Office of the Auditor General
Performance Audit Report

Prisoner Medical, Dental, and Optical Services
Department of Corrections

July 2015

471-0300-14

State of Michigan Auditor General
Doug A. Ringler, CPA, CIA

The auditor general shall conduct post audits of financial
transactions and accounts of the state and of all branches,
departments, offices, boards, commissions, agencies,
authorities and institutions of the state established by this
constitution or by law, and performance post audits thereof.
Article IV, Section 53 of the Michigan Constitution

Report Summary
Performance Audit
Prisoner Medical, Dental, and Optical
Services
Department of Corrections

Report Number:
471-0300-14
Released:
July 2015

The Bureau of Health Care Services (BHCS), Department of Corrections (DOC), is
responsible for coordinating medical, dental, and optical services to approximately
45,000 prisoners in 33 correctional facilities. These services are provided through a
network of outpatient clinics operated at correctional facilities and through a managed
health care system for off-site services.

Audit Objective
Objective #1: To assess the effectiveness of BHCS's efforts to provide medical,
dental, and optical services.

Conclusion
Moderately effective

Reportable
Condition

Agency
Preliminary
Response

DOC did not ensure that its medical providers
conducted all chronic care condition medical
assessments timely and documented them consistently.
DOC may have jeopardized its ability to manage and
treat potentially serious medical conditions before they
became more severe and costly (Finding #1).

X

Agrees

DOC did not consistently charge required prisoner
copayments relating to medical, dental, and optical
services. DOC did not charge prisoner copayments for
57% of the health care visits (Finding #2).

X

Agrees

Findings Related to This Audit Objective

Material
Condition

Audit Objective
Objective #2: To assess the effectiveness of DOC's efforts to monitor its health care
vendor's compliance with selected contract requirements.

Conclusion
Moderately effective

Reportable
Condition

Agency
Preliminary
Response

DOC did not monitor the managed health care vendor's
compliance with service level agreement (SLA)
performance requirements timely. Performance issues
were not corrected timely and others may not have been
identified timely, potentially impacting the proper
management of prisoner health care (Finding #3).

X

Agrees

DOC needs to improve its process to verify the accuracy
and validity of prisoner health care costs for off-site
services. DOC paid $1.7 million for invalid prisoner
health care charges for off-site services (Finding #4).

X

Agrees

Findings Related to This Audit Objective

Material
Condition

Audit Objective
Objective #3: To assess the effectiveness of DOC's efforts to ensure the
completeness, accuracy, and security of the electronic medical records (EMR) system
related to medical, dental, and optical services.
Findings Related to This Audit Objective
DOC had not established effective user access controls
over the EMR system and could not ensure that the
EMR data was protected from unauthorized
modification or disclosure. Twelve users had
unnecessary access to prisoner medical records for up to
six months (Finding #5).

A copy of the full report can be
obtained by calling 517.334.8050
or by visiting our Web site at:
http://audgen.michigan.gov

Material
Condition

Conclusion
Moderately effective

Reportable
Condition

Agency
Preliminary
Response

X

Agrees

Office of the Auditor General
201 N. Washington Square, Sixth Floor
Lansing, Michigan 48913
Doug A. Ringler, CPA, CIA
Auditor General
Laura J. Hirst, CPA
Deputy Auditor General

Doug A. Ringler, CPA, CIA
Auditor General
201 N. Washington Square, Sixth Floor • Lansing, Michigan 48913 • Phone: (517) 334-8050 • http://audgen.michigan.gov

July 2, 2015

Ms. Heidi E. Washington, Director
Department of Corrections
Grandview Plaza Building
Lansing, Michigan
Dear Ms. Washington:
I am pleased to provide this performance audit report on Prisoner Medical, Dental, and Optical
Services, Department of Corrections.
We organize our findings and observations by audit objective. Your agency provided
preliminary responses to the recommendations at the end of our fieldwork. The Michigan
Compiled Laws and administrative procedures require an audited agency to develop a plan to
comply with the recommendations and submit it within 60 days of the date above to the Office of
Internal Audit Services, State Budget Office. Within 30 days of receipt, the Office of Internal
Audit Services is required to review the plan and either accept the plan as final or contact the
agency to take additional steps to finalize the plan.
We appreciate the courtesy and cooperation extended to us during this audit.
Sincerely,

Doug Ringler
Auditor General

Michigan Office of the Auditor General
471-0300-14

This Page Left Intentionally Blank

Michigan Office of the Auditor General
471-0300-14

4

TABLE OF CONTENTS

PRISONER MEDICAL, DENTAL, AND OPTICAL SERVICES

Page
Report Summary

1

Audit Objectives, Conclusions, Findings, and Observations
Providing Medical, Dental, and Optical Services
1. Improvements needed for timely completion and consistent
documentation of chronic care condition medical assessments.
2. Inconsistently charging copayments.
Monitoring the Health Care Vendor

8
9
12
14

3. Improvements needed over monitoring performance of the managed
health care vendor.

15

4. Improvements needed to verify the accuracy and validity of off-site
service charges.

18

Ensuring the Completeness, Accuracy, and Security of the EMR System
5. User access controls over the EMR system need improvement.

