THE HONORABLE RICHARD J. GRIFFIN
INSPECTOR GENERAL, DEPARTMENT OF VETERANS AFFAIRS
BEFORE THE UNITED STATES HOUSE OF REPRESENTATIVES
COMMITTEE ON VETERANS AFFAIRS
SUBCOMMITTEE ON OVERSIGHT AND INVESTIGATIONS
HEARING ON FRAUD AND MISMANAGEMENT IN VA
SEPTEMBER 23, 1999
Mr. Chairman and Members of the Subcommittee,
today I will present to you the Office of Inspector General’s (OIG)
views on fraud and mismanagement in selected Veterans Affairs (VA)
programs and summaries of the OIG audits and investigations in those
areas. I will focus on
veterans benefits, debt management, and procurement and contracting
activities.
Veterans Benefits
One of three principal missions assigned to my
office by the Inspector General Act of 1978 is the duty to provide
leadership in efforts to prevent and detect fraud and abuse in VA
programs and operations. Recently,
the Under Secretary for Benefits asked us to evaluate vulnerabilities in
the Compensation and Pension (C&P) program that might facilitate
fraud or abuse, particularly fraud committed by VA employees.
The request came about
after two successful criminal investigations of thefts from the C&P
program totaling over $1.2 million.
Two Veterans Benefits Administration (VBA) claims examination
employees, at separate VBA Regional Offices, each embezzled over
$600,000 in unconnected schemes. A brief description of each follows.
In April 1998, a man was arrested in New Jersey
on drug possession charges. The
arresting officers found a fictitious identification card on his person
and records relating to a savings account in the name shown on the
identification card. Our
joint investigation led to the discovery that fraudulent VA disability
compensation benefits were paid into the savings account monthly since
August 1986. At the time the fraud was discovered, the payments were made
at the rate of $5,011 monthly, the maximum VA compensation rate.
The man arrested turned
out to be a former VA employee who had worked as a disability rating
specialist at VBA’s New York Regional Office from January 1986 to May
1987. The former employee was ultimately convicted of having
fraudulently received VA compensation benefits to which he was not
entitled. The scheme was
perpetrated using another person’s Social Security Number (SSN). The
name and date of birth used were not those of the person whose SSN was
used. Therefore, even though technology offers the opportunity and
ability to verify entitlement by computer matching VA claim records with
Department of Defense (DoD) and Social Security Administration (SSA)
records, a totally fictitious identity was successfully used to
perpetrate a fraud.
The fraudulent payments
continued monthly for 12 years, totaling over $620,000.
Based on what we have learned, VA controls and procedures were
not followed. As a result, the fraud was not discovered and could have
continued indefinitely were it not for the perpetrator’s arrest on
drug charges.
In the second case, a supervisor at VA Regional
Office St. Petersburg stole $615,451 by creating a fraudulent disability
compensation award in the name of the employee’s fiancé, a veteran
who had served in the Persian Gulf War.
The fraud began in March 1997 and continued until the
employee’s arrest in January 1999.
After the initial fraudulent payment, the
perpetrator used VBA’s computer system on 10 occasions between March
and October 1997, to retroactively increase the fraudulent payments she
was sending to their bank account.
These actions generated a series of one-time payments totaling
about $520,000, and incrementally increased the recurring benefit
payments to $5,011 monthly. At
the time of her arrest, the perpetrator was a Veterans Service Center
Section Chief, a mid-level managerial position.
We are continuing to investigate related matters.
As a result of the
discovery of these thefts, the Under Secretary for Benefits requested
that my office review internal controls in the C&P program to
determine what vulnerabilities existed that may have facilitated these
frauds. This past June, I provided the Under Secretary our
vulnerability assessment, reporting on 18 observed vulnerabilities in 6
general internal control categories. We then began an initiative to
assess the scope and breadth of vulnerability in selected areas and to
try to determine if there is a systemic problem.
This follow-up activity
will require a substantial amount of time to complete and our efforts to
identify, investigate, and prosecute employee fraud in the C&P
program will continue indefinitely.
Vulnerabilities that Diminish Quality Control
and Facilitate the Ability to Commit Fraud
Separation-of-duty controls intended to
prevent fraud had been abandoned or circumvented.
