  developing procedures that require the reconciliation of HCFAC deposit  information.
As we agreed with your office, unless you publicly announce the contents  of this report earlier, we plan no further distribution of it until 30 days  from the report date. At that time, we will send copies to the Secretary of  HHS, the Attorney General, and other interested parties. The report will  also be available at no charge on GAO’s Web site at http://www.gao.gov.
If you or your staff have any questions about this report, please contact me  at (202) 512-9312 or dalykl@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. GAO staff who made major contributions to this report are  listed in appendix IV.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: The objectives of this review were to determine to what extent the  Department of Health and Human Services (HHS) and the Department of  Justice (DOJ) (1) took action to address the recommendations we made in  2005 and (2) designed effective controls over reporting Health Care Fraud  and Abuse Control (HCFAC) program deposits and expenditures for fiscal  years 2008 and 2009.
To address the extent to which HHS and DOJ took action to address the  recommendations made in 2005, we:    Obtained and reviewed documentation provided by HHS and DOJ such  as policies and procedures and the Report Completion Guide.
Interviewed officials at HHS and DOJ including the Acting Deputy  Inspector General and the Assistant Director of the Executive Office  for United States Attorneys to identify actions to improve HCFAC  program operations.
To address the extent to which HHS and DOJ designed effective controls  over reporting HCFAC deposits and expenditures, we:    Obtained and reviewed relevant HHS and DOJ policies and procedures  for reporting deposits and expenditures within each agency.
Used criteria outlined in our Standards for Internal Control in the  Federal Government, specifically as it relates to control activities and  monitoring, to assess the effectiveness of controls over the reporting  of amounts related to deposits and expenditures. We applied these  standards to assess whether the design of the controls documented in  the policies and procedures reasonably assured accurate and  consistent reporting of HCFAC amounts in the joint annual HCFAC  report. We did not verify the validity or accuracy of the reported  amounts.
Assessed the reliability of data used to select our nongeneralizable  tracing deposit control totals of the electronic databases to the  corresponding deposit line item totals reported in the HCFAC  reports and the Bureau of the Public Debt’s Federal Hospital  Insurance Trust Fund (HI trust fund) statements;   obtaining the funding decision memorandum detailing how the  HCFAC funds would be distributed between HHS and DOJ for  fiscal years 2008 and 2009 to verify the HCFAC funds certified by  HHS and DOJ officials; comparing amounts reported in the joint HCFAC reports to the  approved funding decision memorandum and comparing amounts  from the decision memorandum to the Office of Management and  Budget (OMB) documentation (Apportionment Schedule SF-132)  to verify that the amounts were made available; tracing total expenditure amounts to supporting documentation,  including electronic databases, billing packages, and intra- and  interagency agreements; and reviewing existing information about the electronic data and the  systems that produced them.
We determined that the data were sufficiently reliable to select our  samples.
Selected a nongeneralizable stratified random sample for each of the  deposit types (gifts and bequests, criminal fines, civil monetary  penalties, and penalties and multiple damages) that HHS and DOJ  reported a dollar amount greater than zero in the fiscal years 2008 and  2009 annual HCFAC reports. We selected a total of 47 deposit  transactions for fiscal year 2008 and 55 transactions for fiscal year  2009. Transaction selection criteria included various factors such as  dollar amounts and transaction volume. For the selected transactions,  we reviewed various sources of documentation depending on the type  of deposit to determine whether dollar amounts were accurately  reported. Examples of supporting documentation for deposits included  check registers; electronic fedwires; health care tracking forms used  to allocate deposit collections among the various health care  programs; judgment orders and agency letters identifying applicable  fines and penalties assessed; and collection system query reports.  These randomly selected transactions were designed to provide  additional details about the processing of those transactions and were  not intended to be representative of the universe of HCFAC  transactions. See appendix II for information about the universe of  transactions and our sampled items.
