Nc Doc Audit 2008
Download original document:
This text is machine-read, and may contain errors. Check the original document to verify accuracy.
STATE OF NORTH CAROLINA DEPARTMENT OF CORRECTION FISCAL CONTROL AUDIT OFFICE OF THE STATE AUDITOR BETH A. WOOD, CPA STATE AUDITOR DEPARTMENT OF CORRECTION FISCAL CONTROL AUDIT STATE OF NORTH CAROLINA Office of the State Auditor 2 S. Salisbury Street 20601 Mail Service Center Raleigh, NC 27699-0601 Telephone: (919) 807-7500 Fax: (919) 807-7647 Internet http://www.ncauditor.net Beth A. Wood, CPA State Auditor AUDITOR’S TRANSMITTAL February 11, 2010 The Honorable Beverly Eaves Perdue, Governor The General Assembly of North Carolina The Honorable Alvin W. Keller, Jr., Secretary, Department of Correction This report presents the results of our fiscal control audit at the Department of Correction. Our work was performed by authority of Article 5A of Chapter 147 of the North Carolina General Statutes and was conducted in accordance with the performance audit standards contained in Government Auditing Standards, issued by the Comptroller General of the United States. The objective of a fiscal control audit is to identify improvements needed in internal control over selected fiscal matters, such as financial accounting and reporting; compliance with finance-related laws, regulations, and provisions of contracts or grant agreements; and/or management of financial resources. The results of our audit disclosed deficiencies in internal control and/or instances of noncompliance or other matters that are considered reportable under Government Auditing Standards. These items are described in the Audit Findings and Responses section of this report. North Carolina General Statutes require the State Auditor to make audit reports available to the public. Copies of audit reports issued by the Office of the State Auditor may be obtained through one of the options listed in the back of this report. Beth A. Wood, CPA State Auditor TABLE OF CONTENTS PAGE OBJECTIVES, SCOPE, METHODOLOGY, AND RESULTS ................................................................1 AUDIT FINDINGS AND RESPONSES .............................................................................................5 EXHIBITS: EXHIBIT A - HOSPITAL PAID CLAIMS ...............................................................................15 EXHIBIT B - OTHER MEDICAL PROVIDER PAID CLAIMS ...................................................16 ORDERING INFORMATION ........................................................................................................19 OBJECTIVES, SCOPE, METHODOLOGY, AND RESULTS OBJECTIVES, SCOPE, AND METHODOLOGY As authorized by Article 5A of Chapter 147 of the North Carolina General Statutes, we have conducted a fiscal control audit at the Department of Correction. There were no special circumstances that caused us to conduct the audit, but rather it was performed as part of our effort to periodically examine and report on the financial practices of state agencies and institutions. The objective of a fiscal control audit is to identify improvements needed in internal control over selected fiscal matters, such as financial accounting and reporting; compliance with finance-related laws, regulations, and provisions of contracts or grant agreements; and/or management of financial resources. Our audit does not provide a basis for rendering an opinion on internal control, and consequently, we have not issued such an opinion. Management is responsible for establishing and maintaining effective internal control. Internal control is a process designed to provide reasonable assurance that relevant objectives are achieved. Because of inherent limitations in internal control, errors or fraud may nevertheless occur and not be detected. Also, projections of any evaluation of internal control to future periods are subject to the risk that conditions may change or compliance with policies and procedures may deteriorate. To accomplish our audit objectives, we gained an understanding of internal control over matters described below and evaluated the design of the internal control. We then performed further audit procedures consisting of tests of control effectiveness and/or substantive procedures that may reveal significant deficiencies in internal control. Specifically, we performed procedures such as interviewing personnel, observing operations, reviewing policies, analyzing accounting records, and examining documentation supporting recorded transactions and balances. Whenever sampling was used, we applied a nonstatistical approach but chose sample sizes comparable to those that would have been determined statistically. Our results are reported for our selected sample items and we have chosen not to project our results to the population as a whole. As a basis for evaluating internal control, we applied the internal control guidance contained in Internal Control Integrated Framework, published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). As discussed in the framework, internal control consists of five interrelated components, which are (1) control environment, (2) risk assessment, (3) control activities, (4) information and communication, and (5) monitoring. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions 1 OBJECTIVES, SCOPE, METHODOLOGY, AND RESULTS (CONTINUED) based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Our audit scope covered the period July 1, 2008, through December 31, 2008, and included selected internal controls in the following organizational units: Division of Prisons – Health Services The mission of this unit is to provide access to quality, cost effective healthcare that is rendered by competent healthcare professionals. This unit is staffed by medical professionals and is responsible for authorizing medical care for all inmates within the State’s correctional facilities. It is also responsible for reviewing services provided for medical necessity and addressing questions related to the appropriateness of billed medical charges. Division of Departmental Purchasing & Services This unit is the centralized location for procurement, warehousing, transportation/communications, and leased property acquisition and management for the Department. It is responsible for negotiating contracts with medical service providers to ensure that inmates within the State’s correctional facilities receive adequate health services in accordance with North Carolina General Statute 148-19. Division of Administration – Controller’s Office This unit is responsible for the general accounting functions of the Department. The Medical Claims Management section falls under the direction of the controller’s office and is responsible for processing claims from providers of medical services to inmates. It is further responsible for establishing policies and procedures to effectively perform that function. The Payroll section also falls under the direction of the Controller’s office. This section is responsible for entering department-specific deductions into the State’s human resources/payroll system (BEACON) and for the resolution of payroll issues as presented by employees, BEACON support services, and management. Division of Administration – Human Resources This unit is responsible for processing newly hired personnel into the Department and for other personnel actions, including the input of new personnel into BEACON for payroll purposes. Five regional processors, under the direction of the departmental personnel director, do the input of new personnel into the BEACON system. Division of Administration – Management Information Systems This unit provides tools to help correction employees manage offenders such as recording pertinent data about offenders, tracking their movements, and charting their progress in 2 OBJECTIVES, SCOPE, METHODOLOGY, AND RESULTS (CONCLUDED) programs and other rehabilitative efforts. For our audit, those tools included the Offender Population Uniform System and Medical Operations Maintenance System. During our audit, we considered internal control related to the following accounts and control objectives: Contracted Medical/Rehabilitative Services – During the period audited, the Department reported $44.9 million for contracted medical/rehabilitative services. These expenditures are incurred and paid by the Department for services provided by either hospitals or other medical service providers to the inmate population. Such services are considered necessary for ongoing operations that cannot be provided by the current staff. We examined internal controls designed to ensure that the Department properly accounted for expenditures and that purchases were in compliance with state, departmental, and contract requirements. Personal Services – During the period audited, the Department reported $373 million for personal services expenditures. These expenditures are incurred and paid by the Department for services rendered by permanent and temporary employees and their related fringe benefits. We examined internal controls designed to ensure that the Department properly paid and accounted for personal services expenditures. We also examined internal controls designed to ensure compliance with applicable federal, state, and departmental requirements. RESULTS The results of our audit disclosed deficiencies in internal control and/or instances of noncompliance or other matters that are considered reportable under generally accepted government auditing standards. These items are described in the Audit Findings and Responses section of this report. 3 [This Page Left Blank Intentionally] 4 AUDIT FINDINGS AND RESPONSES 1. INADEQUATE PROCEDURES TO CONTAIN INMATE MEDICAL COSTS The Department does not have internal controls in place to ensure inmate medical costs are minimized. As a result, there is an increased burden on the Department and the State’s financial resources to provide medical care to the inmate population. The costs of inmate medical services exceed $100 million annually and continue to increase. The Department establishes and maintains contractual relationships with hospitals and other medical service providers to deliver medical services that the prison institutions are not equipped to provide to inmates. In addition, for those services requiring special delegation, the Department attempts to contract with medical service providers through memoranda of agreement for the performance of those services. Our discussions with Department staff indicate that the hospitals and medical providers generally dictate the terms of the agreements; therefore, the terms of the contracts vary widely from contract to contract and are not always in the best interest of the Department. In addition, some of the contract terms are vague, such as providers billing for “usual and customary fees” without an established definition of what is “usual and customary.” Services are also rendered by medical providers that are not under contract with the Department. For non-contracted medical services, the Department’s claims examiners attempt to follow Medicare guidelines when pricing and adjudicating claims. However, there are no departmental policies and procedures that provide guidance to the examiners as to how to handle medical claims that deviate from Medicare guidelines. Payments for non-contracted medical services tend to result in much higher medical costs to the Department than payments made under service contracts. The Department, under legislative mandate, conducted a survey to determine how other states provide for the delivery of inmate healthcare services. The results of that survey indicated that other states limited costs to: amounts established in negotiated contracts. Medicare or Medicaid rates. rates paid under other programs for indigent care. discounted insurance provider rates. Our own research of other states’ practices revealed the following examples of cost containment measures: 5 AUDIT FINDINGS AND RESPONSES (CONTINUED) Idaho bases its inmate medical services reimbursement rate on its State Medicaid reimbursement rates. That limitation applies to all medical care services provided outside the facility including hospitalization, professional services, medical goods, and prescription drugs