oversight

Multi-State Plan Program Operations at CareFirst BlueCross and BlueShield of the District of Columbia

Published by the Office of Personnel Management, Office of Inspector General on 2016-10-13.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

 U.S. OFFICE OF PERSONNEL MANAGEMENT
      OFFICE OF THE INSPECTOR GENERAL
              OFFICE OF AUDITS




                    Final Audit Report

                MULTI-STATE PLAN PROGRAM OPERATIONS
                 AT CAREFIRST BLUE CROSS BLUE SHIELD
                     OF THE DISTRICT OF COLUMBIA
                                               Report Number 1M-0E-00-16-028
                                                      October 13, 2016




                                                                -- CAUTION --
This audit report has been distributed to Federal officials who are responsible for the administration of the audited program. This audit report may
contain proprietary data which is protected by Federal law (18 U.S.C. 1905). Therefore, while this audit report is available under the Freedom of
Information Act and made available to the public on the OIG webpage (http://www.opm.gov/our-inspector-general), caution needs to be exercised before
releasing the report to the general public as it may contain proprietary information that was redacted from the publicly distributed copy.
             EXECUTIVE SUMMARY
                                Multi-State Plan Program Operations at
                      CareFirst Blue Cross Blue Shield of the District of Columbia
Report No. 1M-0E-00-16-028                                                                     October 13, 2016




Why Did We Conduct The Audit?            What Did We Find?

The primary objective of our audit       Our audit of the 2015 MSP Program operations at CareFirst DC
was to obtain reasonable assurance       disclosed no significant findings pertaining to enrollment, rates and
that CareFirst Blue Cross Blue Shield    benefits, quality improvement and patient safety standards, and
                                         data and information security. Accordingly, this final report
of the District of Columbia (CareFirst
                                         contains no recommendations.
DC) complied with the provisions of
Contract MSP-BCBS-2015-02
(Contract) and applicable Federal
regulations for contract year 2015.

What Did We Audit?

The Office of the Inspector General
has completed a performance audit of
the Multi-State Plan (MSP) Program
operations at CareFirst DC. Our audit
of CareFirst DC’s compliance with
the 2015 Contract and applicable
regulations was conducted from
April 25, 2016, through June 1, 2016,
at CareFirst DC’s offices in
Baltimore, Maryland, and our offices
in Cranberry Township,
Pennsylvania, and Washington, D.C.




 _______________________
 Michael R. Esser
 Assistant Inspector General
 for Audits
                                                       i
                      ABBREVIATIONS

Affordable Care Act   The Patient Protection and Affordable Care Act
Association           Blue Cross Blue Shield Association
BCBS                  Blue Cross Blue Shield
CareFirst DC          CareFirst Blue Cross Blue Shield of the District of Columbia
Contract              Contract MSP-BCBS-2015-02
MSP                   Multi-State Plan
OIG                   Office of the Inspector General
OPM                   U.S. Office of Personnel Management
PBM                   Pharmacy Benefit Manager
SHOP                  Small Business Health Options Program




                                       ii
IV. MAJOR CONTRIBUTORS TO THIS REPORT
          TABLE OF CONTENTS

                                                                                                                         Page 

          EXECUTIVE SUMMARY ......................................................................................... i 


          ABBREVIATIONS ..................................................................................................... ii 


  I.	     BACKGROUND ..........................................................................................................1 


  II.	    OBJECTIVES, SCOPE, AND METHODOLOGY ..................................................3 


  III.	   RESULTS OF THE AUDIT .......................................................................................5 


  IV.	    MAJOR CONTRIBUTORS TO THIS REPORT ....................................................6 


          REPORT FRAUD, WASTE, AND MISMANAGEMENT

IV. MAJOR CONTRIBUTORS
            I. BACKGROUND
                       TO THIS REPORT

This final report details the results of our performance audit of the Multi-State Plan (MSP)
Program operations at CareFirst Blue Cross Blue Shield of the District of Columbia (CareFirst
DC). The audit covered contract year 2015. It was performed by the U.S. Office of Personnel
Management's (OPM) Office of the Inspector General (OIG), as established by the Inspector
General Act of 1978, as amended.