20
21

Supplemental Information
Exhibit 1 - Average Annual Health Care Expenditures Per Prisoner

23

Exhibit 2 - Cumulative Percentage Change in Health Care Expenditures Per
Prisoner and Medical Care Consumer Price Index

24

Services Description

25

Audit Scope, Methodology, and Other Information

26

Glossary of Abbreviations and Terms

30

Michigan Office of the Auditor General
471-0300-14

5

This Page Left Intentionally Blank

Michigan Office of the Auditor General
471-0300-14

6

AUDIT OBJECTIVES, CONCLUSIONS,
FINDINGS, AND OBSERVATIONS

Michigan Office of the Auditor General
471-0300-14

7

PROVIDING MEDICAL, DENTAL, AND OPTICAL SERVICES
BACKGROUND

The Bureau of Health Care Services (BHCS) is responsible for
coordinating medical, dental, and optical services to
approximately 45,000 prisoners in 33 correctional facilities.
These services are provided through a network of outpatient
clinics operated at the correctional facilities and through a
managed health care system for off-site services.
Approximately 17,700 prisoners, 39.3% of the prison
population, had at least one medical assessment for a chronic
care condition* during the period October 1, 2013 through
April 30, 2014.
According to the Michigan Compiled Laws and the Department
of Corrections (DOC) policy directive, DOC prisoners who
request and receive nonemergency medical, dental, or optical
services are generally responsible for a $5.00 copayment.
According to the policy, DOC will charge the copayment to the
prisoner's account regardless of the prisoner's ability to pay.
DOC collected approximately $479,000 in copayments for
eligible medical, dental, and optical services for the period
October 2011 through April 2014.

AUDIT OBJECTIVE

To assess the effectiveness* of BHCS's efforts to provide
medical, dental, and optical services.

CONCLUSION

Moderately effective.

FACTORS
IMPACTING
CONCLUSION

•

BHCS's medical providers completed annual health
screenings, medical screenings upon transfer to a different
facility, and follow-up care for off-site services timely.

•

BHCS responded to prisoner requests for medical, dental,
and optical services timely and appropriately.

•

DOC collected approximately $479,000 in copayments for
eligible medical, dental, and optical services, which is
approximately the same level of collection identified in the
prior audit.

•

Reportable condition* related to the timely completion and
consistent documentation of chronic care condition medical
assessments.

•

Reportable condition related to DOC not charging
copayments for 57.1% of the health care visits.

* See glossary at end of report for definition.

Michigan Office of the Auditor General
471-0300-14

8

FINDING #1
Improvements are
needed to timely
complete and
consistently
document chronic
care condition
medical
assessments.

DOC did not ensure that its medical providers* conducted all
chronic care condition medical assessments timely and
documented them consistently. DOC may have jeopardized its
ability to manage and treat potentially serious medical
conditions before they became more severe and costly.
DOC's contract with its managed health care vendor requires
that medical providers assess prisoners with chronic care
conditions every month, three months, or six months if their last
assessed level of control was poor, fair, or good, respectively.
Also, for prisoners with multiple chronic care conditions, the
contract requires that medical providers assess those prisoners
based on the condition with the least level of control and
assess and document the prisoner's level of control for every
chronic care condition in the electronic medical record (EMR)
system. In addition, DOC requires that medical providers
annually assess all prisoners with chronic care conditions in
their birth month.
DOC could not provide a facility-specific listing of all prisoners
who had at least one chronic care condition at any point in time
and, therefore, could not ensure that all prisoners with chronic
care conditions received the necessary medical treatment.
Staff at the 8 correctional facilities that we contacted informed
us that they manually track prisoners with chronic care
conditions because they were not able to identify these
prisoners from the EMR system.
We reviewed the EMR system for 100 randomly selected
prisoners from a listing of approximately 17,700 prisoners who
had at least one medical assessment for a chronic care
condition during the period October 1, 2013 through April 30,
2014. DOC completed 543 chronic care condition medical
assessments (386 routine and 157 annual) for these 100
prisoners during this time period. We noted that the medical
providers did not:
a. Complete 109 (28.2%) of the 386 routine assessments
timely, averaging 28 days late and ranging from 1 to
225 days late.

22% of the chronic
care condition medical
assessments not
completed timely.

b. Complete 13 (8.3%) of the 157 annual assessments
timely, averaging 69 days late and ranging from 1 to
288 days late.
c. Document the prisoner's level of control for every
chronic care condition for 151 (27.8%) of the 543
completed chronic care condition medical assessments
and, therefore, could not ensure the timeliness of the
subsequent assessment.

* See glossary at end of report for definition.

