SOCIAL SECURITY ADMINISTRATION

ADMINISTRATIVE COSTS CLAIMED
BY THE NEBRASKA DISABILITY
DETERMINATION SERVICES

June 2008

A-07-07-17170

AUDIT REPORT

Mission

By conducting independent and objective audits, evaluations and investigations, we inspire public confidence in the integrity and security of SSA's programs and operations and protect them against fraud, waste and abuse. We provide timely, useful and reliable information and advice to Administration officials, Congress and the public.

Authority

The Inspector General Act created independent audit and investigative units, called the Office of Inspector General (OIG). The mission of the OIG, as spelled out in the Act, is to:

Conduct and supervise independent and objective audits and investigations relating to agency programs and operations.
Promote economy, effectiveness, and efficiency within the agency.
Prevent and detect fraud, waste, and abuse in agency programs and operations.
Review and make recommendations regarding existing and proposed legislation and regulations relating to agency programs and operations.
Keep the agency head and the Congress fully and currently informed of problems in agency programs and operations.

To ensure objectivity, the IG Act empowers the IG with:

Independence to determine what reviews to perform.
Access to all information necessary for the reviews.
Authority to publish findings and recommendations based on the reviews.

Vision

We strive for continual improvement in SSA's programs, operations and management by proactively seeking new ways to prevent and deter fraud, waste and abuse. We commit to integrity and excellence by supporting an environment that provides a valuable public service while encouraging employee development and retention and fostering diversity and innovation.

MEMORANDUM

Date: June 19, 2008

To: Michael W. Grochowski
Regional Commissioner
Kansas City

From: Inspector General

Subject: Administrative Costs Claimed by the Nebraska Disability Determination Services (A-07-07-17170)

OBJECTIVE

Our objectives were to evaluate the Nebraska Disability Determination Services' (NE DDS) internal controls over the accounting and reporting of administrative costs, determine whether costs claimed by the NE-DDS were allowable and properly allocated and funds were properly drawn, and assess limited areas of the general security control environment. Our audit included the administrative costs claimed by the NE-DDS during Federal Fiscal Years (FY) 2005 and 2006.

BACKGROUND

The Disability Insurance (DI) program, established under Title II of the Social Security Act (Act), provides benefits to wage earners and their families in the event the wage earner becomes disabled. The Supplemental Security Income (SSI) program, established under Title XVI of the Act, provides benefits to financially needy individuals who are aged, blind, and/or disabled.

The Social Security Administration (SSA) is responsible for implementing policies for the development of disability claims under the DI and SSI programs. Disability determinations under both DI and SSI are performed by disability determination services (DDS) in each State and other responsible jurisdictions. Such determinations are required to be performed in accordance with Federal law and underlying regulations. In carrying out its obligation, each DDS is responsible for determining claimants' disabilities and ensuring that adequate evidence is available to support its determinations.

To assist in making proper disability determinations, each DDS is authorized to purchase medical examinations, x-rays, and laboratory tests on a consultative basis to supplement evidence obtained from the claimants' physicians or other treating sources.

SSA reimburses the DDS for 100 percent of allowable reported expenditures up to its approved funding authorization. The DDS withdraws Federal funds through the Department of the Treasury's (Treasury) Automated Standard Application for Payments (ASAP) system to pay for program expenditures. Funds drawn down must comply with Federal regulations and intergovernmental agreements entered into by Treasury and States under the Cash Management Improvement Act of 1990.

An advance or reimbursement for costs under the program must comply with the Office of Management and Budget's (OMB) Circular A 87, Cost Principles for State, Local, and Indian Tribal Governments. At the end of each quarter of the FY, each DDS is required to submit a State Agency Report of Obligations for SSA Disability Programs (SSA 4513) to account for program disbursements and unliquidated obligations. The SSA-4513 reports expenditures and unliquidated obligations for personnel service costs, medical costs, indirect costs, and all other nonpersonnel costs.

The Nebraska Department of Education is the NE-DDS' parent agency. The NE-DDS is located in Lincoln, Nebraska.

RESULTS OF REVIEW

Other than the areas discussed in this report, the NE-DDS had effective controls over the accounting and reporting of administrative costs. With the exception of paying consultative examination (CE) providers for missed CE appointments without SSA approval, the costs claimed by the NE-DDS during our audit period were allowable, properly allocated, and funds were properly drawn. We found that the NE-DDS needed to improve controls over its CE provider sanction process and inventory controls. Regarding general security control, NE-DDS did not comply with SSA policies for after hours cleaning services, its security plan was incomplete, and its disaster recovery plan (DRP) had not been tested.

CE PROVIDERS PAID FOR MISSED APPOINTMENTS

The NE-DDS paid CE providers a fee when claimants missed their CE appointments. Specifically, the NE-DDS paid the CE provider up to 50 percent of the fee for the missed CE. As a result, SSA reimbursed the NE-DDS $229,519 for payments to CE providers for missed CE appointments during FYs 2005 and 2006. The payments represented more than 7 percent of total CE expenses during the same timeframe. SSA had not approved the payments for missed CE appointments, as required.

