Office of Personnel Management, Office of Inspector General | U.S. Office of Personnel Management | Audit of BlueCross and BlueShield's Retail Pharmacy Member Eligibility in 2006, 2007, and 2011

Audit of BlueCross and BlueShield's Retail Pharmacy Member Eligibility in 2006, 2007, and 2011

Published by the Office of Personnel Management, Office of Inspector General on 2013-11-08.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

U.S. OFFICE OF PERSONNEL MANAGEMENT
OFFICE OF THE INSPECTOR GENERAL
OFFICE OF AUDITS

Final Audit Report
Subject:

AUDIT OF BLUECROSS AND BLUESHIELD’S
RETAIL PHARMACY MEMBER ELIGIBILITY
IN 2006, 2007, AND 2011

Report No. 1H-01-00-12-072

Date: November 8, 2013

--CAUTION--
This audit report has been distributed to Federal officials who are responsible for the administration of the audited program. This audit
report may contain proprietary data which is protected by Federal law (18 U.S.C. 1905). Therefore, while this audit report is available
under the Freedom of Information Act and made available to the public on the OIG webpage, caution needs to be exercised before
releasing the report to the general public as it may contain proprietary information that was redacted from the publicly distributed copy.
AUDIT REPORT

AUDIT OF BLUE CROSS AND BLUESHIELD’S
RETAIL PHARMACY MEMBER ELIGIBILITY
IN 2006, 2007, AND 2011

CONTRACT CS 1039
PLAN CODES 10 AND 11

Report No. 1H-01-00-12-072 November 8, 2013
Date: ________________

____________________________
Michael R. Esser
Assistant Inspector General
for Audits

AUDIT OF BLUE CROSS AND BLUESHIELD’S
RETAIL PHARMACY MEMBER ELIGIBILITY
IN 2006, 2007, AND 2011

CONTRACT CS 1039
PLAN CODES 10 AND 11

Report No. 1H-01-00-12-072 November 8, 2013
Date: ________________

The enclosed audit report details the results of our member eligibility-focused audit of the
BlueCross and BlueShield’s (Plan) retail pharmacy claims in 2006, 2007, and 2011. The
primary objective of our audit was to determine if the Plan complied with the regulations and
requirements contained within Contract CS 1039, between the Plan and the Office of Personnel
Management (OPM), and the requirements within its contract with CVS Caremark, its Pharmacy
Benefit Manager. The audit was performed in our Washington, D.C. office from September 27,
2012 to May 22, 2013.

In addition to a review of member eligibility for contract years 2006, 2007, and 2011, the audit
also covered compliance with the Health Insurance Portability and Accountability Act (HIPAA)
and program requirements for fraud and abuse for contract year 2011. A previous audit (Report
Number 1H-01-00-11-063, dated August 8, 2012) covered HIPAA and fraud and abuse
compliance for contract years 2006 and 2007. Our current audit identified improper claim
payments in regards to member eligibility. As a result, the FEHBP was overcharged $2,305,973,
which includes $6,465 for lost investment income calculated through August 31, 2013.

i
an equal chance of being selected, it is reasonable to expect that the error rate occurs consistently
throughout the universe and not solely within the selected sample. Therefore, we decided to
project the results of our review of claims for 2011 to the entire 2011 universe of potential errors.
We did not project our error rates for 2006 and 2007 to the respective universes due to the
significant time elapsed since the claims were paid, the fact that the claims have reached or are
approaching the end of the contractual limitation for records retention (although our intention to
audit these records was announced to the Plan well in advance of that date), and because claims
of that age are unlikely to be recovered.

Additionally, we are concerned that the Plan’s responses to the recommendations in this
report convey an attitude that erroneously paid claims are allowable as long as it has made
a recovery effort, no matter the cause of the error. The Plan shows no sign of being
disturbed that its weak internal controls are the root cause of the overpayments. This
should clearly be a major priority for a carrier that covers over half of the FEHBP
membership. We are also concerned that the Plan appears to rely upon our audits to
identify erroneous claim payments rather than act proactively to identify and begin
recovery efforts in a timelier manner on its own, as is required by its contract with OPM.

The results of our audit have been summarized below.

MEMBER ELIGIBILITY REVIEW

• Member Eligibility Problems Identified $2,299,508

We identified 1,617 claims for contract years 2006, 2007, and 2011, totaling $680,093, paid
by the Plan for members that were ineligible due to retroactive member eligibility changes
received by the Plan after the date of the claim (making them ineligible for coverage after the
claim was originally processed). After projecting the 2011 results to the 2011 universe, we
are also questioning an additional $681,496 in claim payments.

We also identified 912 claims, totaling $386,497, for contract years 2006, 2007, and 2011
where the Plan’s claims system indicated that recovery (off-set) had not been initiated. For
these claims we are questioning an additional $478,133 after projecting the 2011 results to
the 2011 universe.

Lastly, for contract years 2006, 2007, and 2011 we identified 142 claims, totaling $49,089,
which were unallowable for payment because the Plan’s claims system indicated that the
member was ineligible for coverage at the date of service. The 2011 results were projected
to the 2011 universe resulting in additional questioned costs of $24,200.

HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT

The results of our review showed that CVS Caremark has policies and procedures in place to
address the Health Insurance Portability and Accountability Act Standards for Electronic
Transactions, Privacy Rules, and Security Rules.

ii
FRAUD AND ABUSE

The results of our review showed that CVS Caremark’s policies and procedures for fraud and
abuse complied with section 1.9(c) of Contract CS 1039 and met all eight industry standards
for fraud and abuse programs outlined in FEHBP Carrier Letter 2003-23.

