Federal Bureau of Investigation: Accountability over the HIPAA	 
Funding of Health Care Fraud Investigations Is Inadequate	 
(22-APR-05, GAO-05-388).					 
                                                                 
The Health Insurance Portability and Accountability Act of 1996  
(HIPAA) provided, among other things, funding by transfer to the 
Federal Bureau of Investigation (FBI) to carry out specific	 
purposes of the Health Care Fraud and Abuse Control Program.	 
Congress expressed concern about a shift in FBI resources from	 
health care fraud investigations to counterterrorism activities  
after September 11, 2001. Congress asked GAO to review FBI's	 
accountability for the funds transferred under HIPAA for fiscal  
years 2000 through 2003. GAO determined (1) whether FBI had an	 
adequate approach for ensuring the proper use of the HIPAA	 
transfers and (2) the extent to which FBI had expended these	 
transferred funds on health care fraud investigations in fiscal  
years 2000 through 2003.					 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-05-388 					        
    ACCNO:   A22418						        
  TITLE:     Federal Bureau of Investigation: Accountability over the 
HIPAA Funding of Health Care Fraud Investigations Is Inadequate  
     DATE:   04/22/2005 
  SUBJECT:   Accountability					 
	     Cost analysis					 
	     Federal Bureau of Investigations			 
	     Federal funds					 
	     Federal law					 
	     Federal regulations				 
	     Financial management				 
	     Fraud						 
	     Funds management					 
	     Internal controls					 
	     Investigations by federal agencies 		 
	     Monitoring 					 
	     Appropriations/funds transfers			 
	     Cost estimates					 
	     DOJ/HHS Health Care Fraud and Abuse		 
	     Control Program					 
                                                                 
	     FBI Financial Management System			 
	     FBI Time Utilization and Record Keeping		 
	     System						 
                                                                 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-05-388

United States Government Accountability Office

         GAO	Report to the Chairman, Committee on Finance, U.S. Senate

April 2005

                                 FEDERAL BUREAU
                                OF INVESTIGATION

  Accountability over the HIPAA Funding of Health Care Fraud Investigations Is
                                   Inadequate

                                       a

GAO-05-388

[IMG]

April 2005

FEDERAL BUREAU OF INVESTIGATION

Accountability over the HIPAA Funding of Health Care Fraud Investigations Is
Inadequate

  What GAO Found

FBI used a limited approach to monitoring its use of HIPAA transfers,
which might have been sufficient during times when it clearly used more
agent full time equivalents (FTEs) for health care fraud investigations
than budgeted but was insufficient when some of the agent FTEs previously
devoted to health care fraud investigations were shifted to
counterterrorism activities. FBI's budgeted FTEs (agent and other
personnel) and related costs (such as rent and utilities) were equivalent
to the amount of the HIPAA transfers. However, FBI's approach to
monitoring the use of HIPAA transfers considered only agent FTEs, which
made up about 42 percent of the budgeted health care fraud costs, but did
not consider other personnel FTEs or related costs. According to FBI
officials, they did not monitor these other budgeted amounts to determine
compliance with HIPAA because the actual agent FTEs were historically far
in excess of those budgeted. However, once FBI began to shift agent
resources away from health care fraud investigations, agent FTEs charged
to health care fraud investigations fell below the budgeted amounts, and
FBI could no longer rely on this limited approach to ensure that the
transferred HIPAA funds were properly used. Furthermore, FBI did not have
a system in place to capture its overall health care fraud investigation
costs, and therefore, was not in a position to determine whether or not
all transferred HIPAA funds were properly expended.

In response to GAO's review, FBI engaged in extensive manual efforts to
develop cost estimates related to health care fraud investigations for
fiscal years 2000 through 2003. The final estimate provided to GAO showed
that FBI spent more on health care fraud investigations than was funded by
transfers for each of the 4 years. However, GAO found that, overall, FBI's
estimates of its health care fraud investigation costs were based on data
that had not been or could not be fully validated. Therefore, even though
FBI made a good-faith effort to estimate these costs, because of data
limitations, neither GAO nor FBI could reliably determine whether all of
the HIPAA transfers were spent solely for health care fraud investigations
and related activities for the 4-year period. DOJ is currently planning
the implementation of a new DOJ-wide UFMS, but it has yet to develop the
specific systems requirements that would enable FBI to accurately capture
all of its health care fraud-related costs and therefore to help monitor
compliance with HIPAA and other relevant laws and regulations.

