REPORT DIGEST ILLINOIS HEALTH INFORMATION EXCHANGE AUTHORITY Compliance Examination For the Five Months Ended June 30, 2014 Release Date: June 23, 2015 FINDINGS THIS AUDIT: 21 CATEGORY: NEW -- REPEAT -- TOTAL Category 1: 21 Category 2: 0 Category 3: 0 TOTAL: 21 FINDINGS LAST AUDIT: * * First State Compliance Examination of the Authority Category 1: Findings that are material weaknesses in internal control and/or a qualification on compliance with State laws and regulations (material noncompliance). Category 2: Findings that are significant deficiencies in internal control and noncompliance with State laws and regulations. Category 3: Findings that have no internal control issues but are in noncompliance with State laws and regulations. State of Illinois, Office of the Auditor General WILLIAM G. HOLLAND, AUDITOR GENERAL To obtain a copy of the Report contact: Office of the Auditor General, Iles Park Plaza, 740 E. Ash Street, Springfield, IL 62703 (217) 782-6046 or TTY (888) 261-2887 This Report Digest and Full Report are also available on the worldwide web at www.auditor.illinois.gov INTRODUCTION The Authority was established pursuant to the Illinois Health Information Exchange and Technology Act (20 ILCS 3860). The Authority was established to oversee and operate the Illinois Health Information Exchange and to promote and facilitate the widespread adoption of electronic medical records and participation in health information exchange among health care providers within Illinois and other states. The Authority began operations on February 7, 2014. SYNOPSIS • (14-1) The Authority maintained inaccurate and incomplete financial information. • (14-3) The Authority’s Illinois Health Information Exchange subscriber fees were not accurately assessed. • (14-4) The Authority’s accounts receivable balance was overstated at June 30, 2014 due to recording errors. • (14-6) The Authority had not implemented controls over equipment. • (14-7) The Authority lacked controls over payments to the third party vendor for the development of the Illinois Health Information Exchange. • (14-8) The Authority failed to file with the Office of the Comptroller the original Illinois Health Exchange contract in a timely manner and an amendment to the contract was never filed. • (14-9) The Authority made payroll payments for an individual; however, through an interagency agreement the Department of Healthcare and Family Services was responsible for paying this individual’s payroll costs. • (14-10) The Authority failed to maintain documentation of terminated participants and subscribers of the Illinois Health Information Exchange. FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS INACCURATE FINANCIAL INFORMATION The Illinois Health Information Exchange Authority (Authority) did not maintain accurate and complete financial information. During the examination period, the Authority maintained their expenditure records within a third party accounting software. During the auditors testing, it was noted the expenditures recorded in the accounting software did not reconcile to the expenditure information of the Office of the Comptroller. A difference of $2,482 was noted. In addition, the auditors noted the Authority maintained two separate “books of record” related to receipts collected- an Excel spreadsheet and the third party accounting software. Our review of the two noted significant differences: • The Excel spreadsheet had 19 receipts totaling $2,542,740, which were not properly recorded in the accounting software. The receipts were coded with the incorrect receipt number. As a result, the auditors encountered difficulties in reconciling the Excel spreadsheet to the third party accounting software. • The Excel spreadsheet had 6 receipts totaling $1,136 which were not recorded in the accounting software. In an attempt to balance the Authority’s records with the Office of the Comptroller’s records, the Authority deleted entries from the accounting software. (Finding 1, pages 10 - 11) We recommended the Authority establish one set of financial information and implement controls to ensure the information is accurate and complete. Authority officials agreed with our recommendation and stated they agreed that it maintained two separate “books of record” related to receipts collected- an Excel spreadsheet and a third party accounting software. The Authority also stated they will implement record keeping procedures for all accounts, in order to maintain effective internal control over the record keeping of receipts and expenditures. Lastly, the Authority stated they will modify its Fiscal Policies Manual to reflect these controls and submit the modifications for vote and approval by the Authority Board. INACCURATE FEE ASSESSMENTS The Authority did not accurately assess subscriber fees for the Illinois Health Information Exchange. During testing, the auditors noted the Authority did not properly assess fees to subscribers of the Illinois Health Information Exchange. The Authority was to assess each subscriber an annual fee as outlined in the Illinois Health Information Exchange Direct Messaging Service Agreement (Agreement). Based on sample testing of ten subscriber Agreements and invoices, the auditors noted differences in eight of the subscriber’s invoices. The differences ranged from overbilling by $508 to under-billing by $2,625. (Finding 3, page 14) We recommended the Authority implement controls to ensure subscribers are accurately assessed fees in accordance with the Subscriber Agreement. Additionally, we recommended the Authority return the overbilled amounts and prepare amended billings for the under-billed amounts. Authority officials agreed with our recommendation and stated they have implemented controls to ensure fee schedule modifications are appropriately documented in the Subscriber Agreement. The Authority also stated they will identify and amend FY16 effective Subscriber Agreements to reflect the appropriate fee