provided to prisoners confined in its correction facilities. New Hampshire passed 2009 legislation that requires its Department of Correction to pay hospitals and healthcare facilities 110% of Medicare allowable costs for outpatient, inpatient, and emergency services, as well as ambulatory and specialty services. South Carolina ties inmate hospital reimbursement rates to private insurer rates and inmate physician costs to approximately 135% of Medicare rates. The states of Georgia, Virginia, and Tennessee all use third party contractors to reimburse the majority of medical costs based on negotiated rates. The Department has also obtained an analysis of its reimbursed costs for selected medical procedures compared to the average reimbursed costs under various insurance providers. The analysis indicated that the Department was incurring higher reimbursement costs for similar medical procedures than those paid by the insurance providers. Based on our limited comparison of claims data, we noted that payments were made for inmate medical procedures that would not be considered allowable charges under either the state employee health plan or the Medicaid program. While doing this comparison, we also noted that multiple rates were applied for the same procedure code. In some cases, there was a wide range of rates paid for what appeared to be the same medical procedure. We also researched existing guidelines for the treatment of prisoners at the federal government level. United States Code Title 18, Section 4006, as amended by Public Law 109-162, provides that payment for costs incurred for the provision of health care items and services for individuals in the custody of the United States Marshals Service, the Federal Bureau of Investigation, and the Department of Homeland Security shall be the lesser of the amount billed or the Medicare rate. We examined the 131 largest hospital payments 1 made during the audit period. The tested transactions accounted for $8.9 million of the $31.5 million in hospitalization costs paid. These procedures revealed six instances where the hospital provider was overpaid, resulting in overpayments totaling $170,900. Five errors amounting to $148,519 were the result of using the incorrect payment methodology in calculating the reimbursement. In addition, the Department paid one claim using a contract rate that was higher than the amount billed, with the excess payments totaling $22,381. 1 See Exhibit A for example analysis of payments to hospital providers 6 AUDIT FINDINGS AND RESPONSES (CONTINUED) We expanded the procedures to examine payments made to one particular hospital over an 18-month period from July 2007 through December 2008 and identified payments of $469,000 in excess of the amount billed because the contract rate was applied. These excess payments could have been avoided if contracts included a provision similar to the one in the federal law discussed above to pay the lesser of the amount billed or the stated rate in the contract. In our examination of inmate hospital service payments, we noted that on average, providers were billing the Department at rates that were 467% of the applicable Medicare/Medicaid reimbursement rates. Our tests of other medical service reimbursement rates also indicated that amounts paid by the Department were consistently greater than what would have been reimbursed to the provider under Medicare for the same type and units of service. Recommendation: The Department should implement procedures designed to contain costs of inmate medical care. The Department worked with the North Carolina General Assembly during the last session to pass legislation that required providers of medical services to inmates in the Department’s custody to be paid at rates equal to those paid by the state employee health plan (the plan). However, this legislation was subsequently amended to apply only to those providers and medical facilities that participate in the plan. The impact of the legislation was limited further by an advisory letter from the North Carolina Attorney General that questioned the enforceability of the latter measure since inmates are not plan members. The intended result of the legislative acts was a defined medical reimbursement fee schedule which would assist the Department in its cost containment measures. In addition, North Carolina Session Law 2009-575 directs the Department to seek a contractor to process medical claims on behalf of the Department, provide medical management services to the Department, and to develop a provider network to serve the medical needs of inmates. The Department should also consider other common practices, such as limiting covered services and rates to those allowed under either the Medicaid or Medicare programs. Agency Response: The Department of Correction does not object to the Auditor's findings regarding medical costs. For many years, the Department has worked to address the inadequate procedures to contain inmate medical costs and the deficiencies in internal controls over payment of inmate medical claims. In January 2009, the current administration tried to resolve the medical cost issues by working with the General Assembly to pass Section 19.20 in SL 2009-451 (S202). This provision, signed by the Governor on August 7, 2009, required providers and medical facilities that participate in the State Health Plan to provide health services to DOC inmates at the rates paid by the Plan's beneficiaries. The bill also required the State Health Plan to assist the Department in hiring a contractor to process inmate medical claims. The bill therefore compelled providers to treat inmates, established a fee schedule and authorized the Department to seek a contractor to process medical claims. However, the provision was subsequently 7 AUDIT FINDINGS AND RESPONSES (CONTINUED) amended by SL 2009-575 (H836) and lost its ability to successfully address the processing of inmate medical claims. Without the legislative authority in Section 19.20 in SL 2009-451 to compel medical providers to treat inmates and establish a fee schedule, medical costs as noted in the auditor's report will