                 United States Government Accountability Office

Contents

  Letter

Results in Brief
Background
FBI's Monitoring Approach for HIPAA Transfers Provided Little

Assurance of Transfers' Proper Use FBI's Cost Estimates of Health Care
Fraud Investigations Were Not

Adequately Supported Conclusions Recommendations for Executive Action
Agency Comments and Our Evaluation

1 2 4

5

8 13 13 14

Appendixes

Appendix I: Scope and Methodology 16

Appendix II:	Comments from the Department of Justice and the Federal
Bureau of Investigation 18

Appendix III: GAO Contacts and Staff Acknowledgments 21

Abbreviations

DOJ Department of Justice
FBI Federal Bureau of Investigation
FMS Financial Management System
FTE full time equivalent
GAO Government Accountability Office
HCFU Health Care Fraud Unit
HHS Department of Health and Human Services
HIPAA Health Insurance Portability and Accountability Act
NFC National Finance Center
S&E Salaries and Expenses
TURK Time Utilization and Record Keeping
UFMS Unified Financial Management System

Contents

This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.

A

United States Government Accountability Office Washington, D.C. 20548

April 22, 2005

The Honorable Charles E. Grassley Chairman Committee on Finance United
States Senate

Dear Mr. Chairman:

In 1996 the Congress passed the Health Insurance Portability and
Accountability Act (HIPAA) to, among other things, provide funding through
transfers to the Federal Bureau of Investigation (FBI) to carry out
specific purposes of the Health Care Fraud and Abuse Control Program.1 In
response to a request from you, the Department of Justice (DOJ) notified
the Committee in October 2003 that after the terrorist attacks of
September 11, 2001, and as a result of FBI's reprioritization of
investigations, FBI shifted some agent resources from health care fraud
investigations to counterterrorism matters. FBI's notification was based
on reports from its time utilization system showing that fewer full time
equivalents (FTEs) representing agents had been used for health care fraud
investigations than had been budgeted for fiscal years 2002 and 2003.2

The Committee expressed concern that this shift in agent resources might
have resulted in FBI's not spending dedicated health care fraud
investigation funds in accordance with HIPAA. You asked us to review FBI's
accountability for the HIPAA transfers for fiscal years 2000 through 2003.
We determined (1) whether FBI had an adequate approach for ensuring the
proper use of the HIPAA transfers and (2) the extent to which FBI expended
these transferred funds on health care fraud investigations in fiscal
years 2000 through 2003.

1 Public Law No. 104-191, title II, subtitle A, S:201(a)(b), 110 Stat.
1936, 1992-93 (Aug. 21, 1996) (codified at 42 U.S.C. S:S: 1320a-7c,
1395i(k)(1), (3)(B)).

2 An FTE is a workforce measure equal to 1 work year-2,600 hours for
agents and 2,080 hours for nonagents.

To address these objectives, we compared the design of FBI's existing
financial internal controls and processes related to the HIPAA transfers
and the administration of the funds on health care fraud investigations
with our Standards for Internal Control in the Federal Government.3 We
also evaluated schedules of health care fraud cost estimates prepared by
FBI. We performed our work in accordance with generally accepted
government auditing standards from February 2004 to January 2005. Our
scope and methodology are discussed in greater detail in appendix I. We
requested comments on a draft of this report from the Director of FBI or
his designee. The joint letter with comments from DOJ and FBI is reprinted
in appendix II.

Results in Brief	FBI used a limited approach to monitor its use of HIPAA
transfers, which might have been sufficient when it clearly used more
agent FTEs for health care fraud investigations than budgeted but was
insufficient when some agent FTEs previously devoted to health care fraud
investigations were shifted to counterterrorism activities. As annually
budgeted, FBI committed FTEs (agents and other personnel) and assigned
related costs (such as rent and utilities) equivalent to the amount of the
HIPAA transfers. However, FBI's approach to monitoring the use of HIPAA
transfers considered only agent FTEs, which made up about 42 percent of
budgeted health care fraud costs but did not consider other personnel and
related costs that contributed to the health care fraud investigations.4
FBI officials told us they did not monitor these other budgeted amounts in
determining compliance with HIPAA because the actual agent FTEs were
historically far in excess of those budgeted. However, once FBI began to
shift agent resources away from health care fraud investigations, the
agent FTEs charged to health care fraud investigations fell below the
budgeted amounts, and FBI could no longer reasonably rely on this limited
approach to assure the proper use of the HIPAA transfers. At the time of
our review, FBI's Financial Management System was not capable of tracking
the overall costs of its health care fraud investigations, and therefore,
FBI was not in a position to determine whether or not all transferred
funds were spent for

3 GAO, Standards for Internal Control in the Federal Government,
GAO/AIMD-00-21.3.1. (Washington, D.C.: November 1999).

4 FBI budgeted direct costs (such as agent and other personnel
compensation and benefits, rent, and utilities costs) for the health care
fraud program. Indirect costs contributing to health care fraud
investigations, such as FBI-wide training and forensic laboratory
services, were budgeted under other programs or units.

the purpose provided. DOJ is currently planning to implement a new
DOJ-wide Unified Financial Management System (UFMS) but has yet to develop
the specific systems requirements that would enable FBI to accurately
capture all of its health care fraud-related costs and therefore to help
monitor compliance with HIPAA and other relevant laws and regulations.

