In 1990, we designated the Medicare program, which is administered by the Centers for Medicare and Medicaid Services (CMS) in HHS, as at high risk for improper payments because of its sheer size and vast range of participants—including about 40 million beneficiaries and nearly 1 million physicians, hospitals, and other providers. The program remains at high risk today. In fiscal year 2001, Medicare outlays totaled over $219 billion, and the HHS/OIG reported that $12.1 billion in fiscal year 2001 Medicare fee-for-service payments did not comply with Medicare laws and regulations. The Congress enacted HIPAA, in part, to respond to the problem of health care fraud and abuse. HIPAA consolidated and strengthened ongoing efforts to combat fraud and abuse in health programs and provided new criminal enforcement tools as well as expanded resources for fighting health care fraud, including $158 million in fiscal year 2000 and $182 million in fiscal year 2001. Under the joint direction of the Attorney General and the Secretary of HHS (acting through the HHS/OIG), the HCFAC program goals are as follows: coordinate federal, state, and local law enforcement efforts to control fraud and abuse associated with health plans; conduct investigations, audits, and other studies of delivery and payment for health care for the United States; facilitate the enforcement of the civil, criminal, and administrative statutes applicable to health care; provide guidance to the health care industry, including the issuance of advisory opinions, safe harbor notices, and special fraud alerts; and establish a national database of adverse actions against health care providers. Funds for the HCFAC program are appropriated from the trust fund to an expenditure account, referred to as the Health Care Fraud and Abuse Control Account, maintained within the trust fund. The Attorney General and the Secretary of HHS jointly certify that the funds transferred to the control account are necessary to finance health care anti–fraud and abuse activities, subject to limits for each fiscal year as specified by HIPAA. HIPAA authorizes annual minimum and maximum amounts earmarked for HHS/OIG activities for the Medicare and Medicaid programs. For example, of the $182 million available in fiscal year 2001, a minimum of $120 million and a maximum of $130 million were earmarked for the HHS/OIG. By earmarking funds specifically for the HHS/OIG, the Congress ensured continued efforts by the HHS/OIG to detect and prevent fraud and abuse in the Medicare and Medicaid programs. CMS performs the accounting for the control account, from which all HCFAC expenditures are made. CMS sets up allotments in its accounting system for each of the HHS and DOJ entities receiving HCFAC funds. The HHS and DOJ entities account for their HCFAC obligations and expenditures in their respective accounting systems and report them to CMS monthly. CMS then records the obligations and expenditures against the appropriate allotments in its accounting system. At DOJ, payroll constituted 78 percent of its total expenditures in fiscal year 2000 and 69 percent in fiscal year 2001. Within DOJ, the Executive Office for the United States Attorneys (EOUSA) receives the largest allotment of HCFAC funds. In EOUSA, each district is allocated a predetermined number of full-time equivalent (FTE) positions based on the historical workload of the district. Specific personnel who ordinarily work on health care activities, such as the Health Care Fraud Coordinator, are designated within the DOJ accounting system to have their payroll costs charged to the HCFAC account. In some districts, one FTE could be shared among several individuals, each contributing a portion of time to HCFAC assignments. EOUSA staff track the portion of time devoted to health care activity and other types of cases and investigations in the Monthly Resource Summary System on a daily or monthly basis. DOJ monitors summary information from the Monthly Resource Summary System to determine how staff members’ time is being used. The HHS/OIG expenditures represented over 96 percent of HHS’s total HCFAC expenditures in fiscal years 2000 and 2001. At HHS/OIG, HCFAC expenditures are allocated based on relative proportions of the HCFAC budget authority and the discretionary funding sources. Table 1 below identifies the relative percentages HHS/OIG used in fiscal years 2000 and 2001. HHS/OIG uses these percentages to compute the amounts of payroll and nonpayroll expenditures to be charged to their two funding sources. HHS/OIG tracks staff time spent on various assignments in separate management information systems (MIS). The information in the MIS is summarized and monitored quarterly to adjust the type of work planned and performed, if necessary, so that the use of the funds is consistent with the funding sources’ intended use. HIPAA also requires that amounts equal to the following types of collections be deposited into the trust fund: criminal fines recovered in cases involving a federal health care offense, including collections pursuant to section 1347 of Title 18, United States Code; civil monetary penalties and assessments imposed in health care fraud amounts resulting from the forfeiture of property by reason of a federal health care offense, including collections under section 982(a)(7) of Title 18, United States Code; penalties and damages obtained and otherwise creditable to miscellaneous receipts of the Treasury’s general fund obtained under the False Claims Act (sections 3729 through 3733 of Title 31, United States Code), in cases involving claims related to the provision of health care items and services (other