LOST INVESTMENT INCOME ON FINDINGS

• Lost Investment Income $6,465

As a result of the questioned claims for ineligible members who were ineligible at the time of
service, the FEHBP is due lost investment income of $6,465 through August 31, 2013
(interest will continue to accrue after that date until all questioned costs are returned to the
FEHBP).

iii
CONTENTS
PAGE

EXECUTIVE SUMMARY ................................................................................................. i

I. INTRODUCTION AND BACKGROUND ....................................................................... 1

II. OBJECTIVES, SCOPE, AND METHODOLOGY ............................................................ 3

III. AUDIT FINDINGS AND RECOMMENDATIONS ......................................................... 6

A. MEMBER ELIGIBILITY REVIEW ......................................................................... 6

1. Member Eligibility Problems Identified............................................................. 7

B. HEALTH INSURANCE PORTABILITY AND ACCOUNTABILTY ACT ..........16

C. FRAUD AND ABUSE .............................................................................................16

D. LOST INVESTMENT INCOME ON FINDINGS ...................................................16

1. Lost Investment Income ....................................................................................16

IV. MAJOR CONTRIBUTORS TO THIS REPORT ..............................................................18

SCHEDULE A – CONTRACT CHARGES
SCHEDULE B – QUESTIONED COSTS
SCHEDULE C – LOST INVESTMENT INCOME CALCULATION

APPENDIX (Plan’s response to the draft report, dated July 15, 2013)
I. INTRODUCTION AND BACKGROUND
INTRODUCTION

This report details the results of our audit of BlueCross and BlueShield’s (Plan) Federal
Employees Health Benefits Program (FEHBP) retail pharmacy claims related to member
eligibility, in 2006, 2007, and 2011. The audit was conducted pursuant to the provisions of
Contract CS 1039; Title 5, United States Code, Chapter 89; and Title 5, Code of Federal
Regulations, Chapter 1, Part 890 (5 CFR 890). The audit was performed by the Office of
Personnel Management’s (OPM) Office of the Inspector General (OIG), as established by the
Inspector General Act of 1978, as amended. The audit was performed in our Washington, D.C.
office from September 27, 2012 to May 22, 2013.

BACKGROUND

The FEHBP was established by the Federal Employees Health Benefits (FEHB) Act (Public Law
86-382), enacted on September 28, 1959. The FEHBP was created to provide health insurance
benefits for federal employees, annuitants, and dependents. OPM’s Healthcare and Insurance
Office (HIO) has overall responsibility for administration of the FEHBP, including the
publication of program regulations and agency guidance. As part of its administrative
responsibilities, the HIO contracts with various health insurance carriers that provide service
benefits, indemnity benefits, and/or comprehensive medical services. The provisions of the
FEHB Act are implemented by OPM through regulations codified in 5 CFR 890.

The BlueCross and BlueShield Association (Association), on behalf of participating Blue Cross
and Blue Shield (BCBS) plans, entered into a Government-wide Service Benefit Plan contract
(CS 1039) with OPM to provide a health benefit plan authorized by the FEHB Act. The
Association delegates authority to participating local BCBS plans throughout the United States to
process the health benefit claims of its federal subscribers.

The Association established a Federal Employee Program (FEP) Director’s Office in
Washington, D.C. to provide centralized management for the Service Benefit Plan. The FEP
Director’s Office coordinates the administration of the contract with the Association, BCBS
plans, and OPM. Compliance with the laws and regulations applicable to the FEHBP is the
responsibility of the Plan’s management, which includes establishing and maintaining a system
of internal controls.

The Association also established an FEP Operations Center. The activities of the FEP
Operations Center are performed by CareFirst BCBS, located in Washington, D.C. These
activities include acting as fiscal intermediary between the Association and member plans,
verifying subscriber eligibility, approving or disapproving the reimbursement of local plan
payments of FEHBP claims (using computerized system edits), maintaining a history file of all
FEHBP claims, and maintaining an accounting of all program funds.

Pharmacy Benefit Managers (PBMs) are primarily responsible for processing and paying
prescription drug claims. The services typically include both retail and mail order drug benefits.

1
For drugs acquired through the “local” drugstore, the PBMs contract directly with the
approximately 50,000 retail pharmacies located throughout the United States. For maintenance
prescriptions that typically do not need to be filled immediately, PBMs offer the option of mail
order pharmacies. The PBM is used by the Plan to develop, allocate, and control costs related to
the pharmacy claims program.

The Plan’s pharmacy operations and responsibilities under contract CS 1039 are carried out by
CVS Caremark, which is located in Scottsdale, Arizona. Contract CS 1039 section 1.11 includes
a provision which allows for audits of the program’s operations. Our responsibility is to review
the performance of CVS Caremark to determine if the Plan charged costs to the FEHBP and
provided services to its members in accordance with this contract.

Although the Plan’s pharmacy operations and responsibilities are carried out by CVS Caremark,
the responsibilities related to maintaining and updating member eligibility are the responsibility
of the Plan. The Plan provides CVS Caremark with the membership eligibility data and updates
when changes occur. It is the responsibility of CVS Caremark to initiate recovery efforts if
claims have been paid in error due to retroactive membership eligibility changes. However, it is
the Plan’s responsibility to notify them of these changes and of the claims effected by the
changes before the refund requests can be sent.

All findings identified in our previous audit of the Plan (Report # 1H-01-00-11-063, dated
August 8, 2012) have been resolved.

2
II. OBJECTIVES, SCOPE, AND METHODOLOGY
OBJECTIVES

The primary objectives of this audit were to:

• Determine whether costs charged to the FEHBP and services provided to its members were
in accordance with the terms of the FEHBP contract and Federal regulations.

• To determine if CVS Caremark’s policies and procedures address the Health Insurance
Portability and Accountability Act (HIPAA) Standards for Electronic Transactions, Privacy
Rules, and Security Rules and are in compliance with this Federal regulation.

• To determine if CVS Caremark’s policies and procedures for fraud and abuse complied with
section 1.9(c) of Contract CS 1039 and met all eight industry standards for fraud and abuse
programs outlined in FEHBP Carrier Letter 2003-23.

SCOPE

We conducted this performance audit in accordance with generally accepted government
auditing standards. Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our audit findings and
conclusions based on the audit objectives. We believe that the evidence obtained provides a
reasonable basis for our findings and conclusions based on the audit objectives.