In response to our review, FBI engaged in extensive manual efforts to
estimate its costs related to health care fraud investigations for fiscal
years 2000 through 2003. The original estimates, based on the type of
costs budgeted, showed that FBI spent more on its health care fraud
investigations than was funded by the transfers for fiscal years 2000 and
2001 but less than was funded by transfers for fiscal years 2002 and 2003.
A subsequent FBI estimate adding additional appropriate indirect costs
such as training and forensic laboratory services showed that FBI spent
more on health care fraud investigations than was funded by transfers for
each of the 4 years. All of the components of these estimates, however,
were based on data that had not been or could not be fully validated. For
example, data in FBI's agent time utilization system, which is the primary
element of agent costs and a key basis for all other costs, has never been
properly tested or validated. Because of the data limitations, neither we
nor the FBI could reliably determine whether all of the HIPAA transfers
were used solely for health care fraud investigations and related
activities for the 4-year period.

We are making four recommendations to enhance FBI's accountability over
the HIPAA transfers and the cost of its health care fraud investigations.
In the long term, we recommend that FBI augment the cost-tracking
capabilities of the new UFMS for both payroll and other costs. In the
interim, we recommend that FBI establish formal policies and procedures
that would specify how costs are to be reported and adequately supported
and take steps to assure the reliability of the underlying data. FBI's
Chief Financial Officer stated that DOJ and FBI agreed with our four
recommendations and that FBI has already begun actions devoted to ensuring
that its execution of HIPAA fully meets Congress's intent.

Background	The Health Insurance Portability and Accountability Act of 1996
amended the Social Security Act (the act) to, among other things, (1)
establish a Health Care Fraud and Abuse Control Program5 and (2) establish
an expenditure account, designated as the Health Care Fraud and Abuse
Control Account (Account) within the Federal Hospital Insurance Trust Fund
(Trust Fund).6 The Account is administered by Department of Health and
Human Services' (HHS) Office of Inspector General and DOJ. The amendment
also makes appropriations for the Account from the general fund of the
U.S. Treasury. The appropriations are in specified amounts for each fiscal
year beginning with fiscal year 1997 for transfer to FBI to carry out its
health care fraud investigations.7

In 1997 HHS and FBI entered into an interagency agreement to facilitate
the required annual transfer of funds from the Account to FBI solely for
its health care fraud investigations. FBI receives the transferred funds
and records the funds in its Salaries and Expenses (S&E) appropriation
account at the beginning of each fiscal year. FBI then incurs obligations
for health care fraud investigations and makes payments from the S&E
account, which is also used to make payments for other FBI mission-related
and support activities. The amounts that were transferred to FBI as
required by the act for the years of our review were as follows:

o  fiscal year 2000: $76 million,

o  fiscal year 2001: $88 million,

o  fiscal year 2002: $101 million, and

o  fiscal year 2003: $114 million (and each subsequent year).

5 See, 42 U.S.C. S:1320a-7c(a).

6 See, 42 U.S.C. S:1395i(k)(1). The Account also serves as a pass-through
account for amounts deposited to and appropriated from the Trust Fund in
support of the Health Care Fraud and Abuse Control Program administered by
HHS and DOJ and the Medicare Integrity Program, which is administered by
HHS. See, 42 U.S.C. S:1395i(k)(2), (3)(A), (4). We have also audited other
amounts deposited to and appropriated from the Trust Fund every 2 years,
starting in 1998. The last required audit is in process. For the most
recent report, see GAO, Medicare: Health Care Fraud and Abuse Control
Program for Fiscal Years 2000 and 2001, GAO-02-731 (Washington, D.C.: June
3, 2002).

7 See, 42 U.S.C. S:1395i(k)(3)(B). Since their inception, the authorized
transfers have increased incrementally, beginning with $47 million in
fiscal year 1997.

The amendment requires that these funds be used solely to cover the costs
(including equipment, salaries and benefits, and travel and training) of
the administration and operation of the health care fraud and abuse
control program, including the costs of prosecuting health care matters,
investigations, financial and performance audits of health care programs,
and inspections and other evaluations. These health care fraud
investigations are managed nationally by FBI's Health Care Fraud Unit
(HCFU), which was created in 1992 within the Financial Crimes Section of
the FBI's Criminal Investigative Division. Health care fraud
investigations include those for fraud against government programs and
private insurance, as well as medical privacy law violations. HCFU is
responsible for health care fraud investigations that are conducted by
FBI's field offices and, for management and reporting purposes, both HCFU
and the related field investigations are considered a part of its White
Collar Crime decision unit.

