As reported in our high-risk series, as much as 10 percent of health expenditures nationwide are lost to fraud and abuse. In this regard, the HHS Office of the Inspector General (HHS/OIG) reported that in fiscal year 1997, an estimated 11 percent, or $20 billion of Medicare fee-for-service payments were improper. The Congress enacted HIPAA, in part, to respond to the problem of health care fraud and abuse. HIPAA consolidated and strengthened ongoing efforts to attack fraud and abuse in health programs and provided new criminal and civil enforcement tools, as well as expanded resources for fighting health care fraud, including $104 million in fiscal year 1997 for HCFAC. Under the joint direction of the Attorney General and the HHS Secretary (acting through the HHS/OIG), HCFAC is to achieve the following: coordinate federal, state, and local law enforcement efforts to control fraud and abuse associated with health plans; conduct investigations, audits, and other studies of the delivery and payment for health care in the United States; facilitate the enforcement of the civil, criminal, and administrative statutes applicable to health care; provide guidance to the health care industry, including the issuance of advisory opinions, safe harbor notices, and special fraud alerts; and establish a national database of adverse actions against health care providers. Funds for the HCFAC program are appropriated from the trust fund to a newly created expenditure account, referred to as the Health Care Fraud and Abuse Control Account, maintained within the trust fund. The Attorney General and the Secretary of HHS jointly certify that the funds transferred to the control account are necessary to finance health care anti-fraud and -abuse activities, subject to limits for each fiscal year as specified in HIPAA. Annual minimum and maximum amounts are earmarked specifically for HHS/OIG activities for the Medicare and Medicaid programs. For example, of the $104 million available in fiscal year 1997, a minimum of $60 million and maximum of $70 million was earmarked for the HHS/OIG. By earmarking funds specifically for the HHS/OIG, the Congress ensured continued efforts by the HHS/OIG to detect and prevent fraud and abuse in the Medicare and Medicaid programs. DOJ and HHS refer to the difference between the maximum annual HCFAC appropriation and the maximum amount earmarked for the HHS/OIG as the “wedge amount.” If the HHS/OIG is allocated less than the maximum statutory amount, that difference is added to the wedge amount, which is available to fund health care fraud and abuse activities at other HHS entities and DOJ. Funds that HHS and DOJ do not spend to administer and operate the program may be made available to other federal, state, and local agencies engaged in health care fraud and abuse activities. See appendix I for additional detail regarding HCFAC funding. HIPAA also requires amounts equal to the following types of collections to be deposited in the trust fund: criminal fines recovered in cases involving a federal health care offense, including collections pursuant to section 1347 of Title 18, United States Code, civil monetary penalties and assessments imposed in health care fraud amounts resulting from the forfeiture of property by reason of a federal health care offense, including collections under section 982(a)(6) of Title 18, United States Code, and penalties and damages obtained and otherwise creditable to miscellaneous receipts of the Treasury’s general fund obtained under the False Claims Act (sections 3729 through 3733 of Title 31, United States Code), in cases involving claims related to the provision of health care items and services (other than funds awarded to a relator, for restitution or otherwise authorized by law). HIPAA also authorizes the trust fund to accept unconditional gifts and bequests. To meet our first objective of identifying amounts deposited to the trust fund in fiscal year 1997 pursuant to HIPAA and the sources of these amounts, we reviewed HHS and DOJ’s fiscal year 1997 joint HCFAC report. We also obtained the trust fund’s fiscal year 1997 income statement, which received an unqualified opinion from the independent auditors, Cotton and Company. We compared amounts shown in the joint report as deposits of penalties and multiple damages, criminal fines, civil monetary penalties, and gifts and bequests with the respective amounts reported on the trust fund’s audited income statement. In addition, we selected 17 deposit transactions, focusing on large dollar amounts. We tested the selected transactions to determine whether they were correctly classified as deposits to the trust fund. Further, we interviewed personnel at various HHS and DOJ entities to gain an understanding of procedures and controls