U.S. OFFICE OF PERSONNEL MANAGEMENT OFFICE OF THE INSPECTOR GENERAL OFFICE OF AUDITS Final Audit Report MULTI-STATE PLAN PROGRAM OPERATIONS AT ANTHEM BLUE CROSS BLUE SHIELD OF KENTUCKY Report Number 1M-0B-00-15-024 October 28, 2015 -- CAUTION -- This audit report has been distributed to Federal officials who are responsible for the administration of the audited program. This audit report may contain proprietary data which is protected by Federal law (18 U.S.C. 1905). Therefore, while this audit report is available under the Freedom of Information Act and made available to the public on the OIG webpage (http://www.opm.gov/our-inspector-general), caution needs to be exercised before releasing the report to the general public as it may contain proprietary information that was redacted from the publicly distributed copy. EXECUTIVE SUMMARY Multi-State Plan Program Operations at Anthem Blue Cross Blue Shield of Kentucky Report No. 1M-0B-00-15-024 October 28, 2015 Why Did We Conduct The Audit? What Did We Find? The primary objective of our audit Our audit of the 2014 MSP Program operations at Anthem was to obtain reasonable assurance Kentucky disclosed no significant findings pertaining to that Anthem Blue Cross Blue Shield enrollment, rates and benefits, reporting of significant actions and events, and data and information security. Accordingly, this final of Kentucky (Anthem Kentucky) report contains no recommendations. complied with the provisions of Contract MSPP-2014 and applicable Federal regulations for contract year 2014. What Did We Audit? . The Office of the Inspector General has completed a performance audit of the Multi-State Plan (MSP) Program operations at Anthem Kentucky. Our desk audit covered contract year 2014 and was conducted from April 20, 2015 through July 27, 2015 at our field office in Cranberry Township, Pennsylvania. _______________________ Michael R. Esser Assistant Inspector General for Audits i ABBREVIATIONS Affordable Care Act The Patient Protection and Affordable Care Act Anthem Kentucky Anthem Blue Cross Blue Shield of Kentucky Association Blue Cross Blue Shield Association BCBS Blue Cross Blue Shield MSP Multi-State Plan OIG Office of the Inspector General OPM U.S. Office of Personnel Management PBM Pharmacy Benefit Manager SBC Summary of Benefits and Coverage ii IV. MAJOR CONTRIBUTORS TO THIS REPORT TABLE OF CONTENTS Page EXECUTIVE SUMMARY ......................................................................................... i ABBREVIATIONS ..................................................................................................... ii I. BACKGROUND ..........................................................................................................1 II. OBJECTIVES, SCOPE, AND METHODOLOGY ..................................................3 III. RESULTS OF THE AUDIT .......................................................................................5 IV. MAJOR CONTRIBUTORS TO THIS REPORT ....................................................6 REPORT FRAUD, WASTE, AND MISMANAGEMENT IV. MAJOR CONTRIBUTORS I. BACKGROUND TO THIS REPORT This final report details the results of our performance audit of the Multi-State Plan (MSP) Program operations at Anthem Blue Cross Blue Shield of Kentucky (Anthem Kentucky). The desk audit covered contract year 2014 and was conducted at our field office in Cranberry Township, Pennsylvania. It was performed by the U.S. Office of Personnel Management's (OPM) Office of the Inspector General (OIG), as established by the Inspector General Act of 1978, as amended. The audit was conducted pursuant to the provisions of Contract MSPP-2014; The Patient Protection and Affordable Care Act (Affordable Care Act); Title 45 Code of Federal Regulations Chapter VIII, Part 800; and other applicable Federal regulations. Compliance with the contract as well as laws and regulations applicable to the MSP Program is the responsibility of the Blue Cross Blue Shield Association (Association) and Anthem Kentucky management. Additionally, Anthem Kentucky management is responsible for establishing and maintaining a system of internal controls and procedures. Due to inherent limitations in any system of internal controls, errors or irregularities may nevertheless occur and not be detected. The MSP Program was established by Section 1334 of the Affordable Care Act. Under the Affordable Care Act, OPM was directed to contract with private health insurers to offer MSP products in each state and the District of Columbia. MSP products may be phased in over four years, with MSP products in at least 31 states in the first year; at least 36 states the second year; at least 44 states the third year; and all 50 states and the District of Columbia in the fourth year. OPM negotiates contracts with MSP Program Issuers, including rates and benefits, in consultation with states and marketplaces. In addition, OPM will monitor the performance of MSP Program Issuers and oversee compliance with legal requirements and contractual terms. OPM’s office of National Healthcare Operations has overall