than funds awarded to a relator, for restitution, or otherwise authorized by law); and unconditional gifts and bequests. Criminal fines resulting from health care fraud cases are collected through the Clerks of the Administrative Office of the United States Courts. Criminal fines collections are reported to DOJ’s Financial Litigation Unit associated with their districts. Based on cash receipt documentation received from the Clerks, the Financial Litigation Units then post the criminal fines collection to a database. The database generates at least a biannual report of the amount of criminal fines collected, which is sent to the Department of the Treasury. Treasury relies on this report to determine the amount to deposit to the trust fund. Civil monetary penalties for federal health care offenses are imposed by CMS regional offices or the HHS/OIG against skilled nursing facilities or long-term care facilities and doctors. CMS collects civil monetary penalty amounts and reports them to the Department of the Treasury for deposit to the trust fund. Penalties and multiple damages resulting from health care fraud cases are collected by DOJ’s Civil Division in Washington, D.C., and by Financial Litigation Units in the United States Attorneys’ offices located throughout the country. The Civil Division and United States Attorneys’ offices report collection information to DOJ’s Debt Accounting Operations Group, which reports the amount of penalties and multiple damages to the Department of the Treasury for deposit to the trust fund. HIPAA also allows CMS to accept unconditional gifts and bequests made to the trust fund. The objectives of our review were to identify and assess the propriety of amounts for fiscal years 2000 and 2001 reported as (1) deposits to the trust fund, (2) appropriations from the trust fund for HCFAC activities, (3) expenditures at DOJ for HCFAC activities, (4) expenditures at HHS for HCFAC activities, (5) expenditures for non-Medicare anti–fraud and abuse activities, and (6) savings to the trust fund. To identify and assess the propriety of deposits, we reviewed the joint HCFAC reports, interviewed personnel at various HHS and DOJ entities, obtained electronic data and reports from HHS and DOJ for the various types of deposits, and tested selected transactions to determine whether the proper amounts were deposited to the trust fund. To identify and assess the propriety of amounts appropriated from the trust fund, we reviewed the joint HCFAC reports, and reviewed and analyzed documentation to support the allocation and certification of the HCFAC appropriation. To identify and assess the propriety of expenditure amounts at HHS, we interviewed personnel, obtained electronic data and reports supporting nonpayroll transactions, tested selected nonpayroll transactions, reviewed payroll allocation methodologies, and interviewed selected employees to assess the reasonableness of time and attendance charges to the HCFAC appropriation account for payroll expenditures. To identify and assess the propriety of expenditure amounts at DOJ, we interviewed personnel, obtained electronic data and reports supporting nonpayroll transactions, tested selected nonpayroll transactions, performed analytical procedures, and interviewed selected employees to assess the reasonableness of time and attendance charges to the HCFAC appropriation account for payroll expenditures. We were unable to identify and assess the propriety expenditures for non- Medicare antifraud activities because HHS/OIG and DOJ do not separately account for or monitor such expenditures. To identify and assess the propriety of savings to the trust fund, as well as any other savings, resulting from expenditures from the trust fund for the HCFAC program, we reviewed the joint reports, interviewed personnel, reviewed recommendations and the resulting cost savings as reported in the HHS/OIG’s fiscal years 2000 and 2001 semiannual reports, and tested selected cost savings. We were unable to directly associate the reported cost savings to HCFAC because HHS and DOJ officials do not track them as such due to the nature of health care anti–fraud and abuse activities. We interviewed and obtained documentation from officials at the CMS in Baltimore, Maryland; HHS headquarters—including the Administration on Aging (AOA), the Assistant Secretary for Budget, Technology and Finance (ASBTF) which was formerly the Assistant Secretary for Management and Budget (ASMB), the OIG, and the Office of General Counsel (OGC)—in Washington, D.C.; HHS’s Program Support Center (PSC) in Rockville, Maryland; and DOJ’s Justice Management Division, EOUSA, Criminal Division, Civil Division, and Civil Rights Division in Washington, D.C. We conducted our work in two phases, from April 2001 through June 2001 focusing primarily on fiscal year 2000 HCFAC activity, and from October 2001 through April 2002 focusing primarily on fiscal year 2001 HCFAC activity, in accordance with generally accepted government auditing standards. A detailed discussion of our objectives, scope, and methodology is contained in appendix I of this report. We requested comments on a draft of this report from the Secretary of HHS and the Attorney General or their designees. We received written comments from the Inspector General of HHS and the Acting Assistant Attorney General for Administration at DOJ. We have reprinted their responses in appendices II and III, respectively. The joint HCFAC reports included deposits of about $210 million in fiscal year 2000 and $464 million in fiscal year 2001, pursuant to HIPAA. As shown in figure 1, the sources of these deposits were primarily penalties