oversight

Multi-State Plan Program Operations at Anthem Blue Cross Blue Shield of Kentucky

Published by the Office of Personnel Management, Office of Inspector General on 2015-10-28.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

         U.S. OFFICE OF PERSONNEL MANAGEMENT
            OFFICE OF THE INSPECTOR GENERAL
                     OFFICE OF AUDITS




            Final Audit Report

                            MULTI-STATE PLAN PROGRAM
                         OPERATIONS AT ANTHEM BLUE CROSS
                             BLUE SHIELD OF KENTUCKY

                                          Report Number 1M-0B-00-15-024
                                                 October 28, 2015




                                                             -- CAUTION --
This audit report has been distributed to Federal officials who are responsible for the administration of the audited program. This audit report may
contain proprietary data which is protected by Federal law (18 U.S.C. 1905). Therefore, while this audit report is available under the Freedom of
Information Act and made available to the public on the OIG webpage (http://www.opm.gov/our-inspector-general), caution needs to be exercised
before releasing the report to the general public as it may contain proprietary information that was redacted from the publicly distributed copy.
             EXECUTIVE SUMMARY 

                                Multi-State Plan Program Operations at 

                               Anthem Blue Cross Blue Shield of Kentucky 

Report No. 1M-0B-00-15-024                                                                       October 28, 2015


Why Did We Conduct The Audit?           What Did We Find?

The primary objective of our audit      Our audit of the 2014 MSP Program operations at Anthem
was to obtain reasonable assurance      Kentucky disclosed no significant findings pertaining to
that Anthem Blue Cross Blue Shield      enrollment, rates and benefits, reporting of significant actions and
                                        events, and data and information security. Accordingly, this final
of Kentucky (Anthem Kentucky)
                                        report contains no recommendations.
complied with the provisions of
Contract MSPP-2014 and applicable
Federal regulations for contract year
2014.

What Did We Audit?
                                        .
The Office of the Inspector General
has completed a performance audit of
the Multi-State Plan (MSP) Program
operations at Anthem Kentucky. Our
desk audit covered contract year 2014
and was conducted from
April 20, 2015 through July 27, 2015
at our field office in Cranberry
Township, Pennsylvania.




 _______________________
 Michael R. Esser
 Assistant Inspector General
 for Audits
                                                      i
                       ABBREVIATIONS

Affordable Care Act   The Patient Protection and Affordable Care Act
Anthem Kentucky       Anthem Blue Cross Blue Shield of Kentucky
Association           Blue Cross Blue Shield Association
BCBS                  Blue Cross Blue Shield
MSP                   Multi-State Plan
OIG                   Office of the Inspector General
OPM                   U.S. Office of Personnel Management
PBM                   Pharmacy Benefit Manager
SBC                   Summary of Benefits and Coverage




                                      ii
IV. MAJOR CONTRIBUTORS  TO THIS REPORT
          TABLE OF CONTENTS

                                                                                                                       Page 

        EXECUTIVE SUMMARY ......................................................................................... i 


        ABBREVIATIONS ..................................................................................................... ii 


I.	     BACKGROUND ..........................................................................................................1 


II.	    OBJECTIVES, SCOPE, AND METHODOLOGY ..................................................3 


III.	   RESULTS OF THE AUDIT .......................................................................................5 


IV.	    MAJOR CONTRIBUTORS TO THIS REPORT ....................................................6 


        REPORT FRAUD, WASTE, AND MISMANAGEMENT

 IV. MAJOR CONTRIBUTORS
            I. BACKGROUND
                        TO THIS REPORT

This final report details the results of our performance audit of the Multi-State Plan (MSP)
Program operations at Anthem Blue Cross Blue Shield of Kentucky (Anthem Kentucky). The
desk audit covered contract year 2014 and was conducted at our field office in Cranberry
Township, Pennsylvania. It was performed by the U.S. Office of Personnel Management's
(OPM) Office of the Inspector General (OIG), as established by the Inspector General Act of
1978, as amended.

The audit was conducted pursuant to the provisions of Contract MSPP-2014; The Patient
Protection and Affordable Care Act (Affordable Care Act); Title 45 Code of Federal Regulations
Chapter VIII, Part 800; and other applicable Federal regulations. Compliance with the contract
as well as laws and regulations applicable to the MSP Program is the responsibility of the Blue
Cross Blue Shield Association (Association) and Anthem Kentucky management. Additionally,
Anthem Kentucky management is responsible for establishing and maintaining a system of
internal controls and procedures. Due to inherent limitations in any system of internal controls,
errors or irregularities may nevertheless occur and not be detected.