This performance audit covered an eligibility review of retail pharmacy claims and the Plan’s
adherence to its contractual requirements regarding claims for contract years 2006, 2007, and
2011. The audit scope also included compliance with HIPAA and program requirements for
fraud and abuse for contract year 2011. A previous audit (Report Number 1H-01-00-11-063,
dated August 8, 2012) covered HIPAA and fraud and abuse compliance for contract years 2006
and 2007.

In 2006, 2007, and 2011 the Plan paid $8,831,464,251 in prescription drug charges (claims and
administrative costs) to CVS Caremark. A summary of those costs by contract year is below:

Contract Charges by Year
2006 $2,616,272,544
2007 $2,740,947,608
2011 $3,474,244,099
Total $8,831,464,251

In planning and conducting the audit, we obtained an understanding of the Plan’s internal control
structure to help determine the nature, timing, and extent of our auditing procedures. This was
determined to be the most effective approach to select areas of audit. For those areas selected,
we primarily relied on substantive tests of transactions and not tests of controls. Based on our
testing, we identified internal control deficiencies within the Plan’s claims and eligibility systems

3
which resulted in the payment of claims for ineligible members. This issue is addressed in the
“Audit Findings and Recommendations” section of this report. Additionally, since our audit
would not necessarily disclose all significant matters in the internal control structure, we do not
express an opinion on the Plan’s system of internal controls taken as a whole.

In conducting our audit, we relied to varying degrees on computer-generated data provided by
the Plan. Due to time constraints, we did not verify the reliability of the data generated by the
various information systems involved. However, while utilizing the computer-generated data
during audit testing, nothing came to our attention to cause us to doubt its reliability. We believe
that the data was sufficient to achieve the audit objectives.

We also conducted tests to determine whether the Plan complied with the Contract, Service
Agreements, applicable procurement regulations (i.e., Federal Acquisition Regulations and
Federal Employees Health Benefits Acquisition Regulations, as appropriate), and the laws and
regulations governing the FEHBP. Exceptions noted in the areas reviewed are set forth in the
“Audit Findings and Recommendations” section of this report. With respect to the items not
tested, nothing came to our attention that caused us to believe that the Plan and CVS Caremark
had not complied, in all material respects, with those provisions.

METHODOLOGY

To test whether the Plan accurately charged the FEHBP for 2006, 2007, and 2011 prescription
drug benefits and complied with its contractual requirements, we identified potential error
universes within the full claims universe of 197,261,689 claim lines, totaling $8,831,464,251.

We used statistical sampling software to select a statistical sample for each year. A statistical
sample is selected randomly from a universe using random numbers, in which each item has an
equal chance of being selected. The use of statistical sampling allows us to project the error rates
identified in our samples to the universe of claims. Since, as mentioned above, each claim had
an equal chance of being selected, it is reasonable to expect that the error rate occurs consistently
throughout the universe and not solely within the selected sample. Therefore, we decided to
project the results of our review of claims for 2011 to the entire 2011 universe of potential errors.
We did not project our error rates for 2006 and 2007 to the respective universes due to the
significant time elapsed since the claims were paid, the fact that the claims have reached or are
approaching the end of the contractual limitation for records retention (although our intention to
audit these records was announced to the Plan well in advance of that date), and because claims
of that age are unlikely to be recovered. The use of statistical sampling also requires the
selection of confidence levels and precision rates. For the samples selected, we used a
confidence level of 90 percent and a maximum precision rate of $37,500, which means we are 90
percent sure that the difference between the projected questioned claims and the actual
questioned claims is no more than $37,500.

4
The following audit steps were performed:

Member Eligibility Review
• We identified a potential eligibility error universe of 6,860 claims totaling $1,196,126 for
contract year 2006. The universe contains all claims over $100 and claims that were not
previously reviewed on prior audits. We selected a statistical sample of 804 claims
totaling $206,086 for review to determine if the member was eligible for services at the
time of the claim.

• We identified a potential eligibility error universe of 8,202 claims totaling $1,465,678 for
contract year 2007. The universe contains all claims over $100 and claims that were not
previously reviewed on prior audits. We selected a statistical sample of 912 claims
totaling $264,933 for review to determine if the member was eligible for services at the
time of the claim.

• We identified a potential eligibility error universe of 10,233 claims totaling $2,496,291
for contract year 2011. The universe contains all claims over $100. We selected a
statistical sample of 1,857 claims totaling $985,648 for review to determine if the
member was eligible for services at the time of the claim.

Health Insurance Portability and Accountability Act
• We obtained CVS Caremark’s updated 2011 policies and procedures that address the
HIPAA Standards for Electronic Transactions, Privacy Rules, and Security Rules for
review to determine if the carrier has documented its compliance with this Federal
regulation.

Fraud and Abuse
• We reviewed CVS Caremark’s updated 2011 policies and procedures for fraud and abuse
to determine if the Plan complied with section 1.9 (c) of Contract CS 1039 and met all
eight industry standards for fraud and abuse programs outlined in FEHBP Carrier Letter
2003-23.

As mentioned previously, our selected samples were statistically based. Consequently, we
projected the results of our review of 2011 claims to the universe since it is likely that the results
were representative of the universe as a whole. We used Contract CS 1039 to determine if claim
processing and administrative fees charged to the FEHBP were in compliance with the terms of
the Contract.

The results of our audit were discussed with Plan officials throughout the audit. In addition, a
draft report, dated May 22, 2013, was provided to the Plan for review and comment. The Plan
and CVS Caremark’s responses to the draft report, dated July 15, 2013, were considered in
preparing the final report and are included as an Appendix to this report.

5
III. AUDIT FINDINGS AND RECOMMENDATIONS
A. MEMBER ELIGIBILITY REVIEW

In a previous audit (Report Number 1H-01-00-11-063, dated August 8, 2012) we identified a
high error rate in our sample of potential member eligibility errors. As a result, we decided
to perform a separate audit to expand our review of member eligibility.

Using the universe of potential member eligibility errors for 2006 and 2007 identified in the
previous audit, we selected a statistical sample (separate samples each year) of the remaining
claims (removing those member claims that were previously reviewed). We then compared
the Plan’s enrollment data to the claims paid by CVS Caremark in 2006 and 2007 to
determine if any claims were paid when a member was ineligible for FEHBP benefits with
the Plan. During the audit we expanded the scope to include 2011 claims, which was the
most recent year of claims available in our claims warehouse, to see if improved internal
controls would result in fewer eligibility errors.