continue to escalate. In order to successfully manage medical costs, the Department must have an established fee schedule and statutory language that requires medical providers to accept inmates at the established rates. The Department recognizes the need to control inmate medical costs. Many of the points raised in this finding are a result of very complex situations, some of which are not easily remedied. The Department does not have the legal authority to compel public hospitals or providers to treat inmates, nor do we have an established fee schedule, such as the State Health Plan, Medicare or Medicaid. This is first and foremost the major contributing cause to the problems we face in attempting to control the cost of providing medical care to our inmates. Without the authority to compel medical providers to treat inmates, the Department is forced to negotiate contracts with each provider individually, at rates which are favorable to the provider. Formerly a few contracts did not specify paying the lower of the billed amount or the contract rate, and the Department was legally obligated to pay the contract rate, even when it exceeded the billed amount. Department of Correction Departmental Purchasing will ensure that future contracts are written to pay the lower of billed or contract rates. We concur that multiple rates were applied for the same medical procedure. Rates frequently differed from one medical vendor to another for the same procedure, regardless of the existence of a contract. We also concur that terms varied widely from contract to contract and that contract terms were vague. The Department often had no recourse but to allow contract changes, and without an established fee schedule, the term “usual and customary fees” was subject to wide interpretation. The Department’s current policy is to more clearly define terms such as “usual and customary fees.” To reiterate the problems faced by the Department, without legislative authority such as Section 19.20 in SL 2009-451 to compel medical providers to treat our inmates and without an established fee schedule to impose on our medical providers, costs will continue to escalate. 2. DEFICIENCIES IN INTERNAL CONTROL OVER PAYMENT OF INMATE MEDICAL CLAIMS The Department has not implemented adequate internal control over the payment of inmate medical claims. As a result, there is an increased risk of error in these payments. During our audit, we noted the following deficiencies in the design of internal control: 8 AUDIT FINDINGS AND RESPONSES (CONTINUED) There is a lack of uniform written policies and procedures related to the adjudication of medical claims by the claims examiners in the Department’s medical claims management section. While informal guidelines exist for the processing of medical claims, the allowability and reasonableness of any medical claim is subject to the discretion of the reviewing claims examiner. Based on our discussions with Department management, the Director of Medical Claims Management position is responsible for the development and implementation of such policies. However, that position has been vacant for an extended period, including our audit period, resulting in the oversight for the medical claims processing unit being shifted to the Director of Accounting. The Department’s medical claims management section has to manually enter claim information into the Medical Operations Management System. This system assists in the adjudication and payment processes for inmate medical services, allowable cost determinations, and the application of appropriate reimbursement rates. Given the volume of transactions, errors are likely to occur in such a highly manual process. Two purchasing agents, with input from the Division of Prisons Health Services section, are responsible for negotiating most of the medical service contracts. Effective contract negotiation necessitates a thorough understanding of potential new providers, current market pricing of the services, medical and billing processes, and specific contract terms and their implications. Consequently, legal representation and experienced medical claims contract personnel should be involved in negotiating and drafting contracts. We examined the 131 largest hospital payments made during the audit period, which accounted for $8.9 million of the $31.5 million in hospitalization costs paid. We also examined the largest single payment made to the 56 highest-paid vendors for medical services 2 other than hospitalization during the audit period. These tested transactions accounted for $684,000 of the $13.4 million paid for such services. Our procedures revealed seven instances, totaling $6,615, where the vendor was overpaid. The overpayments resulted from applying incorrect medical services reimbursement rates. During these procedures, we also noted the following: 2 Instances where providers continued to be paid despite not meeting the medical claim form documentation requirements as specified in either their contract documents or in the Department’s published Medical Claims Management Bulletins. Instances where payments were made on claims that did not include valid diagnosis-related group (DRG) codes or utilization review (UR) authorization numbers, both requirements in authenticating a medical claim. See Exhibit B for example analysis of payments for other medical services 9 AUDIT FINDINGS AND RESPONSES (CONTINUED) Instances where the Department accepted handwritten, black and white printed, and/or faxed claim forms, although the Medical Claims Management Bulletins state that only original claim forms will be accepted for processing. Contracts that had vague and/or ambiguous terms that require interpretation by the claims examiners who are responsible for making payments in accordance with the contract terms. In addition, some of the contracts included terms that the Medical Operations Management System was not set up to address, creating additional difficulties and interpretations on behalf of the claims examiners as they processed medical claims. There was also a lack of consistency in the contract terms for the medical services