These types of  collections represent amounts recovered by HHS and DOJ as a result of  health care enforcement activities. Agencies Took Action to Address Three of Four GAO Recommendations

In our April 2005 report, we identified weaknesses related to not properly  capturing certain expenditure data in agency information systems, non- adherence to accounting policy for select HCFAC expenditures, and  lengthy HCFAC report review processes. Both agencies disagreed with our  recommendation to notify Congress on delays in issuing the HCFAC report  by the mandated deadline and thus, did not take action. Record staff hours in workload tracking systems. Develop a more expedited review process. Using these new time  frames, HHS and DOJ jointly issued the fiscal year 2010 HCFAC report on  January 24, 2011, only 23 days later than the mandated reporting date. According to DOJ officials responsible for preparing the HCFAC report,  they intend to use these time frames to meet the mandated deadline when  preparing future year reports. HHS and DOJ did not concur with this  recommendation. We also  found errors in reported HCFAC amounts. Documentation Controls Insufficient to Fully Support HCFAC Deposits and Expenditures

While HHS and DOJ designed controls that were incorporated into its  policies and procedures generally requiring the retention of  documentation for 6 years, the policies and procedures for CMS,  Administration on Aging, and DOJ did not provide sufficient details with  respect to where these documents were to be filed, who should be  responsible for maintaining them, or a combination of both, which would  help ensure accountability and adequate support of HCFAC deposits and  expenditures. During our review, we found instances at HHS and DOJ where  documentation was not available to support expenditures. Also, we found that although  DOJ issued the Report Completion Guide in June 2010 that specified time  frames for both HHS and DOJ for submitting information to complete the  annual HCFAC report, the guide did not require that monitoring control  activities, such as comparisons and supervisory reviews, be performed to  help ensure that reported amounts were accurately presented. For  example, for fiscal year 2009 we found that $716.8 million of the $1.0  billion reported in the restitution and compensatory damages line item  was not transferred to the HI trust fund as stated in the report. Recoveries for Medicare  Part B and Medicaid are not transferred to the HI trust fund, but instead  are to be transferred to the Federal Supplementary Medical Insurance  (SMI) Trust Fund and the Medicaid appropriation account within CMS,  respectively. These  inaccuracies overstated the amount of funds transferred to the HI trust  fund. Conclusions

Although HHS and DOJ have taken action to address our previous  recommendations aimed at improving procedures for recording HCFAC  expenditures and issuing the annual HCFAC report, we found that controls  are not sufficient to ensure that the report is accurate and supported. We recommend that the Secretary of HHS,    direct the Administrator of CMS to:  revise procedures for properly maintaining supporting  documentation for HCFAC deposits and expenditures, to include  specifying the titles of staff responsible for maintaining supporting  documentation;   develop written procedures that incorporate monitoring controls  for HCFAC deposit information recorded in the departmentwide  accounting system, including reconciling the deposit data in this  system to the regional offices’ data collection system;    direct the Assistant Secretary for Aging to:  revise the Administration on Aging’s procedures for properly  maintaining supporting documentation for HCFAC expenditures,  to include specifying the titles of staff responsible for maintaining  supporting documentation and the location of records;   develop written procedures that incorporate monitoring controls  to verify that the payroll expenditures charged against HCFAC are  reasonable and supported; and   direct the Acting General Counsel to develop written procedures that  incorporate monitoring controls for the Office of the General Counsel  staff hours related to HCFAC activities captured in workload tracking  systems, including the reconciliation to staff hours captured in the  departmentwide payroll system; and   develop written procedures in collaboration with DOJ that incorporate  monitoring controls for preparing the joint annual HCFAC report to  help ensure reported amounts are accurate. Of the seven recommendations we made, in its written comments, HHS  generally agreed with five, disagreed with one, and did not address the  remaining recommendation. Appendix I: Objectives, Scope, and Methodology

