REPORT DIGEST DEPARTMENT OF HEALTHCARE AND FAMILY SERVICES FINANCIAL AUDIT FOR THE YEAR ENDED JUNE 30, 2018 Release Date: August 22, 2019 FINDINGS THIS AUDIT: 15 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 6 -- 9 -- 15 Category 2: 0 -- 0 -- 0 Category 3: 0 -- 0 -- 0 TOTAL: 6 -- 9 -- 15 FINDINGS LAST AUDIT: 13 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS • (18-01) The Departments (HFS, DHS, DCFS, and DoA) failed to execute adequate internal controls over the implementation and operation of the State of Illinois’ Illinois-Michigan Program Alliance for Core Technology system (IMPACT). • (18-04) The Departments (HFS and DHS) did not adequately execute internal controls over the implementation and operation of the State of Illinois’ Integrated Eligibility System (IES) Phase II. • (18-06) The Departments (HFS and DHS) did not maintain adequate controls to ensure applications for human service programs were reviewed and approved or denied within the mandated 45 or 30 day timeframes. Additionally, the Departments did not conduct timely redeterminations of eligibility for the Supplemental Nutrition Assistance Program (SNAP), the Temporary Assistance for Needy Families (TANF) Program, and the Medicaid (medical) Program recipients. • (18-09) The Department did not ensure its annual financial reports were prepared in conformity with U.S. generally accepted accounting principles (GAAP). • (18-10) The Department failed to implement adequate monitoring controls over its Managed Care Organizations (MCOs) in accordance with the Code of Federal Regulations (Code) and provisions outlined in the MCOs’ contracts. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS STATEWIDE FAILURE TO EXECUTE INTERAGENCY AGREEMENTS AND PERFORM ESSENTIAL PROJECT MANAGEMENT FUNCTIONS OVER PROVIDER ENROLLMENT IN THE MEDICAID PROGRAM The Department of Healthcare and Family Services (HFS), the Department of Human Services (DHS), the Department of Children and Family Services (DCFS), and the Department on Aging (DoA) (collectively, the “Departments”) failed to execute adequate internal controls over the implementation and operation of the State of Illinois’ Illinois-Michigan Program Alliance for Core Technology system (IMPACT). Specifically, management of the Departments did not enter into interagency agreements (IA) defining each agency’s roles and responsibilities, and did not perform essential project management functions over the implementation of IMPACT. HFS’ and Delegated Agencies’ Roles As set by the State of Illinois’ State Plan under Title XIX of the Social Security Act (State Plan) (Section 1.1), the State’s designated agency responsible for administering and supervising the administration of the Medicaid Program is HFS. However, Section 1.1 of the State Plan also allows for HFS to delegate specific functions to other State entities to assist with the administration of the Medicaid Program, pursuant to a written IA defining each agency’s roles and responsibilities. During our testing, we identified the following delegated agencies, which we will refer to as HFS’ Delegated Agencies, and examples of the Medicaid services they provide which utilizes IMPACT for enrollment of their providers. DHS administers several human service programs under the Medicaid Program, including developmental disabilities support services, rehabilitation services, and substance abuse (prevention and recovery) services. DCFS administers the State’s child welfare program which includes cooperating in the establishment of Medicaid eligibility for children who are wards of the State. DoA administers the State’s programs for residents aged 60 and older, including Home and Community Based Services to Medicaid recipients who meet Community Care Program requirements. Auditor Testing and Results In order to determine if the Departments complied with federal and State laws, rules, and regulations when they developed, implemented, and operated IMPACT, we reviewed the Departments’ applicable policies and procedures governing IMPACT. The testing identified the following material weaknesses in internal control: • The Departments did not have current, formal written agreements defining the roles and responsibilities of HFS or its Delegated Agencies of the Medicaid Program. • While DHS utilized IMPACT to formally approve providers for the purposes of granting payments of their Medicaid claims, it did not utilize IMPACT as its book of record or rely on it to verify the providers met certain federal requirements. In this instance, the book of record means the mandatory system designated by HFS to be used for the tracking of the State’s activities, events, or decisions when approving or denying the enrollment of Medicaid providers. When we inquired of DHS as to why it did not retain the documentation within IMPACT to support its determination of enrollment, DHS management stated it chose to maintain the supporting documentation outside of IMPACT as it could not rely on IMPACT. • When we inquired of DCFS and DoA as to what their processes were regarding the use of IMPACT, they both stated they did not use IMPACT after formally approving the providers for the purpose of granting payments of their Medicaid claims. They both believed HFS was doing the subsequent review of, and maintenance of, provider enrollment information for