This is the accessible text file for GAO report number GAO-05-388 
entitled 'Federal Bureau of Investigation: Accountability over the 
HIPAA Funding of Health Care Fraud Investigations Is Inadequate' which 
was released on May 16, 2005.

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov.

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately.

Report to the Chairman, Committee on Finance, U.S. Senate:

April 2005:

Federal Bureau of Investigation:

Accountability over the HIPAA Funding of Health Care Fraud 
Investigations Is Inadequate:

GAO-05-388:

GAO Highlights:

Highlights of GAO-05-388, a report to the Chairman, Committee on 
Finance, U.S. Senate: 

Why GAO Did This Study:

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) 
provided, among other things, funding by transfer to the Federal Bureau 
of Investigation (FBI) to carry out specific purposes of the Health 
Care Fraud and Abuse Control Program. The Committee expressed concern 
about a shift in FBI resources from health care fraud investigations to 
counterterrorism activities after September 11, 2001. The Committee 
asked GAO to review FBIs accountability for the funds transferred 
under HIPAA for fiscal years 2000 through 2003. GAO determined (1) 
whether FBI had an adequate approach for ensuring the proper use of the 
HIPAA transfers and (2) the extent to which FBI had expended these 
transferred funds on health care fraud investigations in fiscal years 
2000 through 2003.

What GAO Found:

FBI used a limited approach to monitoring its use of HIPAA transfers, 
which might have been sufficient during times when it clearly used more 
agent full time equivalents (FTEs) for health care fraud investigations 
than budgeted but was insufficient when some of the agent FTEs 
previously devoted to health care fraud investigations were shifted to 
counterterrorism activities. FBIs budgeted FTEs (agent and other 
personnel) and related costs (such as rent and utilities) were 
equivalent to the amount of the HIPAA transfers. However, FBIs 
approach to monitoring the use of HIPAA transfers considered only agent 
FTEs, which made up about 42 percent of the budgeted health care fraud 
costs, but did not consider other personnel FTEs or related costs. 
According to FBI officials, they did not monitor these other budgeted 
amounts to determine compliance with HIPAA because the actual agent 
FTEs were historically far in excess of those budgeted. However, once 
FBI began to shift agent resources away from health care fraud 
investigations, agent FTEs charged to health care fraud investigations 
fell below the budgeted amounts, and FBI could no longer rely on this 
limited approach to ensure that the transferred HIPAA funds were 
properly used. Furthermore, FBI did not have a system in place to 
capture its overall health care fraud investigation costs, and 
therefore, was not in a position to determine whether or not all 
transferred HIPAA funds were properly expended. 

In response to GAOs review, FBI engaged in extensive manual efforts to 
develop cost estimates related to health care fraud investigations for 
fiscal years 2000 through 2003. The final estimate provided to GAO 
showed that FBI spent more on health care fraud investigations than was 
funded by transfers for each of the 4 years. However, GAO found that, 
overall, FBIs estimates of its health care fraud investigation costs 
were based on data that had not been or could not be fully validated. 
Therefore, even though FBI made a good-faith effort to estimate these 
costs, because of data limitations, neither GAO nor FBI could reliably 
determine whether all of the HIPAA transfers were spent solely for 
health care fraud investigations and related activities for the 4-year 
period. DOJ is currently planning the implementation of a new DOJ-wide 
UFMS, but it has yet to develop the specific systems requirements that 
would enable FBI to accurately capture all of its health care fraud-
related costs and therefore to help monitor compliance with HIPAA and 
other relevant laws and regulations.

What GAO Recommends:

To enhance accountability for the HIPAA transfers and the costs related 
to health care fraud investigations, GAO recommends that the FBI 
Director augment the cost-tracking capabilities of the new Unified 
Financial Management System (UFMS) and, in the interim, establish 
formal policies and procedures to report and adequately support the 
costs of health care fraud investigations and validate the underlying 
data used. The Department of Justice (DOJ) and FBI agreed with these 
recommendations and indicated that FBI has already taken action to 
implement them.

www.gao.gov/cgi-bin/getrpt?GAO-05-388.

To view the full product, including the scope and methodology, click on 
the link above. For more information, contact Linda Calbom at (202) 512-
9508 or calboml@gao.gov.

[End of section]

Contents:

Letter:

Results in Brief:

Background:

FBI's Monitoring Approach for HIPAA Transfers Provided Little Assurance 
of Transfers' Proper Use:

FBI's Cost Estimates of Health Care Fraud Investigations Were Not 
Adequately Supported:

Conclusions:

Recommendations for Executive Action:

Agency Comments and Our Evaluation:

Appendixes:

Appendix I: Scope and Methodology:

Appendix II: Comments from the Department of Justice and the Federal 
Bureau of Investigation:

Appendix III: GAO Contacts and Staff Acknowledgments:

Abbreviations: 

DOJ: Department of Justice:

FBI: Federal Bureau of Investigation:

FMS: Financial Management System:

FTE: full time equivalent:

GAO: Government Accountability Office:

HCFU: Health Care Fraud Unit:

HHS: Department of Health and Human Services:

HIPAA: Health Insurance Portability and Accountability Act:

NFC: National Finance Center:

S&E: Salaries and Expenses:

TURK: Time Utilization and Record Keeping:

UFMS: Unified Financial Management System:

Letter April 22, 2005:

The Honorable Charles E. Grassley: 
Chairman: 
Committee on Finance: 
United States Senate:

Dear Mr. Chairman:

In 1996 the Congress passed the Health Insurance Portability and 
Accountability Act (HIPAA) to, among other things, provide funding 
through transfers to the Federal Bureau of Investigation (FBI) to carry 
out specific purposes of the Health Care Fraud and Abuse Control 
Program.[Footnote 1] In response to a request from you, the Department 
of Justice (DOJ) notified the Committee in October 2003 that after the 
terrorist attacks of September 11, 2001, and as a result of FBI's 
reprioritization of investigations, FBI shifted some agent resources 
from health care fraud investigations to counterterrorism matters. 
FBI's notification was based on reports from its time utilization 
system showing that fewer full time equivalents (FTEs) representing 
agents had been used for health care fraud investigations than had been 
budgeted for fiscal years 2002 and 2003.[Footnote 2]

The Committee expressed concern that this shift in agent resources 
might have resulted in FBI's not spending dedicated health care fraud 
investigation funds in accordance with HIPAA. You asked us to review 
FBI's accountability for the HIPAA transfers for fiscal years 2000 
through 2003. We determined (1) whether FBI had an adequate approach 
for ensuring the proper use of the HIPAA transfers and (2) the extent 
to which FBI expended these transferred funds on health care fraud 
investigations in fiscal years 2000 through 2003.