The objectives of this review were to determine to what extent the  Department of Health and Human Services (HHS) and the Department of  Justice (DOJ) (1) took action to address the recommendations we made in  2005 and (2) designed effective controls over reporting Health Care Fraud  and Abuse Control (HCFAC) program deposits and expenditures for fiscal  years 2008 and 2009. Assessed the reliability of data used to select our nongeneralizable  tracing deposit control totals of the electronic databases to the  corresponding deposit line item totals reported in the HCFAC  reports and the Bureau of the Public Debt’s Federal Hospital  Insurance Trust Fund (HI trust fund) statements;   obtaining the funding decision memorandum detailing how the  HCFAC funds would be distributed between HHS and DOJ for  fiscal years 2008 and 2009 to verify the HCFAC funds certified by  HHS and DOJ officials; comparing amounts reported in the joint HCFAC reports to the  approved funding decision memorandum and comparing amounts  from the decision memorandum to the Office of Management and  Budget (OMB) documentation (Apportionment Schedule SF-132)  to verify that the amounts were made available; tracing total expenditure amounts to supporting documentation,  including electronic databases, billing packages, and intra- and  interagency agreements; and reviewing existing information about the electronic data and the  systems that produced them. GAO Recommendation No. GAO Recommendation No.
Why GAO Did This Study

To help combat fraud and abuse in health care programs, including Medicare and Medicaid, Congress enacted the Health Care Fraud and Abuse Control (HCFAC) program as part of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). HIPAA requires that the Departments of Health and Human Services (HHS) and Justice (DOJ) issue a joint annual report to Congress on amounts deposited to and appropriated from the Federal Hospital Insurance (HI) Trust Fund for the HCFAC program. In April 2005, GAO reported on the results of its review of HCFAC program activities for fiscal years 2002 and 2003 and made recommendations to HHS and DOJ. The objectives of this requested review were to assess the extent to which HHS and DOJ (1) took actions to address the recommendations made in the 2005 report and (2) designed effective controls over reporting HCFAC deposits and expenditures for fiscal years 2008 and 2009. GAO reviewed HHS and DOJ documentation; selected nongeneralizable samples; and interviewed agency officials.

What GAO Found

Although HHS and DOJ have taken action to address our previous recommendations aimed at improving procedures for recording HCFAC expenditures and issuing the annual HCFAC report, GAO found that controls are not sufficient to ensure that the report is accurate and supported. HHS and DOJ took action to address three of the four recommendations in GAO's 2005 report related to recording staff hours in agency workload tracking systems, using the appropriate account class to record HCFAC expenditure data, and expediting the review process for issuing the annual HCFAC report. Neither agency agreed with the remaining recommendation to notify Congress on delays in issuing the HCFAC report within 1 month after missing the mandated January 1 deadline and thus, did not take action. However, in June 2010, HHS and DOJ implemented an expedited review process for completing the HCFAC report. The fiscal year 2010 HCFAC report was issued on January 24, 2011, 23 days later than the mandated reporting date. According to DOJ officials responsible for preparing the HCFAC report, they intend to use this new expedited review process to meet the mandated deadline when preparing future year reports. Regarding the design of controls, while HHS and DOJ had designed polices and procedures for documentation that generally required the retention of documentation for 6 years, these did not provide sufficient controls to ensure adequate support of HCFAC deposits and expenditures, in accordance with internal control standards. (1) Components at both HHS and DOJ that manage HCFAC activities did not include in their respective policies and procedures controls that specified the person responsible for maintaining the records, the location of records, or a combination of both. (2) GAO found instances at HHS and DOJ where documentation could not be provided to support HCFAC expenditures, such as time and attendance reports. Also, both agencies did not have sufficient monitoring controls such as reconciliations, comparisons, and supervisory reviews, as outlined in internal control standards, to ensure accurate reporting of HCFAC deposits and expenditures. As a result, GAO found instances where data recorded in accounting and payroll systems were inconsistent with other sources such as the HI trust fund statements and agency workload tracking systems. GAO also identified presentation errors in the 2008 and 2009 annual HCFAC reports. For example, in reviewing the line item for restitution and compensatory damages, GAO found that $717 million (70 percent) of the $1.03 billion reported in the fiscal year 2009 HCFAC report was not transferred to the HI trust fund as stated in the report. These amounts, primarily related to Medicare Part B and Medicaid, were transferred to the Federal Supplementary Medical Insurance Trust Fund and the Medicaid appropriation account as required. These inaccuracies overstated the amount of funds transferred to the HI trust fund.

What GAO Recommends

GAO makes 11 recommendations to HHS and DOJ to revise or develop written procedures that include documentation and monitoring controls for HCFAC activities and reporting. DOJ agreed with all four of its recommendations. Of the seven recommendations to HHS, it generally agreed with five, disagreed with one, and did not address the remaining recommendation.