In response to a prior audit, SSA adopted a no-pay policy for missed CE appointments. In April 2000, SSA clarified its no-pay policy and stated that, on an individual case basis, the DDS may request an exemption. , To obtain an exemption, the DDS is instructed to work with its SSA regional office (RO) to reach agreement on payments to CE providers for missed appointments. After an agreement is reached, the RO would then submit the request, along with supporting documentation, to the Office of Disability Determinations (ODD) for exemption consideration. However, we found that the NE DDS did not work with the Kansas City RO on an exemption. Rather, it implemented a payment policy for missed CE appointments without requesting SSA's approval.

NE-DDS' administrator stated that he believes CE providers should be compensated for the loss of revenue resulting from missed CE appointments. We recommend SSA instruct the NE-DDS to refund $229,519 for missed CE appointments unless it can provide acceptable evidence that paying for these missed CE appointments is appropriate. We also recommend that SSA instruct the NE-DDS to immediately stop payments to providers for missed CE appointments until an exemption is requested and approved.

SANCTION LISTING

The NE-DDS did not review the Health and Human Services, Office of Inspector General, (HHS/OIG) List of Excluded Individuals/Entities to ensure CE providers it intended to utilize were not sanctioned from participation in any Federal or federally assisted program. SSA policy indicates that a qualified medical source must not be

sanctioned from participation in Federal programs. Underlying SSA procedures require that, before using the services of any CE provider, DDSs must review the Listing of Excluded Individuals/Entities for each CE provider at least annually.

The NE-DDS is at-risk of contracting with CE providers whose services have been sanctioned by other Federal agencies if it does not review the HHS/OIG sanction listing. The NE-DDS stated it was unaware of the requirement to review the HHS/OIG sanction listing. Since learning of this requirement, NE-DDS stated it has reviewed the HHS/OIG sanction listing and incorporated this procedure in its CE provider review process. We recommend SSA ensure the NE-DDS continues to review the HHS/OIG List of Excluded Individuals/Entities as part of its CE provider background check process.

INVENTORY CONTROL

The NE-DDS did not maintain accurate and complete inventory records of computer equipment.

We could not locate two servers and two laptop computers that were listed on the official inventory records. After our on-site inventory review, NE-DDS management reported that one of the laptops was located and the other laptop had been surplused. We do not know whether the servers contained personally identifiable information (PII). However, the NE DDS stated the PII would have been erased since the equipment was out of service.

The NE-DDS' official inventory records did not include desktop and laptop computers that SSA purchased and shipped directly to the NE-DDS.

The NE DDS did not record this computer equipment stating it believed SSA was responsible for maintaining the inventory of computer equipment SSA purchased for the NE-DDS. Furthermore, the NE-DDS stated that, although SSA policy requires the inventory of equipment, this policy defines equipment as having a minimum per unit acquisition cost of $5,000. The NE-DDS believes it does not need to inventory computer equipment purchased with SSA-applied funds.

We do not agree with the NE-DDS' assertions that they are exempt from documenting SSA supplied computer into their inventory system. Although SSA policy defines equipment using a minimum per unit acquisition cost, this same policy also makes a clear distinction that computer equipment is to be considered separately from other equipment. Additional SSA policy requires an appropriate inventory and control mechanism to account for all property used for disability program purposes. It is noteworthy that Nebraska Department of Education's inventory policy, issued in March 2007, specifically requires that the NE-DDS record and account for computer equipment regardless of per unit acquisition cost, and its tracking system must also identify the current employee assigned accountability for specific computers. Therefore, according to SSA and State policy, a minimum per unit acquisition cost does not apply regarding the inventory of computer equipment.

The NE-DDS also states that it does not own the computer equipment purchased for it by SSA. We do not agree with the NE-DDS' assertions regarding the ownership of SSA-supplied computer equipment. SSA's inventory policy clearly states the title to equipment rests with the State, and the State is responsible for maintenance and inventory of all equipment whether purchased through SSA or the State.

Not maintaining adequate inventory records hinders detection of stolen or misplaced equipment. By creating an appropriate inventory system for computer equipment, the NE-DDS will create security controls to protect records created by the State in performing the disability determination function, as required by SSA policy. We recommend SSA instruct the NE-DDS to immediately establish and maintain equipment inventory in compliance with the policies of SSA and the Nebraska Department of Education. We also recommend that SSA verify the NE DDS' new inventory system complies with appropriate policies.

ACCESS CONTROLS

The NE-DDS did not comply with SSA policies for cleaning services, which require that all offices implement a clean-desk policy or daytime cleaning, and that non-Agency employees, such as cleaning personnel, must not have access to claimant data, and any computer equipment used for data input or storage. NE DDS' cleaning services were provided during nonwork hours, and the NE-DDS did not practice a clean-desk policy. Therefore, cleaning personnel could gain unauthorized access to sensitive information and computer equipment. A lack of access controls increases the risk of unauthorized access and loss of sensitive information and equipment.

The NE-DDS stated that cleaning during regular working hours is disruptive and diminishes the quality of service to the public since it is required to assist the public by telephone. We recommend SSA instruct the NE-DDS to either implement cleaning services during work hours or adhere to SSA's clean desk policy and other limitations on access to claimant data.

