The federal agency in charge of Obamacare paid insurers almost $2.8 billion last year without adequate controls in place to make sure the money was being properly disbursed, according to an internal watchdog.
Without such "effective internal controls ... a significant amount of federal funds are at risk," said the report issued by the inspector general of the U.S. Health and Human Services Department on Tuesday. (Tweet This)
Read More $3,300 higher Obamacare bills possible
The report found that the controls in place "were not effective" for calculating the amount of money insurers were owed and for authorizing the payments made to them.
In response Wednesday, two leading Republican senators wrote to the Centers for Medicare and Medicaid Services with questions about issues cited in the report, saying they were "deeply troubled" by them.
"If these types of results continue it foreshadows a substantial programmatic vulnerability leading to untold billions in fraud, waste and abuse," wrote Sen. Charles Grassley of Iowa, who is chairman of the Senate Judiciary Committee, and Utah's Sen. Orrin Hatch , head of the Finance Committee.
The IG's report focuses on money given insurers during the first four months of 2014 by CMS, the division of HHS that oversees Obamacare. That period was the first time that Obamacare plans were in effect.
CMS is responsible for paying insurers tax credits that offset the cost of premiums for customers of Obamacare marketplaces. Most customers of those government-run exchanges qualify for such subsidies because they have low or moderate incomes.
Many of those people with low incomes also qualify for subsidies that reduce the amount they have to personally pay out of pocket for health services. CMS is responsible for paying insurers those subsidies, known as cost-sharing reductions, or CSR, as well. Both the premium subsidies and the CSRs are key elements of Obamacare, as they help reduce the cost of coverage for many customers.
Without them, many younger and healthy people would be unable to afford, or disinclined to enroll in, health plans sold on government exchanges. Insurers in turn would be less apt to sell plans on those marketplaces, which would hamper the Obama administration's efforts to reduce the national uninsured rate.
The inspector general's office, in its report, reviewed a random sample of 100 payee group-months, totaling about $302 million reimbursed to insurers who sell plans on the exchanges.
"We concluded that CMS's system of internal controls could not ensure that CMS correctly made financial assistance payments during the period January through April 2014," the report said.
In particular, the IG said, the habit of relying on claims by insurers about the amount owed for cost-sharing reduction payments did not ensure such payments flagged as outliers-being in excess of norms-where appropriate.
CMS also "did not have systems in place to ensure that financial assistance payments were made on behalf of confirmed enrollees and in the correct amounts," the report said.
There also weren't any systems in place for state-run Obamacare exchanges "to submit enrollee eligibility data for financial assistance payments." And it "did not always follow its guidance for calculating advance CSR payments," the report found.
Lastly, the IG said, CMS "does not plan to perform a timely reconciliation of these payments."
The report makes a series of recommendations to CMS including implementing computer systems to maintain confirmed enrollment and payment information so the agency doesn't have to rely on the word of insurers, and developing "interim reconciliation procedures to address potentially inappropriate CSR payments."
CMS agreed with both of those suggestions, and said regulatory action addressed other concerns. The agency also modified the calculation of its CSR payment rates.
"CMS takes seriously our responsibility to make sure this financial assistance is paid accurately and that taxpayer dollars are protected," Meaghan Smith, a spokeswoman for HHS, told CNBC.com. "That's why we have a number of well-tested controls and protections in place in order to make accurate payments to issuers as well as an additional layer of protection through an end-of-the-year reconciliation process."
"We are committed to continuing to improve our processes and will work with the inspector general to implement their recommendations," she said.
HHS also noted that the report only found a relatively small amount of inaccuracies in the CSR payments made to insurers.
In their letter to acting CMS Administrator Andy Slavitt, Grassley and Hatch wrote, "We have been concerned about vulnerabilities related to internal controls at CMS due the [Affordable Care Act]-this is yet another in a long line of problems which have occurred since the ACA's initial implementation."
The senators asked Slavitt six questions about whether CMS has implemented the recommendations made by the inspector general, and, "If not, why not?"
More From CNBC