To address these objectives, we compared the design of FBI's existing 
financial internal controls and processes related to the HIPAA 
transfers and the administration of the funds on health care fraud 
investigations with our Standards for Internal Control in the Federal 
Government.[Footnote 3] We also evaluated schedules of health care 
fraud cost estimates prepared by FBI. We performed our work in 
accordance with generally accepted government auditing standards from 
February 2004 to January 2005. Our scope and methodology are discussed 
in greater detail in appendix I. We requested comments on a draft of 
this report from the Director of FBI or his designee. The joint letter 
with comments from DOJ and FBI is reprinted in appendix II.

Results in Brief:

FBI used a limited approach to monitor its use of HIPAA transfers, 
which might have been sufficient when it clearly used more agent FTEs 
for health care fraud investigations than budgeted but was insufficient 
when some agent FTEs previously devoted to health care fraud 
investigations were shifted to counterterrorism activities. As annually 
budgeted, FBI committed FTEs (agents and other personnel) and assigned 
related costs (such as rent and utilities) equivalent to the amount of 
the HIPAA transfers. However, FBI's approach to monitoring the use of 
HIPAA transfers considered only agent FTEs, which made up about 42 
percent of budgeted health care fraud costs but did not consider other 
personnel and related costs that contributed to the health care fraud 
investigations.[Footnote 4] FBI officials told us they did not monitor 
these other budgeted amounts in determining compliance with HIPAA 
because the actual agent FTEs were historically far in excess of those 
budgeted. However, once FBI began to shift agent resources away from 
health care fraud investigations, the agent FTEs charged to health care 
fraud investigations fell below the budgeted amounts, and FBI could no 
longer reasonably rely on this limited approach to assure the proper 
use of the HIPAA transfers. At the time of our review, FBI's Financial 
Management System was not capable of tracking the overall costs of its 
health care fraud investigations, and therefore, FBI was not in a 
position to determine whether or not all transferred funds were spent 
for the purpose provided. DOJ is currently planning to implement a new 
DOJ-wide Unified Financial Management System (UFMS) but has yet to 
develop the specific systems requirements that would enable FBI to 
accurately capture all of its health care fraud-related costs and 
therefore to help monitor compliance with HIPAA and other relevant laws 
and regulations.

In response to our review, FBI engaged in extensive manual efforts to 
estimate its costs related to health care fraud investigations for 
fiscal years 2000 through 2003. The original estimates, based on the 
type of costs budgeted, showed that FBI spent more on its health care 
fraud investigations than was funded by the transfers for fiscal years 
2000 and 2001 but less than was funded by transfers for fiscal years 
2002 and 2003. A subsequent FBI estimate adding additional appropriate 
indirect costs such as training and forensic laboratory services showed 
that FBI spent more on health care fraud investigations than was funded 
by transfers for each of the 4 years. All of the components of these 
estimates, however, were based on data that had not been or could not 
be fully validated. For example, data in FBI's agent time utilization 
system, which is the primary element of agent costs and a key basis for 
all other costs, has never been properly tested or validated. Because 
of the data limitations, neither we nor the FBI could reliably 
determine whether all of the HIPAA transfers were used solely for 
health care fraud investigations and related activities for the 4-year 
period.

We are making four recommendations to enhance FBI's accountability over 
the HIPAA transfers and the cost of its health care fraud 
investigations. In the long term, we recommend that FBI augment the 
cost-tracking capabilities of the new UFMS for both payroll and other 
costs. In the interim, we recommend that FBI establish formal policies 
and procedures that would specify how costs are to be reported and 
adequately supported and take steps to assure the reliability of the 
underlying data. FBI's Chief Financial Officer stated that DOJ and FBI 
agreed with our four recommendations and that FBI has already begun 
actions devoted to ensuring that its execution of HIPAA fully meets 
Congress's intent.

Background:

The Health Insurance Portability and Accountability Act of 1996 amended 
the Social Security Act (the act) to, among other things, (1) establish 
a Health Care Fraud and Abuse Control Program[Footnote 5] and (2) 
establish an expenditure account, designated as the Health Care Fraud 
and Abuse Control Account (Account) within the Federal Hospital 
Insurance Trust Fund (Trust Fund).[Footnote 6] The Account is 
administered by Department of Health and Human Services' (HHS) Office 
of Inspector General and DOJ. The amendment also makes appropriations 
for the Account from the general fund of the U.S. Treasury. The 
appropriations are in specified amounts for each fiscal year beginning 
with fiscal year 1997 for transfer to FBI to carry out its health care 
fraud investigations.[Footnote 7]

In 1997 HHS and FBI entered into an interagency agreement to facilitate 
the required annual transfer of funds from the Account to FBI solely 
for its health care fraud investigations. FBI receives the transferred 
funds and records the funds in its Salaries and Expenses (S&E) 
appropriation account at the beginning of each fiscal year. FBI then 
incurs obligations for health care fraud investigations and makes 
payments from the S&E account, which is also used to make payments for 
other FBI mission-related and support activities. The amounts that were 
transferred to FBI as required by the act for the years of our review 
were as follows:

* fiscal year 2000: $76 million,

* fiscal year 2001: $88 million,

* fiscal year 2002: $101 million, and:

* fiscal year 2003: $114 million (and each subsequent year).

