HIPAA authorized the HCFAC program to consolidate and strengthen ongoing efforts to combat fraud and abuse in health care programs and increase resources for fighting health care fraud. The Secretary of HHS, through the HHS OIG, and the Attorney General, administer the HCFAC program. The HCFAC program goals are to: coordinate federal, state, and local law enforcement efforts to control fraud and abuse associated with health plans; conduct investigations, audits, and other studies of delivery and payment for health care for the United States; facilitate the enforcement of the civil, criminal, and administrative statutes applicable to health care; provide guidance to the health care industry, including the issuance of advisory opinions, safe harbor notices, and special fraud alerts; and establish a national database of adverse actions against health care providers. Figure 1 below provides an overview of the HCFAC funding stream, including the related deposits, the allocation of appropriated funds to carry out federal health care law enforcement activities, and the reporting mandate. The types of collections deposited to the HI trust fund and appropriations from this fund, including related expenditures are discussed below. Criminal fines. DOJ prosecutes entities or persons that are involved in commission of a federal health care offense, such as mail fraud related to a health care program. Courts assess criminal fines upon which the criminal debtor is ordered to submit payment(s) to the United States District Court where the case was prosecuted. Each District Court coordinates with DOJ’s local United States Attorneys Office (USAO) to communicate collections received. The Executive Office for United States Attorneys report collection data on a quarterly basis to the Bureau of the Public Debt for deposit into the HI trust fund. Civil monetary penalties. The Social Security Act authorizes the Secretary of HHS to impose civil monetary penalties for improper claims and other violations by health care providers, facilities, and other parties. Centers for Medicare & Medicaid Services (CMS) regional offices impose some civil monetary penalties. CMS’s Office of Financial Management collects the civil monetary penalties imposed on behalf of the Secretary of HHS and allocates payments received based on information the regional offices record in their data collection system. The Office of Financial Management reports collections for civil monetary penalties on a daily basis to the Bureau of the Public Debt for deposit into the HI trust fund. Forfeitures of property. DOJ prosecutions of entities or persons that are involved in a federal health care offense can result in the forfeiture of property. HHS and DOJ reported no property forfeitures creditable to the HI trust fund under HIPAA in the HCFAC reports for fiscal years 2008 and 2009. Penalties and multiple damages. Courts can impose penalties and multiple damages as a result of HHS and DOJ civil suits against those who have knowingly made false health care claims against the government, such as submitting claims for medical services that were not provided. Of all civil debt collections received, DOJ is entitled to keep 3 percent in its Working Capital Fund for expenses incurred in processing and tracking civil and criminal debt collection litigations. Both CMS and DOJ report collections for penalties and multiple damages on a continuous basis to the Bureau of the Public Debt for deposit into the HI trust fund. Gifts and bequests. CMS occasionally receives gifts and bequests and equally splits the amount received between its Medicare Part A and Medicare Part B programs. Gifts and bequests are donations received from individuals or entities, usually in the form of checks. Upon receipt of a donation, CMS records the amount in its accounting system and reports it to the Bureau of the Public Debt for deposit into the HI trust fund. In addition to the types of deposits authorized by HIPAA and discussed above, HHS and DOJ report other types of collections in connection with health care fraud activities such as HHS OIG audit disallowances and court-awarded restitution and compensatory damages. These types of collections represent amounts recovered by HHS and DOJ as a result of health care enforcement activities. These amounts are returned to the HI trust fund to the extent that they represent repayments to Medicare. Funds for the HCFAC program are appropriated from the HI trust fund to an expenditure account, referred to as the Health Care Fraud and Abuse Control Account (HCFAC account) maintained within the HI trust fund. Annually, the HHS Secretary and the Attorney General jointly certify amounts appropriated from the HI trust fund to the HCFAC account as necessary to finance health care fraud and abuse control activities based on statutory limits. HIPAA, as amended, prescribes the maximum amount that may be certified in a given fiscal year. Any unexpended amounts are carried forward to the next fiscal year. Once HCFAC funds have been certified, CMS’s Division of Accounting Operations performs the accounting for appropriations transferred to the HCFAC account. CMS makes funds available by creating allotments in its accounting system to fund related HCFAC expenditures. CMS provides funds to other HHS components and DOJ through intra- and interagency agreements, as shown in figure 1. This process requires HHS and DOJ to bill CMS through the Intra-governmental Payment and Collection (IPAC) System to obtain payment from their allocation of HCFAC funds. In addition to CMS’s central accounting for HFCAC funds, both HHS and DOJ components have processes to separately manage their allotted HCFAC amounts. In general, these processes include authorizing HCFAC-related expenditures, recording applicable payroll and nonpayroll expenditures incurred to a designated HCFAC code, and reporting any unexpended amounts to be carried forward to the next fiscal year. For fiscal year 2009, the Secretary of HHS and the Attorney General certified $266.4 million in mandatory funding to be appropriated from the HI trust fund to the HCFAC account. Additionally, Congress appropriated $198 million in discretionary funding to that account in response to HHS’s fiscal year 2009 budget request, to fund HCFAC program integrity activities. As such, the total appropriated amount to the HCFAC account for fiscal year 2009 was $464.4 million for that year. Figure 2 provides a historical trend of the amounts appropriated to the HCFAC account over the past 13 fiscal years. Funds were first appropriated to HCFAC in fiscal year 1997. HIPAA limited the amounts appropriated for fiscal years 1998 through 2003 to an amount equal to the limit for the preceding fiscal year plus an additional 15 percent. For fiscal years 2004 through 2006, the amount made available was capped at the 2003 limit. The Tax Relief and Health Care Act (TRHCA) also allowed for yearly increases to the HCFAC account based on the change in the consumer price index for all urban consumers (CPI-U) over the previous fiscal year for fiscal years 2007 through 2010. In fiscal year 2006, TRHCA amended HIPAA so that funds allotted from the HCFAC account are available until expended. Beyond 2010, the Patient Protection and Affordable Care Act, as amended by the Health Care and Education Reconciliation Act of 2010, raised the limit on funds that may be certified for the HCFAC account by the Secretary of HHS and the Attorney General by an additional $350 million over the next 10 years, beginning in fiscal year 2011. The annual allocation of appropriation amounts to the HHS and DOJ components are intended to support a variety of anti-fraud