Independent Service Auditors Report

Transcription

1 Independent Service Auditors Report To the Officers of Group Resources Duluth, Georgia We have examined the accompanying description of the controls of Group Resources. Our examination included procedures to obtain reasonable assurance about whether (1) the accompanying description presents fairly, in all material respects, the aspects of Group Resources controls that may be relevant to a user organization s internal controls as it relates to an audit of financial statements; (2) the controls included in the description were suitably designed to achieve the control objectives specified in the description, if those controls were complied with satisfactorily; and (3) such controls had been placed in operation as of December 31, Our examination was performed in accordance with standards established by the American Institute of Certified Public Accountants and included those procedures we considered necessary in the circumstances to obtain a reasonable basis for rendering our opinion. In our opinion, the accompanying description of the controls of Group Resources presents fairly, in all material respects, the relevant aspects of Group Resources controls that had been placed in operation as of December 31, Also, in our opinion, the controls, as described, are suitably designed to provide reasonable assurance that the specified control objectives would be achieved if the described controls were complied with satisfactorily. In addition to the procedures we considered necessary to render our opinion as expressed in the previous paragraph, we applied tests to specific controls to obtain evidence about their effectiveness in meeting the related control objectives during the period from January 1, 2008 to December 31, This information has been provided to user organizations of Group Resources and to their auditors to be taken into consideration, along with information about internal control risk for user organizations. In our opinion, the controls that were tested, as described on pages 17 through 33, were operating with sufficient 1

2 effectiveness to provide reasonable, but not absolute, assurance that the related control objectives specified on those pages were achieved during the period from January 1, 2008 to December 31, The relative effectiveness and significance of specific controls at Group Resources and their effect on assessments of control risk at user organizations are dependent on their interaction with the controls and other factors present at individual user organizations. We have performed no procedures to evaluate the effectiveness of controls at individual user organizations. The description of controls at Group Resources is as of December 31, 2008, and information about tests of the operating effectiveness of specific controls covers the period from January 1, 2008 to December 31, Any projection of such information to the future is subject to the risk that, because of change, the description may no longer portray the controls in existence. The potential effectiveness of specific controls at Group Resources is subject to inherent limitations and, accordingly, errors or fraud may occur and not be detected. Furthermore, the projection of any conclusions, based on our findings, to future periods is subject to the risk that (1) changes made to the system or controls, (2) changes in processing requirements, or (3) changes required because of the passage of time may alter the validity of such conclusions. This report is intended solely for use by the management of Group Resources, its user organizations, and the independent auditors of its user organizations. September 22,

3 Information Provided by Independent Service Auditors This report is intended to provide clients of Group Resources (Company) with information about the Company s controls relative to the processing of client organizations transactions applicable to the third party administration of selffunded medical benefit plans. This report, when combined with an understanding of the controls at the client organization, is intended to assist the auditors of client organizations in planning the audit of the client organizations, and in assessing control risk for assertion in client organizations financial statements that may be affected by controls at the Company. Our review of the controls of Group Resources was limited to the control objectives and the related description of the control procedures specified by the Company in the main body of the report. Our review was not extended to procedures in effect at client locations. Our review was performed in accordance with American Institute of Certified Public Accountants (AICPA) Statement of Auditing Standards No. 70 (SAS 70), Reports on the Processing of Transactions by Service Organizations. It is the client organization s responsibility to evaluate this information in relation to the internal control structure in place at their organization in order to assess the total internal control structure. If an effective internal control structure is not in place at the client, Group Resources, Inc. s controls may not compensate for such weakness. CONTROL ENVIRONMENT The Company s control environment consists of various elements in establishing the effectiveness of specific controls. Our procedures included the review of the relevant elements of the control environment including: Personnel policies and procedures Policy for training and continuing education Ethical standards Client service and quality assurance, and Segregation of duties The review of the control environment included the following items to the extent we considered necessary: (a) a review of the Company s hierarchy, including the segregation of responsibilities and personnel policies; (b) discussions with various levels of personnel who are responsible for developing, enforcing and applying controls; and (c) observations of personnel in the performance of their assigned duties. 3

4 CONTROLS Our tests of the operating effectiveness of controls included tests which we considered to be necessary to evaluate whether the controls and the compliance with the controls are sufficient to provide reasonable, but not absolute, assurance that the specified control objectives were met during the period January 1, 2008 to December 31, We designed our tests to cover a representative number of activities throughout the year, for each of the controls listed in the main body of the report. In designing our test of the operating effectiveness of the controls, we considered (a) the nature of the controls being tested; (b) the available evidential matter; (c) the control objectives to be achieved: (d) the assessed level of control risk; and (e) the expected efficiency and effectiveness of the test. TESTS OF OPERATING EFFECTIVENESS The description of the tests of operating effectiveness and the results of those tests are included in the main body of this report and are the responsibility of the service auditor. 4

