U.S. OFFICE OF PERSONNEL MANAGEMENT OFFICE OF THE INSPECTOR GENERAL OFFICE OF AUDITS Final Audit Report MULTI-STATE PLAN PROGRAM OPERATIONS AT CAREFIRST BLUE CROSS BLUE SHIELD OF THE DISTRICT OF COLUMBIA Report Number 1M-0E-00-16-028 October 13, 2016 -- CAUTION -- This audit report has been distributed to Federal officials who are responsible for the administration of the audited program. This audit report may contain proprietary data which is protected by Federal law (18 U.S.C. 1905). Therefore, while this audit report is available under the Freedom of Information Act and made available to the public on the OIG webpage (http://www.opm.gov/our-inspector-general), caution needs to be exercised before releasing the report to the general public as it may contain proprietary information that was redacted from the publicly distributed copy. EXECUTIVE SUMMARY Multi-State Plan Program Operations at CareFirst Blue Cross Blue Shield of the District of Columbia Report No. 1M-0E-00-16-028 October 13, 2016 Why Did We Conduct The Audit? What Did We Find? The primary objective of our audit Our audit of the 2015 MSP Program operations at CareFirst DC was to obtain reasonable assurance disclosed no significant findings pertaining to enrollment, rates and that CareFirst Blue Cross Blue Shield benefits, quality improvement and patient safety standards, and data and information security. Accordingly, this final report of the District of Columbia (CareFirst contains no recommendations. DC) complied with the provisions of Contract MSP-BCBS-2015-02 (Contract) and applicable Federal regulations for contract year 2015. What Did We Audit? The Office of the Inspector General has completed a performance audit of the Multi-State Plan (MSP) Program operations at CareFirst DC. Our audit of CareFirst DC’s compliance with the 2015 Contract and applicable regulations was conducted from April 25, 2016, through June 1, 2016, at CareFirst DC’s offices in Baltimore, Maryland, and our offices in Cranberry Township, Pennsylvania, and Washington, D.C. _______________________ Michael R. Esser Assistant Inspector General for Audits i ABBREVIATIONS Affordable Care Act The Patient Protection and Affordable Care Act Association Blue Cross Blue Shield Association BCBS Blue Cross Blue Shield CareFirst DC CareFirst Blue Cross Blue Shield of the District of Columbia Contract Contract MSP-BCBS-2015-02 MSP Multi-State Plan OIG Office of the Inspector General OPM U.S. Office of Personnel Management PBM Pharmacy Benefit Manager SHOP Small Business Health Options Program ii IV. MAJOR CONTRIBUTORS TO THIS REPORT TABLE OF CONTENTS Page EXECUTIVE SUMMARY ......................................................................................... i ABBREVIATIONS ..................................................................................................... ii I. BACKGROUND ..........................................................................................................1 II. OBJECTIVES, SCOPE, AND METHODOLOGY ..................................................3 III. RESULTS OF THE AUDIT .......................................................................................5 IV. MAJOR CONTRIBUTORS TO THIS REPORT ....................................................6 REPORT FRAUD, WASTE, AND MISMANAGEMENT IV. MAJOR CONTRIBUTORS I. BACKGROUND TO THIS REPORT This final report details the results of our performance audit of the Multi-State Plan (MSP) Program operations at CareFirst Blue Cross Blue Shield of the District of Columbia (CareFirst DC). The audit covered contract year 2015. It was performed by the U.S. Office of Personnel Management's (OPM) Office of the Inspector General (OIG), as established by the Inspector General Act of 1978, as amended. The audit was conducted pursuant to the provisions of Contract MSP-BCBS-2015-02 (Contract); The Patient Protection and Affordable Care Act (Affordable Care Act); Title 45 Code of Federal Regulations Chapter VIII, Part 800; and other applicable Federal regulations. Compliance with the contract as well as laws and regulations applicable to the MSP Program is the responsibility of the Blue Cross Blue Shield Association (Association) and CareFirst DC’s management. Additionally, CareFirst DC’s management is responsible for establishing and maintaining a system of internal controls and procedures. Due to inherent limitations in any system of internal controls, errors or irregularities may nevertheless occur and not be detected. The MSP Program was established by Section 1334 of the Affordable Care Act. Under the Affordable Care Act, OPM was directed to contract with private health insurers to offer MSP products in each state and the District of Columbia. OPM negotiates contracts with MSP Program Issuers, including rates and benefits, in consultation with states and marketplaces. In addition, OPM will monitor the performance of MSP Program Issuers and oversee compliance with legal requirements and contractual terms. OPM’s office of National Healthcare Operations has overall responsibility for program administration. The Association, on behalf of participating Blue Cross Blue Shield (BCBS) plans, entered into a contract with OPM to participate in the MSP Program. Along with its participating licensees, the Association offers 172 MSP options in 33 states and the District of Columbia. CareFirst DC was 1 of 38 BCBS plans, or State-Level Issuers, participating in the MSP Program in 2015. The Association is a national federation of 36 independent, community-based and locally operated BCBS companies. The Association grants licenses to independent companies to use the trademarks and names in exclusive geographic areas. It operates and offers health care coverage in all 50 states, the District of Columbia, and Puerto Rico, covering nearly 105 million Americans, and nationally, the Association contracts directly with more than 96 percent of hospitals and 92 percent of professional providers. CareFirst, Inc. is a not-for-profit, non-stock health services company that offers, through its affiliates and subsidiaries, a comprehensive portfolio of products to 3.2 million members in 1 Report No. 1M-0E-00-16-028 Maryland, the District of Columbia, and northern Virginia. One of CareFirst Inc.’s affiliates is Group Hospitalization and Medical Services, Inc., which operates in the District of Columbia as CareFirst BCBS. In 2015, CareFirst DC offered four MSPs on the marketplace, including two Small Business Health Options Program (SHOP) plans. This is our first audit of CareFirst DC’s MSP Program. The preliminary results of this audit were discussed with CareFirst DC and the Association officials at an exit conference. Since the audit concluded that CareFirst DC’s operation of the MSP Program was in accordance with the Contract and applicable laws and regulations, we did not issue a draft report. We would like to convey our appreciation to CareFirst DC and the Association for accommodating us and cooperating fully throughout the entire audit process. 