related to collecting and reporting deposits. To satisfy our second objective of identifying amounts appropriated from the trust fund in fiscal year 1997 for the HCFAC program and the reported justification for expenditures of such amounts, as well as our third objective of identifying expenditures from the trust fund for HCFAC activities not related to Medicare, we reviewed the joint report. We also reviewed documents supporting the allocation of the HCFAC appropriation, such as HHS’ and DOJ’s funding decision memorandum, proposals for the wedge amount, and reallocation documents. In addition, we selected nine expenditures and three obligations, focusing on large dollar amounts. We tested the selected transactions to determine whether they were justified for fraud- and abuse-related activities. Also, because payroll costs were predominantly allocated to the HCFAC appropriation, rather than accounted for directly, we reviewed the allocation methodologies at two entities—HHS/OIG and DOJ’s Criminal Division—to determine whether the methodologies were reasonable. Further, we interviewed personnel at various HHS and DOJ entities to gain an understanding of their procedures for allocating the HCFAC appropriation and reporting related expenditures, including non-Medicare related expenditures. To identify any savings to the trust fund, as well as any other savings, resulting from expenditures from the trust fund for the HCFAC program, which was our fourth objective, we reviewed the joint report. We reviewed all recommendations and the resulting cost savings as reported in the HHS/OIG’s fiscal year 1997 semiannual reports to determine whether such cost savings related to the HCFAC program. In addition, we selected 10 cost savings items from the fiscal year 1997 semiannual reports and reviewed supporting documentation to determine whether such cost savings related to fiscal year 1997 and were adequately substantiated. Further, we interviewed HHS/OIG personnel to determine their methodology for estimating cost savings. We reviewed deposit, appropriation, and savings information reported in HHS’ and DOJ’s joint report. Our review of reported trust fund deposit, appropriation, and savings information was conducted in accordance with standards established by the American Institute of Certified Public Accountants (AICPA)—Attestation Standards sections 100.03 through 100.52. A review is substantially less in scope than an audit. Accordingly, we do not express an opinion on amounts reported in the HHS and DOJ 1997 joint report. In response to HIPAA’s provision that we report on other aspects of the operation of the trust fund as we consider appropriate, we reviewed the status of HIPDB, the national health care fraud and abuse data collection program, which is a requirement of HIPAA. To gain an understanding of the program’s implementation and current status, we reviewed the program status report prepared by Health Resources and Services Administration (HRSA). We also interviewed knowledgeable personnel responsible for HIPDB’s development and reviewed various documents relating to the program. Specifically, we discussed the planning and current status of the data bank with personnel from HHS/OIG and HRSA, the organizations primarily responsible for HIPDB. We did not perform a systems review or consider whether HIPDB, as planned, will be compliant with Year 2000requirements. We performed work and contacted officials at the Health Care Financing Administration in Baltimore, Maryland; HHS Headquarters, the HHS/OIG, the Administration on Aging, and DOJ’s Justice Management Division, Executive Office of the United States Attorneys, Criminal Division, and Civil Division in Washington, D.C.; HRSA and HHS’ Program Support Center in Rockville, Maryland; and the Pennsylvania Eastern District United States Attorneys Office in Philadelphia, Pennsylvania. We conducted our work from February 1998 through May 6, 1998 in accordance with generally accepted government auditing standards, which incorporate AICPA standards and provide additional audit standards. We requested comments on a draft of this report from the Secretary of HHS and the Attorney General or their designees. The Inspector General of HHS provided us with written comments, which are reprinted in appendix II. On May 15, the DOJ Chief, Health Care Fraud Unit provided us with oral comments. Both agencies’ comments are discussed in the “Agency Comments” section. HHS and DOJ reported total deposits of $130.7 million to the trust fund in fiscal year 1997 pursuant to HIPAA. These deposits are reported as resulting almost totally from penalties and multiple damages obtained under the False Claims Act and criminal fines. Table 1 presents the total reported deposits to the trust fund in fiscal year 