ARCHIVED - Final Audit Report - Audit of Non-Insured Health Benefits Pharmacy

June 2011

Management Response and Action Plan

Table of Contents

• Executive Summary
• 1. Introduction
  • 1.1 Background
  • 1.2 Objective
  • 1.3 Scope and Approach
  • 1.4 Statement of Assurance
• 2. Findings, Recommendations and Management Responses
  • 2.1 Governance
    • 2.1.1 Roles and Responsibilities
  • 2.2 Risk Management
    • 2.2.1 Risk Profiling
    • 2.2.2 Emergency Management
    • 2.2.3 Prescription Monitoring Program
  • 2.3 Control
    • 2.3.1 Audit Program Framework
    • 2.3.2 Claims Processing
    • 2.3.3 Security
    • 2.3.4 Privacy
  • 2.4 Results and Performance
• 3. Conclusion
• Appendix A - Audit Lines of Enquiry and Audit Criteria
• Appendix B - Non Insured Health Benefit (NIHB) simplified health benefit process

Executive Summary

The Non-Insured Health Benefit (NIHB) Program provides eligible First Nations and Inuit with coverage for a limited range of medically necessary health-related goods and services not provided through private insurance plans, provincial/territorial health or social programs, or other publicly funded programs. This includes pharmacy, dental, vision, medical supplies and equipment, medical transportation, provincial health premiums and other health care benefits. In 2009-2010, $435.1 million was spent on pharmacy, medical supplies and equipment benefits. The First Nations and Inuit Health Branch administers the program and a private sector contractor processes the pharmacy claims on behalf of the Department. Service providers (e.g. pharmacists) deliver pharmacy benefits to clients.

The objective of the audit was to assess the management control framework for administering pharmacy benefits of the NIHB Program (i.e. over the counter and prescription drugs). The audit was conducted by the Audit and Accountability Bureau and sufficient and appropriate procedures were performed and evidence gathered to support the accuracy of the audit conclusion. The audit findings and conclusions are based on a comparison of the conditions that existed as of the date of the audit, against established criteria that were agreed upon with management. Further, the evidence was gathered in accordance with the Internal Auditing Standards for the Government of Canada and the International Standards for the Professional Practice of Internal Auditing.

Historically, the NIHB management team has responded positively to the various internal and external assessments resulting in a management control framework for pharmacy benefits that is sound despite transitioning over the last 18 months to a new contractor for claims processing. There are a number of controls in place to confirm client and service provider eligibility. There are appropriate system security controls as well as privacy procedures in maintaining the confidentiality of the clients' personal information. In addition, there is a documented financial control framework for the claims processing system and reconciliation occurs before approving Claims Processor funding requests under Section 34, of the Financial Administration Act.

While the framework is sound, its operating effectiveness can be further enhanced and the audit highlights five areas where additional action would serve to further strengthen overall management practices. First, while management carries out risk management activities and has an up to date program risk profile, the risk profile would be strengthened by considering access to pharmacy benefits during a community emergency (e.g. evacuation due to flood). There is an up to date disaster recovery and business continuity plan for the claims processing system however it could be more comprehensive by including a description of assets, contact lists and recovery strategies. NIHB business continuity plans should also include participation in the recovery of the claims processing system.

Secondly, the Prescription Monitoring Program, which analyzes the data in the claims processing system to detect provider billing irregularities and client safety issues, could be further expanded to analyze early pharmaceutical refills and prescriptions for stimulants.

Third, in the last year, while the Department transitioned to a new claims processor, there were some challenges. Despite there being a well designed provider audit framework, there were issues with its implementation. NIHB has recognized the problems and has taken positive steps through a formal contract resolution process with the Claims Processor to have the audit framework implemented as intended. As a next step, the NIHB Program should perform a review of the results of various components of the program audit framework quarterly and update the Administrative Procedures Manual as required.

Fourth, as noted, there is a documented financial control framework, however the Department needs to continue to set any debt transferred to Health Canada as receivables in the departmental financial system so that a recovery process can be followed.

Lastly, there is a defined organizational objective for the NIHB Program as well as a performance measurement strategy aligned with Health Canada's Program Activity Architecture but the strategy could be improved by including indicators that show the contribution of pharmacy benefits to the health status of First Nations and Inuit.

Management has agreed with the five recommendations and has developed an action plan which will serve to further strengthen pharmacy benefits of the NIHB Program.