Michigan Office of the Auditor General
471-0300-14

9

d. Document the prisoner's previous level of control for
23 (6.0%) of the 386 routine assessments and,
therefore, could not ensure the timeliness of the
subsequent assessment.
e. Update the prisoner's history for 144 (26.5%) of the 543
completed chronic care visits.
f.

Correctly identify 42 (7.7%) visits as non-chronic care
visits.

g. Correctly identify 74 (12.0%) visits as chronic care
visits.
DOC explained that reasons for the delays in completing
chronic care condition medical assessments may include
overbooking the medical provider's schedule, errors in
scheduling the next visit, prisoner transfers, and inaccurate or
incomplete documentation in the EMR system. Also, according
to staff at the 8 correctional facilities we contacted, the
requirement to assess all of the prisoner's chronic care
conditions at each visit was not always enforced.
We noted a similar condition related to the timeliness of chronic
care condition medical assessments in our prior audit. DOC
indicated that it agreed with the recommendation and was
undertaking several efforts to improve the scheduling and
timeliness of chronic care condition services, including
incorporating a new EMR system with the ability to run
exception reports on the timeliness of chronic care condition
visits. During this audit, DOC indicated that there have been
delays in creating the exception reports in the EMR system and
the expected completion date is December 2015.
RECOMMENDATIONS

We recommend that DOC improve its processes to ensure
timely completion of all chronic care condition medical
assessments.
We also recommend that DOC ensure that medical providers
consistently document medical assessments for prisoners with
chronic care conditions.

AGENCY
PRELIMINARY
RESPONSE

Michigan Office of the Auditor General
471-0300-14

DOC provided us with the following response:
DOC agrees with the recommendations and has taken steps to
comply. DOC implemented a chronic care project in the
Southern region facilities that focused on appropriately
scheduling chronic care patients according to their level of
control, defining and training providers on the documentation
needed for chronic care patients, illustrating the role of nursing
in the chronic care process, and showing staff how to utilize
some existing scheduling reports available in the EMR system

10

to monitor and track chronic care patients. This project has
been completed, and the lessons learned from it will be
implemented on a Statewide basis. DOC will also train staff on
new exception reports once they become available in the EMR
system.
DOC will also be forming a clinical workgroup that will evaluate
the current chronic care time frames and level of control
guidelines that are part of the managed care contract. This
workgroup will evaluate whether there is a need to change
those guidelines and will develop a communication plan so that
the information regarding chronic care treatment is
disseminated to DOC staff and contracted medical providers.

Michigan Office of the Auditor General
471-0300-14

11

FINDING #2
Improvements are
needed to
consistently charge
prisoner
copayments.

DOC did not consistently charge required prisoner copayments
relating to medical, dental, and optical services. This practice
could lead to excessive requests for medical, dental, and
optical services, creating unnecessary work for health care
staff and unnecessary health care costs for DOC.
Section 791.267a of the Michigan Compiled Laws requires that
a prisoner who receives nonemergency medical, dental, or
optical services at his or her request is responsible for a
copayment. Also, DOC policy directive 03.04.101 requires that
a prisoner shall be charged, regardless of the prisoner's ability
to pay, a $5.00 copayment for each health care visit, except
under certain circumstances.
DOC maintains accounts on behalf of its prisoners. Prisoners
can use their funds to purchase personal items, pay
court-ordered debt or restitution, and pay for medical
copayments. According to DOC's records from August 2014,
the average prisoner balance in the prisoner accounts was
approximately $78.00. A $5.00 copayment would reduce the
prisoner account balance by approximately 6.4%.

DOC did not charge
prisoner copayments
for 57% of the health
care visits.

We randomly selected 100 prisoners incarcerated as of
April 30, 2014. For each of these prisoners, we randomly
selected and tested up to 2 prisoner-initiated requests for
medical, dental, and optical services that resulted in a health
care visit during our audit period and that required a
copayment in accordance with DOC's policy. We determined
that DOC did not charge copayments for 48 (57.1%) of the
84 health care visits, consisting of 19 medical, 27 dental, and
2 optical appointments.
DOC explained that the primary reasons that it did not charge
copayments for these 48 visits was because:
a. It did not interpret the copayment law as applying to
urgent dental visits.
b. It directed the correctional facilities to not charge a
copayment for dental visits that did not include a
complete dental examination or for a dental cleaning if
the patient had already had a dental cleaning in the
past year.
c. Health care staff did not forward the appropriate
paperwork to the business office for billing.
We noted a similar condition related to DOC not consistently
charging prisoner copayments in our prior audit. DOC
indicated that it agreed with the recommendation and had
implemented various compliance measures.

Michigan Office of the Auditor General
471-0300-14

12

RECOMMENDATION

We again recommend that DOC consistently charge prisoner
copayments relating to medical, dental, and optical services.

