INDEPENDENT EXTERNAL AUDIT: 2015 AUDIT FINDINGS REPORT · 2019-07-29 · WAHBE State Based Marketplace 2015 Audit Findings Report Page 3 of 12 WASHINGTON AUDIT FINDINGS REPORT 2015

WAHBE State Based Marketplace 2015 Audit Findings Report Page 1 of 12

INDEPENDENT EXTERNAL AUDIT: 2015 AUDIT FINDINGS REPORT

WASHINGTON WASHINGTON HEALTH BENEFIT EXCHANGE (WAHBE)


WASHINGTON AUDIT FINDINGS REPORT 2015

INDEPENDENT EXTERNAL AUDIT: 2015 FINDINGS REPORT

TO: CCIIO STATE EXCHANGE GROUP FROM: BERRY DUNN MCNEIL & PARKER, LLC (BERRYDUNN) DATE: JULY 29, 2016 SUBJECT: AUDIT FINDINGS REPORT FOR WASHINGTON AUDIT PERIOD: JANUARY 1, 2015 – DECEMBER 31, 2015

I. EXECUTIVE SUMMARY PURPOSE The purpose of this independent external audit is to assist the State of Washington in determining whether the Washington Health Benefit Exchange (WAHBE), the Washington State-Based Marketplace (SBM), is in compliance with certain programmatic requirements set forth by the Centers for Medicare and Medicaid Services (CMS). Name of SBM: Washington Health Benefit Exchange (WAHBE) State of SBM: Washington Name of Auditing Firm: BerryDunn Our responsibility was to perform a programmatic audit to report on WAHBE’s compliance with 45 CFR 155 as described in the CMS memo dated June 18, 2014, Frequently Asked Questions about the Annual Independent External Audit of SBMs. The Program Integrity Rule Part II (“PI, Reg.”), 45 CFR 155.1200 (c), states, “The State Exchange must engage an independent qualified auditing entity which follows U.S. generally accepted governmental auditing standards (GAGAS) to perform an annual independent external programmatic audit and must make such information available to the United States (U.S.) Department of Health and Human Services for review.” SCOPE The scope of this engagement was limited to an examination of WAHBE’s policies and procedures to test whether the policies and procedures are in compliance with the programmatic requirements under 45 CFR 155, Subparts B, C, D, E, F, H, K and M for the 12-month period January 1, 2015 through December 31, 2015. The engagement did not include an audit of the Statement of Appropriations and Expenditures of WAHBE, nor did it include an examination of WAHBE’s financial controls and compliance with the financial accounting and reporting requirements of 45 CFR 155.



We conducted our audit in accordance with U.S. GAGAS contained in Government Auditing Standards, issued by the Comptroller General of the United States. We completed an examination of WAHBE’s compliance with certain programmatic requirements under 45 CFR 155 and issued our reports, dated July 29, 2016.

We reviewed processes and procedures, read pertinent documents, and performed inquiries, observations, and staff interviews to obtain reasonable assurance regarding whether WAHBE is in compliance with 45 CFR 155 in all material respects. METHODOLOGY Audit Firm Background: BerryDunn is the largest certified public accounting and consulting firm headquartered in New England, with more than 280 professionals. BerryDunn has, for more than 40 years, provided comprehensive audit and tax services for a broad range of State Based Marketplaces, healthcare, not-for profit, and governmental entities. Those services include conducting audits in accordance with Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance, previously referred to as OMB Circular A-133) for several sizable healthcare organizations, many of which receive U.S. Department of Health and Human Services federal grants or funding. In addition, we provide audit services for higher education, social service, and economic development organizations, as well as other entities that receive federal grants and are subject to the Uniform Guidance.

Programmatic Audit: We have examined WAHBE’s compliance with the programmatic policies and procedures requirements described in 45 CFR 155 for the year ended December 31, 2015, and have issued a report thereon dated July 29, 2016.

