AUDIT COMMITTEE SUMMARY
April 16, 2019
Audit of Human Resources Department
BlueCross BlueShield Contract Compliance
Report Issued April 4, 2019
Objective
Determine if vendor and HR are in compliance with the BlueCross BlueShield contract and HR is adequately monitoring the contract.
Background
BCBS provides third party administrative (TPA) services for the City’s self-funded medical plans, flexible spending account, health savings account, COBRA administration, and preferred provider network. The contract commenced January 1st 2017 and has a value of $5,000,000. It is a five year contract with one two-year option to extend. The TPA fee associated with the contract is billed to the City once a month and claims are billed weekly. The TPA fee is billed based on the number of participants and the rate was $34.93 for calendar year (CY) 2017 and $35.98 for CY 2018.
HR is responsible for monitoring the contract with BCBS. A contract monitor uses a contract administration plan (CAP) to monitor all key contract requirements. Key contract requirements include insurance coverage, performance measures, and invoice payments.
Scope and Methodology
The audit scope included HR monitoring processes which included key contract requirements in the BCBS contract for CY 2017 and 2018. We reviewed for compliance with performance measures. We also reviewed invoices for appropriate documentation, supervisory approval, and accurate recording. Additionally, we reviewed the accuracy of the TPA fee. Finally, we reviewed for appropriate user access for systems with information associated with this contract.
Conclusions
BCBS and HR are in compliance with the BCBS contract and HR is adequately monitoring the contract. HR has implemented a contract administration plan to monitor key contract requirements. Additionally, HR is monitoring for adherence to performance measures. In addition, HR has established controls to ensure invoices were properly supported and approved. Finally, HR is monitoring the monthly TPA fee to ensure it is properly calculated.
However, we identified areas in need of improvement. Access to the fiscal planning drive which contains protected health information was inappropriate. Additionally, HR was not in compliance with the Health Insurance Portability and Accountability Act Privacy and Security Policy and Procedure documentation requirements.
We made recommendations to address the opportunities. Management agreed with the recommendations and developed positive corrective action plans.