Audit Of Athletics Health Services Billing And Collections .
Audit of Athletics Health ServicesBilling and Collections Processand Contract PerformanceReport No. 20/21-04November 10, 2020
Date:November 10, 2020To:Pete Garcia, Executive Director of Sports and EntertainmentFrom:Trevor L. Williams, Chief Audit ExecutiveSubject: Audit of Athletics Health Services Billing and Collections Process andContract Performance – Report No. 20/21-04We have completed an audit of Athletics Health Services Billing and CollectionsProcess and Contract Performance for the period of July 1, 2018, throughDecember 31, 2019. The primary objective of our audit was to determine if: a) internalmedical services provided to student-athletes are accurately and timely billed, collected,and recorded and b) services provided by the contracted claims billing company areeffective and compliant with the contractual agreement. We also evaluated relatedInformation Technology controls over the software system that connects to electronicmedical records and verified they were adequate and effective.The University hired Vivature, Inc., a third-party entity, to provide full-servicemanagement of its athletic health services claims billing and collection function. Basedon the Service Agreement, the company would receive a flat fee of 10,000 plus 25% ofcollections, annually. Since October 2016, total claims of 16,694 approximating 8.3million in billed charges were submitted, of which Athletics received approximately 210,100 in revenue. Since June 2014, when the contract became effective,approximately 112,500 of fees have accrued.Overall, our audit found that controls over the claims billing and collections process forinjuries to student-athletes need improvement. There are control gaps in the process ofmonitoring the contract revenue that is generated by this activity. Compliance with theterms of the Service Agreement also deserve focused attention. The audit resulted in 14recommendations, of which management has agreed to implement six. Management’sproposed corrective action for addressing the remaining eight recommendationsincludes terminating the contractual relationship between FIU Athletics and Vivature.We want to take this opportunity to express our appreciation to you and your staff for thecooperation and courtesies extended to us during the audit.AttachmentC: FIU Board of TrusteesMark B. Rosenberg, University PresidentKenneth G. Furton, Provost, Executive Vice President, and Chief Operating OfficerKenneth A. Jessell, Senior Vice President and Chief Financial OfficerJavier I. Marques, Vice President for Operations & Safety and Chief of Staff,Office of the PresidentJulie Berg-McGraw, Senior Associate Athletic DirectorHeath Glick, Senior Associate Athletic Director
TABLE OF CONTENTSPageGLOSSARY OF ABBREVIATIONS . 1OBJECTIVES, SCOPE, AND METHODOLOGY . 2BACKGROUND . 3Overview of the Billing and Collections Process . 4Financial Data . 7Personnel. 9OBSERVATIONS AND RECOMMENDATIONS . 10Areas Within the Scope of the Audit Tested Without Exception . 11Selected IT Controls . 11Audit Logs and Monitoring Information Disclosure . 11Backup Controls . 11Change Management . 12Segregation of Duties . 12Areas Within the Scope of the Audit Tested With Exception. 131. Billing and Collections . 13Student-Athlete Consent Forms . 13Check Log and Deposits . 14Claims Testing . 152. Compliance with the Contractual Agreement . 19Contract Compliance . 19Collections and Payments . 233. Information Technology Controls . 27User Access . 27Training and Awareness. 27Management Security Governance Oversight. 28Business Continuity Plan. 28APPENDIX I – COMPLEXITY RATINGS LEGEND . 31APPENDIX II – OIA CONTACT AND STAFF ACKNOWLEDGMENT . 32
GLOSSARY OF ABBREVIATIONSAT:Athletic TrainerBCP:Business Continuity PlanBKM:BKM Sowan Horan ConsultantCPT:Common Procedural Technology CodesDOS:Date of ServiceDRP:Disaster Recovery PlanEFT:Electronic Funds TransferEMR:Electronic Medical RecordEOB:Explanation of BenefitsFIU:Florida International UniversityGL:General LedgerHCN:HealthCare NetworkHIPAA:Health Insurance Portability and Accountability ActHITECH:Health Information Technology for Clinical and Economic Health ActIT:Information TechnologyNIST:National Institute of Standards and TechnologyOIA:Office of Internal AuditSOC:Service Organization ControlsPage 1 of 32
OBJECTIVES, SCOPE, AND METHODOLOGYPursuant to the Office of Internal Audit’s (OIA) approved annual audit plan for the 20192020 fiscal year, we have completed an audit of the Florida International University (FIUor “University”) Athletics Health Services Billing and Collections Process and ContractPerformance.The primary objective of our audit was to determine if established controls and procedureswere adequate to ensure that: a) internal medical services provided to student-athletesare accurately and timely billed, collected, and recorded; and b) services provided byVivature, Inc. 1 (Vivature) are effective and comply with the Services Agreement (the“Agreement”) entered into by Vivature and the University. We also evaluated relatedInformation Technology (IT) controls over the software system that connects to