HIPAA established the HCFAC program to consolidate and strengthen ongoing efforts to combat fraud and abuse in health care programs and expand resources for fighting health care fraud. The Attorney General and the Secretary of HHS through the HHS Office of Inspector General (HHS/OIG) administer HCFAC. The HCFAC program goals are to coordinate federal, state, and local law enforcement efforts to control fraud and abuse associated with health plans; conduct investigations, audits, and other studies of delivery and payment for health care for the United States; facilitate the enforcement of the civil, criminal, and administrative statutes applicable to health care; provide guidance to the health care industry, including the issuance of advisory opinions, safe harbor notices, and special fraud alerts; and establish a national database of adverse actions against health care providers. HIPAA requires the following types of collections to be deposited in the trust fund: criminal fines recovered in cases involving a federal health care offense; civil monetary penalties and assessments imposed in health care fraud amounts resulting from the forfeiture of property by reason of a federal penalties and damages obtained and otherwise creditable to miscellaneous receipts of the general fund of the Treasury obtained under sections 3729 through 3733 of Title 31, United States Code (commonly known as the False Claims Act), in cases involving claims related to the provision of health care items and services (other than funds awarded to a relator, for restitution, or otherwise authorized by law); and unconditional gifts and bequests. Funds for the HCFAC program are appropriated from the trust fund to an expenditure account, referred to as the Health Care Fraud and Abuse Control Account (control account) maintained within the trust fund. The Attorney General and the Secretary of HHS jointly certify that the funds transferred to the control account are necessary to finance health care fraud and abuse control activities. Only a portion of the funds collected and deposited to the trust fund are appropriated to the control account annually for the HCFAC program. The maximum amounts that may be appropriated for HCFAC each year are specified by HIPAA. The maximum amount for fiscal year 1997, the first year of HCFAC, was $104 million and HIPAA limited the amounts for each of the fiscal years 1998 through 2003 to an amount equal to the limit for the preceding fiscal year increased by 15 percent. For each fiscal year after 2003, the amount made available was capped at the 2003 limit (See table 1). In addition to the annual limits on the total amount made available for HCFAC, HIPAA includes annual minimum and maximum amounts that are earmarked specifically for HHS/OIG activities for the Medicare and Medicaid programs. For example, of the $240.6 million available in fiscal year 2003, a minimum of $150 million and a maximum of $160 million were earmarked for the HHS/OIG to ensure continued efforts by the HHS/OIG to detect and prevent fraud and abuse in the Medicare and Medicaid programs. HHS’s Centers for Medicare and Medicaid Services (CMS) performs the accounting for the HCFAC control account. Prior to fiscal year 2003, CMS set up allotments in its accounting system for each of the HHS and DOJ entities receiving HCFAC funds. The HHS and DOJ entities accounted for their HCFAC obligations and expenditures in their respective accounting systems and reported them to CMS. CMS then recorded the obligations and expenditures against the appropriate allotments in its accounting system. However, for fiscal year 2003, HHS changed the method of providing funds to DOJ from a direct allotment to a reimbursable agreement. This change requires DOJ components to prepare and submit billing packages to CMS to obtain reimbursement from DOJ’s allotment of the HCFAC funds. HHS and DOJ reported total deposits to the trust fund of about $766 million in fiscal year 2002 and $243 million in fiscal year 2003. On the basis of our review of a statistical sample of deposit transactions for fiscal years 2002 and 2003, we determined that the amounts HHS and DOJ reported as deposits to the trust fund were appropriate. As shown in figure 1, these deposits primarily consisted of penalties and multiple damages and criminal fines collected as a result of health care fraud cases. The considerable difference in the amount of criminal fines reported for fiscal year 2002 and 2003 is primarily due to large criminal fine collections from two major cases settled in prior years. In addition, the difference in the amount of penalties and multiple damages reported for fiscal years 2002 and 2003 was primarily due to collections of amounts from a major case settled in a prior year. Related to our review of criminal fine deposits, DOJ provided us with supporting documents related to a $13.0 million adjustment that was calculated and reported to the Department of the Treasury in September 2002 to correct the amount of criminal fine deposits previously