REPORT DIGEST DEPARTMENT OF HEALTHCARE AND FAMILY SERVICES FINANCIAL AUDIT FOR THE YEAR ENDED JUNE 30, 2019 THIS DIGEST COVERS THE DEPARTMENT OF HEALTHCARE AND FAMILY SERVICES’ FINANCIAL AUDIT AS OF AND FOR THE YEAR ENDED JUNE 30, 2019. THE DEPARTMENT’S COMPLIANCE EXAMINATION COVERING THE TWO YEARS ENDED JUNE 30, 2019 WILL BE ISSUED AT A LATER DATE. Release Date: April 28, 2020 FINDINGS THIS AUDIT: 11 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 1 -- 8 -- 9 Category 2: 1 -- 1 -- 2 Category 3: 0 -- 0 -- 0 TOTAL: 2 -- 9 -- 11 FINDINGS LAST AUDIT: 15 Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General FRANK J. MAUTINO, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov SYNOPSIS • (19-01) The Departments (HFS and DHS) lacked controls over eligibility determinations, redeterminations and Mid-Point Reporting requirements for Federal programs where such determination/requirement is documented using the Integrated Eligibility System. • (19-03) The Departments (HFS and DHS) did not maintain adequate internal control to ensure applications for benefits and redeterminations of eligibility for benefits were completed timely. • (19-07) The Department’s internal controls were not sufficient to ensure its annual financial statements were updated for known changes affecting account balances for the year ended June 30, 2019. • (19-09) The Departments (HFS and DHS) failed to design and implement adequate internal controls over the operation of the State of Illinois’ Illinois Medicaid Program Advanced Cloud Technology system (IMPACT). FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS INADEQUATE CONTROLS OVER ELIGIBILITY DETERMINATIONS, REDETERMINATIONS AND MID-POINT REPORTING REQUIREMENTS The Department of Healthcare and Family Services (HFS) and the Department of Human Services (DHS) (collectively, the “Departments”) lacked controls over eligibility determinations, redeterminations and Mid-Point Reporting requirements for Federal programs where such determination/ requirement is documented using the Integrated Eligibility System. The Departments’ Integrated Eligibility System (IES) is the automated system used by the Departments which intakes, processes (with the assistance of caseworkers), and approves recipient applications, redetermination, Midpoint Reports and, maintenance items, in order to determine eligibility and make payments for the State’s human service programs. In order to conclude if the determination of eligibility was proper during the audit period, we selected a sample of 60 cases (29 new applications and 31 redeterminations) and tested whether the cases were properly certified (approved or denied) based on non- financial, financial and timeliness criteria. For SNAP cases we also tested whether the Mid- Point Report (MPR) was timely certified, where applicable. Our testing considered all the documentation contained within the case file, including the scanned documentation supporting caseworker overrides required prior to certification. In 13 of the 60 cases tested (21.7%) we noted 15 exceptions where either the case was not certified timely and/or the case file did not contain documentation supporting eligibility upon certification. In order to understand the functions performed by the caseworkers more fully, we conducted on-site observations at three of the Department of Human Services’ local offices. We noted the following types of issues the caseworkers encountered in their utilization of IES while working with recipients: • IES timed out and sent the caseworker back to the login screen while entering recipients’ information. Consequently, the caseworker had to reenter information. • IES indicated a recipients’ information contained errors; however, the caseworker’s review of the information noted no errors. • IES had technical errors while interfacing the other applications to conduct verification of the recipients’ information. • IES had errors in determining the benefits for recipients. • IES had issues determining recipients’ eligibility. • IES was unable to produce correspondence to recipients. Further, we noted insufficient communication between the Departments’ internal operating units which administer IES and related systems and the Departments’ financial reporting units, along with a lack of communication between the Departments and the auditors. We discovered that in September 2019, HFS’ Bureau of Eligibility Integrity identified system defects which resulted in temporary eligibility status recipients, or presumptively eligible recipients, maintaining their eligibility status in error after the Departments had deemed them ineligible. However, this condition was not reported to HFS’ financial reporting unit to determine the impact of this defect on the Departments’ financial statements, and it was not made known to the auditors. In fact, it was not until February 2020, during testing for the Statewide Single Audit performed by other auditors, that exceptions in the other auditors’ testing and further inquiries related thereto led to HFS’ disclosure of the existence of these system defects. At our request, HFS performed an analysis of the impact of this defect on the Departments’ financial statements and determined HFS paid benefits of $4.7 million in error for recipients who had been determined ineligible and received $217 thousand in federal financial participation (FFP) from those disbursements, pertaining to fiscal year 2019. The lack of a formal process to communicate matters such as those identified above represents a significant weakness in internal control over the Departments’ financial reporting. It is essential that financial- related consequences of system defects be communicated with appropriate fiscal personnel to determine the potential impact on the financial statements. Further, full and timely disclosure of potential or known problems to the auditors is essential to avoiding delays in the audits, including audits of the Departments’ financial statements, the Statewide Single Audit, and the Statewide Comprehensive Annual Financial Report. (Finding 1, pages 52-55) This finding has been repeated since 2015. We recommended management of the Departments provide adequate training and supervision of caseworkers, implement additional controls to ensure