U.S. OFFICE OF PERSONNEL MANAGEMENT
OFFICE OF THE INSPECTOR GENERAL
OFFICE OF AUDITS
Final Audit Report
MULTI-STATE PLAN PROGRAM OPERATIONS
AT CAREFIRST BLUE CROSS BLUE SHIELD
OF THE DISTRICT OF COLUMBIA
Report Number 1M-0E-00-16-028
October 13, 2016
-- CAUTION --
This audit report has been distributed to Federal officials who are responsible for the administration of the audited program. This audit report may
contain proprietary data which is protected by Federal law (18 U.S.C. 1905). Therefore, while this audit report is available under the Freedom of
Information Act and made available to the public on the OIG webpage (http://www.opm.gov/our-inspector-general), caution needs to be exercised before
releasing the report to the general public as it may contain proprietary information that was redacted from the publicly distributed copy.
EXECUTIVE SUMMARY
Multi-State Plan Program Operations at
CareFirst Blue Cross Blue Shield of the District of Columbia
Report No. 1M-0E-00-16-028 October 13, 2016
Why Did We Conduct The Audit? What Did We Find?
The primary objective of our audit Our audit of the 2015 MSP Program operations at CareFirst DC
was to obtain reasonable assurance disclosed no significant findings pertaining to enrollment, rates and
that CareFirst Blue Cross Blue Shield benefits, quality improvement and patient safety standards, and
data and information security. Accordingly, this final report
of the District of Columbia (CareFirst
contains no recommendations.
DC) complied with the provisions of
Contract MSP-BCBS-2015-02
(Contract) and applicable Federal
regulations for contract year 2015.
What Did We Audit?
The Office of the Inspector General
has completed a performance audit of
the Multi-State Plan (MSP) Program
operations at CareFirst DC. Our audit
of CareFirst DC’s compliance with
the 2015 Contract and applicable
regulations was conducted from
April 25, 2016, through June 1, 2016,
at CareFirst DC’s offices in
Baltimore, Maryland, and our offices
in Cranberry Township,
Pennsylvania, and Washington, D.C.
_______________________
Michael R. Esser
Assistant Inspector General
for Audits
i
ABBREVIATIONS
Affordable Care Act The Patient Protection and Affordable Care Act
Association Blue Cross Blue Shield Association
BCBS Blue Cross Blue Shield
CareFirst DC CareFirst Blue Cross Blue Shield of the District of Columbia
Contract Contract MSP-BCBS-2015-02
MSP Multi-State Plan
OIG Office of the Inspector General
OPM U.S. Office of Personnel Management
PBM Pharmacy Benefit Manager
SHOP Small Business Health Options Program
ii
IV. MAJOR CONTRIBUTORS TO THIS REPORT
TABLE OF CONTENTS
Page
EXECUTIVE SUMMARY ......................................................................................... i
ABBREVIATIONS ..................................................................................................... ii
I. BACKGROUND ..........................................................................................................1
II. OBJECTIVES, SCOPE, AND METHODOLOGY ..................................................3
III. RESULTS OF THE AUDIT .......................................................................................5
IV. MAJOR CONTRIBUTORS TO THIS REPORT ....................................................6
REPORT FRAUD, WASTE, AND MISMANAGEMENT
IV. MAJOR CONTRIBUTORS
I. BACKGROUND
TO THIS REPORT
This final report details the results of our performance audit of the Multi-State Plan (MSP)
Program operations at CareFirst Blue Cross Blue Shield of the District of Columbia (CareFirst
DC). The audit covered contract year 2015. It was performed by the U.S. Office of Personnel
Management's (OPM) Office of the Inspector General (OIG), as established by the Inspector
General Act of 1978, as amended.
The audit was conducted pursuant to the provisions of Contract MSP-BCBS-2015-02 (Contract);
The Patient Protection and Affordable Care Act (Affordable Care Act); Title 45 Code of Federal
Regulations Chapter VIII, Part 800; and other applicable Federal regulations. Compliance with
the contract as well as laws and regulations applicable to the MSP Program is the responsibility
of the Blue Cross Blue Shield Association (Association) and CareFirst DC’s management.