AGENCY
PRELIMINARY
RESPONSE

DOC provided us with the following response:

Michigan Office of the Auditor General
471-0300-14

DOC agrees with the recommendation and has taken steps to
comply. DOC already issued a memorandum to appropriate
staff to clarify requirements concerning dental visits and also
plans to send a memorandum to staff reiterating the
requirements contained in the Prisoner Health Care
Copayment Policy Directive 3.04.101. In addition, DOC will
develop an audit tool and administer it on a semi-annual basis
using a random sample to monitor that copayments are
consistently charged. Facilities found noncompliant will receive
further instruction from the Assistant Health Service
Administrators. Facilities that fell below a certain compliance
threshold will also be re-audited three months after the initial
audit.

13

MONITORING THE HEALTH CARE VENDOR
BACKGROUND

DOC contracts with a private vendor to provide a Statewide
managed health care system for off-site services and to
provide medical providers, including physicians, physician
assistants, and nurse practitioners, for on-site services. DOC
reimburses the managed health care vendor for these services
based on a fixed per prisoner, per month rate, adjusted to
reflect actual costs. DOC paid its managed health care vendor
$108.4 million and $68.8 million for on-site and off-site
services, respectively, for the period October 2011 through
April 2014.
DOC assigned the responsibility for monitoring the financial
aspects of the managed health care contract to its Bureau of
Fiscal Management and the responsibility for monitoring the
service delivery aspects to BHCS.

AUDIT OBJECTIVE

To assess the effectiveness of DOC's efforts to monitor its
health care vendor's compliance with selected contract
requirements.

CONCLUSION

Moderately effective.

FACTORS
IMPACTING
CONCLUSION

•

DOC and the managed health care vendor met on a regular
basis to discuss performance issues. In addition, DOC
regularly monitored the vendor's performance by reviewing
various reports. Examples of information in these reports
include provider schedules, waiting times, appointment
backlogs, and utilization rates.

•

DOC completed 8 service level agreement (SLA) audits,
identified instances of noncompliance with the contract, and
collected $357,000 in penalties from the managed health
care vendor.

•

Reportable condition related to DOC not completing SLA
audits timely.

•

Reportable condition related to DOC not having a process
to verify the accuracy and validity of the vendor's prisoner
health care charges.

Michigan Office of the Auditor General
471-0300-14

14

FINDING #3
Improvements are
needed to managed
health care vendor
monitoring.

DOC completed only
50% of the required
SLA audits of its
managed health care
vendor.

DOC did not monitor the managed health care vendor's
compliance with SLA performance requirements timely. The
managed health care vendor did not correct identified SLA
performance issues timely, and DOC may not have identified
additional SLA performance issues to ensure that prisoner
health care was managed appropriately.
DOC's managed health care contract clearly defines processes
and measurable outcomes* to monitor and resolve
performance issues, including 12 SLA requirements, to be
reviewed and audited annually. DOC informed us that it audits
3 of the 12 SLA requirements each quarter and that it
considers content and timeliness of medical provider
appointments, chronic care condition medical assessments,
and specialty services as critical SLA requirements. Also, the
contract requires that the vendor provide a written corrective
action plan (CAP) within 15 days of the completion of the SLA
audit and pay an assessment when the vendor does not meet
the SLA requirements. In addition, the contract requires DOC's
quarterly audits to include any SLA requirement that was
noncompliant in the previous quarter and, if still noncompliant,
the penalty amount shall be double. Although DOC had not
established any time frames within which to complete the SLA
audits and issue the reports, we estimated that, in order for
DOC to effectively monitor the SLA requirements and allow the
vendor sufficient time to implement corrective action, a period
of 180 days would be reasonable.
DOC indicated that its practice is to share preliminary audit
findings with the vendor for discussion purposes, prior to
issuing a final SLA audit report. We reviewed the timeliness of

* See glossary at end of report for definition.

Michigan Office of the Auditor General
471-0300-14

15

DOC's completion of the 16 quarterly SLA audits required from
the inception of the contract in February 2009 through April 30,
2014:

Number of Days From End of SLA Quarter Until:

Notes

Preliminary Findings
Shared With the
Vendor (a)

Final SLA Audit
Report Completed
or April 30, 2014

Final SLA Audit
Report Completed
Less the 180 Days
or April 30, 2014

June 30, 2010

(b)(c)

188

309

129

September 30, 2010

(b)(c)

201

329

149

End of SLA Quarter

December 31, 2010

(c)

213

299

119

March 31, 2011

(d)

Unknown

242

62

June 30, 2011

(b)(c)

440

945

765

September 30, 2011

(b)(e)

578

943

763

794

814

634

(e)

703

760

580

June 30, 2012

(b)(e)

872

669

489

September 30, 2012

(b)(e)

Not Available

577

397

December 31, 2011
March 31, 2012

December 31, 2012

428

448

268

(e)

338

395

215

June 30, 2013

(b)(e)

507

304

124

September 30, 2013

(b)(e)

Not Available

212

32

March 31, 2013

December 31, 2013
March 31, 2014

(f)
(f)(g)

63

83

Not Applicable

(27)

30

Not Applicable

Notes:
(a) Information was provided by DOC, unaudited.
(b)   Audit includes critical SLA requirements.
(c)   SLA audit results required the vendor to submit a CAP.
(d)   DOC could not provide data.
(e)   Not complete - SLA audit still in process as of April 30, 2014.
(f)

Not applicable because the date is less than 180 days before April 30, 2014.