To complete our review, we were provided access to the Plan’s claims system (“FEP Direct”)
which gave us current information related to member eligibility, claims, and any related
refunds. Rather than provide the Plan with 3,573 claims and ask if the members were
eligible or not, we manually reviewed each claim by looking up the member in FEP Direct
and reviewing their eligibility. For claims which we determined had eligibility errors, we
printed all of the FEP Direct screens used in determining that the member was not eligible at
the time of service.

Before issuing a draft report, we electronically sent the Plan a spreadsheet with all of the
claims in question along with all of the screen prints from our review. We asked the Plan to
respond to each claim indicating whether or not they agreed with our findings, and if they did
not, explain why they disagreed with our determination. If recoveries had not been initiated
we asked the Plan to provide a reason why it was not done, and if recoveries had been
initiated to provide supporting documentation for a selected number of recoveries. The Plan
did not review the information timely and requested an extended time frame to complete its
review. When responses were received from the Plan, they were generic, blanket responses
covering many of the claims instead of the detailed claim by claim responses that we
requested. We met with the Plan prior to issuance of our draft report and stressed to it the
importance of a detailed claim by claim review of our questioned costs. However, responses
provided to the draft report were again generic, blanket responses following another
extension of time to respond.

Additionally, the Plan had CVS Caremark respond to the findings even though we made it
clear to the Plan in discussions that our concerns were not with CVS Caremark but with the
Plan’s internal claims system and internal controls (as such, none of the recommendations in
the draft report were addressed to CVS Caremark).

The claims reviewed in this audit were statistically sampled and are representative of the
universe. A statistical sample is selected randomly from a universe using random numbers,

6
in which each item has an equal chance of being selected. The use of statistical sampling
allows us to project the error rates identified in our samples to the universe of claims. Since,
as mentioned above, each claim had an equal chance of being selected, it is reasonable to
expect that the error rate occurs consistently throughout the universe and not solely within
the selected sample. Therefore, we decided to project the results of our review of claims for
2011 to the entire 2011 universe of potential errors. We did not project our error rates for
2006 and 2007 to the respective universes due to the significant time elapsed since the claims
were paid, the fact that the claims have reached or are approaching the end of the contractual
limitation for records retention (although our intention to audit these records was announced
to the Plan well in advance of that date), and because claims of that age are unlikely to be
recovered.

1. Member Eligibility Problems Identified $2,299,508

We identified 1,617 claims for contract years 2006, 2007, and 2011, totaling $680,093,
paid by the Plan for members that were ineligible due to retroactive member eligibility
changes received by the Plan after the date of the claim (making them ineligible for
coverage after the claim was originally processed). After projecting the 2011 results to
the 2011 universe, we are questioning an additional $681,496 in claim payments. The
Plan’s claim system indicates that recovery (off-set) has been initiated on these claims.

We also identified 912 claims, totaling $386,497, for contract years 2006, 2007, and 2011
where the Plan’s claims system indicated that recovery (off-set) had not been initiated.
For these claims we are questioning an additional $478,133 after projecting the 2011
results to the 2011 universe.

Finally, for contract years 2006, 2007, and 2011 we identified 142 claims, totaling
$49,089, which were unallowable for payment because the Plan’s claims system
indicated that the member was ineligible for coverage at the date of service. The 2011
results were projected to the 2011 universe resulting in additional questioned costs of
$24,200.

During our review of the 2006, 2007, and 2011 claims, we identified the following
problems:

Recoverable Claims with Off-Set Process Begun by Plan

We identified 1,617 claims for contract years 2006, 2007, and 2011, totaling $680,093,
that were paid by the Plan for members that were ineligible due to retroactive member
eligibility changes received by the Plan after the date of the claim. Our review
determined that the Plan’s claims system indicated that it had identified the claims as
overpaid and marked them for recovery (off-set) against the next claim submitted for
payment. However, we could not determine if the required recovery letters were sent.
Consequently, we projected error rates for the 2011 review to the 2011 universe and
questioned an additional $681,496 in claim payments.

7
Dollar
Number of Total
Amount of Projected
Year Questioned Questioned
Questioned Amount
Claims Amount
Claims
2006 360 $100,390 N/A $100,390
2007 404 $125,230 N/A $125,230
2011 853 $454,473 $681,496 $1,135,969
Total 1,617 $680,093 $681,496 $1,361,589

The Plan contracts with CVS Caremark to administer its pharmacy benefit and to pay the
member’s claims on its behalf. As CVS Caremark is the party that is the primary payer,
the Plan relies upon it to make the initial recovery efforts from the members. Upon
learning of an eligibility change for a member that would make a claim ineligible for
payment, the Plan informs CVS Caremark to begin recovery efforts. CVS Caremark
sends out letters at 30, 60, and 90 days requesting a refund from the member. If no
recovery is made by CVS Caremark, it notifies the Plan and then it updates its system to
off-set the amount from the next claim submitted for payment.

Contract CS 1039, Section 2.3(g) Erroneous Payments states, “If the carrier or OPM
determines that a Member’s claim has been paid in error for any reason (except fraud and
abuse), the Carrier shall make a prompt and diligent effort to recover the erroneous
payment to the member from the member or, if to the provider, from the provider.”

Section 2.3(g) continues to outline the process for notifying the member of the
overpayment, including the sending of the 30, 60, and 90 day letters, and allowing the
Plan to begin an off-set of claims after 120 days of the first notice. The Plan may cease
recovery efforts if it is deemed more cost effective to do so. However, the Plan is
required to maintain “records that document individual unrecovered erroneous payment
collection activities for audit for future reference.”

Finally, Section 2.3(g)(11) states “In compliance with the provisions of the Contract
Disputes Act, the Carrier shall return to the Program an amount equal to the uncollected
erroneous payment where the Contracting Officer determines that (a) the Carrier’s failure
to appropriately apply its operating procedure caused the erroneous payment and (b) that
the Carrier failed to make a prompt and diligent effort to recover an erroneous payment.”