1. Introduction

1.1 Background

The First Nations and Inuit Health Branch manages the NIHB Program. In 2009-2010, the NIHB program provided 831,090 eligible First Nations and Inuit with coverage for a limited range of medically necessary health-related goods and services not provided through private insurance plans, provincial/territorial health or social programs, or other publicly funded programs; the provision of the NIHB program to First Nations and Inuit is rooted in the 1979 Federal Indian Health Policy; the Health Benefit Authority is used as terms and conditions; and parliamentary approval is obtained through annual appropriations acts. The NIHB Program includes pharmacy benefits (i.e. prescription and over the counter drugs) that contribute to optimal health outcomes in a fair, equitable and cost-effective manner, recognizing the unique health needs of First Nations and Inuit clients.

Pharmacy, medical supplies and equipment benefits represent forty-two percent of NIHB benefit expenditures and ten percent of Health Canada's total expenditures. Sixty-four percent of the eligible population received at least one pharmacy, medical supplies or equipment benefit and this utilization rate has remained stable for the past five years. The First Nations and Inuit population has a growth rate that is almost twice that of the Canadian population primarily due to a higher birth rate; amendments to legislation have also resulted in greater numbers of eligible clients. NIHB anticipates that the costs of pharmacy benefits will increase significantly in the coming years.

The NIHB group is responsible for overall program administration. In 2009-10, administration and claims processing contract costs were $62.4 million for all NIHB benefits; administrative costs were six percent of expenditures. The responsibility for processing pharmacy claims is the responsibility of a third party. The current contract has been in operation since December 2009, after a one year transition phase from the previous claims processing contract. From December 2008 to November 2009, the new Claims Processor was developing its processes, tools and testing its operational readiness; during that time, the previous Claims Processor was fully operational. In December 2009, the new Claims Processor began operations for processing claims and the administration of the audit program framework. The Claims Processor uses the Health Insured Claims Processing System (HICPS) to process claims from service providers dispensing pharmacy benefits to eligible clients.

A 2008 Health Canada internal audit of the system did not find any major problems with accuracy and completeness of data and the control environment. However, there were risks for unauthorized access to the application or the database which were re-examined and found to be acceptable.

The Chief Financial Officer Branch works with NIHB to establish the program financial control framework in support of management practices. There are also pharmacists in the Regions and Programs Branch--hereafter referred to as regional pharmacist--responsible for liaison with service providers and who provide regional and technical guidance for the NIHB program. Client eligibility is based on treaty or status numbers issued by Indian and Northern Affairs Canada for First Nations or an Inuk recognized by one of the Inuit Land Claim organizations.

1.2 Objective

The objective of the audit was to assess the management control framework for administering pharmacy benefits of the

NIHB

Program (i.e. over the counter and prescription drugs).

1.3 Scope and Approach

The audit examined governance, risk management practices, controls, results and performance. The lines of enquiry and audit criteria were derived using Treasury Board of Canada Secretariat's Core Management Controls: A Guide for Internal Auditors (See Appendix A). Examination included document reviews, interviews and field work with the Claims Processor responsible for administration of the HICPS. HICPS data for claims settled between January 1, 2010 and June 30, 2010 were examined. A sub-set of data was analyzed with all claims with the status "paid" (at time of extraction) that were submitted through the network claim method at the point of sale. Data analysis software was used to summarize and analyze data to identify areas of interest.

The audit was conducted primarily in the National Capital Region and on location at the Claims Processor. Regional pharmacists were contacted throughout the course of the audit, as well as financial officers in the Chief Financial Officer Branch. The audit examined the first year of operations with the Claims Processor, from December 2009 to the end of the examination period March 4, 2011. In addition, the audit reviewed the implementation phase of the new contract and data from the previous contract, as required.

The audit did not examine medical supplies and equipment, since they have a separate management framework and service delivery model. The audit did not include the integrity of the data in HICPS as it was already audited in 2008.

1.4 Statement of Assurance

In the professional judgement of the Chief Audit Executive, sufficient and appropriate procedures were performed and evidence gathered to support the accuracy of the audit conclusion. The audit findings and conclusion are based on a comparison of the conditions that existed as of the date of the audit, against established criteria that were agreed upon with management. Further, the evidence was gathered in accordance with the Internal Auditing Standards for the Government of Canada and the International Standards for the Professional Practice of Internal Auditing.