them. After asking HFS to confirm if DCFS’ and DoA’s statements were accurate, HFS management stated that was not the case and both DCFS and DoA had the responsibility to subsequently review their providers eligibility for enrollment in the Medicaid program. • The Departments implemented IMPACT despite the inability of IMPACT to allow Illinois officials to generate customary and usual system internal control reports, including such information as provider data, security measures, or updates made to IMPACT. The Departments must go through the third party service provider (TSP) in order to obtain any reports needed by the State. • Based on testing of the documented procedures governing IMPACT, the auditors noted the following: – the procedures only addressed the actions that should have been taken by HFS and did not include the procedures to be followed or taken by the Delegated Agencies, – the procedures contained contradictory provisions, and – the procedures did not depict the actual actions taken by HFS staff during the examination period. • The Departments failed to establish and maintain adequate general information technology controls over IMPACT. • The Departments had inadequate project management over the implementation of IMPACT. According to the Intergovernmental Agreements, Amendments, and Statements of Work signed between HFS and the TSP, who maintains and hosts IMPACT, the TSP was to provide HFS various deliverables throughout the implementation of the project for its timely review and approval. During testing of the deliverables required to be provided, the auditors noted the following: – HFS did not receive 9 of the 60 (15%) required deliverables, – For 39 of the 51 (76%) deliverables received, there was no supporting documentation to demonstrate HFS had approved them, and – One of the 51 (2%) deliverables received, the Provider Enrollment (PE) Implementation Plan, was noted as “draft”. As a result, HFS does not have supporting documentation to show it received and approved the “final” version of the deliverable. The purpose of the PE Implementation Plan was to define the overall approach for the implementation of the PE module of IMPACT. • As a result of inadequate project management, the Departments did not implement adequate security controls over IMPACT. • The Departments did not design and establish an adequate internal control structure over provider enrollment determination such that sufficient and appropriate evidence, maintained in a paperless format, existed to support each provider met various compliance requirements at the time when the Departments determined each provider’s eligibility. Further, management at the Departments failed to adequately monitor manual provider enrollment determinations, as (1) staff did not consistently document their review of the provider applications in accordance with HFS’ Process Checklists and (2) HFS did not establish a system of supervisory reviews of work performed by staff. (Finding 1, pages 52-56) We recommended management of the Departments execute detailed IAs which define the roles and responsibilities of each agency regarding the Medicaid Program. The IAs should sufficiently address necessary procedures to enforce monitoring and accountability provisions over IMPACT as required by the Code of Federal Regulations, the State Plan, and the Act so the enrollment of providers offering services to recipients of the Medicaid program is carried out in an effective, compliant, efficient, and economical manner. We further recommended the Departments obtain and review/approve the remaining deliverables from the TSP and, in the future, the Departments should establish adequate controls over project management for the development and implementation of major projects, such as IMPACT. HFS officials accepted the recommendation and stated it will update interagency agreements to include the roles and responsibilities of each agency. FAILURE TO PERFORM ESSENTIAL PROJECT MANAGEMENT FUNCTIONS OVER THE INTEGRATED ELIGIBILITY SYSTEM (IES) The Department of Healthcare and Family Services (HFS) and the Department of Human Services (DHS) (collectively, the “Departments”) did not adequately execute internal controls over the implementation and operation of the State of Illinois’ Integrated Eligibility System (IES) Phase II. Specifically, management of the Departments did not perform adequate project management functions over the implementation of IES Phase II. IES was developed to consolidate and modernize eligibility functions and to comply with the Affordable Care Act of 2010. Phase II of IES was placed into service on October 25, 2017. In order to determine if the Departments had complied with Federal and State laws, rules, and regulations when the Departments developed, implemented, and operated IES Phase II, we tested the Departments’ applicable policies and procedures governing IES Phase II. Our testing identified the following: • The Departments did not have current, formal written agreements, policies, or procedures defining the roles and responsibilities of HFS, DHS, and DoIT regarding the operation of IES. • During our analysis and review of IES Phase II data, 128 individuals were identified in which each individual's Social Security number had been overwritten when a data update was done after the conversion to IES Phase