(g) Number is negative because the information was shared with the vendor prior to the end of the
SLA quarter.

Also, DOC identified noncompliance in 4 of the SLA audits,
requiring the vendor to submit a CAP and DOC to audit those
SLA requirements in the following quarter. DOC received 3 of
the 4 CAPs timely; however, it received the fourth CAP 167
days late. Also, DOC did not obtain support that the vendor
implemented the corrective action proposed in any of the 4
CAPs and did not audit the noncompliant SLA requirements in
the subsequent audits.
Michigan Office of the Auditor General
471-0300-14

16

RECOMMENDATION

We recommend that DOC monitor the managed health care
vendor's compliance with SLA performance requirements
timely.

AGENCY
PRELIMINARY
RESPONSE

DOC provided us with the following response:
DOC agrees with the recommendation and has taken steps to
comply.
DOC acknowledges that the SLA audits have not been
completed timely and has simplified the current audit tools to
make it easier and more efficient for the audit team to collect
data for each of the SLAs. Teams have also been assigned
with dedicated time to complete the remaining audits that are
behind schedule. Additionally, DOC has developed a tracking
system to help ensure that all components of the SLA audit
process are completed on time. The system will record when
the audit findings were sent to the vendor, when the corrective
action plans were submitted by the vendor, and when the
corrective action plan is due so that it can be monitored as part
of the regular contract meetings with the vendor. The tracking
system will also identify any noncompliant SLA requirements
that need to be re-audited. DOC will implement the re-audit
process during the remaining SLA audits.
DOC also feels it important to note that it is currently working
on a Request for Proposal covering health care services that
will restructure SLA audits to improve monitoring of contractor
performance. The SLAs will list Key Performance Indicators
that will be assessed to ensure that service goals drive
continuous improvement and efficiency.

Michigan Office of the Auditor General
471-0300-14

17

FINDING #4
Improvements are
needed to verify the
accuracy and
validity of off-site
service charges.

DOC paid $1.7 million
for off-site services
for 349 released or
paroled prisoners.

DOC needs to improve its process to verify the accuracy and
validity of prisoner health care costs for off-site services
charged by the managed health care vendor. DOC paid
$1.7 million for invalid prisoner health care charges for off-site
services.
DOC provides health care services to prisoners in accordance
with court decisions, legislation, correctional and health care
standards, and policies and procedures. Properly monitoring
health care charges could assist DOC in controlling health care
costs.
The Bureau of Fiscal Management monitored and reconciled
billings, monitored cost fluctuations, and ensured timely
payments to the vendor. However, our review of DOC's
records of vendor charges for off-site services provided during
the period October 2011 through April 2014 and the prisoner's
status in DOC's Offender Management Network Information
System (OMNI) noted that DOC inappropriately paid $1.7
million for 349 prisoners who had been released or paroled
prior to the date of the medical visit.
Also, in October 2010, a third party one-time review of the
claims paid by DOC for off-site services noted the potential for
the payment of off-site claims for prisoners who were not
incarcerated as of the date of service. DOC had not developed
a process to verify the accuracy and validity of the charges in
response to this review.
We noted a similar condition related to DOC's monitoring of
off-site services in our prior audit. DOC indicated that it agreed
and had taken steps to comply.

RECOMMENDATION

We recommend that DOC improve its process to verify the
accuracy and validity of the prisoner health care costs for
off-site services charged by the managed health care vendor.

AGENCY
PRELIMINARY
RESPONSE

DOC provided us with the following response:
DOC agrees with the recommendation and is currently working
with the managed health care vendor to review all off-site
service charges for the entire contract period to ensure the
accuracy of those charges. The vendor is working with its
subcontractor to recoup the monies that were paid for invalid
prisoner health care charges.
DOC has also worked with the vendor to ensure that it is
utilizing the daily census file to validate its off-site claims to
ensure the accuracy of claim payments. In addition, the
Bureau of Fiscal Management is developing a monthly process
to verify the accuracy and validity of the vendor's charges by

Michigan Office of the Auditor General
471-0300-14

18

sampling off-site claims to ensure that claims were not paid for
prisoners who were no longer under the jurisdiction of DOC.
Additionally, DOC has strengthened the language related to
claims payment and processing in the new Request for
Proposal covering health care services.

Michigan Office of the Auditor General
471-0300-14

19

ENSURING THE COMPLETENESS, ACCURACY, AND SECURITY OF
THE EMR SYSTEM
BACKGROUND

DOC uses an EMR system to document health care services
provided to prisoners. The EMR system is designed to
accurately represent current medical information of the
prisoners, including personal statistics such as age and weight,
demographics, medical history, medication and allergies,
immunization status, laboratory test results, radiology images,
and vital signs.