2. Findings, Recommendations and Management Responses

2.1 Governance

Audit Criterion: Active committees are in place to provide strategic oversight.

There are numerous committees and processes which form the governance structure to provide oversight on the NIHB - pharmacy program. The external governing environment includes committees, processes and independent advisory bodies. For example, NIHB relies on the Common Drug Review process, used by most of the public pharmacy benefit plans in Canada. The process provides guidance and recommendations for drug listings, based on clinical evidences, the therapeutic value of the medication and cost-effectiveness. NIHB uses and supports independent advisory expert committees such has the Drug Evaluation Advisory Committee and the Federal Pharmacy and Therapeutics Committee for advice on criteria for limited use or exception drugs, client safety control measures and prescription drug abuse. NIHB participates in external committees such as those of the Canadian Agency for Drug and Technologies in Health, as well as the joint committees of the Canadian Institute for Health Information and Patented Medicine Price Review Board.

NIHB's internal governance structure is comprised of management and coordination committees for pharmacy benefits. This includes: the NIHB Director's Committee; the NIHB Management Committee; the Regional Managers Forum; the Risk Management Committee; the Payment Requisition Committee; the Pharmacy Forum and Group and the advisory committees of the Prescription Monitoring Program.

Finally, NIHB has a number of joint committees with the Claims Processor for on-going coordination at the strategic, management and operational levels. There is also a Performance Incentive Fee Committee for the Claims Processor contract.

In summary, NIHB's environment is comprised of a number of external and independent committees, as well as an internal governance structure that are working as intended for pharmacy benefits.

2.1.1 Roles and Responsibilities

Audit Criterion: Roles and responsibilities are clearly defined.

Interviews with key personnel and a review of key documents demonstrated that roles and responsibilities for the NIHB program are clearly defined and communicated. (See Appendix B) Health Canada provides a range of health benefits to First Nations and Inuit clients, which includes pharmacy as a category of benefits. Claims processing and the registration of service providers who dispense pharmacy benefits to clients are carried out by a contractor.

Roles and responsibilities within NIHB are also up-to-date and reflect the responsibilities for pharmacy benefits. The majority of the administration of pharmacy benefits is carried out by NIHB officers at headquarters in Ottawa - such as the pharmacy policy framework, client safety initiatives, prior approval for specific drugs through the Drug Exception Centre, Claims Processor contracting and billing, data monitoring, and joint management with the Claims Processor for the audit framework.

The role and responsibility of the regional pharmacist is to liaise with service providers in the region and to provide regional and technical guidance for the NIHB program. Each region has a pharmacist in this role and it is working well in supporting the program.

2.2 Risk Management

Audit Criterion: Risks are identified, assessed and mitigating strategies are in place.

2.2.1 Risk Profiling

There is an up-to-date risk profile for the NIHB program which includes all benefits. Some pharmacy risk management activities are presented in client safety reports; for example, the report includes a description of warning and rejection messages to pharmacists regarding drug interactions, repeat prescriptions and client drug therapy history; trend analysis of prescription drugs use; and highlights of achievements of the independent expert advisory committee. Other pharmacy risks related to finance (Claims Processor and program level), transactions, billing and client safety are managed through a number of committees.

Pharmacy benefits are delivered to clients by service providers such as local or larger scale pharmacy operations. The program risk profile includes the risk that service providers are not available under routine conditions, like serving isolated locations. Should service delivery be interrupted due to local continuity events (e.g. fire) or wider community emergencies (e.g. flood), there should be a back up plan. The program risk profile should be expanded to include client access in the event of emergencies. Including the risk of service provider unavailability in emergency situations in the NIHB risk profile will provide an opportunity to take stock of existing mitigation strategies and to determine if additional ones are required. (See recommendation 1)

2.2.2 Emergency Management

In the event of an emergency, disaster recovery and business continuity plans are important risk management practices for the health and safety of First Nations and Inuit. NIHB has business continuity plans for twenty-six critical services, all plans were signed by responsible directors since June 2010 and there was a Branch "table top" exercise.

A review of plans for five pharmacy critical services noted incomplete information on assets, contact lists and recovery strategies. The business continuity plan for the Drug Exception Centre--responsible for prior approval of pharmacy benefits--presents a reasonable amount of detail in that it includes use of a power generator and manual processing tools in case of system unavailability. However, the plan for the Drug Exception Centre could be improved by updating references to the previous Claims Processor and completing existing information such as "a generator which can support operations X% in the event of a power outage during regular business hours...the following can be connected to the generator within X minutes/hours and sustained for up to X hours/day [...]". Lastly, the business continuity plan for liaison with stakeholders did not include the relevant contact information; the plan for the provision of pharmacy advice within NIHB was lacking a description of the assets required to continue work with remote access, like a list of employees with telework arrangements.

