oversight

Audit of the Government Employees Health Association, Inc.

Published by the Office of Personnel Management, Office of Inspector General on 2018-05-10.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

 U.S. OFFICE OF PERSONNEL MANAGEMENT
    OFFICE OF THE INSPECTOR GENERAL
             OFFICE OF AUDITS




    Final Audit Report

                  AUDIT OF
GOVERNMENT EMPLOYEES HEALTH ASSOCIATION, INC.
           LEE’S SUMMIT, MISSOURI

           Report Number 1B-31-00-17-041
                   May 10, 2018
               EXECUTIVE SUMMARY
                        Audit of the Government Employees Health Association, Inc.

Report No. 1B-31-00-17-041                                                                           May 10, 2018



 Why did we conduct the audit?             What did we find?

 We conducted this limited scope audit     We questioned $3,660,811 in cash management activities. We also
 to obtain reasonable assurance that the   identified a procedural finding regarding GEHA’s Fraud and Abuse
 Government Employees Health               Program.
 Association, Inc. (GEHA), as sponsor
 and administrator of the GEHA Benefit     Our audit results are summarized as follows:
 Plan, is complying with the provisions
                                           x   Miscellaneous Health Benefit Credits – The audit disclosed no
 of the Federal Employees Health
 Benefits Act and regulations that are         findings pertaining to miscellaneous health benefit credits.
 included, by reference, in the Federal        Overall, we concluded that GEHA timely returned health benefit
 Employees Health Benefits Program             refunds and recoveries, including pharmacy drug rebates, to the
 (FEHBP) contract. Our objectives              FEHBP.
 were to determine if GEHA charged
                                           x   Cash Management – We determined that GEHA held an excess
 costs to the FEHBP and provided
                                               working capital deposit of $3,660,811 in the dedicated FEHBP
 services to FEHBP members in
                                               investment account as of June 30, 2017.
 accordance with the contract.

 What did we audit?                        x   Fraud and Abuse Program – We determined that GEHA is not in
                                               compliance with the communication and reporting requirements
 Our audit covered miscellaneous health        for fraud and abuse cases that are set forth in FEHBP Carrier
 benefit credits, such as refunds and          Letter 2014-29. We also identified several non-compliance issues
 pharmacy drug rebates, from 2012              regarding GEHA’s Fraud and Abuse Program policies and
 through March 2017 for the GEHA               procedures and GEHA’s 2015 and 2016 Annual Fraud, Waste,
 Benefit Plan. We also reviewed                and Abuse Reports.
 GEHA’s cash management activities
 and practices related to FEHBP funds
 from 2012 through March 2017 for the
 GEHA Benefit Plan, and GEHA’s
 Fraud and Abuse Program from 2015
 through March 2017. Due to concerns
 with GEHA’s working capital funds,
 we expanded our scope to also include
 these funds from April 2017 through
 June 2017.


  _______________________
  Michael R. Esser
  Assistant Inspector General
  for Audits                                           i
                   ABBREVIATIONS


CFR          Code of Federal Regulations
CL           Carrier Letter
FAR          Federal Acquisition Regulations
FEHB         Federal Employees Health Benefits
FEHBAR       Federal Employees Health Benefits Acquisition Regulations
GEHA         Government Employees Health Association, Inc.
Guidelines   Letter of Credit System Guidelines
OIG          Office of the Inspector General
OPM          U.S. Office of Personnel Management
PBM          Pharmacy Benefit Manager
SIU          Special Investigations Unit




                                   ii
                        TABLE OF CONTENTS

                                                                                                                      Page

       EXECUTIVE SUMMARY ......................................................................................... i

       ABBREVIATIONS ..................................................................................................... ii 


I.     BACKGROUND ..........................................................................................................1 


II.    OBJECTIVES, SCOPE, AND METHODOLOGY ..................................................3

III.   AUDIT FINDINGS AND RECOMMENDATIONS.................................................7

       A. MISCELLANEOUS HEALTH BENEFIT CREDITS ............................................7

       B. CASH MANAGEMENT .........................................................................................7

            1. Excess Working Capital Deposit .......................................................................7

       C. FRAUD AND ABUSE PROGRAM .....................................................................10

            1. Special Investigations Unit ...............................................................................10

       APPENDIX: Government Employees Health Association, Inc. Draft Report Response,
       dated February 6, 2018

       REPORT FRAUD, WASTE, AND MISMANAGEMENT
                              I. BACKGROUND

This final audit report details the findings, conclusions, and recommendations resulting from our
limited scope audit of the Federal Employees Health Benefits Program (FEHBP) operations at
the Government Employees Health Association, Inc. (GEHA), as sponsor and administrator of the
GEHA Benefit Plan. GEHA is located in Lee’s Summit, Missouri.

The audit was performed by the U.S. Office of Personnel Management’s (OPM) Office of the
Inspector General (OIG), as established by the Inspector General Act of 1978, as amended.

The FEHBP was established by the Federal Employees Health Benefits (FEHB) Act (Public Law
86-382), enacted on September 28, 1959. The FEHBP was created to provide health insurance
benefits for Federal employees, annuitants, and dependents. OPM’s Healthcare and Insurance
Office has overall responsibility for administration of the FEHBP. The provisions of the FEHB
Act are implemented by OPM through regulations, which are codified in Title 5, Chapter 1, Part
890 of the Code of Federal Regulations (CFR). Health insurance coverage is made available
through contracts with various health insurance carriers.