Summary of Programmatic Audit Procedures: Our audit consisted of specific procedures and objectives to evaluate instances of noncompliance and to test WAHBE’s compliance with certain subparts of 45 CFR Part 155. BerryDunn examined compliance with the requirements under Title 45, Part 155, in the following programmatic areas:

• General Functions (Subpart B)

• General Functions (Subpart C)

• Eligibility Determinations (Subpart D)

• Enrollment Functions (Subpart E)

• Appeals (Subpart F)

• SHOP (Subpart H)

• Certification of Qualified Health Plans (Subpart K)

• Oversight and Program Integrity Standards (Subpart M)



We reviewed the processes and procedures under Title 45, Part 155, in the following programmatic areas in order to determine whether they are in compliance with the requirements of the ACA:

• Navigators, Certified Application Counselors, and Brokers

• Call Center Processes and Procedures

• Eligibility Processes and Procedures

• Appeals

• SHOP

• Qualified Health Plan Certification

• Compliance and Program Integrity

We reviewed the following documentation, which was obtained directly from WAHBE, or located on either the WAHBE website or the CMS website:

• 42 CFR Parts 431, 435, and 457, Medicaid Program Eligibility Changes Under the Affordable Care Act of 2010

• Affordable Care Act (ACA) # 22—Conversion of Net Income Standards to MAGI Equivalent Income Standards

• Blueprint Report

• Business rules for calculating Modified Adjusted Gross Income (MAGI)

• Board Bylaws

• Board Financial Update (5/26/2016)

• Board Meeting Minutes (1/1/2015-6/30/2016)

• Broker Listing

• Business rules for determining eligibility for Advanced Premium Tax Credit (APTC) and Cost Sharing Reductions (CSR)Corrective Action Plans

• Certified Application Counselor Implementation Guidelines

• Certified Application Counselor Listing

• Charter

o Advisory Committee

o Agents/Brokers

o HBE Compliance Committee

o Health Equity Technical Advisory Committee

o Navigator

o Outreach

• CMS Monthly Reports

• CMS Quarterly Reports



• Contracts

o Ciber (IT Resources)

o Cognizant (Software Provider)

o Coolsoft (IT Resources)

o Deloitte (Systems Integrator)

o eHealth (Software Provider)

o Faneuil (Call Center)

o GMMB (Marketing & Advertisement Strategy)

o KP Printing (Printing and Mailing)

o Milestone (Software Provider)

o Public Consulting Group (Software Provider)

o TEK Systems (Software Provider)

o Template for Certified Application Counselor Attestations

o Template for Certified Application Counselors (CAC) Entity Agreement

o Template for Navigator Attestations

o Template for Navigator Entity Agreement

• Governance Documentation

o Conditional Approval Letter – CMS

o Conflict of Interest Statement

o Cooperative Agreement – WA DSHS

o Ethics Statement

o Final Demonstration Agreement (FDA) – CMS & WA

o Memorandum of Understanding (MOU) – CMS & WA

o Memorandum of Understanding – WA OIC

o Privacy and Security Policies

• Navigator Forms

o Code of Ethics

o Conflict of Interest

o Privacy and Security

• Navigator Listing

• Notices

o Additional Verification Required notices

o Incomplete Application notices

o DSHS 14-012 Consent form

o DSHS 14-532 Authorized Representative form

o Eligibility Decision notices



• Operations Manual

• Organization Charts

• Policies and Procedures for Appeals

• Policies and Procedures for Eligibility Determinations

• Policies and Procedures for Employee Onboarding and Provisioning

o Board Conflict of Interest Statement

• Policies and Procedures for Identity Check

• Policies and Procedures for Privacy and Security

o Access Control Policy – Healthplanfinder System

o Personnel Action Request – Healthplanfinder System

o Personnel Security Policy – Healthplanfinder System

o Privacy Policy – Healthplanfinder System

• Policies and Procedures or Record Retention

• Policies and Procedures for Renewals

• Policies and Procedures for Verification of Self-Attested Data

• Policies and Procedures for Whistleblowers

• Qualified Health Plans (QHP) Offered by WAHBE

• Second Lowest Cost Silver Plan Data

• Security Documents, Including

o Authority to Connect

o Computer Matching (CMPPA) Agreement – DHHS, CMS & WAHBE

o Data Sharing Agreement – WA DSHS

o Data Sharing Agreement – WA OIC & Healthplanfinder

o Data Use, Exchange, Interconnection (DEX) Agreement

o Information Exchange Agreement (IEA) – CMS & WAHBE

o Interconnection Security Agreement (ISA), Master & Associate – CMS Data Services Hub