The Claims Processor has current business continuity and disaster recovery plans for the claims system and relies on NIHB to participate in the activation and implementation of the plans. Therefore, NIHB is an external dependency and should have recovery strategies to support the Claims Processor should both organizations need to activate the plans at the same time. NIHB's business continuity plans should include recovery strategies to support the Claims Processor.

The disaster recovery and business continuity plans for the Claims Processor and NIHB present varying interpretations of the impact on the Drug Exception Centre should it become unavailable. The Claims Processor states there is a possibility service providers may refuse to dispense pharmacy benefits without prior approval, whereas NIHB expects service providers to use their authority to "emergency dispense." There is an opportunity for greater integration of the disaster recovery and business continuity plans of NIHB and the Claims Processor.

Recommendation 1

It is recommended that the Assistant Deputy Minister, First Nations and Inuit Health Branch update the NIHB risk profile, business continuity plans and recovery strategies and integrate these with the Disaster Recovery Plan for the Health Information Claim Processing System.

Management Response

2.2.3 Prescription Monitoring Program

There is a wealth of claims processing data that can be used for profiling prescription risks and for development of mitigation strategies. For example, in 2009-10 there were over 15.9 million claim lines in the system available for analysis by the NIHB Prescription Monitoring Program. This program monitors drugs which may be abused and it monitors clients' use of multiple service providers and/or prescribers. A high risk score brings clients to the attention of the Health Canada pharmacist as worthy of further clinical evaluation. Following evaluation, if there remains a safety concern, the client is entered into the monitoring program. Currently, the monitoring program is available in Alberta and in the Atlantic regions and management reports that it is expected to be expanded into a national program in 2011.

The audit team undertook its own six month analysis of the claims settled between January 1, 2010 and June 30, 2010. The purpose of the analysis was to look for patterns in the data for all drugs, not just those of abuse and included data across Canada to demonstrate that by "casting the data net wider" the NIHB program may be able to flag more outliers warranting further evaluation. More specifically, the audit team's analysis showed instances of clients using up to 22 service providers and 34 prescribers over a six month period for drugs. The analysis identified three cases of concern that would not have been identified by NIHB's monitoring program; they were use of stimulants, non-narcotic pain medications and cardiac drugs. NIHB reports that each case will be placed in the prescription monitoring program.

NIHB conducted a preliminary analysis of early refills completed in 2010 and noted there were 90,196 early refills (less than one percent of total claims), and in 11,789 cases the reason listed for early refills was "item lost." Technically, as long as clients have a valid prescription and provides a reason for the early refill, service providers can authorize based on professional judgement.

There is a need for ongoing monitoring of data to assess the effectiveness controls in preventing use of multiple service providers for early refills. Currently the controls need to be strengthened in order to flag overlapping consumption periods. There is an NIHB control related to early refills on a specific category of opioids which requires prior approval where a police report is required. The audit team's data analysis provides NIHB with the opportunity to expand their existing surveillance activities which may impact current policy, practices and provider audits.

Recommendation 2

It is recommended that the Assistant Deputy Minister, First Nations and Inuit Health Branch enhance NIHB data monitoring and analysis to include such items as stimulants and early refills.

Management Response

2.3 Control

Audit Criterion: There is an appropriate and effective suite of controls in place for over the counter and prescription drugs.

Over the years, NIHB has put in place a suite of controls designed to prevent, minimize and detect errors, irregularities, misuse or abuse of program funds (see text box below). These controls, their governance and integration with other program management functions, form the basis of the management control framework for the pharmacy program.

The Claims Processing System Financial Control Framework defines the roles, responsibilities, key procedures and standards related to HICPS and payment processes. Its two main objectives are: to ensure due diligence and sound management by all parties involved in the claims processing system and to support the implementation, maintenance and monitoring of an effective, transparent, consistent and balanced suite of controls.

2.3.1 Audit Program Framework

Audit Criterion: A program audit framework is implemented to meet NIHB Pharmacy operational objectives.