INCOMPLETE SECURITY PLAN

The NE-DDS' security plan did not adhere to SSA's policy requiring a security plan consisting of eight parts, with each part containing specific information. We found that the NE-DDS security plan was missing three of the eight required parts: (1) the DDS Systems Interconnection Access Security Plan, (2) the Violations Reports and Resolution Plan, and (3) the Risk Assessment.

Furthermore, essential information was missing in the other five parts of the security plan.

1. The Physical DDS Security Description/Profile was missing a line of succession or authority in the event of a disaster.
2. The Systems Security Awareness and Training Plan was missing information on how newly hired employees and contractors are trained.
3. The Tri-Annual Systems Review/Recertification Plan was missing the tri-annual recertification process, the DDS policy on platform security, and the instructions for the comprehensive integrity review process.
4. The Continuity of Operations Plan was missing a description of SSA and NE DDS responsibilities and a description of workload and workflow of the NE-DDS.
5. The DRP did not quantify what local resources are needed to operate the NE-DDS in the event of a disaster.

Because there was no complete security plan, there was a risk that critical business processes were not protected or would not recover timely in the event of a disaster. A delay in creating a complete security plan could result in a longer recovery period following a catastrophic event. NE-DDS personnel stated that conversion to electronic folders was given priority over the security plan, and, since the conversion is complete, the NE-DDS plans to create a new security plan in accordance with SSA's policy. We recommend SSA assist the NE DDS in the timely creation of a security plan in accordance with its policy.

DRP NOT TESTED

The NE-DDS' DRP was not tested as set forth in SSA policy. The DRP documents DDS data and personnel information involved in restoring system operations that are vital to disaster recovery. As a result of not testing the DRP, there was a risk that critical business processes were not protected or would not recover timely in the event of a disaster. NE-DDS' delay in testing the DRP could result in a longer recovery period following a catastrophic event. We recommend SSA work with the NE-DDS to ensure the timely testing of the DRP.

CONCLUSION AND RECOMMENDATIONS

Other than the areas discussed in this report, the NE-DDS had effective controls over the accounting and reporting of administrative costs. With the exception of paying CE providers for missed CE appointments without SSA approval, the costs claimed by the NE-DDS during our audit period were allowable, properly allocated, and funds were properly drawn. We found that the NE-DDS needed to improve controls over its CE sanctioned provider process and inventory controls. Regarding general security control, NE-DDS did not comply with SSA policies for after hours cleaning services, its security plan was incomplete, and its DRP had not been tested.

We recommend the SSA Regional Commissioner:

1. Instruct the NE-DDS to refund $229,519 for missed CE appointments unless it can provide acceptable evidence that paying for these missed CE appointments is appropriate.

2. Instruct the NE-DDS to immediately stop payments to providers for missed CE appointments until an exemption is requested and approved.

3. Ensure the NE-DDS continues to review the HHS/OIG List of Excluded Individuals/Entities as part of its consultative examiner background check process.

4. Instruct the NE-DDS to immediately establish and maintain proper equipment inventory in compliance with policies of SSA and the Nebraska Department of Education.

5. Verify the NE-DDS' new inventory system complies with appropriate policies.
6. Instruct the NE-DDS to either implement cleaning services during work hours or adhere to SSA's clean-desk policy during nonwork hours and other limitations on access to claimant data.

7. Assist the NE-DDS in the timely creation of a security plan in accordance with its policy.

8. Work with the NE-DDS to ensure the timely testing of NE-DDS' DRP.

AGENCY COMMENTS

In commenting on our draft report, SSA agreed with all of our recommendations. See Appendix C for the full text of SSA's comments.

NEBRASKA DISABILITY DETERMINATION SERVICES' COMMENTS

In commenting on our draft report the NE-DDS agreed with three of the eight recommendations in our audit report. See Appendix D for the full text of the NE-DDS' comments.

The NE-DDS disagreed with Recommendations 1 and 2 stating in part that paying for missed CE appointments is a good business practice; consistent with its parent agency practice; consistent with standard business practice in the community; and contributes to making accurate determinations. The NE-DDS also stated that SSA's attempt to collect reimbursement of nearly a quarter of a million dollars constitutes a threat to the continuation of the state-federal relationship in Nebraska.

The NE-DDS also disagreed in part with Recommendations 4 and 5 citing a different interpretation of the SSA inventory policies and procedures than what we outlined in our report. However, the NE-DDS commented that it will agree to conform to SSA inventory requirements once the requirements are stated.

The NE-DDS disagreed with Recommendation 6 stating that SSA policy gives the NE-DDS discretion as to whether it chooses to implement cleaning services during work hours and adhere to SSA's clean desk policy.

OIG RESPONSE

The SSA Regional Office has already taken actions to implement Recommendations 1 and 2. Following the issuance of our draft report, SSA worked with the NE-DDS to develop a request for exemption of payment for missed appointments, allowing for reduced reimbursement instead of paying the CE provider up to 50 percent of the fee for the missed CE during our audit period. This exemption has been approved by the Office of Disability Determinations. The NE-DDS plans to implement this new

procedure on June 2, 2008. Since SSA reached agreement on the exemption, it does not plan to request a refund of the funds paid for missed appointments. Therefore, SSA has taken appropriate actions to address these recommendations and the concerns stated in the NE-DDS' comments are no longer applicable.