appropriate documentation of eligibility is obtained at the time of certification and retained in IES, complete certifications of applications and redeterminations timely, establish formal lines of communication between operating unit personnel and financial reporting personnel, and correct IES application errors. HFS officials accepted the recommendation and stated the Department will work with DHS and the Department of Innovation and Technology to improve staff training materials and communication, maintain better documentation through use of electronic case records, address timeliness issues with both applications and redeterminations through staff hiring and process simplification, and prioritize defects and enhancements for release into IES to improve performance and accuracy. Further, HFS stated the HFS Division of Medical Programs and the Division of Finance will develop a formal process to communicate any system defects that may have financial impact. UNTIMELY PROCESSING OF APPLICATIONS FOR BENEFITS AND REDETERMINATIONS OF ELIGIBILITY FOR BENEFITS The Department of Healthcare and Family Services (HFS) and the Department of Human Services (DHS) (collectively, the “Departments”) did not maintain adequate internal control to ensure applications for benefits and redeterminations of eligibility for benefits were completed timely. As part of our audit procedures, we tested the Departments’ compliance with the federal time requirements for approving or denying applications, conducting redeterminations, and working any changes communicated by recipients for the SNAP, TANF, and Medical programs. • For initial applications – The Departments had a backlog of 107,242 Medical applications, 19,957 SNAP applications, and 6,476 TANF applications, for which the determination of eligibility to receive benefits was not complete as of June 30, 2019. Additionally, there were 1,279 applications in which the applicant did not specify the program; therefore, we were unable to determine the timeliness of the application. • For redeterminations - The Departments had incurred a backlog of at least 170,720 medical redeterminations, and 980 SNAP and TANF redeterminations as of June 30, 2019. In addition to the known redetermination backlog, because of a defect within IES, the date information was received was not documented and we were unable to determine the timeliness of the redeterminations for 68,612 Medical recipients and 2,146 SNAP and TANF recipients. • For change documentation (a/k/a maintenance) - The Departments had a backlog of 51,903 cases for which information had been received by the Departments but not reviewed as of June 30, 2019. Because the information had not been reviewed, the Departments did not know which program(s) might be impacted. As such, we were unable to determine the timeliness of processing the information. (Finding 3, page 59-61) This finding has been repeated since 2017. We recommended the Departments work together to implement controls to comply with the requirement that applications are reviewed and approved or denied within 45 or 30 days, as applicable, and the Departments should establish appropriate controls to both monitor the progress of eligibility redeterminations and ensure those redeterminations occur timely along with any change documentation received. HFS accepted the recommendation and stated all backlogs are being addressed through a combination of staff hiring, enhanced training, process simplifications, policy streamlining and system enhancements. FINANCIAL STATEMENT PREPARATION WEAKNESSES The Department of Healthcare and Family Services’ (Department) internal controls were not sufficient to ensure its annual financial statements were updated for known changes affecting account balances for the year ended June 30, 2019. Annually, the Department reports a liability on its balance sheet for obligations for various medical claims incurred during the fiscal year. The Department refers to this liability as the medical accrual. One component of the calculation of the medical accrual liability at June 30, 2019, was an estimated amount owed related to changes in capitation rates. Although the Department received its 2019 calendar year rates in November of 2018, for various reasons it delayed implementing rate changes until an amendment of the 2019 rates was received. From January 2019 through June 2019 the Department had paid claims at the 2018 calendar year rates until such time as the 2019 calendar year rates amendment was approved and implemented. When the Department initially drafted its financial statements it estimated the amount payable for the difference of the amounts paid previously using the old rates compared to what would be owed and retroactively payable under new 2019 rates. However, on September 25, 2019, the Department received the final 2019 amended rates and therefore should have corrected its liability calculation using the final 2019 amended rates for its financial statements. The Department’s failure to update its medical accrual calculation resulted in an overstatement of liabilities in its financial statements totaling $70.2 million for this issue. The Department corrected its financial statements after the auditors made it aware of the misstatement. (Finding 7, pages 69-70) This finding has been repeated since 2016. We recommended the Department strengthen its internal controls to ensure its financial statements are updated for known changes affecting year end account balances. The Department accepted the recommendation and stated the Department will strengthen its controls to obtain monthly updates on significant estimates used in the calculation of the medical accrual liability. INSUFFICIENT REVIEW AND DOCUMENTATION OF PROVIDER ENROLLMENT DETERMINATIONS AND FAILURE TO EXECUTE INTERAGENCY AGREEMENTS The Department of Healthcare and Family Services (HFS), and the Department of Human Services (DHS) (collectively, the “Departments”) failed to design and implement adequate internal controls over the operation of the State of Illinois’ Illinois Medicaid Program Advanced Cloud Technology system (IMPACT). Specifically, we noted the Departments did not sufficiently review and document approval for provider enrollments and had not entered into interagency agreements (IA) defining each agency’s roles and responsibilities. HFS’ and DHS’ Roles As set by the State of Illinois’ State Plan under Title XIX of the Social Security Act (State Plan) (Section 1.1), the State’s designated agency responsible for administering and supervising the administration of the Medicaid Program is HFS. However, Section 1.1 of the State Plan allows for HFS to delegate specific functions to other State agencies to assist with the administration of the Medicaid Program, pursuant to a written IA defining each agency’s roles and responsibilities. As such, DHS administers several human service programs under the Medicaid Program, including developmental disabilities support services, rehabilitation services, and substance abuse (prevention and recovery) services. Auditor Testing and Results Interagency Agreements We noted the Departments did not have interagency agreements defining the specific roles and responsibilities. Quality/Supervisory Reviews Not Conducted We noted the Departments do not have a process for supervisors to perform, at least on a sample basis, quality reviews of the activities performed by staff to obtain independent evidence that staff members are acting within the scope of their authority and that transactions and events comport with management’s expectations. Detail Sample Testing Based on the population provided by HFS, during Fiscal Year 2019, 26,529 provider applications were approved. In order to determine if the providers’ applications were approved in accordance with federal and State laws/rules/regulations, a sample of 40 approved applications were selected for testing. Our testing of the 40 provider files noted: • 38 approved provider applications included requests for the applicable Department to backdate their enrollment beginning dates. Of those 38 approved applications, 28 (74%) provider files did not contain documentation of the Department's reason for allowing an exception and thereby backdating the provider's enrollment. As a result, we could not determine if the backdating of enrollment, and the subsequent payments was proper. Also, 4 of the 38 (11%) provider files were backdated in excess of HFS' policy, ranging from 19 to 413 days past the 180 day limit. • 8 (20%) provider files did not contain documentation the applicable Department reviewed the provider's required professional license or board certification to confirm the licenses/certifications were valid at the time the application was approved. • 3 (8%) provider files did not have documentation the applicable Department confirmed the provider's national board certification end date. In fact the certifications were recorded with open ended expiration dates within IMPACT. • 1 (3%) provider file noted a felony charge during the screening process. However, there was no documentation the application was sent to the Office of Inspector General (OIG) for detailed review and approval. DHS Testing During our testing, we determined DHS did not utilize IMPACT as the book of record or rely on it to verify their providers met certain Medicaid requirements prior to approving them to provide services. In fact, DHS was performing procedures to determine if the providers met certain Medicaid eligibility requirements outside of IMPACT. Upon completion of those procedures, DHS entered the information into IMPACT and approved the provider in order to grant the approval for payment. However, DHS did not regularly follow-up on discrepancies identified upon IMPACT completing verification of information, background checks, and professional licensing. Additionally, on a monthly basis IMPACT checks provider profiles against several databases to determine if the provider licenses are valid and current, and identifies suspected criminal activity. However, we determined DHS was not regularly following up on noted issues. Although DHS performed various procedures in determining if providers met the Medicaid eligibility requirements, we noted there was no consistent process for reviewing issues identified and reporting to HFS to ensure only eligible providers were paid with federal and/ or State funds. (Finding 9, page 73-76) We recommended management of the Departments improve controls to ensure each Departments’ staff and supervisors are properly obtaining, reviewing, and retaining documentation in IMPACT to support Medicaid provider enrollment and execute detailed interagency agreements defining the roles and responsibilities of each agency regarding the Medicaid program. Furthermore, we recommended DHS utilize IMPACT as their book of record for provider enrollment. DHS should also develop controls to review any noted issues and notify HFS of any issues affecting eligibility. HFS accepted the recommendation and stated the Department has adopted a formal quality assurance process that has been memorialized in a new Standard Operating Procedure (SOP). In addition, HFS stated the Department is updating existing SOPs, where appropriate, to clearly outline the comment requirements and providing sample comment suggestions to standardize the process amongst all staff and these updates will be shared with staff during future staff training sessions. Lastly, HFS stated all SOPs have also been incorporated into the sister agency Interagency Agreements that have been drafted. OTHER FINDINGS The remaining findings pertain to the lack of security controls over the IES, insufficient internal controls over changes to the IES and recipient data, inadequate disaster recovery over the IES, the lack of a detailed agreement with the Department of Innovation & Technology, incorrect claim payments, inadequate general information technology controls over IMPACT, and failure to review external service providers’ internal controls. We will review the Department’s progress towards the implementation of our recommendations in our next financial audit. AUDITOR’S OPINION The auditors stated the financial statements of the Department of Healthcare and Family Services as of and for the year ended June 30, 2019 are fairly stated in all material respects. This financial audit was performed by Sikich LLP. JANE CLARK Division Director This report is transmitted in accordance with Section 3-14 of the Illinois State Auditing Act. FRANK J. MAUTINO Auditor General FJM:jv