and anti-abuse activities. For example, in May 2009, HHS and DOJ established a task force—the Health Care Fraud Prevention and Enforcement Action Team (HEAT)—comprised of top level law enforcement and professional staff from both agencies to prevent health care fraud and enforce current anti- fraud laws around the country. Other examples include HHS OIG investigations, audits, and evaluations that identify vulnerabilities for questionable or fraudulent financial practices related to Medicaid outpatient prescription drug expenditures and Medicare contractor costs. Similarly, DOJ’s USAOs use HCFAC funding to support civil and criminal health care fraud and abuse litigation. HCFAC funds are also used to train attorneys, investigators, and auditors in the investigation and prosecution of health care fraud and abuse; prosecute health care matters through criminal, civil, and administrative proceedings; and conduct investigations, financial, and performance audits of health care programs, inspections, and other evaluations. In our April 2005 report, we identified weaknesses related to not properly capturing certain expenditure data in agency information systems, non- adherence to accounting policy for select HCFAC expenditures, and lengthy HCFAC report review processes. We made recommendations to HHS and DOJ to improve procedures for recording HCFAC expenditures and issuing the annual HCFAC report. Based on our analysis of documentation, HHS and DOJ took actions that addressed three of the four recommendations. Both agencies disagreed with our recommendation to notify Congress on delays in issuing the HCFAC report by the mandated deadline and thus, did not take action. Each of the recommendations and applicable actions taken are described further below. Record staff hours in workload tracking systems. In our 2005 report, we found that two HHS OIG components—Office of Evaluations and Inspections and Office of Investigations—had not recorded all staff hours in their workload tracking systems, which are used to monitor actual hours spent on HCFAC activities. HHS OIG uses the workload tracking systems to monitor HCFAC payroll expenditures, and incomplete information could hinder those efforts. We recommended that the HHS Inspector General require all HHS OIG components to develop procedures for ensuring that all key staff hours spent on HCFAC activities are recorded in the HHS OIG workload tracking systems. In April 2006, the HHS OIG’s Office of Evaluation and Inspections updated its procedures for entering information into its workload tracking system, including guidance related to the completion of timesheets. The procedures instruct employees to record time to specific inspection codes and instruct managers to review staff time recorded in the system. In addition, HHS OIG’s Office of Investigations updated its procedures in October 2009, which require all Office of Investigations personnel to record time and attendance in its workload tracking system. We determined that HHS OIG components’ actions substantially addressed the recommendation. Record expenditure data under the correct account class. In our 2005 report, we noted that only one of the four DOJ components receiving HCFAC funds properly recorded expenditures as required by DOJ policies and procedures. We recommended that the Attorney General develop monitoring procedures to ensure that DOJ components record key HCFAC program expenditure data under the appropriate HCFAC account class in DOJ’s accounting system. In April 2005, DOJ updated its policies and procedures that require individual components to monitor obligations recorded in the accounting system on a quarterly basis. Further, in fiscal year 2009 the Executive Office for the United States Attorneys provided procedures to the USAOs, which receive the largest portion of the HCFAC allocation, on how to charge HCFAC expenditures using the proper program code. According to DOJ officials, component officials review system reports on a regular basis to verify that HCFAC obligations and expenditures are correctly reflected in the accounting system. We determined that DOJ’s actions were sufficient to close the recommendation. Develop a more expedited review process. In our 2005 report, we noted that a lengthy review process within HHS and DOJ resulted in failure to meet the mandated annual January 1 deadline for reporting HCFAC activities. For example, the fiscal year 2003 HCFAC report, the most recent report at the time of that review, was issued 1 year after the mandated reporting date. We recommended that the Secretary of HHS and the Attorney General develop a more expedited review process for the joint annual HCFAC reports. In June 2010, DOJ issued a Report Completion Guide, an expedited review process that provides instructions and time frames for submitting information to complete the annual HCFAC report. The guide introduced a new process whereby DOJ and HHS components utilized a shared website to distribute documents for edit and review. The guide also established time frames for issuing the fiscal year 2010 HCFAC report by January 1, 2011. Using these new time frames, HHS and DOJ jointly issued the fiscal year 2010 HCFAC report on January 24, 2011, only 23 days later than the mandated reporting date. According to DOJ officials responsible for preparing the HCFAC report, they intend to use these time frames to meet the mandated deadline when preparing future year reports. We determined that HHS and DOJ’s efforts meet the intent of our recommendation. However, as discussed later in this report, although timeliness is important, ensuring that the report is accurate and reliable remains a concern. Notify Congress of delays in report issuance. In our 2005 report, we noted that repeated delays in issuing the joint annual HCFAC report impact the relevance of the data being reported. We recommended that the Secretary of HHS and the Attorney General notify congressional oversight committees of delays in issuing the annual report within 1 month of missing the January 1 deadline. HHS and DOJ did not concur with this recommendation. However, as we stated above, both HHS and DOJ developed and implemented a new timeline of dates to edit and review the annual HCFAC report, which resulted in issuing the fiscal year 2010 annual HCFAC report within one month of the mandate. Continuing to take steps to meet these internal deadlines will be necessary to issue the HCFAC report by the mandated deadline to provide timely, relevant information to Congress. Our review of HHS and DOJ policies and procedures showed that both agencies had not designed sufficient controls to help ensure that HCFAC deposits and expenditures were accurately reported. GAO’s Standards for Internal Control in the Federal Government provides that management should establish control mechanisms and activities, and monitor and evaluate these controls. Specifically, during our review we found that HHS and DOJ did not have sufficient controls in their policies and procedures with respect to (1) maintaining and retaining supporting documentation for HCFAC deposits and expenditures and (2) monitoring HCFAC deposits and expenditures to help ensure accurate reporting. From our review of the underlying documentation to support HCFAC activities and nongeneralizable samples of deposits and expenditures, we identified instances in which these design deficiencies resulted in HHS’s and DOJ’s inability to support reported amounts for HCFAC expenditures. We also found errors in reported HCFAC amounts. While HHS and DOJ designed controls that were incorporated into its policies and procedures generally requiring the retention of documentation