We remain committed to Recommendations 4 and 5 which require the NE-DDS to establish and maintain proper equipment inventory in compliance with policies of SSA and the Nebraska Department of Education and instruct SSA to verify the NE-DDS' new inventory system complies with appropriate policies. However, the NE-DDS' comments to our draft report indicates that it may not fully understand SSA requirements for the inventory process. Therefore, SSA should discuss the inventory requirements with the NE-DDS as part of its process for taking corrective actions on our recommendations.

We also remain committed to our recommendation that the NE-DDS either implement cleaning services during work hours or adhere to SSA's clean-desk policy. Implementation of this recommendation is necessary for the protection of disability claimants' PII that is not protected by computer PINS and passwords. The minimal effort required on the part of the NE-DDS to implement a clean-desk policy is far outweighed by the protection it would provide disability claimants.

OTHER MATTER

Personally Identifiable Information

Disability claimants of the NE-DDS had PII routinely disclosed to vendors. The NE-DDS processes over 18,000 disability determinations each FY. During the disability determination process, the NE-DDS purchases services that include medical evidence (CE and medical evidence of record) and claimant travel. Our review of medical and applicant travel invoices revealed that these documents contained PII including name, address, date of birth, Social Security number, and telephone number. Although we have no reason to believe this information has been abused, this practice could potentially result in abuse of claimant's PII.

Federal guidance dictates that agencies should reduce their current holdings of all PII to the minimum necessary for the proper performance of a documented agency function. Agencies must also review their use of Social Security numbers in agency systems and programs to identify instances in which collection or use of the Social Security number is superfluous.

On October 5, 2007, SSA ODD informed ROs that DDS' should review their processes to eliminate the use of the Social Security numbers on correspondence where possible. The NE-DDS informed us that it has begun the process of removing the Social Security number from documents where it is not absolutely necessary.

Patrick P. O'Carroll, Jr.

Appendices
APPENDIX A - Acronyms
APPENDIX B - Scope and Methodology
APPENDIX C - Agency Comments
APPENDIX D - Nebraska Disability Determination Services Comments
APPENDIX E - OIG Contacts and Staff Acknowledgments

Appendix A
Acronyms

Act Social Security Act
ASAP Automated Standard Application for Payments
CE Consultative Examination
C.F.R. Code of Federal Regulations
DDS Disability Determination Services
DI Disability Insurance
DRP Disaster Recovery Plan
FY Fiscal Year
HHS Health and Human Services
NE-DDS Nebraska Disability Determination Services
ODD Office of Disability Determinations
OIG Office of Inspector General
OMB Office of Management and Budget
PII Personally Identifiable Information
POMS Program Operations Manual System
Pub. L. No. Public Law Number
RO Regional Office
SSA Social Security Administration
SSA-4513 State Agency Report of Obligations for SSA Disability Programs
SSI Supplemental Security Income
Treasury Department of the Treasury
U.S.C. United States Code

Appendix B
Scope and Methodology
SCOPE

To achieve our objective, we:

" Reviewed applicable Federal laws and regulations, pertinent parts of the Social Security Administration's (SSA) Program Operations Manual System and other criteria relevant to administrative costs claimed by the Nebraska Disability Determination Services (NE-DDS), and the draw down of SSA program appropriations.

Interviewed staff at the Nebraska Department of Education and the NE DDS.

Reviewed State policies and procedures related to personnel, medical services, and all other nonpersonnel costs.

Evaluated, tested, and documented internal controls regarding accounting, financial reporting, and cash management activities.

Reconciled State accounting records to the administrative costs reported by the NE-DDS on the State Agency Report of Obligations for SSA Disability Programs (SSA-4513) for Federal Fiscal Years (FY) 2005 through 2006.

Examined specific administrative expenditures (personnel, medical services, and all other nonpersonnel costs) incurred and claimed by the NE-DDS for FYs 2005 and 2006 on the SSA-4513. We used statistical sampling to select expenditures to test for support of the medical service and all other nonpersonnel costs as discussed in the following methodology section of this appendix.

Examined the indirect costs claimed by NE-DDS for FYs 2005 through 2006.

Compared the amount of SSA funds drawn for support of program operations to the expenditures reported on the SSA-4513.

Determined whether selected funds from cancelled warrants were properly returned to SSA.

Determined whether unliquidated obligations were properly supported.

Reviewed the NE-DDS' general security control.

Reviewed Office of Management and Budget guidance related to safeguarding personally identifiable information.

We determined that the data provided by Nebraska Department of Education and NE DDS used in our audit were sufficiently reliable to achieve our audit objectives. We assessed the reliability of the data by reconciling it with the costs claimed on the SSA 4513. We also conducted detailed audit testing on selected data elements in the electronic data files.

We performed work at the NE-DDS, and the Kansas City, Missouri, Office of Audit. We conducted fieldwork from June 2007 through January 2008. The audit was conducted in accordance with generally accepted government auditing standards.