There is a strong program audit framework which includes provider profiling, client confirmation letters, next day claims verification, desk and on-site provider audits. The framework was assessed as "robust" by the Office of the Auditor General in the 2004 Audit of Federal Drug Benefit Programs. The purpose of the program audit framework is to: prevent and detect inappropriate billing practices; validate active licensure of registered service providers; detect billing irregularities; confirm paid services were received by NIHB program clients; and ensure that service providers have retained appropriate documentation to support submitted claims. Overall, the program audit framework reviews claims submission and financial transactions with service providers for compliance with NIHB Program requirements. The audit program framework is documented in an Administrative Procedures Manual.

Transition to the new Claims Processor was managed to minimize impact on clients and service providers through a transition plan and project risk profile. From December 2008 to November 2009, the new Claims Processor was developing its processes, tools and testing its operational readiness; during that time, the previous Claims Processor was fully operational. In December 2009, the new Claims Processor began operations for processing claims and the administration of the audit program framework. While most of the transition was a success--including processing claims--there were challenges in the implementation of the audit program framework. A contract resolution process is underway and has had positive results for most of the provider audit framework components. The contract also includes a performance incentive fee and partial payments were awarded to the Claims Processor on criteria related to the program audit framework. The next sections of the report address how the program audit framework is being implemented and the challenges experienced in the first year of operations.

Planning and Oversight

The plan for the program audit framework is comprised of defined criteria for next day claims verification, client confirmation letters and provider profiling, as well as the selection of service providers for desk and on-site audits. It is important that the components of the audit framework are implemented as they build on each other for optimized outcome. For example, negative findings in a desk audit are considered when selecting service providers for on-site audits. Criteria should be examined periodically to ensure they generate intended results and remain current with NIHB Program risks.

Three committees provide oversight for the provider audit framework. The Audit Review Committee--a joint NIHB and Claims Processor committee--assesses the audit framework to ensure criteria for next day claims verification, client confirmation and provider profiling are risk-based and reviews the result of desk and on-site audits. The Audit Review Committee should be meeting quarterly, but has only met once since December 2009. The mandate of the NIHB Risk Management Committee is to develop an accountability framework to manage the risk of inappropriate billing to the program for pharmacy and other benefits. The Risk Management Committee includes members from NIHB, legal services, AAB and Regions and Programs Branch--except Québec and North--and was inactive for nine months; it has resumed quarterly meetings, having convened twice since September 2010. The NIHB Payment Requisition Committee includes members from NIHB and the Chief Financial Officer Branch and is responsible for providing guidance on audits; it is meeting as required.

Next Day Claim Verification and Client Confirmation Letters

Next day claims verification uses risk-based criteria to draw a daily sample of claims submitted by service providers for verification of supporting documentation (e.g. prescriptions). Claims without supporting documentation are reversed. Service providers with ongoing claims problems are monitored monthly for a period of three months and may be referred for desk or on-site audits. There was an issue with the number of service providers to include in monthly monitoring of next day claims verification, which has been resolved through the contract resolution process.

Confirmation letters are sent to clients to verify that pharmacy benefits claimed were dispensed. The Claims Processor follows-up on negative responses. Sampling is random and could be supplemented with targetted risks (e.g. high dollar claims and service providers not subject of other audits) to better detect irregularities. Client confirmation letters have assisted in the detection of questionable transactions which lead to the discovery of fraudulent service providers in the past. However, there are no current results of client confirmation letters as they were suspended between May 2010 and January 2011 due to format and content errors. Operations have since resumed and the backlog has been cleared.

There has been an increase in recoveries for next day claims verification and client confirmation letters: from $556,869 in 2008-09 to $846,074 in 2009-10. The NIHB program should closely monitor the results of recent adjustment to next day claims verification and client confirmation letters to evaluate their contribution to the overall goal of the program audit framework.

Provider Profiling

Provider profiling is a data analysis tool that reviews HICPS data for anomalous billing patterns with risk-based criteria. Profiling results are presented to NIHB quarterly. NIHB and the Claims Processor have been working together to improve profiling criteria.

The Claims Processor combines the results of profiling and next day claims verification, current and past audits, client confirmation letters, referrals, tips and complaints to develop bi-annual recommendations of service providers for desk and on-site audits. NIHB recently provided training to the Claims Processor on a reporting tool which can generate additional analysis for consideration in the selection of service providers to audit. Claims Processor recommendations are reviewed by NIHB officers and regional pharmacists bilaterally. The Administrative Procedures Manual calls for the participation of Provider Review Committees and the Audit Review Committee in provider profiling and selection of service providers to audit, however this process has not been implemented.