The GEHA Benefit Plan is a fee-for-service employee organization plan, offering high and
standard options, with a preferred provider organization. Enrollment is open to all Federal
employees and annuitants that are eligible to enroll in the FEHBP and who are, or become,
members of GEHA. All Federal employees and annuitants that enroll in the GEHA Benefit Plan
must be, or must become, members of GEHA. GEHA is the sponsor and administrator of the
GEHA Benefit Plan, operating under Contract CS 1063 (contract) to provide a health benefits
plan authorized by the FEHB Act.

GEHA’s contract with OPM is experience-rated. Thus, the costs of providing benefits in the
prior year, including underwritten gains and losses that have been carried forward, are reflected
in current and future years’ premium rates. In addition, the contract provides that in the event of
termination, unexpended program funds revert to the FEHBP Trust Fund. In recognition of these
provisions, the contract requires an accounting of program funds be submitted at the end of each
contract year. The accounting is made on a statement of operations known as the Annual
Accounting Statement.

Compliance with laws and regulations applicable to the FEHBP is the responsibility of GEHA’s
management. In addition, management of GEHA is responsible for establishing and maintaining
a system of internal controls.




                                                 1                   Report No. 1B-31-00-17-041
All findings from our previous audit of GEHA (Report No. 1B-31-00-10-038, dated March 12,
2012), covering contract years 2006 through 2010, have been satisfactorily resolved.

The results of this audit were provided to GEHA in written audit inquiries; were discussed with
GEHA officials throughout the audit and at an exit conference on November 15, 2017; and were
presented in detail in a draft report, dated December 21, 2017. GEHA’s comments offered in
response to the draft report were considered in preparing our final report and are included as an
Appendix to this report.




                                                 2                  Report No. 1B-31-00-17-041
II. OBJECTIVES, SCOPE, AND METHODOLOGY
OBJECTIVES

The objectives of our audit were to determine whether GEHA charged costs to the FEHBP and
provided services to FEHBP members in accordance with the terms of the contract. Specifically,
our objectives were as follows:

       Miscellaneous Health Benefit Credits

       x	 To determine whether health benefit refunds and recoveries, including pharmacy drug
          rebates, were returned timely to the FEHBP.

       Cash Management

       x	 To determine whether GEHA handled FEHBP funds in accordance with the contract
          and applicable laws and regulations concerning cash management in the FEHBP.

       Fraud and Abuse Program

       x	 To determine whether GEHA’s communication and reporting of fraud and abuse
          cases complied with the terms of Contract CS 1063 and Carrier Letter 2014-29.

SCOPE

We conducted our limited scope performance audit in accordance with generally accepted
government auditing standards. Those standards require that we plan and perform the audit to
obtain sufficient and appropriate evidence to provide a reasonable basis for our findings and
conclusions based on our audit objectives. We believe that the evidence obtained provides a
reasonable basis for our findings and conclusions based on our audit objectives.

We reviewed GEHA’s Annual Accounting Statements for contract years 2012 through 2016
pertaining to the GEHA Benefit Plan. During this period, GEHA processed approximately $14.1
billion in FEHBP health benefit payments and charged the FEHBP                     in
administrative expenses for the GEHA Benefit Plan. Specifically, we reviewed miscellaneous
health benefit credits, such as refunds, fraud recoveries and pharmacy drug rebates, from 2012
through March 2017 for the GEHA Benefit Plan. We also reviewed GEHA’s cash management
activities and practices related to FEHBP funds from 2012 through March 2017 for the GEHA
Benefit Plan, as well as GEHA’s Fraud and Abuse Program from 2015 through March 2017.


                                                3	                 Report No. 1B-31-00-17-041
Due to concerns with GEHA’s working capital funds, we expanded our scope to also include
these funds from April 2017 through June 2017.

In planning and conducting our audit, we obtained an understanding of GEHA’s internal control
structure to help determine the nature, timing, and extent of our auditing procedures. This was
determined to be the most effective approach to select areas of audit. For those areas selected,
we primarily relied on substantive tests of transactions and not tests of controls. Based on our
testing, we did not identify any significant matters involving GEHA’s internal control structure
and its operations. However, since our audit would not necessarily disclose all significant
matters in the internal control structure, we do not express an opinion on GEHA’s system of
internal controls taken as a whole.

We also conducted tests to determine whether GEHA had complied with the contract provisions,
the applicable procurement regulations (i.e., Federal Acquisition Regulations (FAR) and Federal
Employees Health Benefits Acquisition Regulations (FEHBAR), as appropriate), and the laws
and regulations governing the FEHBP. The results of our tests indicate that, with respect to the
items tested, GEHA did not fully comply with all provisions of the contract and Federal
procurement regulations. Exceptions noted in the areas reviewed are set forth in detail in the
"Audit Findings and Recommendations" section of this audit report. With respect to the items
not tested, nothing came to our attention that caused us to believe that the Plan had not complied,
in all material respects, with those provisions.