electronicmedical records and verified they were adequate and effective.The audit was conducted in conformance with the International Standards for theProfessional Practice of Internal Auditing promulgated by The Institute of Internal Auditorsand applicable Special Publications issued by the National Institute of Standards andTechnology (NIST). The audit included an assessment of internal controls within thecontext of the audit objectives and tests of the accounting records and such other auditingprocedures, as we considered necessary under the circumstances.In addition, our audit included an examination of claims billed, total billed charges,revenues, and expenses as of the Agreement’s effective date of June 20, 2014, withtransactional testing specifically for the audit period of July 1, 2018, through December31, 2019. Audit fieldwork was conducted from February 2020 to August 2020.During the audit, we observed current practices and processing techniques, interviewedresponsible personnel, and tested transactions for adherence to applicable Universitypolicies and procedures, Federal and State laws and regulations, and the terms of theAgreement. Sample sizes and transactions selected for testing were determined on ajudgmental basis applying a non-statistical sampling methodology.As part of our audit, we reviewed internal and external audit reports and found that noreports had been issued during the last three years with any applicable recommendationsrelated to the scope and objectives of this audit, which otherwise would have requiredfollow-up.1Vivature, Inc. is the contracted third-party entity that provides billing solutions for student-athletes andstudent health centers at FIU.Page 2 of 32
BACKGROUNDAccording to University literature, the mission of the Florida International University SportsMedicine Department (“Athletics” or “the department”) is to:“provide all student-athletes at Florida International University the highestquality medical care and safest environment in which to compete. To fulfillthis mission the sports medicine team will focus on education, prevention,assessment, treatment, and rehabilitation of athletic injuries and illnessesbecause we care to make a difference. In addition, we are dedicated toproviding a high-quality educational environment for the graduate studentsin the Florida International University Graduate Athletic Training Program tocreate a valuable clinical experience.”TheSportsMedicineteamcomprises 13 Certified AthleticTrainers (6 Staff and 7 GraduateAssistants), who are Board ofCertification (BOC) certified, holdState of Florida License, andCPR/AED Professional Rescuercertifications. The Athletic Trainers(AT) work under the supervision dicalPhysicians, Sports Psychologists,and Registered Dieticians to providea total team approach to eachathlete's care.The department uses state of the artpreventativeandrehabilitativetechniques to minimize injury riskand enhance recoverytime.Through consistent management ofathletic injuries and professional personal interactions with each student-athlete, theyprovide unique and quality health care services for 18 Division I competitive sports.On June 20, 2014, the University entered into an agreement with Vivature to provideathletic services for Athletics. The Contract and Proposal for FIU, included an Exhibit A Services document and the First Amendment, effective on February 15, 2016,(collectively “the Agreement”).Vivature is owned by Orchestrate HR, Inc., a full-service Human Resource vendorheadquartered in Dallas, Texas. The company operates primarily as an employeebenefits broker, third party administrator, managing general underwriter, humanresources outsourcer, athletic department solutions, athletic insurance billing solutionsPage 3 of 32
and payroll processing provider that enables companies of all sizes to focus on their corecompetencies.Vivature offers a variety of service packages to its customers. Athletics selected theCompany’s Platinum-Ath service level package, which includes: NExTT Injury Management System Software (“Blue Ocean” or “the system”)Annual on-boarding of all paperwork and additions of new athletesMonthly Verification of insuranceTwo NExTT Kiosk Hardware UnitsHealthcare Reform Enrollment ServicesBilling ServicesOne iPadThe NExTT Electronic Medical Record (EMR) Athletic software is a web-basedapplication. The EMR software platform enables the Athletic Trainers to document all theinjuries and treatments performed on the student-athletes. Once the information is in thesoftware, it documents, tracks, and reports solutions for billing, claims discounting,verification of insurance, and utilization of injury tracking.Part of the billing services to be provided by Vivature, per the Agreement, includes claimsadjudication for physical therapy services provided to the student-athletes. TheAgreement states that “Vivature will recover potential third party billing revenue for theUniversity using tested, proven software, experienced billing personnel, effective qualityassurance procedures, assertive collections techniques, and careful tracking of individualclaims through the billing system.” FIU’s “Go Live Date” for