o Producer Participation Agreement – Healthplanfinder System

o IRS Safeguard Security Report (SSR)

o Plan of Action & Milestones (POA&M)

o Privacy Impact Assessment (PIA)

o System Security Plan (SSP) and Workbook

o Third-Party Independent Security Assessment Report (SAR) [Cross-Reference Control Family SSP]

o User Access Attestations – Healthplanfinder System



• SHOP – Business Enrollment Guide

• SHOP – Business Renewal Guide

• SHOP – Carrier Enrollment Guide

• SHOP – Employer Processes and Procedures

• SHOP – IRS Report

• SHOP – Issue Resolution

• Training Materials for Call Center Staff

o Basic Inbound Call Handling Process map

• Training Materials for Navigators

o American Indian/Alaska Native module

o Assisting Consumers in Plan Comparison and Selection module

o Carrier Enrollment & Reconciliation Process module

o Conditional Eligibility Verifications module

o Customer Resolution Scenarios module

o Insurance 101 module

o Navigator Program Appendix A: Conflict of Interest standards

o Navigator Program Training Plan 2016

o QHPs

o Role of the Navigator 2016 module

o Security & Privacy Training for Healthplanfinder Access module

o Troubleshooting Desk Aid tutorial

• WAHBE Handbook

• WAHBE Healthplanfinder Single Streamlined Application

• WAHBE Staff Update on Budget (3/2016)

• WAHBE ‘Budget by Year’ document

In order to understand management and staff responsibilities and processes as they relate to compliance with 45 CFR, Part 155, we performed walkthroughs of data systems and operations and interviewed the following WAHBE staff:

• Appeals Manager

• Associate Director of Project Management Office

• Chief Executive Officer

• Chief Financial Officer

• Chief Information Officer

• Communications/Outreach Director

• Deputy Chief Financial Officer



• Deputy Director of Operations

• Deputy Director of Operations – Call Center

• Enterprise Project Manager

• Exchange Board Members

• IT Data Management Team

• IT Manager Security & Quality Assurance

• Legal Services Director

• Operations Director

• Policy Director

• Small Business/Agent Manager

We interviewed the following staff at the Spokane Call Center:

• Operations Director • Quality Manager • Senior Program Specialists

We interviewed the following staff from Seattle King County Navigator Lead Organization

• Deputy Program Manager • Program Manager • Directors of Representative Navigator Programs

We interviewed the following staff from the Office of the Insurance Commissioner:

• Deputy Insurance Commissioner • Senior Health Policy Advisor

CONFIDENTIAL INFORMATION OMITTED

N/A



II. AUDIT FINDINGS

KEY FINDINGS

FINDING #2015-001

Criteria Subpart D – Eligibility, 45 CFR §155.315 requires that a State Based Marketplace (SBM) make a determination based upon the data entered by an applicant in the application, and data received from automated data sources. Under 45 CFR §155.315 (f), the Exchange must make a reasonable effort to identify and address any inconsistency between the self-attested data in the application and the information obtained from outside data sources by contacting the applicant and requesting them to provide additional information to resolve the inconsistency. Pursuant to 45 CFR §155.315 (f) (2) (ii), the Exchange must provide the applicant with a period of 90 days (beginning with the date when the applicant receives the notice requesting documentation) to resolve an inconsistency between the self-attested data and the data received from outside sources. We note that, due to the uncertainty of when an applicant actually receives a notice, WAHBE has changed its policy to set a time limit of 95 days after the notice was issued. Pursuant to 45 CFR §155.315 (f) (3), the Exchange can extend the period if an applicant demonstrates a good-faith effort to provide sufficient documentation to resolve the inconsistency. During this inconsistency period, an applicant (who is otherwise qualified) is eligible to enroll in a Qualified Health Plan and is eligible for insurance affordability programs (45 CFR § 155.315 (f) (4)). WAHBE refers to these case as “conditionally eligible.” If, after the 90-day period (or applicable extensions), the Exchange is unable to resolve the discrepancy between the self-attested information and the data sources with customer-provided information, then it must re-perform the eligibility calculations and notify the applicant of their new eligibility determination.