In conducting our audit, we relied to varying degrees on computer-generated data provided by
GEHA. Due to time constraints, we did not verify the reliability of the data generated by the
various information systems involved. However, while utilizing the computer-generated data
during our audit, nothing came to our attention to cause us to doubt its reliability. We believe
that the data was sufficient to achieve our audit objectives.

The audit was performed at GEHA’s office in Lee’s Summit, Missouri on various dates from
August 15, 2017, through September 28, 2017. Audit fieldwork was also performed at our
offices in Jacksonville, Florida; Cranberry Township, Pennsylvania; and Washington, D.C.
through November 15, 2017. Throughout the audit process, GEHA did an excellent job
providing complete and timely responses to our numerous requests for supporting
documentation. We greatly appreciated GEHA’s exceptional cooperation and responsiveness
during the pre-audit and fieldwork phases of this audit.




                                                 4                   Report No. 1B-31-00-17-041
METHODOLOGY

We obtained an understanding of the internal controls over GEHA’s financial and cash
management systems by inquiry of GEHA officials.

We interviewed GEHA personnel and reviewed GEHA’s policies, procedures, and accounting
records during our audit of miscellaneous health benefit credits. For the period 2012 through
March 31, 2017, we also judgmentally selected and reviewed the following FEHBP items for the
GEHA Benefit Plan:

   Health Benefit Refunds

   x	 A high dollar sample of 60 health benefit refund cash receipts, totaling $12,617,196
      (from a universe of          refund cash receipt amounts, totaling               , for the
      audit scope). Our high dollar sample included the 10 highest refund cash receipt amounts
      from each year in the audit scope.

   x	 A high dollar sample of 5 health benefit refunds returned via provider offsets, totaling
      $47,480 (from a universe of          refunds returned via provider offsets, totaling
                 , for the audit scope). For this sample, we selected all provider offsets of
      $5,000 or more from 2017 only.

   x	 A high dollar sample of 8 aging health benefit refunds, totaling $231,653 (from a
      universe of     aging refunds, totaling          , as of March 31, 2017). For this
      sample, we selected seven aging refund amounts of $10,000 or more, totaling $228,266,
      from 2017 and the highest aging refund amount, totaling $3,387, from 2016.

   Other Miscellaneous Health Benefit Recoveries

   x	 All    pharmacy drug rebate amounts, totaling                 , for the audit scope.

   x	 A high dollar sample of 25 fraud recoveries, totaling $23,680,874 (from a universe of
      fraud recoveries, totaling            , for the audit scope). For this sample, we selected
      all fraud recoveries of $100,000 or more from 2012 through 2014 and $50,000 or more
      from 2015 and 2016.

   x	 44 unidentified cash receipts, totaling $92,302 (from a universe of         unidentified
      receipts, totaling            , for the audit scope). For this sample, we judgmentally
      selected all of these cash receipts from 2017 where the members could not be identified.


                                                5	                  Report No. 1B-31-00-17-041
We reviewed these samples to determine if health benefit refunds and recoveries, including
pharmacy drug rebates, were timely returned to the FEHBP. The results of these samples were
not projected to the applicable universes since there were no exceptions identified.

We reviewed GEHA’s cash management activities and practices to determine whether GEHA
handled FEHBP funds in accordance with Contract CS 1063 and applicable laws and regulations.
Specifically, we reviewed a sample of 54 letter of credit account drawdown amounts, totaling
$816,546,144 (from a universe of           letter of credit account drawdowns, totaling
                  , for the GEHA Benefit Plan during the period 2012 through March 31, 2017),
for the purpose of determining if GEHA’s letter of credit account drawdowns were appropriate
and adequately supported. Our sample included a week of letter of credit account drawdowns
(representing 4 or 5 letter of credit account drawdown amounts) judgmentally selected from each
of the 11 semi-annual periods in the audit scope. The sample results were not projected to the
universe of letter of credit account drawdowns since there were no exceptions identified. We
also reviewed GEHA’s working capital calculations, adjustments and/or balances from 2012
through June 30, 2017; United States Treasury offsets and interest income transactions from
2012 through March 31, 2017; and GEHA’s dedicated FEHBP investment account activity
during the scope and the balance as of March 31, 2017, for the GEHA Benefit Plan.

We also interviewed GEHA’s Special Investigations Unit regarding the effectiveness of the
Fraud and Abuse Program, as well as reviewed GEHA’s communication and reporting of fraud
and abuse cases to test compliance with Contract CS 1063 and FEHBP Carrier Letter 2014-29.




                                               6                  Report No. 1B-31-00-17-041
III. AUDIT FINDINGS AND RECOMMENDATIONS

 A. MISCELLANEOUS HEALTH BENEFIT CREDITS

   The audit disclosed no findings pertaining to miscellaneous health benefit credits. Overall, we
   concluded that GEHA timely returned health benefit refunds and recoveries, including pharmacy
   drug rebates, to the FEHBP.

 B. CASH MANAGEMENT

   1. Excess Working Capital Deposit                                                   $3,660,811

      As of June 30, 2017, GEHA held a working capital deposit of $3,660,811 over the
      amount needed to meet GEHA’s daily cash needs for FEHBP claim payments.