AUDIT OBJECTIVE

To assess the effectiveness of DOC's efforts to ensure the
completeness, accuracy, and security of the EMR system
related to medical, dental, and optical services.

CONCLUSION

Moderately effective.

FACTORS
IMPACTING
CONCLUSION

•

DOC accurately documented the annual health screenings,
health screenings upon transfer to a different facility, and
follow-up care for off-site services in the EMR system.

•

DOC accurately documented the requests from prisoners
for medical, dental, and optical services and the action
taken for these requests in the EMR system.

•

Reportable condition related to the need for better user
access controls over the EMR system.

•

DOC's EMR system could not generate a facility-specific
listing of all prisoners who had at least one chronic care
condition at any point in time (see Finding 1), resulting in
correctional facilities manually tracking this information.

Michigan Office of the Auditor General
471-0300-14

20

FINDING #5
User access
controls over the
EMR system need
improvement.

12 users had
unnecessary access
to prisoner medical
records for up to
6 months.

DOC had not established effective user access controls over
the EMR system and could not ensure that the EMR data was
protected from unauthorized modification or disclosure.
Control Objectives for Information and Related Technology*
(COBIT) provides guidance for maintaining the integrity of
information and protecting information technology assets.
Also, the Federal Information System Controls Audit Manual*
(FISCAM) provides guidance relating to access to sensitive
system resources.
Our review of selected security access controls over the EMR
system disclosed:
a. DOC did not disable user access upon a user's
employment departure. Department of Technology,
Management, and Budget (DTMB) policy 1335.00.03
indicates that a system owner must manage information
system accounts, which includes deactivating accounts
of terminated or transferred users. DOC indicated that
it has a process in place to remove departed or
transferred employees. However, our review of 12
departed or transferred users noted that their user
access was disabled due to an extended period of
inactivity rather than manually disabled due to
departure or transfer. As a result, these 12 users had
access to confidential prisoner records for up to 185
days after their departure date.
b. DOC did not disable user access after a reasonable
period of inactivity. DTMB policy 1335.00.03 indicates
that an information system should automatically disable
inactive accounts after 120 days. Our review disclosed
that the EMR system has been programmed to disable
users after 185 days of inactivity.
c. DOC did not routinely review high-risk user (such as a
user with super user privileges) activity in the EMR
system. FISCAM indicates that the use of privileged
user accounts should be adequately monitored to
ensure that inappropriate activity does not go
undetected by management.

RECOMMENDATION

We recommend that DOC improve its user access controls
over the EMR system.

* See glossary at end of report for definition.

Michigan Office of the Auditor General
471-0300-14

21

AGENCY
PRELIMINARY
RESPONSE

DOC provided us with the following response:
DOC agrees with the recommendation and will comply. DOC
had a process in place to disable user access for departed or
transferred employees. Upon receiving a deactivation request
CHJ-629 from an EMR system authorized requestor, the
Healthcare-support team would disable the account and also
notify DTMB to delete the user's active directory. Upon
completion, the Healthcare-support team would notify the
authorized requestor that the deactivation request was
complete. DOC will improve the process by requiring EMR
system authorized requestors to conduct periodic audits using
listings of departed employees from HR or the contractor to
ensure that user access was disabled.
DOC has also taken steps to change the EMR to automatically
disable inactive accounts after 120 days.
DOC will also work with DTMB to establish a method to
monitor the activities of EMR Power Administrators.

Michigan Office of the Auditor General
471-0300-14

22

SUPPLEMENTAL INFORMATION
UNAUDITED
Exhibit 1
PRISONER MEDICAL, DENTAL, AND OPTICAL SERVICES
Department of Corrections

Average Annual Health Care Expenditures Per Prisoner
Last Ten Fiscal Years

Health Care Expenditures Per Prisoner

$6,000
$5,392

$5,460

2009

2010

$5,464

$5,303

$5,413

$5,258

$4,849

$5,000

$4,722
$4,223

$4,000

$3,690

$3,000

$2,000

$1,000

$0
2005

2006

2007

2008

2011

2012

2013

2014

Fiscal Year

This graph indicates that the Department of Corrections' health care expenditures per prisoner steadily increased through fiscal
year 2009; however, the expenditures have since leveled off.
Fiscal Year
2005

2006

2007

2008

2009

2010

2011

2012

2013

2014

Total Health Care
Expenditures
(in millions)

$180.5

$213.7

$242.7

$245.3

$261.2

$249.3

$241.9

$233.5

$240.5

$235.0

Average Number
of Prisoners

48,907

50,595

51,397

50,577

48,435

45,652

44,262

44,025

44,423

44,702

Source: Bureau of Fiscal Management, Department of Corrections.