METHODOLOGY

SAMPLING METHODOLOGY

The sampling methodology encompassed the four general areas of costs reported on the SSA-4513: (1) personnel, (2) medical, (3) indirect, and (4) all other nonpersonnel costs. We obtained a data extract of all costs and the associated invoices for FYs 2005 through 2006 for use in statistical sampling. This was obtained from the accounting systems used in the preparation of the SSA-4513.

Personnel Costs

We randomly selected 1 pay period, the month of August, in FY 2006 for review. We then selected a random sample of 50 regular employees for review and testing of the payroll records. For medical consultant costs, we also selected the month of August, in FY 2006, for review. We then selected all 19 medical consultants for review and testing of the payroll records.

Medical Costs

We sampled 100 items (50 items from each of FY 2005 and 2006) using a stratified random sample of medical costs based on the proportion of medical evidence of record and consultative examination costs to the total medical costs claimed.

Indirect Costs

NE-DDS indirect costs are computed by applying a federally approved rate to a cost base. This methodology was approved by the United States Department of Education, which is the Federal agency designated to negotiate and approve the indirect cost rate. On the final SSA-4513s, the NE-DDS claimed indirect costs of $460,944 for FY 2005 and $511,934 for FY 2006. We reviewed the FY 2005 and 2006 indirect cost calculations to ensure the correct rate was applied.

All Other Nonpersonnel Costs

We sampled 100 items (50 expenditures from FY 2005 and 50 from FY 2006) using a stratified random sample. The random sample was based on the proportion of costs in each of the cost categories to the total costs claimed.

Appendix C
Agency Comments

Sent: Thursday, May 08, 2008 4:36 PM
Subject: Signed Draft Report (A-07-07-17170) - Kansas City Response

To: Inspector General

From: Regional Commissioner
Kansas City Region

Subject: Administrative Costs Claimed by the Nebraska Disability Determination Services (A-07-07-17170) - Response

Thank you for sharing the draft report of the administrative audit for fiscal years 2005 and 2006 conducted at the Nebraska Disability Determination Services (DDS). The preliminary findings illustrate that overall the Nebraska DDS has effective controls over the accounting and reporting of administrative costs. The auditors did identify the following recommendations that require corrective action or improved processes. I agree with the recommendations outlined in the draft report. We will work with the DDS to correct these findings.

Recommendations:
1. Instruct the Nebraska DDS to refund $229,519 for missed CE appointments unless it can provide acceptable evidence that paying for these missed CE appointments is appropriate.

2. Instruct the DDS to immediately stop payments to providers for missed CE appointments until an exemption is requested and approved.

Action Pending: The Regional Office worked with the Nebraska DDS to develop a request for exemption of payment for missed appointments, allowing for reduced reimbursement. This exemption has been approved by the Office of Disability Determination. The DDS plans to implement this new procedure on June 2, 2008, which will allow the DDS enough time to inform their consultative examination panelists of the change in their policy. Since we have now come to an agreement on this exemption, the Region does not plan to request a refund of DDS funds paid for missed appointments.

3. Ensure the DDS continues to review the HHS/OIG List of Excluded Individuals/Entities as part of its consultative examiner background check process.

Action Pending: The DDS is now aware of the requirement to review the HHS/OIG sanction listing and will incorporate this into their CE provider review process. The Center for Disability Professional Relation's Officer will follow-up with the DDS during Professional Relations visits to ensure this is being done on a regular basis.

4. Instruct the DDS to immediately establish and maintain proper equipment inventory in compliance with policies of SSA and the Nebraska Department of Education.

5. Verify the DDS' new inventory system complies with appropriate policies.

Action Pending: The Center for Disability Programs will work with the DDS to see that they establish proper equipment inventory and verify the new system complies with appropriate policies.

6. Instruct the DDS to either implement cleaning services during work hours or adhere to SSA's clean-desk policy during non-work hours and other limitations on access to claimant data.

Action Pending: The DDS is evaluating options to comply with SSA policies for cleaning services.

7. Assist the DDS in the timely creation of a security plan in accordance with its policy.

8. Work with the DDS to ensure the timely testing of the DDS' Disaster Recovery Plan.

Action Pending: The Center for Disability Programs will work with the DDS to develop a complete security plan that adheres to SSA's policy requirements. The Office of Disability Determination, Division of DDS Systems, will be contacted regarding the possibility of testing the Nebraska DDS Disaster Recovery Plan.

OTHER MATTER

Personally Identifiable Information (PII)
Disability claimants of the DDS had PII routinely disclosed to vendors. Review of medical and applicant travel invoices revealed that these documents contained PII including name, address, date of birth, Social Security number, and telephone number.

Action Pending: The DDS is working to remove the Social Security number from all documents where it is not absolutely necessary.

We appreciate the auditor's exceptional communication and cooperation with the DDS and Regional Office during the course of the audit process. We hope to have all matters addressed by the time the final audit report is received. If you have questions, please contact me at 816-936-5700. If your staff needs additional assistance or information, they may contact Linda Kerr-Davis, Disability Program Administrator for Nebraska, at 816-936-5685.