      OPM’s “Letter of Credit System Guidelines” (Guidelines), dated May 2009, states:
      “Carriers should maintain a working capital balance equivalent to an average of 2 days of
      paid claims. The working capital fund should be established using federal funds.
      Carriers are required to monitor their working capital funds on a monthly basis and adjust
      if necessary on a quarterly basis. The interest earned on the working capital funds must
      be credited to the FEHBP at least on a monthly basis. The working capital is not required
      but strongly recommended.” Based on the Guidelines, the Carrier’s working capital
      calculation must also exclude electronic fund transfers.

      In addition, based on the regulations governing the financing of Federal programs by the
      letter of credit method, as established in 31 CFR 205 (Treasury Department Circular No.
      10750), electronic fund transfers should not be included in the working capital
      calculation. These instructions are established under the provisions of Treasury
      Department Circular No. 1083 (Regulations Governing the Utilization of the U.S. TFCS),
      5 CFR Part 890, and 48 CFR Chapter 16.

      Based on industry practice (e.g., other FEHBP experience-rated Carriers), the working
      capital deposit should be recalculated on a regular basis to determine if the amount
      currently maintained is adequate to meet the Carrier’s daily cash needs for FEHBP claim
      payments. If the working capital deposit amount is over or under funded, then GEHA
      should make an appropriate adjustment.




                                                   7              Report No. 1B-31-00-17-041
        GEHA reviewed the working capital deposit on a regular basis (usually monthly) during
        the period January 2012 through June 2017.1 We noted that GEHA increased the
        working capital deposit in November 2016. When reviewing the working capital
        calculation, we determined that GEHA inappropriately included electronic fund transfers
        in the calculation. As of June 30, 2017, GEHA held a working capital deposit amount of
                      in the dedicated FEHBP investment account.

                                         To determine if GEHA maintained an appropriate
           GEHA held an excess
                                         working capital deposit amount, we recalculated
          working capital deposit of
                                         GEHA’s working capital deposit (excluding electronic
         $3,660,811 in the dedicated
         FEHBP investment account        fund transfers) and determined that, as of June 30, 2017,
             as of June 30, 2017.        GEHA should have only maintained a working capital
                                         deposit of              . Therefore, we determined that,
        as of June 30, 2017, GEHA held a working capital deposit with an excess amount of
        $3,660,811 (             minus                ) over the amount actually needed to meet
        GEHA’s daily cash needs for FEHBP claim payments. Since GEHA maintained these
        excess working capital funds in the dedicated FEHBP investment account, lost
        investment income is not applicable for this finding.

        GEHA Response:

        “GEHA concurs with the finding from the standpoint that electronic funds transfers
        (EFTs) were included in our working capital calculation inaccurately; both the
        regulations and OPM’s Letter of Credit System Guidelines state that EFTs should be
        excluded from such working capital calculations. GEHA utilizes EFT payments as one
        of our health benefit payment options to providers. . . . In 2017, % of the health
        benefit dollars paid by GEHA were paid via EFT.

        When comparing our bank balance adjusted for the $3,660,811 of excess working
        capital as calculated by OIG to the working capital calculation excluding EFTs of
                      for the period January 1, 2017 through September 30, 2017, GEHA
        calculates 89 occurrences (32%) where return of this excess working capital
        calculation would result in the bank control account balance being less than the
        working capital balance. There are eleven occurrences where GEHA’s control balance
        would be more than              less than the working capital calculation. On one
        occasion, the bank balance would fall below            .



1
  Although the audit scope for GEHA’s cash management activities and practices initially only included 2012
through March 2017, we expanded the scope of our review for the working capital deposit to also include the
months of April 2017 through June 2017.

                                                               8               Report No. 1B-31-00-17-041
By excluding the EFTs [electronic fund transfers], GEHA is exposed to additional risk
of having insufficient funds for the FEHBP . . . As such, GEHA sent a waiver request
to our contracting officer . . . on October 20, 2017.”

OIG Comment:

We understand GEHA’s concern for excluding electronic fund transfers from the
working capital calculation as well as GEHA’s reason for requesting a waiver from the
contracting officer. However, based on our analysis of the FEHBP investment account, a
working capital balance of               (excluding electronic fund transfers in the
calculation) would have provided sufficient funds for GEHA to pay FEHBP claims,
without incurring overdrafts or a negative account balance. We suggest that the
contracting officer consider our analysis when reviewing and/or before approving
GEHA’s waiver request.

Recommendation 1

We recommend that the contracting officer require GEHA to return $3,660,811 to the
FEHBP for the excess working capital deposit.

Recommendation 2

We recommend that GEHA implement corrective actions to ensure that the working
capital deposit is properly calculated in accordance with the Guidelines and applicable
regulations. GEHA should recalculate the working capital deposit on a monthly basis
and adjust at least on a quarterly basis (if necessary). If an exception for the working
capital calculation is necessary, then GEHA should request prior approval (a waiver)
from the contracting officer.

Recommendation 3

Since the use of electronic fund transfers by the experience-rated Carriers to pay FEHBP
claim payments have substantially increased in the past several years, we recommend that
the contracting officer(s) and/or OPM’s Benefits Insurance Accounting Office review and
revise (if necessary) the Guidelines, including the formula for the working capital
calculation, and propose regulation changes if applicable.