for 6 years, the policies and procedures for CMS, Administration on Aging, and DOJ did not provide sufficient details with respect to where these documents were to be filed, who should be responsible for maintaining them, or a combination of both, which would help ensure accountability and adequate support of HCFAC deposits and expenditures. Our review found that while the HHS OIG and the Office of the General Counsel policies and procedures for documentation contained sufficient controls as to the type of documentation to be retained, the retention period, the location of records, and the person responsible for maintaining the records, CMS and Administration on Aging policies and procedures were lacking some of these controls. Specifically, CMS policies and procedures for documentation of HCFAC deposits and expenditures, did not identify the person responsible for maintaining supporting documents. We found the same weakness with Administration on Aging policies and procedures for documentation of HCFAC expenditures. Further, Administration on Aging policies and procedures did not specify where those documents should be filed. Officials from the Administration on Aging told us that they are in the process of revising their policies and procedures to address these issues. In its comments, Administration on Aging indicated that it expects to incorporate these changes by summer 2011. We also reviewed DOJ’s controls for retention of documents related to HCFAC deposits and expenditures. DOJ’s procedures for deposits identified controls related to the type of documentation to be retained, the retention period, and the location of records, but they did not specify the person responsible for maintaining supporting documents. Although DOJ’s departmentwide expenditure procedures identified controls related to the type of documentation and the retention period, and indicated that documents should be maintained in the obligation file, the procedures did not specify the location of the obligation file and the person responsible for maintaining the records within each office. During our review, we found instances at HHS and DOJ where documentation was not available to support expenditures. For example, we found that HHS’s Administration on Aging did not maintain, and therefore could not provide, underlying documentation to support how the estimated payroll percentages for fiscal years 2008 and 2009 were derived, which are used to charge payroll expenditures against the HCFAC account on a biweekly basis. In fiscal year 2008, for example, the Administration on Aging charged approximately 29 percent of its total HCFAC allocation, or $879,607, to payroll expenses, an amount that could not be fully supported due to the lack of documentation. Therefore, we were unable to verify the justification of such expenditures. In addition, during our review, we found that DOJ could not provide sufficient documentation to support 12 nongeneralizable payroll sample items selected for fiscal years 2008 and 2009, such as time and attendance reports, workload tracking system reports, and records of actual payroll disbursements. Further, DOJ could not provide documentation to support unexpended amounts carried forward from fiscal year 2008 to fiscal year 2009, totaling $522,278. At the end of each fiscal year, DOJ communicates to HHS the amount of unused funds so that HHS can carry them forward to the following fiscal year via an interagency agreement. To report this amount, DOJ’s Justice Management Division compiles obligation data provided by the different DOJ components. However, DOJ’s Justice Management Division could not locate the documents that supported the amount of funds carried forward in the fiscal year 2009 interagency agreement. GAO’s Standards for Internal Control in the Federal Government provides that internal control be designed to ensure that all transactions and other significant events be clearly documented and the documentation be readily available for examination. The standards also provide that records should be properly managed and maintained and documentation should appear in management directives, administrative policies, or operating manuals. Insufficient controls over documentation increase the risk of not having sufficient support to ensure reported HCFAC amounts are accurate and funds are spent as intended. HHS’s and DOJ’s procedures did not incorporate sufficient monitoring controls to help ensure HCFAC deposits and expenditures were accurately reported. Monitoring of deposits. HHS and DOJ had not designed controls to require the reconciliation of HCFAC deposits recorded in their departmentwide accounting systems to data collection systems or to the HI trust fund statements. Specifically, CMS did not have written procedures that required the reconciliation of civil monetary penalty amounts in the CMS regional offices’ data collection system to CMS’s accounting system. We found two instances from our fiscal year 2009 nongeneralizable sample of deposits where CMS regional offices had made adjustments that were recorded in their data collection system, but not communicated to the Office of Financial Management for recording in CMS’s accounting system, which is used as a source to compile the data for the HCFAC report. These two instances resulted in a $15,066 overstatement error in CMS’s accounting system, which CMS officials corrected after we brought the errors to their attention. Although CMS officials stated that they reconcile the data maintained in both systems on a monthly basis, they were not able to provide us an example of these reconciliation reports. In February 2011, CMS officials told us that they were in the process of developing procedures for the Office of Financial Management to require these reconciliations. In addition, DOJ’s Justice Management Division did not have written procedures that included controls to reconcile deposits of the 3 percent portion of penalties and multiple damages reported in the HI trust fund statements to the agency’s accounting system records. For example, for fiscal year 2009 we identified an overstatement in the amount of $596,266 in the HI trust fund statements when comparing to DOJ’s records. When we inquired about the difference, DOJ officials from the Justice Management Division confirmed that an overstatement had occurred because of adjusting entries that had been communicated to the Bureau of the Public Debt but not captured in the HI trust fund statements. In February 2011, DOJ officials told us that to avoid this from happening in the future, they were in the process of developing procedures that would include monitoring controls for reconciling on a quarterly basis penalties and multiple damages between DOJ records and the statements issued by the Bureau of the Public Debt to ensure reported amounts are accurate and consistent between both agencies. Monitoring of expenditures. Similarly, certain HHS components and DOJ did not have written procedures that incorporated controls for reconciling or comparing HCFAC staff hours to verify the accuracy of payroll expenditures charged against the HCFAC account. Specifically, HHS’s Administration on Aging did not have controls for monitoring HCFAC actual payroll hours. HHS’s Administration on Aging charges payroll expenditures based on estimates made prior to or after the beginning of the year. Because the Administration on Aging does not record hours at the HCFAC activity level, it cannot verify that the payroll expenditures charged against the HCFAC account throughout the year are reasonably accurate. According to officials at the Administration on Aging, they believe that tracking hours at