Michael W. Grochowski

Appendix D
Nebraska Disability Determination Services Comments

NEBRASKA DEPARTMENT OF EDUCATION
Disability Determinations Section
Mailing Address: PO Box 82530 - Lincoln, Nebraska 68501-2530 - Phone (402) 471-2961
FAX # 402-471-3626
Determinations for Social Security and Supplemental Security Income Disability

May 14, 2008

Patrick P. O'Carroll, Jr.
Office of Inspector General
Social Security Administration
Baltimore, MD 21235-0001

Dear Mr. O'Carroll:

Re: Audit A-07-07-17170

By letter dated April 14, 2008, your office conveyed a draft Audit Report relative to the administrative costs claimed by the Nebraska Disability Determinations Services. The audit covered fiscal years 2005 and 2006. You requested written comments on each of the recommendations contained in the draft report. This letter serves as the response of the Nebraska Department of Education.

BACKGROUND

The relevant statutes and regulations create an opportunity for the state and federal governments to maintain a partnership in the administration of the Social Security Disability Program. Participation is voluntary for the states. SSA may terminate its relationship with a state in the presence of performance that persistently falls below SSA's established standards.

All states presently participate in the program which is evidence that the states and SSA feel that there are mutual advantages in doing so. For SSA, the advantages are tangible and obvious. They most notably include having exclusive access to points of business presence in every state and to a trained and experienced state workforce whose compensation is far less than would be the case if the work were performed by federal employees. Simply and significantly, SSA saves a lot of money by having the disability determination function performed by the states.

For the states, the benefits are less concrete, and the financial incentive, if any, is small. SSA does fund all operational expenses. Additionally, SSA reimburses the states for the administrative overhead (indirect costs) associated with participating in the program. But since the state does not "keep" any of the funding for operational expenses and since the indirect costs are fair in terms of the added expense to the state, there is little or nothing resembling a "profit" for the states.

What each state does experience from the partnership is an opportunity to play a role in assuring that its residents receive an acceptable level of service in the administration of the program. Service to its citizens and fair and appropriate regard for state government in general and the state business community are the incentives for state participation in the program.

In Nebraska, DDS management is sometimes asked by other officials in state government --- legislators, their staffs, budget analysts, and a former governor's chief of staff --- "why is this a state program? why not just turn this over to SSA? is keeping this program really worth the risk from a PR and liability point of view?"

The structure and nature of the state federal partnership has evolved over the history of the program in ways that are relevant to some of the findings of this audit. Before the enactment of Public Law 96-265 in 1980, the business relationships between the state and federal components were determined by individually negotiated contracts. This enabled each state to declare and negotiate the terms under which it would perform functions on behalf of SSA. Under 96-265, the contracts were invalidated and SSA was empowered to issue regulations that would define the business relationship. Such regulations were issued on May 29, 1981. The fundamental understanding was that SSA would provide the policies, workload, performance expectations, funding, and oversight while the states would provide a business environment, business rules, and personnel.

Two citations from the original regulation are relevant:

We (SSA) do not intend to become involved in the State's ongoing management of the program except as necessary and in accordance with these regulations".

The States will have control over management of their operations as long as their performance is adequate under the standards which we set".

But as time has passed, SSA has increasingly sought to determine business rules, administrative procedures, etc. within the DDSs. This observation is made here because it becomes relevant to some of the specific findings of the audit. At least a theoretical possibility exists that the trend in SSA determination and enforcement of administrative and business rules would so compromise a state's reason for being in the program as to compel reexamination of the state's position.

RESULTS OF THE REVIEW

PAYMENT TO CE PROVIDERS FOR MISSED APPOINTMENTS

OIG observed that the DDS has a practice of paying health care providers a fee when claimants fail to appear for their scheduled appointments, that this practice had not been approved by SSA, and that this is not consistent with SSA instructions. OIG recommends that SSA instruct the DDS to immediately stop paying such a fee and to refund $229,519.

DDS disagrees with OIG's recommendation for the following reasons:

paying such a fee is a good business practice;
it is consistent with the parent agency practice;
it is consistent with standard business practice in the community;
it contributes to our highest priority of making accurate determinations;
permitting the DDS to exercise its own discretion on this matter (and potentially on other matters) is consistent with the fundamental understanding in having a state-federal partnership;
SSA may lack the regulatory authority to impose its requirement on this matter;
attempting to effectuate a payment of nearly a quarter of a million dollars constitutes a threat to the continuation of the state-federal relationship in Nebraska.

Paying the fee is a good business practice. When DDS schedules an appointment with a medical provider, that provider blocks out time that could otherwise have been sold" to another purchaser. This is particularly important in the case of psychologists who schedule an hour or more of their time to the exclusion of all other activities. When our claimant fails to appear for the examination, the time and business opportunity is lost. Asking the provider to take this risk with no opportunity for compensation is unfair and unreasonable. Our examination providers are our business partners, the success of our operations depend upon them, and we value their good will. The OIG recommendation is not consistent with maintaining good business relationships.

It is consistent with the parent agency practice. In comparable situations, most notably the contracting for translation services, the parent agency pays a fee to professional service provider when he or she is present and ready to provide the service but the client fails to appear and a business opportunity is consequently lost. When SSA chooses to do business with us, especially under a regulation which states an intention to defer to local business practices, it gives up its absolute right to unilaterally dictate business practices. If exercise of such an absolute right is essential in SSA's view, then we acknowledge SSA's option to make arrangements with some other entity to schedule and pay for consultative examinations.