The amendment requires that these funds be used solely to cover the 
costs (including equipment, salaries and benefits, and travel and 
training) of the administration and operation of the health care fraud 
and abuse control program, including the costs of prosecuting health 
care matters, investigations, financial and performance audits of 
health care programs, and inspections and other evaluations. These 
health care fraud investigations are managed nationally by FBI's Health 
Care Fraud Unit (HCFU), which was created in 1992 within the Financial 
Crimes Section of the FBI's Criminal Investigative Division. Health 
care fraud investigations include those for fraud against government 
programs and private insurance, as well as medical privacy law 
violations. HCFU is responsible for health care fraud investigations 
that are conducted by FBI's field offices and, for management and 
reporting purposes, both HCFU and the related field investigations are 
considered a part of its White Collar Crime decision unit.

FBI's Monitoring Approach for HIPAA Transfers Provided Little Assurance 
of Transfers' Proper Use:

FBI used a limited approach to monitoring its use of HIPAA transfers, 
which might have been sufficient when it clearly used more agent FTEs 
for health care fraud investigations than it had budgeted. But this 
approach was insufficient when some of the agent FTEs previously 
devoted to health care fraud investigations were shifted to 
counterterrorism activities, causing actual FTEs to fall below budgeted 
FTEs. At the time of our review, FBI's Financial Management System 
(FMS) was unable to track overall costs related to health care fraud 
investigations. As a result, FBI had minimal assurance that all of the 
transferred HIPAA funds were properly spent. DOJ is currently planning 
to implement the new DOJ-wide Unified Financial Management System, but 
it has yet to develop the specific systems requirements to enable it to 
accurately capture all of the costs of its health care fraud 
investigations and therefore to help monitor compliance with HIPAA and 
other relevant laws and regulations.

FBI's budget for health care fraud investigations was equivalent to the 
amount of the HIPAA transfers and included only the direct program 
costs. These direct costs consisted of payroll and benefits for agents 
and certain other personnel involved in health care fraud 
investigations,[Footnote 8] plus related costs such as rent and 
supplies. FBI used an approach to monitoring the use of HIPAA transfers 
that considered agent FTEs only without considering the other direct 
program costs. For the 4 years we reviewed, the agent FTEs represented 
about 42 percent of the budgeted amounts for work on health care fraud 
investigations, while the other direct program costs represented about 
58 percent of the budgeted amounts. FBI obtained agent FTEs from 
reports generated by its time utilization system, which records the 
percentage of time that agents worked on each investigative 
classification and, if applicable, major cases. FBI officials told us 
that prior to September 11, 2001, reported agent FTEs charged to the 
health care fraud investigations were historically far in excess of 
those budgeted and they were satisfied that the resources expended on 
health care fraud investigations exceeded the HIPPA transfers.[Footnote 
9] For example, in fiscal year 2000, FBI reported that health care 
fraud agent FTEs exceeded the number budgeted that year by about 19 
percent.

However, this limited approach to monitoring the use of the HIPAA 
transfers was insufficient when agent FTEs were shifted to 
counterterrorism activities after September 11, 2001, because it lacked 
the specificity of cost information for both direct and indirect 
costs.[Footnote 10] Furthermore, FBI's FMS was not capable of providing 
this specific cost information. Therefore, in years when reported agent 
FTEs were close to or below budgeted FTE amounts, FBI had no effective 
mechanism in place to monitor compliance with HIPAA. This was the case 
when reported agent FTEs approximated the budgeted amounts in fiscal 
year 2001 and fell below budgeted FTEs in fiscal years 2002 and 2003 by 
31 percent and 26 percent, respectively.

Reliable information on the costs of federal programs and activities is 
crucial for the effective management of government operations and 
assists internal and external users in assessing the budget integrity, 
operating performance, stewardship, and systems and control of program 
activities. In this regard, the Chief Financial Officers Act of 1990 
expressly calls on agencies to provide for the systematic measurement 
of performance and the development of cost information.[Footnote 11] In 
addition, "Statement of Federal Financial Accounting Standards Number 
4" established for all federal agencies cost accounting concepts and 
standards aimed at providing reliable and timely information on the 
full cost of federal programs, their activities, and outputs.[Footnote 
12] Cost information for program activities is especially crucial in 
order to properly manage and account for funds that have been 
appropriated, or in this case, transferred for certain authorized 
purposes.

FBI's FMS has minimal capability to track health care fraud 
investigation and other specific program costs necessary to meet 
federal guidance. FMS tracks costs by cost center, of which only 
headquarters costs are separately identifiable by program.[Footnote 13] 
However, substantially all of the direct costs for health care fraud 
investigations are incurred at the individual field offices, each of 
which is considered separate cost centers. The specific program costs 
within each field location, therefore, are not individually tracked or 
separately identifiable. As a result, FBI cannot use FMS to track and 
report all health care fraud investigation costs.

DOJ is currently in the process of implementing a new financial 
management system. The new UFMS is likely to have the capability to 
capture nonpersonnel costs on a program or subprogram basis, if design 
specifications are set to do so. However, according to FBI finance 
officials, specifications have not been set up for UFMS to capture 
total payroll costs at the program level. These costs amounted to about 
55 percent of the budgeted health care fraud investigation costs. Under 
UFMS as currently planned, payroll costs are to be processed by the 
U.S. Department of Agriculture's National Finance Center (NFC)[Footnote 
14] starting in 2006 and recorded at the summary level. As a result, 
they will be combined with the payroll costs of other programs and will 
not be separately identifiable.