schedules and commensurate billings. INACCURATE ACCOUNTS RECEIVABLE RECORDS AND REPORTING The Authority did not accurately record and report the Authority’s accounts receivable at June 30, 2014. During sample testing, the auditors noted the accounts receivable recorded for seven of ten (70%) subscribers to the Illinois Health Information Exchange were inaccurate, resulting in an overstatement of accounts receivable of $10,531 at June 30, 2014. In addition, the third and fourth Quarterly Accounts Receivable Reports submitted to the Illinois Office of the Comptroller were not supported by the Authority’s accounts receivable records. As of June 30, 2014, the Authority reported accounts receivables of $38,082. (Finding 4, pages 15-16) We recommended the Authority implement controls to ensure accounts receivable are accurately recorded and reported to the Office of the Comptroller. Authority officials agreed with our recommendation and stated they will implement additional controls to ensure accounts receivable are accurately recorded and reported to the Illinois Office of the Comptroller. The Authority also stated they will modify its Fiscal Policies Manual to reflect these controls and submit the modifications for vote and approval by the Authority Board. LACK OF CONTROLS OVER EQUIPMENT The Authority had not implemented controls over equipment. During testing, the auditors noted: • The Authority did not maintain complete and accurate property control records. The Authority’s records listed 88 items; however, the records did not contain acquisition information and location. Additionally, 12 items did not indicate the property control tag number. • The Authority did not conduct an annual physical inventory of State equipment in their possession and submit required documentation to the Department of Central Management Services Property Control Division. • The Authority did not file the quarterly Agency Report of State Property (C-15) with the Office of the Comptroller for the third and fourth quarter of FY14. • During their testing, the auditors conducted a complete inventory with Authority staff. The inventory noted 171 items. -- 134 of 171 (78%) property items contained property control tags from other State agencies. -- 37 of 171 (22%) items either did not have a property asset tag or did not have a legible property asset tag. -- 14 computer equipment items which were located on the Authority’s listing could not be located during the auditor’s inventory. Due to the Authority’s incomplete and inaccurate property control records, the Schedule of Changes in State Property was not able to be presented in the Supplementary Information for State Compliance Purposes Section of the Report. (Finding 6, pages 19-20) We recommended the Authority maintain complete and accurate property control records. In addition, we recommended the Authority conduct an annual inventory and submit the required reports to the Department of Central Management Services and the Office of the Comptroller. Authority officials agreed with our recommendation and stated they will maintain complete and accurate property control records, including conducting inventory and submitting required reports to the Illinois Department of Central Management Services and the Office of the Comptroller. The Authority also stated they will modify its Fiscal Policies Manual to reflect these controls and submit the modifications for vote and approval by the Authority Board. LACK OF CONTROLS OVER CONTRACT PAYMENTS The Authority lacked controls over payments to the third party vendor for the development of the Illinois Health Information Exchange. During testing, the auditors noted: • All invoices submitted by the vendor were dated August 5, 2014, with services dating from January 1, 2014. • Two invoices, totaling $201,376 included services from January 1, 2014 through February 6, 2014, totaling $66,532, which was prior to the creation of the Authority. • Three invoices, totaling $731,648 stated they were for Change Orders that were dated August 1, 2014 and August 13, 2014. • One invoice, totaling $377,872, was for the percentage of completion for the same service. However, the contract payment schedule was based on the completion of deliverables. • The services described in three of the invoices, totaling $731,648 could not be tied to the original or contract renewal services. • One invoice was not approved by the Authority. (Finding 7, pages 21-22) We recommended the Authority implement controls to ensure payments are made for services the Authority is responsible for and in accordance with the contract. Authority officials agreed with our recommendation and stated they will implement controls and insist upon contractual language to ensure payments are made for services contracted for. The Authority also stated they will modify its Fiscal Policies Manual to reflect these controls and submit the modifications for vote and approval by the Authority Board. The Authority does note that each of the invoices listed above corresponds to documented work actually performed by the third party vendor in furtherance of the Authority’s mission. However, the Authority agrees that contract payment needs to fully align with the Authority’s overall project management framework and future third party vendor contracts. The Authority stated they will implement this change in FY16, in order to fully comply with the auditor’s recommendation. LACK OF CONTROLS OVER CONTRACTS The Authority failed to ensure proper controls had been established in the administration of the Illinois Health Information Exchange contract. During testing, the auditors noted: • The Authority took responsibility for the administration of the contract for the development of the Exchange on February 7, 2014; however, they did not file the contract with the Office of the Comptroller (Comptroller) until August 13, 2014, the same day as the Authority submitted invoices for payment. In addition, the Authority did not file a Late Filing Affidavit. • The Authority filed the contract with the Comptroller on August 13, 2014 for $1.3 million, which was an increase of $507,002 from the contract renewal maximum. In March 2014, the Authority entered into an agreement for the increase which was due to additional services not identified in the original contract. However, the Authority did not file a contract amendment with the Comptroller. (Finding 8, pages 23-24) We recommended the Authority implement controls to ensure contracts are timely filed with the Comptroller, including Late Filing Affidavits. In addition, we recommended the Authority file all contract amendments with the Comptroller. Authority officials agreed with our recommendation and stated they will implement controls to ensure contracts and contract amendments are timely filed with the Comptroller, including Late Filing Affidavits. The Authority also stated they will modify its Fiscal Policies Manual to reflect these controls and submit the modifications for vote and approval by the Authority Board. IMPROPER PAYROLL PAYMENTS The Authority made improper payroll payments. The Authority had entered into an interagency agreement with the Department of Healthcare and Family Services for the transfer of an individual to serve as the Communications Manager/Liaison to the Department of Healthcare and Family Services for the Authority. The interagency agreement stated the Department of Healthcare and Family Services would be responsible for paying the individual’s salary, State-paid contributions for retirement, Social Security, and group insurance contributions. However, the auditors noted the Communications Manager/Liaison payroll was paid by the Authority, totaling $48,190. (Finding 9, page 25) We recommended the Authority work with the Department of Healthcare and Family Services to ensure the Communications Manager/Liaison is paid in accordance with the interagency agreement. Authority officials agreed with our recommendation and stated they will work with the Illinois Department of Healthcare and Family Services to document the Parties’ interpretation and resolution of the assignment of responsibilities pursuant to the Interagency Agreement. FAILURE TO MAINTAIN CONTROLS OVER TERMINATED PARTICIPANTS The Authority did not maintain controls over participants and subscribers of the Illinois Health Information Exchange which had been terminated. As part of their testing, the auditors requested a listing of terminated accounts from the Authority. The Authority stated they were unable to provide an accurate listing of accounts terminated during the examination period. Accounts terminated during the examination period were “deleted” within their accounting software, which resulted in permanent deletion of any historical account record and information. (Finding 10, pages 26-27) We recommended the Authority implement controls to maintain records of subscribers and participants that had been terminated. In addition, we recommended the Authority properly assess fees as outlined in the Subscriber Agreements. Authority officials agreed with our recommendation and stated they have implemented controls to ensure information recorded in its third party vendor software is accurate and complete. The Authority restated it has implemented controls to ensure fee schedule modifications are appropriately documented in the Subscriber Agreement as set forth in its Response to Finding 2014-003. OTHER FINDINGS The remaining findings pertain to: 1) segregation of duties, 2) inaccurate monthly reconciliations, 3) failure to adopt rules related to fees and charges, 4) uncollectible receivables, 5) personnel policies, 6) lack of project management, 7) required information not filed, 8) travel, 9) receipts processing, 10) voucher processing, 11) signature cards, 12) noncompliance with the Illinois Health Information Exchange and Technology Act, and 13) computer security. We will review the Authority’s progress towards the implementation of our recommendations in our next examination. OTHER MATTERS The Authority does not receive appropriations from the General Assembly. The Authority’s strategic direction is dependent upon the Governor’s healthcare technology, coordination, and delivery policies. The Authority is currently collaborating with the Office of the Governor and the Department of Healthcare and Family Services (HFS), in order to solidify the role the Authority will play in those policies. As part of this collaboration, the Authority and HFS are working together for the submission of a federal FY16 funding proposal from the health information technology funding programs of the federal government’s Centers for Medicare and Medicaid Services (CMS). These programs are specifically designed to continue the federal government’s investment in state Health Information Exchanges, such as the Illinois Health Information Exchange. Because the funding proposal is still in development, the Authority is not aware of the amount of a possible award. The Authority has also collaborated with two regional Health Information Organizations on a separate federal funding opportunity to develop specific aspects of healthcare connectivity in Illinois. The Authority and its collaborators submitted an application for this opportunity on April 6, 2015, and the funding award will be announced on or around June 12, 2015. ACCOUNTANT’S OPINION The Independent Accountant’s Report on State Compliance, on Internal Control Over Compliance and on Supplementary Information for State Compliance Purpose contains a scope disclaimer. The Authority did not have complete and accurate records; therefore, the scope of our work was not sufficient to enable us to express, and we do not express, an opinion on the Authority’s compliance with the requirements listed in the Report. WILLIAM G. HOLLAND Auditor General WGH:mkl AUDITORS ASSIGNED This examination was performed by the Office of the Auditor General’s staff.