5 OVERVIEW OF SERVICES PROVIDED Group Resources (Company) is a Third Party Administrator (TPA) of selffunded benefit plans. The Company s headquarters is in Duluth, Georgia; however, the Company has satellite offices in Dallas, Texas, and Houston, Texas (sales office only). The Company provides administrative services that include the management and processing of their clients (Groups) self-funded health benefit plans. The services provided by the Company include: Comprehensive Administrative Services - Analyze current benefit programs to ensure that the plans are meeting the Groups needs. The Company s goal is to process claims within 10 working days of receipt and to process the claims with a financial accuracy rate in excess of 98.5%. Employee Communications - Provide the written program materials including a comprehensive summary of benefits, ID cards, and instructions for claim submissions. Plan Documents and Summary Plan - Prepare and issue the plan documents and summary plan document descriptions. Computerized Management Reports - Monthly reports, check registers, aggregate claim reports, experience summaries by employee and dependents and type of coverage, utilization reports, shock claim reports, along with fully customized reports are available. COBRA Administration - Maintain the COBRA administration required by COBRA rules and regulation. HIPAA Administration - Assist employers in fulfilling their obligations set forth by the Health Insurance Portability and Accountability Act. Managed Care and Cost Containment - The Company offers managed care programs that provide Preferred Provider discounts and substantial network access. 5

6 OVERVIEW OF SERVICES PROVIDED (continued) Group Life Insurance - Provide group term life insurance through partnership with Life Insurance companies. Pharmacy Benefit Management Services (PBM) - The Company has multiple PBM arrangements, which provide employers with quality service and discounts using Prescription Drug Cards and Mail Order Pharmacies. Discount Laboratory Services - The Company offers a card program from a Diagnostics Company, enabling employees to receive lab work at no charge while reducing employers lab benefit costs. The Company adjudicates claims using a proprietary claims payment system, TPA TeamUp. Employers, providers and employees have direct access to their claims payers, eligibility personnel, and claims data via telephone, and online access. The TPA TeamUp software is utilized to maintain health care provider data, eligibility records, and for the processing and payment of claims. Each Group utilizes a custom plan developed specifically for its needs. The Company makes recommendations to the Group and matches the Group with a reinsurer to provide excess coverage, if requested to do so. The Group, the reinsurer and the Company then approve the plan, an Administrative Services Agreement is signed by the Group and the Company, and a reinsurance agreement is signed by the Group and the reinsurer. The majority of plans have specific limits (limits per employee) and aggregate limits per Group, which must be met before any reinsurance applies. The Company is compensated on a per employee basis percentage basis depending on the Administrative Services Agreement. Employees of the Groups are provided all required paperwork and ID cards. The Company services the claims processing for the Groups employee health claims. The claims are sent to the Company for processing and the Company adjudicates the claims in a timely manner. 6

7 COMPANY OVERVIEW Organization The Company s activities are overseen by a number of layers of management which ensures that the clients of the Company are well serviced and that the services provided meet the clients needs. Figure 1 shows the basic hierarchy of the Company. Figure 1 President SR Vice President / CIO Vice President AWAC Coordinator IT Controller Accounting Mail Room Systems Coordinator Managed Care and Reporting Claims Repricing Provider Services Document Specialist Marketing Sales Account Managers Business Unit A Benefit Advisors, Member Service Representatives and Reinsurance Business Unit B Benefit Advisors, Member Service Representatives and Auditing Business Unit C Benefit Advisors, Member Service and Representatives 7

8 Claims Processing The Company utilizes a team (Business Unit) approach to the processing of the claims to ensure a proper segregation of duties while still providing the clients and their employees with the accuracy and customer services they require. There are three Business Units, two in Atlanta and one that covers the Dallas and Houston offices. Each team consists of the following personnel: Business Unit Director - supervises the Business Unit. Benefit Advisors - responsible for adjudication of the claims. Responsibilities include communications with employees and providers to ensure the accurate adjudication of the claims. Their access to the TPA TeamUp system is limited to the claims processing side of the software. They have read-only access to the eligibility of the employees or providers. Member Service Representatives - maintain eligibility of plan participants and provide paperwork and ID cards to participants. They are the primary contact between the Company and the Groups. Shared personnel: Claims Re-pricing - verify and adjust the provider claims submissions to adjust, as needed, to the provider contracts. The re-pricing personnel utilize either the TPA TeamUp system or the PPO websites for the verification and adjustment of the claims to the allowed limits. Benefit Advocate dedicated phone and person to handle questions from clients and their employees. The Company has an internal auditor that audits 3% of the claims processed by each Benefit Advisor. The auditor summarizes the results of the audited claims and results are utilized by the Company to verify the accuracy of the claims process. All claims with charges in excess of $10,000 are verified by the internal auditor prior to the claim being released for payment. Training of all Business Unit members is the responsibility of the internal auditor and the results of audited claims are utilized to determine training needs. 8