billing services, which is thefirst day whereby Vivature submitted an encounter form to a health benefit plan, wasOctober 1, 2016.The annual fee for these services is 10,000, in addition to a monthly fee of 25 percentof collections received for the insurance billing and related services performed asdescribed above.Overview of the Billing and Collections ProcessWhen a student-athlete is injured and seen internally, the Athletic Trainer determines theappropriate diagnosis code and treatment plan based on the injury. This information,along with student demographics, insurance data, and other notes related to the injuryare processed in Blue Ocean. All diagnoses and treatment plans are reviewed andelectronically signed off by the Athletics Team Orthopedic Physician, who is also listed asthe provider for all claims submitted by Athletics.Vivature then captures this information from the system, performs “built-in” analysis todetermine if a billable service was provided, and electronically submits the claim to aclearinghouse for “scrubbing.” The clearinghouse sends an acknowledgment (a claimresponse) and if the claim is “clean,” it is electronically submitted to the respectivePage 4 of 32
insurance company for billing. If not “clean,” then the acknowledgment is reviewed todetermine and correct the triggering issue and the claim is resubmitted, if applicable.All related claim correspondence (i.e., acknowledgments, Explanation of Benefits (EOB),remit advices, etc.) is usually sent to the address on file with the insurance company,which is typically established when managed care contracts and rates are negotiated.Athletics utilizes the managed care contracts and rates that were negotiated by the FIUHealthCare Network (HCN). Because health care services and billing are also performedby HCN, as well as other departments at the University, claim correspondence andrelated payments by the insurance company can be sent to several different addresseson campus. Thus, Athletics instituted a process in which they pick up all Athletics-relatedclaim correspondence from HCN and log all checks received. These correspondencesare usually identified based on the provider’s name and/or procedures performed (i.e.,diagnosis codes specifically related to physical therapy treatment, which is not performedat HCN). Athletics deposits all checks received and sends all other correspondence toVivature for further review and processing. HCN can also receive electronic funds transfer(EFT) payments for Athletics-related claims, which they identify and transfer to Athletics.Once Vivature receives the correspondence, they are responsible for utilizing best effortsto ensure claims are timely reworked and resubmitted, as applicable.Page 5 of 32
The flowchart below (Figure 1) provides a high-level overview of the billing and collectionsprocess.Page 6 of 32
Financial DataSince 2016, a total of 16,694 claims, totaling approximately 8.3 million in billed chargeswere submitted, according to information obtained from Vivature. During the same period,Athletics has received approximately 210,100 in revenues on the total claims billed,according to entries in the General Ledger and Athletics Check Log.The following table provides a summary of the total claims billed by year, including totalbilled charges, expected revenues, revenues received, and percent of revenues earned.Table 1: Billed Claims and Revenue By YearYearTotal Claims Total ed% of RevenuesReceived to TotalBilled Charges20162017201820192,5974,7094,4384,950 1,281,3312,418,4702,362,2232,243,565 141,074266,274260,081247,016 100,91456,32852,8530%4%2%2%Total16,694 8,305,589 914,445 210,0953%* Estimated by Vivature at 11.01% of total billed charges.Based on the Agreement, approximately 112,500 associated fees have accrued (seeTable 2). Contract fee comprises an annual amount of 10,000 for hardware and softwarefor the injury management system and other services provided by Vivature, in addition to25% of collections for billing services. The annual fee began accruing as of June 2014,when the contract became effective, whereas the fee on collections began accruing as ofOctober 2016, when billing services commenced.Table 2: Associated Fees by yearYear201420152016201720182019TotalAnnualFee 10,00010,00010,00010,00010,00010,00025% ofCollections 25,22914,08213,213 60,000 52,524Page 7 of 32Total 10,00010,00010,00035,22924,08223,213 112,524
The graphs below (Figure 2) depict total billed charges by insurance provider. Asdepicted, the total billed charges for claims submitted to United HealthCare, BlueCross,CIGNA and Aetna health plans were approximately 4.2 million, representing about 51percent of the total billed charges.Page 8 of 32
PersonnelBelow is the organizational structure for the Sports Medicine Department, including otherpersonnel that are involved in the injury, treatment, or billing processes for studentathletes.Athletic Director and ExecutiveDirector of Sports andEntertainmentDirector of Finance & AccountingAccountant CoordinatorSenior Associate AthleticDirectorAssistant Athletic Director - HeadAthletic TrainerInsuranceCoordinatorAssociate HeadAthletic TrainerAssistant AthleticTrainer / NutritionistAssistant AthleticTrainersGraduate AssistantAthletics Trainers /InternsPage 9 of 32
