Auditing a Private Third-Party Claims Processor for Medicare Case background developed by Yan Xiong, Ph.D. and Daniel W. Law, Ph.D.

Transcription

1 Auditing a Private Third-Party Claims Processor for Medicare Case background developed by Yan Xiong, Ph.D. and Daniel W. Law, Ph.D., CPA Medicare is a federally funded program in the United States that covers the cost of medical care for the elderly and disabled. Medicare is divided into two parts: 1) Medicare Part A, which provides basic protection against the costs of inpatient hospital and other institutional providers, and 2) Medicare Part B, which covers the costs of doctors and other healthcare practitioners that are not covered under Medicare Part A. Bob works as a senior auditor of Information Systems (IS) for the U.S. Department of Health and Human Services (HHS), which administers the Medicare program. HHS maintains contracts with several private health care organizations across the country to process Medicare electronic and paper claims from health care providers, including individual physicians, clinics, and hospitals. The private processors are granted exclusive rights to process medical claims from providers within broad geographic regions, which consist of several states. One of these companies, Medicare Southwest (MSW), processes Medicare claims from providers within four states in the American southwest. MSW is a relatively small organization with approximately 80 employees. However, its parent company, Acme Corporation, consists of one of the largest affiliations of health-care plans in the southwest. The vast majority of Acme s $5 billion in revenue is composed of private health care premiums that are collected and processed for other private subsidiary organizations. Only a relatively small portion of Acme s revenue (approximately $100 million/year) comes from MSW. MSW is located on the campus of Acme s Houston, Texas facility. In addition to the 80 MSW employees, approximately 1,200 Acme employees work at the site. These Acme

2 employees provide direct and indirect support for all of the subsidiaries, including MSW. Approximately 60 Acme employees are assigned to provide direct support for MSW. Most of these employees are data entry personnel and managers, although a few make up a small, dedicated Information Technology (IT) staff. Other Acme staff members who support the entire Acme facility provide indirect support, including some IT and building security. Claims Processing As the senior federal IS auditor, Bob and the three lower-level auditors have just started to examine the claims processing system. Bob has learned that Acme provides a wide variety of services related to claims processing for its subsidiaries, including MSW. For example, Acme maintains a large data center to process all electronic claims, including those from MSW. Acme s staff also processes paper claims. During the initial tour of Acme s claims processing and data center areas, Acme s IT Security Officer and MSW s internal auditor provided Bob and his staff with an overview of MSW s entire claims process. Health care providers, including individual doctors, clinics, and hospitals, submit MSW claims to the Houston facility either electronically, or through hard copies sent via U.S. mail. As electronic claims are received, they are automatically screened by Acme s computer system for errors and discrepancies, such as missing information and incorrect amounts claimed for particular medical procedures. If the claims do not contain any apparent errors, they are automatically processed by Acme s computer system, and a check is created and mailed to the health care provider. If errors are discovered, the claims are automatically forwarded to Acme s onsite adjudication department for further review. The adjudication staff attempts to correct the information by contacting the provider or by adjusting the amounts to 2

3 match the procedure performed. After correction, the adjudication staff submits the claim back through the electronic processing system without further review. Paper claims are received and sorted in the mailroom, along with all other mail for all subsidiaries. Paper claims are then delivered to Acme staff members who enter the claims data into the system. Prior to final submission, the data that is entered into the system is checked and approved by the single data entry manager on duty. The manager is able to correct any errors prior to submission. After submission, the claims are processed and paid. All claims contain confidential data, including names, social security numbers (government identification numbers), and specific health care treatments provided to patients. Bob noticed that most of the Acme adjudication and data entry personnel are actually temporary employees hired through agencies. Acme prefers to use the services of temporary agencies to allow more flexibility and to reduce hiring costs in these high-turnover positions. Bob also noticed that the data entry personnel who support MSW shared their facility with the data entry personnel from the other private subsidiaries. In fact, some of the data entry personnel who support MSW also work on claims from other private Acme subsidiaries. The manager of the claims processing staff explained that a separate facility was not available, and that a shared facility and workload allows for more flexibility to adjust for changes needed in staffing levels. Since employees dedicated to several different subsidiaries share the data entry area for paper claims, the manager said that no one owns the space. Consequently, no single manager is responsible for approving, deleting, and reviewing all physical access to the data entry area. Instead, each individual manager is responsible for initiating requests to grant and delete physical access for their own temporary and permanent employees by notifying the facilities manager. 3

4 The facilities manager can only print lists of everyone with access to the facility. Therefore, the lists are never reviewed, because individual managers are only familiar with their own employees. The facilities manager did state, however, that the individual managers of any employees who were terminated promptly notified him. As part of the audit procedures, Bob and his staff examined a sample of twenty incoming electronic claims. The claim amounts were then compared with the amounts actually processed and paid by the computer system. Bob and his staff noted that the amount claimed exceeded the amount paid by the computer system by five cents for every third claim. They further observed that several of the lead programmers for the computer system had access in the production environment and the ability to make changes to payment amounts. Also, fraudulent claims have been a frequent concern in the Medicare program, including: Multiple claims for medical procedures that are usually not performed on the same patient more than once within a particular period of time (i.e. organ transplants). Claims for medical procedures that cannot be performed for a particular patient (i.e. physical therapy coma patients). Claims for deceased individuals. 4

5 Please develop a comprehensive written response to the below items, with a maximum of pages. CASE STUDY QUESTIONS 1. Develop a process diagram/flowchart of MSW s current claims processing system (current state as-is process flowchart). 2. Discuss the top risks present at MSW. Risks may include information technology risks (i.e. physical and logical security) or business process risks; including: financial, operational and/or compliance risks. 3. What types of tests could auditors conduct to ensure that MSW s operations are properly controlled? 4. For each of the risks identified, recommend appropriate internal controls to address these concerns by drafting an internal audit report to MSW management, with recommendations on how to mitigate the identified risks. Be sure to include: background, observations, risks, and recommendations. 5. Modify the process diagram/flowchart in question 1, by inserting the recommended internal controls into the process (recommended to-be process flowchart). 6. If you were a potential client considering using MSW s services, list the top issues that you would want to discuss with MSW management prior to entering into a 3 rd party agreement with them. 5