The MSP Program was established by Section 1334 of the Affordable Care Act. Under the
Affordable Care Act, OPM was directed to contract with private health insurers to offer MSP
products in each state and the District of Columbia. MSP products may be phased in over four
years, with MSP products in at least 31 states in the first year; at least 36 states the second year;
at least 44 states the third year; and all 50 states and the District of Columbia in the fourth year.
OPM negotiates contracts with MSP Program Issuers, including rates and benefits, in
consultation with states and marketplaces. In addition, OPM will monitor the performance of
MSP Program Issuers and oversee compliance with legal requirements and contractual terms.
OPM’s office of National Healthcare Operations has overall responsibility for program
administration.

The Association, on behalf of participating Blue Cross Blue Shield (BCBS) plans, entered into a
contract with OPM to engage in the MSP Program. In accordance with requirements for the first
year of the MSP Program contract, participating plans offered 154 MSP options in 30 states and
the District of Columbia. Anthem Kentucky was 1 of 35 BCBS plans, or State-level issuers,
participating in the MSP Program in 2014.

The Association is a national federation of 37 independent, community-based and locally
operated BCBS companies. The Association grants licenses to independent companies to use the
trademarks and names in exclusive geographic areas. It operates and offers health care coverage
in all 50 states, the District of Columbia, and Puerto Rico, covering nearly 105 million



                                              1                               Report No. 1M-0B-00-15-024
Americans, and nationally, the Association contracts directly with more than 96 percent of
hospitals and 92 percent of professional providers.

Anthem, Inc. is an independent licensee of the Association serving nearly 71 million people with
its affiliated companies such as Anthem BCBS. Anthem BCBS is a Blue-licensed subsidiary of
Anthem, Inc. and operates in 12 states, including Kentucky as Anthem Kentucky. In addition to
offering the MSP options on Kentucky’s state-based marketplace, Kynect, Anthem Kentucky
offers other individual and family health plans, dental and vision plans, Medicare supplement
plans, and wellness programs.

This is our first audit of Anthem Kentucky’s MSP Program. We selected Anthem Kentucky
because Anthem is a large health insurance provider with MSP products in multiple states and
because Kentucky operates its own marketplace, which provided insight into the differences
between state-based and federally-facilitated marketplaces.

The preliminary results of this audit were discussed with Anthem Kentucky and the Association
officials at an exit conference and in subsequent correspondence. Since the audit concluded that
Anthem Kentucky’s operation of the MSP Program was in accordance with Contract MSPP-
2014 and applicable laws and regulations, we did not issue a draft report.

We would like to convey our appreciation to Anthem Kentucky and the Association for
accommodating us and cooperating fully throughout the entire audit process.




                                            2                             Report No. 1M-0B-00-15-024
 IV. MAJOR CONTRIBUTORS
 II. OBJECTIVES, SCOPE, AND TO THIS REPORT
                            METHODOLOGY

Objectives
The primary objective of this performance audit was to obtain reasonable assurance that Anthem
Kentucky was in compliance with the provisions of its contract with OPM and applicable laws
and regulations governing the MSP Program for contract year 2014. Specifically, we reviewed
enrollment, rates and benefits, reporting of significant actions and events, and data and
information security.

Scope and Methodology
We conducted this performance audit in accordance with generally accepted government
auditing standards. Those standards required that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions
based on our audit objectives.

The desk audit work was performed from April 20, 2015 through July 27, 2015 at our Cranberry
Township, Pennsylvania field office.

We obtained an understanding of Anthem Kentucky’s internal control structure, but we did not
use this information to determine the nature, timing, and extent of our audit procedures. Our
review of internal controls was limited to the procedures Anthem Kentucky had in place for
processing enrollment; ensuring best pricing in pharmacy rates; reconciling pharmacy pricing;
ensuring compliance with benefits offered in the Kentucky benchmark plan; preparing the
Summaries of Benefits and Coverage (SBC); reporting significant actions and events; protecting
Personally Identifiable Information (PII); and reporting information security breaches.

Specifically, we interviewed Anthem Kentucky personnel and reviewed policies and procedures
over its enrollment functions, including enrollment processing, reconciliations, and welcome kit
issuance. We also tested a judgmental sample of enrollment form 834s for auto-enrollment
errors, updates, cancellations, and terminations to determine if they were processed accurately.
Our judgmental sample included 46 form 834s (12 auto-enrollment errors, 25 updates, 6
cancellations, and 3 terminations) out of a universe of 1,902 form 834s from 2014. We assigned
a number to each error message or transaction description in the universe and used a random
number generator from Random.org to select our samples. This resulted in the selection of three
form 834s for each error message or transaction description that occurred more than 10 times for
auto-enrollment errors, cancellations, and terminations and five form 834s for each error
message or transaction description that occurred more than 25 times for enrollment updates. The
results from our sample were not projected to the sample universe.