Selected a nongeneralizable random sample of expenditures for each  of the agency components that were allocated HCFAC appropriation  funds as reported in the annual HCFAC reports for fiscal years 2008  and 2009. For the Centers for Medicare & Medicaid Services (CMS)  and the United States Attorneys Office (USAO), we obtained electronic  databases and selected a nongeneralizable stratified random sample  for those agency components. We selected a total of 63 transactions  for fiscal year 2008 and 62 transactions for fiscal year 2009 related to  payroll and nonpayroll expenditures. Transaction selection criteria  included various factors such as dollar amounts, transaction volume,  and source of information. For these transactions, we reviewed  various sources of documentation depending on the type of  expenditure to determine whether dollar amounts were accurately  reported and the use of funds were consistent with the Health  Insurance Portability and Accountability Act of 1996 (HIPAA).  Examples of supporting documentation for expenditures included  workload tracking system and payroll system query reports; time and  attendance reports; salary forms; invoices; contracts; and travel  vouchers. These randomly selected transactions were designed to  provide additional details about the processing of those transactions  and were not intended to be representative of the universe of HCFAC  transactions. See appendix II for information about the universe of  transactions and our sampled items.
Performed additional procedures for HHS Office of Inspector General  (OIG) payroll transactions as this component received 67 percent and  42 percent of total HCFAC appropriations allocated for fiscal years  2008 and 2009, respectively. Specifically, we (1) obtained time reports  from workload tracking systems for all four OIG components (Office  of Audit Services, Office of Investigations, Office of Evaluations and  Inspections, and Office of Counsel to the Inspector General) to  determine if the projects identified as HCFAC were properly classified;  and (2) compared the number of hours in the workload tracking  systems to the number of hours in the HHS payroll system to  determine if the components’ systems included hours for all staff.
Interviewed agency officials from HHS and DOJ including budget  analysts and financial specialists to obtain an understanding and  clarification of the processes used to report deposits to the HI trust  fund and appropriations from this fund, including related  expenditures.
We conducted our work from February 2010 through May 2011 in  accordance with U.S. generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Information about the Universe of Transactions and Our Sampled Items
paragraphs: During our review of fiscal years 2008 and 2009 Health Care Fraud and  Abuse Control (HCFAC) program activities, we selected nongeneralizable  samples to further understand the Department of Health and Human  Services (HHS) and the Department of Justice (DOJ) procedures for  HCFAC deposits and expenditures. For deposits, we stratified the data and  selected random transactions, as summarized in table 1 below, for each of  the deposit types authorized by the Health Insurance Portability and  Accountability Act of 1996 (HIPAA) for which HHS and DOJ reported  dollar amounts greater than zero in the fiscal years 2008 and 2009 HCFAC  reports.
For expenditures, we selected samples from object classes that in  aggregate accounted for 50 percent or more of total obligations for each  component that received HCFAC funds. Based on dollar amounts, we then  selected random transactions, as summarized in table 2 below.
section_title: Appendix III: Comments from the Department of Health and Human Services
paragraphs: Appendix III: Comments from the Department  of Health and Human Services  GENERAL COMMENTS OF THE DEPARTMENT OF HEALTH AND HUMAN  SERVICES (HHS) ON THE GOVERNMENT ACCOUNTABILITY OFFICE’S (GAO)  DRAFT REPORT ENTITLED, “HEALTH CARE FRAUD AND ABUSE CONTROL  PROGRAM: IMPROVEMENTS NEEDED IN CONTROLS OVER REPORTING  DEPOSITS AND EXPENDITURES” (GAO-11-446)
The Department appreciates the opportunity to comment on this draft report.
GAO Recommendation No. 1 We recommend that the Secretary of HHS direct the Administrator of CMS to:  revise procedures for properly maintaining supporting documentation for HCFAC  deposits and expenditures, to include specifying the titles of staff responsible for  maintaining supporting documentation;  develop written procedures that incorporate monitoring controls for HCFAC deposit  information recorded in the departmentwide accounting system, including reconciling the  deposit data in this system to the regional offices’ data collection system  Centers for Medicare and Medicaid Services (CMS) Response CMS disagrees with GAO’s assertion that we have inadequate controls or procedures regarding  retention of HCFAC related records because we do not explicitly identify the title of staff  responsible for management of such records.  Standard Form 135, Records Transmittal and  Receipt, which is prescribed by the National Archives and Records Administration (NARA),  accompanies all records stored in an approved facility, and includes the Agency contact name,  office, and telephone number, but NARA does not require staff titles.  Each CMS component is  responsible for following all federal records retention policies for its HCFAC-related functions. Also, all CMS employees are required to take records retention training each year, and are  responsible for appropriately and consistently applying CMS’ Records Management guidelines.   CMS believes the information it maintains is sufficient to ensure accountability and proper and  consistent supporting documentation for HCFAC deposits and expenditures.  CMS believes that  specifying the titles of particular CMS staff is unwarranted and that creation of a new records  retention system uniquely for HCFAC records would be duplicative and unnecessary.