Condition: The Exchange has not implemented procedures to ensure reasonable effort is made to identify and address inconsistencies between the self-attested data in the application and the information obtained from outside data sources. Because Healthplanfinder (HPF) could not identify and manage the conditionally eligible cases, WAHBE had to manually manage these cases. The defined procedure requires WAHBE to initially determine eligibility based upon the applicant’s self-attested data in his or her application and subsequently verify that data through a match with the Federal Data Services Hub. Where there is no relevant data available within the Federal Data Services Hub, or the data is not reasonably compatible with the self-attested data (i.e., within defined parameters), then WAHBE is required to notify the consumer and ask for documentation to resolve the inconsistency.



Cause: The HPF system could not automatically identify and track conditionally eligible cases. WAHBE manually tracked the conditionally eligible cases, but given the volume of such cases WAHBE staff were unable to resolve data inconsistencies for all conditionally eligible cases within the required 90-day period.

Effect: The lack of an automated process to manage conditionally eligible cases and ensure that discrepancies between self-attested data and data provided by external data sources were resolved within the required 90-day period resulted in some cases retaining the eligibility status determined using the original self-attested data, without completing a verification process. Had the verification process been timely completed, some of those cases may have been assigned a different eligibility status. Applicants who were inappropriately provided Advanced Premium Tax Credit (APTC) eligibility beyond the 90-day period will, ultimately, reconcile their actual premium tax credit eligibility through the tax filing process. However, there is no recoupment of benefits for those individuals incorrectly provided Cost Sharing Reduction (CSR) eligibility. Therefore, it is possible that, if WAHBE had completed the verification process for all of the cases as required, some of the cases that received APTC or CSR would ultimately have been determined ineligible for such benefits.

FINDING #2015-002

Criteria: Subpart M(b)(1) – Oversight and Program Integrity Standards for State Exchanges, 45 CFR §155.1200 requires the Exchange, at least annually, provide to HHS a financial statement presented in accordance with U.S. generally accepted accounting principles by April 1 of each year.

Condition: WAHBE has not complied with this reporting deadline.

Cause: The Exchange did not have procedures in place to ensure timely procurement of a qualified independent audit entity and, therefore, the audited financial statement was delayed.

Effect: CMS is not appraised in a timely manner of any potential issues raised in the audit report.



AUDITOR’S OPINION

We have issued an Independent Auditor’s Report on the Schedule of Appropriations and Expenditures for the Year Ended December 31, 2015, reflecting the following type of opinion: N/A

QUALIFIED UNQUALIFIED ADVERSE DISCLAIMER

ADDITIONAL COMMENTS

N/A



III. RECOMMENDATIONS

FINDING #2015-001

We recommend that WAHBE work with the systems integrator to implement, as soon as practical, the code fixes needed to support automated monitoring of the cases for which the inconsistency between self-attested data and data from outside sources, (such as the Federal Data Services Hub), has not been resolved within the required 90-day period. We further recommend that these cases be assigned for resolution by a Customer Service Representative before the 90-day period concludes. In the interim, WAHBE should continue to manage its manual review process to ensure that all cases with inconsistencies identified during the verification process are properly processed within the required 90-day period.

FINDING #2015-002

WAHBE has engaged BerryDunn to complete a financial audit and testing of eligibility and enrollment testing for the 18-month period ended June 30, 2016 and with the completion of those reports WAHBE will be on schedule for the audit reports. We recommend that WAHBE have a qualified audit entity available to perform the independent audit for the year ending June 30, 2017 in time to submit the required audited financial statements by April 1, 2018 and the programmatic audit report by June 1, 2018.

IV. CONCLUSION

We confirm to the best of our knowledge that the information included in this Audit Findings Report is accurate and based on a thorough review of the documentation required for this report.

SIGNATURE OF AUDIT FIRM: _____________________________________ COMPLETION DATE OF AUDIT FINDINGS REPORT: July 29, 2016