Additionally, CareFirst DC’s management is responsible for establishing and maintaining a
system of internal controls and procedures. Due to inherent limitations in any system of internal
controls, errors or irregularities may nevertheless occur and not be detected.
The MSP Program was established by Section 1334 of the Affordable Care Act. Under the
Affordable Care Act, OPM was directed to contract with private health insurers to offer MSP
products in each state and the District of Columbia. OPM negotiates contracts with MSP
Program Issuers, including rates and benefits, in consultation with states and marketplaces. In
addition, OPM will monitor the performance of MSP Program Issuers and oversee compliance
with legal requirements and contractual terms. OPM’s office of National Healthcare Operations
has overall responsibility for program administration.
The Association, on behalf of participating Blue Cross Blue Shield (BCBS) plans, entered into a
contract with OPM to participate in the MSP Program. Along with its participating licensees, the
Association offers 172 MSP options in 33 states and the District of Columbia. CareFirst DC was
1 of 38 BCBS plans, or State-Level Issuers, participating in the MSP Program in 2015.
The Association is a national federation of 36 independent, community-based and locally
operated BCBS companies. The Association grants licenses to independent companies to use the
trademarks and names in exclusive geographic areas. It operates and offers health care coverage
in all 50 states, the District of Columbia, and Puerto Rico, covering nearly 105 million
Americans, and nationally, the Association contracts directly with more than 96 percent of
hospitals and 92 percent of professional providers.
CareFirst, Inc. is a not-for-profit, non-stock health services company that offers, through its
affiliates and subsidiaries, a comprehensive portfolio of products to 3.2 million members in
1 Report No. 1M-0E-00-16-028
Maryland, the District of Columbia, and northern Virginia. One of CareFirst Inc.’s affiliates is
Group Hospitalization and Medical Services, Inc., which operates in the District of Columbia as
CareFirst BCBS. In 2015, CareFirst DC offered four MSPs on the marketplace, including two
Small Business Health Options Program (SHOP) plans.
This is our first audit of CareFirst DC’s MSP Program. The preliminary results of this audit
were discussed with CareFirst DC and the Association officials at an exit conference. Since the
audit concluded that CareFirst DC’s operation of the MSP Program was in accordance with the
Contract and applicable laws and regulations, we did not issue a draft report.
We would like to convey our appreciation to CareFirst DC and the Association for
accommodating us and cooperating fully throughout the entire audit process.
2 Report No. 1M-0E-00-16-028
IV. OBJECTIVES,
II. MAJOR CONTRIBUTORS
SCOPE, ANDTO THIS REPORT
METHODOLOGY
Objective
The primary objective of this performance audit was to obtain reasonable assurance that
CareFirst DC was in compliance with the provisions of its contract with OPM and applicable
laws and regulations governing the MSP Program for contract year 2015. Specifically, we
reviewed enrollment, rates and benefits, quality improvement and patient safety standards, and
data and information security.
Scope and Methodology
We conducted this performance audit in accordance with generally accepted government
auditing standards. Those standards required that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions
based on our audit objectives. We believe that the evidence obtained provides a reasonable basis
for our findings and conclusions based on our audit objectives.
The audit fieldwork was performed from April 25, 2016, through June 1, 2016, at CareFirst DC’s
offices in Baltimore, Maryland, and our offices in Cranberry Township, Pennsylvania, and
Washington, D.C.
We obtained an understanding of CareFirst DC’s internal control structure and used this
information to determine the nature, timing, and extent of our audit procedures. Our review of
internal controls was limited to the procedures that CareFirst DC had in place for manually
processing enrollment; pursuing best pricing and transparency with its Pharmacy Benefit
Manager (PBM); ensuring compliance with required quality improvement and patient safety
standards for hospitals; and disaster recovery planning.
