The appropriations are in specified amounts for  each fiscal year beginning with fiscal year 1997 for transfer to FBI to carry  out its health care fraud investigations. FBI’s Monitoring Approach for HIPAA Transfers Provided Little Assurance of Transfers’ Proper Use

FBI used a limited approach to monitoring its use of HIPAA transfers,  which might have been sufficient when it clearly used more agent FTEs for  health care fraud investigations than it had budgeted. But this approach  was insufficient when some of the agent FTEs previously devoted to health  care fraud investigations were shifted to counterterrorism activities,  causing actual FTEs to fall below budgeted FTEs. As a result, FBI had  minimal assurance that all of the transferred HIPAA funds were properly  spent. DOJ is currently planning to implement the new DOJ-wide Unified  Financial Management System, but it has yet to develop the specific  systems requirements to enable it to accurately capture all of the costs of  its health care fraud investigations and therefore to help monitor  compliance with HIPAA and other relevant laws and regulations. These direct costs consisted of payroll and benefits for agents and certain  other personnel involved in health care fraud investigations, plus related  costs such as rent and supplies. For the 4 years we reviewed,  the agent FTEs represented about 42 percent of the budgeted amounts for  work on health care fraud investigations, while the other direct program  costs represented about 58 percent of the budgeted amounts. FBI officials told us that prior  to September 11, 2001, reported agent FTEs charged to the health care  fraud investigations were historically far in excess of those budgeted and  they were satisfied that the resources expended on health care fraud  investigations exceeded the HIPPA transfers. Therefore, in years when reported agent FTEs were close to or  below budgeted FTE amounts, FBI had no effective mechanism in place to  monitor compliance with HIPAA. FBI’s Cost Estimates of Health Care Fraud Investigations Were Not Adequately Supported

In the absence of system-generated program costs and upon our request for  cost schedules, FBI began developing an estimate of its health care fraud  investigation costs incurred for fiscal years 2000 through 2003 in an  attempt to determine the propriety of its use of the HIPAA transfers. However, we found that the estimates were  either directly or indirectly based on data from FBI’s time utilization  system, which had not been properly validated, and various other data that  were not adequately supported. As a result, despite a good-faith effort by  FBI to estimate these costs, neither we nor FBI could reliably determine  whether the HIPAA transfers were spent solely on health care fraud  investigations for the 4-year period. With the  addition of these indirect costs, FBI ultimately estimated that it spent more  on health care fraud investigations than was funded by the HIPAA transfers  for all 4 years. Conclusions

FBI’s monitoring approach for determining the proper use of HIPAA  funding was limited and did not provide the level of assurance needed  when agent FTEs devoted to health care fraud investigations were close to  or below budgeted amounts. Scope and Methodology

We reviewed the internal controls related to the use of the Health Insurance  Portability and Accountability Act (HIPAA) transfers and the cost estimates  of health care fraud investigations for fiscal years 2000 through 2003.
Why GAO Did This Study

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) provided, among other things, funding by transfer to the Federal Bureau of Investigation (FBI) to carry out specific purposes of the Health Care Fraud and Abuse Control Program. Congress expressed concern about a shift in FBI resources from health care fraud investigations to counterterrorism activities after September 11, 2001. Congress asked GAO to review FBI's accountability for the funds transferred under HIPAA for fiscal years 2000 through 2003. GAO determined (1) whether FBI had an adequate approach for ensuring the proper use of the HIPAA transfers and (2) the extent to which FBI had expended these transferred funds on health care fraud investigations in fiscal years 2000 through 2003.

What GAO Found

FBI used a limited approach to monitoring its use of HIPAA transfers, which might have been sufficient during times when it clearly used more agent full time equivalents (FTEs) for health care fraud investigations than budgeted but was insufficient when some of the agent FTEs previously devoted to health care fraud investigations were shifted to counterterrorism activities. FBI's budgeted FTEs (agent and other personnel) and related costs (such as rent and utilities) were equivalent to the amount of the HIPAA transfers. However, FBI's approach to monitoring the use of HIPAA transfers considered only agent FTEs, which made up about 42 percent of the budgeted health care fraud costs, but did not consider other personnel FTEs or related costs. According to FBI officials, they did not monitor these other budgeted amounts to determine compliance with HIPAA because the actual agent FTEs were historically far in excess of those budgeted. However, once FBI began to shift agent resources away from health care fraud investigations, agent FTEs charged to health care fraud investigations fell below the budgeted amounts, and FBI could no longer rely on this limited approach to ensure that the transferred HIPAA funds were properly used. Furthermore, FBI did not have a system in place to capture its overall health care fraud investigation costs, and therefore, was not in a position to determine whether or not all transferred HIPAA funds were properly expended. In response to GAO's review, FBI engaged in extensive manual efforts to develop cost estimates related to health care fraud investigations for fiscal years 2000 through 2003. The final estimate provided to GAO showed that FBI spent more on health care fraud investigations than was funded by transfers for each of the 4 years. However, GAO found that, overall, FBI's estimates of its health care fraud investigation costs were based on data that had not been or could not be fully validated. Therefore, even though FBI made a good-faith effort to estimate these costs, because of data limitations, neither GAO nor FBI could reliably determine whether all of the HIPAA transfers were spent solely for health care fraud investigations and related activities for the 4-year period. DOJ is currently planning the implementation of a new DOJ-wide UFMS, but it has yet to develop the specific systems requirements that would enable FBI to accurately capture all of its health care fraud-related costs and therefore to help monitor compliance with HIPAA and other relevant laws and regulations.