9 Claims Processing (continued) Each team works with other personnel within the Company to provide the required services to the Company s clients. Figure 2 flow-charts the claims process. Figure 2 Mailroom - Claims arrive at the Company and are sorted by PP Group and Benefit Advisor and date stamped. Non PPO Claim PPO claim Re-pricing - claims are verified and repriced. Benefit Advisor receives the claims. Claims are processed by Group and date received. Each claim is processed on TPA TeamUp and is then approved or denied (adjudicated). Company s goal is adjudication by the Benefit Advisor within 10 working days of receipt. Check printing All adjudicated claims are placed on hold in the TPA TeamUp system until the Group s check printing date. Emdeon Business Services processes all Explanations of Benefits and checks. The EOBs sent to the employees are processed along with individual checks to providers. If applicable, the Company s reinsurance personnel file claims eligible for reinsurance. Payments are sent to Groups. If the Company receives the payment, then the check is forwarded to the Group. 9

10 Administrative Service Agreements The Company custom develops each of the self-funded insurance plans for each of its Groups. The majority of the Groups that utilize the Company were brought to the Company by insurance brokers. The Company has Sales personnel that deal directly with the brokers and Account Managers that assist the Sales personnel in working with the Groups and insurance brokers. The Company s Marketing personnel work with the reinsurance companies to underwrite and quote the reinsurance premiums. A detailed Administrative Service Agreement is prepared for each Group to sign along with a Plan Document that lists the details of the self-funded health insurance plan. Provider File Maintenance Provider information is recorded on the TPA TeamUp system in two different ways. PPO providers send the data to the Company electronically. The IT department receives the information and loads it into the system. Additionally, provider information is added to the system when claims arrive and the provider is not in the system. When a claim is being processed, the provider information is checked by Re-pricing personnel and then again by the Benefit Advisors. Providers that are not on the system or have had changes are then added to or updated on the system. Re-pricing personnel are responsible for keeping the provider information current. Benefit Advisors and Member Service Representatives do not have access to update provider information. Eligibility File Maintenance Member service representatives are responsible for maintaining the eligibility records of each Group s enrollment information. The information is initially sent to the Company either by mail, fax, or electronically. The member service representatives only have access to the eligibility area of the TPA TeamUp System. Changes and/or updates to the eligibility files are added to the system as they are received. The Groups can verify the eligibility of plan participants from the monthly invoices. Before claim checks are issued, the Groups receive check registers showing the participants names with the claim amounts. 10

11 Preparation of Explanation of Benefits (EOB) and claim payments The printing of the EOBs and payments have been outsourced to Emdeon Business Services. Each Group has a specific schedule of the days that claim EOBs and checks are printed. The TPA TeamUp registers are sent electronically from the Payroll/Checkroom Processor to the Company s IT Department, which uploads the data to the Emdeon Business Services website. Emdeon then processes and verifies the data, after which they notify the Payroll/Checkroom Processor that the reports are ready for the Company to approve. Upon authorization from the Group, the Company notifies Emdeon to print and mail the checks and EOBs. The majority of the checks are printed on bank accounts owned by the Groups. Thirteen of the Groups contracted with the Company utilize individual bank accounts controlled by the Company established for the benefit of the Group. Reinsurance Most of the Groups that utilize the services of the Company have contracts with reinsurance companies to provide excess loss coverage. The plans can have two types of limits, specific and aggregate. Specific limits are set on a participant basis, and limit the exposure of the Group to a set amount per participant. The Specific limit is a fixed dollar amount set in the contract with the reinsurance company. Aggregate limits are overall limits that apply to the Group as a whole, less any amounts eligible for specific reimbursement. The aggregate limit is based on a funding factor that is set in the contract with the reinsurance company. The funding factor multiplied by the number of participants in the plan determines the monthly aggregate limit. The aggregate limit changes on a monthly basis based on the number of participants in the Group. The Benefit Advisors are notified by the TPA TeamUp system when a participant has reached 50% of their specific limit. The Benefit Advisors notify the reinsurance department that the participant has reached 50% of their specific limit and the reinsurance department then tracks that participant s claims moving forward. Once the specified limit is reached, then the reinsurance department will begin filing the claims with the reinsurance company. 11

12 Reinsurance (continued) The reinsurance department also handles aggregate reinsurance claims. Aggregate claims reports are run on a monthly basis on the TPA TeamUp system. The aggregate claims reports are analyzed by the reinsurance department and any reinsurance claims are filed for those Groups that had claims in excess of their Aggregate limit. The majority of the Groups have advance funding agreements with the reinsurance companies, meaning that the Aggregate Limit claims are filed and paid on a monthly basis. If there is not an advance funding agreement in place, then the Aggregate Limit claims are not paid until the end of the policy year. Invoicing of Groups The Company invoices the Groups on a monthly basis. Member Service Representatives prepare the basic bill for the accounting department. The basic bill consists of the agreed upon cost per participant multiplied by the number of participants. The accounting department then prepares the formal invoice on its accounting system. The agreed upon cost per participant consists of the following: Cost of reinsurance, PPO fees, Pre-certification fees, brokers fees, the Company s fees, life, short-term disability, long-term disability and any other agreed upon fees in the Administrative Service Agreement. Additionally, the Company will, on request, provide additional services such as specialized mailings, next day mailing or any other item requested by the Groups. These additional services are billed to the Groups on the monthly invoice. Invoices are billed a month in advance and payment is due by the first of each month. The Company offers a grace period and charges a late fee per the terms of the Administrative Services Agreement. 12