Desk and On-Site Audits

Desk audits verify a targeted sample of paid claims for compliance with NIHB Program requirements. The purpose of on-site audits is to validate active service provider licensure, detect billing irregularities, confirm paid services are received by clients and ensure appropriate claims documentation is retained. If significant anomalies are identified (e.g. lack of supporting documentation) a more thorough on-site audit may be conducted. Regional pharmacists may participate in on-site audits and the Claims Processor considers their participation as useful due to their knowledge of the provincial requirements and local pharmacy community.

With the transition in Claims Processors, there have been delays in the completion of desk and on-site audits and a decrease in the total amount of recoveries. From December 2009 to March 2010, 48.1 percent of the final audit reports were late; from April 2010 to September 2010, 76.2 percent. In 2008-09, 103 audits were completed by the previous Claims Processor with recoveries of $1,066,922. In 2009-2010, 84 desk and on-site audits were completed by both the previous and current Claims Processors with recoveries of $1,375,135. Of those overall results, the current Claims Processor has completed 46 desk and on-site audits with recoveries of $286,192 since December 2009. NIHB and the Claims Processor are taking steps to clear the backlog of late reports and to deal with systemic causes of delays.

Audit Quality Assurance

There are quality assurance processes for desk and on-site audits with clear roles and responsibilities for NIHB and the Claims Processor. This includes a claims processor checklist with a list of items reviewed, the reviewer and quality assurance approver. An assessment of completed checklists indicated a focus on checking boxes and a missed opportunity to identify required changes in such areas as audit reports, auditor training, policies and practices. There are Provider Review Committees for each desk and on-site audit, to discuss audit findings, review and approve audit reports and letters to service providers. Meetings include representatives from the Claims Processor, NIHB and the Regions and Programs Branch personnel. There are no terms of reference for the Provider Review Committee despite this being a requirement in the Administrative Procedures Manual.

NIHB has identified the need for improved quality assurance prior to audits being tabled at Provider Review Committees and has temporarily devoted resources to quality assurance. A review of provider review committee minutes confirmed a focus on individual findings and inadequate direction on interpretation of findings for subsequent audits. The Claims Processor has acknowledged these issues and taken corrective actions including training, the addition of a pharmacist to the quality assurance team and draft desktop procedures. Provider review committees generate a wealth of useful information related to questionable service provider practices, and there is a need to summarize these lessons learned for the consideration of the Claims Processor and Department.

Implementation of the Audit Program Framework

As a result of the audit program framework, 10 service providers have been delisted since 2007, 10 service providers were refused registration with the new Claims Processor in 2009 and there have been no de-listings in 2009-10. In addition to de-listings, NIHB has referred cases of suspected misuse of program funds to the Audit and Accountability Bureau for investigation on a case by case basis. Recent forensic audits indicate significant problems have been occurring for years and it is unclear why they were not detected earlier by the audit program framework. There is an opportunity for increased early communication of suspect service providers by the Claims Processor to NIHB and the Audit and Accountability Bureau.

While the the audit program framework is well designed it is unfortunate that there have been problems with the implementation of the framework during the transition to the new Claims Processor. Through the formal contract resolution process, a majority of problems have been resolved and a few remain outstanding such as clearing the backlog of desk and on-site audits and improving quality assurance. It is important that all components are working together for the whole audit program framework to prevent and detect inappropriate billing practices. A regular review of the results of the audit program framework will help validate that the various components are working as intended. In addition, trends and risk in service provider practices can be identified for adjustments to audit program framework criteria and practices as required.

Recommendation 3

It is recommended that the Assistant Deputy Minister, First Nations and Inuit Health Branch direct the NIHB Program to review the results of the program audit framework quarterly to ensure timely attention is given to issues noted.

Management Response

2.3.2 Claims Processing

Over 12 million claims are submitted by service providers for pharmacy benefits, 99 percent of which are electronically entered in HICPS. The Claims Processor summarises the claims processed and submits a request to NHIB for funding twice a month. NHIB verifies and reconciles the request and forwards to the Chief Financial Officer Branch who ensures the payment is a lawful charge against an appropriation and processes the invoice for payment.