                                            9              Report No. 1B-31-00-17-041
C. FRAUD AND ABUSE PROGRAM

  1. Special Investigations Unit                                                  Procedural

                                 GEHA is not in compliance with the communication and
      GEHA did not report
                                 reporting requirements for fraud and abuse cases that are set
       all fraud and abuse
        cases to the OIG.        forth in the FEHBP Carrier Letter (CL) 2014-29. Specifically,
                                 GEHA did not report all fraud and abuse cases to the OIG.
     Without awareness of these existing potential fraud and abuse issues, the OIG cannot
     investigate the broader impact of these potential issues on the FEHBP as a whole. We
     also identified several non-compliance issues regarding GEHA’s Fraud and Abuse
     Program policies and procedures and GEHA’s 2015 and 2016 Annual Fraud, Waste, and
     Abuse Reports.

     Contract CS 1063, Part III, Section 1.9 (a) states, “The Carrier must submit to OPM an
     annual analysis of the costs and benefits of its [Fraud and Abuse] program. The Carrier
     must submit annual reports to OPM by March 31 addressing the following: . . . 10)
     Estimated Financial Losses; 11) Non-Recoverable Loss; . . . 12) Dollars Recovered by
     SIU and/or Vendor Activities; . . . 16) Prevented Loss . . . .”

     CL 2014-29 (Office of Personnel Management Federal Employees Health Benefits
     Fraud, Waste and Abuse), dated December 19, 2014, states that all Carriers “are required
     to submit a written notification to the OPM-OIG within 30 working days when there is
     potential reportable [Fraud and Abuse] that has occurred against the FEHB Program.
     OPM-OIG considers a potential reportable [Fraud and Abuse] as, after preliminary
     review of the complaint, the carrier takes an affirmative step to investigate the
     complaint.” There is no dollar threshold for this requirement.

     Part II (Fraud and Abuse - Carrier Actions) of CL 2014-29 states, “FEHBP Carriers must,
     at a minimum, perform the following activities to prevent, detect, investigate, and report
     FEHBP [Fraud and Abuse]: . . . Develop programs to prevent, detect, and identify
     persons and organizations involved in suspicious claim activity . . . Provide claims data
     upon request from OPM-OIG . . . and track all data requests separately. . . . Provide
     liaison and investigative support to OPM-OIG . . . upon request. . . . Track all provider,
     member, and pharmacy case notifications sent to OPM-OIG and all other law
     enforcement agencies, and provide an annual report of such activity to OPM . . . Provide
     annual fraud, waste, and or abuse reports (medical and pharmacy), due March 31st, to
     Health Insurance, Federal Employees Insurance Operations, [OPM] . . . .”



                                                10             Report No. 1B-31-00-17-041
Part III (Industry Standards) of CL 2014-29 states, “All FEHB Carriers must have, at a
minimum . . . commercial industry-based program standards to prevent, detect,
investigate, and report all FEHB related [Fraud and Abuse].” For example, each Carrier
must have a Fraud and Abuse prevention, detection, investigation, and reporting manual.
This Fraud and Abuse manual must include all of the Carrier’s plans, policies, and
procedures involved in the Carrier’s Fraud and Abuse Program.

For the period 2015 through March 31, 2017, GEHA opened          fraud and abuse cases
with potential FEHBP exposure. From this universe, we selected and reviewed a
judgmental sample of 31 cases for determining if GEHA timely reported these cases to
the OIG. Based on our review of these 31 cases, we determined that 22 cases were not
reported to the OIG and 5 cases were timely reported to the OIG. The remaining four
cases in our sample did not require OIG notification.


           Sample Results - Cases Opened with Potential FEHBP
                   Exposure (as Identified by GEHA)

                          22

                                                       Not Reported

                                                       Reported Timely
                   4            5
                                                       Notification Not Required




Ultimately, GEHA’s incomplete reporting of potential FEHBP cases to the OIG has
resulted in a failure to meet the communication and reporting requirements that are set
forth in CL 2014-29. The lack of notification by GEHA did not allow the OIG to
investigate whether other FEHBP Carriers are exposed to the identified fraudulent
activity. As a result, this lack of OIG notification by GEHA may result in additional
improper payments being made by other FEHBP Carriers. This also does not allow the
OIG’s Administrative Sanctions Group to be notified timely.




                                          11              Report No. 1B-31-00-17-041
The following are additional non-compliance issues that were identified during
discussions with GEHA’s Special Investigations Unit (SIU) and/or while reviewing
GEHA’s Fraud and Abuse Program policies and procedures as well as GEHA’s 2015 and
2016 Annual FWA Reports:

x




x	 For 2015 and 2016, GEHA also reported that the PBM had a fraud, waste, and abuse
   manual, a formal employee-training program on fraud, waste, and abuse, a fraud
   hotline, fraud detection software, and private information security and patient safety
   security programs. However, GEHA’s Fraud, Waste, and Abuse Process and
   Procedure Manual does not address or have this required information, which is being
   reported in the Annual Fraud, Waste, and Abuse Reports. During the audit, GEHA’s
   SIU could not provide this information related to these required data elements.