When our initial review was provided to the Plan in advance of our draft report, we
requested it to provide copies of the recovery letters sent for a subset of the claims
questioned (304 in total). However, the Plan did not provide this information until it was
requested again in the draft report. Our review of the letters found that each of them
(initial recover letter, as well as the 30, 60, and 90 day follow-up letters) had the same
date.

This is a concern to us because the process could allow CVS Caremark to show the
recovery process as completed when the initial letter is generated. Additionally, if the

8
letters are all generated simultaneously, partial recoveries received within the 90 day
follow-up process would not be accounted for in the letters.

Prior to preparing this report we made numerous attempts to obtain an explanation as to
why the recovery letters for each claim had identical dates. However, the Plan did not
respond to any of our requests. As a result, we could not determine if the Plan met its
due diligence requirements, which resulted in our questioning $1,361,589.

Recommendation 1

We recommend that the contracting officer direct the Plan to return $680,093 to the
FEHBP for eligibility errors for 2006, 2007, and 2011, as it could not document its
prompt and diligent efforts to recover the overpayments.

Plan’s Comments:

The Plan disagrees with our finding. CVS Caremark agrees that the questioned claims
had retroactive changes made to the enrollment records after adjudication and states that
recovery letters were sent to members upon receipt of termination notices and that
overpayments have been setup for off-set in the FEP claims system. The FEP Claims
System has recovered $1,790 of these overpayments as of August 8, 2013. Copies of the
refund letters were provided to the OIG on July 15, 2013, and as a result the due
diligence requirements of CS 1039 have been met.

OIG’s Comments:

As stated previously in the finding, because the recovery letters provided had identical
dates and the Plan did not respond to our questions, we could not determine if the Plan
met its due diligence requirements. Additionally, the Plan did not provide evidence to
support the recovery and return of the $1,790 (out of the $680,093 questioned).
Therefore, we did not reduce the amount questioned by those potential recoveries.

Recommendation 2

We recommend that the contracting officer direct the Plan to return $681,496 to the
FEHBP for the projected eligibility errors for 2011.

Plan’s Comments:

The draft report did not include this recommendation.

OIG Comments:

9
response to the draft report, did not object to this valid audit approach. In the resolution
process we suggest that the Plan has two options to address the questioned amount
(unless a settlement is reached): it may either return the full amount questioned, or it may
review the entire universe of claims to determine the specific claims paid in error,
provide supporting documentation to OPM, and begin the recovery process.

Recoverable Claims Where the Off-Set Process was not Begun by Plan

Our review also identified 912 claims, totaling $386,497, for contract years 2006, 2007,
and 2011 that were paid by the Plan for members that were ineligible due to retroactive
member eligibility changes received by the Plan after the date of the claim and where the
Plan’s claims system did not show the off-set recovery process was begun. We are
questioning an additional $478,133 in claim payments after projecting the 2011 error rate
to its corresponding universe.

Dollar
Number of Total
Amount of Projected
Year Questioned Questioned
Questioned Amount
Claims Amount
Claims
2006 166 $39,108 N/A $39,108
2007 207 $64,219 N/A $64,219
2011 539 $283,170 $478,133 $761,303
Total 912 $386,497 $478,133 $864,630

Discussion with the Plan indicated that as a result of our previous audit, Report Number
1H-01-00-11-063, it had identified a systematic error in its claims system that caused
many of these errors. According to the Plan, when a “file correction” is manually made
to a member’s eligibility information, the system is unable to retroactively determine if
claims were paid after the date eligibility was terminated. As a result of this system error,
the claims were not sent to CVS Caremark to initiate recovery efforts.

Section 2.3(g) of the contract states that “It is the Carrier’s responsibility to proactively
identify overpayments through comprehensive, statistically valid reviews and a robust
internal control program.”

It is our opinion that the Plan’s lack of proper internal controls to identify any and all
changes to member eligibility, no matter how the change was made, resulted in its failure
to identify and potentially recover these claims when they could have been more readily
recovered. Therefore, these claims should be deemed unallowable and the funds
questioned should be returned to the FEHBP.

In addition, it should be noted that this type of error is not limited to pharmacy claims,
but most likely also can be found across all of the Plan’s many medical claims where
“file corrections” were made.

10
Finally, the Plan indicated that recoveries were not initiated on many claims because they
were over three years old when the eligibility update was received. However, according
to the contract there is no time limitation on recovery efforts. The contract does allow the
Plan to cease recovery efforts if it is more cost effective to do so, but the contract requires
an effort to be made.

As the Plan did not comply with the contract’s requirements to make a prompt and
diligent effort to recover these payments that it should have identified (or in some cases
did identify, but did not attempt to recover due to age), these claims should be deemed
unallowable and the amounts questioned should be returned to the FEHBP.

Recommendation 3

We recommend that the contracting officer direct the Plan to return $386,497 to the
FEHBP for eligibility errors for 2006, 2007, and 2011, as it did not make a prompt and
diligent effort to recover the overpayments.

Plan’s Comments:

The Plan disagrees with our finding. CVS Caremark agrees that the questioned claims
had retroactive changes made to the enrollment records after adjudication. Many of these
retroactive changes were made by a manual file correction for which no notification is
issued. The Plan developed a process during 2012 to send periodic listings of potential
payment errors due to file corrections to CVS Caremark for overpayment recovery,
ensuring timely initiation. Copies of the refund letters were provided to the OIG on
July 15, 2013, and as a result, the due diligence requirements of CS 1039 have been met.
In addition we provided select copies of file corrections that occurred and show CVS
Caremark initiated recovery. Some of the documentation could not be provided due to
the age of the files being beyond our records retention requirements.

Finally, medical claims that have file corrections are included in the FEP Claims System
Claims Audit Monitoring Tool, which is used by Plans to initiate recovery on potential
payment errors.

OIG’s Comments:

In its response, the Plan provided us with copies of the refund letters for the claims in
question that were all dated July 8, 2013. This date was after the issuance of our draft
report. We would have to, therefore, disagree that the procedures implemented by the
Plan in 2012 to initiate recovery on potential payment errors involving manual file
corrections is effective or ensuring timely initiation. It appears that these claims were
identified solely as a result of our audit as the letters were dated after issuance of our
draft report.