  FBI's Monitoring Approach for HIPAA Transfers Provided Little Assurance of
  Transfers' Proper Use

FBI used a limited approach to monitoring its use of HIPAA transfers,
which might have been sufficient when it clearly used more agent FTEs for
health care fraud investigations than it had budgeted. But this approach
was insufficient when some of the agent FTEs previously devoted to health
care fraud investigations were shifted to counterterrorism activities,
causing actual FTEs to fall below budgeted FTEs. At the time of our
review, FBI's Financial Management System (FMS) was unable to track
overall costs related to health care fraud investigations. As a result,
FBI had minimal assurance that all of the transferred HIPAA funds were
properly spent. DOJ is currently planning to implement the new DOJ-wide
Unified Financial Management System, but it has yet to develop the
specific systems requirements to enable it to accurately capture all of
the costs of its health care fraud investigations and therefore to help
monitor compliance with HIPAA and other relevant laws and regulations.

FBI's budget for health care fraud investigations was equivalent to the
amount of the HIPAA transfers and included only the direct program costs.
These direct costs consisted of payroll and benefits for agents and
certain other personnel involved in health care fraud investigations,8
plus related costs such as rent and supplies. FBI used an approach to
monitoring the use of HIPAA transfers that considered agent FTEs only
without considering the other direct program costs. For the 4 years we
reviewed, the agent FTEs represented about 42 percent of the budgeted
amounts for work on health care fraud investigations, while the other
direct program costs represented about 58 percent of the budgeted amounts.
FBI obtained agent FTEs from reports generated by its time utilization
system, which records the percentage of time that agents worked on each
investigative classification and, if applicable, major cases. FBI
officials told us that prior to September 11, 2001, reported agent FTEs
charged to the health care fraud investigations were historically far in
excess of those budgeted and they were satisfied that the resources
expended on health care fraud investigations exceeded the HIPPA
transfers.9 For example, in fiscal year 2000, FBI reported that health
care fraud agent FTEs exceeded the number budgeted that year by about 19
percent.

However, this limited approach to monitoring the use of the HIPAA
transfers was insufficient when agent FTEs were shifted to
counterterrorism activities after September 11, 2001, because it lacked
the specificity of cost information for both direct and indirect costs.10
Furthermore, FBI's FMS was not capable of providing this specific cost
information. Therefore, in years when reported agent FTEs were close to or
below budgeted FTE amounts, FBI had no effective mechanism in place to
monitor compliance with HIPAA. This was the case when reported agent FTEs
approximated the budgeted amounts in fiscal year 2001 and fell below
budgeted FTEs in fiscal years 2002 and 2003 by 31 percent and 26 percent,
respectively.

8 Other personnel include supervisory agents and both administrative and
investigative support staff.

9 In years that FBI agents engaged in more health care fraud
investigations than were covered by the transferred amounts, FBI funded
the difference with its S&E appropriation.

10 These indirect costs included FBI-wide training and forensic laboratory
services as further described in the next section.

Reliable information on the costs of federal programs and activities is
crucial for the effective management of government operations and assists
internal and external users in assessing the budget integrity, operating
performance, stewardship, and systems and control of program activities.
In this regard, the Chief Financial Officers Act of 1990 expressly calls
on agencies to provide for the systematic measurement of performance and
the development of cost information.11 In addition, "Statement of Federal
Financial Accounting Standards Number 4" established for all federal
agencies cost accounting concepts and standards aimed at providing
reliable and timely information on the full cost of federal programs,
their activities, and outputs.12 Cost information for program activities
is especially crucial in order to properly manage and account for funds
that have been appropriated, or in this case, transferred for certain
authorized purposes.

FBI's FMS has minimal capability to track health care fraud investigation
and other specific program costs necessary to meet federal guidance. FMS
tracks costs by cost center, of which only headquarters costs are
separately identifiable by program.13 However, substantially all of the
direct costs for health care fraud investigations are incurred at the
individual field offices, each of which is considered separate cost
centers. The specific program costs within each field location, therefore,
are not individually tracked or separately identifiable. As a result, FBI
cannot use FMS to track and report all health care fraud investigation
costs.

11 See, 31 U.S.C. S:902(a)(3)(D).

12 Federal Accounting Standards Advisory Board, "Statement of Federal
Financial Accounting Standards Number 4" Managerial Cost Accounting
Concepts and Standards for the Federal Government (Washington, D.C.: July
31, 1995).