13 DESCRIPTION OF THE CONTROL ENVIRONMENT Personnel Policies and Procedures The Company has developed an employee handbook that lists and describes the employment policies. The Company is an equal opportunity employer, with a policy of nondiscrimination and is fully committed to the principles of equality in employment and opportunity for all employees. There are defined rules for determining the status of employment within the Company. There is a 90-day orientation period for all new employees during which the employment status is probationary. Reviews are conducted on an annual basis for all employees, and consideration is given to performance, position within the Company and current economic conditions. The Company employee handbook specifically discusses the importance of client satisfaction, confidentiality, and the requirement to conduct all business in an ethical manner. All employees have signed confidentiality agreements with the Company. The Company has formal written job descriptions for the following positions: Benefit Advisors Member Service Representatives Account Managers Executive Assistant Business Unit Directors PPO Re-Pricers Systems Coordinator Training The company has ongoing training programs for all employees to ensure that the employees are kept up to date on industry and job specific issues. Training is done both internally and externally based on the needs of the employees. The internal auditor tests 3% of claims processed. Additional training is provided on an as needed basis based on the results of the audits. Additionally, the 13

14 Training (continued) auditors review all of the refunds and voids to determine if additional training or procedures are required. Segregation of Duties The Company utilizes the TPA TeamUp system to process all of the Groups information in order to properly service the Groups self-funded insurance plans. The Company has established policies that ensure that personnel only have access to those areas that relate to the employees responsibilities. Mailroom personnel only have access to view provider and eligibility information in order to assist them in the handling of the mail. Re-pricing personnel are limited to accessing only the re-pricing information and provider information. Benefit Advisors only have access to the claims processing areas of the system. If they see a problem with the providers information they must notify repricing in order for the changes to be made. The Benefit Advisors are allowed to view eligibility information; however, other individuals must make any changes. Each Group has an assigned Benefit Advisor, which allows the advisor to become familiar with the Groups employees and claims histories. Member Service Advisors only have access to the eligibility and the identification card printing capabilities on the system. Each Group is also assigned a specific Member Service Advisor, which allows them to get to know their Groups. The Benefit Advisors, Member Service Advisors and the Re-pricing personnel work together within one of the three business units and are supervised by a Business Unit Director. Reinsurance personnel are not part of the business units. The business units communicate with the reinsurance department to facilitate the filing of the reinsurance claims. The reinsurance department also runs reports on the TPA TeamUp system to ensure that all claims that need to be sent to the reinsurance company are properly filed. 14

15 Segregation of Duties (continued) The Company has two full-time IT personnel that are responsible for maintaining the system and the data on the system. New Groups and renewal Groups sign new Administrative Service Agreements on an annual basis based on their Group s policy year. Separate personnel work with the Groups to develop plans that meet the Groups needs. Once the Plan Document has been executed, the information is sent to the Company s System Coordinator. The System Coordinator is responsible for entering the Group s specific information regarding the plan s policy, which includes, but is not limited to, deductibles, co-pays, rules of coverages, and limitations. Sample claims are then tested on the system to ensure accuracy of the information. The Internal Auditor audits the claims processed by the Company and reports directly to the Business Unit Director of Team B. Accounting personnel assemble the invoices for the Groups. Access to multiple areas of the system is limited to the President, Vice Presidents, and the Business Unit Directors. The system records the identification of the personnel that make changes to the data; therefore, any unauthorized access is recorded and noted on the system. Description of the Computerized Information Systems All computer processing and data management information is handled in the Georgia office. The satellite offices located in Dallas and Houston have access to the internal servers via point-to-point data lines. The Company utilizes multiple servers with appropriate hard drive storage, memory capacity and processing speed. The Company maintains two sets of backup information with one set stored offsite. The Company has appropriate UPS devices attached to the network to allow for proper and safe shutdowns due to power outages. The system will shut down automatically in the case of power outages. 15

16 Description of the Computerized Information Systems (continued) The TPA TeamUp software is the primary software utilized by the Company to process claims and maintain their Groups data. The Company primarily utilizes a Novell network for the TPA TeamUp system. Additionally, the Company s web site, which is hosted by a third party, does not have direct access to the Company s network. The Company downloads data to the hosted web site, and changes posted on the web site are printed out by Company personnel to be input into the TPA TeamUP system. The IT department issues all passwords and user names. The Company s web site allows for 24/7 access to employers, employees and providers to verify and follow claims. Additionally, employers can make all required changes on the web site. Employees may access their plan summaries, link to their PPO web site, and notify the Company to add or change dependent coverages, change address, or order a new ID card. Description of Controls, Control Objectives, Related Control Procedures and Tests of Operating Effectiveness Group Resources has specified its control objectives and identified the controls to achieve the objectives as determined by management. There are specific controls in place to achieve each control objective. Rosenthal & Kaplin, PC, as the service auditor, has determined the nature, timing and extent of testing to be performed. 16