In response to this recommendation, CVS Caremark provided comments pertaining to its
internal control system. These comments were not included in the Plan’s Comments, as

11
they are irrelevant to the finding. Our finding identifies the Plan’s lack of internal
controls as a cause for untimely recovery initiation of these claims, not CVS Caremark’s.
Throughout our audit process, the Plan often sought a response from CVS Caremark
when we repeatedly asked for its response.

Our scope for this audit was a review of member eligibility at the time a claim was paid.
Eligibility files are maintained by the Plan and updates to member eligibility are received
by the Plan. Determination that a recovery is to be initiated due to a retroactive eligibility
change is a responsibility of the Plan. CVS Caremark only initiates recoveries when
notified by the Plan to do so. CVS Caremark was not notified in a timely manner to
initiate recoveries for these claims due to the Plan’s claims system not identifying the
claims to be recovered. The responsibility for this oversight lies solely with the Plan.

Recommendation 4

We recommend that the contracting officer direct the Plan to return $478,133 to the
FEHBP for projected eligibility errors for 2011.

Plan’s Comments:

The draft report did not include this recommendation.

OIG Comments:

Although the draft report did not include this recommendation, we did inform the Plan in
the draft report that the samples from this audit were statistically based and that we
planned on projecting the error rates to the claims error universe. The Plan, in its
response to the draft report, did not object to this valid audit approach. In the resolution
process we suggest that the Plan has two options to address the questioned amount
(unless a settlement is reached): it may either return the full amount questioned, or it may
review the entire universe of claims to determine the specific claims paid in error,
provide supporting documentation to OPM, and begin the recovery process.

Recommendation 5

We recommend that the contracting officer direct the Plan to make immediate
improvements to its internal control system so that it is able to identify all changes to a
member’s eligibility information when they are made and identify all potentially overpaid
claims as a result of the change.

Plan’s Comments:

The FEP Claims System is transaction driven and when a change is made to a member’s
enrollment records a Retro Enrollment Change Notification is generated. Manual file
corrections are not transactions. Therefore, a notification is not generated. The FEP
Director’s Office and the FEP Operations Center are working on a resolution to identify

12
and automate the notifications for manual file corrections. In the meantime, the FEP
Director’s Office has developed a manual process to identify and generate file correction
changes to send to CVS Caremark on a periodic basis. CVS Caremark manually
generates overpayment recovery notices upon notification of the file correction.

OIG’s Comments:

We acknowledge that the Plan is working on a solution to automate manual file
corrections. However, as stated in our response to the previous recommendation, the
manual process that has been implemented to identify file corrections and generate
notifications is not entirely effective. The claims identified in our audit were not
previously identified by the Plan for recovery initiation.

Recommendation 6

We recommend that the contracting officer direct the Plan to follow all aspects of Section
2.3(g) in its recovery efforts on all claims identified as overpaid in the future no matter
the age of the claim.

Plan’s Comments:

CVS Caremark disagrees with our recommendation. It stated that because manual file
corrections do not automatically generate notifications, it did not initiate recovery on
these overpayments until it received the list of claims from the OIG. Recovery was
initiated upon receiving the information. Therefore, the due diligence requirements were
met and they are in compliance with Section 2.3(g) of contract CS 1039.

OIG’s Comments:

While we would agree with CVS Caremark’s statements regarding its not being notified
of these overpayments, the focus of this recommendation was not on the manual file
corrections, but on those claims for which the Plan stated no recovery attempt was made
because the claim was over three years old. These claim recoveries are not the
responsibility of CVS Caremark, but of the Plan who, of its own accord, decided that the
claims were too old to attempt recovery and never notified CVS Caremark to initiate
recovery. As a result, we feel that the due diligence requirements for these claims were
not met by the Plan.

Unallowable Claims for Ineligible Members

Additionally, we identified 142 claims for contract years 2006, 2007, and 2011, totaling
$49,089, which were unallowable for payment because the Plan’s claims system
indicated that the member was ineligible for coverage at the date of service. We have
questioned an additional $24,200 in claim payments after projecting the 2011 results to
its universe.

13
Dollar
Number of Total
Amount of Projected
Year Questioned Questioned
Questioned Amount
Claims Amount
Claims
2006 68 $15,140 N/A $15,140
2007 36 $7,073 N/A $7,073
2011 38 $26,876 $24,200 $51,076
Total 142 $49,089 $24,200 $73,289

FEHBAR 1652.216-71(b) and Contract CS 1039, Section 3.2(b) Definition of costs (1)
state, “The Carrier may charge a cost to the contract for a contract term if the cost is
actual, allowable, allocable, and reasonable.” Additionally, Contract CS 1039, Section
3.2(b)(1)(i) states that the Carrier must “on request, document and make available
accounting support for the cost to justify that the cost is actual, reasonable and
necessary.”

Again, it is our opinion that the Plan’s internal control system is not sufficient to meet the
requirements of the contract. All claims identified and questioned clearly showed that the
member was ineligible for coverage prior to and at the date of the service. Consequently,
these claims should be deemed unallowable as they never should have been paid, and the
amounts questioned should be returned to the FEHBP.

Recommendation 7

We recommend that the contracting officer direct the Plan to return $49,089 for contract
years 2006, 2007, and 2011 to the FEHBP for eligibility errors where it did not make a
prompt and diligent effort to recover the overpayments.

Plan’s Comments:

The Plan disagrees with our finding. Upon notification of the errors during the OIG audit
and confirmation of the overpayments, recovery was initiated by CVS Caremark. As a
result, the due diligence requirements of contract CS 1039 were met. The OIG was
provided copies of the recovery letters on July 15, 2013.

OIG’s Comments:

The Plan fails to recognize that the claims questioned in this finding were due to the
members being ineligible at the time of payment and that the Plan’s own claims system
showed that these members were ineligible prior to the services incurred. The Plan
provided no further documentation from its eligibility database to show that these
members were eligible or, if ineligible, it did not provide an explanation or steps to
correct the problem.