x	 In 2016, all FEHBP Carriers were required to comply with Carrier Letter 2014-29.
   We noted that GEHA’s 2016 Annual Fraud, Waste, and Abuse Report did not track or
   report the estimated financial losses, non-recoverable losses, recoveries, and
   prevented losses for the medical benefits. GEHA was also non-compliant with
   requirements for tracking and reporting the identified losses, estimated financial
   losses, and non-recoverable losses for the pharmacy Fraud, Waste, and Abuse
   Program. Additionally, the reported pharmacy data amounts for recoveries and actual
   savings were not verified by GEHA.

x	 In 2016,               that        FWA cases were detected, but no pharmacy related
   cases were actually reported to the OIG. Again, GEHA did not track and could not
   support these pharmacy related data elements that were reported to OPM in the 2016
   Annual Fraud, Waste, and Abuse Report. In response to this finding, GEHA’s SIU
   stated,
                                                . Process improvements are in place to
   have
         based on the new definitions and timelines outlined in the latest carrier letter.”




                                            12              Report No. 1B-31-00-17-041
x   GEHA’s Fraud and Abuse Process and Procedure Manual does not have PBM
    oversight and investigative procedures, systematic information for tracking potential
    fraud and abuse allegations that are received from the PBM, and procedures related to
    other vendors (such as behavioral health and network provider vendors).

GEHA Response:

“We are implementing the recommendations, but we wish to clarify the record
regarding the outlined findings.

Attached is a summary detailing the cases that were selected for review in the audit
(Attachment 1). After further review, we found providers who were already OIG cases
under different provider names, some that were not appropriate for notifications, and
some that were submitted as notifications. Since the audit time period, additional
guidance has been provided in Carrier Letter 2017-13 and we are updating processes to
be consistent with this guidance.

During the years audited, we feel we have received conflicting feedback regarding
submitting notifications; at times we were told to send all possible cases, other times we
were told to only send thoroughly investigated cases, other times to send at different
levels of investigation, and at one time, to send a lead within 30 days of knowledge.
The latest carrier letter clearly outlines definitions and timelines. As noted above, we
are updating our processes to be consistent with the latest carrier letter guidance. As
noted above, several of the providers included in the audit were already OIG cases and
in some instances, notifications had previously been sent with no response from, or
declined by, OIG. We do not feel these cases, known to OIG, are examples of a failure
to meet the communication and reporting requirements. On these cases in particular,
the GEHA SIU consistently communicated with the OIG on data exposure requests,
provided additional information needed on ongoing cases, and had numerous other
communications with OIG. In 2016, GEHA responded to 174 requests from OIG for
data and case information related to the OIG data requests. We do believe the latest
guidance has provided us with information that will lead to more notifications.

We have attached additional information and clarification specific to the additional
concerns that were identified by OIG during discussions with GEHA and/or while
reviewing our Fraud and Abuse Program procedures and our 2015 and 2016 Annual
FWA Reports (Attachment 2).”




                                           13              Report No. 1B-31-00-17-041
        OIG Comment:

        In response to the draft report, GEHA provided “Attachment 1” that included additional
        documentation and explanations as to why 22 cases in the sample were not reported to
        the OIG. Our review of the additional documentation and the accompanying
        explanations did not change the results of our review for these 22 cases.

        After reviewing GEHA’s additional information provided in “Attachment 2” (regarding
        the non-compliance issues that were identified during our discussions with GEHA
        officials and/or while reviewing GEHA’s Fraud and Abuse Program procedures and
        GEHA’s 2015 and 2016 Annual Fraud, Waste, and Abuse Reports), we revised these
        non-compliance issues accordingly (see page 12), based on this additional information.

        Recommendation 4

        We recommend that the contracting officer require GEHA to provide evidence or
        supporting documentation ensuring that GEHA has implemented the necessary process
        and procedural changes to meet the communication and reporting requirements of fraud
        and abuse cases that are contained in CL 2014-29 and CL 2017-13 (OPM Federal
        Employees Health Benefits Fraud, Waste, and Abuse).2

        GEHA Response:

        GEHA agrees with this recommendation and states that processes and procedures have
        been implemented to comply with CL 2014-29 and CL 2017-13.

        Recommendation 5

        We recommend that the contracting officer instruct GEHA to perform a comprehensive
        review (or self-assessment) of GEHA’s Fraud and Abuse Program. GEHA should
        provide the results of this comprehensive review to the contracting officer as well as the
        applicable corrective actions that were implemented (and/or will be implemented) to
        ensure compliance with the requirements of the FEHBP contract and CL 2017-13.




2
 CL 2017-13 (dated November 20, 2017) consolidates and updates the information from CL 2014-29, which is
superseded by this guidance. CL 2017-13 also supplements guidance from the FEHBP contract (Section 1.9 – Plan
Performance).

                                                         14                Report No. 1B-31-00-17-041
GEHA Response:

GEHA agrees with this recommendation. GEHA states, “The SIU is undergoing a
process improvement project by our internal Business Process Improvement
Department. The annual report to OPM will include a summary of the corrective
actions implemented.”

