A Performance Audit
An Audit Report on Medicaid Managed Care Contract Processes at the Health and Human Services Commission
October 2016
Summary Analysis
The Health and Human Services Commission (Commission) should develop and implement an overall strategy for planning, managing, and coordinating audit resources that it uses to verify the accuracy and reliability of program and financial information that managed care organizations (MCOs) report to it. The lack of an overall strategy has resulted in gaps in audit coverage of MCOs, lack of consistent follow-up on audit findings, inconsistent application of procedures, and duplication of effort.
The Commission lacks a documented process to show how it determines which MCOs to audit. Although the Commission paid contracted audit firms a total of $1,337,525 to assess the risks of each MCO in fiscal years 2011, 2013, and 2015, it did not document how those risk assessments were used to select which MCOs to audit. The risk assessments identified risk areas for all of the MCOs reviewed. However, the Commission did not audit 12 (52 percent) of the 23 MCOs that provided Medicaid services from fiscal year 2011 through fiscal year 2015.
The Commission does not have a documented process for how it should follow up on performance audit findings. For performance audits covering fiscal year 2011 through May 2016, the Commission did not verify or track whether MCOs corrected findings for 11 (92 percent) of 12 performance audits conducted.3
When performing AUP engagements for the Commission, both contracted audit firms have the same objective of validating MCOs’ financial statistical reports that the Commission uses to verify the amount of “experience rebates”1 that MCOs owe. However, the Commission’s requirements for the audit firms to expand certain tests were different for each of the two firms. The Commission did not require each audit firm to expand those tests to determine whether identified errors were systemic within an MCO’s operations and could materially affect the accuracy of financial statistical reports.
The Commission does not have a process to issue corrective action plans to correct performance or noncompliance issues identified in AUP engagements.
In addition, since fiscal year 2012 the Commission has not conducted performance audits of the services that MCOs’ pharmacy benefit manager contractors provide. Pharmacy benefit manager contractors administer the prescription drug benefits of MCOs. From March 2012 to August 2015, MCOs reported they paid $235,199,287 to pharmacy benefit manager contractors to administer $7.4 billion in prescription benefits.
The Office of Inspector General conducted performance audits on the financial statistical reports of 6 of the 8 MCOs that had been previously evaluated by contracted audit firms during AUP engagements. The Commission paid those contracted audit firms a total of $236,415 to evaluate those financial statistical reports.
The Commission did not collect $2,022,025 (41 percent) of the $4,950,664 in costs that it incurred for fiscal years 2011 through 2015 for audit-related services for which MCOs were required to reimburse the Commission.
The Commission collected $787,077,260 (99.6 percent) of the $789,862,545 in experience rebates that MCOs were contractually required to pay the Commission for fiscal years 2011 through 2014. However, it did not resolve in a timely manner the experience rebates that certain MCOs disputed. Specifically, the Commission did not collect $3,458,395 in required rebates from 3 MCOs for fiscal years 2011, 2012, and 2013 as a result of unresolved disputes.
The Commission’s Health Plan Management unit indicated that it did not receive detailed information available from the Commission’s External Quality Review Organization. The Health Plan Management unit could use that detailed information to strengthen its monitoring efforts. Specifically, the detailed information includes performance information on MCOs from Medicaid client surveys, such as ratings on access to urgent care or Medicaid clients’ ratings of their health plans.
The Commission did not establish adequate information technology controls to ensure that its reconciliations of daily deposits were documented, access to its systems was appropriate, and changes to the systems were documented.
Graphics, Media, Supporting documents