13 Headquarters costs are less than 1 percent of total reported health
care fraud investigation costs. These costs tracked in FMS include
personnel-type costs only, such as regular compensation and benefits and
incentive awards.

DOJ is currently in the process of implementing a new financial management
system. The new UFMS is likely to have the capability to capture
nonpersonnel costs on a program or subprogram basis, if design
specifications are set to do so. However, according to FBI finance
officials, specifications have not been set up for UFMS to capture total
payroll costs at the program level. These costs amounted to about 55
percent of the budgeted health care fraud investigation costs. Under UFMS
as currently planned, payroll costs are to be processed by the U.S.
Department of Agriculture's National Finance Center (NFC)14 starting in
2006 and recorded at the summary level. As a result, they will be combined
with the payroll costs of other programs and will not be separately
identifiable.

NFC officials told us that they recommend that all customers receive
summary and detailed-level data. NFC uses a 27-digit accounting code, of
which 24 digits are available to agencies to establish an account
structure for detailed payroll information such as program, subprogram,
and job code levels. NFC officials also stated that they met informally
with FBI personnel and explained how the accounting codes could be used to
support FBI's needs. An FBI official told us that because of security
concerns, FBI would have to give consideration to using such codes. The
absence of accounting codes for programs and subprograms or other control
mechanisms for monitoring payroll and other costs will continue to impede
FBI's ability to assess compliance with HIPAA and other relevant laws and
regulations.

  FBI's Cost Estimates of Health Care Fraud Investigations Were Not Adequately
  Supported

In the absence of system-generated program costs and upon our request for
cost schedules, FBI began developing an estimate of its health care fraud
investigation costs incurred for fiscal years 2000 through 2003 in an
attempt to determine the propriety of its use of the HIPAA transfers. FBI
engaged in extensive manual efforts and developed cost estimates that, in
their final form, appropriately considered both direct program costs and
the portion of indirect, FBI-wide support unit costs that related to the
health care fraud program. However, we found that the estimates were
either directly or indirectly based on data from FBI's time utilization
system, which had not been properly validated, and various other data that

14 NFC develops and operates administrative and financial systems,
including payroll/personnel, administrative payments, and accounts
receivable for both the U.S. Department of Agriculture and more than 60
other federal organizations under crossservicing or franchising
agreements.

were not adequately supported. As a result, despite a good-faith effort by
FBI to estimate these costs, neither we nor FBI could reliably determine
whether the HIPAA transfers were spent solely on health care fraud
investigations for the 4-year period.

FBI officials told us at the start of our review that they were unable to
provide us with a report of actual costs and had not previously estimated
the costs associated with the transfers for fiscal years 2000 through 2003
primarily because of the financial systems' weaknesses that we previously
discussed. As an alternative, they proposed to provide us with an estimate
of health care fraud investigation costs and subsequently developed an
estimation methodology. Because cost estimates for this program had never
before been attempted, FBI tried different approaches and revised the
estimates several times during our review. The first three estimates for
the 4-year period were revised to reflect slight changes in the
methodology and to correct an error in the estimates but were quite
similar to each other in method and in results. In essence, FBI estimated
the direct costs for each budgeted line item of the health care fraud
program. These were categorized into four groups: (1) headquarters payroll
and benefits; (2) agent payroll and benefits; (3) other field personnel's
payroll and benefits; and (4) related nonpersonnel costs such as
utilities, equipment, and supplies. The method for estimating each group
is as follows:

o 	Headquarters payroll and benefits, as previously discussed, were
predominantly tracked in FMS.

o 	The agent payroll and benefits costs, accounting for approximately 46
percent of FBI's estimated program costs for the 4 years,15 were estimated
directly on the basis of agent FTEs reported in FBI's Time Utilization and
Record Keeping (TURK) system and average FBI-wide salaries and benefits
for General Schedule 10-13 field agents.

15 FBI estimated its actual agent payroll and benefits costs to be 46
percent of total health care fraud costs. This was subsequently revised to
34 percent with the addition of indirect costs in the fourth version of
its costs estimates, as described later.

o 	The other field personnel's payroll and benefits, which represented
about 29 percent of FBI's estimated program costs for the 4 years,16 were
estimated from a combination of sources, including investigative support
staff FTEs from its TURK system, that were summarized in two manual
spreadsheets. The spreadsheets were prepared by two staff members, one of
whom no longer works at FBI. The methodology for this staff member's
spreadsheet is uncertain, and the results could not be verified.

o 	FBI's related nonpersonnel cost estimates were generally proportionate
to the budgeted amount on the basis of a ratio of budgeted FTEs versus the
FTEs reported in the TURK system. For example, for fiscal year 2003, the
nonpersonnel costs line-item amounts were estimated at about 79 percent of
the budgeted amount, since only 664 total FTEs were reportedly charged to
health care fraud investigations, while a total of 844 FTEs were
budgeted.17 However, the budgeted and estimated amounts for these costs
were not subsequently compared with actual costs for any of the years
presented in order to verify the reasonableness of the amounts.