It is consistent with standard business practice in the community.

Medical practitioners generally assess charges to patients who make appointments and who do not appear for the appointments without having given adequate notice of cancellation. Expecting practitioners to treat DDS differently than their patients is not reasonable.

OIG's recommendation runs counter to our highest objective. The top priority of the DDS is to make correct and accurate determinations of eligibility for disability benefits. Doing so requires that we attempt to recruit the best and most competent sources for medical examinations. Not surprisingly, the best sources are those in highest demand. Not paying a fee for missed appointments will cause us to lose the opportunity to do business with providers who are in highest demand.

SSA may lack the regulatory authority to require that no fees be paid in these circumstances.

In the current CFR, SSA states its basic intent as follows:
§404.1603 Basic responsibilities for us and the State.
(a) General. We will work with the State to provide and maintain an effective system for processing claims of those who apply for and who are receiving benefits under the disability program. We will provide program standards, leadership, and oversight. We do not intend to become involved in the State's ongoing management of the program except as is necessary and in accordance with these regulations. The State will comply with our regulations and other written guidelines.
With regard to payment for medical purchases, the CFR states:
§404.1624 Medical and other purchased services.
Subject to the provisions of §405.805(b)(2) of this chapter in claims adjudicated under the procedures in part 405 of this chapter, the State will determine the rates of payment to be used for purchasing medical or other services necessary to make determinations of disability. The rates may not exceed the highest rate paid by Federal or other agencies in the State for the same or similar type of service. The State will maintain documentation to support the rates of payment it uses.
Clearly, payment for missed appointments falls under the heading of purchased medical services and clearly the CFR defers to the state practice. While OIG or SSA may quote other much more general phraseology (such as, "the DDS will follow our guidelines), deference must go to the more specific language.

Threatening to attempt to recover money paid for missed appointments could have undesired consequences for the future of the state federal relationship. As mentioned in the previous section, there is little in the way of tangible benefit for the state in this partnership. For SSA to threaten to recover a large amount of money (or any amount of money), would further weaken the rationale. It would create the appearance of a situation in which the best the state could do would be to have the federal partner cover

the expenses of doing federal work but in which there would be a potential penalty in which the state would have to provide its own funding should a mistake be made. Many reasonable state policy makers would oppose such an arrangement.

Any decision should be made by weighing the probable benefits against the probable risks. When applied to the question of deciding whether or not OIG will recommend recovery of funds, there are no benefits and there are many risks. There are no benefits because this recovery of funds simply will not happen. The Nebraska legislature is not going to appropriate Nebraska taxpayer dollars to pay SSA for having done SSA work. Neither will the threat intimidate the DDS into following SSA directions for which SSA lacks regulatory authority. There are no other benefits. Meanwhile, there is considerable risk. The recommendation is inflammatory and without any possible constructive consequence. Therefore DDS recommends that the OIG draft report be amended to exclude any reference to recovery of funds.

SANCTION LISTING

OIG observed that DDS had only recently been reviewing the HHS OIG List of Excluded Individuals/Entities to make sure that we are not doing business with health care providers who have been sanctioned by other federal agencies. OIG recommended that DDS continue to use this listing.

DDS agrees with the OIG finding and recommendation.

INVENTORY CONTROL

DDS disagrees with a number of OIG's observations and recommendations regarding inventory control.

OIG Statement DDS Response
DDS could not locate two out of service laptops, but later located one. DDS did recover both laptops.
"We do not agree with the NE DDS' assertions that they are exempt from documenting SSA supplied computer equipment into their inventory system."
These statements are made in the context of determining whether or not DDS must maintain a formal inventory of computer equipment supplied by SSA with a unit cost of less than $5000. DDS made no such assertion. DDS believes that it must abide by the POMS requirements for inventory control for all equipment including computer equipment. POMS 39530.020 requires that DDS inventory all equipment whether purchased by SSA or by the state with SSA funds. DDS does follow this instruction. But POMS 39530.001 D defines "equipment" as an article having an acquisition cost of $5000 or more.
Although POMS 39530.001D does define equipment using a minimum per unit acquisition cost, this same policy says that computer equipment must be considered separately. The POMS quoted by OIG does indeed say that computer equipment must be considered separately. But it does not say that it must be inventoried.
Additional policy requires (POMS 39563.200) requires an appropriate inventory and control mechanism to account for all property used for disability program purposes. Yes, but it does not define what an appropriate system would be. This reference is very general and we must defer to the more specifically worded sections that, taken together, say that items costing at least $5000 must be inventoried.
OIG has an opinion about what should be inventoried. But the POMS does not back up that opinion. If SSA has specific requirements it should state them clearly in POMS and then, provided that they do not conflict with a higher authority, DDS will comply.
DDSs contention that it does not own the computer equipment is wrong. SSA's policy says that title rests with the state. That is one fact in support of OIG's interpretation. But there are others. First, every piece of computer equipment that SSA ships to DDS bears a sticker that says "SSA - Property of the Federal Government". Second, if it were truly the property of the state, it could be reassigned from DDS to some other agency of state government. Does OIG think that SSA would stand still for that?
We recommend that SSA instruct the NE DDS to immediately establish and maintain equipment inventory in compliance with the policies of SSA and the Nebraska Department of Education. We also recommend that SSA verify the NE DDS' new inventory system complies with appropriate policies. To the extent that OIG is recommending that SSA require DDS to conform to SSA requirements (once they are stated so that everyone knows what they are), DDS agrees. But the OIG recommendation seems to go further and to recommend that SSA interject itself into the supervision of state employees by taking actions to inspect state compliance with state instructions. If this is the intended meaning, then DDS strongly disagrees that SSA should get involved in state supervision of state practices.

