The Health Insurance Portability and Accountability Act of 1996 amended the Social Security Act (the act) to, among other things, (1) establish a Health Care Fraud and Abuse Control Program and (2) establish an expenditure account, designated as the Health Care Fraud and Abuse Control Account (Account) within the Federal Hospital Insurance Trust Fund (Trust Fund). The Account is administered by Department of Health and Human Services’ (HHS) Office of Inspector General and DOJ. The amendment also makes appropriations for the Account from the general fund of the U.S. Treasury. The appropriations are in specified amounts for each fiscal year beginning with fiscal year 1997 for transfer to FBI to carry out its health care fraud investigations. In 1997 HHS and FBI entered into an interagency agreement to facilitate the required annual transfer of funds from the Account to FBI solely for its health care fraud investigations. FBI receives the transferred funds and records the funds in its Salaries and Expenses (S&E) appropriation account at the beginning of each fiscal year. FBI then incurs obligations for health care fraud investigations and makes payments from the S&E account, which is also used to make payments for other FBI mission-related and support activities. The amounts that were transferred to FBI as required by the act for the years of our review were as follows: fiscal year 2000: $76 million, fiscal year 2001: $88 million, fiscal year 2002: $101 million, and fiscal year 2003: $114 million (and each subsequent year). The amendment requires that these funds be used solely to cover the costs (including equipment, salaries and benefits, and travel and training) of the administration and operation of the health care fraud and abuse control program, including the costs of prosecuting health care matters, investigations, financial and performance audits of health care programs, and inspections and other evaluations. These health care fraud investigations are managed nationally by FBI’s Health Care Fraud Unit (HCFU), which was created in 1992 within the Financial Crimes Section of the FBI’s Criminal Investigative Division. Health care fraud investigations include those for fraud against government programs and private insurance, as well as medical privacy law violations. HCFU is responsible for health care fraud investigations that are conducted by FBI’s field offices and, for management and reporting purposes, both HCFU and the related field investigations are considered a part of its White Collar Crime decision unit. FBI used a limited approach to monitoring its use of HIPAA transfers, which might have been sufficient when it clearly used more agent FTEs for health care fraud investigations than it had budgeted. But this approach was insufficient when some of the agent FTEs previously devoted to health care fraud investigations were shifted to counterterrorism activities, causing actual FTEs to fall below budgeted FTEs. At the time of our review, FBI’s Financial Management System (FMS) was unable to track overall costs related to health care fraud investigations. As a result, FBI had minimal assurance that all of the transferred HIPAA funds were properly spent. DOJ is currently planning to implement the new DOJ-wide Unified Financial Management System, but it has yet to develop the specific systems requirements to enable it to accurately capture all of the costs of its health care fraud investigations and therefore to help monitor compliance with HIPAA and other relevant laws and regulations. FBI’s budget for health care fraud investigations was equivalent to the amount of the HIPAA transfers and included only the direct program costs. These direct costs consisted of payroll and benefits for agents and certain other personnel involved in health care fraud investigations, plus related costs such as rent and supplies. FBI used an approach to monitoring the use of HIPAA transfers that considered agent FTEs only without considering the other direct program costs. For the 4 years we reviewed, the agent FTEs represented about 42 percent of the budgeted amounts for work on health care fraud investigations, while the other direct program costs represented about 58 percent of the budgeted amounts. FBI obtained agent FTEs from reports generated by its time utilization system, which records the percentage of time that agents worked on each investigative classification and, if applicable, major cases. FBI officials told us that prior to September 11, 2001, reported agent FTEs charged to the health care fraud investigations were historically far in excess of those budgeted and they were satisfied that the resources expended on health care fraud investigations exceeded the HIPPA transfers. For example, in fiscal year 2000, FBI reported that health care fraud agent FTEs exceeded the number budgeted that year by about 19 percent. However, this limited approach to monitoring the use of the HIPAA transfers was insufficient when agent FTEs were shifted to counterterrorism activities after September 11, 2001, because it lacked the specificity of cost information for both direct and indirect costs. Furthermore, FBI’s FMS was not capable of providing this specific cost information. Therefore, in years when reported agent FTEs were close to or below budgeted FTE amounts, FBI had no effective mechanism in place to monitor compliance with HIPAA. This was the case when reported agent FTEs approximated the budgeted amounts in fiscal year 2001 and fell below budgeted FTEs in fiscal years 2002 and 2003 by 31 percent and 26 percent, respectively. Reliable information on the costs of federal programs and activities is crucial for the effective management of government operations and assists internal and external users in assessing the budget integrity, operating performance, stewardship, and systems and