NFC officials told us that they recommend that all customers receive 
summary and detailed-level data. NFC uses a 27-digit accounting code, 
of which 24 digits are available to agencies to establish an account 
structure for detailed payroll information such as program, subprogram, 
and job code levels. NFC officials also stated that they met informally 
with FBI personnel and explained how the accounting codes could be used 
to support FBI's needs. An FBI official told us that because of 
security concerns, FBI would have to give consideration to using such 
codes. The absence of accounting codes for programs and subprograms or 
other control mechanisms for monitoring payroll and other costs will 
continue to impede FBI's ability to assess compliance with HIPAA and 
other relevant laws and regulations.

FBI's Cost Estimates of Health Care Fraud Investigations Were Not 
Adequately Supported:

In the absence of system-generated program costs and upon our request 
for cost schedules, FBI began developing an estimate of its health care 
fraud investigation costs incurred for fiscal years 2000 through 2003 
in an attempt to determine the propriety of its use of the HIPAA 
transfers. FBI engaged in extensive manual efforts and developed cost 
estimates that, in their final form, appropriately considered both 
direct program costs and the portion of indirect, FBI-wide support unit 
costs that related to the health care fraud program. However, we found 
that the estimates were either directly or indirectly based on data 
from FBI's time utilization system, which had not been properly 
validated, and various other data that were not adequately supported. 
As a result, despite a good-faith effort by FBI to estimate these 
costs, neither we nor FBI could reliably determine whether the HIPAA 
transfers were spent solely on health care fraud investigations for the 
4-year period.

FBI officials told us at the start of our review that they were unable 
to provide us with a report of actual costs and had not previously 
estimated the costs associated with the transfers for fiscal years 2000 
through 2003 primarily because of the financial systems' weaknesses 
that we previously discussed. As an alternative, they proposed to 
provide us with an estimate of health care fraud investigation costs 
and subsequently developed an estimation methodology. Because cost 
estimates for this program had never before been attempted, FBI tried 
different approaches and revised the estimates several times during our 
review. The first three estimates for the 4-year period were revised to 
reflect slight changes in the methodology and to correct an error in 
the estimates but were quite similar to each other in method and in 
results. In essence, FBI estimated the direct costs for each budgeted 
line item of the health care fraud program. These were categorized into 
four groups: (1) headquarters payroll and benefits; (2) agent payroll 
and benefits; (3) other field personnel's payroll and benefits; and (4) 
related nonpersonnel costs such as utilities, equipment, and supplies. 
The method for estimating each group is as follows:

* Headquarters payroll and benefits, as previously discussed, were 
predominantly tracked in FMS.

* The agent payroll and benefits costs, accounting for approximately 46 
percent of FBI's estimated program costs for the 4 years,[Footnote 15] 
were estimated directly on the basis of agent FTEs reported in FBI's 
Time Utilization and Record Keeping (TURK) system and average FBI-wide 
salaries and benefits for General Schedule 10-13 field agents.

* The other field personnel's payroll and benefits, which represented 
about 29 percent of FBI's estimated program costs for the 4 
years,[Footnote 16] were estimated from a combination of sources, 
including investigative support staff FTEs from its TURK system, that 
were summarized in two manual spreadsheets. The spreadsheets were 
prepared by two staff members, one of whom no longer works at FBI. The 
methodology for this staff member's spreadsheet is uncertain, and the 
results could not be verified.

* FBI's related nonpersonnel cost estimates were generally 
proportionate to the budgeted amount on the basis of a ratio of 
budgeted FTEs versus the FTEs reported in the TURK system. For example, 
for fiscal year 2003, the nonpersonnel costs line-item amounts were 
estimated at about 79 percent of the budgeted amount, since only 664 
total FTEs were reportedly charged to health care fraud investigations, 
while a total of 844 FTEs were budgeted.[Footnote 17] However, the 
budgeted and estimated amounts for these costs were not subsequently 
compared with actual costs for any of the years presented in order to 
verify the reasonableness of the amounts.

We determined that the primary source data used either directly or 
indirectly to estimate the health care fraud costs, as reported from 
the TURK system, had not been properly tested to determine the reliance 
that could be placed on the information. Prior to fiscal year 2002, the 
work time percentages and related investigative classification 
information in the TURK system, which has been operational in its 
current form since 1991 and is used by FBI for a variety of budgetary 
and program management decision making, had never been properly 
validated. We found that for fiscal years 2002 and 2003, FBI conducted 
limited internal testing, including tests on whether the work hours 
recorded in the system were correctly charged to the appropriate 
investigative case. The tests were performed at all of the field office 
locations and produced error rates that varied from year to year and 
across field locations but were not conducted on statistically valid 
samples. Therefore, the results cannot be applied to the population 
beyond the specific items tested. Nonetheless, the identified errors 
raise questions about the reliability of the data in TURK and 
demonstrate the need for additional data validation work by FBI. In 
addition, a key financial official indicated that at least one of the 
tests might not have been properly designed to validate the data.

In addition to the lack of validation of the TURK data, certain other 
supporting documentation could not be verified or was not adequate. 
Examples include the following:

* The health care fraud equipment account, approximately 5 percent of 
budgeted amounts for the 4 years, funded purchases other than equipment 
such as travel and training expenses and was used much like a 
discretionary account. FBI officials told us that at year's end, these 
nonequipment costs were adjusted by moving them out of the equipment 
account and into the appropriate line item on the basis of the amounts 
recorded in a detailed listing of purchases prepared by HCFU. We were 
unable to reconcile the amount of purchases recorded in the detailed 
equipment listings or the amount of interaccount adjustments to the FBI 
cost estimates, and no such reconciliation was provided by FBI. The 
amount of interaccount adjustments ranged from $424,000 to $7.5 million 
a year for the 4 years under review.

* FBI used average salaries of support personnel at year's end that 
might not have accurately represented the mix of salaries of the staff 
supporting health care fraud investigations whose duties ranged from 
administrative to professional (e.g., medical experts).

