HIPAA established the HCFAC program to consolidate and strengthen ongoing efforts to combat fraud and abuse in health care programs and expand resources for fighting health care fraud. The Attorney General and the Secretary of HHS through the HHS Office of Inspector General (HHS/OIG) administer HCFAC. The HCFAC program goals are to coordinate federal, state, and local law enforcement efforts to control fraud and abuse associated with health plans; conduct investigations, audits, and other studies of delivery and payment for health care for the United States; facilitate the enforcement of the civil, criminal, and administrative statutes applicable to health care; provide guidance to the health care industry, including the issuance of advisory opinions, safe harbor notices, and special fraud alerts; and establish a national database of adverse actions against health care providers. HIPAA requires the following types of collections to be deposited in the trust fund: criminal fines recovered in cases involving a federal health care offense; civil monetary penalties and assessments imposed in health care fraud amounts resulting from the forfeiture of property by reason of a federal penalties and damages obtained and otherwise creditable to miscellaneous receipts of the general fund of the Treasury obtained under sections 3729 through 3733 of Title 31, United States Code (commonly known as the False Claims Act), in cases involving claims related to the provision of health care items and services (other than funds awarded to a relator, for restitution, or otherwise authorized by law); and unconditional gifts and bequests. Funds for the HCFAC program are appropriated from the trust fund to an expenditure account, referred to as the Health Care Fraud and Abuse Control Account (control account) maintained within the trust fund. The Attorney General and the Secretary of HHS jointly certify that the funds transferred to the control account are necessary to finance health care fraud and abuse control activities. Only a portion of the funds collected and deposited to the trust fund are appropriated to the control account annually for the HCFAC program. The maximum amounts that may be appropriated for HCFAC each year are specified by HIPAA. The maximum amount for fiscal year 1997, the first year of HCFAC, was $104 million and HIPAA limited the amounts for each of the fiscal years 1998 through 2003 to an amount equal to the limit for the preceding fiscal year increased by 15 percent. For each fiscal year after 2003, the amount made available was capped at the 2003 limit (See table 1). In addition to the annual limits on the total amount made available for HCFAC, HIPAA includes annual minimum and maximum amounts that are earmarked specifically for HHS/OIG activities for the Medicare and Medicaid programs. For example, of the $240.6 million available in fiscal year 2003, a minimum of $150 million and a maximum of $160 million were earmarked for the HHS/OIG to ensure continued efforts by the HHS/OIG to detect and prevent fraud and abuse in the Medicare and Medicaid programs. HHS’s Centers for Medicare and Medicaid Services (CMS) performs the accounting for the HCFAC control account. Prior to fiscal year 2003, CMS set up allotments in its accounting system for each of the HHS and DOJ entities receiving HCFAC funds. The HHS and DOJ entities accounted for their HCFAC obligations and expenditures in their respective accounting systems and reported them to CMS. CMS then recorded the obligations and expenditures against the appropriate allotments in its accounting system. However, for fiscal year 2003, HHS changed the method of providing funds to DOJ from a direct allotment to a reimbursable agreement. This change requires DOJ components to prepare and submit billing packages to CMS to obtain reimbursement from DOJ’s allotment of the HCFAC funds. HHS and DOJ reported total deposits to the trust fund of about $766 million in fiscal year 2002 and $243 million in fiscal year 2003. On the basis of our review of a statistical sample of deposit transactions for fiscal years 2002 and 2003, we determined that the amounts HHS and DOJ reported as deposits to the trust fund were appropriate. As shown in figure 1, these deposits primarily consisted of penalties and multiple damages and criminal fines collected as a result of health care fraud cases. The considerable difference in the amount of criminal fines reported for fiscal year 2002 and 2003 is primarily due to large criminal fine collections from two major cases settled in prior years. In addition, the difference in the amount of penalties and multiple damages reported for fiscal years 2002 and 2003 was primarily due to collections of amounts from a major case settled in a prior year. Related to our review of criminal fine deposits, DOJ provided us with supporting documents related to a $13.0 million adjustment that was calculated and reported to the Department of the Treasury in September 2002 to correct the amount of criminal fine deposits previously reported in error. When we reviewed the supporting documents for the adjustment, we identified a mathematical error of approximately $130,000 in DOJ’s determination of the adjustment. While the amount of error has a minimal impact on the trust fund balance, we found that DOJ lacked supervisory review procedures for deposits, which may have contributed to the error going unnoticed. Lack of supervisory review could result in undetected material errors to the trust fund in the future. The Comptroller General’s Standards for Internal Control in the Federal Government state that management review is an important control activity in helping to ensure that all transactions are completely and accurately recorded. DOJ officials acknowledged the importance of this control activity and in response they developed new procedures to ensure proper