Recommendation 6

We recommend that the contracting officer require GEHA to revise the Fraud and Abuse
Process and Procedure Manual to include investigative processes and procedures that
address all of the health benefits applicable to the FEHB plan (including pharmacy drug
claims). GEHA should also implement the necessary procedures to ensure proper PBM
oversight.

GEHA Response:

GEHA agrees with this recommendation and states that the “SIU manual has been
updated and now addresses all Fraud and Abuse aspects of the health benefit plan,
including prescription drug benefit claims.”

Recommendation 7

We recommend that the contracting officer verify that GEHA provides a complete and
accurate 2017 Annual Fraud and Abuse Report. We also recommend that GEHA provide
the contracting officer complete documentation (or have available for on-site inspection)
to support all entry items and data elements in this annual report.

GEHA Response:

GEHA agrees with this recommendation and states that the “SIU will submit a
complete and accurate annual report and will have all supporting documentation
available for on-site inspection.”




                                          15              Report No. 1B-31-00-17-041
APPENDIX




February 6, 2018

                         , Group Chief
Experience-Rated Audits Group
Office of the Inspector General
U.S. Office of Personnel Management
1900 E Street, Room 6400
Washington, DC 20415-1100



We have completed our review of the OIG draft report for the limited scope audit of the Federal
Employees Health Benefits Program (FEHBP) operations at the Government Employees Health
Association, Inc. (GEHA) dated December 21, 2017. We have included our responses for each audit area
within the OIG report draft. In response to the Special Investigations Unit (SIU) finding we have provided
separately, supplementary information we would like you to consider.

Cash Management – Excess Working Capital Deposit

OIG Finding:

As of June 30, 2017, GEHA held a working capital (WC) deposit of $3,660,811 over the amount needed
to meet GEHA’s daily cash needs for FEHBP claim payments. As a result, GEHA should adjust the WC
deposit and return the excess WC funds of $3,660,811 to the FEHBP.

GEHA Response:

GEHA concurs with the finding from the standpoint that electronic funds transfers (EFTs) were included
in our working capital calculation inaccurately; both the regulations and OPM’s Letter of Credit System
Guidelines state that EFTs should be excluded from such working capital calculations.

GEHA utilizes EFT payments as one of our health benefit payment options to providers. This payment
method helps reduce administrative expenses by eliminating the printing and postage costs as providers
who receive EFT payments also receive claims payment details electronically via an 835 electronic
remittance advice. In 2017, 41% of the health benefit dollars paid by GEHA were paid via EFT.

When comparing our bank balance adjusted for the $3,660,811 of excess working capital as calculated by
OIG to the working capital calculation excluding EFTs of                  for the period January 1, 2017
through September 30, 2017, GEHA calculates 89 occurrences (32%) where return of this excess working
capital calculation would result in the bank control account balance being less than the working capital
balance. There are eleven occurrences where GEHA’s control balance would be more than
less than the working capital calculation. On one occasion, the bank balance would fall below         .
February 6, 2018
Page 2 of 5

By excluding the EFTs, GEHA is exposed to additional risk of having insufficient funds for the FEHBP
program. As such, GEHA sent a waiver request to our contracting officer at the Office of Personnel
Management on October 20, 2017.

Recommendation 1

We recommend that the contracting officer require GEHA to return $3,660,811 to the FEHBP for the
excess WC deposit.

GEHA Response:

As indicated in our waiver request to OPM, 41% of our payments are made via EFT. Excluding these
from the working capital calculation puts GEHA at risk for having insufficient funds available for FEHBP
benefit payments.

Recommendation 2

We recommend that GEHA implement corrective actions to ensure that the WC deposit is properly
calculated in accordance with the Guidelines and applicable regulations. GEHA should recalculate the
WC deposit on a monthly basis and adjust at least on a quarterly basis (if necessary). If an exception for
the WC calculation is necessary, then GEHA should request prior approval (a waiver) from the
contracting officer.

GEHA Response:

As noted above, we believe an exception to the WC calculation is necessary. GEHA sent a waiver request
to our contracting officer at the Office of Personnel Management on October 20, 2017.

Recommendation 3

Since the use of EFTs by the experience-rated Carriers to pay FEHBP claim payments have substantially
increased in the past several years, we recommend that the contracting officer(s) and/or OPM’s Benefits
Insurance Accounting Office review and revise (if necessary) the Guidelines, including the formula for
the WC calculation, and propose regulation changes if applicable.

GEHA Response:

We agree and support this change in the Guidelines.




                                                                          Report No. 1B-31-00-17-041
February 6, 2018
Page 3 of 5

Fraud and Abuse Program – Special Investigations Unit

OIG Finding:

GEHA is not in compliance with the communication and reporting requirements for fraud and abuse cases
that are set forth in the FEHBP Carrier Letter (CL) 2014-29. Specifically, GEHA did not report all fraud
and abuse cases to the OIG. Without awareness of these existing potential fraud and abuse issues, the
OIG cannot investigate the broader impact of these potential issues on the FEHBP as a whole. We also
identified several non-compliance issues regarding GEHA’s Fraud and Abuse (F&A) Program policies
and procedures and the Plan’s 2015 and 2016 Annual Fraud, Waste, and Abuse (FWA) Reports.

