The Health Insurance Portability and Accountability Act of 1996 amended the Social Security Act (the act) to, among other things, (1) establish a Health Care Fraud and Abuse Control Program and (2) establish an expenditure account, designated as the Health Care Fraud and Abuse Control Account (Account) within the Federal Hospital Insurance Trust Fund (Trust Fund). The Account is administered by Department of Health and Human Services’ (HHS) Office of Inspector General and DOJ. The amendment also makes appropriations for the Account from the general fund of the U.S. Treasury. The appropriations are in specified amounts for each fiscal year beginning with fiscal year 1997 for transfer to FBI to carry out its health care fraud investigations. In 1997 HHS and FBI entered into an interagency agreement to facilitate the required annual transfer of funds from the Account to FBI solely for its health care fraud investigations. FBI receives the transferred funds and records the funds in its Salaries and Expenses (S&E) appropriation account at the beginning of each fiscal year. FBI then incurs obligations for health care fraud investigations and makes payments from the S&E account, which is also used to make payments for other FBI mission-related and support activities. The amounts that were transferred to FBI as required by the act for the years of our review were as follows: fiscal year 2000: $76 million, fiscal year 2001: $88 million, fiscal year 2002: $101 million, and fiscal year 2003: $114 million (and each subsequent year). The amendment requires that these funds be used solely to cover the costs (including equipment, salaries and benefits, and travel and training) of the administration and operation of the health care fraud and abuse control program, including the costs of prosecuting health care matters, investigations, financial and performance audits of health care programs, and inspections and other evaluations. These health care fraud investigations are managed nationally by FBI’s Health Care Fraud Unit (HCFU), which was created in 1992 within the Financial Crimes Section of the FBI’s Criminal Investigative Division. Health care fraud investigations include those for fraud against government programs and private insurance, as well as medical privacy law violations. HCFU is responsible for health care fraud investigations that are conducted by FBI’s field offices and, for management and reporting purposes, both HCFU and the related field investigations are considered a part of its White Collar Crime decision unit. FBI used a limited approach to monitoring its use of HIPAA transfers, which might have been sufficient when it clearly used more agent FTEs for health care fraud investigations than it had budgeted. But this approach was insufficient when some of the agent FTEs previously devoted to health care fraud investigations were shifted to counterterrorism activities, causing actual FTEs to fall below budgeted FTEs. At the time of our review, FBI’s Financial Management System (FMS) was unable to track overall costs related to health care fraud investigations. As a result, FBI had minimal assurance that all of the transferred HIPAA funds were properly spent. DOJ is currently planning to implement the new DOJ-wide Unified Financial Management System, but it has yet to develop the specific systems requirements to enable it to accurately capture all of the costs of its health care fraud investigations and therefore to help monitor compliance with HIPAA and other relevant laws and regulations. FBI’s budget for health care fraud investigations was equivalent to the amount of the HIPAA transfers and included only the direct program costs. These direct costs consisted of payroll and benefits for agents and certain other personnel involved in health care fraud investigations, plus related costs such as rent and supplies. FBI used an approach to monitoring the use of HIPAA transfers that considered agent FTEs only without considering the other direct program costs. For the 4 years we reviewed, the agent FTEs represented about 42 percent of the budgeted amounts for work on health care fraud investigations, while the other direct program costs represented about 58 percent of the budgeted amounts. FBI obtained agent FTEs from reports generated by its time utilization system, which records the percentage of time that agents worked on each investigative classification and, if applicable, major cases. FBI officials told us that prior to September 11, 2001, reported agent FTEs charged to the health care fraud investigations were historically far in excess of those budgeted and they were satisfied that the resources expended on health care fraud investigations exceeded the HIPPA transfers. For example, in fiscal year 2000, FBI reported that health care fraud agent FTEs exceeded the number budgeted that year by about 19 percent. However, this limited approach to monitoring the use of the HIPAA transfers was insufficient when agent FTEs were shifted to counterterrorism activities after September 11, 2001, because it lacked the specificity of cost information for both direct and indirect costs. Furthermore, FBI’s FMS was not capable of providing this specific cost information. Therefore, in years when reported agent FTEs were close to or below budgeted FTE amounts, FBI had no effective