review of all adjustments and deposit amounts before reports are sent to Treasury. In addition, in September 2004, DOJ made the necessary correction to the amount of criminal fine deposits reported to the trust fund. However, because the correction of the error was not made until after the end of fiscal year 2003, the HCFAC joint report for fiscal year 2003 did not include the correction. In fiscal years 2002 and 2003, $209 million and $240 million, respectively, were appropriated from the trust fund for performing HCFAC program activities. On the basis of our review of supporting documents, we determined that these amounts were consistent with HIPAA and that the amount of HCFAC funds specified in the joint reports was made available to HHS and DOJ. We also determined that HHS’s and DOJ’s expenditure of amounts appropriated from the trust fund was reasonable. However, we did note that some data on expenditures were not included in HHS and DOJ information systems. For example, some staff hours needed to monitor payroll expenses were not tracked in HHS/OIG workload tracking systems. Also, DOJ did not record some expenditure data in its accounting system as HCFAC expenses and therefore could not provide an electronic file of all nonpayroll expenses from which we could select a statistical sample of these fiscal year 2003 expenses. We tested nonpayroll expenses, selected on a nonstatistical basis, from hard copy documents and determined that they were adequately supported and related to HCFAC. However, having all data on HCFAC expenses in its accounting system could help managers in monitoring how HCFAC funds are spent. HIPAA specifies the maximum amounts that may be appropriated from the trust fund each year for HCFAC, as well as a minimum and maximum amount of the appropriations that must go to the HHS/OIG for Medicare and Medicaid antifraud activities. For fiscal years 2002 and 2003, HHS and DOJ each received the maximum amount from the trust fund allowed under HIPAA. In addition, HHS and DOJ entered into memorandums of agreement to agree on how much of the HCFAC appropriation each HHS and DOJ unit would receive. The amount allocated to each unit was included in the HHS and DOJ joint reports and is depicted in figure 2. In accordance with HIPAA, HHS/OIG was allocated amounts within the minimum and maximum funding allowed by statute—$145 million and $160 million, for fiscal years 2002 and 2003 respectively. In the HHS and DOJ joint report, the HHS/OIG, other HHS units, and DOJ provided information related to how the HCFAC funds were used. The HHS/OIG reported that its fiscal years 2002 and 2003 HCFAC funds were used in carrying out efforts to both detect health care fraud and abuse and prevent it. These efforts included several fraud prevention activities that reduced program losses as well as participation in prosecutions and settlements of cases involving Medicare and Medicaid fraud, and investigations, audits, and evaluations that helped reveal vulnerabilities or incentives for fraudulent practices. Other HHS components also reported on how they had expended their HCFAC funds including CMS. CMS received $2.7 million in fiscal year 2002 and $23.4 million in fiscal year 2003. The increase in funding for fiscal year 2003 was in support of several projects including the Medicaid Payment Accuracy Measurement Project, Medicare/Medicaid Data Analysis Project, and Medicaid Financial Management initiatives, including Medicaid Audits. DOJ reported that its funding was used to support its role in civil and criminal prosecution of health care professionals, providers, and others as well as its role in recovering funds that federal health care programs have paid as a result of fraud, waste, and abuse. We determined that expenditures charged by HHS and DOJ for HCFAC activities were reasonable. In evaluating HHS HCFAC expenditures, we focused on expenditures of the HHS/OIG. The HHS/OIG’s payroll and nonpayroll expenses represented about 96 percent of all HHS expenditures charged against HCFAC funds for fiscal years 2002 and 2003. We reviewed the methodology that the HHS/OIG used to charge expenditures against its HCFAC funding and determined that it was reasonable. The OIG charges a percentage of its total payroll and nonpayroll expenses to the HCFAC program. The percentage that is charged each year is based on the relative proportion of its annual HCFAC funding to its total funding. These amounts are then monitored throughout the year. As table 2 shows, HCFAC funding for fiscal years 2002 and 2003 was 80 and 81 percent, respectively, of the OIG’s total funding. HHS/OIG management takes several steps to help assure that HCFAC funds are expended on HCFAC-related activities. For one, management meets with its component offices at the beginning of the year to determine how much of each component’s resources will be devoted to HCFAC- related activities. Some component offices make plans to devote resources to HCFAC in excess of the 80-81 percent funding level, while other components plan to devote less. OIG management evaluates each component’s plans in relation to each component’s full-time equivalents (FTE) to ensure that OIG resources overall are spent on HCFAC activities in accordance with the funding level. In addition, throughout the year, three of the components, Office of Audit Services (OAS), Office of Evaluations and Inspections (OEI), and Office of Investigations (OI) track the staff time spent on various projects in their workload tracking system. The information in each component’s system is summarized and monitored quarterly to ensure that staff time is being spent on HCFAC in accordance with the funding. The OIG’s Office of Management and Policy (OMP) requests summary reports from the component offices that include the staff time spent on HCFAC activities and uses the information in determining if the