providers that we reviewed. Some of the contracts in place exceeded the five-year term limit imposed by the North Carolina Division of Purchase and Contract. Recommendation: The Department should examine its current internal control procedures over inmate medical claims and determine appropriate measures to address the deficiencies noted above. Agency Response: The Department recognizes the need to develop written policies and procedures, which must be in place prior to awarding a contract to a third party contractor, as directed by House Bill 836. We concur that having written policies and procedures would have reduced some of the inconsistencies which have occurred. We concur that the Director of Medical Claims Management position has been vacant since April of 2008. The Department posted this position, but the hiring process was suspended. By the time the position was reposted, a hiring freeze prevented the current administration from filling it. We concur that the Medical Operations Management System (MOMS) requires manual entry. The Department does not currently have an automated system for the payment of medical claims. Department of Correction Departmental Purchasing recognizes the need for experienced medical claims personnel and legal representation to be involved in the negotiation of contracts. They have been involved in an ongoing process of working with Department Management, Division of Purchase and Contract, the Department of Justice and our own Department legal staff to pursue this need. Currently Department legal staff is reviewing all new contracts. We concur that there were instances where payments were made on claims which did not include valid diagnosis-related group (DRG) codes or utilization review (UR) authorization numbers. Certain vendors under contract were paid based on a percentage of billed charges, and DRG codes or UR codes may not have been required. We concur that certain contracts exceeded the five-year term imposed by the North Carolina Division of Purchase and Contract. Often vendors refused to negotiate a new 10 AUDIT FINDINGS AND RESPONSES (CONTINUED) contract with the Department, or the negotiations occurred during an extended period, which caused the five-year term limit to be violated. To reiterate the problems faced by the Department, without legislative authority such as Section 19.20 in SL 2009-451 to compel medical providers to treat our inmates and without an established fee schedule to impose on our medical providers, costs will continue to escalate. 3. DEFICIENCIES IN THE PERSONNEL AND PAYROLL PROCESSES We identified deficiencies in the Department’s internal control over the administration of personnel and payroll processes. As a result, the Department has not complied with state personnel policies and there is an increased risk that there will be errors in the compensation paid to employees and in the related accounts on the financial statements. The Department has employees located throughout the State, and payroll data are accumulated and summarized in the State’s human resource/payroll system (BEACON). Those employees that are unable to enter their time directly into BEACON are required to prepare manual timesheets. We judgmentally selected a sample of 40 employees to test the Department’s personnel and payroll procedures. Our sample included 18 selfservice employees who entered their own time into the system and 22 employees who were required to complete manual timesheets that were then entered into BEACON by a time administrator. Our tests were performed for the period July 1, 2008 through December 21, 2008 and revealed the deficiencies described below. Time Records Manual timesheets were not consistently signed by the employee or approved by the employee’s supervisor. We noted that timesheets for 10 of the 22 sample employees requiring timesheets were unsigned by either the employee or the employee’s supervisor for the time period reviewed. Employee Compensation There are several factors that impact the compensation paid to an individual employee. Position settings/classifications are established within BEACON for each employee that correlate to particular pay structures. In addition, an employee’s work schedule during the pay period determines the employee’s eligibility for shift and additional pay premiums. For the Department, we determined that an employee’s pay amount could be calculated based on time worked across three different time periods. Regular pay is calculated based on the calendar dates of the current month. Overtime pay and “additional” pay are calculated from the 8th of the previous month through the 5th of the current month. Shift premium pay is calculated from the 25th of the previous month through the 25th of the current month. We noted that these varying time periods for 11 AUDIT FINDINGS AND RESPONSES (CONTINUED) accumulating an employee’s time worked compounded the difficulty in determining the accuracy of compensation paid. All time worked during any of the above time periods must be approved in BEACON by a supervisor by established BEACON payroll deadlines to be included in an employee’s monthly paycheck. Any time worked that is not approved by those deadlines will not be paid until the approval occurs. Our tests of the 40 sample employees included a recalculation of the monthly pay amounts. The results of our tests were: We noted that supervisors and time administrators were not adhering to the established approval deadlines. This impacted the July 2008 pay amount for 18 of our 40 employee sample items. After making adjustments for the time that was outside the deadlines, we noted that five employees were paid incorrectly, resulting in a net underpayment of $1,360. Five employees worked less than the required hours for the month; however, they were paid their regular monthly salary because the supervisor did not appropriately adjust the employee’s hours worked in BEACON. Payroll Reconciliation A reconciliation between the North Carolina Accounting System (NCAS) and BEACON has been performed only once since the Department began using BEACON in April 2008. At the conclusion of our