We determined that the primary source data used either directly or
indirectly to estimate the health care fraud costs, as reported from the
TURK system, had not been properly tested to determine the reliance that
could be placed on the information. Prior to fiscal year 2002, the work
time percentages and related investigative classification information in
the TURK system, which has been operational in its current form since 1991
and is used by FBI for a variety of budgetary and program management
decision making, had never been properly validated. We found that for
fiscal years 2002 and 2003, FBI conducted limited internal testing,
including tests on whether the work hours recorded in the system were
correctly charged to the appropriate investigative case. The tests were
performed at all of the field office locations and produced error rates
that varied from year to year and across field locations but were not
conducted on

16 FBI estimated its other personnel's payroll and benefits costs to be 29
percent of total health care fraud costs. This was subsequently revised to
21 percent with the addition of indirect costs in the fourth version of
its cost estimates, as described later.

17 Various immaterial nonpersonnel cost line items, such as automated
data-processing services and special operations, were reported at budgeted
amounts. The health care fraud equipment line item was adjusted at year's
end in an attempt to reflect actual equipment costs only.

statistically valid samples. Therefore, the results cannot be applied to
the population beyond the specific items tested. Nonetheless, the
identified errors raise questions about the reliability of the data in
TURK and demonstrate the need for additional data validation work by FBI.
In addition, a key financial official indicated that at least one of the
tests might not have been properly designed to validate the data.

In addition to the lack of validation of the TURK data, certain other
supporting documentation could not be verified or was not adequate.
Examples include the following:

o 	The health care fraud equipment account, approximately 5 percent of
budgeted amounts for the 4 years, funded purchases other than equipment
such as travel and training expenses and was used much like a
discretionary account. FBI officials told us that at year's end, these
nonequipment costs were adjusted by moving them out of the equipment
account and into the appropriate line item on the basis of the amounts
recorded in a detailed listing of purchases prepared by HCFU. We were
unable to reconcile the amount of purchases recorded in the detailed
equipment listings or the amount of interaccount adjustments to the FBI
cost estimates, and no such reconciliation was provided by FBI. The amount
of interaccount adjustments ranged from $424,000 to $7.5 million a year
for the 4 years under review.

o 	FBI used average salaries of support personnel at year's end that might
not have accurately represented the mix of salaries of the staff
supporting health care fraud investigations whose duties ranged from
administrative to professional (e.g., medical experts).

o 	FBI surveyed field office managers in an effort to capture other FTEs
that were related to health care fraud investigations. Field managers
estimated the portion of hours or FTEs spent investigating health care
fraud cases that were recorded in TURK under other investigative
classifications. For example, a case dealing with an Internet pharmacy
that was investigated by a Cyber Crimes squad could be considered a health
care fraud investigation and included in the estimate of health care fraud
costs. These other agent FTEs are difficult to verify and, in some cases,
were reported from memory.

On average, the first three FBI cost estimates showed that FBI spent
$33 million more on health care fraud investigations than the amount of
the
HIPAA transfers for fiscal years 2000 and 2001 and about $29 million less
than the HIPAA transfers for fiscal years 2002 and 2003. When we were
provided with these cost estimates, FBI officials stated that this shift
in
resources away from health care fraud investigations in the latter 2 years
was a result of the increase in the counterterrorism investigative
activity
after the September 11 attacks. FBI management prepared a fourth and
final cost estimate that included an allocation of the additional costs of
other FBI units, such as forensic laboratory services and mandatory
training that support various FBI programs, including the health care
fraud
program. While it is generally appropriate to include such indirect costs
when determining total program costs, these additional costs were not
previously considered when budgeting the funds transferred by the
Congress to FBI for its health care fraud investigations.18 Furthermore,
these additional items were not included in DOJ's October 2003 response to
the Senate Finance Committee regarding FBI's use of the HIPAA transfers.

FBI estimated the portion of costs for each of the six support units-
training, forensics, information management, technical field support,
criminal justice services, and management and administration-that
related to health care fraud investigations and added them to the
estimates
of direct costs previously provided to us in the third version. While FBI
put
forth a good-faith effort to devise a way to allocate the indirect support
unit
costs to health care fraud investigations, its methodology relied, in
part, on
layers of unvalidated data. For example, FBI allocated FBI-wide support
unit costs as reported in its audited financial statements first to the
DOJ
Strategic Goal that included health care fraud investigations.19
The percentages used in this calculation were the same used to allocate
costs for FBI's Statement of Net Cost; however, FBI's auditors said they
did
not validate the methodology or documentation supporting the
allocation percentages. After FBI allocated the specific support unit
costs
to the DOJ Strategic Goals, FBI allocated those costs to health care fraud
investigations using FTE data based primarily on TURK, which, as
previously discussed, has not been validated.