17 CONTROL OBJECTIVE 1 - NEW/RENEWAL PLAN SETUP Controls provide reasonable assurance that new/renewal plan and participant information is properly recorded into TPA TeamUp. The Systems Coordinator inputs the plan s specifications into the TPA TeamUp system. The plan specifications are printed and compared to the plan documents to verify accuracy. Sample data is entered into the system to further verify the information as being correct. The reports on the plan s specifications are distributed to the Group s human resources/finance personnel, and to the Company s officers, and the business unit director. Description of Control Procedures The plan s specifications on the system are compared to the plan document to ensure accuracy. Tests of Controls Discussed the processes utilized with the System Coordinator. Randomly selected fifteen Groups and examined each Group s master file. Reviewed the printout showing the plan specification and the confirmed fax receipts showing information was sent to the Group. Reviewed the Company s summary report sent to all employees involved with the Group. The Administrative Service Agreement is properly signed. Reinsurance contracts are properly signed and match the plan summary documentation. Reviewed the signed Administrative Service Agreement in the master files for ten of the Groups. Reviewed fifteen master files and inspected the Reinsurance contracts to match the coverage to the plan summary documentation. Results of Tests Performed No relevant exceptions noted. 17

18 CONTROL OBJECTIVE 2 - ELIGIBILITY AND PARTICIPANT PLAN ENTRY Controls provide reasonable assurance that TPA TeamUp is accurately updated with participant enrollment information on a timely basis. The Group determines the eligibility rules, which are part of the Plan Document. The Group is responsible for notifying their employees of their plan eligibility. The Company provides assistance as requested. New Groups provide their employee information to the Company during the sales process for underwriting purposes. Once the plan has been approved and signed, the Member Service Representative receives the participant information and enters the information into the TPA TeamUp system. The Company sends a complete listing of participants to the Groups with the monthly invoice for verification. Additionally a check register is sent to each Group prior to the mailing of claim payments and EOBs. Description of Control Procedures Participant enrollment information is properly updated in the TPA TeamUp system. Invoices are properly prepared and include the relevant participant information. Check registers are prepared, sent to and approved by Groups. Tests of Controls Interviewed Member Service Representatives and reviewed the enrollment process. Observed the printing of ID cards. Reviewed Group eligibility files. Interviewed Accounts Receivable Manager and reviewed selected invoices. Observed the actual invoice and the census attached. Check printing has been outsourced to Emdeon Business Services. No relevant exceptions noted. Results of Tests Performed 18

19 CONTROL OBJECTIVE 3 - PROVIDER INFORMATION Maintenance of provider information in the TPA TeamUp system provides accurate provider information and links to the appropriate preferred provider network. Provider information is input into the system in two different ways: - The preferred provider networks provide updated provider lists on a monthly basis. The information is then uploaded by the IT department into the system. - When claims arrive from providers not listed on the system, the Repricing personnel attempt to match the provider to existing providers on the system. The Re-pricing personnel can make any changes to the provider information if needed. If the provider is not on the system, the claim is forwarded to the Benefit Advisor. The Benefit Advisor will then verify the provider s information and then request that the Re-pricing personnel add the provider to the system. Description of Control Procedures The provider information is properly added to the system by the IT department. New providers, not on the system, are updated in a timely manner by appropriate personnel. Provider changes are properly updated on the system. Tests of Controls Discussed the electronic updating of the provider information with the LAN Administrator and the Database Specialist. Interviewed Benefit Advisors and Business Unit Directors to identify the appropriate personnel. Verified that only Re-pricing personnel have the ability to update the provider information. Interviewed Re-pricing personnel and observed that the Re-pricing personnel must match multiple items of provider information based on each PPO s guidelines. Results of Test Performed No relevant exceptions noted. 19

20 CONTROL OBJECTIVE 4 - CLAIMS PROCESSING Controls provide reasonable assurances that claims are processed in a timely and accurate manner. The Company receives claims primarily by mail. The claims are sorted by the mailroom personnel by Benefit Advisor and then by Group. The claims are then sent to the Re-pricing department for adjustment to the PPOs agreed upon pricing levels. Some PPOs require that they re-price their own claims. The mailroom personnel forward those claims to the appropriate PPO for re-pricing. Once the claims have been re-priced the claims are forwarded to the Group s assigned Benefit Advisor. Each Benefit Advisor processes the claims by date received and by Group. The Company s goal is for the Benefit Advisors to adjudicate all claims, approved or denied, within 10 working days of receipt. The Benefit Advisor may request additional information from either the insured or the provider. Those claims are considered to be on hold and are considered adjudicated for claims turnaround purposes. Once a claim has been adjudicated, the claim is ready for payment and is placed on hold in the system. Each Group has specific days on which the Company processes its payments and explanation of benefits (EOB). The register is sent electronically from Payroll/Checkroom Processor to the Company s IT Department, where is it is uploaded into the Emdeon Business Services website. Emdeon runs the reports and notifies the Payroll/Checkroom Processor that they are ready. After she reviews them, she releases them on their website for printing. The payments and EOBs are processed by Emdeon Business Services. The Advanced Warning and Containment, (AWAC ) data mining system is utilized to review all claims after adjudication. The AWAC system utilizes physician-produced algorithms to analyze the data for at risk claimants before they become catastrophic. The system helps identify undiagnosed health issues and also identifies problems with claims to help manage the care and financial resources of the participants and the Groups. The Company contracts with an independent company that owns the AWAC system. 20