II. • During our review of the Departments’ User Acceptance Test Plan (Plan) which was used to implement IES Phase II into production, we noted the Plan did not document the Departments’ controls over all aspects of the Departments’ user testing. Specifically, the Plan did not address controls governing the Departments’ Adverse Action Testing and the Requirements Traceability Matrix (RTM) Scripts for Test Scripts for Technology. • The Departments’ review and approval of required contract deliverables for the implementation of IES Phase II were inadequate. • The Departments implemented IES Phase II even though IES Phase II did not take into consideration information being retained by a third party service provider (TSP) that was sending and accepting redetermination paperwork and reporting functions for the State. • DHS waived the requirement for the SNAP December 2017, January 2018, and February 2018 Mid-Point reports (MPRs). • The Departments failed to establish and maintain adequate general information technology controls. Specifically, we noted the Departments did not implement adequate security or change management controls over IES. • The Departments had insufficient review and documentation of recipient eligibility determinations. Additionally, we would like to note that from the Fall of 2018 through the Spring of 2019, we made several requests to the Departments for essential documentation relating to the testing of IES Phase II’s project management, systems development, and contractual requirements in order to assess the risk of material misstatements to Departments’ financial statements. In July 2019, the Departments finally provided sufficient supporting documentation regarding the above in order for us to provide an unmodified opinion. (Finding 4, pages 68-74) We recommended (1) the Departments cooperate fully with FNS and Federal CMS to timely implement all corrective actions necessary to alleviate the potential for future acts of material noncompliance, (2) the Departments execute written agreements, policies, and procedures defining the roles and responsibilities of HFS, DHS, and DoIT regarding the operation of IES for each of the applicable human service programs, (3) the Departments should obtain, review, and approve the remaining deliverables from the development vendor and, in the future, the Departments should take action to establish adequate controls over project management for the development and implementation of major projects, such as IES, and (4) the Departments should provide accurate and timely responses to auditor requests. HFS accepted the recommendation and stated it will continue to cooperate with Federal CMS on implementation of corrective actions, continue to work with DHS and DoIT on improving project management, increase staffing levels, enhance training, streamline policies, and simplify IES processes. Further HFS noted it feels it has worked cooperatively to respond accurately and timely to requests from the auditors. BACKLOG OF APPLICATIONS AND REDETERMINATIONS FOR HUMAN SERVICE PROGRAMS The Department of Healthcare and Family Services (HFS) and the Department of Human Services (DHS) (collectively, the “Departments”) did not maintain adequate controls to ensure applications for human service programs were reviewed and approved or denied within the mandated 45 or 30 day timeframes. Additionally, the Departments did not conduct timely redeterminations of eligibility for the Supplemental Nutrition Assistance Program (SNAP) and the Temporary Assistance for Needy Families (TANF) Program, and the Medicaid (medical) Program recipients. The Departments’ Integrated Eligibility System (IES) is the automated system used by the Departments which intakes, processes (with the assistance of caseworkers), and approves recipient applications, maintenance items, and redeterminations in order to determine eligibility and make payments for the State’s human service programs. As part of our audit procedures, we tested the Departments’ compliance with the federal time requirements for approving or denying applications, conducting redeterminations, and working any changes communicated by recipients for the SNAP, the TANF, and the medical programs. • For initial applications – The Departments provided us information indicating that as of June 30, 2018, the Departments had a backlog of 125,044 medical applications and 24,859 SNAP applications for which eligibility was not yet determined (worked) within the 45 day or 30 day requirements, as applicable. The oldest medical applications dated back to 2013 and the oldest SNAP applications dated back to 2014. • For redeterminations - The Departments provided us information indicating that as of June 30, 2018, the Departments had incurred a backlog of 96,979* medical redeterminations and 23,199* SNAP and TANF redeterminations (see note below). The oldest medical redeterminations dated back to 2016 and the oldest SNAP and TANF redeterminations dated back to 2017. *As described in the Finding 2018-004, upon implementation of IES Phase II, the Departments extended the due dates for cases that were to be redetermined in October 2017 through December 2017. As of June 30, 2018, there were 173,331 such cases that had not yet been redetermined. These cases were not included in the 120,178 redetermination cases (96,979 medical