* FBI surveyed field office managers in an effort to capture other FTEs 
that were related to health care fraud investigations. Field managers 
estimated the portion of hours or FTEs spent investigating health care 
fraud cases that were recorded in TURK under other investigative 
classifications. For example, a case dealing with an Internet pharmacy 
that was investigated by a Cyber Crimes squad could be considered a 
health care fraud investigation and included in the estimate of health 
care fraud costs. These other agent FTEs are difficult to verify and, 
in some cases, were reported from memory.

On average, the first three FBI cost estimates showed that FBI spent 
$33 million more on health care fraud investigations than the amount of 
the HIPAA transfers for fiscal years 2000 and 2001 and about $29 
million less than the HIPAA transfers for fiscal years 2002 and 2003. 
When we were provided with these cost estimates, FBI officials stated 
that this shift in resources away from health care fraud investigations 
in the latter 2 years was a result of the increase in the 
counterterrorism investigative activity after the September 11 attacks. 
FBI management prepared a fourth and final cost estimate that included 
an allocation of the additional costs of other FBI units, such as 
forensic laboratory services and mandatory training that support 
various FBI programs, including the health care fraud program. While it 
is generally appropriate to include such indirect costs when 
determining total program costs, these additional costs were not 
previously considered when budgeting the funds transferred by the 
Congress to FBI for its health care fraud investigations.[Footnote 18] 
Furthermore, these additional items were not included in DOJ's October 
2003 response to the Senate Finance Committee regarding FBI's use of 
the HIPAA transfers.

FBI estimated the portion of costs for each of the six support units-- 
training, forensics, information management, technical field support, 
criminal justice services, and management and administration--that 
related to health care fraud investigations and added them to the 
estimates of direct costs previously provided to us in the third 
version. While FBI put forth a good-faith effort to devise a way to 
allocate the indirect support unit costs to health care fraud 
investigations, its methodology relied, in part, on layers of 
unvalidated data. For example, FBI allocated FBI-wide support unit 
costs as reported in its audited financial statements first to the DOJ 
Strategic Goal that included health care fraud investigations.[Footnote 
19] The percentages used in this calculation were the same used to 
allocate costs for FBI's Statement of Net Cost; however, FBI's auditors 
said they did not validate the methodology or documentation supporting 
the allocation percentages. After FBI allocated the specific support 
unit costs to the DOJ Strategic Goals, FBI allocated those costs to 
health care fraud investigations using FTE data based primarily on 
TURK, which, as previously discussed, has not been validated.

On average, the additional indirect costs represented approximately $34 
million, or 27 percent of total health care fraud costs per year. With 
the addition of these indirect costs, FBI ultimately estimated that it 
spent more on health care fraud investigations than was funded by the 
HIPAA transfers for all 4 years. However, with the magnitude of 
unverified and inadequately supported data, neither we nor FBI could 
reliably determine whether the HIPAA transfers were spent solely on 
health care fraud investigations for the 4-year period.

Conclusions:

FBI's monitoring approach for determining the proper use of HIPAA 
funding was limited and did not provide the level of assurance needed 
when agent FTEs devoted to health care fraud investigations were close 
to or below budgeted amounts. Absent a financial management system that 
could capture the costs of its health care fraud investigations, FBI 
had to resort to extensive manual efforts to estimate the costs but did 
not have the data needed to do so reliably. Until FBI improves its data 
reliability and either develops a financial management system capable 
of tracking and reporting health care fraud investigation cost 
information or some other effective monitoring approach, it will 
continue to lack sufficient accountability over the use of the HIPAA 
transfers. Inadequate accountability hinders efforts to budget, manage, 
and account for program funds appropriately and will leave FBI at an 
increased risk of violating HIPAA and other laws.

Recommendations for Executive Action:

We are making four total recommendations--two enhancing FBI's 
accountability over the HIPAA transfers and the costs related to health 
care fraud investigations in the short term and two augmenting the new 
Unified Financial Management System's cost-tracking capabilities in the 
long term. We recommend that the Director of the FBI take the following 
actions:

* Develop formal, interim policies and procedures for reporting health 
care fraud investigation costs that specify (1) the costs to be 
estimated and/or allocated, (2) the supporting documentation to be 
maintained, and (3) the method to validate those data used.

* Periodically conduct statistically valid testing of the data in the 
Time Utilization and Record Keeping system, in particular, the work 
time percentages and related investigative classification information 
to ensure the TURK system's reliability. In addition, require field 
office managers to follow up on any issues identified in the testing.

* Either specify that the UFMS have the capability to allocate payroll 
costs provided by the NFC payroll system to specific programs or 
develop cost accounting codes at the program and subprogram levels to 
enable NFC to provide the necessary detailed payroll reports.

* Ensure that the UFMS has the capability and design specifications to 
track nonpersonnel costs related to health care fraud investigations.

Agency Comments and Our Evaluation:

In a joint letter with written comments on a draft of this report 
(reprinted in appendix II), DOJ and FBI agreed with the four 
recommendations in this report and said they have begun to address the 
two short-term recommendations. Specifically, FBI is expecting to 
complete reviews of its procedures used to track health care fraud 
investigation costs and the collection and validation procedures for 
data entered into the TURK system by May 31, 2005. Concerning the long- 
term solution through financial management system enhancements, FBI 
acknowledged the need to establish control mechanisms to monitor both 
personnel and nonpersonnel costs related to health care fraud 
investigations to ensure the transparent allocation of FBI resources 
while maintaining appropriate levels of security. FBI notes that health 
care fraud investigations funded by HIPAA have contributed to a number 
of significant, high-profile case accomplishments as a result of the 
FBI's dedication of HIPAA resources. FBI and DOJ officials provided 
oral comments on technical matters, which we have incorporated as 
appropriate.