OBSERVATIONS AND RECOMMENDATIONSOur overall assessment of internal control is presented in the table below. In summarywe noted that, controls over the claims billing and collections process for injuries tostudent-athlete needs improvement related to the process for monitoring the revenueproduction cycle and contract compliance, among others. The areas tested during theaudit and our observations and recommendations are detailed on the following pages.CRITERIAProcess ControlsPolicy & ProceduresComplianceEffectInformation RiskExternal RiskSATISFACTORYOPPORTUNITIESTO IMPROVEINADEQUATEXXXXXINTERNAL CONTROLS LEGENDCRITERIASATISFACTORYOPPORTUNITIESTO IMPROVEINADEQUATEEffectiveOpportunities existto improveeffectivenessDo not exist or are notreliableNon-complianceissues are minorNon-complianceissues may besystematicNon-complianceissues are pervasive,significant, or havesevere consequencesNot likely to impactoperations or programoutcomesImpact on outcomescontainedNegative impact onoutcomesInformation systemsare reliableData systems aremostly accurate butneed to be improvedSystems produceincomplete orinaccurate data whichmay causeinappropriate financialand operationaldecisionsNone or lowPotential for damageSevere risk of damageProcess Controls(Activities established mainlythrough policies andprocedures to ensure thatrisks are mitigated, andobjectives are achieved.)Policy & ProceduresCompliance(The degree of compliancewith process controls –policies and procedures.)Effect(The potential negativeimpact to the operationsfinancial, reputational, social,etc.)Information Risk(The risk that informationupon which a businessdecision is made isinaccurate.)External Risk(Risks arising from eventsoutside of the organization’scontrol; e.g., political, legal,social, cybersecurity,economic, environment.)Page 10 of 32
Areas Within the Scope of the Audit Tested Without Exception:Selected IT ControlsAs previously mentioned, Athletics medical billing function is executed through Vivature’sNExTT EMR application. To determine whether key IT controls were in place, werequested that Athletics provide us with a copy of any Service Organization Cont
provide unique and quality health care services for 18 Division I competitive sports. On June 20, 2014, the University entered into an agreement with Vivature to provide athletic services for Athletics. The Contract and Proposal for FIU, included an Exhibit A - Services document and the First Amendment, effective on February 15, 2016,
The quality audit system is mainly classified in three different categories: i Internal Audit ii. External Audits iii. Regulatory Audit . Types Of Quality Audit. In food industries all three audit system may be used to carry out 1. Product manufacturing audit 2. Plant sanitation/GMP audit 3. Product Quality audit 4. HACCP audit
The Jandakot Airport Track Classic . Saturday 1st February 2020 . Western Australia Athletics Stadium . Technical Rules of Competition . This competition will be conducted in accordance with the rules/regulations of World Athletics, Oceania Athletics Association and Athletics Australia. VENUE. The competition will be held at WA Athletics .
INTERNAL AUDIT Example –Internal audit report [Short Client Name] Internal Audit Report Rev. [Rev Number] STEP ONE: Audit Plan Process to Audit (Audit Scope): Audit Date(s): Lead Auditor: Audit #: Auditor(s): Site(s) to Audit: Applicable Clauses of [ISO 9001 or AS9100] S
4.1 Quality management system audit 9.2.2.2 Quality management system audit - except: organization shall audit to verify compliance with MAQMSR, 2nd Ed. 4.2 Manufacturing process audit 9.2.2.3 Manufacturing process audit 4.3 Product audit 9.2.2.4 Product audit 4.4 Internal audit plans 9.2.2.1 Internal audit programme
The athletics games will provide children with the opportunity to make the most of the beneficial practice of Athletics, in terms of Health, Education, and Self-fulfillment. 2.1 Objectives These are the organisational objectives of the concept of "IAAF KIDS' ATHLETICS": That a large number of children can be active at the same time
CHAPTER 12 Internal Audit Charters and Building the Internal Audit Function 273 12.1 Establishing an Internal Audit Function 274 12.2 Audit Charter: Audit Committee and Management Authority 274 12.3 Building the Internal Audit Staff 275 (a) Role of the CAE 277 (b) Internal Audit Management Responsibilities 278 (c) Internal Audit Staff .
Internal Audit Boot Camp Session 2: Phases of an Audit Program . IA Boot Camp 03/17/21 National Indian Gaming Commission Page 17 of 26 . It is important to understand and include audit steps within your audit program. Audit steps can be updated and created during the planning phase. Audit steps provide the auditor with the proper guidance to
AUDIT OF DEKALB COUNTY DATA CENTER PHYSICAL SECURITY AUDIT REPORT NO. 2018-007-IT John Greene Chief Audit Executive FINAL REPORT What We Did In accordance with the Office of Independent Internal Audit's (OIIA) Annual Audit Plan, we conducted a performance audit of the DeKalb County Data Center Physical Security.