the HCFAC activity level would not be cost effective nor provide better results to justify the costs. However, because the estimated percentage of time charged against the HCFAC account may not represent the actual time spent on HCFAC activities for a given pay period, it is critical that some type of monitoring procedures or verification procedures are designed to help ensure that the payroll expenditures charged to the HCFAC account are reasonable and supported. DOJ’s Civil Rights Division also charges HCFAC payroll expenditures based on estimates. Although Civil Rights Division officials indicated that they track and record actual hours and make adjustments to payroll expenditures if differences are noted, these controls were not documented in DOJ’s policies and procedures. In addition, HHS OIG and the Office of the General Counsel for HHS, as well as DOJ USAO and Civil Division, did not have written procedures that included controls for reconciling or comparing HCFAC hours recorded in workload tracking systems to departmentwide payroll or accounting systems. We found instances where staff hours captured in workload tracking systems did not agree with staff hours recorded in departmentwide payroll or accounting systems. For example, we found that the workload tracking system used by the Office of Counsel to the Inspector General included approximately 10 percent fewer hours for fiscal year 2008 and 7 percent fewer hours in fiscal year 2009 when compared to HHS’s payroll system reports. Similarly, we found two instances from our fiscal year 2008 nongeneralizable sample of expenditures where USAO’s workload tracking system included fewer hours than the HCFAC hours recorded and billed in DOJ’s accounting system, which collectively accounted for a 40 percent difference between the two systems. Failure to complete these reconciliations or comparisons could lead to unsubstantiated payroll expenditures that should not be charged to the HCFAC account. HHS OIG and DOJ officials told us that they were aware of the differences. HHS OIG officials indicated that while they did not have procedures that specifically addressed the reconciliation of data captured in their workload tracking systems, they believed they had other compensating controls, such as periodic inspections of timesheets, to mitigate the risk of inconsistent data between systems. They also noted that they were considering taking actions to revise their policies and procedures to add new monitoring controls to address the need to reconcile data between the systems. Further, DOJ officials indicated that because they spend significantly more resources on HCFAC activities than the sum that is allocated to DOJ from the HCFAC account, it is not cost beneficial to require personnel to record their time consistently in both systems. Also, according to DOJ officials, although not formally documented, each component has processes to monitor HCFAC expenditures to ensure they do not over-bill the HCFAC account. For example, the officials stated that the Criminal Division performs quarterly reviews of percentages used to charge payroll expenditures against the HCFAC account. Not having policies and procedures to ensure that sufficient controls over HCFAC expenditures are in place could result in misstatements and ultimately hinder HHS and DOJ managers in preparing meaningful budgets to support future HCFAC funding requests. Monitoring of annual report compilation. Also, we found that although DOJ issued the Report Completion Guide in June 2010 that specified time frames for both HHS and DOJ for submitting information to complete the annual HCFAC report, the guide did not require that monitoring control activities, such as comparisons and supervisory reviews, be performed to help ensure that reported amounts were accurately presented. During our review of the HCFAC reports, we found presentation errors of $245.7 million and $717.5 million for fiscal years 2008 and 2009, respectively, of the total amounts reported as transferred to the HI trust fund. For example, for fiscal year 2009 we found that $716.8 million of the $1.0 billion reported in the restitution and compensatory damages line item was not transferred to the HI trust fund as stated in the report. Of the $716.8 million, $441.0 million related to Medicaid, $245.4 million related to Medicare Part B, and $30.4 million represented a double-counting error. The $30.4 million double-counting error related to civil monetary penalties and CMS’s portion of penalties and multiple damages, which were already reported under separate line items. HHS and DOJ disclosed the double- counting error and the Medicaid presentation error in the fiscal year 2010 annual HCFAC report issued on January 24, 2011. Recoveries for Medicare Part B and Medicaid are not transferred to the HI trust fund, but instead are to be transferred to the Federal Supplementary Medical Insurance (SMI) Trust Fund and the Medicaid appropriation account within CMS, respectively. We found a similar issue in the fiscal year 2008 HCFAC report, where the total amount reported as transferred to the HI trust fund included Medicare Part B recoveries totaling $245.7 million. These inaccuracies overstated the amount of funds transferred to the HI trust fund. In addition, CMS officials told us that the amounts reported in the HHS OIG audit disallowances line item, totaling about $662.5 million and $360.2 million for fiscal years 2008 and 2009, respectively, included both Medicare and Medicaid recoveries. As stated above, Medicaid recoveries are to be transferred to the Medicaid appropriation account within CMS rather than the HI trust fund. However, these officials stated that the dollar amount associated with each type of recovery could not be determined because the current system does not readily distinguish between Medicare and Medicaid recoveries for amounts previously reported in the HCFAC report. Full disclosures had not been made in the report to inform readers that reported amounts included Medicare Part B and Medicaid, which are not transferred to the HI trust fund. In the fiscal years 2008 and 2009 HCFAC reports, HHS and DOJ incorrectly indicated in footnotes that reported amounts did not include Medicaid funds. CMS officials indicated they will separately report Medicare and Medicaid recoveries related to HHS OIG audit disallowances in future HCFAC reports. According to CMS officials, they plan to accomplish this by manually tracking Medicare and Medicaid recoveries. In addition, DOJ officials told us that they are in the process of developing written guidance on the preparation of the annual HCFAC report and anticipate issuance by June 2011. GAO’s Standards for Internal Control in the Federal Government provides that internal control should generally be designed to assure that ongoing monitoring occurs in the course of normal operations, including regular management and supervisory activities, comparisons, reconciliations, and other actions people take in performing their duties. Having detailed written policies and procedures that incorporate these key monitoring controls decreases the risk of reporting inaccurate HCFAC data that could be misleading to Congress when judging the success of the program. Although HHS and DOJ have taken action to address our previous recommendations aimed at improving procedures for recording HCFAC expenditures and issuing the annual HCFAC report, we found that controls are not sufficient to ensure that the report is accurate and supported. As HHS and DOJ accelerate the reporting process in an attempt to complete the report by the January 1 mandated reporting deadline, it is important that they