As agreed with your office, unless you publicly announce its contents 
earlier, we plan no further distribution of this report until 30 days 
from its issue date. At that time, we will send copies of this report 
to the Ranking Minority Member, Senate Committee on Finance; the 
Attorney General of the United States; the Director, FBI; the Director, 
Office of Management and Budget; and other interested parties. We will 
make copies available to others upon request. In addition, the report 
will be available at no charge on the GAO Web site at [Hyperlink, 
http://www.gao.gov].

Should you or your staff have any questions on the matters discussed in 
this report, please contact me on (202) 512-9508 or by e-mail at 
[Hyperlink, calboml@gao.gov] or contact Steven R. Haughton, Assistant 
Director, at (202) 512-5999 or [Hyperlink, haughtons@gao.gov]. Major 
contributors to this report are included in appendix III.

Sincerely yours,

Signed by: 

Linda M. Calbom: 
Director, Financial Management and Assurance:

[End of section]

Appendixes:

Appendix I: Scope and Methodology:

We reviewed the internal controls related to the use of the Health 
Insurance Portability and Accountability Act (HIPAA) transfers and the 
cost estimates of health care fraud investigations for fiscal years 
2000 through 2003.

We requested available documentation of the policies, procedures, and 
guidelines relating to the HIPAA transfers and the health care fraud 
program. We conducted interviews with Federal Bureau of Investigation 
(FBI) officials to obtain an understanding of the internal controls, 
including fund controls, in place over transferred funds. We reviewed 
the sufficiency of those internal controls in light of GAO's Standards 
for Internal Control in the Federal Government.

Because of the inability of FBI's existing Financial Management System 
to produce program-level cost information as described in this report, 
FBI developed an estimate of the costs of health care fraud 
investigations. FBI provided us with a schedule of cost estimates for 
its health care fraud investigations for each of the 4 fiscal years, a 
description of the cost-estimation methodology, and various 
documentation that supported some of the headquarters and field office 
costs. During the course of our work, FBI modified its original 
schedule of cost estimates twice because of slight changes to the cost- 
estimation methodology. For all three schedules of costs, we evaluated 
the overall method of cost estimation to determine the method's 
reasonableness and ability to assure that applicable laws and 
regulations were followed. Additionally, we (1) identified the sources 
of information used in the methodology; (2) verified, where possible, 
the underlying data flow and formulas; and (3) compared the cost 
estimates with the amount of funds transferred to FBI for each of the 4 
years. FBI provided us with a fourth and final schedule of cost 
estimates on January 5, 2005, which included allocations of FBI-wide 
administrative and support costs not originally considered part of 
health care fraud costs. We requested supporting documentation for 
these additional allocations and reviewed the limited documentation 
that was available.

FBI's cost-estimation methodology was based significantly on 
information derived from the Time Utilization and Record Keeping 
system. We were unable to rely on this system's data for the purpose of 
our review because the data for fiscal years 2000 and 2001 had not been 
validated and a limited internal review reported varying error rates 
for the data for fiscal years 2002 and 2003. The internal review, 
however, was not statistically valid. We did not attempt to 
independently validate the system.

We performed our work from February 2004 through January 2005 in 
accordance with generally accepted government auditing standards. We 
requested written comments on this report from the Director of the FBI 
or his designee. A joint letter with comments from DOJ and FBI was 
received and is reprinted in appendix II.

[End of section]

Appendix II: Comments from the Department of Justice and the Federal 
Bureau of Investigation:

U.S. Department of Justice:
Federal Bureau of Investigation:
Washington, D. C. 20535-0001:

April 13, 2005:

Ms. Linda M. Calbom:
Director, Financial Management and Assurance: 
United States Government Accountability Office: 
Washington, DC 20548:

Re: GAO-05-388:

Dear Ms. Calbom,

Thank you for the opportunity to review the Government Accountability 
Office (GAO) draft report entitled "Federal Bureau of Investigation: 
Accountability over HIPAA Funding of Health Care Fraud Investigations 
is Inadequate." The draft report has been reviewed by various 
components of the Department of Justice (DOJ), including the FBI's 
Finance Division. This letter constitutes the formal Department of 
Justice comments to the draft report and it is requested that it be 
included in the GAO's final report.

The FBI is devoted to ensuring that its execution of the Health 
Insurance Portability and Accountability Act of 1996 (HIPAA) fully 
meets the intent of the Congress. Since the FBI first started receiving 
HIPAA resources in Fiscal Year (FY) 1997, the FBI has made health care 
fraud investigations one of its top white collar criminal investigative 
priorities. In communications to FBI field offices, program managers at 
FBI Headquarters have made it very clear that the Bureau's HIPAA-funded 
resources are to be dedicated as the Congress intended. As a direct 
result, the FBI's investigations into health care fraud have yielded a 
significant return on the public's investment through the HIPAA.

FBI health care fraud investigations funded by the HIPAA have 
contributed to a number of significant, high-profile case 
accomplishments, including, but not limited to, the following:

-In 2003, the federal government resolved its litigation against the 
nation's largest for-profit hospital company, HCA (formerly known as 
Columbia/HCA). After an investigation that was a model of cooperation 
among federal and state investigative authorities, HCA paid the United 
States $631 million to resolve liability for false claims resulting 
from a variety of allegedly unlawful practices, including cost report 
fraud and the payment of kickbacks to physicians. Previously, in 2000, 
HCA subsidiaries pled guilty to substantial criminal conduct in 
multiple districts and paid more than $840 million in criminal fines, 
civil damages, and penalties. Combined with a separate administrative 
settlement with the Centers for Medicare & Medicaid Services, under 
which HCA paid an additional $250 million to resolve overpayment claims 
arising from certain of its cost reporting practices, the government 
recovered $1.7 billion from HCA, by far the largest recovery ever 
reached by the government in a health care fraud investigation.