1997 pursuant to HIPAA as reported by HHS and DOJ in their fiscal year 1997 joint HCFAC report. We found no material weaknesses in the procedures that HHS and DOJ have put in place for identifying and reporting deposits pursuant to HIPAA. In addition, nothing came to our attention to suggest that HHS and DOJ did not accurately classify HIPAA deposits in their fiscal year 1997 joint HCFAC report, except for a $5 million overstatement of criminal fines that they noted in the joint report. Penalties and damages obtained under the False Claims Act and criminal fines resulting from health care fraud cases, as reported by HHS and DOJ, comprised about 68 percent and 32 percent, respectively, of the deposits to the trust fund pursuant to HIPAA. DOJ’s Civil Division in Washington, D.C., and Financial Litigation Units in United States Attorneys Offices located throughout the country collect penalties and damages resulting from health care fraud cases. They report collection information to DOJ’s Debt Accounting Operations Group, which in turn centrally accounts for collections of penalties and multiple damages and reports to the Department of the Treasury the amounts to be deposited to the trust fund. Clerks of the Administrative Office of the United States Courts located throughout the country collect criminal fines resulting from health care fraud cases and report these collections to the Financial Litigation Unit associated with their districts. The Financial Litigation Units report criminal fine collections to DOJ’s Executive Office of the United States Attorneys in Washington, D.C., which centrally reports the amount of criminal fines collected to the Department of the Treasury. We found that the amounts shown in the joint report as deposits of penalties and multiple damages, criminal fines, civil monetary penalties, and gifts and bequests agreed with the respective amounts reported on the trust fund’s audited fiscal year 1997 income statement. In addition, we found that the 17 deposit transactions we reviewed totaling approximately $43 million were accurately reported and classified as deposits to the trust fund. We also found that deposits reported in fiscal year 1997 primarily resulted from actions initiated prior to the creation of HCFAC. According to DOJ officials, investigation and litigation of health care fraud cases generally span several years. Once cases are settled, it may take several more years before any resulting fines, penalties, and damages are paid in full. Consequently, deposits to the trust fund reported in fiscal year 1997 pursuant to HIPAA essentially resulted from prior years investigation and litigation efforts. For example, in fiscal year 1997, DOJ reported nearly $41 million in deposits to the trust fund pursuant to HIPAA as a part of a $319 million settlement with Smithkline Beecham Clinical Labs, which was the result of a 3-year task force effort targeting unbundling schemes perpetrated by independent clinical laboratories. Also, a 7-year investigation of home health agency fraud resulted in a $255 million settlement with First American Home Health Care of Georgia, formerly ABC Home Health Services, in fiscal year 1997. DOJ reported almost $20 million in deposits to the trust fund pursuant to HIPAA in fiscal year 1997 as a result of this settlement. Similarly, investigation and litigation activities initiated in fiscal year 1997 will most likely result in collections in future years. In fiscal year 1997, the Attorney General and HHS Secretary certified the entire $104 million appropriation as necessary to carry out the HCFAC program. We found no material weaknesses in HHS’ and DOJ’s process for allocating the HCFAC appropriation for fraud and abuse control purposes. The Attorney General and HHS Secretary entered into a memorandum of understanding which laid the groundwork for allocating funds among program participants. In applying for funds, applicants were required to explain how proposed activities conformed to the statute and the HCFAC program and to provide a spending plan. HHS and DOJ jointly reviewed proposals and made funding decisions for the HCFAC funds. In this first year, HHS and DOJ did not make the final funding decisions for allocating the wedge funds until December 1996. Also, HHS and DOJ did not grant funds to other federal, state, and local agencies until July 1997, after requesting, reviewing, and approving proposals for HCFAC funds. Table 2 presents fiscal year 1997 allocations and obligations for the HCFAC program. The HHS/OIG was allotted $70 million, the maximum statutory amount authorized, to build upon the policies and practices of Operation Restore Trust (ORT), while strategically increasing resources dedicated to fraud activities, enhancing existing Medicare fraud protection