establish controls that are designed to provide complete, accurate, and reliable information in the annual HCFAC report. Based on our review of the fiscal years 2008 and 2009 HCFAC reports, HHS and DOJ do not have sufficient controls for maintaining and retaining documentation and performing monitoring such as reconciliation and review activities to ensure accurate and consistent reporting of HCFAC deposits and expenditures. These design weaknesses led to instances where documentation was not readily available and amounts included in the HCFAC reports contained errors. Until HHS and DOJ strengthen their controls for documenting and monitoring HCFAC reporting processes, their ability to provide Congress with an accurate and timely annual report of HCFAC activities will continue to be compromised. Inaccuracies in the mandated annual report limit its usefulness to congressional decision makers and other interested parties. We are making the following 11 recommendations to HHS and DOJ to improve controls over the accounting and reporting of HCFAC activities. We recommend that the Secretary of HHS, direct the Administrator of CMS to: revise procedures for properly maintaining supporting documentation for HCFAC deposits and expenditures, to include specifying the titles of staff responsible for maintaining supporting documentation; develop written procedures that incorporate monitoring controls for HCFAC deposit information recorded in the departmentwide accounting system, including reconciling the deposit data in this system to the regional offices’ data collection system; direct the Assistant Secretary for Aging to: revise the Administration on Aging’s procedures for properly maintaining supporting documentation for HCFAC expenditures, to include specifying the titles of staff responsible for maintaining supporting documentation and the location of records; develop written procedures that incorporate monitoring controls to verify that the payroll expenditures charged against HCFAC are reasonable and supported; and direct the Acting General Counsel to develop written procedures that incorporate monitoring controls for the Office of the General Counsel staff hours related to HCFAC activities captured in workload tracking systems, including the reconciliation to staff hours captured in the departmentwide payroll system; and develop written procedures in collaboration with DOJ that incorporate monitoring controls for preparing the joint annual HCFAC report to help ensure reported amounts are accurate. We recommend that the HHS Inspector General develop written procedures that incorporate monitoring controls for HHS OIG staff hours related to HCFAC activities captured in workload tracking systems, including the reconciliation to staff hours captured in the departmentwide payroll system. We recommend that the Attorney General direct the Deputy Assistant Attorney General / Controller to: revise procedures for properly maintaining supporting documentation for HCFAC deposits and expenditures, to include specifying the titles of staff responsible for maintaining supporting documentation and the location of records; develop written procedures that incorporate monitoring controls for reconciling HCFAC deposits of the 3 percent portion of penalties and multiple damages information recorded in the departmentwide accounting system to the HI trust fund statements; develop written procedures that incorporate monitoring controls to verify that the payroll expenditures charged against HCFAC are reasonable and supported; and develop written procedures in collaboration with HHS that incorporate monitoring controls for preparing the joint annual HCFAC report to help ensure reported amounts are accurate. We provided a draft of this report to HHS and DOJ for review and comment. Written comments from the HHS Assistant Secretary for Legislation are reproduced in appendix III. DOJ indicated via e-mail that it agreed with the findings and the four recommendations we made to revise or develop written procedures that include documentation and monitoring controls for HCFAC activities and reporting. While DOJ did not provide written comments, it provided technical comments, as did HHS, that we incorporated as appropriate. We made a total of 11 recommendations, 7 to HHS and 4 to DOJ. Of the seven recommendations we made, in its written comments, HHS generally agreed with five, disagreed with one, and did not address the remaining recommendation. Specifically, HHS agreed with our recommendation related to revising the Administration on Aging’s procedures for properly maintaining supporting documentation for HCFAC expenditures and stated that it plans to incorporate these changes by summer 2011. Also, HHS agreed with our recommendation to develop written procedures for preparing the joint annual HCFAC report and indicated that it has begun to work with DOJ to improve the Report Completion Guide. In addition, HHS OIG agreed with our recommendation to develop written procedures that incorporate monitoring controls for staff hours related to HCFAC activities recorded in its workload tracking systems and stated that it will incorporate these procedures into its formal policies. Further, the Administration on Aging stated its view that addressing our recommendation to develop written procedures to verify that HCFAC payroll expenditures are reasonable and supported would not provide material results to justify the additional expense and workload. However, the Administration on Aging agreed to explore other options to refine its HCFAC payroll expenditures. The Office of the General Counsel agreed and stated that it had addressed our recommendation to develop written procedures that incorporate monitoring controls for staff hours recorded in the workload tracking system. It stated that on February 2, 2011, it provided us procedures for properly accounting for HCFAC expenditures. While we received procedures from the Office of the General Counsel, these procedures did not address our finding. Instead, the procedures discussed the transfer of payroll expenditures to the HCFAC account. Therefore, we determined that this recommendation has not been addressed. CMS disagreed with our recommendation to revise procedures for maintaining supporting documentation for HCFAC deposits and expenditures, which include specifying the titles of staff responsible for maintaining supporting documentation. CMS stated that the National Archives and Records Administration does not require staff titles on a standard form it prescribes for transferring records to approved records facilities (SF-135) and that CMS requires staff to take records retention training each year. CMS also stated it believes the information maintained is sufficient to ensure accountability and proper and consistent supporting documentation for HCFAC deposits and expenditures. However, we continue to believe that CMS’s policies and procedures for documentation are insufficient, as they do not identify the staff responsible for maintaining documentation as required by the National Archives and Records Administration regulations. Also, CMS stated that the creation of a new records retention system for HCFAC records would be duplicative and unnecessary. We do not believe that a new records retention system exclusively for HCFAC records is necessary to achieve accountability for documentation responsibilities. Rather, a modification to CMS’s existing procedures that identifies the responsible staff by title to show authority levels for properly maintaining supporting documentation, help provide continuity when staff change positions, and promote accountability would be sufficient to