reported in error. When we reviewed the supporting documents for the adjustment, we identified a mathematical error of approximately $130,000 in DOJ’s determination of the adjustment. While the amount of error has a minimal impact on the trust fund balance, we found that DOJ lacked supervisory review procedures for deposits, which may have contributed to the error going unnoticed. Lack of supervisory review could result in undetected material errors to the trust fund in the future. The Comptroller General’s Standards for Internal Control in the Federal Government state that management review is an important control activity in helping to ensure that all transactions are completely and accurately recorded. DOJ officials acknowledged the importance of this control activity and in response they developed new procedures to ensure proper review of all adjustments and deposit amounts before reports are sent to Treasury. In addition, in September 2004, DOJ made the necessary correction to the amount of criminal fine deposits reported to the trust fund. However, because the correction of the error was not made until after the end of fiscal year 2003, the HCFAC joint report for fiscal year 2003 did not include the correction. In fiscal years 2002 and 2003, $209 million and $240 million, respectively, were appropriated from the trust fund for performing HCFAC program activities. On the basis of our review of supporting documents, we determined that these amounts were consistent with HIPAA and that the amount of HCFAC funds specified in the joint reports was made available to HHS and DOJ. We also determined that HHS’s and DOJ’s expenditure of amounts appropriated from the trust fund was reasonable. However, we did note that some data on expenditures were not included in HHS and DOJ information systems. For example, some staff hours needed to monitor payroll expenses were not tracked in HHS/OIG workload tracking systems. Also, DOJ did not record some expenditure data in its accounting system as HCFAC expenses and therefore could not provide an electronic file of all nonpayroll expenses from which we could select a statistical sample of these fiscal year 2003 expenses. We tested nonpayroll expenses, selected on a nonstatistical basis, from hard copy documents and determined that they were adequately supported and related to HCFAC. However, having all data on HCFAC expenses in its accounting system could help managers in monitoring how HCFAC funds are spent. HIPAA specifies the maximum amounts that may be appropriated from the trust fund each year for HCFAC, as well as a minimum and maximum amount of the appropriations that must go to the HHS/OIG for Medicare and Medicaid antifraud activities. For fiscal years 2002 and 2003, HHS and DOJ each received the maximum amount from the trust fund allowed under HIPAA. In addition, HHS and DOJ entered into memorandums of agreement to agree on how much of the HCFAC appropriation each HHS and DOJ unit would receive. The amount allocated to each unit was included in the HHS and DOJ joint reports and is depicted in figure 2. In accordance with HIPAA, HHS/OIG was allocated amounts within the minimum and maximum funding allowed by statute—$145 million and $160 million, for fiscal years 2002 and 2003 respectively. In the HHS and DOJ joint report, the HHS/OIG, other HHS units, and DOJ provided information related to how the HCFAC funds were used. The HHS/OIG reported that its fiscal years 2002 and 2003 HCFAC funds were used in carrying out efforts to both detect health care fraud and abuse and prevent it. These efforts included several fraud prevention activities that reduced program losses as well as participation in prosecutions and settlements of cases involving Medicare and Medicaid fraud, and investigations, audits, and evaluations that helped reveal vulnerabilities or incentives for fraudulent practices. Other HHS components also reported on how they had expended their HCFAC funds including CMS. CMS received $2.7 million in fiscal year 2002 and $23.4 million in fiscal year 2003. The increase in funding for fiscal year 2003 was in support of several projects including the Medicaid Payment Accuracy Measurement Project, Medicare/Medicaid Data Analysis Project, and Medicaid Financial Management initiatives, including Medicaid Audits. DOJ reported that its funding was used to support its role in civil and criminal prosecution of health care professionals, providers, and others as well as its role in recovering funds that federal health care programs have paid as a result of fraud, waste, and abuse. We determined that expenditures charged by HHS and DOJ for HCFAC activities were reasonable. In evaluating HHS HCFAC expenditures, we focused on expenditures of the HHS/OIG. The HHS/OIG’s payroll and nonpayroll expenses represented about 96 percent of all HHS expenditures charged against HCFAC funds for fiscal years 2002 and 2003. We reviewed the methodology that the HHS/OIG used to charge expenditures against its HCFAC funding and determined that it was reasonable.