activities, and pursuing new anti-fraud initiatives. The HHS/OIG reported that HCFAC funding allowed it to open six new investigative offices and three new audit offices and increase its staff levels by approximately 240 in fiscal year 1997. The following briefly summarizes the reported allocation of the $34 million wedge amount and the purposes for which those funds were used. The Department of Justice was allocated a total of $22.2 million primarily to increase efforts to litigate health care fraud cases and provide fraud training courses. DOJ reported that in fiscal year 1997, it had established a total of 208 new positions for health care fraud enforcement, including 116 attorneys, 26 paralegals, and 66 support positions. HCFA was allocated $5.3 million—$1.8 million to expand its survey and certification of Medicare coverage reviews tested under ORT, $1.9 million for the HCFA Customer Information System, and $1.6 million to extend a contract with the Los Alamos National Laboratory. Medicare coverage review surveys are intended to provide fiscal and regional home health intermediaries, who process and pay Medicare claims, with better information to assess overpayments and implement collection procedures. The HCFA Customer Information System is designed to identify potential targets for Medicare fraud and abuse investigations. HCFA received funding to purchase hardware for the system and provide connectivity to the HHS/OIG and DOJ. HCFA also received HCFAC funding to extend its contract with the Los Alamos National Laboratory to develop algorithms that could be developed as software to identify suspicious providers and patterns of abuse. HRSA was allocated $2 million to design and implement the adverse action database, referred to as the Healthcare Integrity and Protection Data Bank (which is discussed later in this report). The HHS Office of the General Counsel was allocated $1.8 million primarily to support the expected increased litigation workload resulting from HIPAA. The Administration on Aging was allocated $1.1 million to continue its outreach, education, and training efforts demonstrated in ORT. Eleven other federal and state agencies were allocated a total of $1.5 million for health care fraud and abuse prevention and detection activities. We found no material weaknesses in HHS and DOJ procedures to identify and report HCFAC expenditures. HCFA performs the accounting for the control account, from which HCFAC expenditures are made. HCFA sets up allotments in its accounting system for each of the HHS and DOJ entities receiving HCFAC funds. The HHS and DOJ entities account for their HCFAC obligations and expenditures in their respective accounting systems and report them to HCFA on a monthly basis. HCFA records the obligations and expenditures against the appropriate allotments in its accounting system. We reviewed supporting documentation, such as obligating documents and invoices, for nine expenditure transactions totaling $726,000. We also reviewed three obligation transactions totaling $3.3 million for which no expenditures had been made in fiscal year 1997. In addition, we reviewed the methodology used to allocate payroll costs to the HCFAC program at two entities—the HHS/OIG and DOJ’s Criminal Division—whose fiscal year 1997 payroll costs allocated to HCFAC totaled $38 million. We found that (1) the expenditures and obligations we tested related to HHS and DOJ funding decisions and the proposals approved for HCFAC funds and (2) the transactions appeared justified for fraud and abuse activities. In addition, we found no material weaknesses in the payroll cost allocation methodologies we reviewed. We were not able to identify HCFAC program expenditures from the trust fund not related to Medicare because the HHS/OIG and DOJ do not separately account for or monitor such expenditures. HIPAA restricts the HHS/OIG’s use of HCFAC funds to the Medicare and Medicaid programs. According to HHS/OIG officials, they use HCFAC funds only for audits, evaluations, or investigations related to Medicare or Medicaid. The officials also stated that while some activities may be limited to either Medicare or Medicaid, most activities are generally related to both programs. Because HIPAA does not preclude the HHS/OIG from using HCFAC funds for Medicaid efforts, the HHS/OIG does not believe it is necessary or beneficial to account for such expenditures separately. Similarly, DOJ officials do not believe that it is practical or beneficial to separately account for non-Medicare expenditures due to the nature of health care fraud cases. HIPAA permits DOJ to use HCFAC funds for health care fraud activities involving other health care programs. According to DOJ officials, health care fraud cases usually involve several health care