21 CONTROL OBJECTIVE 4 - CLAIMS PROCESSING (continued) Description of Control Procedures 95% of all claims are processed within 10 days of receipt. Tests of Controls We verified 715 adjudicated claims for accuracy and timeline of processing. Controls provide reasonable assurances that claims are processed in a timely and accurate manner. Description of Control Procedures Claims are processed in a procedurally correct manner. Claims are processed in a financially accurate manner. All voided and refund checks are audited and the results are added to the Benefit Advisors statistics. The Company will make strong efforts to recover overpayments and to issue subsequent payments if claims are underpaid. Tests of Controls Tested 715 claims and found no errors in the testing. Review of the internally audited claims showed that 97.54% of the claims tested were processed in a procedurally correct manner. Tested 715 claims and found minimal errors in the testing. Claims tested showed that 99.44% of the claims tested were accurate financially. Discussed the policy with the internal auditor, who verified that she audits all claims that resulted in voids or refunds. Discussed the Company s procedures with Benefit Advisors, Business Unit Directors and internal auditor. Verified that the Company follows up on all overpayment and underpayment of claims. The internal auditor audits the claims that are reported as overpaid or underpaid to determine cause. Based on discussions with the Company personnel, overpayments are typically due to incorrect PPO information and underpayments are typically due to errors in coding of the claims. 21

22 CONTROL OBJECTIVE 4 - CLAIMS PROCESSING (continued) Controls provide reasonable assurances that claims are processed in a timely and accurate manner. Description of Control Procedures Claims in excess of $10,000 must be approved by the internal auditor prior to adjudication. The Company utilizes the AWAC system to screen adjudicated claims. The claims processing area of the TPA TeamUp is limited to Benefit Advisors. Tests of Controls Interviews with Benefit Advisors, Business Unit Directors and internal auditor verified that no claim over $10,000 can be processed without internal audit approval. Interviewed the AWAC coordinator who explained that all adjudicated claims are summarized and sent through the AWAC system for screening. The AWAC system then requests additional information on certain claims. The company that owns the AWAC system then provides guidance for claims that it identifies as problematic. Access is limited to Benefit Advisors and other key members of management. The IT department verified that the access to the claims area is limited to authorized personnel only. 22

23 CONTROL OBJECTIVE 4 - CLAIMS PROCESSING (continued) Controls provide reasonable assurances that claims are processed in a timely and accurate manner. Description of Control Procedures Overall claims process results in claims that are correctly and accurately processed. Tests of Controls Auditors selected 715 claims to test. The claims selected were determined by selecting two days per Benefit Advisor during the period January 1, 2008 through December 31, 2008 and then randomly selecting 10 claims for each day along with all claims over $10,000 for each Benefit Advisor for testing. Reviewed the claims for accuracy, and verified that the claims were processed properly. The total dollar amounts of the claims tested were as follows: Total dollar amount of claims $ 3,229,863 Ineligible amounts/discounts (1,704,726) Less differences (10) Claims paid $ 1,525,127 Financial accuracy of claims tested was 99.44%. Processing and procedural accuracy of the claims tested was 100%. Results of Test Performed No relevant exceptions noted. 23

24 CONTROL OBJECTIVE 5 - PAYMENT OF CLAIMS AND EXPLANATIONS OF BENEFITS (EOB) Controls provide reasonable assurances that claims paid and EOBs sent out are processed in a timely and accurate manner. Check processing has been outsourced to Emdeon Business Services. Each Group has designated check-printing days, with the majority of Groups having their checks and EOBs printed on a weekly basis. All claims adjudicated receive an EOB explaining the determination of the claim. The process for the check printing and EOB printing is as follows: Payroll/Checkroom Processor will pull the report for the Groups to be processed for the day. A production report is run on the TPA TeamUp system. Checks are rolled over for each Group, which batches the EOBs and checks. Payroll/Checkroom Processor runs the check registers, which assigns the check numbers and creates a print file for the checks to be printed for the Groups to be processed for the day. Payroll/Checkroom Processor sends the reports to the Groups for verification of accuracy. Payroll/Checkroom Processor sends reports electronically to the Company s IT Department. They are uploaded to Emdeon Business Service website and run through their program. Payroll/Checkroom Processor is notified that the reports are ready for verification, and after authorization received from the Group the checks are released for printing via Emdeon s website. Emdeon prints the checks and EOBs. For Groups that request signatures to be machine printed, the Company loaded the signatures into the programs. Checks that are printed have a summarized EOB on the check stub, and a separate EOB is printed for the insured. Denial of benefit EOBs are printed out in duplicate, one for the provider and one for the insured. Checks and EOBs are then mailed. 24