fieldwork, this reconciliation was incomplete pending a response from BEACON support services on reconciling items. The State Personnel Manual sets forth policies related to salary administration. Additionally, departmental policies address time entry guidelines requiring the timely approval of time records. Recommendation: The Department should improve its internal control over the personnel and payroll processes to address the deficiencies noted above. Agency Response: TIME RECORDS Manual timesheets are being used in some locations as documentation for time administrators to enter time in the BEACON HR/payroll system where employees do not have Employee Self Service authority to enter their own time into the system. We concur that there were some situations where the signatures of the employees and supervisors were not complete in the sample. The Department has informed the units to ensure that this documentation is complete prior to filing records. 12 AUDIT FINDINGS AND RESPONSES (CONTINUED) EMPLOYEE COMPENSATION Overtime pay and additional pay are not always calculated from the 8th of the previous month through the 4th of the current month. In the BEACON system it is paid on a 4-week cycle for employees subject to overtime, but covered under the Fair Labor Standards Act’s 7-K exemption (which allow overtime to be paid at time and a half only after exceeding 171 hours worked in a 4-week cycle) and is not always calculated on the same day of the previous month to the current month. For subject employees who are not covered by the 7-K exemption, overtime is paid based on all hours worked over 40 in any given week, which have been entered into BEACON, been approved, and completed time evaluation between payroll cutoff for the previous month and payroll cutoff for the current month. These dates vary from month to month. Also, the shift premium is not always paid from the 25th of the previous month until the 25th of the current month. Shift premium is paid for eligible hours which have been entered, approved and completed time evaluation between the payroll cutoff for one month through the payroll cutoff for the succeeding month. If the review period of this audit captured required adjustments in the July 2008 paychecks, this was only three months after the Department of Correction implemented BEACON. During this period, the BEACON system required numerous and significant programming changes to address problems in time reporting and payroll inaccuracies the Department experienced. The agency distributes timely communication and instructions to the field in the form of administrative memorandums reflecting any updates or changes in the system. PAYROLL RECONCILIATION Since the date of the audit fieldwork, we have implemented a procedure for monthly reconciliation of BEACON with NCAS (North Carolina Accounting System). Also, as of October 9, 2009, the State Controller’s Office has provided State Agencies with a finance job aid with payroll financial reconciliation guidelines. The DOC Controller’s Office has always reconciled the State’s CMCS (Cash Management Control System) in NCAS. BEACON has now been reconciled in NCAS back to November 2008. 4. INADEQUATE CONTROL OVER USER ACCESS SYSTEM TO THE OFFENDER POPULATION UNIFIED We identified deficiencies in the Department’s oversight and management of medical employee access to the Offender Population Unified System. The Offender Population Unified System tracks an inmate’s entire history from incarceration to release, including housing, transfers, medical, and disciplinary data. The system is segmented to account for different activities during an inmate’s term of incarceration. The medical section uses the system to authorize and track medical 13 AUDIT FINDINGS AND RESPONSES (CONCLUDED) services provided to an inmate. Improper access could result in the provision of an unauthorized or unnecessary medical service. We judgmentally selected four system users from a population of 26 that had the capability to approve the payment of an inmate medical claim. We noted that access authorization documentation for one user was dated the same day as our request for the document. The Security Administrator stated that this individual had been with the Department and had access to the system dating back to 1988; however, there was no access approval documentation for that time period. Maintaining proper access controls over computer systems helps to protect the confidentiality and integrity of information by preventing alteration, unauthorized use, or loss of data. Statewide Information Technology Standards specify that system access be controlled and prescribe procedures such as documented reviews of users’ rights and immediate termination of access upon leaving employment. Recommendation: The Department should enhance and enforce prescribed procedures for documenting security access privileges for the Offender Population Unified System. Periodic security reviews should be conducted to ensure that access is restricted to authorized users, and employee user access rights should be systematically evaluated to ensure privileges granted are appropriate to the necessary job requirements. Agency Response: We concur that access approval documentation was missing for one user of the Offender Population Unified System (OPUS); however, this employee was an authorized user, and his access went back to 1988. The Department will conduct periodic security reviews to ensure that system access is restricted to authorized users. We will also verify that access rights are systematically evaluated to ensure privileges granted are appropriate to the necessary job requirements. 