programs, including Medicare and health programs administered by other federal agencies, such as the Department of Veterans Affairs, the Department of Defense, and the Office of Personnel Management. Consequently, it is difficult to separately charge personnel costs and other litigation expenses to specific parties in health care fraud cases. Also, according to DOJ officials, even if Medicare is not a party in a health care fraud case, the case may provide valuable experience in health care fraud matters, allowing auditors, investigators, and attorneys to become more effective in their efforts to combat Medicare fraud. Neither HHS nor DOJ have plans to identify these expenditures in the future. In this first year of the HCFAC program, we were unable to quantify the savings to the trust fund, or any other savings, resulting from expenditures from the trust fund due to the nature of health care anti-fraud and -abuse activities. As discussed earlier, audits, evaluations, and investigations can take several years to complete. Once they are completed, it can take several more years before recommendations or initiatives are implemented. Likewise, it is not uncommon for litigation activities to span many years before a settlement is reached. Consequently, any savings resulting from health care anti-fraud and -abuse activities funded by the HCFAC program in fiscal year 1997 will likely not be realized until subsequent years. In their joint report, HHS and DOJ reported approximately $6.1 billion of cost savings during fiscal year 1997 resulting from implementation of HHS/OIG recommendations and other initiatives. However, as the recommendations and other initiatives relate to actions that predate the HCFAC program, the cost savings cannot be associated with expenditures from the trust fund pursuant to HIPAA. We found that $4 billion of the reported $6.1 billion of cost savings related to the Medicare program. The remaining $2.1 billion were specific to the Medicaid program and, thus, would not impact the trust fund since the Medicaid program is funded with general appropriations. We have discussed this with the HHS/OIG, which has agreed to provide cost savings information related to the Medicare and Medicaid programs separately in future reports. In response to HIPAA’s provision for us to report on other aspects of the trust fund, we determined the status of development and implementation of the Healthcare Integrity and Protection Data Bank (HIPDB). This database was to provide a way of tracking criminal convictions, civil judgments, and other adverse actions against healthcare providers, suppliers, and practitioners on a nationwide basis. As required by HIPAA, the database was to be established by January 1, 1997. While HHS did not believe it could develop the database by that date, it planned to have an interim database operational by March 1998. As mentioned previously, HHS and DOJ allocated $2 million of the fiscal year 1997 HCFAC appropriation for this effort. HHS officials advised us that the project has been redirected. They stated that there will not be an interim database as previously planned and that the database will not be operational until at least May 1999. We plan to include an evaluation of the database project in our next report under HIPAA. In commenting on this draft report, DOJ stated that it had no formal comments. HHS did not raise any issues relating to the facts presented in the report. However, HHS offered a technical comment that DOJ agreed with in its oral comments. We have incorporated the agencies’ comments as appropriate. We are sending copies of this report to the Chairmen and Ranking Minority Members of the Senate and House Committees on Judiciary, the Secretary of HHS, the Attorney General, and other interested parties. Copies will be made available to others on request. Please contact me at (202) 512-4476 if you or your staff have any questions. Major contributors to this letter are listed in appendix III. HIPAA provided for appropriations of up to $104 million to the control account for fiscal year 1997, of which $60 million (the minimum) to $70 million (the maximum) was earmarked for HHS/OIG activities involving Medicare and Medicaid. In addition, HIPAA authorizes the HHS/OIG to retain for current use certain reimbursements for the costs of conducting investigations and audits and monitoring compliance plans. In fiscal year 1997, these reimbursements were reported to total $540,000. According to HHS/OIG officials, these funds will be used to open two new investigative offices in Vermont and New Hampshire in fiscal year 1998. Also, HIPAA provided for appropriating an additional $47 million from the general fund of the Treasury to the control account for transfer to the Federal Bureau of