The audit was conducted pursuant to the provisions of Contract MSP-BCBS-2015-02 (Contract);
The Patient Protection and Affordable Care Act (Affordable Care Act); Title 45 Code of Federal
Regulations Chapter VIII, Part 800; and other applicable Federal regulations. Compliance with
the contract as well as laws and regulations applicable to the MSP Program is the responsibility
of the Blue Cross Blue Shield Association (Association) and CareFirst DC’s management.
Additionally, CareFirst DC’s management is responsible for establishing and maintaining a
system of internal controls and procedures. Due to inherent limitations in any system of internal
controls, errors or irregularities may nevertheless occur and not be detected.

The MSP Program was established by Section 1334 of the Affordable Care Act. Under the
Affordable Care Act, OPM was directed to contract with private health insurers to offer MSP
products in each state and the District of Columbia. OPM negotiates contracts with MSP
Program Issuers, including rates and benefits, in consultation with states and marketplaces. In
addition, OPM will monitor the performance of MSP Program Issuers and oversee compliance
with legal requirements and contractual terms. OPM’s office of National Healthcare Operations
has overall responsibility for program administration.

The Association, on behalf of participating Blue Cross Blue Shield (BCBS) plans, entered into a
contract with OPM to participate in the MSP Program. Along with its participating licensees, the
Association offers 172 MSP options in 33 states and the District of Columbia. CareFirst DC was
1 of 38 BCBS plans, or State-Level Issuers, participating in the MSP Program in 2015.

The Association is a national federation of 36 independent, community-based and locally
operated BCBS companies. The Association grants licenses to independent companies to use the
trademarks and names in exclusive geographic areas. It operates and offers health care coverage
in all 50 states, the District of Columbia, and Puerto Rico, covering nearly 105 million
Americans, and nationally, the Association contracts directly with more than 96 percent of
hospitals and 92 percent of professional providers.

CareFirst, Inc. is a not-for-profit, non-stock health services company that offers, through its
affiliates and subsidiaries, a comprehensive portfolio of products to 3.2 million members in



                                             1                               Report No. 1M-0E-00-16-028
Maryland, the District of Columbia, and northern Virginia. One of CareFirst Inc.’s affiliates is
Group Hospitalization and Medical Services, Inc., which operates in the District of Columbia as
CareFirst BCBS. In 2015, CareFirst DC offered four MSPs on the marketplace, including two
Small Business Health Options Program (SHOP) plans.

This is our first audit of CareFirst DC’s MSP Program. The preliminary results of this audit
were discussed with CareFirst DC and the Association officials at an exit conference. Since the
audit concluded that CareFirst DC’s operation of the MSP Program was in accordance with the
Contract and applicable laws and regulations, we did not issue a draft report.

We would like to convey our appreciation to CareFirst DC and the Association for
accommodating us and cooperating fully throughout the entire audit process.




                                            2                             Report No. 1M-0E-00-16-028
IV. OBJECTIVES,
II.  MAJOR CONTRIBUTORS
                SCOPE, ANDTO THIS REPORT
                          METHODOLOGY

 Objective
 The primary objective of this performance audit was to obtain reasonable assurance that
 CareFirst DC was in compliance with the provisions of its contract with OPM and applicable
 laws and regulations governing the MSP Program for contract year 2015. Specifically, we
 reviewed enrollment, rates and benefits, quality improvement and patient safety standards, and
 data and information security.

 Scope and Methodology
 We conducted this performance audit in accordance with generally accepted government
 auditing standards. Those standards required that we plan and perform the audit to obtain
 sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions
 based on our audit objectives. We believe that the evidence obtained provides a reasonable basis
 for our findings and conclusions based on our audit objectives.

 The audit fieldwork was performed from April 25, 2016, through June 1, 2016, at CareFirst DC’s
 offices in Baltimore, Maryland, and our offices in Cranberry Township, Pennsylvania, and
 Washington, D.C.

 We obtained an understanding of CareFirst DC’s internal control structure and used this
 information to determine the nature, timing, and extent of our audit procedures. Our review of
 internal controls was limited to the procedures that CareFirst DC had in place for manually
 processing enrollment; pursuing best pricing and transparency with its Pharmacy Benefit
 Manager (PBM); ensuring compliance with required quality improvement and patient safety
 standards for hospitals; and disaster recovery planning.