25 Controls provide reasonable assurances that claims paid and EOBs sent out are processed in a timely and accurate manner. CONTROL OBJECTIVE 5 - PAYMENT OF CLAIMS AND EXPLANATIONS OF BENEFITS (EOB) (continued) The majority of the Groups that utilize the services of the Company have the Company print checks on accounts set up and controlled by the Group. As of December 31, 2008, the Company has control of 13 bank accounts that it has established for the benefit Groups. These Groups have the Company maintain and reconcile the checking accounts utilized for the payment of their claims. The Company reconciles these accounts and provides reports to the Groups on a monthly basis. The Groups that have the Company maintain checking accounts on their behalf fund their accounts either on a monthly basis or on an as needed basis. Checks received by the Company to fund these bank accounts are deposited into the appropriate accounts on a daily basis. Controls provide reasonable assurances that claims paid and EOBs sent out are processed in a timely and accurate manner. Description of Control Procedures The system properly and accurately processes the checks and EOBs. Accounts maintained and reconciled by the Company are maintained properly. Tests of Controls Discussed the check and EOB processing run with the Payroll/Checkroom Processor used by Emdeon Business Services. Verified that the system is designed so that the check processing personnel cannot change the checks and EOBs to be printed. Any claims or EOBs scheduled to be paid, that need to be adjusted or pulled, must be handled individually. Met with the accounting personnel directly responsible for the maintenance of the accounts and had copies of the bank reconciliations provided to us. We then

26 randomly selected ten of the bank reconciliations for audit verification. 25 GROUP RESOURCES CONTROL OBJECTIVE 5 - PAYMENT OF CLAIMS AND EXPLANATIONS OF BENEFITS (EOB) (continued) Reports are received by Emdeon and verified by the Company. Emdeon has proper internal controls and procedures to accurately process checks and EOBs. Reports were reviewed with the Payroll/Checkroom Processor. The reports from Emdeon and the Company are compared for accuracy. Any discrepancy is handled prior to the Company releasing the checks and EOBs for printing by Emdeon. Reviewed the SAS 70 report for the period 6/30/07-12/31/08 for Advanced Business Fulfillment, LLC, a division of Emdeon Business Services. Spoke with Emdeon finance department and verified the Company works only with the Advanced Business Fulfillment, LLC division. No relevant exceptions noted. Results of Test Performed

27 26 GROUP RESOURCES CONTROL OBJECTIVE 6 - INVOICING OF GROUPS Controls provide reasonable assurances that invoices are accurate and sent in a timely manner. The accounting department prepares all invoices. The Member Service Representatives are responsible for providing the basic invoice amount to the accounting department. The information is entered into the accounting system and an invoice is prepared. Invoices are typically prepared around the 20th of the month and sent to the Groups either by mail or electronically. The invoices are billed one month in advance; therefore, an invoice sent out in October is for the month of November. Invoices to be mailed are sent to the mailroom, and invoices that are sent electronically are given to each Group s designated Member Service Advisor for delivery via . Attached to each invoice are the supporting documents showing the participants in the plan and the cost per participant. The Company invoices for special services on the monthly invoices. Description of Control Procedures The Member Service Representatives prepare the invoices based on enrollment information and additional charges received by the accounting department. Additional expenses for special services are properly billed. Tests of Controls Interviewed Member Service Representatives and the accounting personnel responsible for invoicing. Reviewed invoices that had been prepared for delivery to the Groups. Discussed special services with Company personnel and all stated that they notify accounting regarding additional expenses. Results of Test Performed

28 No relevant exceptions noted. 27 GROUP RESOURCES CONTROL OBJECTIVE 7 - REPORT PROCESSING Controls provide reasonable assurance that reports are accurate. In the Administrative Service Agreement, the Company agrees to provide reports based on each Group s needs. The standard reports available to the Groups include: check registers, claims processed reports, aggregate claim reports, specific claim reports, and benefit analysis reports. The Company also has the ability to generate custom reports to meet each Group s needs. The Director of Managed Care & Client Reporting is responsible for the custom reports generated by the Company. Custom reports are prepared as needed and sent electronically to the Group. Description of Control Procedures All Groups receive reports on a monthly basis. Custom reports are prepared on an as needed basis. Tests of Controls Reviewed reporting policies and procedures with the client reporting personnel and management. Interviewed the Director of Managed Care & Client Reporting, who verified that he maintains a multiple page listing of custom reports and required frequency. During testing of Groups we noted that some contracts required specialized reporting. Verified that all information provided to Groups comes from system data. Verified that all reports come directly from the TPA TeamUp data, and that custom reports are strictly data mined custom reports.