Michigan Office of the Auditor General
471-0300-14

23

UNAUDITED
Exhibit 2
PRISONER MEDICAL, DENTAL, AND OPTICAL SERVICES
Department of Corrections

Cumulative Percentage Change in Health Care Expenditures Per Prisoner
and Medical Care Consumer Price Index
Last Ten Fiscal Years

60%
48%

Cumulative Percentage Change

50%

48%
47%

46%
44%

42%

40%

35%
32%

31%
29%

28%

30%

24%
20%
20%

16%
14%

13%

Percentage change in average annual medical
care expenditure per prisoner

8%

10%
4%

Percentage change in medical care consumer
price index

0%
0%
2005

2006

2007

2008

2009

2010

2011

2012

2013

2014

Fiscal Year

This graph shows cumulative percentage change in annual Department of Corrections' health care expenditures per
prisoner and the annual medical care consumer price index for fiscal years 2005 through 2014.

Source: Bureau of Fiscal Management, Department of Corrections, and Bureau of Labor Statistics, U.S. Department
of Labor.

Michigan Office of the Auditor General
471-0300-14

24

SERVICES DESCRIPTION
BHCS is responsible for coordinating medical, dental, and
optical services for approximately 45,000 prisoners in 33
correctional facilities. These services are provided through a
network of outpatient clinics operated at the correctional
facilities and through a managed health care system for off-site
services. In-patient care is provided at the Duane L. Waters
Health Center, at DOC-operated secure units at Allegiance
Health Hospital in Jackson and McLaren Greater Lansing
Hospital in Lansing, and at other local hospitals.
For fiscal year 2014, DOC spent $235.1 million for prisoner
medical, dental, and optical services, including $151.5 million
for on-site health care services and administration and $83.6
million for off-site health care services. The average prisoner
population for fiscal year 2014 was 44,702 prisoners, resulting
in an average annual cost per prisoner of $5,258 for health
care services.

Michigan Office of the Auditor General
471-0300-14

25

AUDIT SCOPE, METHODOLOGY, AND OTHER INFORMATION
AUDIT SCOPE

To examine the health care and other records of DOC and BHCS
related to the delivery of prisoner medical, dental, and optical
services. We conducted this performance audit* in accordance
with generally accepted government auditing standards. Those
standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for
our findings and conclusions based on our audit objectives. We
believe that the evidence obtained provides a reasonable basis
for our findings and conclusions based on our audit objectives.
Although BHCS is also responsible for prisoner mental health
services, substance abuse services, and pharmaceuticals, these
were not included within the scope of this audit.

PERIOD

Our audit procedures, which included a preliminary survey, audit
fieldwork, report preparation, analysis of agency responses, and
quality assurance, generally covered the period October 1, 2011
through April 30, 2014.

METHODOLOGY

We conducted a preliminary survey of DOC's prisoner health care
services, specifically, the delivery of medical, dental, and optical
services, to gain an understanding of the operations and activities
in order to establish our audit objectives, scope, and
methodology. During our preliminary survey, we:

OBJECTIVE #1

•

Interviewed BHCS management and staff.

•

Reviewed State statutes and DOC policies and
procedures related to medical, dental, and optical
services.

•

Visited a judgmentally selected DOC correctional facility
and reviewed a sample of prisoner medical records at the
facility to understand documentation and procedure
requirements.

To assess the effectiveness of BHCS's efforts to provide medical,
dental, and optical services.
To accomplish our first objective, we:
•

Reviewed records for a random sample of 100 prisoners of
the approximately 45,000 prisoners incarcerated as of
April 30, 2014 to determine whether DOC timely
completed required annual health screenings, medical
screenings for transferred prisoners, and follow-up care for
prisoners who received off-site services.

* See glossary at end of report for definition.

Michigan Office of the Auditor General
471-0300-14

26

OBJECTIVE #2

•

Reviewed a random sample of prisoners to determine
whether DOC completed chronic care condition medical
assessments timely and consistently (see Finding 1).

•

Interviewed health unit managers from 8 randomly
selected correctional facilities to understand their chronic
care condition processes.

•

Reviewed a random sample of prisoner records for
medical, dental, or optical appointments to determine
whether DOC charged a copayment when appropriate
(see Finding 2).

•

Identified the total amount of copayments collected for
prisoner medical, dental, and optical services compared to
the amount collected in the prior audit.

To assess the effectiveness of DOC's efforts to monitor its health
care vendor's compliance with selected contract requirements.
To accomplish our second objective, we:

OBJECTIVE #3

Michigan Office of the Auditor General
471-0300-14

•

Reviewed SLA audits completed to determine whether
they were completed timely and whether appropriate
corrective action was taken.

•

Reviewed a judgmentally selected sample of 10 and a
randomly selected sample of 25 of the approximately
20,000 off-site claims paid to determine whether DOC and
the managed health care vendor had documentation to
support the amount and dates of service.

•

Analyzed payments made to the managed health care
vendor and cost settlement data to determine whether the
payments were appropriate.