OIG overall is performing HCFAC work as planned. The lead OMP staff person said that when material variances are identified in the amount of staff time devoted to HCFAC, the components are instructed to adjust the type of work performed. We reviewed the monitoring reports that the OMP staff prepares and these reports showed that the amount of time devoted to HCFAC activities for the OIG as a whole was in line with the planned amount. We also performed several tests on the information maintained in components’ workload systems as they are relied on in monitoring HCFAC payroll expenditures. For example, we analyzed the data in the components’ workload tracking systems to determine if the projects identified as HCFAC were appropriately classified as HCFAC-related in each component. We analyzed titles and supporting documents for all of the projects in the workload tracking systems of OAS and OEI—two components that account for about 55 percent of the OIG staff. We determined that the projects were appropriately classified as HCFAC or non-HCFAC. We also compared hours in the OAS, OEI, and OI workload tracking systems to hours in the payroll system to determine if the components’ systems included hours for all staff. We found that the hours recorded in OAS’s system agreed with hours in the payroll system. However, hours in OI’s and OEI’s systems did not agree with the payroll system. The OI system included approximately 52 percent fewer hours for fiscal year 2002 and 44 percent fewer hours for 2003 than were in the payroll system. OI managers were aware of the variance and explained that until they recently implemented a new system, their workload system did not include staff hours for administrative and supervisory staff. In determining the amount of staff hours spent on HCFAC-related assignments, OI concluded that administrative and supervisory time was spent in the same relative percentages as the staff who recorded their time in the workload system. In June 2003, OI upgraded its workload tracking system to record hours for all staff. In addition, OI implemented new procedures to help ensure that all hours were recorded in its workload system. The procedures include weekly automatic, system-generated electronic mail messages that are sent to supervisors informing them of employees that did not record their time and a reconciliation of hours in the HHS payroll system to hours in the workload system that is performed during periodic inspections at regional offices. The OEI workload tracking system included about 12 percent fewer hours than the payroll system for fiscal years 2002 and 2003. OEI officials said that they did not have procedures in place to identify missing hours. However, they believed that most of the people not entering data into the workload system were probably managers and administrative personnel whose hours would probably reflect the same allocation of hours between HCFAC and non-HCFAC work as those staff recording hours. In addition, the OMP staff person who monitored staff hours applied the HCFAC and non-HCFAC hours recorded in the workload system against the total FTEs for OEI to determine that the OIG as a whole performed HCFAC work as planned. Therefore, while this issue did not appear to impact the propriety of HCFAC payroll expenditures during our review period, incomplete staff hours in the component workload tracking systems could hinder OIG managers in monitoring the amount of HCFAC work performed in the future. Therefore, it is critical that all OIG components have procedures in place to ensure that workload data are complete. In assessing the reliability of DOJ fiscal year 2002 expenditures, we tested a statistical sample of the largest category of fiscal year 2002 nonpayroll expenses, which accounted for 69 percent of nonpayroll and 34 percent of DOJ’s total fiscal year 2002 HCFAC expenditures. We determined that nonpayroll expenses were adequately supported and related to HCFAC on the basis of our review of supporting documentation. In addition, we reviewed the payroll expenses charged by DOJ’s United States Attorneys Office (USAO) against HCFAC funds that represented 76 percent of DOJ’s fiscal year 2002 HCFAC payroll expenditures and 38 percent of DOJ’s total fiscal year 2002 HCFAC expenditures. We determined that the USAO methodology for charging salaries to HCFAC was reasonable. USAO charged the full annual salaries of 160 individuals against HCFAC program funds in fiscal year 2002 as a surrogate for the 160 FTEs that were funded by the program. USAO managers said that this was administratively easier than trying to charge a portion of the salary of all the staff that perform health care fraud and abuse work. To assess the reasonableness of this approach, we reviewed the hours recorded in the USAO workload system for fiscal year 2002. According to data in the system, USAO staff devoted about 587,168 staff hours (282.3 FTEs) to health care fraud-related activities during fiscal year 2002, which was about 76 percent more than the 160 FTEs (332,800 hours) funded by the program. In addition, to ensure that the salaries charged to HCFAC were reasonable, we compared the average annual salaries for the 160 staff (i.e., attorneys, paralegals, and administrative staff) charged to the HCFAC account to the average annual salary for the same positions USAO-wide. We found that the salaries were generally comparable. Our review of DOJ’s fiscal year 2003 HCFAC expenditures also included a review of USAO salaries charged against HCFAC funds as these amounts represented 75 percent of DOJ’s fiscal year 2003 HCFAC payroll expenditures and 49 percent of all fiscal year 2003 HCFAC expenses. USAO charged the salaries of 162 individuals against HCFAC funding in fiscal year 2003. Our review procedures were similar to our work on 2002 payroll expenditures, and we again found the payroll