and multiple damages. In testing at DOJ, we identified some errors in the recording of HCFAC collections that resulted in an estimated overstatement of $169,765 to the trust fund in fiscal year 2001. These uncorrected errors, which related to criminal fines deposited to the trust fund, were not detected by DOJ officials responsible for submitting collection reports to the Department of the Treasury. Our work did not identify errors in recording collections in any of the other categories for fiscal years 2000 and 2001. We did not identify errors related to fiscal year 2000 criminal fines. Of the 58 statistically sampled criminal fines transactions, we tested the collection of 2 fines reported at $8,693 and $50,007 that were supported by documentation for $6,097 and $25,000, respectively, and resulted in overstatements to the trust fund totaling over $27,000. We estimated the most likely overstatement of collections of criminal fines deposited to the trust fund as a result of transactions incorrectly recorded was $169,765. In both cases, the errors were not detected by DOJ staff responsible for submitting the criminal fines report to the Department of the Treasury. DOJ officials told us that there was a programming mistake in generating the criminal fines report that resulted in these errors. DOJ officials also told us that the mistake has been corrected to address the problem in the future and they plan to research the impact of the programming oversight to determine what, if any, adjustments or offsets are needed and will make the necessary corrections next quarter. While the total estimated overstatement is relatively insignificant compared to the total amount of $464 million in HCFAC collections that was reported to the trust fund in fiscal year 2001, the control weaknesses that gave rise to these errors could result in more significant misstatements. As reported in the joint HCFAC reports for fiscal years 2000 and 2001, the Attorney General and the Secretary of HHS certified the entire $158.2 million and $181.9 million appropriations, respectively, as necessary to carry out the HCFAC program. Based on our review, the requests for fiscal years 2000 and 2001 HCFAC appropriations were properly supported for valid purposes under HIPAA. Figures 2 and 3 present fiscal years 2000 and 2001 allocations for the HCFAC program, respectively. Based on our review, we found that the planned use of HCFAC appropriations was intended for purposes as stated in HIPAA statute. According to the joint HCFAC reports, HCFAC’s increased resources have enabled HHS/OIG to broaden its efforts both to detect fraud and abuse and to help deter the severity and frequency of it. The HHS/OIG reported that HCFAC funding allowed it to open 14 new investigative offices and increase its staff levels by 61 during fiscal year 2000, with the result that OIG is closer to its goal of extending its investigative and audit staff to cover all geographical areas in the country. As shown in figures 2 and 3, we also found that DOJ and other HHS organizations requested and were granted $38.9 million in fiscal year 2000 and $51.9 million in fiscal year 2001. DOJ’s funds were used primarily to continue its efforts to litigate health care fraud cases and provide health care fraud training courses. In fiscal year 2001, $4 million of HHS’s HCFAC allocation was approved by designees of the Attorney General and the Secretary of HHS for reallocation to DOJ to support the federal government’s tobacco litigation activities for fiscal year 2001. In addition, $12 million of fiscal year 2001 HCFAC funds allocated to DOJ’s Civil Division were used to support the federal government’s suit against the major tobacco companies, as allowed under HIPAA. In addition, other HHS organizations used their HCFAC allocations for the following purposes in fiscal years 2000 and 2001: The Office of General Counsel used its funds primarily for litigation activity, both administrative and judicial. CMS, the agency with primary responsibility for administering the Medicare and Medicaid programs, along with the ASMB, used its HCFAC funds allocated in fiscal year 2000 to fund contractual consultant services on establishing a formal risk management function within each organization. CMS used its HCFAC funds allocated in fiscal year 2001 to assist states in developing Medicaid payment accuracy measurements methodologies and to conduct pilot studies to measure and reduce state Medicaid payment errors. The AOA was allocated funds to develop and disseminate consumer education information to older Americans and to train staff to recognize and report fraud, waste, and abuse in the Medicare and Medicaid programs. The ASBTF, formerly the ASMB, used its HCFAC funds for consultant services that will help ensure that the new HHS integrated financial management system, of which the CMS Healthcare Integrated General Ledger Accounting System will be a major component, is being developed to meet the department’s financial management goals, which include helping to prevent waste and abuse in HHS health care programs. At DOJ, we identified problems indicating that oversight of HCFAC expenditure transaction processing needs to be reemphasized. These problems include charging non-HCFAC transactions to the HCFAC appropriation and the inability to provide us with a detailed list of HCFAC expenditure transactions to support summary totals on their internal financial report in a timely manner. These problems could impede DOJ’s ability to adequately account for growing HCFAC expenditures, which totaled over $23.7 million for fiscal year 2000 and $26.6 million for fiscal year 2001, as shown