14 Hospital Paid Claims Exhibit A This Exhibit presents the 20 highest paid hospital inpatient claims that were tested as part of our procedures at the NC Department of Correction. Hospital Reference Hospital A Hospital A Hospital A Hospital A Hospital B Hospital A Hospital C Hospital B Hospital D Hospital E Hospital F Hospital A Hospital B Hospital G Hospital B Hospital A Hospital H Hospital B Hospital A Hospital A Total Amount Billed by the Hospital for 1 Services $507,386.13 $248,940.76 $231,311.59 $190,587.22 $199,770.73 $180,644.98 $188,382.71 $163,127.58 $143,507.35 $127,089.20 $126,220.44 $131,411.73 $137,770.14 $242,778.90 $119,303.11 $106,457.00 $124,916.23 $110,096.25 $98,561.02 $97,098.93 Total Amount Paid by 2 Department $482,016.82 $236,493.72 $219,746.01 $181,057.86 $179,793.66 $171,612.73 $150,706.16 $146,814.82 $143,507.35 $127,089.20 $126,220.44 $124,841.14 $123,993.13 $114,106.08 $107,372.80 $101,134.15 $99,932.98 $99,086.63 $93,632.97 $92,243.98 Medicare/ Medicaid 3 Reimbursement Rate $120,451.03 $54,678.32 $50,674.71 $42,425.74 $69,485.62 $42,726.94 $60,668.67 $56,988.33 $33,321.47 $37,829.35 $29,074.14 $29,614.76 $40,287.47 $18,565.50 $43,714.25 $12,640.80 $29,935.90 $49,961.27 $19,487.19 $10,491.16 Percentage of Amount Applicable Paid Over Diagnosis Medicare/Medicaid Related Group 4 5 Reimbursement Rate (DRG) 400% 958 433% 853 434% 225 427% 225 259% 489 402% 225 248% 329 258% 542 431% 565 336% 233 434% 498 422% 335 308% 168 615% 004 246% 076 800% 682 334% 824 198% 423 480% 246 879% 287 DRG Description 6 Other O.R. Procedures for Multiple Significant Trauma w CC Infectious & Parasitic Diseases w O.R. Procedure w MCC Cardiac Defib Implant w Cardiac Cath w/o Ami/HF/Shock w/o MCC Cardiac Defib Implant w Cardiac Cath w/o Ami/HF/Shock w/o MCC Knee Procedures w/o PDX of Infection w/o CC/MCC Cardiac Defib Implant w Cardiac Cath w/o Ami/HF/Shock w/o MCC Major Small & Large Bowel Procedures w MCC Pathological Fractures & Musculoskeletal & Conn Tissue Malig w MCC Other Musculoskeletal Sys & Connective Tissue Diagnoses w CC Coronary Bypass w Cardiac Cath w MCC Local Excision & Removal Int Fix Devices of Hip & Femur w CC/MCC Peritoneal Adhesiolysis w MCC Other Resp System O.R. Procedures w/o CC/MCC Trach w MV 96+ hrs or PDX Exe Face, Mouth & Neck w/o Major O.R. Viral Meningitis w/o CC/MCC Renal Failure w MCC Lymphoma & Non-Accute Leukemia w Other O.R. Procedures w CC Other Hepatobiliary or Pancreas O.R. Procedures w MCC Perc Cardiovasc Proc w Drug-Eluting Stent w MCC or 4+ Vessels/Stents Circulatory Disorders Except AMI w Card Cath w/o MCC NOTES: 1 This amount represents the amount billed by the hospital for the dates of service included on the UB-04 Medical Claim Form. 2 The amount paid by the Department. 3 The Medicare rates were provided from the Centers for Medicare & Medicaid (CMS) Prospective Payment System (PPS) Inpatient PC Pricer. The following information was entered to generate the reimbursement amounts: Provider ID, DRG code (from UB-04), Service Dates (from UB-04), Total Charges Billed by the Provider (from UB-04). 4 Amount (reimbursement amount paid to the vendor by Department) divided by the Medicare/Medicaid Rate. 5 DRG is a system used to classify hospital cases that are expected to use similar hospital resources. They are used to detemine how much Medicare pays the hospital. 6 Description of the DRG code obtained from the Centers for Medicare & Medicaid (CMS) Prospective Payment System (PPS) Inpatient PC Pricer for applicable code. MCC means Major Complicating Condition; CC means Complicating Condition. 15 Other Medical Provider Paid Claims Exhibit B This Exhibit presents the 20 highest other medical provider paid claims, with associated Medicare rates, that were tested as part of our procedures at the NC Department of Correction. 1 2 3 4 5 Other Provider Reference Other Provider JJ Other Provider JJ Other Provider JJ Other Provider JJ Other Provider JJ Other Provider B Other Provider B Other Provider B Other Provider L Other Provider L Other Provider L Other Provider L Other Provider L Other Provider L Other Provider X Other Provider X Other Provider X Other Provider X Other Provider X Other Provider X Other Provider DD 6 Other Provider G Other Provider G 7 Other Provider T Other Provider T Other Provider T Other Provider T Other Provider T Other Provider T Amount Billed Total Amount Paid 2 by the Provider 1 $182.00 $182.00 $622.00 $622.00 $5,945.00 $5,945.00 $300.00 $303.00 $10,340.00 $10,340.00 $16,576.00 $12,432.00 $1,674.00 $837.00 $4,365.00 $2,182.50 $6,063.00 $6,063.00 $6,063.00 $3,031.50 $3,575.00 $1,787.50 $3,556.00 $1,778.00 $2,293.00 $1,146.50 $1,095.00 $1,095.00 $3,946.00 $2,450.65 $4,000.00 $1,177.19 $4,302.00 $1,001.18 $4,485.00 $1,233.95 $1,500.00 $655.70 $500.00 $500.00 $17,283.67 $9,631.19 $4,748.00 $2,656.00 $300.00 $6,000.00 $188.00 $100.00 $66.00 $106.00 $6,409.80 $2,390.40 $99.36 $5,694.00 $62.79 $28.05 $21.82 $35.21 Payment Under Medicare 3 $86.08 $148.90 $2,355.86 $73.22 $4,122.45 $727.00 $210.53 $150.71 $181.75 $181.75 $150.71 $2,014.37 $207.38 $198.45 $1,361.47 $654.00 $556.22 $685.53 $364.28 $0.00 CMS PPS Inpatient Pricer Rate: $5837.09 $833.75 $262.47 $33.12 $3,833.60 $62.79 $17.28 $21.82 $35.21 Applicable CPT® or HCPCS (five digit code) and Modifiers Codes (two digit code) 4 99214/25 96413 J9035 96417 J9001 35474 35493 36247 35474 35474/59, 51 36247/51 34201/51 37205/51 37206 22612 22630/51 63042/51 22840 22851 20936 DRG 292 CPT®/HCPCS Code Description 5 Office/outpatient visit, est Chemo, iv infusion, 1 hr Bevacizumab injection (drug) Chemo iv infus each addl seq Doxorubican hcl liposome injection (drug) Repair arterial blockage Atherectomy, percutaneous Place catheter in artery Repair arterial blockage Repair arterial blockage Place catheter in artery Removal of artery clot Transcath iv stent, percut Transcath iv stent/perc addl Lumbar spine fusion Lumbar spine fusion Laminotomy, single lumbar Insert spine fixation device Apply spine prosth device Local bone graft Heart Failure & Shock w CC; Diseases & Disorders of the Circulatory System 67312/50 67332 96415 J9263 96411 J9190 90766 90767 Revise two eye muscles Rerevise eye muscles add-on Chemo, iv infusion, addl hr Oxaliplatin (drug) Chemo, iv push, addl drug Fluorouracil injection (drug) Ther/proph/dg iv inf, add-on Tx/proph/dg addl seq iv inf 16 Days or Units of Service 6 1 1 41 1 10 2 1 1 1 1 1 2 1 1 1 1 1 1 1 1 N/A 1 1 3 400 1 10 1 1 Other Medical Provider Paid Claims Exhibit B This Exhibit presents the 20 highest other medical provider paid claims, with associated Medicare rates, that were tested as part of our procedures at the NC Department of Correction. 