expenditure amounts to be reasonable. We also tested a nonstatistical selection of nonpayroll expenses for fiscal year 2003 from hard copy documentation included in DOJ billing packages. We determined that these expenses were adequately supported and related to HCFAC. We did not select a statistical sample of fiscal year 2003 nonpayroll HCFAC expenses because DOJ could not provide an electronic file of detailed transactions from its accounting system for all nonpayroll HCFAC expenditures. Only one of the four DOJ components properly recorded expenditures under the specific HCFAC account class in the accounting system. DOJ accounting policy, issued March 2003, required that each DOJ component record expenses charged against HCFAC funds under a specific HCFAC account class so that they can be readily identified as related to HCFAC. Managers for the components that did not follow this accounting policy told us that they recorded their fiscal year 2003 HCFAC expenses at a summary level under an account class for general expenses and not under the HCFAC account class as required because they instead prepared the hard copy billing packages for reimbursement, which were supposed to provide details on HCFAC expenditures. However, we found that the billing packages contained varying levels of detail. Without the full detail recorded in the accounting system it is difficult to monitor HCFAC expenditures. In addition, the lack of such expenditure detail could impede DOJ officials’ ability to prepare meaningful budgets to support future HCFAC funding requests. For the first time, some of the reported cost savings can be considered savings to the trust fund, resulting from trust fund expenditures for the HCFAC program. The joint reports cited cost savings of nearly $19.9 billion for fiscal year 2002 and $20.8 billion for fiscal year 2003, as a result of HHS/OIG recommendations and other initiatives. Of these amounts, about $1.5 billion in cost savings for fiscal year 2002 and $3.9 billion for fiscal year 2003 resulted from actions taken since the HCFAC program was created. However, the remaining cost savings ($18.4 billion for fiscal year 2002 and $16.9 billion for fiscal year 2003) continued to be related to actions that predate the HCFAC program and cannot be associated with expenditures from the trust fund for HCFAC activities. Further, since audit, evaluation, investigation, and litigation activities typically span several years, savings from such activities in fiscal years 2002 and 2003 may not be realized until future years. As has been the case in the past, most of the audits and evaluations related to the reported cost savings (i.e., 47 of the 50 audits cited by the OIG) were done by the OIG before the HCFAC program was created. However, the HHS/OIG cited cost savings related to three reports that were issued in fiscal year 2000. One of the three reports, which consolidated the results of seven HHS/OIG audits on Medicaid enhanced payments, found that payments to some providers were not based on the cost of providing services. The report included recommendations that resulted in changes in program regulations and administrative actions. For example, in January 2001, CMS issued a final rule to change Medicaid payment policies, placing limitations on enhanced payments under Medicaid upper-payment limit requirements for hospital services, nursing facility services, intermediate care facility services for the mentally retarded, and clinic services. In addition, CMS issued a final rule in January 2002 placing additional limitations on enhanced payments for hospitals. CMS projected that the regulatory changes would result in cost savings of $79.3 billion over 10 years beginning with about $1.4 billion in fiscal year 2002 and about $3.8 billion in fiscal year 2003. The two other reports issued in fiscal year 2000 that resulted in costs savings of about $100 million for both fiscal years 2002 and 2003 were related to recovering overpayments to nursing homes and Medicaid drug rebates. Because the three reports were issued since the HCFAC program was created and the savings occurred in fiscal years 2002 and 2003, the savings can be linked to expenditures from the trust fund. We reviewed the support for the total cost savings amounts reported by the HHS/OIG for fiscal years 2002 and 2003. We initially found an overstatement of $840 million in the amounts included in the draft report for fiscal year 2003. The overstatement occurred because the HHS/OIG did not record an adjustment for the revised cost savings amounts issued by the Congressional Budget Office (CBO). The annual cost savings amounts reported by the HHS/OIG are based on estimates issued by CBO of savings that are expected from implementation of health-care-related legislation. CBO revised its estimate of fiscal year 2003 cost savings that would be realized from implementation of the Medicare, Medicaid, and SCHIP Balanced Budget Refinement Act of 1999, but HHS officials did not recognize and factor in the effect of the adjustment in the fiscal year 2003 draft HCFAC report. HHS officials explained that the responsibility for preparing the cost savings amounts had recently been reassigned to another staff person who had not looked for CBO adjustments. The cost savings amounts were corrected and restated in the final report. HIPAA requires that HHS and DOJ issue a joint report on the HCFAC program for each fiscal year by January 1 of the following calendar year. For fiscal years 1997 through 2000, the joint HCFAC report was issued on or close to January 1 of the subsequent year. However, beginning with the report for fiscal year 2001 the report has been issued late and the length of the delay has increased each year. See table 3 for the timing of reports for fiscal years 2001, 2002, and 2003. The fiscal year 2003 report was more than a year late when it was