responsibility for program administration. The Association, on behalf of participating Blue Cross Blue Shield (BCBS) plans, entered into a contract with OPM to engage in the MSP Program. In accordance with requirements for the first year of the MSP Program contract, participating plans offered 154 MSP options in 30 states and the District of Columbia. Anthem Kentucky was 1 of 35 BCBS plans, or State-level issuers, participating in the MSP Program in 2014. The Association is a national federation of 37 independent, community-based and locally operated BCBS companies. The Association grants licenses to independent companies to use the trademarks and names in exclusive geographic areas. It operates and offers health care coverage in all 50 states, the District of Columbia, and Puerto Rico, covering nearly 105 million 1 Report No. 1M-0B-00-15-024 Americans, and nationally, the Association contracts directly with more than 96 percent of hospitals and 92 percent of professional providers. Anthem, Inc. is an independent licensee of the Association serving nearly 71 million people with its affiliated companies such as Anthem BCBS. Anthem BCBS is a Blue-licensed subsidiary of Anthem, Inc. and operates in 12 states, including Kentucky as Anthem Kentucky. In addition to offering the MSP options on Kentucky’s state-based marketplace, Kynect, Anthem Kentucky offers other individual and family health plans, dental and vision plans, Medicare supplement plans, and wellness programs. This is our first audit of Anthem Kentucky’s MSP Program. We selected Anthem Kentucky because Anthem is a large health insurance provider with MSP products in multiple states and because Kentucky operates its own marketplace, which provided insight into the differences between state-based and federally-facilitated marketplaces. The preliminary results of this audit were discussed with Anthem Kentucky and the Association officials at an exit conference and in subsequent correspondence. Since the audit concluded that Anthem Kentucky’s operation of the MSP Program was in accordance with Contract MSPP- 2014 and applicable laws and regulations, we did not issue a draft report. We would like to convey our appreciation to Anthem Kentucky and the Association for accommodating us and cooperating fully throughout the entire audit process. 2 Report No. 1M-0B-00-15-024 IV. MAJOR CONTRIBUTORS II. OBJECTIVES, SCOPE, AND TO THIS REPORT METHODOLOGY Objectives The primary objective of this performance audit was to obtain reasonable assurance that Anthem Kentucky was in compliance with the provisions of its contract with OPM and applicable laws and regulations governing the MSP Program for contract year 2014. Specifically, we reviewed enrollment, rates and benefits, reporting of significant actions and events, and data and information security. Scope and Methodology We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards required that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. The desk audit work was performed from April 20, 2015 through July 27, 2015 at our Cranberry Township, Pennsylvania field office. We obtained an understanding of Anthem Kentucky’s internal control structure, but we did not use this information to determine the nature, timing, and extent of our audit procedures. Our review of internal controls was limited to the procedures Anthem Kentucky had in place for processing enrollment; ensuring best pricing in pharmacy rates; reconciling pharmacy pricing; ensuring compliance with benefits offered in the Kentucky benchmark plan; preparing the Summaries of Benefits and Coverage (SBC); reporting significant actions and events; protecting Personally Identifiable Information (PII); and reporting information security breaches. Specifically, we interviewed Anthem Kentucky personnel and reviewed policies and procedures over its enrollment functions, including enrollment processing, reconciliations, and welcome kit issuance. We also tested a judgmental sample of enrollment form 834s for auto-enrollment errors, updates, cancellations, and terminations to determine if they were processed accurately. Our judgmental sample included 46 form 834s (12 auto-enrollment errors, 25 updates, 6 cancellations, and 3 terminations) out of a universe of 1,902 form 834s from 2014. We assigned a number to each error message or transaction description in the universe and used a random number generator from Random.org to select our samples. This resulted in the selection of three form 834s for each error message or transaction description that occurred more than 10 times for auto-enrollment errors, cancellations, and terminations and five form 834s for each error message or transaction description that occurred more than 25 times for enrollment updates. The results from our sample were not projected to the sample universe. 