Federal Reports

Our objective was to determine whether the U.S. Department of Education’s (Department) and Federal Student Aid’s (FSA) overall information technology security programs and practices were effective as they relate to Federal information security requirements. We found the Department and FSA programs were not effective in any of the five security functions—Identify, Protect, Detect, Respond, and Recover. We also identified findings in all eight metric domains, which included findings with the same or similar conditions contained in prior Office of Inspector General reports.

This report was issued in conjunction with the Office of Inspector General for the Railroad Retirement Board's Semiannual Report to the Congress. It was incorporated by reference in the corresponding Semiannual Report. which is available at the link below.

Our objective was to determine whether the Social Security Administration's (SSA) overall information security program and practices were effective and consistent with the requirements of the Federal Information Security Modernization Act of 2014 (FISMA), as defined by the Department of Homeland Security (DHS).

Since 2010, the Centers for Medicare & Medicaid Services' (CMS's) Comprehensive Error Rate Testing (CERT) program has identified nebulizers and related drugs (i.e., inhalation drugs) among the top 20 supplies with the highest improper Medicare payments. Prior OIG reviews (for calendar years (CYs) 2014 and 2015) found that the top two suppliers of inhalation drugs complied or generally complied with Medicare requirements. However, our review of a third supplier (for CYs 2015 and 2016) found similar billing issues to those identified by the CERT program. These three suppliers received 56 percent of total Medicare payments for inhalation drugs during CY 2017 (audit period). We conducted this nation-wide review to determine whether the issues identified by the CERT program were primarily caused by suppliers that received the remaining 44 percent of payments, which we had not previously reviewed.