released. HHS and DOJ officials told us that the joint reports have been issued late because of lengthy review processes within each agency. They have attempted to expedite the process but with little apparent success. Delays in issuing the HCFAC reports significantly erode the usefulness of these reports to Congress and others in making decisions about HCFAC program funding and oversight. While the information on HCFAC trust fund activity provided in the HHS and DOJ fiscal years 2002 and 2003 joint reports was reasonable, better tracking of time charges by HHS/OIG and nonpayroll expenditures by DOJ would improve their ability to monitor the use of HCFAC funds. In addition, the usefulness of the fiscal year 2002 and fiscal year 2003 joint annual reports was severely impaired due to their untimely issuance. Until HHS and DOJ streamline their internal review processes, the annual joint reports will continue to be delinquent and therefore of limited use to congressional decision makers and other interested parties. To improve HHS’s accountability over HCFAC program expenditures, we recommend that the HHS Inspector General require all HHS/OIG components to develop procedures for ensuring that all key staff hours spent on HCFAC activities are recorded in OIG workload tracking systems. To improve DOJ’s accountability for HCFAC program expenditures, we recommend that the Attorney General develop monitoring procedures to ensure that DOJ components record key HCFAC program expenditure data under the appropriate HCFAC account class in DOJ’s accounting system. To help ensure that the joint HHS and DOJ HCFAC reports are issued in a more timely manner, we recommend that the Secretary of HHS and the Attorney General develop a more expedited review process and notify congressional committees with oversight responsibility for the HCFAC program of delays in issuing the joint report within 1 month after missing the January 1 deadline and provide updates until the report is issued. A draft of this report was provided to HHS and DOJ for their review and comment. Written comments from HHS and DOJ are reprinted in appendixes III and IV. HHS and DOJ also provided technical comments that we incorporated as appropriate. In written comments, HHS concurred with our recommendation that the HHS Inspector General require all of its components to develop procedures for ensuring that all key staff hours spent on HCFAC activities are recorded in its workload tracking systems and noted that it is already moving to implement such procedures. Similarly, in its written comments, DOJ concurred with our recommendation for ensuring that DOJ components record key HCFAC program expenditure data under the appropriate HCFAC account class in DOJ’s accounting system and noted that its Justice Management Division will meet with the components to assist them in using the accounting classes designated for HCFAC funds. Regarding our recommendation for ensuring that HCFAC reports are issued in a more timely manner, HHS and DOJ agreed to develop a more expedited review process for the HCFAC reports. DOJ commented that it has already instituted several new procedures that it believes will shorten the time needed for future reports and HHS stated that it will work with DOJ in developing changes to the review process. HHS and DOJ, however, did not agree that they should report to Congress delays in issuing the HCFAC report by the mandated deadline. In their comments, HHS and DOJ noted that additional reporting, which requires clearance through both departments, would be counterproductive to clearing the annual HCFAC report. HHS added that such notification would not provide Congress with any substantial information and DOJ added that reporting on delays would be of little value to congressional oversight committees. Instead, DOJ officials stated that they propose to expedite the review and approval process, to the extent that source data are available and circumstances are within the department’s control. We disagree with HHS’s and DOJ’s position that Congress would not gain any value in knowing that the HCFAC report is going to be issued after the date that Congress mandated in law. Congress should be informed if reports that it may use in making future program funding and oversight decisions are not expected to be issued by the mandated report deadline. In addition, it appears that HHS and DOJ interpreted our recommendation for reporting delays in issuing the HCFAC report to mean sending Congress a report that would require a formal clearance process through both agencies. This was not our intent. HHS and DOJ officials can and should develop a mechanism for notifying Congress of delays that would not place an undue burden on their staff or interfere with issuing and clearing the HCFAC report itself. Such a mechanism could be as simple as sending an electronic mail message to all the committees of jurisdiction. DOJ also commented on the status of two remaining open recommendations from our prior report. We will continue to work with DOJ to obtain documentation to support the actions that DOJ said it is implementing. We are sending copies of this report to the Secretary of HHS, the Attorney General, and other interested parties. Copies will be made available to others on request. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov. If you or your staffs have any questions, please contact me at (202) 512-8341 or by e-mail at calboml@gao.gov. Additional GAO contacts and acknowledgments are provided in appendix IV. To assess the reliability and reasonableness of information reported by HHS and DOJ in the joint HCFAC reports for fiscal years 2002 and 2003 as deposits to the trust fund and the sources of such amounts, we did the following. We reviewed the joint HHS and DOJ HCFAC reports for fiscal years 2002 and 2003 to identify amounts deposited to the trust fund. We interviewed HHS and DOJ officials to update our understanding of procedures related to deposits. We obtained data from HHS and DOJ reports and electronic databases for the various deposits as of September 30, 2002, and September 30, 2003, and selected deposit transactions on a statistical basis to determine whether the proper amounts were deposited to the trust fund. We assessed the reliability of the data by (1) performing electronic testing of required data elements, (2) reviewing existing information about the data and the system that produced them, and (3) interviewing agency officials knowledgeable about the data. We determined that the data were sufficiently reliable for the purposes of this report. The transactions that we selected on a statistical basis included the following: We selected a dollar unit sample of penalties and multiple damages totaling $276.8 million from a population totaling $322.6 million for fiscal year 2002, and a dollar unit sample totaling $181.2 million from a population totaling $229.8 million for fiscal year 2003. We selected a dollar unit sample of criminal fines totaling $435.5 million from a population totaling $443.5 million for fiscal year 2002 and a dollar unit sample totaling $1.9 million from a population totaling $2.5 million for fiscal year 2003. We selected a dollar unit sample of civil monetary penalties totaling $1.7 million from a population totaling $6.9 million for fiscal year 2002 and a dollar unit sample totaling $1.7 million from a population totaling $7.1 million for fiscal year 2003. We obtained supporting documentation for each sample transaction from various sources depending on the type of deposit. We traced amounts reported on the supporting documentation to reports and other records to confirm that proper amounts were reported as deposits. To assess the reliability of information reported by HHS and DOJ in the joint HCFAC reports for fiscal years 2002 and 2003 as appropriations from the trust fund for HCFAC, we obtained and reviewed the HIPAA legislation, which includes the maximum and minimum amounts that can be appropriated from the trust fund for HCFAC; obtained and reviewed the HCFAC funding requests for the HHS and DOJ components to determine whether activities included in the requests were consistent with the stated purposes of the HIPAA legislation; obtained the funding decision memorandum detailing how the funds would be distributed between HHS and DOJ, and obtained related documentation for fiscal years 2002 and 2003 to verify the HCFAC funds certified by HHS and DOJ officials; and compared amounts reported in the joint HCFAC reports to the approved funding decision memorandum and compared amounts from the decision memorandum to the OMB documentation (Apportionment Schedule SF-132) to verify that the amounts were made available. To assess the reliability of information reported by HHS and DOJ in the joint HCFAC reports for fiscal years 2002 and 2003 as the justification for the expenditure of HCFAC funds, we did the following. We reviewed the justifications provided in the reports and discussed them with HHS and DOJ officials. We obtained and analyzed data from the HHS/OIG components’ workload tracking systems on the number of hours recorded as worked on HCFAC projects. We reviewed these data for obvious errors and completeness and compared these data for the four selected components with hardcopy documents we obtained from these components, and to the HHS payroll system data. When we found discrepancies we brought them to the attention of the specific component and worked with them to obtain explanations for the discrepancies before conducting our analyses. On the basis of this, we determined that the data were sufficiently reliable for the purposes of this report. We evaluated the methodology used by the HHS/OIG to charge payroll expenses against HCFAC funds for fiscal years 2002 and 2003—these expenses represented 76 percent and 78.6 percent respectively of total HCFAC expenses. For our evaluation, we (1) obtained the total number of staff hours recorded in the workload tracking systems for each of the OIG components and compared the hours in these systems to hours in the HHS payroll system; (2) obtained a list of HHS/OIG projects and related staff hours included in the workload tracking systems for two OIG components, OAS and OEI (staff in OAS and OEI accounted for 55 percent of all OIG employees), and reviewed the project subjects to assess whether projects identified as HCFAC were appropriately classified; and (3) for the project subjects that were unclear, we obtained and reviewed documentation describing the work performed for the jobs to assess whether the job was appropriately classified as HCFAC or non-HCFAC. We analyzed HHS/OIG nonpayroll expenditures charged against HCFAC funds for fiscal years 2002 and 2003—these represented 20 and 17.4 percent respectively. We obtained reports from HHS on the amount of HCFAC and non-HCFAC expenditures by expenditure category (travel, rent, supplies, etc.) for each fiscal year; we then calculated the percentage charged to HCFAC and non-HCFAC funds for each category and compared them to the percentages used by the OIG to allocate expenses against HCFAC funding—80 percent for HCFAC in fiscal year 2002 and 81 percent in fiscal year 2003. We obtained DOJ expenditure and allotment reports for all five components that charge activity to the HCFAC program and calculated the total amount of payroll and nonpayroll expenditures. We evaluated the methodology used by the U.S. Attorney Offices (USAO) to charge payroll expenses against the HCFAC fund. These expenses accounted for 38 percent and 49 percent respectively of total DOJ expenses charged against fiscal years 2002 and 2003 HCFAC funds and 76 percent and 75 percent respectively of DOJ’s total fiscal years 2002 and 2003 HCFAC payroll