18 As stated in "Statement of Federal Financial Accounting Standards
Number 4," it is appropriate to include both direct and indirect costs
when reporting the full costs of program activities.

19 FBI officials excluded from this allocation certain costs that were not
associated with health care fraud investigations, such as international
training.

On average, the additional indirect costs represented approximately $34
million, or 27 percent of total health care fraud costs per year. With the
addition of these indirect costs, FBI ultimately estimated that it spent
more on health care fraud investigations than was funded by the HIPAA
transfers for all 4 years. However, with the magnitude of unverified and
inadequately supported data, neither we nor FBI could reliably determine
whether the HIPAA transfers were spent solely on health care fraud
investigations for the 4-year period.

Conclusions	FBI's monitoring approach for determining the proper use of
HIPAA funding was limited and did not provide the level of assurance
needed when agent FTEs devoted to health care fraud investigations were
close to or below budgeted amounts. Absent a financial management system
that could capture the costs of its health care fraud investigations, FBI
had to resort to extensive manual efforts to estimate the costs but did
not have the data needed to do so reliably. Until FBI improves its data
reliability and either develops a financial management system capable of
tracking and reporting health care fraud investigation cost information or
some other effective monitoring approach, it will continue to lack
sufficient accountability over the use of the HIPAA transfers. Inadequate
accountability hinders efforts to budget, manage, and account for program
funds appropriately and will leave FBI at an increased risk of violating
HIPAA and other laws.

  Recommendations for Executive Action

We are making four total recommendations-two enhancing FBI's
accountability over the HIPAA transfers and the costs related to health
care fraud investigations in the short term and two augmenting the new
Unified Financial Management System's cost-tracking capabilities in the
long term. We recommend that the Director of the FBI take the following
actions:

o 	Develop formal, interim policies and procedures for reporting health
care fraud investigation costs that specify (1) the costs to be estimated
and/or allocated, (2) the supporting documentation to be maintained, and
(3) the method to validate those data used.

o 	Periodically conduct statistically valid testing of the data in the
Time Utilization and Record Keeping system, in particular, the work time
percentages and related investigative classification information to

ensure the TURK system's reliability. In addition, require field office
managers to follow up on any issues identified in the testing.

o 	Either specify that the UFMS have the capability to allocate payroll
costs provided by the NFC payroll system to specific programs or develop
cost accounting codes at the program and subprogram levels to enable NFC
to provide the necessary detailed payroll reports.

o 	Ensure that the UFMS has the capability and design specifications to
track nonpersonnel costs related to health care fraud investigations.

  Agency Comments and Our Evaluation

In a joint letter with written comments on a draft of this report
(reprinted in appendix II), DOJ and FBI agreed with the four
recommendations in this report and said they have begun to address the two
short-term recommendations. Specifically, FBI is expecting to complete
reviews of its procedures used to track health care fraud investigation
costs and the collection and validation procedures for data entered into
the TURK system by May 31, 2005. Concerning the long-term solution through
financial management system enhancements, FBI acknowledged the need to
establish control mechanisms to monitor both personnel and nonpersonnel
costs related to health care fraud investigations to ensure the
transparent allocation of FBI resources while maintaining appropriate
levels of security. FBI notes that health care fraud investigations funded
by HIPAA have contributed to a number of significant, high-profile case
accomplishments as a result of the FBI's dedication of HIPAA resources.
FBI and DOJ officials provided oral comments on technical matters, which
we have incorporated as appropriate.

As agreed with your office, unless you publicly announce its contents
earlier, we plan no further distribution of this report until 30 days from
its issue date. At that time, we will send copies of this report to the
Ranking Minority Member, Senate Committee on Finance; the Attorney General
of the United States; the Director, FBI; the Director, Office of
Management and Budget; and other interested parties. We will make copies
available to others upon request. In addition, the report will be
available at no charge on the GAO Web site at http://www.gao.gov.

Should you or your staff have any questions on the matters discussed in
this report, please contact me on (202) 512-9508 or by e-mail at

[email protected] or contact Steven R. Haughton, Assistant Director, at
(202) 512-5999 or [email protected]. Major contributors to this report are
included in appendix III.

