Audit 415399

Criteria: Medicaid for Aged, Blind and Disabled case records should contain documentation that verifications were done in preparation of the application/recertification and these items will agree to reports in the NC FAST system. In this process, documentation should be present and agree back to the records in the NC FAST system. Any items discovered in the process should be considered in regards to a specific eligibility requirement and explained within the documentation. Condition: There was one (1) technical error discovered during our procedures that verifications in the County documentation and the representative data contained in NC FAST were not the same amounts or files containing policy requirements were not properly documented to be considered in compliance with program control requirements. The error was as follows: Household composition was keyed incorrectly into NC FAST, resulting in countable income being calculated incorrectly for the participant in NC FAST. No QCs, as this error did not result in the participant receiving a greater or lesser benefit. Context: We examined 120 Medicaid applicants to re-determine eligibility. These findings were disclosed in a separately issued spreadsheet to the North Carolina Department of Health and Human Services and are being reported with the financial statement audit as it relates to Medicaid administrative cost compliance audit. Effect: Medicaid benefits are dependent on a variety of factors, some of which include: number of household members, age of household members, and total countable income for the household. Consequently, household composition being keyed incorrectly into NC FAST could result in a participant having been approved for benefits for which they were not eligible. Cause: Participant information was entered incorrectly into NC FAST. Recommendation: Upon being entered into NC FAST, participant information should be scanned and reviewed to ensure accuracy.

Criteria: The State of North Carolina’s information and information systems are valuable assets that must be protected. Each information asset must be evaluated and classified with protective controls assigned that are commensurate to its established value. Appropriate security measures, including policies and procedures, must be in place to protect all information assets from accidental or unauthorized use, theft, modification, destruction, and to prevent the unauthorized disclosure of restricted information. These measures must ensure the confidentiality (as applicable), integrity, and availability of information assets. Each County DSS Agency, through its management, is required to protect and secure the information assets under its control. Condition: There were multiple instances noted during our procedures in which confidential participant information was not properly protected and secured to prevent unauthorized use, modification, and theft. The instances were as follows: Personal computers of caseworkers were left unattended while showing confidential participant information. Context: While on-site at DSS, we performed walkthroughs through 5-10 offices, those of which were vacant at the present time, to ensure the personal computers in those offices left unattended were either locked or logged out, and not showing participant information. Effect: Personal computers of caseworkers contain confidential information for respective participants. Improper security and protection of this information could result in unauthorized use, modification, and theft- potentially leading to negative consequences for the participant. Cause: Employees being preoccupied with daily job responsibilities; general human nature. Recommendation: When leaving personal computers unattended, double-check to make sure computer is either locked or logged off.