HICPS is used to review the funding requests from the Claims Processor in accordance with its clients' eligibility and pricing policies. With the exception of manually selecting the start and end date for a typical fifteen day billing cycle, this is an automated process that is efficient and effectively managed. The evidences reviewed indicate that all funding requests from the Claims Processor are reconciled before payment is approved under Section 34, of the Financial Administration Act. A total of 28 invoices were reconciled from the start of the new contract from December 16, 2009, to January 31, 2011. It covered expenditures related to pharmacy benefits of $686,952,000; the average invoice was $24,534,000.

When NIHB transferred to the new Claims Processor, there was a debt transfer of $487,919.07 from the previous contractor. This debt relates to two NIHB programs - the next day claims verification program which had a receivable of $148,247.72 and the on-site audit program which triggered receivables of $331,454.06. NIHB reports that all outstanding debts incurred by the previous contractor were reviewed and actions were taken to identify which would receive "assignment of right" to the Department or be transferred to the new contractor for collection. In that regard, in the past NIHB has written off some of the debt in conjunction with the Chief Financial Officer Branch and the contractor has put in place processes to collect through the use of a "withhold" of future payments until the receivable is exhausted and settlement plans. Currently, there is $110,886.34 still under recovery. Given next day claim verification and on site audits continue to trigger receivables; it is important that NIHB continue to closely monitor the debt recovery process.

Recommendation 4

It is recommended that the Assistant Deputy Minister, First Nations and Inuit Health Branch work with the Assistant Deputy Minister, Chief Financial Officer Branch to set any debt transferred to Health Canada as receivables in the departmental financial system so that a recovery process can be followed.

Management Response

2.3.3 Security

Audit Criterion: There are system and process controls for security and privacy of information.

The Claims Processor contract requires that sensitive information regarding clients is secure. The security requirements contained in the contract, the security requirements check list attached to the contract and the Public Works and Government Services Canada Industrial Security Manual must be adhered to by the Claims Processor and its sub-contractors.

The administration of users' access rights for HICPS is well defined and executed. There are appropriate controls in place so that only required users have access to the system with adequate authorization and authentication in accordance with time and corresponding functions or assigned tasks. HICPS users' roles and responsibilities have been appropriately reviewed and revised by the security officer and management. There are controls in place via the periodic review process, automatic terminated date for contract personnel using the system and automated suspending for these dormant accounts. There is a "no-sharing of accounts" configuration/policy and account uniqueness which provide good mechanisms to protect the system and its data and also for enforcing HICPS access information's policy.

HICPS is designed and administered with defined controls in place to assure that only authorized personnel have administrator rights in the system. This includes strict password rules and/or two-factor authentication processes. In addition, the system has enhanced data protection and security with relation to safeguarding client information. There are vigorous logging, monitoring and alerting processes in all layers of the system. Operating systems, applications and the database have been reviewed, reacted to and reported daily/monthly as appropriate.

2.3.4 Privacy

The Department and the Claims Processor are compliant with privacy procedures in maintaining the confidentiality of the clients' personal information while administering the pharmacy program. In order to process pharmacy benefits, the NIHB Program collects, uses, discloses and retains clients' personal information, and is required to do so in accordance with the applicable federal laws and policies. NIHB has developed a Privacy Code with the objective to "set out the NIHB Program's commitments that will ensure responsible and secure handling of personal information collected, used, disclosed and retained for program delivery, administration and management; and to foster transparency, accountability and increased awareness of the NIHB Program's privacy procedures and practices. The Claims Processor also has developed administrative procedures associated with the protection of privacy. As a Program of the federal government, NIHB must comply with the Privacy Act, the Canadian Charter of Rights and Freedoms, the Access to Information Act, as well as Treasury Board of Canada Secretariat privacy and data protection policies including the Privacy Impact Assessment Policy.

During 2009/2010, NIHB updated its Privacy Impact Assessment on HICPS. In addition, an Information Sharing Agreement with Indian and Northern Affairs Canada was approved as of August 2009 to deal with the authority and the roles and responsibilities of each party when handling personal information.

Client information goes through several steps in the systems lifecycle, thus the placement of controls is segmented for claims processing and access is functionally limited. For example, only specific employees of Health Canada and the Claims Processor have access to HICPS. The service providers, however, do not have access to the clients' personal data base but, nevertheless, must confirm to the privacy codes of their own regulatory or licensing boards. Privacy policies are actively enforced at the front-end rather than at each stage of the information lifecycle in accordance with applicable federal laws and policies. As well, Health Canada has put in place continual privacy training mechanisms to reduce the risk of non compliance and is about to launch its required annual privacy audit.