in figure 4. We found that over $480,000 in interest penalties not related to HCFAC activities were miscoded and inadvertently charged to the HCFAC appropriation. The DOJ officials responsible for recording this transaction told us there was an offsetting error of $482,000 in HCFAC-related expenditures that were not recorded to the HCFAC account. Regardless of whether these errors essentially offset, they are indicative of a weakness in DOJ’s financial processes for recording HCFAC and other expenditures. DOJ was also unable to provide a complete and timely reconciliation of detailed transactions to summary expenditure amounts reported in its internal reports. DOJ made several attempts beginning in January 2002 to provide us with an electronic file that reconciled to its internal expenditure report. As of mid-May 2002, we have not received a reconciled file for fiscal year 2001 HCFAC expenditures. We did, however, receive a reconciled file for fiscal year 2000 HCFAC expenditures on April 23, 2002. To their credit, DOJ officials responsible for maintaining DOJ financial systems identified problems associated with earlier attempts to provide this essential information to support its internal reports. While we were ultimately able to obtain this information for fiscal year 2000, we did not receive it in sufficient time to apply statistical sampling techniques for selecting expenditure transactions for review as we had done at HHS. While we used other procedures to compensate for not obtaining this detailed data file in a timely manner, we cannot project the results of our procedures to the population of DOJ expenditures. Both Office of Management and Budget Circular (OMB) A-127, Financial Management Systems, and the Comptroller General’s Standards for Internal Control in the Federal Government require that all transactions be clearly documented and that documentation be readily available for examination. DOJ’s financial statement auditor noted several problems related to the Department’s internal controls over financial reporting, such as (1) untimely recording of financial transactions, (2) weak general and application controls over financial management systems, and (3) inadequate financial statement preparation controls. The financial statement audit report specifically discusses problems related to untimely recording of financial transactions and inadequate financial statement preparation controls at offices, boards, and divisions that process HCFAC transactions. The financial statement auditor recommended that DOJ monitor compliance with its policies and procedures. Further, the auditor recommended that DOJ consider centralizing information systems that capture redundant financial data, or consider standardizing the accumulation and recording of financial transactions in accordance with the department’s requirements. Overall, we generally found adequate documentation to support $114.9 million in fiscal year 2000 and $129.8 million in fiscal year 2001 HCFAC expenditures shown in figure 5. However, we found that a purchase for an HHS/OIG employee award in fiscal year 2001 was questionable because it did not have adequate documentation to support that it was a valid HCFAC expenditure. We also found that HHS’s policies and procedures for employee awards did not include specific guidance on documenting the purchase of such nonmonetary awards. As stated before, the Comptroller General’s Standards for Internal Control in the Federal Government calls for appropriate control activities to ensure that transactions and internal control policies and procedures are clearly documented. HHS/OIG has since provided us with documentation to support the award as a valid HCFAC transaction and told us that it is revising its current policies and procedures to include nonmonetary employee awards. We were not able to identify HCFAC program trust fund expenditures that were unrelated to Medicare because the HHS/OIG and DOJ do not separately account for or monitor such expenditures. Even though HIPAA requires us to report on expenditures related to non-Medicare activities, it does not specifically require HHS or DOJ to separately track Medicare and non-Medicare expenditures. However, HIPAA does restrict the HHS/OIG’s use of HCFAC funds to Medicare and Medicaid programs. According to HHS/OIG officials, they use HCFAC funds only for audits, evaluations, or investigations related to Medicare and Medicaid. The officials also stated that while some activities may be limited to either Medicare or Medicaid, most activities are generally related to both programs. Because HIPAA does not preclude the HHS/OIG from using HCFAC funds for Medicaid efforts, HHS/OIG officials have stated they do not believe it is necessary or beneficial to account for such expenditures separately. Similarly, DOJ officials told us that it is not practical or beneficial to account separately for non-Medicare expenditures because of the nature of health care fraud cases. HIPAA permits DOJ to use HCFAC funds for health care fraud activities involving other health programs. According to DOJ officials, health care fraud cases usually involve several health care programs, including Medicare and health care programs administered by other federal agencies, such as the Department of Veterans Affairs, the Department of Defense, and the Office of Personnel Management. Consequently, it is difficult to allocate personnel costs and other litigation expenses to specific parties in health care fraud cases. Also, according to DOJ officials, even if Medicare is not a party in a health care fraud case, the case may provide valuable experience in health