Additionally, it is our opinion that the $73,289 in payments questioned does not meet the
definition of “good faith payments.” We base this opinion on the fact that a reasonable

14
business person would not pay a claim for an individual with terminated coverage. As
stated above, the Plan’s own eligibility database shows that the members questioned were
ineligible at the time the claims were incurred. It is then our assumption that the Plan
was aware of the eligibility status of these individuals at that time. However, this
information was apparently not communicated to CVS Caremark by the Plan. As a
result, we have determined that these payments are unreasonable and unallowable
charges against the contract which must be returned immediately, regardless of the Plan’s
recovery efforts, and are subject to lost investment income (LII).

Lastly, it is of great concern to us that the Plan’s responses to this, and other
recommendations in this report, convey an attitude that erroneously paid claims are
allowable as long as a recovery effort has been made. The fact that the Plan’s weak
internal controls were the cause of the problem, or that years have passed without the
Plan ever determining that an error (and in many cases repeated errors) have occurred,
does not seem to be a concern to the Plan. It clearly should be, especially for a carrier
that covers over half of the FEHBP membership. The Plan continually requested time
extensions to review claims provided to it both prior to and after issuance of our draft
report. Yet in spite of being granted this additional time, the documentation provided to
support its review and recovery efforts did not demonstrate due diligence. Additionally,
the Plan relies upon our audits to identify erroneous claims rather than act proactively to
identify and recover monies on its own as is required in its contract with OPM.

Recommendation 8

We recommend that the contracting officer direct the Plan to return $24,200 to the
FEHBP for projected eligibility errors for 2011.

Plan’s Comments:

The draft report did not include this recommendation.

OIG Comments:

Recommendation 9

We recommend that the contracting officer require the Plan to obtain the eligibility error
universe for contract years 2009, 2010, and 2012 from the OIG and to report to OPM, at

15
least quarterly, on the status and recovery efforts made on the identified improperly paid
claims.

Plan’s Comments:

The draft audit report did not include this recommendation.

Recommendation 10

We recommend the contracting officer direct the Plan to institute internal controls and
edits to the eligibility system that would reject or suspend a claim for which no eligibility
exists at the time of the claim.

Plan’s Comments:

The draft audit report did not include this recommendation.

B. HEALTH INSURANCE PORTABILITY AND ACCOUNTABILTY ACT

The results of our review showed that the PBM has policies and procedures in place to
address the HIPAA Standards for Electronic Transactions, Privacy Rules, and Security Rules.

C. FRAUD AND ABUSE

The results of our review showed that the PBM’s policies and procedures for fraud and abuse
complied with section 1.9(c) of Contract CS 1039 and met all eight industry standards for
fraud and abuse programs outlined in FEHBP Carrier Letter 2003-23.

D. LOST INVESTMENT INCOME ON FINDINGS

1. Lost Investment Income $6,465

The FEHBP is due $6,465 for LII related to the $73,289 in questioned claims for
members who were ineligible at the time of service.

FEHBAR 1652.215-71(e) and Contract CS 1039, Section 3.4 Investment Income (d),
state “Investment income lost as a result of unallowable, unallocable, or unreasonable
charges against the contract shall be paid from the first day of the contract term following
the contract term in which the unallowable charge was made and shall end on the earlier
of: (1) the date the amounts are returned to the Special Reserve (or the Office of
Personnel Management); (2) the date specified by the Contracting Officer; or (3) the date
of the Contracting Officer’s Final Decision.” In addition, Section 3.4 Investment Income
(f) provides that LII shall bear simple interest at the quarterly rate determined by the
Secretary of the Treasury under the authority of 26 U.S.C. 6621 (a) (2).

16
We computed LII that would have been earned using the rates specified by the Secretary
of Treasury and determined that the FEHBP is due $6,465 for LII, calculated from
erroneous claim payments made in 2006, 2007, and 2011.

Recommendation 11

We recommend that the contracting officer require the Plan to credit the FEHBP $6,465
for LII calculated through August 31, 2013 (interest will continue to accrue after that date
until all questioned costs are returned to the FEHBP).

Plan’s Comments:

The draft audit report did not include LII on audit findings.

17
IV. MAJOR CONTRIBUTORS TO THIS REPORT
Special Audits Group

, Auditor-In-Charge

, Auditor

, Group Chief

, Senior Team Leader

18
AUDIT OF BLUECROSS AND BLUESHIELD'S
RETAIL PHARMACY MEMBER ELIGIBILITY
IN 2006, 2007, AND 2011

REPORT NUMBER 1H-01-00-12-072

SCHEDULE A - CONTRACT CHARGES

PHARMACY CLAIMS

2006 Retail Prescription Drug Claim Payments $2,616,272,544
2007 Retail Prescription Drug Claim Payments 2,740,947,608
2011 Retail Prescription Drug Claim Payments 3,474,244,099

TOTAL CONTRACT CHARGES $8,831,464,251

SCHEDULE B - QUESTIONED COSTS

A. MEMBER ELIGIBILITY REVIEW

1. Member Eligibility Problems Identified
Recoverable Claims with Off-Set Process Begun by Plan $1,361,589
Recoverable Claims Where the Off-Set Process was not Begun by Plan 864,630
Unallowable Claims for Ineligible Members 73,289
Total Member Eligibility Claims Questioned $2,299,508

B. LOST INVESTMENT INCOME (See Schedule C) $6,465

TOTAL QUESTIONED COSTS $2,305,973
SCHEDULE C

AUDIT OF BLUECROSS AND BLUESHIELDS'S
RETAIL PHARMACY MEMBER ELIGIBILITY
IN 2006, 2007, AND 2011

REPORT NUMBER 1H-01-00-12-072

LOST INVESTMENT INCOME CALCULATION

LOST INVESTMENT INCOME 2006 2007 2008 2009 2010 2011 2012 2013 TOTAL

A. QUESTIONED CHARGES (Subject to Lost Investment Income)

Unallowable Claims for Ineligible Members $15,140 $7,073 $0 $0 $0 $51,076 $0 $0 $73,289

