Loading...
HomeMy WebLinkAboutF0111 Health Benefits Follow-up PUBLISHED 7-9-25To request this information in an alternate format, please call (541) 330- 4674 or send email to internal.audit@Deschutes.org Health Benefits Audit Follow-up: Improved financial models, yet data security risks persist. July 2025 Our 2024 audit of health benefits raised questions about rising costs, data security, and payment accuracy. Nine months later, the County has made progress by revising financial models but continues to work on performance reporting and procedures. Even after a data mishap led to the inadvertent sharing of personal health records with Deschutes County auditors, management opted not to require contractors to report on their internal controls. Deschutes County Office of the Internal Auditor Page 1 of 4 Audit Follow-up Report: July 2025 Health Benefits Third Party Administrator Recommendation Status Key: Initial finding: Health Benefits Fund reserves were below the level set by County policy. The fund balance fell below contingency reserve policy level minimums in June 2023 and remained at or below the amount throughout Fiscal Year 2024. External financial auditors commented on the “significant decline” in the fund balance when discussing the County’s Fiscal Year 2023 financial statements. In June of 2024 the fund balance was nearing the claims reserve floor set by state law. Recommendation: County Administration, along with Human Resources and Finance, should conduct an after-action review and root cause analysis to document why the Health Benefit Fund fell below the contingency level and steps they could take to prevent it from occurring in the future. Update: Finance provided a root cause analysis in its response to the audit report. Causes mainly aligned with those included in the audit report. Human Resources and Finance met with the County’s Benefit Advisors to revise and recalibrate the forecasting model to better align with current health care industry costs and trends as well as increasing the frequency and timing of these reviews to better align with the County’s budgeting processes. Finance also added a footnote to monthly financial reports about the reserve policy. 1 Resolved 3 In Process 1 Accept Risk Management addressed risk. Auditors will no longer monitor. Recommendations are in progress. Auditors will continue to monitor. Management accepted the risk of not implementing the recommendation. Health benefits financial model recalibrated. Deschutes County Office of the Internal Auditor Page 2 of 4 Audit Follow-up Report: July 2025 Health Benefits Third Party Administrator Initial finding: During this audit, the third-party health benefits administrator accidentally shared sensitive medical information about other clients with Deschutes County auditors. The accident raised questions about how the administrator protected information. The administrator declined to provide more information about what information security controls it had in place, what went wrong to allow it to share data with Deschutes County auditors, how it alerted the organizations whose data was affected, or how it planned to prevent such accidents in the future. To understand how information security controls work, it is standard in the industry for clients, such as Deschutes County, to request service organization control reports from third-party administrators. Recommendation: Human Resources should add a requirement for service organization control reporting to the next health benefits third- party administrator contract. Update: Human Resources decided to rely on the contractor’s certification rather than requesting a Service Organization Controls audit that would outline the third-party administrator's controls. Recommendation: Human Resources should create a policy for reviewing third-party administrator service organization controls reporting including follow-up about any non-functioning controls and documentation of Deschutes County complementary controls. Update: Human Resources will not implement a policy for reviewing third- party administrator controls because they will not be requesting a report. No review of information security controls despite data sharing error. Deschutes County Office of the Internal Auditor Page 3 of 4 Audit Follow-up Report: July 2025 Health Benefits Third Party Administrator Initial finding: The County relied on the third-party health benefits administrator to process claims in a timely and accurate manner and to ensure that claim payments conformed with plan requirements. It is standard in the industry for third-party administrators to report on financial accuracy, payment accuracy, and claim turnaround. Human Resources staff did not request performance reporting from the administrator, and the company did not report it until auditors requested it. Recommendation: Human Resources should add requirements for reporting on payment accuracy, financial accuracy, and timeliness specific to Deschutes County to the next health benefits third-party administrator contract. Reporting should be at least yearly. Update: Human Resources agreed to work with the third-party administrator to begin tracking data in the 2025 plan year and will ensure requirements are added to future contracts. Anticipated completion February 2026. Recommendation: Human Resource should share the report with the Employee Benefits Advisory Committee. Update: Human Resources intends to share performance reporting with the Employee Benefits Advisory Committee at its July 2025 meeting. Initial finding: Payments to the third-party administrator were accurate but documented procedures would increase confidence in future payments. Working to gather reporting on payment accuracy and turnaround time. Developing procedures to ensure third party administrator payments are correct. Deschutes County Office of the Internal Auditor Page 4 of 4 Audit Follow-up Report: July 2025 Health Benefits Third Party Administrator Recommendation: Human Resources should follow through with plans to document procedures related to health benefits payment processing. Procedures should include back-up staff to fill in when primary staff are absent. Update: Human Resources staff were working to document procedures. Staff plan to coordinate with the new Human Resources Director to identify back-up staff when primary staff are absent. Next Steps: We will continue to report on the status of in process audit recommendations in our Global Follow-up Report at the end of each calendar year. Deschutes County Office of the Internal Auditor Audit Follow-up Report: Health Benefits Third Party Administrator The mission of the Office of Internal Audit is to improve the performance of Deschutes County government and to provide accountability to residents. We examine and evaluate the effectiveness, efficiency, and equity of operations through an objective, disciplined, and systematic approach. The Office of Internal Audit: Audit committee: Elizabeth Pape – County Internal Auditor Daryl Parrish, Chair – Public member Phil Anderson – Public member Jodi Burch – Public member Phone: 541-330-4674 Joe Healy – Public member Email: internal.audit@deschutes.org Kristin Toney – Public member Web: www.deschutes.org/auditor Patti Adair, County Commissioner Steve Dennison, County Clerk Lee Randall, Facilities Director If you would like to receive future reports and information from Internal Audit or know someone else who might like to receive our updates, sign up at http://bit.ly/DCInternalAudit.