care fraud matters, allowing auditors, investigators, and attorneys to become more effective in their efforts to combat Medicare fraud. Since there is no requirement to do so, HHS and DOJ continue to assert that they do not plan to identify these expenditures in the future. Nonetheless, attributing HCFAC activity costs to particular programs would be helpful information for the Congress and other decision makers to use in determining how to allocate federal resources, authorize and modify programs, and evaluate program performance. The Congress also saw value in having this information when it tasked us with reporting expenditures for HCFAC activities not related to Medicare. We believe that there is intrinsic value in having this information. For example, HCFAC managers face decisions involving alternative actions, such as whether to pursue certain cases. Making these decisions should include a cost awareness along with other available information to assess the case potential. Further, having more refined data on HCFAC expenditures is an essential element to developing effective performance measures to assess the program’s effectiveness. In the joint HCFAC reports, HHS/OIG reported approximately $14.1 billion of cost savings during fiscal year 2000 and over $16 billion of cost savings during fiscal year 2001 from implementation of its recommendations and other initiatives. We were unable to directly associate these savings to HCFAC and other program expenditures from the trust fund, as required by HIPAA, because HHS and DOJ officials do not track them as such due to the nature of health care anti–fraud and abuse activities. HIPAA does not specifically require HHS and DOJ to attribute savings to HCFAC expenditures. Of the reported cost savings, $2.1 billion in fiscal year 2000 and $3.1 billion in fiscal year 2001 were reported as related to the Medicaid program, which is funded through the general fund of the Treasury, not the Medicare trust fund. Our analysis indicated that the vast majority of HHS/OIG work related to the reported cost savings of $14 billion and $16 billion was performed prior to the passage of HCFAC. Based on our review, we found that amounts reported as cost savings were adequately supported. Cost savings represent funds or resources that will be used more efficiently as a result of documented measures taken by the Congress or management in response to HHS/OIG audits, investigations, and inspections. These savings are often changes in program design or control procedures implemented to minimize improper use of program funds. Cost savings are annualized amounts that are determined based on Congressional Budget Office estimates over a 5-year period. HHS and DOJ officials have stated that audits, evaluations, and investigations can take several years to complete. Once they have been completed, it can take several more years before recommendations or initiatives are implemented. Likewise, it is not uncommon for litigation activities to span many years before a settlement is reached. According to DOJ and HHS officials, any savings resulting from health care anti–fraud and abuse activities funded by the HCFAC program in fiscal years 2000 and 2001 will likely not be realized until subsequent years. Because the HCFAC program has been in existence for over 4 years, information may now be available for agencies to determine the cost savings associated with expenditures from the trust fund pursuant to HIPAA. Associating specific cost savings with related HCFAC expenditures is an important step in helping the Congress and other decision makers evaluate the effectiveness of the HCFAC program. Our review of fiscal years 2000 and 2001 HCFAC activities found that appropriations, HHS expenditures, and reported cost savings were adequately supported, but we did identify some errors in the recording of collections and expenditures at DOJ. These errors indicate the need to strengthen controls over DOJ’s processing of HCFAC collections and expenditures to ensure that (1) moneys collected from fraudulent acts against the Medicare program are accurately recorded and (2) expenditures for health care antifraud activities are justified and accurately recorded. Effective internal control procedures and management oversight are critical to supporting management’s fiduciary role and its ability to manage the HCFAC program responsibly. Further, separately tracking Medicare and non-Medicare expenditures and cost savings and associating them by program could provide valuable information to assist the Congress, management, and others in making difficult programmatic choices. To improve DOJ’s accountability for the HCFAC program collections, we recommend that the Attorney General fully implement plans to make all necessary correcting adjustments for collections transferred to the trust fund in error and ensure that subsequent collection reports submitted to the Department of the Treasury are accurate. To improve DOJ’s accountability for HCFAC program expenditures, we recommend that the Attorney General make correcting adjustments for expenditures improperly charged to reinforce financial management policies and procedures to minimize errors in recording HCFAC transactions. To facilitate providing the Congress and other decision makers with relevant information on program performance and results, we recommend that the Attorney General and the Secretary of HHS assess the feasibility of tracking cost savings and expenditures attributable to HCFAC activities by the various federal programs affected. A draft of this report was provided to HHS and DOJ for their review and comment. In written comments, HHS