expenses. USAO payroll expenses were equal to the annual salaries for 160 FTEs for fiscal year 2002 and 162 FTEs for fiscal year 2003. We reviewed the hours recorded in USAO’s workload system to ensure that the office devoted staff time to HCFAC-related activities equal to or greater than the annual hours of the 160 FTEs for both fiscal years. We compared the average annual salary for USAO staff positions (attorney, paralegal, administrative) charged to the HCFAC account to the average annual salary for the same staff positions USAO-wide to ensure that the salary amounts charged against HCFAC were reasonable. We interviewed an agency official knowledgeable about the data obtained from USAO’s workload system to identify any data problems and determined that the data were sufficiently reliable for the purposes of this report. We tested a statistical sample of the largest category of nonpayroll expenses, the Civil component advisory services, which accounted for 34 percent of total DOJ expenses charged against fiscal year 2002 HCFAC funds and 69 percent of the total nonpayroll expenses. We selected a dollar unit sample of 19 transactions totaling $13.1 million from a population totaling $16.5 million and compared the transaction data to supporting documentation such as invoices and advisory services contracts to make sure they agreed. We tested nonpayroll expenses charged against fiscal year 2003 HCFAC funds selected on a nonstatistical basis. We did not select a statistical sample of nonpayroll expenses because DOJ’s accounting system did not identify the complete population of expenditure transactions charged against HCFAC funds. We modified our methodology and (1) obtained copies of all billing packages submitted by DOJ to HHS for reimbursement, (2) selected a nonstatistical sample equal to 50 percent ($6.7 million of a total $13.4 million) of the total summary amounts listed on each billing package, and (3) traced and compared the data to supporting documentation, such as invoices and advisory services contracts. To assess the reliability of information reported by HHS and DOJ in the joint HCFAC reports for fiscal years 2002 and 2003 as cost savings, we obtained the schedule of HHS/OIG Cost Savings 1998-2011 and compared the data for fiscal years 2002 and 2003 to the HCFAC joint reports; obtained the fiscal years 2002 and 2003 HHS/OIG semiannual reports and traced and compared the amounts identified as cost savings to the amounts reported in the fiscal years 2002 and 2003 HCFAC joint reports; selected cost saving transactions on a nonstatistical basis, traced and compared the data to supporting documentation; and reviewed the dates of reports that the OIG cited as having findings and recommendations that resulted in the reported cost savings. In assessing the status of recommendations made in our prior report, we reviewed the recommendations included in our prior report and the comments provided by DOJ on our prior report to identify corrective actions that had been implemented or were to be implemented in the future; provided a list of the prior-year recommendations and their status per DOJ comments to DOJ management and requested supporting documentation for the corrective actions taken; and reviewed the supporting documentation to verify that the corrective actions were implemented and that the corrective actions completely addressed the recommendations. We conducted our work from August 2003 through January 2005 in accordance with U.S. generally accepted government auditing standards. We provided a draft of this report to HHS and DOJ for their comments. Written comments from the Acting Inspector General of HHS and the Assistant Attorney General for Administration at DOJ are included in appendixes III and IV, respectively. We also received technical comments from HHS and DOJ that were incorporated as appropriate. DOJ determined the amount of the overstatement and submitted an adjustment to the Bureau of Public Debt (BPD) in September 2002. However, in our review of the supporting documentation we identified a mathematical error in DOJ’s calculations. DOJ agreed with the revised amount and submitted the adjustment to BPD in September 2004. reports submitted to the Department of the Treasury are accurate. DOJ developed and implemented new procedures for reviewing collections reports for accuracy and approving them prior to submission to BPD. According to DOJ officials, the misposted non-HCFAC charge, along with the HCFAC charge that was posted to another account, have been corrected in the Financial Management Information System. GAO requested, but had not received at the end of fieldwork, documentation that supports the correction of the charges. According to DOJ officials, the department is continuing its ongoing financial management training efforts to reinforce the importance of accurate financial management processing and the minimization of data entry and errors. Also, the issue is also emphasized in monthly Financial Managers Council meetings and “clean audit” training. GAO requested, but had not received at the end of fieldwork, documentation to verify whether DOJ staff responsible for HCFAC accounting functions have completed the designated training. To facilitate providing Congress and other decision makers with relevant information on program performance and results, we recommend that the Attorney General and the Secretary of HHS assess the feasibility of tracking cost savings and expenditures attributable to HCFAC activities by the various federal programs affected. This recommendation is closed because of recent changes to HIPAA legislation. HIPAA had required GAO to report on cost savings and expenditures attributable to HCFAC activities by the various federal programs affected but did not require HHS and DOJ to track cost savings and expenditures in this manner. In December 2003, Congress