2.4 Results and Performance

Audit Criterion: Management identifies, monitors and reports on performance measures linked to organizational objectives and planned results.

The organizational objective of NIHB is to provide benefits to clients that: are appropriate to their unique health needs; contribute to the achievement of an overall health status for First Nations and Inuit people that is comparable to that of the Canadian population as a whole; are sustainable from a fiscal and benefit management perspective; and facilitate First Nations/Inuit control at a time and pace of their choosing. There is a performance measurement strategy aligned with Health Canada's Program Activity Architecture for all NIHB benefits. The strategy includes annual indicators for immediate and intermediate outcomes. For example the immediate outcome of the NIHB being managed in a cost-effective and sustainable manner is measured annually by a comparison with other plans of benefit expenditures, annual growth percentage and ratio of administrative and benefit costs. The long term outcome of improving the health status of First Nations and Inuit is measured by the number of clients and access to benefits; NIHB's performance measurement strategy is missing health indicators. This could include indicators such as a comparison of life expectancy of First Nations, Inuit and other Canadians. There are also NIHB indicators in a draft dashboard for the Deputy Minister, which combine pharmacy benefits with medical supplies and equipment.

NIHB reports on pharmacy-specific topics in the client safety reports and there are numerous operational reports from the Claims Processor. The annual NIHB report provides extensive and current trends related to the client population, program and regional expenditures, pharmacy benefit utilization and initiatives like the program audit framework and the drug review process. The report combines pharmacy benefits (i.e. prescription and over the counter drugs) and medical supplies and equipment, when they are in fact managed separately. It is therefore difficult to obtain a clear picture of pharmacy benefits. In addition to performance indicators and reports, it is important to have feedback mechanisms supporting operational and strategic decision-making. NIHB receives some operational feedback through a three-level drug appeals process and an incident management system with the Claims Processor. NIHB is lacking indicators related to service providers and currently relies on its governance structure to bring operational feedback at the strategic level.

In summary, there is a performance management strategy linked to the organizational objective and it would be strengthened by including health indicators to show the contribution of pharmacy benefits to the long term organizational objectives.

Recommendation 5

It is recommended that the Assistant Deputy Minister, First Nations and Inuit Health Branch develop health indicators to demonstrate the contribution pharmacy benefits make to the long term organizational objectives.

Management Response

3. Conclusion

The current governance framework for pharmacy benefits provides good senior management oversight and consideration of expert recommendations for drug listings. Roles and responsibilities are also clear.

Pharmacy risks are managed through a variety of committees and there is an up to date NIHB Program risk profile. The NIHB Program risk profile will be strengthened with a consideration of access to pharmacy benefits in community emergencies. There are up to date disaster recovery and business continuity plans for HICPS and NIHB; however, NIHB plans could be more comprehensive and include participation in HICPS recovery. HICPS data analysis for provider billing irregularities and client safety should be expanded to include early refills and stimulants.

There are controls in place for the delivery of pharmacy benefits: confirmation of client and service provider eligibility; financial controls for HICPS; and payment reconciliation for the Claims Processor payment. There is a well-designed program audit framework in place; however there have been issues with implementation since the transition to the new Claims Processor in December 2009. Work is underway to resolve the issues and the provider audit framework will be further strengthened by a regular assessment of its results to address issues noted. Debts transferred to Health Canada should continue to be entered in the departmental financial system as accounts receivable. There are appropriate HICPS controls and privacy procedures for confidentiality of client information.

The NIHB Program has a defined organizational objective as well as a performance measurement strategy, which could be improved by including indicators that show the contribution of pharmacy benefits to the health of First Nations and Inuit. There are client safety and annual reports for the NIHB Program.

Overall, the management control framework for pharmacy benefits is sound as a result of the NIHB management team responding positively to the various internal and external assessments. While the framework is sound, its operating effectiveness can be further enhanced. Actions to address the five recommendations will further strengthen Health Canada's pharmacy benefit program.

Appendix A - Audit Lines of Enquiry and Audit Criteria

The audit criteria are developed using the Treasury Board of Canada Secretariat's Core Management Controls: A Guide for Internal Auditors.

Appendix B

Appendix B - Non Insured Health Benefit (NIHB) simplified health benefit process