control of program activities. In this regard, the Chief Financial Officers Act of 1990 expressly calls on agencies to provide for the systematic measurement of performance and the development of cost information. In addition, “Statement of Federal Financial Accounting Standards Number 4” established for all federal agencies cost accounting concepts and standards aimed at providing reliable and timely information on the full cost of federal programs, their activities, and outputs. Cost information for program activities is especially crucial in order to properly manage and account for funds that have been appropriated, or in this case, transferred for certain authorized purposes. FBI’s FMS has minimal capability to track health care fraud investigation and other specific program costs necessary to meet federal guidance. FMS tracks costs by cost center, of which only headquarters costs are separately identifiable by program. However, substantially all of the direct costs for health care fraud investigations are incurred at the individual field offices, each of which is considered separate cost centers. The specific program costs within each field location, therefore, are not individually tracked or separately identifiable. As a result, FBI cannot use FMS to track and report all health care fraud investigation costs. DOJ is currently in the process of implementing a new financial management system. The new UFMS is likely to have the capability to capture nonpersonnel costs on a program or subprogram basis, if design specifications are set to do so. However, according to FBI finance officials, specifications have not been set up for UFMS to capture total payroll costs at the program level. These costs amounted to about 55 percent of the budgeted health care fraud investigation costs. Under UFMS as currently planned, payroll costs are to be processed by the U.S. Department of Agriculture’s National Finance Center (NFC) starting in 2006 and recorded at the summary level. As a result, they will be combined with the payroll costs of other programs and will not be separately identifiable. NFC officials told us that they recommend that all customers receive summary and detailed-level data. NFC uses a 27-digit accounting code, of which 24 digits are available to agencies to establish an account structure for detailed payroll information such as program, subprogram, and job code levels. NFC officials also stated that they met informally with FBI personnel and explained how the accounting codes could be used to support FBI’s needs. An FBI official told us that because of security concerns, FBI would have to give consideration to using such codes. The absence of accounting codes for programs and subprograms or other control mechanisms for monitoring payroll and other costs will continue to impede FBI’s ability to assess compliance with HIPAA and other relevant laws and regulations. In the absence of system-generated program costs and upon our request for cost schedules, FBI began developing an estimate of its health care fraud investigation costs incurred for fiscal years 2000 through 2003 in an attempt to determine the propriety of its use of the HIPAA transfers. FBI engaged in extensive manual efforts and developed cost estimates that, in their final form, appropriately considered both direct program costs and the portion of indirect, FBI-wide support unit costs that related to the health care fraud program. However, we found that the estimates were either directly or indirectly based on data from FBI’s time utilization system, which had not been properly validated, and various other data that were not adequately supported. As a result, despite a good-faith effort by FBI to estimate these costs, neither we nor FBI could reliably determine whether the HIPAA transfers were spent solely on health care fraud investigations for the 4-year period. FBI officials told us at the start of our review that they were unable to provide us with a report of actual costs and had not previously estimated the costs associated with the transfers for fiscal years 2000 through 2003 primarily because of the financial systems’ weaknesses that we previously discussed. As an alternative, they proposed to provide us with an estimate of health care fraud investigation costs and subsequently developed an estimation methodology. Because cost estimates for this program had never before been attempted, FBI tried different approaches and revised the estimates several times during our review. The first three estimates for the 4-year period were revised to reflect slight changes in the methodology and to correct an error in the estimates but were quite similar to each other in method and in results. In essence, FBI estimated the direct costs for each budgeted line item of the health care fraud program. These were categorized into four groups: (1) headquarters payroll and benefits; (2) agent payroll and benefits; (3) other field personnel’s payroll and benefits; and (4) related nonpersonnel costs such as utilities, equipment, and supplies. The method for estimating each group is as follows: Headquarters payroll and benefits, as previously discussed, were predominantly tracked in FMS. The agent payroll and benefits costs, accounting for approximately 46 percent of FBI’s estimated program costs for the 4 years, were estimated directly on the basis of agent FTEs reported in FBI’s Time Utilization and Record Keeping (TURK) system and average FBI-wide salaries and benefits for General Schedule 10-13 field agents. The other field personnel’s payroll and benefits, which represented about 29 percent of FBI’s estimated program costs for the 4 years, were estimated from a combination of sources, including investigative support staff FTEs from its TURK system, that were summarized in two manual spreadsheets. The spreadsheets were