mechanism in place to monitor compliance with HIPAA. This was the case when reported agent FTEs approximated the budgeted amounts in fiscal year 2001 and fell below budgeted FTEs in fiscal years 2002 and 2003 by 31 percent and 26 percent, respectively. Reliable information on the costs of federal programs and activities is crucial for the effective management of government operations and assists internal and external users in assessing the budget integrity, operating performance, stewardship, and systems and control of program activities. In this regard, the Chief Financial Officers Act of 1990 expressly calls on agencies to provide for the systematic measurement of performance and the development of cost information. In addition, “Statement of Federal Financial Accounting Standards Number 4” established for all federal agencies cost accounting concepts and standards aimed at providing reliable and timely information on the full cost of federal programs, their activities, and outputs. Cost information for program activities is especially crucial in order to properly manage and account for funds that have been appropriated, or in this case, transferred for certain authorized purposes. FBI’s FMS has minimal capability to track health care fraud investigation and other specific program costs necessary to meet federal guidance. FMS tracks costs by cost center, of which only headquarters costs are separately identifiable by program. However, substantially all of the direct costs for health care fraud investigations are incurred at the individual field offices, each of which is considered separate cost centers. The specific program costs within each field location, therefore, are not individually tracked or separately identifiable. As a result, FBI cannot use FMS to track and report all health care fraud investigation costs. DOJ is currently in the process of implementing a new financial management system. The new UFMS is likely to have the capability to capture nonpersonnel costs on a program or subprogram basis, if design specifications are set to do so. However, according to FBI finance officials, specifications have not been set up for UFMS to capture total payroll costs at the program level. These costs amounted to about 55 percent of the budgeted health care fraud investigation costs. Under UFMS as currently planned, payroll costs are to be processed by the U.S. Department of Agriculture’s National Finance Center (NFC) starting in 2006 and recorded at the summary level. As a result, they will be combined with the payroll costs of other programs and will not be separately identifiable. NFC officials told us that they recommend that all customers receive summary and detailed-level data. NFC uses a 27-digit accounting code, of which 24 digits are available to agencies to establish an account structure for detailed payroll information such as program, subprogram, and job code levels. NFC officials also stated that they met informally with FBI personnel and explained how the accounting codes could be used to support FBI’s needs. An FBI official told us that because of security concerns, FBI would have to give consideration to using such codes. The absence of accounting codes for programs and subprograms or other control mechanisms for monitoring payroll and other costs will continue to impede FBI’s ability to assess compliance with HIPAA and other relevant laws and regulations. In the absence of system-generated program costs and upon our request for cost schedules, FBI began developing an estimate of its health care fraud investigation costs incurred for fiscal years 2000 through 2003 in an attempt to determine the propriety of its use of the HIPAA transfers. FBI engaged in extensive manual efforts and developed cost estimates that, in their final form, appropriately considered both direct program costs and the portion of indirect, FBI-wide support unit costs that related to the health care fraud program. However, we found that the estimates were either directly or indirectly based on data from FBI’s time utilization system, which had not been properly validated, and various other data that were not adequately supported. As a result, despite a good-faith effort by FBI to estimate these costs, neither we nor FBI could reliably determine whether the HIPAA transfers were spent solely on health care fraud investigations for the 4-year period. FBI officials told us at the start of our review that they were unable to provide us with a report of actual costs and had not previously estimated the costs associated with the transfers for fiscal years 2000 through 2003 primarily because of the financial systems’ weaknesses that we previously discussed. As an alternative, they proposed to provide us with an estimate of health care fraud investigation costs and subsequently developed an estimation methodology. Because cost estimates for this program had never before been attempted, FBI tried different approaches and revised the estimates several times during our review. The first three estimates for the 4-year period were revised to reflect slight changes in the methodology and to correct an error in the estimates but were quite similar to each other in method and in results. In essence, FBI estimated the direct costs for each budgeted line item of the health care fraud program.