GAO Recommendation No. 2 We recommend that the Secretary of HHS direct the Assistant Secretary for Aging to:   revise the Administration on Aging’s procedures for properly maintaining supporting  documentation for HCFAC expenditures, to include specifying the titles of staff  responsible for maintaining supporting documentation and the location of records; develop written procedures that incorporate monitoring controls to verify that the payroll  expenditures charged against HCFAC are reasonable and supported  Administration on Aging (AoA) Response We agree with the first part of the recommendation, on the maintenance of supporting  documentation and will move forward to incorporate these changes into our filing system by  Summer 2011, to the extent feasible.
Concerning the second part of the recommendation, on developing written procedures  incorporating monitoring controls, we have used the same approach to capture HCFAC payroll  charges for more than a decade.  At the beginning of each year, AoA surveys each of the  GENERAL COMMENTS OF THE DEPARTMENT OF HEALTH AND HUMAN  SERVICES (HHS) ON THE GOVERNMENT ACCOUNTABILITY OFFICE’S (GAO)  DRAFT REPORT ENTITLED, “HEALTH CARE FRAUD AND ABUSE CONTROL  PROGRAM: IMPROVEMENTS NEEDED IN CONTROLS OVER REPORTING  DEPOSITS AND EXPENDITURES” (GAO-11-446) approximately twenty-seven staff in Headquarters and the Regional Offices who work on  HCFAC activities to determine the percentage of time each individual estimates that they will  spend, on average, over the entire year on HCFAC.  The Accounting for Pay System (AFPS) is  then used to allocate the same estimated percentage of the person’s pay to HCFAC funding each  pay period, regardless of the number of hours the person actually works on HCFAC during those  specific two weeks. The percentages allocated for most staff are small—no more than ten to  twenty-five percent in most cases.  In the aggregate this resulted in FY 2008 in approximately  29%, or $879,607, of AoA’s $3.1 million FY 2008 HCFAC allocation being used for personnel  costs, a reasonable percentage given that these dollars are used to provide administrative and  related support for AoA’s Senior Medicare Patrol anti-fraud education program.
AoA uses the Department’s ITAS system to track actual hours worked by employees, and this  system does not have the ability to track hours spent on one type of activity versus another.  To  implement the type of controls that GAO recommends would therefore require the establishment  of a completely new, wholly separate tracking system from that used by the Department for time  and attendance purposes.  Such a system would require employees to track and log hourly  HCFAC activity, to cumulate and report that activity to a central tracking point of contact, and  then require this information to periodically be used to adjust the labor distributions in the  accounting system for each of those individuals.  While this approach could result in a more  accurate accounting, it would do so at a price of a very substantially increased workload at every  level disproportionate to the amount of HCFAC funding received.  Further, some time ago, AoA  eliminated requirements that employees sign in and out and keep a written record of their time  and attendance in connection with collective bargaining agreements.  AoA does not believe that  the penny-wise approach favored by GAO would have sufficiently material results as to justify  the additional expense and workload.
AoA is willing, however, to engage in exploratory discussions with other Operating Divisions  within the Department who may be faced with similar situations—whether or not related to  HCFAC dollars—to determine if there are other approaches which might allow it either to  further refine the payroll charges or to further adjust a subsequent year’s estimated percent of  time spent on HCFAC.  If a less resource intensive solution could be identified, AoA would be  open to its implementation.