TOTAL $15,140 $7,073 $0 $0 $0 $51,076 $0 $0 $73,289

B. LOST INVESTMENT INCOME CALCULATION

a. Prior Years Total Questioned (Principal) $0 $15,140 $7,073 $0 $0 $0 $51,076 $0
b. Cumulative Total $0 $0 $15,140 $22,213 $22,213 $22,213 $22,213 $73,289
c. Total $0 $15,140 $22,213 $22,213 $22,213 $22,213 $73,289 $73,289

d. Treasury Rate: January 1 - June 30 5.125% 5.250% 4.750% 5.625% 3.250% 2.625% 2.000% 1.375%

e. Interest (d * c) $0 $397 $528 $625 $361 $292 $733 $504 $3,440

f. Treasury Rate: July 1 - December 31 5.750% 5.750% 5.125% 4.875% 3.125% 2.500% 1.750% 1.750%

g. Interest (f * c) $0 $435 $569 $541 $347 $278 $641 $214 $3,025

Total Interest By Year (e + g) $0 $832 $1,097 $1,166 $708 $570 $1,374 $718 $6,465
APPENDIX

Federal Employee Program
1310 G Street, N.W.
Washington, D.C. 20005
July 15, 2013 202.942.1000
Fax 202.942.1125

Group Chief, Special Audits Group
Office of the Inspector General
U.S. Office of Personnel Management
1900 E Street, Room 6400
Washington, DC 20415-1100

Reference: OPM DRAFT AUDIT REPORT
CVS/CAREMARK Expanded Retail Pharmacy Operations
Audit Report Number 1H-01-00-12-072
(Dated May 22, 2013 Received May 23, 2013)

Dear :

This is our response to the above referenced U.S. Office of Personnel Management
(OPM) Draft Audit Report covering the Federal Employees’ Health Benefits Program
(FEHBP) for Expanded Retail Pharmacy Operations at CVS/Caremark. Our comments
concerning the findings in this report are as follows:

A. MEMBER ELIGIBILITY REVIEW

1. Member Eligibility Problems Identified $1,115,679

The OIG Auditors identified 2,671 claims, totaling $1,115,679 paid for members that
were ineligible due to retroactive member eligibility changes after the drugs were
dispensed:

Recommendation # 1 $630,618

CVS/Caremark agrees that claims for drugs totaling $630,618 were dispensed prior to
receiving retroactive enrollment changes that terminated the coverage for the
questioned members identified in this finding. However, the claims were paid in error
because termination information was submitted by the Federal Payroll Offices and or
members to FEP after the claims had already been paid. Recovery letters were sent to
the members immediately upon receipt of the retro-active termination notices. As of the
date of this response, the overpayments have also been setup for off-set in the FEP
claims system. As of August 8, 2013, the FEP Claims System has recovered $1,790 of
these overpayments. Copies of the refund letters were provided to OIG on July 15,
July 15, 2013
Draft Report Response

2013. As a result, CS1039 Due Diligence requirements were met and evidence has
been provided to the OIG.

Recommendation # 2 $435,972

We disagree with the OIG’s statement that the internal controls over the overpayment
recovery efforts at CVS/Caremark are not adequate.

Deleted by OIG
Not Relevant to the Audit Report

CVS/Caremark agrees that claims for drugs totaling $435,972 were dispensed before
the termination dates were loaded to the FEP System or retroactive enrollment notices
were received. A number of these changes were the result of FEP Operations Center
(FEPOC) manually processed enrollment changes (File Corrections) for which no
notification is generated.

During 2012, the FEP Director’s Office developed a process to send periodic listings of
potential payment errors due to File Corrections to CVS/Caremark for initiation of
overpayment recovery. This new procedure ensures timely initiation of recovery for
potential overpayments. Copies of the refund letters sent to members once Caremark
became aware of the overpayments were provided to OIG on July 15, 2013. In
addition, on July 15, we provided select copies of documentation that File Corrections
occurred for claims in this category and that Caremark initiated recovery once the
impact of these File Corrections were documentation As a result, CS1039 Due
Diligence requirements were met. The remaining documentation of the File Corrections
cannot be provided because the ages of the changes are beyond our record retention
requirements.

Medical claims related to termination file corrections are included in the FEP Claims
System Claims Audit Monitoring Tool (CAMT), which is used by Plans to initiate
recovery on potential terminated member claims.

Recommendation # 3 Procedural

The FEP Claims System generates Retro Enrollment Changes Notifications for
transactions that make changes to the members’ enrollment records. The FEP Claims
System is a transaction driven system. Because these changes are not transactions,
the system does not generate notifications for File Corrections. The FEPDO and the
FEPOC continue to research how to identify and automate the notifications for File
Corrections. However, to minimize the impact of this issue, the FEP Director’s Office
has developed a manual process to generate File Correction changes to CVS/Caremark
on a periodic basis. Once received, Caremark manually generates overpayment
July 15, 2013
Draft Report Response

recovery notices. Medical claims impacted by file corrections are included on the
FEPDO online CAMT, used by Plans to initiate recovery on terminated member claims.

Recommendation # 4 Procedural

CVS/Caremark is in compliance with all aspects of Section 2.3(g) of CS1039 in its
recovery efforts on all claims identified as overpayments. Because retro-termination
notices are not generated for File Corrections, Caremark did not initiate recovery for
these overpayments until they received the OIG listing. Once Caremark was informed
of the overpayments, recovery letters were sent to these members. As a result,
CS1039 Due Diligence requirements were met. Copies of the refund letters were
provided to the OIG on July 15, 2013.

Recommendation # 5 $49,089

When Caremark was notified of the error during the OIG audit, upon confirmation of the
overpayments, recovery was initiated. As a result, CS1039 Due Diligence requirements
were met. Copies of the refund letters to support Caremark’s overpayment recovery
activities were provided to the OIG on July 15, 2013.

We appreciate the opportunity to provide our response to this Draft Audit Report and
request that our comments be included in their entirety as an amendment to the Final
Audit Report.

Sincerely,

Managing Director
Program Assurance