prepared by two staff members, one of whom no longer works at FBI. The methodology for this staff member’s spreadsheet is uncertain, and the results could not be verified. FBI’s related nonpersonnel cost estimates were generally proportionate to the budgeted amount on the basis of a ratio of budgeted FTEs versus the FTEs reported in the TURK system. For example, for fiscal year 2003, the nonpersonnel costs line-item amounts were estimated at about 79 percent of the budgeted amount, since only 664 total FTEs were reportedly charged to health care fraud investigations, while a total of 844 FTEs were budgeted. However, the budgeted and estimated amounts for these costs were not subsequently compared with actual costs for any of the years presented in order to verify the reasonableness of the amounts. We determined that the primary source data used either directly or indirectly to estimate the health care fraud costs, as reported from the TURK system, had not been properly tested to determine the reliance that could be placed on the information. Prior to fiscal year 2002, the work time percentages and related investigative classification information in the TURK system, which has been operational in its current form since 1991 and is used by FBI for a variety of budgetary and program management decision making, had never been properly validated. We found that for fiscal years 2002 and 2003, FBI conducted limited internal testing, including tests on whether the work hours recorded in the system were correctly charged to the appropriate investigative case. The tests were performed at all of the field office locations and produced error rates that varied from year to year and across field locations but were not conducted on statistically valid samples. Therefore, the results cannot be applied to the population beyond the specific items tested. Nonetheless, the identified errors raise questions about the reliability of the data in TURK and demonstrate the need for additional data validation work by FBI. In addition, a key financial official indicated that at least one of the tests might not have been properly designed to validate the data. In addition to the lack of validation of the TURK data, certain other supporting documentation could not be verified or was not adequate. Examples include the following: The health care fraud equipment account, approximately 5 percent of budgeted amounts for the 4 years, funded purchases other than equipment such as travel and training expenses and was used much like a discretionary account. FBI officials told us that at year’s end, these nonequipment costs were adjusted by moving them out of the equipment account and into the appropriate line item on the basis of the amounts recorded in a detailed listing of purchases prepared by HCFU. We were unable to reconcile the amount of purchases recorded in the detailed equipment listings or the amount of interaccount adjustments to the FBI cost estimates, and no such reconciliation was provided by FBI. The amount of interaccount adjustments ranged from $424,000 to $7.5 million a year for the 4 years under review. FBI used average salaries of support personnel at year’s end that might not have accurately represented the mix of salaries of the staff supporting health care fraud investigations whose duties ranged from administrative to professional (e.g., medical experts). FBI surveyed field office managers in an effort to capture other FTEs that were related to health care fraud investigations. Field managers estimated the portion of hours or FTEs spent investigating health care fraud cases that were recorded in TURK under other investigative classifications. For example, a case dealing with an Internet pharmacy that was investigated by a Cyber Crimes squad could be considered a health care fraud investigation and included in the estimate of health care fraud costs. These other agent FTEs are difficult to verify and, in some cases, were reported from memory. On average, the first three FBI cost estimates showed that FBI spent $33 million more on health care fraud investigations than the amount of the HIPAA transfers for fiscal years 2000 and 2001 and about $29 million less than the HIPAA transfers for fiscal years 2002 and 2003. When we were provided with these cost estimates, FBI officials stated that this shift in resources away from health care fraud investigations in the latter 2 years was a result of the increase in the counterterrorism investigative activity after the September 11 attacks. FBI management prepared a fourth and final cost estimate that included an allocation of the additional costs of other FBI units, such as forensic laboratory services and mandatory training that support various FBI programs, including the health care fraud program. While it is generally appropriate to include such indirect costs when determining total program costs, these additional costs were not previously considered when budgeting the funds transferred by the Congress to FBI for its health care fraud investigations. Furthermore, these additional items were not included in DOJ’s October 2003 response to the Senate Finance Committee regarding FBI’s use of the HIPAA transfers. FBI estimated the portion of costs for each of the six support units— training, forensics, information management, technical field support, criminal justice services, and management and administration—that related to health care fraud investigations and added them to the estimates of direct costs previously provided to us in the third version. While FBI put forth a good-faith effort to devise a way to allocate the indirect support unit costs to health care fraud investigations, its methodology relied, in part, on layers of unvalidated data. For example, FBI allocated FBI-wide support unit costs as reported in its audited financial statements first