                                            3                              Report No. 1M-0B-00-15-024
To gain an understanding of Anthem Kentucky’s internal controls over rates and benefits, we
interviewed Anthem Kentucky personnel and reviewed documentation to ensure that Anthem
Kentucky’s MSP options covered the appropriate essential health benefits and specific pharmacy
benefits for “Gastrointestinal Agents - Other” required by the contract and applicable laws and
regulations. We reviewed procedures and processes for preparing and posting the SBCs to
Kynect as well as support for corrective actions implemented for these processes as a result of
internal audit reports. In addition, we reviewed documentation supporting Anthem Kentucky’s
efforts to ensure best pricing with its pharmacy benefit manager (PBM), including pricing
reconciliations performed between Anthem Kentucky and the PBM as well as the results of a
third party best pricing review.

We reviewed notifications of significant actions and events that occurred in 2014 to verify that
Anthem Kentucky properly and timely reported the information to OPM in compliance with the
contract. We also reviewed corrective actions being taken by Anthem Kentucky to address the
significant events.

We reviewed Anthem Kentucky’s policies and procedures for protecting PII to verify if the
controls met the requirements stated within the OPM contract, but we did not test the
effectiveness of these policies and procedures. We also reviewed policies and procedures for
reporting security breaches as well as a notification of a 2014 security breach to verify that
Anthem Kentucky properly and timely reported the breach to OPM in compliance with the
contract. Finally, we reviewed any corrective actions taken by Anthem Kentucky in response to
the OPM/OIG Information System Audits Group report (Report # 1A-10-00-13-012, issued
September 10, 2013) to ensure corrective action has been taken to address the OIG’s
recommendations.

In conducting the audit, we relied to varying degrees on computer-generated data provided by
Anthem Kentucky and the Association. We did not verify the reliability of the data generated by
the various information systems involved. However, nothing came to our attention during our
audit utilizing the computer-generated data to cause us to doubt its reliability.




                                            4                             Report No. 1M-0B-00-15-024
                   III. RESULTS OF THE AUDIT

Overall, we concluded that Anthem Kentucky was in compliance with the provisions of its
contract with OPM and applicable laws and regulations governing the MSP Program for contract
year 2014. Specifically, the results of our reviews related to enrollment, rates and benefits,
reporting of significant actions and events, and data and information security showed that
Anthem Kentucky:

    	 Accurately processed a sample of enrollment actions, performed enrollment
       reconciliations on a regular basis, and implemented corrective actions to address
       timeliness issues with distributing welcome kits;

    	 offered MSP options that covered the appropriate essential health benefits and pharmacy
       benefits, generally prepared and posted accurate SBCs and implemented timely
       corrective actions where necessary, pursued best pricing with its PBM and regularly
       reconciled pharmacy pricing reports;

    	 timely reported significant actions and events to OPM and took corrective action, as
       necessary; and

    	 had policies and procedures in place to protect PII, properly and timely reported a 2014
       security breach to OPM, and responded to all of the recommendations from a prior OPM
       OIG audit report with corrective action plans to address the issues.

Because our audit disclosed no findings, this final report contains no recommendations.




                                            5	                            Report No. 1M-0B-00-15-024
 IV. MAJOR CONTRIBUTORS TO THIS REPORT

COMMUNITY-RATED AUDITS GROUP

             , Auditor-in-Charge

         , Auditor




            , Senior Team Leader

        , Group Chief




                                   6   Report No. 1M-0B-00-15-024
                                                                                                                         



                                       Report Fraud, Waste, and 

                                           Mismanagement 

                                                  Fraud, waste, and mismanagement in
                                               Government concerns everyone: Office of
                                                   the Inspector General staff, agency
                                                employees, and the general public. We
                                              actively solicit allegations of any inefficient
                                                    and wasteful practices, fraud, and
                                               mismanagement related to OPM programs
                                              and operations. You can report allegations
                                                          to us in several ways:


                        By Internet:               http://www.opm.gov/our-inspector-general/hotline-to-
                                                   report-fraud-waste-or-abuse


                         By Phone:                 Toll Free Number:                              (877) 499-7295
                                                   Washington Metro Area:                         (202) 606-2423


                           By Mail:                Office of the Inspector General
                                                   U.S. Office of Personnel Management
                                                   1900 E Street, NW
                                                   Room 6400
                                                   Washington, DC 20415-1100
                     
                                                                                                                         
                                                                                                                         




                                                             -- CAUTION --
This audit report has been distributed to Federal officials who are responsible for the administration of the audited program. This audit report may
contain proprietary data which is protected by Federal law (18 U.S.C. 1905). Therefore, while this audit report is available under the Freedom of
Information Act and made available to the public on the OIG webpage (http://www.opm.gov/our-inspector-general), caution needs to be exercised
before releasing the report to the general public as it may contain proprietary information that was redacted from the publicly distributed copy.

                                                                                                               Report No. 1M-0B-00-15-024