•

Analyzed charges for off-site claims and reviewed OMNI to
determine whether duplicate payments were made and
whether the prisoner was incarcerated at the date of the
service.

•

Reviewed licensing records for a random sample of 20 of
the approximately 1,200 BHCS staff and the approximately
100 medical providers employed by the managed health
care vendor to determine whether they were properly
licensed.

To assess the effectiveness of DOC's efforts to ensure the
completeness, accuracy, and security of the EMR system related
to medical, dental, and optical services.

27

To accomplish our third objective, we reviewed:

CONCLUSIONS

•

Records of a randomly selected sample of 100 prisoners
of the approximately 45,000 prisoners incarcerated as of
April 30, 2014 to determine whether the medical services
provided were properly documented in the EMR system.

•

A judgmentally selected sample of 13 and a randomly
selected sample of 37 EMR system users of the
approximately 2,500 users identified by DOC to determine
whether their access was appropriate.

•

DOC's general and access controls related to the EMR
system to determine whether the controls met information
technology standards.

We base our conclusions on our audit efforts and the resulting
material conditions* and reportable conditions.
When selecting activities or programs for audit, we direct our
efforts based on risk and opportunities to improve State
government operations. Consequently, we prepare our
performance audit reports on an exception basis.

AGENCY
RESPONSES

Our audit report contains 5 findings and 6 corresponding
recommendations. DOC's preliminary response indicates that it
agrees with all 6 recommendations.
The agency preliminary response that follows each
recommendation in our report was taken from the agency's written
comments and oral discussion at the end of our audit fieldwork.
Section 18.1462 of the Michigan Compiled Laws and the State of
Michigan Financial Management Guide (Part VII, Chapter 4,
Section 100) require an audited agency to develop a plan to
comply with the recommendations and submit it within 60 days
after release of the audit report to the Office of Internal Audit
Services, State Budget Office. Within 30 days of receipt, the
Office of Internal Audit Services is required to review the plan and
either accept the plan as final or contact the agency to take
additional steps to finalize the plan.

PRIOR AUDIT
FOLLOW-UP

We released our prior performance audit of the Prisoner Medical
and Dental Services, Department of Corrections (471-0300-06), in
March 2008. Within the scope of this audit, we followed up 5 of
the 9 prior audit recommendations. We rewrote 4 prior audit
recommendations for inclusion in Findings 1 and 4 of this audit
report. We repeated 1 prior recommendation in Finding 2 of this
audit report.

* See glossary at end of report for definition.

Michigan Office of the Auditor General
471-0300-14

28

SUPPLEMENTAL
INFORMATION

Michigan Office of the Auditor General
471-0300-14

As a part of our audit report, we prepared supplemental
information that relates to our audit objectives (Exhibits 1 and 2).
Our audit was not directed toward expressing an opinion on this
information.

29

GLOSSARY OF ABBREVIATIONS AND TERMS
BHCS

Bureau of Health Care Services.

CAP

corrective action plan.

chronic care condition

Condition requiring medical treatment for an indefinite time frame.

Control Objectives for
Information and Related
Technology (COBIT)

A framework, control objectives, and audit guidelines published by
the IT Governance Institute as a generally applicable and accepted
standard for good practices for controls over information
technology.

DOC

Department of Corrections.

DTMB

Department of Technology, Management, and Budget.

effectiveness

Success in achieving mission and goals.

EMR

electronic medical record.

Federal Information
System Controls Audit
Manual (FISCAM)

A methodology published by the U.S. Government Accountability
Office (GAO) for performing information system control audits of
federal and other governmental entities in accordance with
Government Auditing Standards.

material condition

A matter that, in the auditor's judgment, is more severe than a
reportable condition and could impair the ability of management to
operate a program in an effective and efficient manner and/or
could adversely affect the judgment of an interested person
concerning the effectiveness and efficiency of the program.

medical provider

A physician, physician assistant, or nurse practitioner.

OMNI

Offender Management Network Information System.

outcome

An actual impact of a program or an entity.

Michigan Office of the Auditor General
471-0300-14

30

performance audit

An audit that provides findings or conclusions based on an
evaluation of sufficient, appropriate evidence against criteria.
Performance audits provide objective analysis to assist
management and those charged with governance and oversight in
using the information to improve program performance and
operations, reduce costs, facilitate decision making by parties with
responsibility to oversee or initiate corrective action, and contribute
to public accountability.

reportable condition

A matter that, in the auditor's judgment, is less severe than a
material condition and falls within any of the following categories:
an opportunity for improvement within the context of the audit
objectives; a deficiency in internal control that is significant within
the context of the audit objectives; all instances of fraud; illegal
acts unless they are inconsequential within the context of the audit
objectives; significant violations of provisions of contracts or grant
agreements; and significant abuse that has occurred or is likely to
have occurred.

SLA

service level agreement.

Michigan Office of the Auditor General
471-0300-14

31

This Page Left Intentionally Blank

This Page Left Intentionally Blank