to the DOJ Strategic Goal that included health care fraud investigations. The percentages used in this calculation were the same used to allocate costs for FBI’s Statement of Net Cost; however, FBI’s auditors said they did not validate the methodology or documentation supporting the allocation percentages. After FBI allocated the specific support unit costs to the DOJ Strategic Goals, FBI allocated those costs to health care fraud investigations using FTE data based primarily on TURK, which, as previously discussed, has not been validated. On average, the additional indirect costs represented approximately $34 million, or 27 percent of total health care fraud costs per year. With the addition of these indirect costs, FBI ultimately estimated that it spent more on health care fraud investigations than was funded by the HIPAA transfers for all 4 years. However, with the magnitude of unverified and inadequately supported data, neither we nor FBI could reliably determine whether the HIPAA transfers were spent solely on health care fraud investigations for the 4-year period. FBI’s monitoring approach for determining the proper use of HIPAA funding was limited and did not provide the level of assurance needed when agent FTEs devoted to health care fraud investigations were close to or below budgeted amounts. Absent a financial management system that could capture the costs of its health care fraud investigations, FBI had to resort to extensive manual efforts to estimate the costs but did not have the data needed to do so reliably. Until FBI improves its data reliability and either develops a financial management system capable of tracking and reporting health care fraud investigation cost information or some other effective monitoring approach, it will continue to lack sufficient accountability over the use of the HIPAA transfers. Inadequate accountability hinders efforts to budget, manage, and account for program funds appropriately and will leave FBI at an increased risk of violating HIPAA and other laws. We are making four total recommendations—two enhancing FBI’s accountability over the HIPAA transfers and the costs related to health care fraud investigations in the short term and two augmenting the new Unified Financial Management System’s cost-tracking capabilities in the long term. We recommend that the Director of the FBI take the following actions: Develop formal, interim policies and procedures for reporting health care fraud investigation costs that specify (1) the costs to be estimated and/or allocated, (2) the supporting documentation to be maintained, and (3) the method to validate those data used. Periodically conduct statistically valid testing of the data in the Time Utilization and Record Keeping system, in particular, the work time percentages and related investigative classification information to ensure the TURK system’s reliability. In addition, require field office managers to follow up on any issues identified in the testing. Either specify that the UFMS have the capability to allocate payroll costs provided by the NFC payroll system to specific programs or develop cost accounting codes at the program and subprogram levels to enable NFC to provide the necessary detailed payroll reports. Ensure that the UFMS has the capability and design specifications to track nonpersonnel costs related to health care fraud investigations. In a joint letter with written comments on a draft of this report (reprinted in appendix II), DOJ and FBI agreed with the four recommendations in this report and said they have begun to address the two short-term recommendations. Specifically, FBI is expecting to complete reviews of its procedures used to track health care fraud investigation costs and the collection and validation procedures for data entered into the TURK system by May 31, 2005. Concerning the long-term solution through financial management system enhancements, FBI acknowledged the need to establish control mechanisms to monitor both personnel and nonpersonnel costs related to health care fraud investigations to ensure the transparent allocation of FBI resources while maintaining appropriate levels of security. FBI notes that health care fraud investigations funded by HIPAA have contributed to a number of significant, high-profile case accomplishments as a result of the FBI’s dedication of HIPAA resources. FBI and DOJ officials provided oral comments on technical matters, which we have incorporated as appropriate. As agreed with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days from its issue date. At that time, we will send copies of this report to the Ranking Minority Member, Senate Committee on Finance; the Attorney General of the United States; the Director, FBI; the Director, Office of Management and Budget; and other interested parties. We will make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov. Should you or your staff have any questions on the matters discussed in this report, please contact me on (202) 512-9508 or by e-mail at calboml@gao.gov or contact Steven R. Haughton, Assistant Director, at (202) 512-5999 or haughtons@gao.gov. Major contributors to this report are included in appendix III. We reviewed the internal controls related to the use of the Health Insurance Portability and Accountability Act (HIPAA) transfers and the cost estimates of health care fraud investigations for fiscal years 2000 through 2003. We requested available documentation of the policies, procedures, and guidelines relating to the HIPAA transfers and the health care fraud program. We conducted interviews with Federal Bureau of Investigation (FBI) officials to obtain an understanding of the internal controls, including fund controls, in place over transferred funds. We reviewed the sufficiency of those internal controls in light of GAO’s Standards for Internal Control