-In coordination with the Department of Health and Human Services, 
Office of the Inspector General (HHS-OIG), the FBI launched the 
National Initiative on Ambulance and Medical Transportation Fraud. 
After conducting specialized training, 37 FBI field offices 
investigated 101 cases pertaining to ambulance or medical 
transportation fraud from FY 2000 to FY 2003. These cases resulted in 
55 convictions, 34 plea agreements or settlements, and total 
restitution ordered of $65 million.

-In FY 2003, following an FBI/FDA investigation into allegations of 
dilution of chemotherapy medications, pharmacist Robert Courtney 
entered a guilty plea, was sentenced to 30 years imprisonment, and was 
ordered to pay restitution in the approximate amount of $10.6 million. 
Subsequent findings in the case identified approximately 4,200 victims 
and 98,000 potentially adulterated prescriptions dating back as far as 
1985. As a result of investigating the source of the chemotherapy drugs 
that Courtney purchased, six other convictions were obtained against 
defendants who were diverting prescription drugs from appropriate 
distribution channels.

-Operation Headwaters was an investigation which began in FY 1999 and 
targeted durable medical equipment manufacturers across the U.S. in the 
area of enteral feeding, diabetic footwear, and wound care products. To 
date, this investigation has resulted in four corporate pleas, seven 
convictions of individuals, criminal fines in excess of $216 million, 
and civil restitution and fines of approximately $454.5 million.

The foreign terrorist attacks upon the U.S. on September 11, 2001 
demanded an instant 100% commitment from the FBI towards 
counterterrorism. In the days and weeks that followed the attacks, 
almost every FBI Agent in the world worked diligently on one of the 
most massive investigations in the FBI's history. Nonetheless, the 
months that followed the attacks showed that the FBI was able to 
regroup, refocus, and balance the urgent priority of counterterrorism 
investigations with its commitments towards other criminal 
investigations, including health care fraud. FBI Headquarters program 
managers ensured that field offices planned for and undertook the steps 
necessary to eventually return to staffing levels planned for these 
other investigations, including health care fraud investigations.

The FBI is in agreement with the GAO concerning all four of its 
recommendations. The FBI recognizes the necessity of having a full and 
accurate reporting of its financial data to track resources received as 
a result of the HIPAA. The FBI believes that the health care fraud 
investigation cost data provided to the GAO are accurate. Nonetheless, 
the FBI also recognizes the necessity of having these cost data 
properly validated. In acknowledgement of the need to develop formal, 
interim policies and procedures for reporting health care fraud 
investigation costs, the FBI is currently in the process of conducting 
a review of the methods used to estimate, document, and validate these 
costs. The goal of this review is to establish an interim process that 
will fully meet the expectations of the Congress in the reliability and 
validity of the FBI's reporting of health care fraud investigation 
costs.

The FBI currently relies upon its Time Utilization Record Keeping 
(TURK) system to track the hundreds of different types of investigative 
classifications worked by FBI Field Agents. The FBI acknowledges the 
need to conduct statistically valid testing of data entered into the 
TURK system, and thus plans to update testing and controls surrounding 
all aspects of TURK data collection. In addition, any future FBI 
resource utilization tracking systems will be designed to interact with 
UFMS and/or payroll data systems in order to provide cost information 
down to the program and subprogram level. Although the FBI is concerned 
with overburdening its field agents with increased administrative 
matters, nonetheless field agents are expected to record this program 
deployment information completely and accurately.

In acknowledgement of its long-term need to update its cost-tracking 
capabilities, the FBI has provided full-time staff resources to 
participate in the DOJ's Unified Financial Management System (UFMS) 
project. As part of its transition plan, the DOJ plans on interfacing 
the UFMS with the National Finance Center's (NFC) payroll system. The 
DOJ has not yet determined which specific NFC data elements will be 
interfaced with the UFMS. Once the DOJ has completed defining its 
standard codes, the FBI will define its codes in accordance with the 
Department's plan. Due to the sensitivity of FBI program information, 
the FBI does not expect development of cost accounting codes at the 
program and subprogram level for sending payroll data to the NFC. 
However, the FBI recognizes that it must have the capability to 
allocate payroll costs provided by the NFC program to specific 
programs. Therefore, the FBI expects that it will use payroll output 
data from the NFC to port into a system, managed by the FBI, that will 
establish control mechanisms for monitoring costs of FBI programs and 
subprograms, most notably the FBI's Health Care Fraud Program.

The FBI acknowledges the need to track non-personnel costs related to 
health care fraud investigations. In the development of a future cost 
accounting system, the FBI will establish control mechanisms to monitor 
all aspects of FBI operations, including both investigative and support 
programs. These controls will track both personnel and non-personnel 
resources devoted to these programs. Any future system used to track 
these costs will be designed to meet the expectations of the Congress 
in transparency of allocation of FBI resources, while maintaining the 
level of security that is absolutely required for the continued 
operation of FBI programs.

To summarize, the FBI is taking the following actions as an immediate 
response to the recommendations offered by the GAO:

1. The FBI is conducting a full review of the cost accounting systems 
and procedures currently in place used to track health care fraud 
investigation costs. This review will be required to include 
recommendations for near-term policies and procedures to ensure valid, 
reliable, and fully documented data on health care fraud investigation 
costs, until implementation of new, permanent cost tracking mechanisms 
can be put in place. This review is due for completion and report to 
the FBI's Chief Financial Officer by May 31, 2005.

2. The FBI is conducting a full review of the collection and validation 
procedures for data entered into the TURK system. This review will be 
required to include recommendations for near and long-term policies and 
procedures that will ensure valid statistical sampling in audits of the 
TURK database, as well as proper oversight of TURK data entry at the 
field office level. This review is due for completion and report to the 
FBI's Chief Financial Officer by May 31, 2005.

Thank you for the opportunity to comment on your report.