concurred with our recommendation to assess the feasibility of tracking cost savings and expenditures attributable to HCFAC activities by the various federal programs affected. In its written comments, DOJ agreed with all but one of our recommendations, and expressed concern with some of our findings. The following discussion provides highlights of the agencies’ comments and our evaluation. Letters from HHS and DOJ are reprinted in appendixes II and III. DOJ acknowledged the two errors we found in fiscal year 2001 criminal fine amounts and attributed them to a programming problem. As we discussed in the report, DOJ indicated it had already taken action to address our recommendations by correcting the programming error to address future amounts reported for criminal fines. DOJ also stated that an effort is currently under way to research the impact of the programming error and plans to determine what, if any, adjustments or offsets are needed to correct amounts previously reported to the Department of the Treasury. DOJ indicated that it had already discovered and fixed the programming error prior to our review. However, as we reported, DOJ was not aware of the errors we identified, nor did it call our attention to the possibility of errors occurring due to this programming problem. In addition, DOJ acknowledged in its comments that errors have occurred in the recording of valid HCFAC expenditure transactions and stated that corrections have been made to address our related recommendation. Additionally, DOJ incorrectly interpreted our statement that the problems identified in our review could impede its ability to account for growing HCFAC expenditures. In its comments, DOJ construed this to mean that we concluded that program managers lack timely access to financial reports or supporting transactions. That was not our intent nor the focus of our review. As stated in our report, the problems we encountered indicate that additional emphasis should be placed on DOJ’s financial management policies and procedures to minimize errors in recording HCFAC transactions. DOJ did state that it will continue its standing practice of continually educating its staff and reinforcing its financial management policies and procedures to minimize errors in recording HCFAC and all other transactions within DOJ. However, based on our findings, this standing practice needs modification in order to bolster its effectiveness. DOJ also stated that our reference to the findings for departmental systems as cited in the Audit Report: U.S. Department of Justice Annual Financial Statement Fiscal Year 2001, Report No. 02-06, was inapplicable. To address DOJ’s concerns, we clarified the report to cite problems that its financial statement auditors found at entities within DOJ that process HCFAC transactions. Finally, regarding our recommendation to both HHS and DOJ to assess the feasibility of tracking cost savings and expenditures attributable to HCFAC activities by the various federal programs affected, HHS/OIG stated in its written comments that it had previously considered alternatives that would allow it to track and attribute cost savings and expenditures but had identified obstacles to doing so. At the same time, HHS/OIG agreed with our recommendation to perform an assessment of tracking cost savings and expenditures by program, which is critical to developing effective performance measures. However, DOJ stated that it is neither practical nor beneficial to track cost savings or non-Medicare expenditures associated with HCFAC enforcement activities. Without capturing such information, the Congress and other decision makers do not have the ability to fully assess the effectiveness of the HCFAC program. Therefore, we continue to believe that, at a minimum, DOJ should study this further, as HHS has agreed to do. We are sending copies of this report to the Secretary of HHS, the Attorney General, and other interested parties. Copies will be made available to others on request. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov. If you or your staffs have any questions, please contact me at (202) 512-9508 or by e-mail at calboml@gao.gov or Kay L. Daly, Assistant Director, at (202) 512-9312 or by e-mail at dalykl@gao.gov. Key contributors to this assignment are listed in appendix IV. To accomplish the first objective, identifying and assessing the propriety of amounts reported for deposits in fiscal years 2000 and 2001 as (1) penalties and multiple damages, (2) criminal fines, (3) civil monetary penalties, and (4) gifts and bequests, we did the following: Reviewed the joint HHS and DOJ HCFAC reports for fiscal years 2000 and 2001 to identify amounts deposited to the trust fund. Interviewed personnel at various HHS and DOJ entities to update our understanding of procedures related to collections/deposits. Obtained access to databases and reports from HHS and DOJ for the various collections/deposits as of September 30, 2000, and September 30, 2001. Tested selected transactions to determine whether the proper amounts were deposited to the trust fund. We obtained and recomputed supporting documentation from various sources depending on the type of collection/deposit. We traced amounts reported on the supporting documentation to reports and other records to confirm that proper amounts were appropriately reported. To perform these tests, we did the following: Drew dollar unit samples of 60 items from a population of 626 penalties and multiple damages (PMD), totaling $454,615,907, from an electronic database for CMS PMDs and from the FMIS Dept Management Transfer of Funds from the U.S. Department of Justice Via OPAC