Sincerely yours,

Linda M. Calbom Director, Financial Management and Assurance

Appendix I

Scope and Methodology

We reviewed the internal controls related to the use of the Health
Insurance Portability and Accountability Act (HIPAA) transfers and the
cost estimates of health care fraud investigations for fiscal years 2000
through 2003.

We requested available documentation of the policies, procedures, and
guidelines relating to the HIPAA transfers and the health care fraud
program. We conducted interviews with Federal Bureau of Investigation
(FBI) officials to obtain an understanding of the internal controls,
including fund controls, in place over transferred funds. We reviewed the
sufficiency of those internal controls in light of GAO's Standards for
Internal Control in the Federal Government.

Because of the inability of FBI's existing Financial Management System to
produce program-level cost information as described in this report, FBI
developed an estimate of the costs of health care fraud investigations.
FBI provided us with a schedule of cost estimates for its health care
fraud investigations for each of the 4 fiscal years, a description of the
cost-estimation methodology, and various documentation that supported some
of the headquarters and field office costs. During the course of our work,
FBI modified its original schedule of cost estimates twice because of
slight changes to the cost-estimation methodology. For all three schedules
of costs, we evaluated the overall method of cost estimation to determine
the method's reasonableness and ability to assure that applicable laws and
regulations were followed. Additionally, we (1) identified the sources of
information used in the methodology; (2) verified, where possible, the
underlying data flow and formulas; and (3) compared the cost estimates
with the amount of funds transferred to FBI for each of the 4 years. FBI
provided us with a fourth and final schedule of cost estimates on January
5, 2005, which included allocations of FBI-wide administrative and support
costs not originally considered part of health care fraud costs. We
requested supporting documentation for these additional allocations and
reviewed the limited documentation that was available.

FBI's cost-estimation methodology was based significantly on information
derived from the Time Utilization and Record Keeping system. We were
unable to rely on this system's data for the purpose of our review because
the data for fiscal years 2000 and 2001 had not been validated and a
limited internal review reported varying error rates for the data for
fiscal years 2002 and 2003. The internal review, however, was not
statistically valid. We did not attempt to independently validate the
system.

Appendix I Scope and Methodology

We performed our work from February 2004 through January 2005 in
accordance with generally accepted government auditing standards. We
requested written comments on this report from the Director of the FBI or
his designee. A joint letter with comments from DOJ and FBI was received
and is reprinted in appendix II.

Appendix II

Comments from the Department of Justice and the Federal Bureau of Investigation

Appendix II
Comments from the Department of Justice
and the Federal Bureau of Investigation

Appendix II
Comments from the Department of Justice
and the Federal Bureau of Investigation

Appendix III

                     GAO Contacts and Staff Acknowledgments

GAO Contacts	Linda M. Calbom, (202) 512-9508 Steven R. Haughton, (202)
512-5999

Acknowledgments	In addition to those named above, Sharon O. Byrd, Richard
T. Cambosos, Tyshawn A. Davis, Lori B. Ryza, and Ruth S. Walk made key
contributions to this report.

GAO's Mission	The Government Accountability Office, the audit, evaluation
and investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people. GAO
examines the use of public funds; evaluates federal programs and policies;
and provides analyses, recommendations, and other assistance to help
Congress make informed oversight, policy, and funding decisions. GAO's
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.

Obtaining Copies of The fastest and easiest way to obtain copies of GAO
documents at no cost

is through GAO's Web site (www.gao.gov). Each weekday, GAO postsGAO
Reports and newly released reports, testimony, and correspondence on its
Web site. To Testimony have GAO e-mail you a list of newly posted products
every afternoon, go to

www.gao.gov and select "Subscribe to Updates."

Order by Mail or Phone	The first copy of each printed report is free.
Additional copies are $2 each. A check or money order should be made out
to the Superintendent of Documents. GAO also accepts VISA and Mastercard.
Orders for 100 or more copies mailed to a single address are discounted 25
percent. Orders should be sent to:

U.S. Government Accountability Office 441 G Street NW, Room LM Washington,
D.C. 20548

To order by Phone:	Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061

  To Report Fraud, Contact:
  Waste, and Abuse in Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: [email protected] Programs Automated answering system: (800)
424-5454 or (202) 512-7470

Congressional	Gloria Jarmon, Managing Director, [email protected] (202)
512-4400 U.S. Government Accountability Office, 441 G Street NW, Room 7125

Relations Washington, D.C. 20548

Public Affairs	Paul Anderson, Managing Director, [email protected] (202)
512-4800 U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, D.C. 20548

                               Presorted Standard
                              Postage & Fees Paid
                                      GAO
                                Permit No. GI00

United States
Government Accountability Office
Washington, D.C. 20548-0001

Official Business
Penalty for Private Use $300

Address Service Requested
*** End of document. ***