ACCESS CONTROLS

DDS does not agree with some of OIG's observations and recommendations regarding access controls and concludes that OIG's recommendations are not support by POMS

OIG Statement DDS Response
DDS does not comply with SSA policies for cleaning services which require either a "clean desk" policy or daytime cleaning. OIG cites POMS 39566.010B2a and B6e as its source. OIG has mischaracterized and overstated what the POMS actually says. 39566.010A prefaces all succeeding guidelines by saying that the contents of the section are discretionary. The specific sections referenced by OIG say "offices should implement a clean desk policy or daytime cleaning" and "the office should be cleaned during work hours". DDS believes that SSA chose the term "should" when the term "must" was available and intentionally labeled the guidelines as discretionary. POMS does not support the OIG recommendation.
Non agency employees such as cleaning personnel must not have access to claimant data and computer equipment used for data input or storage per POMS 39566.030B. DDS feels that the use of PINs and passwords is sufficient to prevent non agency personnel access to the sensitive information.

INCOMPLETE SECURITY PLAN

OIG observed that the DDS security plan was incomplete and recommended the development of a security plan in accordance with SSA policy.

SSA's requirements for security planning have been something of a moving target and DDS has not been able to keep up. DDS does accept this finding and will work with the SSA RO to update and complete our security plan.

DRP NOT TESTED

OIG observed that the DDS disaster recovery plan has not been tested and recommended that SSA and DDS work together to test the DRP.

DDS agrees with the OIG finding and recommendation.

Thank you for the opportunity to comment on the draft. Depending on the extent to which the language in the final report is modified in view of these comments, DDS requests that these comments be included as an appendix to the final audit report.

Sincerely,

Douglas Willman
DDS Administrator

Appendix E
OIG Contacts and Staff Acknowledgments
OIG Contacts
Mark Bailey, Director, Kansas City Audit Division, (816) 936-5591
Ken Bennett, Information Technology Specialist, (816) 936-5593
Acknowledgments
In addition to those named above:
Doug Kelly, Auditor-in-Charge

For additional copies of this report, please visit our web site at www.socialsecurity.gov/oig or contact the Office of the Inspector General's Public Affairs Specialist at (410) 965-3218. Refer to Common Identification Number A-07-07-17170.

Overview of the Office of the Inspector General
The Office of the Inspector General (OIG) is comprised of an Office of Audit (OA), Office of Investigations (OI), Office of the Chief Counsel to the Inspector General (OCCIG), Office of External Relations (OER), and Office of Technology and Resource Management (OTRM). To ensure compliance with policies and procedures, internal controls, and professional standards, the OIG also has a comprehensive Professional Responsibility and Quality Assurance program.

Office of Audit
OA conducts financial and performance audits of the Social Security Administration's (SSA) programs and operations and makes recommendations to ensure program objectives are achieved effectively and efficiently. Financial audits assess whether SSA's financial statements fairly present SSA's financial position, results of operations, and cash flow. Performance audits review the economy, efficiency, and effectiveness of SSA's programs and operations. OA also conducts short-term management reviews and program evaluations on issues of concern to SSA, Congress, and the general public.

Office of Investigations
OI conducts investigations related to fraud, waste, abuse, and mismanagement in SSA programs and operations. This includes wrongdoing by applicants, beneficiaries, contractors, third parties, or SSA employees performing their official duties. This office serves as liaison to the Department of Justice on all matters relating to the investigation of SSA programs and personnel. OI also conducts joint investigations with other Federal, State, and local law enforcement agencies.

Office of the Counsel to the Inspector General
OCIG provides independent legal advice and counsel to the IG on various matters, including statutes, regulations, legislation, and policy directives. OCIG also advises the IG on investigative procedures and techniques, as well as on legal implications and conclusions to be drawn from audit and investigative material. Also, OCIG administers the Civil Monetary Penalty program.

Office of External Relations
OER manages OIG's external and public affairs programs, and serves as the principal advisor on news releases and in providing information to the various news reporting services. OER develops OIG's media and public information policies, directs OIG's external and public affairs programs, and serves as the primary contact for those seeking information about OIG. OER prepares OIG publications, speeches, and presentations to internal and external organizations, and responds to Congressional correspondence.

Office of Technology and Resource Management
OTRM supports OIG by providing information management and systems security. OTRM also coordinates OIG's budget, procurement, telecommunications, facilities, and human resources. In addition, OTRM is the focal point for OIG's strategic planning function, and the development and monitoring of performance measures. In addition, OTRM receives and assigns for action allegations of criminal and administrative violations of Social Security laws, identifies fugitives receiving benefit payments from SSA, and provides technological assistance to investigations.