and 23,199 SNAP) discussed in this finding. As a result, our testing indicated a total known redetermination backlog of 293,509 cases. • For change documentation received by the Departments (a/k/a maintenance) - The Departments provided us information indicating that as of June 30, 2018, there were 85,736 backlogged documents (60,992 medical and 24,744 SNAP and/or TANF documents) on hand that have been received from active recipients to update eligibility information pertaining to their cases, which were not related to either their initial application or annual redetermination. For example, a recipient who got a new job between the date of original application, but before his/her scheduled annual redetermination date, would need to supply the Departments with new income information, which would in turn likely impact their benefit levels. (Finding 6, page 81-84) We recommended the Departments (1) provide significant oversight to ensure the corrective action plans are submitted and approved within the required timeframe, (2) ensure every provision within the corrective action plans is strictly adhered to and fully implemented, (3) work together to implement controls to comply with the requirement that applications are reviewed and approved or denied within 45 or 30 days, as applicable, (4) establish appropriate controls to both monitor the progress of eligibility redeterminations and ensure those redeterminations occur timely, (5) the internal audit functions of the Departments should periodically monitor adherence to the established controls, and (6) assign and train any additional personnel necessary so that initial applications are worked and redeterminations and maintenance of eligibility are performed within the timeframes required by the Code. HFS accepted the recommendation and stated it will continue to cooperate with Federal CMS on implementation of corrective actions and it will continue to work with DHS on implementing system and business process improvements to meet federal requirements on processing timeframes. FINANCIAL STATEMENT PREPARATION WEAKNESSES The Department of Healthcare and Family Services (Department) did not ensure its annual financial reports were prepared in conformity with U.S. generally accepted accounting principles (GAAP). We noted the Department did not perform a sufficient review of all accounts and amounts recorded within its financial statements, GAAP Package reports prepared for the Office of the State Comptroller to prepare the State’s Comprehensive Annual Financial Report, and various additional supporting schedules. The following are some of the errors in the Department’s financial statements, GAAP packages prepared for the Illinois Office of the Comptroller, and additional supporting schedules and analysis we noted: • The Department applied a similar methodology to estimate its liability for medical costs (medical accrual) at June 30, 2018, as had been utilized in prior fiscal years. However, in addition to the calculated liability estimate, the Department added $197.7 million to the reported medical accrual in connection with a court order requiring provisional eligibility on backlogged long-term care applications. Because the Department's estimation methodology historically has intended to encompass backlogged applications for all medical assistance, including long-term care applications, the Department essentially duplicated the portion of the medical accrual attributed to long-term care backlogged applications. After this was questioned by the auditors, the Department performed an analysis of subsequent payments of Fiscal Year 2018 medical liabilities paid through April 30, 2019. With this additional data, the Department reviewed its overall estimate of medical liabilities at June 30, 2018, and determined a $130.8 million reduction of the liability was needed. The Department adjusted its financial statements accordingly. • We noted the Department did not update its Medical Loss Ratio (MLR) recoupment receivable amount for information received after initially drafting the financial statements, but before the statements were issued. As part of its medical accrual calculation, the Department included amounts due back from Managed Care Organizations (MCO) as a result of its MLR calculations, as provided for by the MCO contracts. However, estimates of amounts expected to be received from the MLR recoupments were not updated to be responsive to information available to the Bureau of Managed Care's staff after the financial statements were drafted. Taking the relevant information into consideration, we noted the MLR recoupment receivable should have been adjusted to $31,622,288 instead of the previously recorded $57,570,938, a difference of $25,948,650. The Department adjusted its financial statements accordingly. • The Department did not record the estimated amount of Disproportionate Share Hospital (DSH) adjustment amounts payable to two hospitals. In July 2018, information was received from the United States Department of Health and Human Services' Centers for Medicare and Medicaid Services which indicated an additional $35.4 million was payable from the Department's County Provider Trust Fund to the hospitals above what had previously been disbursed. The Department adjusted its financial statements accordingly. (Finding 9, pages 