Report for DOJ PMDs for fiscal year 2001, and 60 items from a population of 479 penalties and multiple damages, totaling $147,268,092, from an electronic database for CMS PMDs and from the FMIS Dept Management Detail Report for DOJ PMDs for fiscal year 2000. Drew dollar unit samples of 58 items from a population of 179 criminal fines, totaling $2,894,234, from the Criminal Fines Report for fiscal year 2001, and 58 items from a population of 178 criminal fines totaling $57,209,390 from the Criminal Fines Report for fiscal year 2000. Drew dollar unit samples of 29 items from a population of 2,381 civil monetary penalties, totaling $6,060,481, from an electronic database for fiscal year 2001, and 57 items from a population of 1,221 civil monetary penalties, totaling $5,220,177, from an electronic database for fiscal year 2000. Reviewed the entire population of four gifts and bequests, totaling $5,501, for fiscal year 2001. We obtained and analyzed supporting documentation including the letters and checks retained at CMS. There were no gifts and bequests reported for fiscal year 2000, therefore none were tested. To accomplish our second objective, identifying and assessing the propriety of amounts reported in fiscal years 2000 and 2001 as appropriations from the trust fund for HCFAC activities, we did the following: Obtained the funding decision memorandum and reallocation documents to verify the HCFAC funds certified by HHS and DOJ officials. Analyzed the reasons for requesting HCFAC funds to determine that amounts appropriated from the trust fund met the purposes stated in HIPAA to, among other things, coordinate federal, state, and local law enforcement efforts; conduct investigations, audits, and studies related to health care; and provide guidance to the health care industry regarding fraudulent practices. Compared allocations amount reported in the joint HCFAC reports to the approved funding decision memorandum and reallocation documents to verify the accuracy of amounts reported. To accomplish our third objective, identifying and assessing the propriety of amounts for HCFAC expenditures at DOJ for fiscal years 2000 and 2001, we obtained DOJ’s internal financial report, the Expenditure and Allotment Report, EA101, which detailed total expenditure data for each component by subobject class for fiscal year 2000 and fiscal year 2001. To test our population, we further requested that DOJ provide us with a complete detailed population of transactions to support the summary totals on the internal financial report. Because the data were not provided to us on time, nor were they fully reconciled, we could not statistically select a sample and project the results to the population as a whole. We modified our methodology and nonstatistically selected 19 transactions, totaling $2,695,211 in fiscal year 2000, and 38 transactions, totalling $1,362,579 in fiscal year 2001, from DOJ focusing on large dollar amounts, unusual items, and other transactions, which would enhance our understanding of the expenditure process. To determine whether these transactions were properly classified as HCFAC transactions, we interviewed DOJ officials to obtain an understanding of the source and processing of transactions and reviewed, analyzed, and recomputed supporting documentation, such as purchase orders, invoices, and receipts, to determine the propriety of the expenditures. We performed analytical procedures and tested DOJ payroll on the largest component, EOUSA offices. To assess the reasonableness of payroll expenses, we performed a high-level analytical review. To enhance our understanding of how personnel record their work activity in the Monthly Resource Summary System, we nonstatistically selected 20 individuals from 10 districts for fiscal years 2000 and 2001. We interviewed these individuals on their method for charging time to the HCFAC program for fiscal year 2000 and 2001 and to verify whether time charged to the Monthly Resource Summary System was accurate. In the interview, employees were asked whether the time that was recorded in the system was accurate and how and where they received guidance on charging of time. To accomplish our fourth objective, identifying and assessing the propriety of amounts for HCFAC expenditures at HHS for fiscal years 2000 and 2001, we obtained internal reports generated from the agency’s accounting system to identify HCFAC expenditure amounts, obtained detailed records to support HHS payroll and nonpayroll tested selected payroll and nonpayroll transactions to determine whether they were accurately reported. To evaluate payroll charges to the HCFAC appropriation by HHS/OIG employees during fiscal years 2000 and 2001, we performed analytical procedures. We analyzed the methodology used by the HHS/OIG to verify that expenditures were within the predetermined allocation percentages for HCFAC and non-HCFAC expenditures. We also reviewed 10 HHS/OIG employee time charges for fiscal years 2000 and 2001. The selected employees were interviewed regarding their time charges for fiscal years 2000 and 2001. In the interview, employees were asked to verify the time that was recorded by the department’s management information systems or timecards. We also inquired as to how and where employees received guidance on charging their time and whether they understood the various funding sources used to support OIG activities. We verified that the pay rate listed on the employees Standard Form 50 Notification of Personnel Action was the same as the amount charged to the Department of Health and Human Services Regional Core Accounting System Data Flowback Name List (CORE - Central