GEHA Response:

We appreciate the opportunity to respond to the concerns expressed in this report. We are implementing
the recommendations, but we wish to clarify the record regarding the outlined findings.

Attached is a summary detailing the cases that were selected for review in the audit (Attachment 1). After
further review, we found providers who were already OIG cases under different provider names, some
that were not appropriate for notifications, and some that were submitted as notifications. Since the audit
time period, additional guidance has been provided in Carrier Letter 2017-13 and we are updating
processes to be consistent with this guidance.

During the years audited, we feel we have received conflicting feedback regarding submitting
notifications; at times we were told to send all possible cases, other times we were told to only send
thoroughly investigated cases, other times to send at different levels of investigation, and at one time, to
send a lead within 30 days of knowledge. The latest carrier letter clearly outlines definitions and
timelines. As noted above, we are updating our processes to be consistent with the latest carrier letter
guidance. As noted above, several of the providers included in the audit were already OIG cases and in
some instances notifications had previously been sent with no response from, or declined by, OIG. We do
not feel these cases, known to OIG, are examples of a failure to meet the communication and reporting
requirements. On these cases in particular, the GEHA SIU consistently communicated with the OIG on
data exposure requests, provided additional information needed on ongoing cases, and had numerous
other communications with OIG. In 2016, GEHA responded to 174 requests from OIG for data and case
information related to the OIG data requests. We do believe the latest guidance has provided us with
information that will lead to more notifications.

We have attached additional information and clarification specific to the additional concerns that were
identified by OIG during discussions with GEHA and/or while reviewing our Fraud and Abuse Program
procedures and our 2015 and 2016 Annual FWA Reports (Attachment 2).




                                                                           Report No. 1B-31-00-17-041
February 6, 2018
Page 4 of 5

Recommendation 4

We recommend that the contracting officer require the Plan to provide evidence or supporting
documentation ensuring that the Plan has implemented the necessary process and procedural changes to
meet the communication and reporting requirements of fraud and abuse cases that are contained in CL
2014-29 and CL 2017-13 (OPM Federal Employees Health Benefits Fraud, Waste, and Abuse).

GEHA Response:

We concur with this recommendation. Processes and procedures have been implemented to assure
compliance with CL 2014-29 and CL 2017-13. We are prepared to provide evidence of this action to the
Contracting Officer at her request.

Recommendation 5

We recommend that the contracting officer instruct GEHA to perform a comprehensive review (self-
assessment) of the company’s Fraud and Abuse Program. GEHA should provide the results of this
comprehensive review to the contracting officer by March 31, 2018, as well as the applicable corrective
actions that were implemented (and/or will be implemented) to ensure compliance with the requirements
of the FEHBP contract and CL 2017-13.

GEHA Response:

We concur with this recommendation. The SIU is undergoing a process improvement project by our
internal Business Process Improvement department. The annual report to OPM will include a summary
of the corrective actions implemented. In addition, an outside entity will be reviewing the SIU processes
in Q1 2018.

Recommendation 6

We recommend the contracting officer require GEHA to revise the FWA Process and Procedure Manual
to include investigative processes and procedures that address all of the health benefits applicable to the
FEHB plan (including pharmacy drug claims). GEHA should also implement the necessary procedures to
ensure proper PBM oversight.

GEHA Response:

We concur with this recommendation. The SIU manual has been updated and now addresses all FWA
aspects of the health benefit plan, including prescription drug benefit claims.

Recommendation 7

We recommend that the contracting officer verify that GEHA provides a complete and accurate 2017
Annual FWA Report. We also recommend that GEHA provide the contracting officer and/or Audit
Resolution complete documentation (or have available for on-site inspection) to support all entry items
and data elements in this annual report.




                                                                          Report No. 1B-31-00-17-041
February 6, 2018
Page 5 of 5

GEHA Response:

We concur with this recommendation. GEHA’s SIU will submit a complete and accurate annual report
and will have all supporting documentation available for on-site inspection.


We appreciate the opportunity to respond to the draft report.

Sincerely,



                           David W. Koenig
SVP, Health Plan Business Operations


Attachments

cc:
                        , Program Manager and Contracting Officer, Health Insurance 2
                 , Senior Team Leader Experience-Rated Audits Group
                        , Auditor Experience-Rated Audits Group
              President & CEO, GEHA
               Chief Operating Officer, GEHA




                                                                       Report No. 1B-31-00-17-041
                                                               



               Report Fraud, Waste, and
                   Mismanagement

                          Fraud, waste, and mismanagement in
                       Government concerns everyone: Office of
                           the Inspector General staff, agency
                      employees, and the general public. We
                      actively solicit allegations of any inefficient
                            and wasteful practices, fraud, and
                       mismanagement related to OPM programs
                      and operations. You can report allegations
                                  to us in several ways:


     By Internet: 	        http://www.opm.gov/our-inspector-general/hotline-to-
                           report-fraud-waste-or-abuse


       By Phone: 	         Toll Free Number:                  (877) 499-7295
                           Washington Metro Area:             (202) 606-2423


        By Mail:           Office of the Inspector General
                           U.S. Office of Personnel Management
                           1900 E Street, NW
                           Room 6400
                           Washington, DC 20415-1100