 Specifically, we reviewed a judgmental sample of automated enrollment errors and escalated
 cases to determine if these actions were processed accurately. Our judgmental sample consisted
 of 17 automated enrollment errors out of a universe of 95 errors in 2015. We selected both of the
 errors associated with SHOP plans in 2015 since there were only two in the universe. Then, we
 assigned a number to each error in the universe for the individual market and used a random
 number generator from Random.org to select our samples, resulting in a judgmental sample of 15
 errors, or 17 total errors (SHOP and individual market). Similarly, for our judgmental sample of
 escalated cases, we assigned a number to each case in the universe and used a random number
 generator from Random.org to select our samples. This resulted in a judgmental sample of 20
 cases out of a universe of 247 cases from 2015. The results from our samples were not projected
 to the universe.




                                             3                             Report No. 1M-0E-00-16-028
To gain an understanding of CareFirst DC’s efforts to pursue best pricing and promote
transparency with its PBM, we interviewed CareFirst DC personnel about its procedures for
performing pricing and performance guarantee validations. We also reviewed PBM contract
language as well as information related to an on-going market check.

To evaluate CareFirst DC’s compliance with hospital quality improvement and patient safety
standards, we reviewed policies and procedures and standard hospital contract language as well
as hospital certification information maintained by CareFirst DC.

Finally, we reviewed CareFirst DC’s procedures for its disaster recovery program to verify that it
complied with program requirements outlined in the Contract.

In conducting the audit, we relied to varying degrees on computer-generated data provided by
CareFirst DC and the Association. We did not verify the reliability of the data generated by the
various information systems involved. However, nothing came to our attention during our audit
utilizing the computer-generated data to cause us to doubt its reliability.




                                            4                              Report No. 1M-0E-00-16-028
                III. RESULTS OF THE AUDIT

Overall, we concluded that CareFirst DC was in compliance with the provisions of the Contract
and applicable laws and regulations governing the MSP Program for contract year 2015.
Specifically, the results of our reviews related to enrollment, rates and benefits, quality
improvement and patient safety standards, and data and information security showed that
CareFirst DC:

    	 accurately processed automated enrollment errors and escalated enrollment cases;

    	 pursued best pricing with its PBM and promoted transparency in pricing in accordance
       with the Contract;

    	 complied with hospital quality improvement and patient safety standards based on the
       Contract and regulatory requirements; and

    	 had a disaster recovery plan in place to address requirements in the Contract.

Because our audit disclosed no findings, this final report contains no recommendations.




                                            5	                            Report No. 1M-0E-00-16-028
IV. MAJOR CONTRIBUTORS TO THIS REPORT

COMMUNITY-RATED AUDITS GROUP

             , Auditor-in-Charge

         , Lead Auditor

             , Auditor




            , Senior Team Leader

             , Group Chief




                                   6   Report No. 1M-0E-00-16-028
                                                                                                                         



                                       Report Fraud, Waste, and
                                           Mismanagement 

                                                  Fraud, waste, and mismanagement in
                                               Government concerns everyone: Office of
                                                   the Inspector General staff, agency
                                                employees, and the general public. We
                                              actively solicit allegations of any inefficient
                                                    and wasteful practices, fraud, and
                                               mismanagement related to OPM programs
                                              and operations. You can report allegations
                                                          to us in several ways:


                        By Internet:               http://www.opm.gov/our-inspector-general/hotline-to-
                                                   report-fraud-waste-or-abuse


                         By Phone:                 Toll Free Number:                              (877) 499-7295
                                                   Washington Metro Area:                         (202) 606-2423


                           By Mail:                Office of the Inspector General
                                                   U.S. Office of Personnel Management
                                                   1900 E Street, NW
                                                   Room 6400
                                                   Washington, DC 20415-1100
                     
                                                                                                                         
                                                                                                                         




                                                             -- CAUTION --
This audit report has been distributed to Federal officials who are responsible for the administration of the audited program. This audit report may
contain proprietary data which is protected by Federal law (18 U.S.C. 1905). Therefore, while this audit report is available under the Freedom of
Information Act and made available to the public on the OIG webpage (http://www.opm.gov/our-inspector-general), caution needs to be exercised
before releasing the report to the general public as it may contain proprietary information that was redacted from the publicly distributed copy.

                                                                                                               Report No. 1M-0E-00-16-028