Accounting System). We verified that the summary hours as recorded in the U.S. Department of Health & Human Services Employee Data Report (TAIMS - Time and Attendance application) traced to the management information system or time and attendance records. We interviewed the employees to verify that the time charged to the management information system or time and attendance records were accurate. We drew dollar unit samples of 44 items from a population of 36,380 nonpayroll expenditures, totaling $34,156,369, from HHS’s internal accounting records for fiscal year 2001, and 39 items from a population of 27,884 nonpayroll expenditures, totaling $32,914,328, for fiscal year 2000. To assess the propriety of these transactions, we obtained supporting documentation such as invoices, purchase orders, and receipts. We recomputed the documentation as appropriate to the transaction. We were unable to accomplish our fifth objective, to identify and assess the propriety of amounts reported as fiscal years 2000 and 2001 expenditures for non-Medicare anti–fraud and abuse activities, because HHS/OIG and DOJ do not separately account for or monitor such expenditures. Even though HIPAA requires that we report on expenditures related to non- Medicare activities, it does not specifically require HHS or DOJ to separately track Medicare and non-Medicare expenditures. To accomplish our sixth objective, to identify and assess the propriety of amounts reported as savings to the trust fund, we obtained the fiscal years 2000 and 2001 HHS/OIG semiannual reports to identify cost savings as reported in the joint reports and tested selected cost saving transactions to determine whether the amounts were substantiated. We were unable to attribute the reported cost savings to HCFAC expenditures as well as identify any other savings from the trust fund because, according to DOJ and HHS officials, any savings resulting from health care anti–fraud and abuse activities funded by the HCFAC program in fiscal years 2000 and 2001 will likely not be realized until subsequent years. We interviewed and obtained documentation from officials at CMS in Baltimore, Maryland; HHS headquarters–AOA, ASBTF, OIG and the OGC–in Washington, D.C.; HHS’s Program Support Center in Rockville, Maryland; and DOJ’s Justice Management Division, EOUSA, Criminal Division, Civil Division, and Civil Rights Division in Washington, D.C. We conducted our work in two phases, from April 2001 through June 2001 focusing primarily on fiscal year 2000 HCFAC activity, and from October 2001 through April 2002 focusing primarily on fiscal year 2001 HCFAC activity, in accordance with generally accepted government auditing standards. We requested comments on a draft of this report from the Secretary of HHS and the Attorney General. We received written comments from the Inspector General of HHS and the Acting Assistant Attorney General for Administration at DOJ. We have reprinted their responses in appendixes II and III, respectively. Ronald Bergman, Sharon Byrd, Lisa Crye, Jacquelyn Hamilton, Corinne Robertson, Gina Ross, Sabrina Springfield, and Shawnda Wilson made key contributions to this report. Civil Fines and Penalties Debt: Review of OSM’s Management and Collection Processes. GAO-02-211. Washington, D.C.: December 31, 2001. Criminal Debt: Oversight and Actions Needed to Address Deficiencies in Collection Processes. GAO-01-664. Washington, D.C.: July 16, 2001. The General Accounting Office, the investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full- text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site daily. The list contains links to the full-text document files. To have GAO e-mail this list to you every afternoon, go to www.gao.gov and select “Subscribe to daily E-mail alert for newly released products” under the GAO Reports heading.

Summary: The Medicare program is the nation's largest health insurer with almost 40 million beneficiaries and outlays of over $219 billion annually. Because of the susceptibility of the program to fraud and abuse, Congress enacted the Health Care Fraud and Abuse Control (HCFAC) Program as part of the Health Insurance Portability and Accountability Act (HIPPAA) of 1996. HCFAC, which is administered by the Department of Health and Human Services' (HHS) Office of Inspector General (OIG) and the Department of Justice (DOJ), established a national framework to coordinate federal, state, and local law enforcement efforts to detect, prevent, and prosecute health care fraud and abuse in the public and private sectors. HIPPAA requires HHS and DOJ to issue a joint annual report no later than January 1 of each year to Congress for the proceeding fiscal year. The joint HCFAC reports included deposits of $210 million for fiscal year 2000 and $464 million for fiscal year 2001, pursuant to the act. In testing at DOJ, GAO found errors in the recording of criminal fines deposits to the Federal Hospital Insurance Trust Fund in fiscal year 2001 that resulted in an estimated overstatement to the trust fund of $169,765. GAO found that the planned use of HCFAC appropriations was in keeping with the stated purpose in the act. Although GAO found expenditures from the trust fund were generally appropriate at HHS, at DOJ GAO found $480,000 in interest penalties not related to HCFAC activities that were charged to the HCFAC appropriation. GAO was unable to identify expenditures from the HCFAC trust fund for activities unrelated to Medicare because the HHS/OIG and DOJ do not separately account for or monitor these activities. Likewise, GAO was unable to identify savings specifically attributable to activities funded by the HCFAC program.