Specifically, we reviewed a judgmental sample of automated enrollment errors and escalated
cases to determine if these actions were processed accurately. Our judgmental sample consisted
of 17 automated enrollment errors out of a universe of 95 errors in 2015. We selected both of the
errors associated with SHOP plans in 2015 since there were only two in the universe. Then, we
assigned a number to each error in the universe for the individual market and used a random
number generator from Random.org to select our samples, resulting in a judgmental sample of 15
errors, or 17 total errors (SHOP and individual market). Similarly, for our judgmental sample of
escalated cases, we assigned a number to each case in the universe and used a random number
generator from Random.org to select our samples. This resulted in a judgmental sample of 20
cases out of a universe of 247 cases from 2015. The results from our samples were not projected
to the universe.
3 Report No. 1M-0E-00-16-028
To gain an understanding of CareFirst DC’s efforts to pursue best pricing and promote
transparency with its PBM, we interviewed CareFirst DC personnel about its procedures for
performing pricing and performance guarantee validations. We also reviewed PBM contract
language as well as information related to an on-going market check.
To evaluate CareFirst DC’s compliance with hospital quality improvement and patient safety
standards, we reviewed policies and procedures and standard hospital contract language as well
as hospital certification information maintained by CareFirst DC.
Finally, we reviewed CareFirst DC’s procedures for its disaster recovery program to verify that it
complied with program requirements outlined in the Contract.
In conducting the audit, we relied to varying degrees on computer-generated data provided by
CareFirst DC and the Association. We did not verify the reliability of the data generated by the
various information systems involved. However, nothing came to our attention during our audit
utilizing the computer-generated data to cause us to doubt its reliability.
4 Report No. 1M-0E-00-16-028
III. RESULTS OF THE AUDIT
Overall, we concluded that CareFirst DC was in compliance with the provisions of the Contract
and applicable laws and regulations governing the MSP Program for contract year 2015.
Specifically, the results of our reviews related to enrollment, rates and benefits, quality
improvement and patient safety standards, and data and information security showed that
CareFirst DC:
accurately processed automated enrollment errors and escalated enrollment cases;
pursued best pricing with its PBM and promoted transparency in pricing in accordance
with the Contract;
complied with hospital quality improvement and patient safety standards based on the
Contract and regulatory requirements; and
had a disaster recovery plan in place to address requirements in the Contract.
Because our audit disclosed no findings, this final report contains no recommendations.
5 Report No. 1M-0E-00-16-028
IV. MAJOR CONTRIBUTORS TO THIS REPORT
COMMUNITY-RATED AUDITS GROUP
, Auditor-in-Charge
, Lead Auditor
, Auditor
, Senior Team Leader
, Group Chief
6 Report No. 1M-0E-00-16-028
Report Fraud, Waste, and
Mismanagement
Fraud, waste, and mismanagement in
Government concerns everyone: Office of
the Inspector General staff, agency
employees, and the general public. We
actively solicit allegations of any inefficient
and wasteful practices, fraud, and
mismanagement related to OPM programs
and operations. You can report allegations
to us in several ways:
By Internet: http://www.opm.gov/our-inspector-general/hotline-to-
report-fraud-waste-or-abuse
By Phone: Toll Free Number: (877) 499-7295
Washington Metro Area: (202) 606-2423
By Mail: Office of the Inspector General
U.S. Office of Personnel Management
1900 E Street, NW
Room 6400
Washington, DC 20415-1100
-- CAUTION --
This audit report has been distributed to Federal officials who are responsible for the administration of the audited program. This audit report may
contain proprietary data which is protected by Federal law (18 U.S.C. 1905). Therefore, while this audit report is available under the Freedom of
Information Act and made available to the public on the OIG webpage (http://www.opm.gov/our-inspector-general), caution needs to be exercised
before releasing the report to the general public as it may contain proprietary information that was redacted from the publicly distributed copy.
Report No. 1M-0E-00-16-028
Multi-State Plan Program Operations at CareFirst BlueCross and BlueShield of the District of Columbia
Published by the Office of Personnel Management, Office of Inspector General on 2016-10-13.
Below is a raw (and likely hideous) rendition of the original report. (PDF)