3 Report No. 1M-0B-00-15-024 To gain an understanding of Anthem Kentucky’s internal controls over rates and benefits, we interviewed Anthem Kentucky personnel and reviewed documentation to ensure that Anthem Kentucky’s MSP options covered the appropriate essential health benefits and specific pharmacy benefits for “Gastrointestinal Agents - Other” required by the contract and applicable laws and regulations. We reviewed procedures and processes for preparing and posting the SBCs to Kynect as well as support for corrective actions implemented for these processes as a result of internal audit reports. In addition, we reviewed documentation supporting Anthem Kentucky’s efforts to ensure best pricing with its pharmacy benefit manager (PBM), including pricing reconciliations performed between Anthem Kentucky and the PBM as well as the results of a third party best pricing review. We reviewed notifications of significant actions and events that occurred in 2014 to verify that Anthem Kentucky properly and timely reported the information to OPM in compliance with the contract. We also reviewed corrective actions being taken by Anthem Kentucky to address the significant events. We reviewed Anthem Kentucky’s policies and procedures for protecting PII to verify if the controls met the requirements stated within the OPM contract, but we did not test the effectiveness of these policies and procedures. We also reviewed policies and procedures for reporting security breaches as well as a notification of a 2014 security breach to verify that Anthem Kentucky properly and timely reported the breach to OPM in compliance with the contract. Finally, we reviewed any corrective actions taken by Anthem Kentucky in response to the OPM/OIG Information System Audits Group report (Report # 1A-10-00-13-012, issued September 10, 2013) to ensure corrective action has been taken to address the OIG’s recommendations. In conducting the audit, we relied to varying degrees on computer-generated data provided by Anthem Kentucky and the Association. We did not verify the reliability of the data generated by the various information systems involved. However, nothing came to our attention during our audit utilizing the computer-generated data to cause us to doubt its reliability. 4 Report No. 1M-0B-00-15-024 III. RESULTS OF THE AUDIT Overall, we concluded that Anthem Kentucky was in compliance with the provisions of its contract with OPM and applicable laws and regulations governing the MSP Program for contract year 2014. Specifically, the results of our reviews related to enrollment, rates and benefits, reporting of significant actions and events, and data and information security showed that Anthem Kentucky: Accurately processed a sample of enrollment actions, performed enrollment reconciliations on a regular basis, and implemented corrective actions to address timeliness issues with distributing welcome kits; offered MSP options that covered the appropriate essential health benefits and pharmacy benefits, generally prepared and posted accurate SBCs and implemented timely corrective actions where necessary, pursued best pricing with its PBM and regularly reconciled pharmacy pricing reports; timely reported significant actions and events to OPM and took corrective action, as necessary; and had policies and procedures in place to protect PII, properly and timely reported a 2014 security breach to OPM, and responded to all of the recommendations from a prior OPM OIG audit report with corrective action plans to address the issues. Because our audit disclosed no findings, this final report contains no recommendations. 5 Report No. 1M-0B-00-15-024 IV. MAJOR CONTRIBUTORS TO THIS REPORT COMMUNITY-RATED AUDITS GROUP , Auditor-in-Charge , Auditor , Senior Team Leader , Group Chief 6 Report No. 1M-0B-00-15-024 Report Fraud, Waste, and Mismanagement Fraud, waste, and mismanagement in Government concerns everyone: Office of the Inspector General staff, agency employees, and the general public. We actively solicit allegations of any inefficient and wasteful practices, fraud, and mismanagement related to OPM programs and operations. You can report allegations to us in several ways: By Internet: http://www.opm.gov/our-inspector-general/hotline-to- report-fraud-waste-or-abuse By Phone: Toll Free Number: (877) 499-7295 Washington Metro Area: (202) 606-2423 By Mail: Office of the Inspector General U.S. Office of Personnel Management 1900 E Street, NW Room 6400 Washington, DC 20415-1100 -- CAUTION -- This audit report has been distributed to Federal officials who are responsible for the administration of the audited program. This audit report may contain proprietary data which is protected by Federal law (18 U.S.C. 1905). Therefore, while this audit report is available under the Freedom of Information Act and made available to the public on the OIG webpage (http://www.opm.gov/our-inspector-general), caution needs to be exercised before releasing the report to the general public as it may contain proprietary information that was redacted from the publicly distributed copy. Report No. 1M-0B-00-15-024
Multi-State Plan Program Operations at Anthem Blue Cross Blue Shield of Kentucky
Published by the Office of Personnel Management, Office of Inspector General on 2015-10-28.
Below is a raw (and likely hideous) rendition of the original report. (PDF)