address this shortcoming. Lastly, in its comments, CMS did not address our remaining recommendation to develop written procedures that incorporate monitoring controls for HCFAC deposit information recorded in the departmentwide accounting system. However, as we stated in the report, CMS officials told us in February 2011 that they were in the process of developing procedures that require the reconciliation of HCFAC deposit information. As we agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution of it until 30 days from the report date. At that time, we will send copies to the Secretary of HHS, the Attorney General, and other interested parties. The report will also be available at no charge on GAO’s Web site at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-9312 or dalykl@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV. The objectives of this review were to determine to what extent the Department of Health and Human Services (HHS) and the Department of Justice (DOJ) (1) took action to address the recommendations we made in 2005 and (2) designed effective controls over reporting Health Care Fraud and Abuse Control (HCFAC) program deposits and expenditures for fiscal years 2008 and 2009. To address the extent to which HHS and DOJ took action to address the recommendations made in 2005, we: Obtained and reviewed documentation provided by HHS and DOJ such as policies and procedures and the Report Completion Guide. Interviewed officials at HHS and DOJ including the Acting Deputy Inspector General and the Assistant Director of the Executive Office for United States Attorneys to identify actions to improve HCFAC program operations. To address the extent to which HHS and DOJ designed effective controls over reporting HCFAC deposits and expenditures, we: Obtained and reviewed relevant HHS and DOJ policies and procedures for reporting deposits and expenditures within each agency. Used criteria outlined in our Standards for Internal Control in the Federal Government, specifically as it relates to control activities and monitoring, to assess the effectiveness of controls over the reporting of amounts related to deposits and expenditures. We applied these standards to assess whether the design of the controls documented in the policies and procedures reasonably assured accurate and consistent reporting of HCFAC amounts in the joint annual HCFAC report. We did not verify the validity or accuracy of the reported amounts. Assessed the reliability of data used to select our nongeneralizable tracing deposit control totals of the electronic databases to the corresponding deposit line item totals reported in the HCFAC reports and the Bureau of the Public Debt’s Federal Hospital Insurance Trust Fund (HI trust fund) statements; obtaining the funding decision memorandum detailing how the HCFAC funds would be distributed between HHS and DOJ for fiscal years 2008 and 2009 to verify the HCFAC funds certified by HHS and DOJ officials; comparing amounts reported in the joint HCFAC reports to the approved funding decision memorandum and comparing amounts from the decision memorandum to the Office of Management and Budget (OMB) documentation (Apportionment Schedule SF-132) to verify that the amounts were made available; tracing total expenditure amounts to supporting documentation, including electronic databases, billing packages, and intra- and interagency agreements; and reviewing existing information about the electronic data and the systems that produced them. We determined that the data were sufficiently reliable to select our samples. Selected a nongeneralizable stratified random sample for each of the deposit types (gifts and bequests, criminal fines, civil monetary penalties, and penalties and multiple damages) that HHS and DOJ reported a dollar amount greater than zero in the fiscal years 2008 and 2009 annual HCFAC reports. We selected a total of 47 deposit transactions for fiscal year 2008 and 55 transactions for fiscal year 2009. Transaction selection criteria included various factors such as dollar amounts and transaction volume. For the selected transactions, we reviewed various sources of documentation depending on the type of deposit to determine whether dollar amounts were accurately reported. Examples of supporting documentation for deposits included check registers; electronic fedwires; health care tracking forms used to allocate deposit collections among the various health care programs; judgment orders and agency letters identifying applicable fines and penalties assessed; and collection system query reports. These randomly selected transactions were designed to provide additional details about the processing of those transactions and were not intended to be representative of the universe of HCFAC transactions. See appendix II for information about the universe of transactions and our sampled items. Selected a nongeneralizable random sample of expenditures for each of the agency components that were allocated HCFAC appropriation funds as reported in the annual HCFAC reports for fiscal years 2008 and 2009. For the Centers for Medicare & Medicaid Services (CMS) and the United States Attorneys Office (USAO), we obtained electronic databases and selected a nongeneralizable stratified random sample for those agency components. We selected a total of 63 transactions for fiscal year 2008 and 62 transactions for fiscal year 2009 related to payroll and nonpayroll expenditures. Transaction selection criteria included various factors such as dollar amounts, transaction volume, and source of information. For these transactions, we reviewed various sources of documentation depending on the type of expenditure to determine whether dollar amounts were accurately reported and the use of funds were consistent with the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Examples of supporting documentation for expenditures included workload tracking system and payroll system query reports; time and attendance reports; salary forms; invoices; contracts; and travel vouchers. These randomly selected transactions were designed to provide additional details about the processing of those transactions and were not intended to be representative of the universe of HCFAC transactions. See appendix II for information about the universe of transactions and our sampled items. Performed additional procedures for HHS Office of Inspector General (OIG) payroll transactions as this component received 67 percent and 42 percent of total HCFAC appropriations allocated for fiscal years 2008 and 2009, respectively. Specifically, we (1) obtained time reports from workload tracking systems for all four OIG components (Office of Audit Services, Office of Investigations, Office of Evaluations and Inspections, and Office of Counsel to the Inspector General) to determine if the projects identified as HCFAC were properly classified; and (2) compared the number of hours in the workload tracking systems to the number of hours in the HHS payroll system to determine if the components’ systems included hours for all staff. Interviewed agency officials from HHS and DOJ including budget analysts and financial specialists to obtain an understanding and clarification of the processes used to report deposits to the HI trust fund and appropriations from this fund, including related expenditures. We conducted our work from February 2010 through May 2011 in accordance with U.S. generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. During our review of fiscal years 2008 and 2009 Health Care Fraud and Abuse Control (HCFAC) program activities, we selected nongeneralizable samples to further understand the Department of Health and Human