Investigation (FBI) to (1) prosecute, investigate, and audit health care matters and (2) develop and deliver provider and consumer education regarding compliance with fraud and abuse provisions. HIPAA provides for annual increases of 15 percent in HCFAC funding through the year 2003, after which the appropriation for HCFAC and the amount earmarked for the HHS/OIG remains the same. Table I.1 summarizes the HCFAC funding limits for fiscal years 1997 through 2003. Table I.2 presents the HHS/OIG’s annual funding in fiscal year 1996, prior to HIPAA, through fiscal year 2001. Hospital Insurance Trust Fund transfer 1996 (actual) 1997 (actual) 1998 (est.)1999 (est.)2000 (est.)2001 (est.) The projected amounts for fiscal years 2000 and 2001 are based on the assumption that the HHS/OIG’s discretionary funding will remain at the estimated fiscal year 1999 level of $29 million and the HHS/OIG will be allotted the maximum statutory amount authorized. The following are GAO’s comments on HHS’ letter dated May 18, 1998. 1. Now footnote d of table 1. The footnote has been modified to reflect the agency’s comment. 2. Now footnote 4. The footnote has been modified to reflect the agency’s comment. Deborah A. Taylor, Assistant Director Maria Cruz, Senior Audit Manager Anastasia Kaluzienski, Senior Audit Manager Vera Seekins, Audit Manager Diane Morris, Senior Auditor Sandra Silzer, Auditor Maria Zacharias, Communications Analyst The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: Pursuant to a legislative requirement, GAO reviewed the first joint report issued by the Department of Justice (DOJ) and the Department of Health and Human Services (HHS) on the fiscal year (FY) 1997 deposits to the Federal Hospital Insurance Trust Fund and the allocation of the Health Care Fraud and Abuse Control Program (HCFAC) appropriation, focusing on: (1) the amounts deposited to the trust fund and the sources of such amounts; (2) the amounts appropriated from the trust fund for the HCFAC program and the justification for the expenditure of such amounts; (3) expenditures from the trust fund for HCFAC activities not related to Medicare; and (4) any savings to the trust fund, as well as any other savings, resulting from the trust fund for the HCFAC program. GAO noted that: (1) the HHS and DOJ joint report for FY 1997 reported that $130.7 million was deposited to the trust fund pursuant to the Health Insurance Portablity and Accountability Act (HIPAA); (2) the sources of these deposits were primarily penalties and damages and criminal fines resulting from health care fraud audits, evaluations, investigations, and litigation activities initiated prior to implementation of the HCFAC program; (3) the joint report also stated that $104 million was appropriated from the trust fund for the HCFAC program in FY 1997; (4) of the $104 million, HHS and DOJ allocated the maximum--$70 million--to thhe HHS Office of Inspector General (OIG) to increase its Medicare and Medicaid fraud activities; (5) the remaining $34 million was allocated to: (a) DOJ, which received $22.2 million primarily to increase litigative efforts and to provide fraud training; (b) the Health Care Financing Administration (HCFA), which received $5.3 million for various initiatives related to health care fraud and abuse, including the development of a new information system to identify potential targets for fraud investigations; and (c) other federal and state agencies, which received the remaining $6.5 million for a variety of activities, including increased litigation; development of a new adverse action data bank; and outreach, education and training; (6) GAO found no material weaknesses in HHS' and DOJ's processes for accumulating this information, and nothing came to GAO's attention to lead it to believe that the amounts related to HIPAA deposits and the allocation of the HCFAC appropriation reported by HHS and DOJ in their joint report were inaccurate or unsupported; (7) GAO could not identify expenditures from the trust fund for HCFAC activities not related to Medicare because neither HHS OIG nor DOJ separately account for or monitor those expenditures; (8) HIPAA restricts HHS OIG's use of HCFAC funds to Medicare and Medicaid activities; (9) furthermore, health care fraud cases often involve more than one health care program; (10) thus, it is difficult to identify non-Medicare related expenditures; (11) GAO also could not determine the magnitude of savings to the trust fund, or other savings, resulting from trust fund expenditures for the HCFAC program during FY 1997; and (12) finally, the implementation of the Healthcare Integrity and Protection Data Bank, which is to be an important tool to keep unscrupulous providers from having access to Medicare and other health care programs, has been delayed.