in the Federal Government. Because of the inability of FBI’s existing Financial Management System to produce program-level cost information as described in this report, FBI developed an estimate of the costs of health care fraud investigations. FBI provided us with a schedule of cost estimates for its health care fraud investigations for each of the 4 fiscal years, a description of the cost-estimation methodology, and various documentation that supported some of the headquarters and field office costs. During the course of our work, FBI modified its original schedule of cost estimates twice because of slight changes to the cost-estimation methodology. For all three schedules of costs, we evaluated the overall method of cost estimation to determine the method’s reasonableness and ability to assure that applicable laws and regulations were followed. Additionally, we (1) identified the sources of information used in the methodology; (2) verified, where possible, the underlying data flow and formulas; and (3) compared the cost estimates with the amount of funds transferred to FBI for each of the 4 years. FBI provided us with a fourth and final schedule of cost estimates on January 5, 2005, which included allocations of FBI-wide administrative and support costs not originally considered part of health care fraud costs. We requested supporting documentation for these additional allocations and reviewed the limited documentation that was available. FBI’s cost-estimation methodology was based significantly on information derived from the Time Utilization and Record Keeping system. We were unable to rely on this system’s data for the purpose of our review because the data for fiscal years 2000 and 2001 had not been validated and a limited internal review reported varying error rates for the data for fiscal years 2002 and 2003. The internal review, however, was not statistically valid. We did not attempt to independently validate the system. We performed our work from February 2004 through January 2005 in accordance with generally accepted government auditing standards. We requested written comments on this report from the Director of the FBI or his designee. A joint letter with comments from DOJ and FBI was received and is reprinted in appendix II. In addition to those named above, Sharon O. Byrd, Richard T. Cambosos, Tyshawn A. Davis, Lori B. Ryza, and Ruth S. Walk made key contributions to this report. The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to www.gao.gov and select “Subscribe to Updates.”

Summary: The Health Insurance Portability and Accountability Act of 1996 (HIPAA) provided, among other things, funding by transfer to the Federal Bureau of Investigation (FBI) to carry out specific purposes of the Health Care Fraud and Abuse Control Program. Congress expressed concern about a shift in FBI resources from health care fraud investigations to counterterrorism activities after September 11, 2001. Congress asked GAO to review FBI's accountability for the funds transferred under HIPAA for fiscal years 2000 through 2003. GAO determined (1) whether FBI had an adequate approach for ensuring the proper use of the HIPAA transfers and (2) the extent to which FBI had expended these transferred funds on health care fraud investigations in fiscal years 2000 through 2003. FBI used a limited approach to monitoring its use of HIPAA transfers, which might have been sufficient during times when it clearly used more agent full time equivalents (FTEs) for health care fraud investigations than budgeted but was insufficient when some of the agent FTEs previously devoted to health care fraud investigations were shifted to counterterrorism activities. FBI's budgeted FTEs (agent and other personnel) and related costs (such as rent and utilities) were equivalent to the amount of the HIPAA transfers. However, FBI's approach to monitoring the use of HIPAA transfers considered only agent FTEs, which made up about 42 percent of the budgeted health care fraud costs, but did not consider other personnel FTEs or related costs. According to FBI officials, they did not monitor these other budgeted amounts to determine compliance with HIPAA because the actual agent FTEs were historically far in excess of those budgeted. However, once FBI began to shift agent resources away from health care fraud investigations, agent FTEs charged to health care fraud investigations fell below the budgeted amounts, and FBI could no longer rely on this limited approach to ensure that the transferred HIPAA funds were properly used. Furthermore, FBI did not have a system in place to capture its overall health care fraud investigation costs, and therefore, was not in a position to determine whether or not all transferred HIPAA funds were properly expended. In response to GAO's review, FBI engaged in extensive manual efforts to develop cost estimates related to health care fraud investigations for fiscal years 2000 through 2003. The final estimate provided to GAO showed that FBI spent more on health care fraud investigations than was funded by transfers for each of the 4 years. However, GAO found that, overall, FBI's estimates of its health care fraud investigation costs were based on data that had not been or could not be fully validated. Therefore, even though FBI made a good-faith effort to estimate these costs, because of data limitations, neither GAO nor FBI could reliably determine whether all of the HIPAA transfers were spent solely for health care fraud investigations and related activities for the 4-year period. DOJ is currently planning the implementation of a new DOJ-wide UFMS, but it has yet to develop the specific systems requirements that would enable FBI to accurately capture all of its health care fraud-related costs and therefore to help monitor compliance with HIPAA and other relevant laws and regulations.