The objective of separation-of-duty is to prevent fraud by
precluding any one person from having the ability to both authorize and
release payments. With
appropriate separation-of-duty controls in place, complicity of two or
more employees is generally needed to commit a theft, thereby reducing
the opportunity and vulnerability for crime.
As a means to speed up claims processing at VARO
St. Petersburg:
§
Some VBA payment authorizers routinely approved award
actions of peers and subordinates, and released payment, without
actually reviewing the evidence that supported the action or verifying
that the claim was adjudicated in accordance with law.
§
Payment authorization authority, previously reserved to
senior experienced claims examination staff, had been delegated to less
experienced employees. Accordingly,
less experienced employees could trade casework among themselves, rather
than refer the casework to a few senior officials, to obtain payment
authorization. This
practice expanded the overall production capability of the work unit,
but quality assurance was reduced and vulnerability to employee fraud
increased.
At some VBA regions, employees were authorized
duplicative computer command authorities, in violation of VA policy,
apparently to increase overall production capability.
This gave the employees the ability to circumvent
separation-of-duty controls and computer edits to create a benefit
account and approve payment, without the need to refer the case to
another employee for authorization.
Employees with these extraordinary authorities could also create
a fictitious benefit payment account and generate payments, or
fraudulently upgrade the benefit payments of otherwise entitled
beneficiaries, without the knowledge of other VBA employees.
We also found other significant computer access vulnerabilities
that could be exploited to perpetrate a fraud, such as by acquiring and
using the computer access authorities of others to conceal the
perpetrator’s involvement.
Large one-time payments were not always
substantively reviewed before payment was released.
VBA policy required that claims payments exceeding prescribed
amounts ($15,000 for disability compensation payments) be reviewed and
approved by the payment authorizer and the manager of the Adjudication
Division (Adjudication Officer), before payment was released.
We found that such third signature reviews were not always
performed as required or, in some cases, may have been perfunctory.
Additionally, the third review was only a paper review and there
was no computer edit to prevent release of a payment absent the third
review. This was a critical
internal control vulnerability that facilitated the VARO St. Petersburg
fraud.
Another issue relates to failure to control and
secure records regarding employee claims for VA benefits. VBA policy requires that employee claims be adjudicated at
another designated Regional Office, not the Office where the employee
works. Additionally, policy
requires that employee claims records be maintained at the designated
office and held in special secure areas.
We have learned that this policy has not been implemented at all
VBA regions.
Vulnerabilities that Need to be Corrected to
Help Identify Potential Ongoing But As Yet Undetected Fraud Or Abuse
Long running benefit payments need to be reviewed
for continuing entitlement. At
present, running awards of benefits are reviewed only if a claims
examiner or rating specialist establishes a future suspense date
control. For example, a
control might be established for a future medical examination if the
claimant's medical condition is expected to improve, or some other
future event is anticipated. In
most cases, no control exists for future review of static conditions.
Lack of control for
future review creates vulnerability that can facilitate a fraud such as
in the VARO New York embezzlement.
In that case the fraud continued for many years during which time
monthly payments exceeding $5,000 continued.
No control existed that would have triggered a review for
continuing entitlement.
Continued entitlement should also be verified
when mail is returned undeliverable.
The investigation of the VARO New York embezzlement found that
the crime may have been detected years earlier, preventing years of
inappropriate payments, had returned mail been property handled.
In this case, as in most VA benefit cases, payments were
deposited by electronic funds transfer directly to the perpetrator's
bank account. During the
investigation we noted that the VARO was holding returned mail related
to the fraudulent award that dated back several years.
Because the mailing address was that of an abandoned building,
the Postal Service returned the VBA computer generated informational
mail as undeliverable. Employees
at the Regional Office filed the mail without action to determine a
correct address and payments continued until 1998 when the perpetrator
was arrested on the drug charge.
VBA managers have
stated that the volume of returned mail has increased substantially
since the advent of electronic funds transfer, to the point that many
regions have given up on routine attempts to obtain current mailing
addresses on returned mail. This
incident serves as a red flag highlighting the potential consequences of
not acting on returned mail.
Vulnerabilities That
Need To Be Corrected To Improve the Ability to Investigate and Prosecute
Crime
To improve the ability to investigate and
prosecute crime involving the C&P program, we have asked the Under
Secretary to give priority attention to the recording and documentation
issues cited in our assessment, particularly the lack of a comprehensive
audit trail for rating and authorization actions.
As I previously indicated, this documentation shortcoming has
inhibited our investigations, necessitating that we undertake highly
labor-intensive efforts to reconstruct events.
While I find these employee thefts to be a matter
of great concern, there is more at risk from a poor internal control
environment than just vulnerability to employee theft. Poor controls and
mismanagement can lead to extraordinary program losses unrelated to
employee theft. In the last several years, work done by our office in
areas concerning improper payments to Federal and State prisoners,
disability off-sets from military pay, and payments to deceased
beneficiaries have identified opportunities for the Department to save
millions of dollars. Recommendations
related to these issues remain to be fully implemented.
Debt Management Issues
As part of our continuing oversight of the
Veterans Health Administration, the OIG issued five reports over the
last 4 years on medical care cost recovery issues.
Additionally, at the request of the Under Secretary for Health,
we conducted an audit of insurance billing practices at one VA
outpatient clinic. The
issues identified in these reports are recognized by VA top management
as being at high risk, and if not corrected could significantly reduce
future revenue streams and adversely impact the public trust.
Three reports on debt
collection surfaced a recurring issue that demonstrated that VHA could
increase its medical care cost fund collections by tens of millions of
dollars each year. The
audits found that VHA management had not closely monitored or actively
managed the Medical Care Cost Fund (MCCF) billing and collection
process. Additionally, one
of these reports found that management action was needed to correct and
prevent improper billings of VA pensioners and service-connected
veterans.
Two other reports focused on debt establishment,
demonstrating that VHA needed to improve procedures to prevent
unnecessary income verification, ensure compliance with Privacy Act
requirements, and increase MCCF revenues.
Management had not established performance measures and monitors
to effectively oversee and enforce compliance with established debt
management policy, procedures, and laws.
AARP
Billing Practices
In 1999, at the request of the Under Secretary
for Health, the OIG conducted a review of medical insurance billing
practices at VA Outpatient Clinic (OPC), Sepulveda, CA.
The purpose of our review was to determine the validity of
allegations of improper/fraudulent billings to American Association of
Retired Persons (AARP) Health Care Options, administered by the United
Healthcare Insurance Company, and to determine whether there were
opportunities to improve billing practices.
Our review substantiated AARP’s allegation of
improper billing. We did
not substantiate the allegation of fraudulent billings.
We found that VAOPC Sepulveda had agreed to refund over $84,000
or 80 percent of AARP insurance payments made in 1997.
We also found that VAOPC Sepulveda continued to improperly bill
insurance carriers in 1998 for (a) medical services not documented in
medical records, (b) services incorrectly coded, (c) services involving
“upcoded” bills to indicate a higher level of service than actually
provided, and (d) services not covered by insurance.
Improper billing occurred primarily because facility staff were
improperly using and inaccurately coding Patient Care Encounter Forms. Staff were completing Encounter Forms for purposes of
counting workload without considering the impact their entries had on
MCCF billings. We also
believe that improper billing for medical services could occur at other
medical facilities. In
response to our briefing and proposed recommendations VHA management
took immediate action and developed a detailed strategy to correct and
prevent inappropriate billing by VHA facilities.
Procurement
and Contracting Activities
We have devoted
significant resources to detecting and preventing fraud in VA’s
procurement and contracting activities.
As a result of our efforts, the Department has recouped over $130
million dollars since FY 1994. OIG has also recommended $250 million in
cost avoidance. Our efforts in this area have involved issues such as
defective pricing, price reduction and Trade Agreement Act violations on
VA’s Federal Supply Schedule contracts, overcharging, product
substitution, defective products, defective workmanship, non-compliance
with contract terms and conditions, the submission of false claims for
payment, and credit card fraud. Our efforts in the contract area have
also resulted in a steady increase in the number of companies who have
come forward voluntarily to disclose contract problems and make
restitution to the Government.
We are currently
conducting a general review of contracting practices within VA to assess
the impact of procurement reform on the agency’s buying practices. The review involves issues such as local procurements, the
procurement of commercial items, the use of impact cards, local prime
vendor programs, standardization of items, etc.
This completes my
written testimony; I would be pleased to answer any questions the
committee may have.