2 Report No. 1M-0E-00-16-028 IV. OBJECTIVES, II. MAJOR CONTRIBUTORS SCOPE, ANDTO THIS REPORT METHODOLOGY Objective The primary objective of this performance audit was to obtain reasonable assurance that CareFirst DC was in compliance with the provisions of its contract with OPM and applicable laws and regulations governing the MSP Program for contract year 2015. Specifically, we reviewed enrollment, rates and benefits, quality improvement and patient safety standards, and data and information security. Scope and Methodology We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards required that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The audit fieldwork was performed from April 25, 2016, through June 1, 2016, at CareFirst DC’s offices in Baltimore, Maryland, and our offices in Cranberry Township, Pennsylvania, and Washington, D.C. We obtained an understanding of CareFirst DC’s internal control structure and used this information to determine the nature, timing, and extent of our audit procedures. Our review of internal controls was limited to the procedures that CareFirst DC had in place for manually processing enrollment; pursuing best pricing and transparency with its Pharmacy Benefit Manager (PBM); ensuring compliance with required quality improvement and patient safety standards for hospitals; and disaster recovery planning. Specifically, we reviewed a judgmental sample of automated enrollment errors and escalated cases to determine if these actions were processed accurately. Our judgmental sample consisted of 17 automated enrollment errors out of a universe of 95 errors in 2015. We selected both of the errors associated with SHOP plans in 2015 since there were only two in the universe. Then, we assigned a number to each error in the universe for the individual market and used a random number generator from Random.org to select our samples, resulting in a judgmental sample of 15 errors, or 17 total errors (SHOP and individual market). Similarly, for our judgmental sample of escalated cases, we assigned a number to each case in the universe and used a random number generator from Random.org to select our samples. This resulted in a judgmental sample of 20 cases out of a universe of 247 cases from 2015. The results from our samples were not projected to the universe. 3 Report No. 1M-0E-00-16-028 To gain an understanding of CareFirst DC’s efforts to pursue best pricing and promote transparency with its PBM, we interviewed CareFirst DC personnel about its procedures for performing pricing and performance guarantee validations. We also reviewed PBM contract language as well as information related to an on-going market check. To evaluate CareFirst DC’s compliance with hospital quality improvement and patient safety standards, we reviewed policies and procedures and standard hospital contract language as well as hospital certification information maintained by CareFirst DC. Finally, we reviewed CareFirst DC’s procedures for its disaster recovery program to verify that it complied with program requirements outlined in the Contract. In conducting the audit, we relied to varying degrees on computer-generated data provided by CareFirst DC and the Association. We did not verify the reliability of the data generated by the various information systems involved. However, nothing came to our attention during our audit utilizing the computer-generated data to cause us to doubt its reliability. 4 Report No. 1M-0E-00-16-028 III. RESULTS OF THE AUDIT Overall, we concluded that CareFirst DC was in compliance with the provisions of the Contract and applicable laws and regulations governing the MSP Program for contract year 2015. Specifically, the results of our reviews related to enrollment, rates and benefits, quality improvement and patient safety standards, and data and information security showed that CareFirst DC: accurately processed automated enrollment errors and escalated enrollment cases; pursued best pricing with its PBM and promoted transparency in pricing in accordance with the Contract; complied with hospital quality improvement and patient safety standards based on the Contract and regulatory requirements; and had a disaster recovery plan in place to address requirements in the Contract. Because our audit disclosed no findings, this final report contains no recommendations. 5 Report No. 1M-0E-00-16-028 IV. MAJOR CONTRIBUTORS TO THIS REPORT COMMUNITY-RATED AUDITS GROUP , Auditor-in-Charge , Lead Auditor , Auditor , Senior Team Leader , Group Chief 6 Report No. 1M-0E-00-16-028 Report Fraud, Waste, and Mismanagement Fraud, waste, and mismanagement in Government concerns everyone: Office of the Inspector General staff, agency employees, and the general public. We actively solicit allegations of any inefficient and wasteful practices, fraud, and mismanagement related to OPM programs and operations. You can report allegations to us in several ways: By Internet: http://www.opm.gov/our-inspector-general/hotline-to- report-fraud-waste-or-abuse By Phone: Toll Free Number: (877) 499-7295 Washington Metro Area: (202) 606-2423 By Mail: Office of the Inspector General U.S. Office of Personnel Management 1900 E Street, NW Room 6400 Washington, DC 20415-1100 -- CAUTION -- This audit report has been distributed to Federal officials who are responsible for the administration of the audited program. This audit report may contain proprietary data which is protected by Federal law (18 U.S.C. 1905). Therefore, while this audit report is available under the Freedom of Information Act and made available to the public on the OIG webpage (http://www.opm.gov/our-inspector-general), caution needs to be exercised before releasing the report to the general public as it may contain proprietary information that was redacted from the publicly distributed copy. Report No. 1M-0E-00-16-028
Multi-State Plan Program Operations at CareFirst BlueCross and BlueShield of the District of Columbia
Published by the Office of Personnel Management, Office of Inspector General on 2016-10-13.
Below is a raw (and likely hideous) rendition of the original report. (PDF)