8 9 10 11 12 13 Other Provider Reference Other Provider YY Other Provider YY Other Provider YY Other Provider YY Other Provider YY Other Provider YY Other Provider QQ Other Provider QQ Other Provider QQ Other Provider QQ Other Provider QQ Other Provider QQ Other Provider BB Other Provider BB Other Provider BB Other Provider BB Other Provider BB Other Provider BB Other Provider F Other Provider O Other Provider O Other Provider K 14 Other Provider C 15 Other Provider P Other Provider P Other Provider P Other Provider P Other Provider P Other Provider P Amount Billed Total Amount Paid 2 by the Provider 1 $3,425.18 $2,671.64 $312.31 $243.60 $294.40 $377.44 $419.37 $327.11 $493.96 $385.29 $1,221.64 $952.88 $1,900.00 $1,900.00 $1,200.00 $1,200.00 $867.00 $867.00 $500.00 $500.00 $135.00 $135.00 $120.00 $120.00 $27.00 $7.75 $26.00 $3.84 $2.00 $2.00 $6,840.00 $4,320.72 $48.00 $17.41 $318.00 $240.92 $4,759.00 $4,521.05 $7,826.00 $3,371.85 $3,947.00 $1,071.36 $4,662.00 $4,195.80 $3,671.64 $46.00 $483.00 $1,644.00 $1,362.00 $1,075.00 $548.00 $3,671.64 $34.50 $362.25 $1,233.00 $1,021.50 $806.25 $411.00 Payment Under Medicare 3 $3,425.18 $312.31 $377.44 $419.37 $493.96 $610.82 $847.95 $184.78 $151.79 $109.20 $44.21 $62.52 $4.43 $1.86 $1.26 $2,468.98 $0.00 $137.67 $159.31 $1,348.74 $428.55 $807.66 $2,039.80 $8.44 $84.96 $142.17 $290.93 $130.85 $46.63 Applicable CPT® or HCPCS (five digit code) and Modifiers Codes (two digit code) L5321/RT L5624 L5631 L5650 L5671 L5673 33249 33218 93641/26 33241 99251 99238/24 81000 J1580 J1170 52648 A4550 64430 52224 27138 27507/51 00630 CPT®/HCPCS Code Description 5 AK open end SACH Test socket above knee AK/knee disartic acrylic soc Tot contact ak/knee disart s BK/AK locking mechanism Socket insert w lock mech Eltrd/insert pace-defib Repair lead pace-defib, one Electrophysiology evaluation Remove pulse generator Inpatient consultation Hospital discharge day Laboratory services Garamycin gentamicin injection (drug) Hydromorphone injection (drug) Laser surgery of prostate Surgical/injection tray N block inj, pudendal Cystoscopy and treatment Revise hip joint replacement Treatment of thigh fracture Anesthesia Days or Units of Service 6 1 1 1 1 1 2 1 1 1 1 1 1 1 2 1 1 1 1 1 1 1 Anesthesia time: 510 minutes 90945 71010/26 75790/26 36870 35476/51 36558/59 36145/51 Dialysis, one evaluation Chest x-ray Visualize A-V shunt Percut thrombect av fistula Repair venous blockage Insert tunneled cv cath Artery to vein shunt 31 1 1 1 1 1 1 4 17 Other Medical Provider Paid Claims Exhibit B This Exhibit presents the 20 highest other medical provider paid claims, with associated Medicare rates, that were tested as part of our procedures at the NC Department of Correction. 16 17 18 19 20 Other Provider Reference Other Provider EE Other Provider EE Other Provider EE Other Provider U Other Provider U Other Provider U Other Provider U Other Provider U Other Provider LL Other Provider PP Other Provider PP Other Provider PP Other Provider Y Amount Billed Total Amount Paid 2 by the Provider 1 $3,000.00 $3,000.00 $180.00 $180.00 $180.00 $180.00 $250.00 $187.13 $85.00 $56.64 $85.00 $56.64 $85.00 $56.64 $4,950.00 $2,649.50 $2,600.00 $2,730.00 $4,121.00 $1,441.52 $2,785.00 $688.91 $120.00 $46.24 $2,490.00 $1,992.00 Payment Under Medicare 3 $771.07 $20.25 $21.74 $113.41 $34.33 $34.33 $34.33 $1,605.76 $1,015.79 $847.95 $405.24 $27.20 $576.90 Applicable CPT® or HCPCS (five digit code) and Modifiers Codes (two digit code) 4 92980/LC 93539 93540 99222 99231 99231 99231/57 35081 21470 33249 33244 71090/26 00770/QK CPT®/HCPCS Code Description 5 Insert intracoronary stent Injection, cardiac cath Injection, cardiac cath Initial hospital care Subsequent hospital care Subsequent hospital care Subsequent hospital care Repair defect of artery Treat lower jaw fracture Eltrd/insert pace-defib Remove eltrd, transven X-ray & pacemaker insertion Anesthesia Days or Units of Service 6 1 1 1 1 1 1 1 1 1 1 1 1 Anesthesia time: 221 min. NOTES: 1 The total amount billed to Department by the provider on the CMS-1500 Medical Claim Form. 2 The amount paid by Department to the provider for each CPT®/HCPCS service code billed on the CMS-1500 Medical Claim Form. 3 The fee schedule reimbursement rate for the CPT® codes billed by the provider. These amounts were obtained from the various fee schedules available on the Centers for Medicare and Medicaid (CMS) website. The type of medical service provided and the dates of service dictates which fee schedule was used. We calculated the amounts that the provider would have been reimbursed under Medicare for the same type and units of service as submitted on the CMS-1500 Medical Claim form. 4 CPT® means Common Procedural Terminology and is a set of codes, established and maintained by the American Medical Association, intended to describe procedures and services performed by physicians and other health care providers. HCPCS means Healthcare Common Procedure Coding System and is a standarized system, established and maintained by the Centers for Medicare and Medicaid (CMS), that classifies similar medical products and services that are not included in the CPT® coding system for the purpose of efficient claims processing. Modifiers provide the means by which a physician may indicate that a service or procedure has been performed, or has been altered by some specific circumstances, but not changed in its definition or code. 5 CPT®/HCPCS Code Description obtained from the applicable fee schedule. 6 The number of days or units of service that were rendered as documented on the CMS-1500 Medical Claim Form for each CPT®/HCPCS. 18 ORDERING INFORMATION Audit reports issued by the Office of the State Auditor can be obtained from the web site at www.ncauditor.net. Also, parties may register on the web site to receive automatic email notification whenever reports of interest are issued. Otherwise, copies of audit reports may be obtained by contacting the: Office of the State Auditor State of North Carolina 2 South Salisbury Street 20601 Mail Service Center Raleigh, North Carolina 27699-0601 Telephone: 919/807-7500 Facsimile: 919/807-7647 19