GAO Recommendation No. 3 We recommend that the Secretary of HHS direct the Acting General Counsel to: develop written procedures that incorporate monitoring controls for the Office of the  General Counsel staff hours related to HCFAC activities captured in workload tracking  systems, including the reconciliation to staff hours captured in the departmentwide  payroll system GENERAL COMMENTS OF THE DEPARTMENT OF HEALTH AND HUMAN  SERVICES (HHS) ON THE GOVERNMENT ACCOUNTABILITY OFFICE’S (GAO)  DRAFT REPORT ENTITLED, “HEALTH CARE FRAUD AND ABUSE CONTROL  PROGRAM: IMPROVEMENTS NEEDED IN CONTROLS OVER REPORTING  DEPOSITS AND EXPENDITURES” (GAO-11-446)
Office of the General Counsel (OGC) Response At the time of this review, OGC did not have written procedures in-place to clarify 1) its method  of using Practice Manager (PM) workload reports to transfer pay between non-HCFAC and  HCFAC specific Common Accounting Numbers (CANs) in the Department’s Accounting For- Pay System (AFPS) and 2) its corresponding reconciliation process.  Financial data  reconciliation is common practice for government budget staff as part of their regular  duties/responsibilities as budget analysts and thus routinely occurs in the absence of specific  documented procedures.
Nonetheless, prior to the issuance of this draft report, OGC developed such policy guidance in  order to detail its procedures for properly accounting for its associated cost-of-work performed  on behalf of HCFAC.  OGC provided this HCFAC Account Expenditures Policy Guidance to  GAO on February 2, 2011.
GAO Recommendation No. 4 We recommend that the Secretary of HHS develop written procedures in collaboration with DOJ  that incorporate monitoring controls for preparing the joint annual HCFAC report to help ensure  reported amounts are accurate.
HHS Response The Department agrees that having written procedures, or guidance, for the joint annual HCFAC  report will work to ensure accurate reporting.  To further this goal, HHS and DOJ developed the Department of Health and Human Services and Department of Justice Annual Report on the  Health Care Fraud and Abuse Control Program: Report Completion Guide as part of the FY  2010 HCFAC Report process.  DOJ shared this manual with GAO in the fall of 2010.  However,  in response to this GAO report, HHS and DOJ have been working collaboratively to improve the  content of this manual, specifically to ensure the accuracy of the numbers included in the  “Monetary Results” table of the annual HCFAC report.  The updated manual will include a  detailed matrix that describes each transfer or deposit figure included in the “Monetary Results”  table of the HCFAC report, which agency is responsible for reporting that figure, the source of  the data, and who is responsible for verifying the final numbers published in the Annual Report.   This report, or guidance, will be distributed annually to all relevant HHS Operating Divisions as  well as all relevant components within DOJ.
GAO Recommendation No. 5 We recommend that the HHS Inspector General (OIG) develop written procedures that  incorporate monitoring controls for HHS OIG staff hours related to HCFAC activities captured  in workload tracking systems, including the reconciliation to staff hours captured in the  departmentwide payroll system.
GENERAL COMMENTS OF THE DEPARTMENT OF HEALTH AND HUMAN  SERVICES (HHS) ON THE GOVERNMENT ACCOUNTABILITY OFFICE’S (GAO)  DRAFT REPORT ENTITLED, “HEALTH CARE FRAUD AND ABUSE CONTROL  PROGRAM: IMPROVEMENTS NEEDED IN CONTROLS OVER REPORTING  DEPOSITS AND EXPENDITURES” (GAO-11-446)
Office of Inspector General (OIG) Response HHS OIG concurs with this recommendation.   OIG continues to assert that our workload  tracking accurately captures total staff hours and the staff hours allocable to HCFAC-related  activities.  Nevertheless, HHS OIG agrees to incorporate these implemented procedures into  formal written policies that will include reconciliation of overall staff hours to the department- wide payroll system.
section_title: Appendix IV: GAO Contacts and Staff Acknowledgments
subsections: section_title: Staff Acknowledgments
paragraphs: In addition to the contact listed above, Carla J. Lewis (Assistant Director),  Maria C. Belaval, Sharon O. Byrd, William L. Evans, Maria Hasan,  Christopher N. Howard, Jason S. Kirwan, Mitchell D. Owings, and Nina M.  Rostro made significant contributions to this report.