92-94) We recommended the Department (1) take action to ensure all of its transactions are properly recorded and presented in its financial statements and GAAP Packages in accordance with GAAP, and (2) ensure the accuracy and completeness of its financial and non-financial information used during the financial reporting process by reviewing both the source for, and the manual and electronic processing of, its underlying transactions. The Department accepted the recommendation and stated it will reinforce its efforts at organizational communication throughout the year, so that all staff are aware of the need to continually communicate changes and other items potentially impacting the financial statement. This finding has been repeated since 2016. INADEQUATE CONTROLS OVER FISCALLY MONITORING MANAGED CARE ORGANIZATIONS The Department of Healthcare and Family Services (Department) failed to implement adequate monitoring controls over its Managed Care Organizations (MCOs) in accordance with the Code of Federal Regulations (Code) and provisions outlined in the MCOs’ contracts. During Fiscal Year 2018, the Department paid 12 MCOs approximately $9.5 billion and had an additional $1.18 billion outstanding liability balance due to the 12 MCOs at June 30, 2018. While testing certain provisions of the MCO contracts and the Code which would have had a material impact on the Department’s financial statements, we noted the Department did not: • Develop and implement a review process to ensure MCO capitation payments were paid at the federally-approved actuarial rate settings. As a result, we noted instances, totaling $6,899,317, where the Department had a net overpayment to the MCOs for services paid during Fiscal Year 2018. • Develop and implement a review process to ensure the correct percentage of MCO incentive payments, which are manually calculated, were withheld in accordance with the MCO contracts. As a result, we noted instances totaling $263,061 for which the Department underpaid the MCOs during Fiscal Year 2018 by failing to withhold at the rate established by the contracts. • Have or perform procedures to ensure that enrollee encounter data submitted by the MCOs to the State was accurate and complete, as required by the MCO contracts and by the Code (42 C.F.R. § 438.242(d)). Furthermore, for contracts beginning on or after July 1, 2018 (which is for the seven HealthChoice of Illinois contracts and the eight Medicare-Medicaid Alignment Initiative (MMAI) contracts), the Code (42 C.F.R. § 438.818(a)(2)) conditions financial federal participation (FFP) on whether the State has validated the accuracy and completeness of the encounter data. As of the end of fieldwork, the Department had not met these requirements. • Review or monitor claims denied by the MCOs to determine whether the MCOs had appropriately denied claims submitted to them by Medicaid providers. As such, the Department could not demonstrate medical providers were paid for all eligible Medicaid services they provided to Medicaid recipients in accordance with the State Plan. • Adequately review three MCOs' non- benefit/administrative or benefit costs to ensure the MCOs were correctly reporting expense data it supplied to the State's actuary used in connection with the MCOs Medical Loss Ratio (MLR) estimate calculations. Without performing a review of the self-reported cost data submitted by the three MCOs, the Department cannot have any assurance the information the MCOs supplied for the MLR calculation was complete and accurate. (Finding 10, pages 95-96) We recommended the Department take immediate action to exercise and enforce monitoring and accountability provisions established in the contracts with the MCOs and required by the Code. Further, we recommended it is imperative the Department develop and perform procedures over encounter data to exercise its fiduciary responsibility as well as to avoid any disruption in the Federal funding of its Medicaid program. The Department accepted the recommendation and stated it will continue to implement actions to enhance MCO operational quality and accountability. Further, the Department stated it has implemented an additional layer of review of the manual rate entry process and new requirements for disputed claims. OTHER FINDINGS The remaining findings pertain to inadequate general information technology controls over IMPACT, insufficient review and documentation of provider enrollment determinations, the deletion of four months of intake eligibility files and significant problems in determining eligibility for human service programs, lack of controls over changes to the IES, lack of security controls over the IES, duplicate payments to Medicaid MCOs, inaccurate rates used to pay MCOs, incorrect claim payments made to medical providers and MCOs, failure to review external service providers’ internal controls, and inadequate and untimely disclosures. We will review the Department’s progress towards the implementation of our recommendations in our next financial audit. AUDITOR’S OPINION The auditors stated the financial statements of the Department of Healthcare and Family Services as of and for the year ended June 30, 2018 are fairly stated in all material respects. This financial audit was performed by Sikich LLP. JANE S. CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:jv