Federal Reports

This is a publication by GAO's Inspector General that concerns internal GAO operations. The Cybersecurity Act of 2015 requires Inspectors General to report on federal computer systems that are national security systems or that provide access to personally identifiable information. This report satisfies the requirement for the Government Accountability Office (GAO). Because GAO has no national security systems, our report is specific to its computer systems that provide access to personally identifiable information (PII). Our objective was to collect specific information on GAO's information security policies and practices governing systems that provide access to PII and to assess whether logical access policies and practices over these systems are appropriate and were being followed. We did not independently validate the information that GAO provided for this report, except to determine that appropriate logical access standards and guidance were being followed, as required.

Cornerstone Hospital of Austin (the Hospital), in Austin, Texas, did not comply with Medicare requirements for billing Kwashiorkor on any of the 54 claims that we reviewed. The Hospital used diagnosis code 260 for Kwashiorkor but should have billed for other forms of malnutrition. The 54 inpatient claims that were coded incorrectly resulted in overpayments of $358,000. The Hospital believed that all claims identified by OIG were appropriately submitted for payment.