29 Results of Test Performed No relevant exceptions noted. 28 GROUP RESOURCES CONTROL OBJECTIVE 8 - REINSURANCE CLAIMS Controls are in place to ensure that all claims that are eligible for either Specific or Aggregate reinsurance claims are identified and filed in a timely manner to the reinsurance carriers. The TPA TeamUp system automatically notifies the Benefit Advisor once an insured s claims reach 50% of their specific limit. The Benefit Advisor then notifies the reinsurance department. As additional claims are received for the insured, the Benefit Advisor and the reinsurance department track the claims so that once the specific limit has been exceeded, the appropriate reinsurance claims are filed. Aggregate claims are tracked on a monthly basis by the reinsurance department and aggregate claim reports are run. Groups that have exceeded their aggregate limits are pulled and analyzed. Aggregate limits are calculated separately from specific limits; therefore, once the reinsurance department has determined that an aggregate limit has been exceeded, they subtract any claims in excess of the specific deductible on any ineligible claims from the aggregate limit. Description of Control Procedures Once an insured reaches 50% of their specific limit the system notifies the Benefit Advisor. Aggregate claims are reviewed and calculated on a monthly basis. Reinsurance claims are filed on the Groups behalf and the payments are to be made to the Group, not the Company. Tests of Controls During claims testing, auditors reviewed the claims on the system and viewed the notification when a 50% limit is reached. Interviewed reinsurance department personnel, and reviewed copies of the aggregate level reporting. Reviewed the calculations required. Reviewed policies and procedures with reinsurance department and mailroom personnel.

30 Results of Test Performed No relevant exceptions noted. 29 GROUP RESOURCES CONTROL OBJECTIVE 9 - COMPUTER OPERATIONS Policies and procedures are in place to ensure that the security, integrity and reliability of the computer networks and hardware are appropriate for the Company. The Company has implemented controls to provide network based security measures to protect their network. A variety of hardware and software based tools have been implemented to ensure a safe, secure and reliable network. All hardware is considered to be current models, all networks are appropriate and current, and the Company utilizes adequate uninterrupted power supplies, virus software and firewalls. The network administrator is responsible for the issuance of user names and passwords and is responsible for securing the network from unauthorized use. The IT personnel monitor the system on a constant basis and are responsible for keeping the system current and running in optimal conditions. Description of Control Procedures All access to the network and the TPA TeamUp system are controlled by the IT department. Computer hardware and software are current models or versions and are appropriate for the Company. Tests of Controls Interviewed personnel throughout the Company and all stated that their user names and passwords were issued by the IT department and that they can only access the areas of the system for which they are responsible. Auditor physically inspected the computer room and utilized the services of an outside consultant to review the computer operations of the Company..

31 30 GROUP RESOURCES CONTROL OBJECTIVE 9 - COMPUTER OPERATIONS (continued) Policies and procedures are in place to ensure that the security, integrity and reliability of the computer networks and hardware are appropriate for the Company. Description of Control Procedures Outside access to the network is limited and is secure. Tests of Controls Outside consultant verified that standard firewalls limit access. Outside consultant verified that satellite offices communicate with the servers via point to point network connections. Remote access limited to three key members of management. Company web site is hosted by a 3 rd party. Company information is downloaded to the web site; the web site is not connected directly to the Company s Servers. Tested web site for security issues that could comprise network integrity. Network logs track all access to the system. Backups and disaster plans are appropriate for the Company. Outside consultant reviewed logs of system activity and backups. Auditor and outside consultant reviewed backup system to verify that two backups are done on a daily basis, one stored offsite. Disaster plan to be up and running in approximately 72 hours, was reviewed. Results of Test Performed

32 No relevant exceptions noted. 31 GROUP RESOURCES CONTROL OBJECTIVE 10 - PHYSICAL SECURITY Physical accesses to the office and to secure areas of the office are properly secured. The Company has designed the physical security of its offices to control access to the office in order to protect both the Company and its employees. During office hours, magnetic proximity cards control access into the office. Visitors to the Company may only enter the office through the main entrance, which allows them into the lobby of the building. A receptionist is on duty during office hours to greet visitors. Electronic locks limit access into the operating areas of the office. The receptionist only allows access to known visitors; an employee must accompany new visitors into the main area of the office. After office hours, keyed locks and magnetic proximity cards lock the main and employee entrances to the office. Limited personnel have authority or access to the building after office hours. The Company has a burglar and fire alarm system with ceiling sprinklers and fire extinguishers located throughout the office. Additionally, the check processing room and the computer room have additional magnetic proximity locks along with windows into interior hallways to allow observation of personnel in those sensitive areas. Description of Control Procedures During office hours, the main areas of the office outside the lobby are locked. All other exterior doors are locked during business hours. Tests of Controls Auditor was in and out of the offices numerous times during the fieldwork. Magnetic proximity locks control access from the lobby into the main areas of the office. Receptionist would not allow access without questioning auditing staff. After business hours, the building is Main doors to exterior of the building have