Services (HHS) and the Department of Justice (DOJ) procedures for HCFAC deposits and expenditures. For deposits, we stratified the data and selected random transactions, as summarized in table 1 below, for each of the deposit types authorized by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) for which HHS and DOJ reported dollar amounts greater than zero in the fiscal years 2008 and 2009 HCFAC reports. For expenditures, we selected samples from object classes that in aggregate accounted for 50 percent or more of total obligations for each component that received HCFAC funds. Based on dollar amounts, we then selected random transactions, as summarized in table 2 below. Appendix III: Comments from the Department of Health and Human Services GENERAL COMMENTS OF THE DEPARTMENT OF HEALTH AND HUMAN SERVICES (HHS) ON THE GOVERNMENT ACCOUNTABILITY OFFICE’S (GAO) DRAFT REPORT ENTITLED, “HEALTH CARE FRAUD AND ABUSE CONTROL PROGRAM: IMPROVEMENTS NEEDED IN CONTROLS OVER REPORTING DEPOSITS AND EXPENDITURES” (GAO-11-446) The Department appreciates the opportunity to comment on this draft report. GAO Recommendation No. 1 We recommend that the Secretary of HHS direct the Administrator of CMS to: revise procedures for properly maintaining supporting documentation for HCFAC deposits and expenditures, to include specifying the titles of staff responsible for maintaining supporting documentation; develop written procedures that incorporate monitoring controls for HCFAC deposit information recorded in the departmentwide accounting system, including reconciling the deposit data in this system to the regional offices’ data collection system Centers for Medicare and Medicaid Services (CMS) Response CMS disagrees with GAO’s assertion that we have inadequate controls or procedures regarding retention of HCFAC related records because we do not explicitly identify the title of staff responsible for management of such records. Standard Form 135, Records Transmittal and Receipt, which is prescribed by the National Archives and Records Administration (NARA), accompanies all records stored in an approved facility, and includes the Agency contact name, office, and telephone number, but NARA does not require staff titles. Each CMS component is responsible for following all federal records retention policies for its HCFAC-related functions. Also, all CMS employees are required to take records retention training each year, and are responsible for appropriately and consistently applying CMS’ Records Management guidelines. CMS believes the information it maintains is sufficient to ensure accountability and proper and consistent supporting documentation for HCFAC deposits and expenditures. CMS believes that specifying the titles of particular CMS staff is unwarranted and that creation of a new records retention system uniquely for HCFAC records would be duplicative and unnecessary. GAO Recommendation No. 2 We recommend that the Secretary of HHS direct the Assistant Secretary for Aging to: revise the Administration on Aging’s procedures for properly maintaining supporting documentation for HCFAC expenditures, to include specifying the titles of staff responsible for maintaining supporting documentation and the location of records; develop written procedures that incorporate monitoring controls to verify that the payroll expenditures charged against HCFAC are reasonable and supported Administration on Aging (AoA) Response We agree with the first part of the recommendation, on the maintenance of supporting documentation and will move forward to incorporate these changes into our filing system by Summer 2011, to the extent feasible. Concerning the second part of the recommendation, on developing written procedures incorporating monitoring controls, we have used the same approach to capture HCFAC payroll charges for more than a decade. At the beginning of each year, AoA surveys each of the GENERAL COMMENTS OF THE DEPARTMENT OF HEALTH AND HUMAN SERVICES (HHS) ON THE GOVERNMENT ACCOUNTABILITY OFFICE’S (GAO) DRAFT REPORT ENTITLED, “HEALTH CARE FRAUD AND ABUSE CONTROL PROGRAM: IMPROVEMENTS NEEDED IN CONTROLS OVER REPORTING DEPOSITS AND EXPENDITURES” (GAO-11-446) approximately twenty-seven staff in Headquarters and the Regional Offices who work on HCFAC activities to determine the percentage of time each individual estimates that they will spend, on average, over the entire year on HCFAC. The Accounting for Pay System (AFPS) is then used to allocate the same estimated percentage of the person’s pay to HCFAC funding each pay period, regardless of the number of hours the person actually works on HCFAC during those specific two weeks. The percentages allocated for most staff are small—no more than ten to twenty-five percent in most cases. In the aggregate this resulted in FY 2008 in approximately 29%, or $879,607, of AoA’s $3.1 million FY 2008 HCFAC allocation being used for personnel costs, a reasonable percentage given that these dollars are used to provide administrative and related support for AoA’s Senior Medicare Patrol anti-fraud education program. AoA uses the Department’s ITAS system to track actual hours worked by employees, and this system does not have the ability to track hours spent on one type of activity versus another. To implement the type of controls that GAO recommends would therefore require the establishment of a completely new, wholly separate tracking system from that used by the Department for time and attendance purposes. Such a system would require employees to track and log hourly HCFAC activity, to cumulate and report that activity to a central tracking point of contact, and then require this information to periodically be used to adjust the labor distributions in the accounting system for each of those individuals. While this approach could result in a more accurate accounting, it would do so at a price of a very substantially increased workload at every level disproportionate to the amount of HCFAC funding received. Further, some time ago, AoA eliminated requirements that employees sign in and out and keep a written record of their time and attendance in connection with collective bargaining agreements. AoA does not believe that the penny-wise approach favored by GAO would have sufficiently material results as to justify the additional expense and workload. AoA is willing, however, to engage in exploratory discussions with other Operating Divisions within the Department who may be faced with similar situations—whether or not related to HCFAC dollars—to determine if there are other approaches which might allow it either to further refine the payroll charges or to further adjust a subsequent year’s estimated percent of time spent on HCFAC. If a less resource intensive solution could be identified, AoA would be open to its implementation. GAO Recommendation No. 3 We recommend that the Secretary of HHS direct the Acting General Counsel to: develop written procedures that incorporate monitoring controls for the Office of the General Counsel staff hours related to HCFAC activities captured in workload tracking systems, including the reconciliation to staff hours captured in the departmentwide payroll system GENERAL COMMENTS OF THE DEPARTMENT OF HEALTH AND HUMAN SERVICES (HHS) ON THE GOVERNMENT ACCOUNTABILITY OFFICE’S (GAO) DRAFT REPORT ENTITLED, “HEALTH CARE FRAUD AND ABUSE CONTROL PROGRAM: IMPROVEMENTS NEEDED IN CONTROLS OVER REPORTING DEPOSITS AND EXPENDITURES” (GAO-11-446) Office of the General Counsel (OGC) Response At the time of this review, OGC did not have written procedures in-place to clarify 1) its method of using Practice Manager (PM) workload reports to transfer pay between non-HCFAC and