Signed by: 

Joseph L. Ford:

Chief Financial Officer:
Assistant Director, Finance Division: 

[End of section]

Appendix III: GAO Contacts and Staff Acknowledgments:

GAO Contacts:

Linda M. Calbom, (202) 512-9508; 
Steven R. Haughton, (202) 512-5999:

Acknowledgments:

In addition to those named above, Sharon O. Byrd, Richard T. Cambosos, 
Tyshawn A. Davis, Lori B. Ryza, and Ruth S. Walk made key contributions 
to this report.

(190116):

FOOTNOTES

[1] Public Law No. 104-191, title II, subtitle A, 201(a)(b), 110 Stat. 
1936, 1992-93 (Aug. 21, 1996) (codified at 42 U.S.C.  1320a-7c, 
1395i(k)(1), (3)(B)).

[2] An FTE is a workforce measure equal to 1 work year--2,600 hours for 
agents and 2,080 hours for nonagents.

[3] GAO, Standards for Internal Control in the Federal Government, GAO/ 
AIMD-00-21.3.1. (Washington, D.C.: November 1999).

[4] FBI budgeted direct costs (such as agent and other personnel 
compensation and benefits, rent, and utilities costs) for the health 
care fraud program. Indirect costs contributing to health care fraud 
investigations, such as FBI-wide training and forensic laboratory 
services, were budgeted under other programs or units.

[5] See, 42 U.S.C. 1320a-7c(a).

[6] See, 42 U.S.C. 1395i(k)(1). The Account also serves as a pass- 
through account for amounts deposited to and appropriated from the 
Trust Fund in support of the Health Care Fraud and Abuse Control 
Program administered by HHS and DOJ and the Medicare Integrity Program, 
which is administered by HHS. See, 42 U.S.C. 1395i(k)(2), (3)(A), (4). 
We have also audited other amounts deposited to and appropriated from 
the Trust Fund every 2 years, starting in 1998. The last required audit 
is in process. For the most recent report, see GAO, Medicare: Health 
Care Fraud and Abuse Control Program for Fiscal Years 2000 and 2001, 
GAO-02-731 (Washington, D.C.: June 3, 2002).

[7] See, 42 U.S.C. 1395i(k)(3)(B). Since their inception, the 
authorized transfers have increased incrementally, beginning with $47 
million in fiscal year 1997.

[8] Other personnel include supervisory agents and both administrative 
and investigative support staff.

[9] In years that FBI agents engaged in more health care fraud 
investigations than were covered by the transferred amounts, FBI funded 
the difference with its S&E appropriation.

[10] These indirect costs included FBI-wide training and forensic 
laboratory services as further described in the next section.

[11] See, 31 U.S.C. 902(a)(3)(D).

[12] Federal Accounting Standards Advisory Board, "Statement of Federal 
Financial Accounting Standards Number 4" Managerial Cost Accounting 
Concepts and Standards for the Federal Government (Washington, D.C.: 
July 31, 1995).

[13] Headquarters costs are less than 1 percent of total reported 
health care fraud investigation costs. These costs tracked in FMS 
include personnel-type costs only, such as regular compensation and 
benefits and incentive awards.

[14] NFC develops and operates administrative and financial systems, 
including payroll/personnel, administrative payments, and accounts 
receivable for both the U.S. Department of Agriculture and more than 60 
other federal organizations under cross-servicing or franchising 
agreements.

[15] FBI estimated its actual agent payroll and benefits costs to be 46 
percent of total health care fraud costs. This was subsequently revised 
to 34 percent with the addition of indirect costs in the fourth version 
of its costs estimates, as described later.

[16] FBI estimated its other personnel's payroll and benefits costs to 
be 29 percent of total health care fraud costs. This was subsequently 
revised to 21 percent with the addition of indirect costs in the fourth 
version of its cost estimates, as described later.

[17] Various immaterial nonpersonnel cost line items, such as automated 
data-processing services and special operations, were reported at 
budgeted amounts. The health care fraud equipment line item was 
adjusted at year's end in an attempt to reflect actual equipment costs 
only.

[18] As stated in "Statement of Federal Financial Accounting Standards 
Number 4," it is appropriate to include both direct and indirect costs 
when reporting the full costs of program activities.

[19] FBI officials excluded from this allocation certain costs that 
were not associated with health care fraud investigations, such as 
international training.

GAO's Mission:

The Government Accountability Office, the investigative arm of 
Congress, exists to support Congress in meeting its constitutional 
responsibilities and to help improve the performance and accountability 
of the federal government for the American people. GAO examines the use 
of public funds; evaluates federal programs and policies; and provides 
analyses, recommendations, and other assistance to help Congress make 
informed oversight, policy, and funding decisions. GAO's commitment to 
good government is reflected in its core values of accountability, 
integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony:

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through the Internet. GAO's Web site ( www.gao.gov ) contains 
abstracts and full-text files of current reports and testimony and an 
expanding archive of older products. The Web site features a search 
engine to help you locate documents using key words and phrases. You 
can print these documents in their entirety, including charts and other 
graphics.

Each day, GAO issues a list of newly released reports, testimony, and 
correspondence. GAO posts this list, known as "Today's Reports," on its 
Web site daily. The list contains links to the full-text document 
files. To have GAO e-mail this list to you every afternoon, go to 
www.gao.gov and select "Subscribe to e-mail alerts" under the "Order 
GAO Products" heading.

Order by Mail or Phone:

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to:

U.S. Government Accountability Office

441 G Street NW, Room LM

Washington, D.C. 20548:

To order by Phone:

Voice: (202) 512-6000:

TDD: (202) 512-2537:

Fax: (202) 512-6061:

To Report Fraud, Waste, and Abuse in Federal Programs:

Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470:

Public Affairs:

Jeff Nelligan, managing director,

NelliganJ@gao.gov

(202) 512-4800

U.S. Government Accountability Office,

441 G Street NW, Room 7149

Washington, D.C. 20548: