Loading...
HomeMy WebLinkAbout2324-16 Health Benefits Audit (Final 9-23-24) Audit Report Health Benefits Program: Increasing medical costs require improved oversight To request this information in an alternate format, please call (541) 330-4674 or send email to internal.audit@Deschutes.org Take survey by clicking here Human Resources—Health Benefits—#23/24-16 September 2024 Table of Contents: 1. Introduction ....................................................................................... 1 Background ..................................................................................................................... 2 2. Findings ............................................................................................... 6 Health Benefits Fund reserves were below the level set by County policy .......... 7 Human Resources did not request and review standard data security reporting from PacificSource. ................................................................................................... 12 Human Resources staff did not request standard performance reporting from PacificSource. ............................................................................................................ 14 Payments to PacificSource were accurate but documented procedures would increase confidence in future payments. ............................................................... 15 3. Audit Conclusion ............................................................................. 16 4. Management Response .................................................................. 17 5. Appendix A: Objective, Scope, and Methodology ........................ 21 Objectives and Scope ................................................................................................... 22 Methodology ................................................................................................................. 22 Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor Highlights: Why this audit was performed: Health benefit costs increased by $10 million between Fiscal Years 2021 and 2024. With costs increasing, auditors reviewed how well the County managed the medical health benefit program. We recommended that: County Administration conduct an after-action review regarding the drop in the Health Benefit Fund balance. Human Resources establish oversight of third-party administrator data security and performance. Human Resources document procedures for making payments to the third-party administrator. Increasing medical costs require improved oversight The audit objective was to determine whether Human Resources staff oversaw the medical health benefits program to control costs and ensure that members received the best service. What we found: Though many aspects of the medical health benefits program were functioning well, several key issues emerged: • Funding of the Health Benefits Fund: Reserves were insufficient and fell below the level established by County policy. This shortfall indicated potential financial risk and highlighted the need to ensure the County has sufficient funds to pay claims. • Oversight of Data Security: Human Resources did not request standard data security reports from the third-party administrator, PacificSource. This gap in oversight raised concerns about the protection of sensitive medical information and suggested a need for regular monitoring to safeguard data. • PacificSource Performance Monitoring: Human Resources did not request standard performance reports from PacificSource to assess whether performance met industry benchmarks. The absence of reviews impaired the ability to ensure that PacificSource was achieving optimal performance. • Invoice Payment Procedures: Payments to PacificSource were accurate, but the absence of documented procedures could undermine confidence in future payments. Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor Page 1 of 23 1. Introduction Healthcare costs across the country took off after Covid-19, greatly exceeding the expectations of Deschutes County budget and program managers. Reserve funds dropped below policy guidelines and neared the floor set by state law. Auditors reviewed staff oversight of the contract health plan administrator to determine whether the County could do more to control costs and ensure that plan participants received the best service. There were many areas where staff performed well for example, employees were happy with the plan and staff processed payments quickly and accurately. But there were also opportunities for improvement including: • an after-action review to determine whether there are steps staff can take to reduce chances that contingency reserves drop below policy level, • oversight of contractor data security to protect sensitive health information, • oversight of contractor performance to ensure accuracy and timeliness, and • documented procedures to increase confidence in future County payments to the third-party administrator. Increasing medical costs may be outside of County control, but these practices could help to ensure that the program meets financial and service expectations. The Deschutes County Audit Committee authorized a review of the health benefits program in the Internal Audit Work Plan for Fiscal Years 2024 and 2025. Audit objectives, scope, and methodology can be found in Appendix A. Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor Page 2 of 23 Background Deschutes County operates a self-insured health benefit program. Instead of paying a premium rate per participant to a state-licensed health insurance company, the County sets funds aside and pays for medical procedures itself. Plan members included County employees, their dependents, and other participants, such as retired County employees and dependents. Employees and dependents from Central Oregon Intergovernmental Council and the Black Butte Ranch Service District also participate in the plan. The County spent $19 million on medical claims in Fiscal Year 2024 to cover 3,476 participants. Multiple parties were responsible for aspects of the health benefits program including budgeting, implementation, or both. Human Resources Department • Administered the program. • Oversaw contractors who assisted with program implementation including the third-party administrator, PacificSource, and the benefits consultant, Davidson Benefits Planning. Figure I: Roles within the health benefits program. Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor Page 3 of 23 • Reimbursed the third-party administrator for claim payments. PacifcSource • Contracted by Deschutes County to act as a third-party administrator to manage the health benefits plan. • Provided customer service, processed and paid provider claims, and conducted appeals. Davidson Benefits Planning • Conducted actuarial analysis to support appropriate funding level. • Assisted in benefits plan design. • Provided technical expertise in negotiation with the third- party administrator. Employee Benefits Advisory Committee (EBAC) • Made recommendations to the Board of County Commissioners about the health benefits program. • Included representatives from staff (both union and non), management, administration, retirees, and the Central Oregon Intergovernmental Council which also participates in the program. Finance Department • Developed forecasts and models for funding necessary to pay for claims. • Reported fund balances to the Board of County Commissioners and others. County Administration • Proposed funding for the program through the annual budget process and mid-year budget amendments. Also increased premium rates outside of the budget process during Fiscal Year 2024. Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor Page 4 of 23 Board of County Commissioners • Adopted funding for the program through the budget process and mid-year budget amendments. Budget Committee members also participated in the annual budget approval. • Approved the contract for the third-party administrator. • Approved which benefits were offered through the program. There were more than 260,000 individual claims in calendar years 2022 and 2023. The most common claims were for psychotherapy, low- and mid-level office visits, and massage. Source: PacificSource Claims Data The most expensive claims were for rehabilitation, pembrolizumab (a cancer treatment), a cochlear implant system, and fixed wing air transport. Figure II: Most common medical procedures in 2022 and 2023 by claim count. Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor Page 5 of 23 Source: PacificSource Claims Data Health benefits expenses increased at a faster than historical rate after Fiscal Year 2021. Average year over year increases changed from 3 percent a year between Fiscal Year 2013 and 2021, to 13 percent a year between Fiscal Year 2021 and 2024. Source: County Financial Information System **FY 2024 is not final. Deschutes County was not alone in experiencing this trend. According to the Health Care Cost Institute, health spending grew nearly 22 percent from 2018 to 2022 across Oregon. Growth in spending was driven largely by increases in prices. A review of Deschutes County monthly medical claims from 2022- 2024 reflects that the cost of claims increased faster than the number of claims. Figure III: Most expensive medical procedures in 2022 and 2023 by average claim cost. Figure IV: Health benefit expenses increased faster after Fiscal Year 2021. Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor Page 6 of 23 Source: PacificSource Claims Data 2. Findings In light of increasing costs, the audit objective was to determine whether Human Resources staff oversaw the medical health benefits program to control costs and ensure that members received the best service. Based on our review, several key issues emerged: 1. Funding of the Health Benefits Fund: The County's Health Benefits Fund reserves fell below the level established by County policy. This shortfall indicated potential financial risk and highlighted the need to ensure the County had sufficient funds on hand to pay claims. 2. Oversight of Data Security: Human Resources did not request or review standard data security reports from PacificSource. This gap in oversight raised concerns about the protection of sensitive medical information and suggested a need for regular control monitoring to safeguard member data. Figure V: Average claim costs per month increased faster than the number of claims. Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor Page 7 of 23 3. PacificSource Performance Monitoring: Human Resources did not request or review standard performance reports from PacificSource to assess whether performance met industry benchmarks. The absence of such reviews impaired the ability to ensure that PacificSource was delivering services at an acceptable standard and achieving optimal performance. 4. Invoice Payment Procedures: Human Resources payments to PacificSource were accurate, but the absence of documented procedures for verifying payments could undermine confidence in the payment process. Implementing formal documentation procedures would further ensure that future payments will continue to be accurate and timely. Health Benefits Fund reserves were below the level set by County policy Deschutes County has a responsibility to ensure that it has enough funds available to pay health insurance claims. Oregon law requires organizations that self-insure for health benefits keep a reserve fund set at a level determined by actuarial calculations. If the County has insufficient reserves, it risks losing its authority to self-insure. To ensure that County reserves do not drop below the level required by state law, the County adopted a policy to establish two reserves in the Health Benefits Fund using a valuation of the County’s unpaid claim liability. The policy includes two pieces: • Claims Reserve, a baseline amount intended to comply with state law; and • Contingency Reserve, an amount to cover unanticipated claims and mitigate the risk that claims could be higher than those included in the Claims Reserve. Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor Page 8 of 23 According to the policy, the total level of contingency in the Health Benefits Fund should be, at a minimum, the sum of the Claims Reserve and the Contingency Reserve. It can be higher, but the contingency should not fall below the amount set in policy. The fund balance fell below contingency reserve policy level minimums in June 2023 and remained at or below the amount throughout Fiscal Year 2024. External financial auditors commented on the “significant decline” in the fund balance when discussing the County’s Fiscal Year 2023 financial statements. In June of 2024 the fund balance was nearing the claims reserve floor set by state law. Source: County Financial Information System**June 2024 not final For nearly a decade, the County intentionally held fund revenue, premium charges to departments and employees, steady to decrease the Health Benefit Fund balance. This was due to staff and Budget Committee member opinions that the contingency was too high. At first the fund held relatively steady, but as healthcare costs increased after the Covid-19 pandemic, the fund decreased faster than expected. • In June 2019, the contingency amount was about $16.5 million, two times the required contingency. • In June 2020 the fund decreased slightly: 3 percent. • In June 2021, there were indications of changes to come, Figure VI: Health Benefits Fund balance went below Contingency Level and neared the Claims Reserve. Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor Page 9 of 23 though decision makers didn’t acknowledge them at the time. There was a steep decline in June but gains earlier in the year made up most of the difference. The balance was 4 percent lower than June 2020. Staff described it as one bad year and continued to base forecasting on historic fund performance. The Budget Committee discussed whether there were ways the County could tap into the reserve for other projects, though ultimately did not do so. • In December 2021, staff and Budget Committee members continued to focus on reducing the reserve. Staff projected that the fund would be at about $14 million at the end of Fiscal Year 2022. They anticipated increasing the employer contribution to premium rates by zero to 2 percent in July 2022. • By June 2022 the fund had taken a big hit, dropping 27 percent to just above $11 million, $3 million below the December estimate. However, the drop did not raise alarms high enough for staff to take immediate action. Instead, they proposed recommended increases the following year. Commissioners also had to amend the prior year budget to account for $5 million in unexpected expenses. A commissioner asked whether the trend would continue, and consensus was that it was due to pent-up demand from Covid-19 and not a new trend. • In December 2022, Finance staff acknowledged that premiums were no longer covering claims, though they continued to explain increases as due to Covid-19 and not a new trend. They followed through on the plan they outlined in June and said that they would be recommending an 11 percent increase in the employer charge in June 2023. • In June 2023, the fiscal situation looked worse than the previous year with the fund decreasing by $5 million, 54 percent from the prior year. The fund was at $6 million and below the contingency level set by policy. The Fiscal Year 2024 budget included an 11 percent increase to the employer charge in the original adopted budget. Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor Page 10 of 23 • In July 2023, after the budget was adopted, the County Administration required departments to pay an additional employer premium rate of 18 percent, for a total increase of 29 percent. • In January 2024, the County raised the premium charged to employees. It increased from $90 per month for each employee (regardless of whether family members were enrolled) to $95 for an employee only and $116 for an employee with family members. • Despite these historic increases in revenue, the fund balance remained below contingency levels throughout the first half of 2024 and approached the floor set by state law due to continuing increases in claims costs. There were numerous factors that led to hesitation to increase funding: • Past experience and historical budget forecasting may have delayed a pivot to increased contributions. Historically, the County held too much in reserves and focus was on reducing rather than maintaining or increasing reserves. Past audits of the Health Benefits Fund have noted that reserve levels were too high rather than too low. The County held employer and employee contributions to the fund, steady over most of the decade. • County staff, and their industry advisors, did not anticipate increased costs when healthcare facilities re-opened post Covid-19. Deschutes County claims costs dropped in 2020 when non-essential procedures were put on hold. In June 2021, claim costs increased, but staff believed it was due to accessing delayed care and not a new standard for costs. Claims costs continued to increase, but it wasn’t until May 2023 that staff acknowledged to the Budget Committee that the increases were the new normal. Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor Page 11 of 23 • Timelines for making changes to Health Benefits Fund finance model delayed staff reaction to increasing claim costs. Staff talked about three legs to the stool that supports the Health Benefits Fund: employer contributions, employee contributions, and plan design. Each leg comes with timing restrictions that cause lags in revenue. o Employer contributions made up 92 percent of funding for the Health Benefits Fund in Fiscal Year 2024. The Board of County Commissioners adopts the employer contribution through the budget process. Traditionally, the amount was determined through financial modeling prior to the December mid-year budget meeting and then adopted in June of the next year. Therefore, funding levels for the end of a Fiscal Year, June, would have been determined in December of the prior Fiscal Year, 18 months earlier. o Employees contributed 8 percent of funding, so changes in the employee contribution had less impact on the fund balance. Changes to the employee contribution could only be made when the new plan year began in January. Significant increases could also be subject to union bargaining, which could further delay changes. o Plan design also impacted claims costs and funding needs. State law requires certain minimum coverage, but the County had some options. Plan design includes member costs (co-pays, prescription costs, etc.) and decisions about what to include (pre- approval, including optional procedures, etc.). Plan design changes were also tied the new plan year in January. While recognizing the challenge of forecasting funding in a dynamic and challenging environment, identifying opportunities for improvement is still important. Administration, Human Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor Page 12 of 23 Resources, and Finance made some changes to the process. For example, they • increased the funding model’s expected annual increase to healthcare costs from 5 percent in 2021, to 5.5 percent in June of 2024, and finally to 12 percent in August 2024. • implemented an administrative increase to departments in July 2023 outside of the budget process. Though they made these changes, other staff and management continued to ask whether more could be done to prevent the fund from decreasing below contingency levels. Recommendation 1: County Administration, along with Human Resources and Finance, should conduct an after-action review and root cause analysis to document why the Health Benefit Fund fell below the contingency level and steps they could take to prevent it from occurring in the future. Human Resources did not request and review standard data security reporting from PacificSource. PacificSource held sensitive medical and financial information about members on the plan. Information included member names, diagnoses, procedures performed, and social security numbers. Bad actors are interested in this kind of information and may try to access it to steal funds, file fraudulent claims, or blackmail members. During this audit, PacificSource accidentally shared sensitive medical information about other clients with Deschutes County auditors. The information included social security numbers and personal information about medical procedures for plan participants in more than 4,000 other organizations including the City of Eugene, Oregon State University, and Legacy Health. Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor Page 13 of 23 Though auditors were not bad actors, and the information was deleted as soon as it was discovered, the accident raised questions about how PacificSource protected information. PacificSource declined to provide more information about what information security controls it had in place, what went wrong to allow it to share data with Deschutes County auditors, how it alerted the organizations whose data was affected, or how it planned to prevent such accidents in the future. Organizations design information security controls to prevent people without authorization from getting access to sensitive information. To understand how information security controls work, it is standard in the industry for clients, such as Deschutes County, to request service organization control reports from third-party administrators. Service organization control assessments report on standards developed by the American Institute of Certified Public Accountants and are based on trust service criteria including data security, availability, processing integrity, confidentiality, and privacy. Human Resources staff did not request these reports from PacificSource, and the company did not provide them. In lieu of a service organization controls report, PacificSource provided a HITRUST certification, but the certification did not include an explanation of the control system, how well it performed, or complimentary controls the County should provide. There was no requirement for services organization control reporting in the contract between Deschutes County and PacificSource. Recommendation 2: Human Resources should add a requirement for service organization control reporting to the next health benefits third-party administrator contract. Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor Page 14 of 23 Recommendation 3: Human Resources should create a policy for reviewing third-party administrator service organization controls reporting including follow-up about any non-functioning controls and documentation of Deschutes County complementary controls. Human Resources staff did not request standard performance reporting from PacificSource. The County relied on PacificSource to process claims in a timely and accurate manner and to ensure that claim payments conformed with plan requirements. Though there were no complaints about poor performance during the audit, poor performance could result in late payments to providers, unpredictable accounting, and overpayments. It is standard in the industry for third-party administrators to report on • Financial Accuracy: Total dollars paid correctly divided by the total dollars paid, stated as a percentage. • Payment Accuracy: The number of claims paid correctly divided by the total number of claims, stated as a percentage. • Claim Turnaround: Calculated from the date an original claim is received in the claim administrator's office to the date it is processed. Human Resources staff did not request performance reporting from PacificSource, and the company did not report it until auditors requested it. PacificSource provided aggregate data for all customers. The numbers compared favorably with historical Deschutes County performance, but they were not specific to Deschutes County and did not include payment accuracy. Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor Page 15 of 23 Financial Accuracy Payment Accuracy Turnaround 2004 Audit 98.7% 93.5% 10.9 days 2008 Audit 99.1% 96.6% 9 days PacificSource 99.5% Not provided 9 days Benchmark 99.5% 97% 14 days There was no requirement for performance reporting in the contract between Deschutes County and PacificSource. Recommendation 4: Human Resources should add requirements for reporting on payment accuracy, financial accuracy, and timeliness specific to Deschutes County to the next health benefits third-party administrator contract. Reporting should be at least yearly. Recommendation 5: Human Resource should share the report with the Employee Benefits Advisory Committee. Payments to PacificSource were accurate but documented procedures would increase confidence in future payments. In Fiscal Years 2023 and 2024, the County averaged about $18.7 million in spending on medical claims each year. Staff had to process payments quickly and off-cycle because PacificSource paid providers before reimbursement from the County. The high amount of these payments and the quick turnaround time raised the risk that County staff could overpay or pay invoices late. County policy requires that payments are adequately documented, properly authorized, and accurately accounted for. Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor Page 16 of 23 Claim payments were accurate based on a random sample of payments and invoices, and Human Resources had a process in place for claim payment. But there were no documented procedures for processing invoices. Human Resources could be more confident that payments reflected services provided if there were documented procedures and available to staff assigned to fill in if primary staff were absent. Human Resources staff said they were planning to document procedures. Recommendation 6: Human Resources should follow through with plans to document procedures related to health benefits payment processing. Procedures should include back-up staff to fill in when primary staff are absent. 3. Audit Conclusion Health benefit costs increased by $10 million between Fiscal Years 2021 and 2024. With costs increasing, auditors reviewed how well the County managed the medical health benefit program. Though some aspects of the medical health benefits program were functioning correctly, other areas required improvement. To ensure costs are controlled and enhance service quality, it is essential that County staff address contingency fund levels, establish rigorous oversight of third-party administrator data security and performance, and document procedures for payment processes. Addressing these issues will strengthen the overall management of the health benefits program and help ensure that both financial and service-related objectives are met. Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor Page 17 of 23 4. Management Response Date: September 20, 2024 To: Elizabeth Pape, County Internal Auditor From: County Administration, Finance and Human Resources Re: Response to Audit Report #23/24-16 Health Benefits Program Thank you for your audit and assessment of the County’s health benefits program. Collectively, County Administration, Human Resources, and Finance appreciate your work on this important topic. Below, please find responses to the recommendations included in Audit Report #23/24-16 Health Benefits Program. 1. Recommendation: County Administration, along with Human Resources and Finance, should conduct an after-action review and root cause analysis to document why the Health Benefit Fund fell below the contingency level and steps they could take to prevent it from occurring in the future. a) Management position concerning recommendation: ☒ Concurs b) Comments: County Administration, Human Resources and Finance will conduct an after-action review. The audit report provided a summary of actions taken since 2022 highlighting the oversight of the fund. Through already occurring discussions, memos, and presentations, a review of the root causes revealed the following: • Initially, the healthcare industry saw a buildup of claims and the impact of delayed medical care post pandemic • Medical inflation was higher over the past two years than expected and the cost per claim increased significantly. • It was expected claims and medical inflation would slow over time as pent-up demand eased and the labor market began to ease. Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor Page 18 of 23 • In fact, claims costs continued to increase at a higher-than-expected rate due to medical inflation, higher number than expected mid-range large dollar claims, new specialty drugs becoming available on the market, and higher utilization of specialty medications overall. • The health benefits long-term forecast model increased the expected healthcare costs drivers in the out years, assuming higher costs to the plan. Human Resources, Finance, and Administration have already taken steps to increase the contingency level within the fund prior to this recent audit report being issued. In July 2024, Human Resources updated the Employee Benefits Advisory Committee (EBAC) on the significant increase in the cost of the County’s Health Benefits Plan, as well as the planned increase in premiums for the FY25 budget cycle. Additionally, EBAC was tasked with identifying $2 million in plan design cost containment measures and/or increases to the employees for the 2025 plan year. EBAC will provide a recommendation for the Board of County Commissioners. In August 2024, after the budget was adopted, County Administration implemented an increase in department employer premium rates to pay an additional 15 percent per filled position, for a total increase of 30 percent in FY24. County Administration implemented the same increase in August 2023 when initial significant declines occurred. Overall, department costs per employee increased from the FY24 budgeted rate $1,535 to $2,581 per employee with this change to fully fund the Plan prior to the issuance of this report. To provide greater transparency and accountability on reserve levels within the Health Benefits Fund, a new footnote was added to the monthly financial report presented to the Board of County Commissioners by the Chief Financial Officer. The footnote states, “Deschutes County Administrative Policy No. F-13 sets forth the appropriate level of reserves. The reserve is comprised of two parts: 1) Claims Reserve at 1.5 times the valuation amount, and 2) Contingency Reserve at 150% of the value of the Claims Reserve. The level of reserve is set at $8 million ($3.2 million claim reserve and $4.8 million contingency reserve requirements). The reserve requirement amount should be compared to the Total Fund Balance amount in this report.” In addition to these steps, Human Resources and Finance have met with the County’s Benefit Advisors to revise and recalibrate the forecasting model to better align with Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor Page 19 of 23 current health care industry costs and trends as well as increasing the frequency and timing of these reviews to better align with the County’s budgeting processes. c) The new Health Benefits Reserve Policy footnote was implemented in September 2024 when presenting the August 2024 monthly financial reports to the Board of County Commissioners. The health plan cost containment measures will be effective with the January 1, 2025 plan year. Administration anticipates that the after-action review will be completed by November 2024. 2. Recommendation: Human Resources should add a requirement for service organization control reporting to the next health benefits third-party administrator contract. a) Management position concerning recommendation: ☒ Disagrees b) Comments: PacificSource does not participate in the SOC audit, instead they undergo the HITRUST Alliance's CSF security certification, the state financial audit. PacificSource firmly believes that HITRUST CSF is a significantly more in- depth assessment of their Security program than the AICPA SOC reports. Further, PacificSource states the SOC reports are more attestations of controls, while HITRUST is an evaluation of the controls by a qualified assessor, that is then checked and validated by HITRUST. PacificSource states that HITRUST certification is the healthcare industry standard for protecting healthcare data. In researching the differences between these two security reports, HR agrees HITRUST appears to be a health care industry “gold standard” in protecting healthcare PHI. Additionally, adding SOC reporting will likely increase the cost to the plan. Human Resources, Administration and Finance will make an assessment at the time of the next third-party administrator procurement process about which report to require in future contracts and if a modification from current reporting is needed. The analysis will include an assessment of internal resources required to evaluate reporting and of any potential new costs to the plan. 3. Recommendation: Human Resources should create a policy for reviewing third-party administrator service organization controls reporting including Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor Page 20 of 23 follow-up about any non-functioning controls and documentation of Deschutes County complementary controls. a) Management position concerning recommendation: ☒ Disagrees b) Comments: The creation of a potential new policy or procedure related to service organization controls would be dependent on a decision to add SOC reporting. 4. Recommendation: Human Resources should add requirements for reporting on payment accuracy, financial accuracy, and timeliness specific to Deschutes County to the next health benefits third-party administrator contract. Reporting should be at least yearly. a) Management position concerning recommendation: ☒ Concurs b) Comments: Currently, PacificSource shares some performance measures relative to their book of business, however these reports are not in depth, vary in frequency, and are not specific to Deschutes County claims. PacificSource currently completes the PacificSource Relative Index of Service Measures (PRISM) report. They use these measures internally across their book of business to look at performance not only in commercial lines of business, but also Medicare and Medicaid. HR will work with PacificSource to begin tracking this data in the 2025 plan year and will ensure that these requirements are added to future third-party administrator contracts. c) HR anticipates that reporting will be available by February 2026. 5. Recommendation: Human Resources should share the report with the Employee Benefits Advisory Committee. a) Management position concerning recommendation: ☒ Concurs b) Comments: Human Resources will provide the reports with EBAC at regular intervals. c) HR anticipates that this will be completed by February 2026. PacificSource will begin tracking this data in the 2025 plan year. Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor Page 21 of 23 6. Recommendation: Human Resources should follow through with plans to document procedures related to health benefits payment processing. Procedures should include back-up staff to fill in when primary staff are absent. a) Management position concerning recommendation: ☒ Concurs b) Comments: While Human Resources has documentation for processing general payments, staff have drafted procedures specific to processing health benefits payments. Given the recent retirement and staff restructuring on the Benefits Team, the back-up staff set to fill-in on health benefit payment processing is being cross trained and will be documented in the procedures. c) HR anticipates that this will be completed by October 2024. 5. Appendix A: Objective, Scope, and Methodology The County Internal Auditor was created by the Deschutes County Code as an independent office conducting performance audits to provide information and recommendations for improvement. Audit findings result from incidents of non-compliance with stated procedures and/or departures from prudent operation. The findings are, by nature, subjective. The audit disclosed certain policies, procedures and practices that could be improved. The audit was neither designed nor intended to be a detailed study of every relevant system, procedure, or transaction. Accordingly, the opportunities for improvement presented in the report may not be all-inclusive of areas where improvement may be needed and does not replace efforts needed to design an effective system of internal control. Management has responsibility for the system of internal controls, including monitoring internal controls on an ongoing basis to ensure that any weaknesses or non-compliance are promptly identified and corrected. Internal controls provide reasonable but not absolute assurance that an organization’s goals and objectives will be achieved. Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor Page 22 of 23 Objectives and Scope The overall objective of the audit was to determine whether Human Resources staff oversaw the medical health benefits program to control costs and ensure that members received the best service. Subobjectives included: 1. Determine whether Human Resources overpaid PacificSource. 2. Determine whether Human Resources had adequate oversight to ensure PacificSource performance met industry benchmarks. 3. Determine whether Human Resources had adequate oversight to ensure PacificSource protected medical information. 4. Determine whether the County adequately funded the Health Benefits Fund. The audit was conducted in the Spring and Summer of 2024. Scope depended on the source of data, but generally encompassed Fiscal Years 2022 and 2023. Scope included a review of medical benefits only and excluded pharmacy, vision, and dental. Auditors excluded vision and dental coverage because costs and risks were lower in these areas. Auditors excluded pharmacy because the County recently partnered with a new pharmacy benefits provider. Methodology Audit procedures included: • Interviewing staff and consultants involved in the health benefits program. • Reviewing meeting records to understand decision-making including meeting of the Board of County Commissioners, “Audit objectives” define the goals of the audit. Audit procedures are created to address the audit objectives. Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor Page 23 of 23 the Budget Committee, and the Employee Benefits Advisory Committee. • Reviewing rules, policies, and best practices related to health benefits. • Analyzing PacificSource claims data to identify trends. • Reconciling health benefit invoice payments to back-up documentation. Compared all health benefit payments from the County’s financial information system from July 2022 to June 2024 to invoices. For a sample of invoices, compared invoice back-up documentation submitted by PacificSource to claims data. Results can be extrapolated to the population because a random representative sample was used. • Reviewing performance reporting submitted by PacificSource. • Reviewing information system controls reporting submitted by PacificSource including the HITRUST certificate. • Reviewing Health Benefits Fund data from the County’s financial information system. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. (2018 Revision of Government Auditing Standards, issued by the Comptroller General of the United States.) Human Resources—Health Benefits—#23/24-16 September 2024 Deschutes County Office of the Internal Auditor The mission of the Office of Internal Audit is to improve the performance of Deschutes County government and to provide accountability to residents. We examine and evaluate the effectiveness, efficiency, and equity of operations through an objective, disciplined, and systematic approach. The Office of Internal Audit: Audit committee: Elizabeth Pape – County Internal Auditor Daryl Parrish, Chair - Public member Aaron Kay – Performance Auditor Phil Anderson – Public member Jodi Burch – Public member Phone: 541-330-4674 Joe Healy - Public member Email: internal.audit@deschutes.org Summer Sears – Public member Web: www.deschutes.org/auditor Kristin Toney - Public member Patti Adair, County Commissioner Charles Fadeley, Justice of the Peace Lee Randall, Facilities Director Please take a survey on this report by clicking this link: https://forms.office.com/g/CKmRFz805B Or use this QR Code: If you would like to receive future reports and information from Internal Audit or know someone else who might like to receive our updates, sign up at http://bit.ly/DCInternalAudit.