HCFAC specific Common Accounting Numbers (CANs) in the Department’s Accounting For- Pay System (AFPS) and 2) its corresponding reconciliation process. Financial data reconciliation is common practice for government budget staff as part of their regular duties/responsibilities as budget analysts and thus routinely occurs in the absence of specific documented procedures. Nonetheless, prior to the issuance of this draft report, OGC developed such policy guidance in order to detail its procedures for properly accounting for its associated cost-of-work performed on behalf of HCFAC. OGC provided this HCFAC Account Expenditures Policy Guidance to GAO on February 2, 2011. GAO Recommendation No. 4 We recommend that the Secretary of HHS develop written procedures in collaboration with DOJ that incorporate monitoring controls for preparing the joint annual HCFAC report to help ensure reported amounts are accurate. HHS Response The Department agrees that having written procedures, or guidance, for the joint annual HCFAC report will work to ensure accurate reporting. To further this goal, HHS and DOJ developed the Department of Health and Human Services and Department of Justice Annual Report on the Health Care Fraud and Abuse Control Program: Report Completion Guide as part of the FY 2010 HCFAC Report process. DOJ shared this manual with GAO in the fall of 2010. However, in response to this GAO report, HHS and DOJ have been working collaboratively to improve the content of this manual, specifically to ensure the accuracy of the numbers included in the “Monetary Results” table of the annual HCFAC report. The updated manual will include a detailed matrix that describes each transfer or deposit figure included in the “Monetary Results” table of the HCFAC report, which agency is responsible for reporting that figure, the source of the data, and who is responsible for verifying the final numbers published in the Annual Report. This report, or guidance, will be distributed annually to all relevant HHS Operating Divisions as well as all relevant components within DOJ. GAO Recommendation No. 5 We recommend that the HHS Inspector General (OIG) develop written procedures that incorporate monitoring controls for HHS OIG staff hours related to HCFAC activities captured in workload tracking systems, including the reconciliation to staff hours captured in the departmentwide payroll system. GENERAL COMMENTS OF THE DEPARTMENT OF HEALTH AND HUMAN SERVICES (HHS) ON THE GOVERNMENT ACCOUNTABILITY OFFICE’S (GAO) DRAFT REPORT ENTITLED, “HEALTH CARE FRAUD AND ABUSE CONTROL PROGRAM: IMPROVEMENTS NEEDED IN CONTROLS OVER REPORTING DEPOSITS AND EXPENDITURES” (GAO-11-446) Office of Inspector General (OIG) Response HHS OIG concurs with this recommendation. OIG continues to assert that our workload tracking accurately captures total staff hours and the staff hours allocable to HCFAC-related activities. Nevertheless, HHS OIG agrees to incorporate these implemented procedures into formal written policies that will include reconciliation of overall staff hours to the department- wide payroll system. In addition to the contact listed above, Carla J. Lewis (Assistant Director), Maria C. Belaval, Sharon O. Byrd, William L. Evans, Maria Hasan, Christopher N. Howard, Jason S. Kirwan, Mitchell D. Owings, and Nina M. Rostro made significant contributions to this report.

Summary: To help combat fraud and abuse in health care programs, including Medicare and Medicaid, Congress enacted the Health Care Fraud and Abuse Control (HCFAC) program as part of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). HIPAA requires that the Departments of Health and Human Services (HHS) and Justice (DOJ) issue a joint annual report to Congress on amounts deposited to and appropriated from the Federal Hospital Insurance (HI) Trust Fund for the HCFAC program. In April 2005, GAO reported on the results of its review of HCFAC program activities for fiscal years 2002 and 2003 and made recommendations to HHS and DOJ. The objectives of this requested review were to assess the extent to which HHS and DOJ (1) took actions to address the recommendations made in the 2005 report and (2) designed effective controls over reporting HCFAC deposits and expenditures for fiscal years 2008 and 2009. GAO reviewed HHS and DOJ documentation; selected nongeneralizable samples; and interviewed agency officials. Although HHS and DOJ have taken action to address our previous recommendations aimed at improving procedures for recording HCFAC expenditures and issuing the annual HCFAC report, GAO found that controls are not sufficient to ensure that the report is accurate and supported. HHS and DOJ took action to address three of the four recommendations in GAO's 2005 report related to recording staff hours in agency workload tracking systems, using the appropriate account class to record HCFAC expenditure data, and expediting the review process for issuing the annual HCFAC report. Neither agency agreed with the remaining recommendation to notify Congress on delays in issuing the HCFAC report within 1 month after missing the mandated January 1 deadline and thus, did not take action. However, in June 2010, HHS and DOJ implemented an expedited review process for completing the HCFAC report. The fiscal year 2010 HCFAC report was issued on January 24, 2011, 23 days later than the mandated reporting date. According to DOJ officials responsible for preparing the HCFAC report, they intend to use this new expedited review process to meet the mandated deadline when preparing future year reports. Regarding the design of controls, while HHS and DOJ had designed polices and procedures for documentation that generally required the retention of documentation for 6 years, these did not provide sufficient controls to ensure adequate support of HCFAC deposits and expenditures, in accordance with internal control standards. (1) Components at both HHS and DOJ that manage HCFAC activities did not include in their respective policies and procedures controls that specified the person responsible for maintaining the records, the location of records, or a combination of both. (2) GAO found instances at HHS and DOJ where documentation could not be provided to support HCFAC expenditures, such as time and attendance reports. Also, both agencies did not have sufficient monitoring controls such as reconciliations, comparisons, and supervisory reviews, as outlined in internal control standards, to ensure accurate reporting of HCFAC deposits and expenditures. As a result, GAO found instances where data recorded in accounting and payroll systems were inconsistent with other sources such as the HI trust fund statements and agency workload tracking systems. GAO also identified presentation errors in the 2008 and 2009 annual HCFAC reports. For example, in reviewing the line item for restitution and compensatory damages, GAO found that $717 million (70 percent) of the $1.03 billion reported in the fiscal year 2009 HCFAC report was not transferred to the HI trust fund as stated in the report. These amounts, primarily related to Medicare Part B and Medicaid, were transferred to the Federal Supplementary Medical Insurance Trust Fund and the Medicaid appropriation account as required. These inaccuracies overstated the amount of funds transferred to the HI trust fund. GAO makes 11 recommendations to HHS and DOJ to revise or develop written procedures that include documentation and monitoring controls for HCFAC activities and reporting. DOJ agreed with all four of its recommendations. Of the seven recommendations to HHS, it generally agreed with five, disagreed with one, and did not address the remaining recommendation.