passed Public Law 108- 173, which amended the HIPAA legislation. The amendment removed the language requiring GAO to identify any expenditures from the Trust Fund with respect to activities not involving the Medicare program. W. Ed Brown, H. Donald Campbell, Lisa Crye, Kelly Lehr, Kathryn Peterson, and Matthew Wood made key contributions to this report. Sharon Byrd provided statistical sampling technical assistance. High-Risk Series: An Update. GAO-05-207. Washington, D.C.: January 1, 2005. Medicare: CMS’s Program Safeguards Did Not Deter Growth in Spending for Power Wheelchairs. GAO-05-43. Washington, D.C.: November 17, 2004. Medicare Hospice Care: Modifications to Payment Methodology May Be Warranted. GAO-05-42. Washington, D.C.: October 15, 2004. Medicare Physician Payments: Concerns about Spending Target System Prompt Interest in Considering Reforms. GAO-05-85. Washington, D.C.: October 8, 2004. Comprehensive Outpatient Rehabilitation Facilities: High Medicare Payments in Florida Raise Program Integrity Concerns. GAO-04-709. Washington, D.C.: August 12, 2004. Medicaid Program Integrity: State and Federal Efforts to Prevent and Detect Improper Payments. GAO-04-707. Washington, D.C.: July 16, 2004. Comptroller General’s Forum on Health Care: Unsustainable Trends Necessitate Comprehensive and Fundamental Reforms to Control Spending and Improve Value. GAO-04-793SP. Washington, D.C.: May 2004. Criminal Debt: Actions Still Needed to Address Deficiencies in Justice’s Collection Processes. GAO-04-338. Washington, D.C.: March 5, 2004. Medicare Home Health: Payments to Most Freestanding Home Health Agencies More Than Covered Their Costs. GAO-04-359. Washington, D.C.: February 27, 2004. Medicaid: Improved Federal Oversight of State Financing Schemes Is Needed. GAO-04-228. Washington, D.C.: February 13, 2004. Financial Management: Status of the Governmentwide Efforts to Address Improper Payment Problems. GAO-04-99. Washington, D.C.: October 17, 2003. Medicare Provider Enrollment: Opportunities to Enhance Program Integrity Efforts. GAO-03-185. Washington, D.C.: March 17, 2003. Medicare: Payment for Blood Clotting Factor Exceeds Providers’ Acquisition Cost. GAO-03-184. Washington, D.C.: January 10, 2003. High-Risk Series: An Update. GAO-03-119. Washington, D.C.: January 1, 2003. Medicaid Financial Management: Better Oversight of State Claims for Federal Reimbursement Needed. GAO-02-300. Washington, D.C.: February 28, 2002. Medicare: Health Care Fraud and Abuse Control Program for Fiscal Years 2000 and 2001. GAO-02-731. Washington, D.C.: June 3, 2002. Civil Fines and Penalties Debt: Review of CMS’ Management and Collection Processes. GAO-02-116. Washington, D.C.: December 31, 2001. Medicare: Reporting on the Health Care Fraud and Abuse Control Program for Fiscal Years 1998 and 1999. GAO/AIMD-00-51R. Washington, D.C.: December 13, 1999.

Summary: Because of the susceptibility of health care programs to fraud and abuse, Congress enacted the Health Care Fraud and Abuse Control (HCFAC) program as part of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Pub. L. No. 104-191. HIPAA requires that the Departments of Health and Human Services (HHS) and Justice (DOJ) issue a joint annual report to Congress on amounts deposited to the Federal Hospital Insurance Trust Fund and amounts appropriated from the trust fund for the HCFAC program. It also requires GAO to submit reports biennially. This, our final report required by law, provides the results of our review of amounts reported as (1) deposits to the trust fund, (2) appropriations from the trust fund and justification for expenditure of such amounts by HHS and DOJ, and (3) savings resulting from expenditures from the trust fund. We also report on the repeated late issuance of the annual HCFAC report as well as the status of our prior recommendations. Our review of the HCFAC program for fiscal years 2002 and 2003 determined that amounts reported as trust fund deposits--$766 million (fiscal year 2002) and $243 million (fiscal year 2003)--were appropriate. The sources of these deposits were primarily penalties and multiple damages and criminal fines collected from health care fraud cases. Amounts reported as appropriations from the trust fund for HCFAC activities--$209 million (fiscal year 2002) and $240 million (fiscal year 2003)--were consistent with HIPAA. The HHS/OIG received funds within the minimum and maximum amounts allowed by HIPAA to carry out Medicare and Medicaid antifraud activities. The expenditures charged against HCFAC funds by HHS and DOJ for fiscal years 2002 and 2003 were reasonable but the HHS/OIG did not record time charges in its workload systems for all staff that worked on HCFAC activities. Also, DOJ did not record all fiscal year 2003 expenditures in its accounting system so they could be readily identified as HCFAC related. Failure to properly record staff hours and expenditure data could hinder DOJ and HHS in monitoring the uses of HCFAC funds. Some reported cost savings--$19.9 billion (fiscal year 2002) and $20.8 billion (fiscal year 2003) can be considered savings to the trust fund, resulting from trust fund expenditures for the HCFAC program, but most can not. For example, $1.5 billion of the cost savings for fiscal year 2002 and $3.9 billion for fiscal year 2003 are the result of HHS/OIG recommendations and other initiatives since the HCFAC program was created. However, the remaining cost savings continued to be largely the result of actions that predate the HCFAC program and cannot be associated with expenditures from the trust fund for HCFAC. HIPAA requires that HHS and DOJ issue to Congress a joint HCFAC report on January 1 of each year. However, DOJ and HHS have issued the last three reports late and the length of the delay has increased each year. HHS and DOJ cited onerous internal review processes as the reason for late issuance.