Open Recommendations

IHS should designate a central owner in IHS headquarters to ensure clear roles and responsibilities for shared ownership in implementing patient protection policies, and managing and responding to abuse reports;

IHS should continue to actively promote an organizational culture of transparency and work to resolve barriers to staff reporting of abuse

The executive in charge, office of under secretary for health, and the principal executive director, office of acquisition, logistics, and construction, require the Healthcare Commodities Program Office and Strategic Acquisition Center to develop a formal process to validate correct order fulfillment reporting by the prime vendors, ensure the correct algorithms are used, and help prevent missed opportunities to identify and mitigate issues.

The executive in charge, office of under secretary for health, and the principal executive director, Office of Acquisition, Logistics, and Construction, require the Healthcare Commodities Program Office and Strategic Acquisition Center to monitor the Integrated Product Team’s development and implementation of a process to validate performance metric reporting such as on unadjusted fill rates.

The executive in charge, office of under secretary for health, requires the Procurement and Logistics Office to strengthen controls, monitor the Healthcare Commodities Program Office monthly, and ensure adherence to the established Medical/Surgical Prime Vendor Next Generation program control plan.

Perform a comprehensive review of FAA's root cause analysis training to ensure it meets Agency expectations. Modify training, as appropriate, based on the review and require inspectors to complete the course(s) or offer inspectors access to industry-based training programs.

Bureau of the Fiscal Service (Fiscal Service) management should finalize policies and procedures to review audit logs of production DB2 servers.

Bureau of the Fiscal Service (Fiscal Service) management should implement an oversight process to ensure that designated Fiscal Service personnel: a. Reviews the security logs for the UNIX and DB2 servers hosting the Payment Information Repository (PIR), Judgment Fund Internet Claim System (JFICS), and Security Payment System (SPS) applications on a pre-defined frequency, as indicated in the Fiscal Service Baseline Security Requirements (BLSR). b. Formally documents completion of their reviews and any escalations to the Information System Security Office (ISSO), and c. Retains the audit logs and documentation of its reviews for 18 months, as required by the BLSR.

Bureau of the Fiscal Service (Fiscal Service) management should periodically review Fiscal Service management's implementation and operation of the review the security audit logs for the UNIX and DB2 servers hosting the Payment Information Repository (PIR), Judgment Fund Internet Claim System (JFICS), and Secure Payment System (SPS) applications to determine that Fiscal Service management completes the reviews on a pre-defined basis, documents completion of the reviews and escalations, and maintains such documentation.

Bureau of the Fiscal Service (Fiscal Service) management should establish an effective enforcement process or mechanism to ensure that (a) UNIX and DB2 events and monitoring controls are followed, and (b) Fiscal Service management has confidence it consistently reviews for potential unauthorized or inappropriate activity.

Bureau of the Fiscal Service (Fiscal Service) management should develop and implement documentation to assign responsibility for ensuring adequacy of UNIX and database security and baseline settings.

Bureau of the Fiscal Service (Fiscal Service) management should update existing UNIX and database configuration security baseline documents to ensure that these documents fully incorporate and enforce the components of the Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIG). Management should document any deviations from the STIGs and note compensating controls that mitigate the security risk to an acceptable level.

Bureau of the Fiscal Service (Fiscal Service) management should develop, document, and implement policies, procedures, and controls to conduct periodic reviews of actual UNIX and database settings against the security configuration baselines.

Bureau of the Fiscal Service (Fiscal Service) management should provide logging and monitoring of security related events to include the retention of evidence of reviews performed.

Bureau of the Fiscal Service (Fiscal Service) management should develop a baseline of essential security settings and specifying that baseline as the standard to be observed.

Bureau of the Fiscal Service (Fiscal Service) management should implement corrective actions to address all vulnerabilities associated with the baseline enforcement to include removing the three default user accounts on UNIX servers.

We recommend that the Texas Health Presbyterian Hospital Dallas strengthen controls to ensure full compliance with Medicare requirements, specifically: - ensure all IRF beneficiaries meet Medicare criteria for acute inpatient rehabilitation and all required documentation is included in the medical record: - ensure all inpatient beneficiaries meet Medicare criteria for inpatient hospital services; - ensure procedure and diagnosis codes are supported in the medical records and staff are properly trained; and - ensure HCPCS codes are supported in the medical records and staff are properly trained.

(U) Rec. 2.a: Recommendation is Classified.

This recommendation contains information about IT deficiencies which, if made public, could endanger NARA systems. Please contact the OIG if you need further information.

This recommendation contains information about IT deficiencies which, if made public, could endanger NARA systems. Please contact the OIG if you need further information.

This recommendation contains information about IT deficiencies which, if made public, could endanger NARA systems. Please contact the OIG if you need further information.

This recommendation contains information about IT deficiencies which, if made public, could endanger NARA systems. Please contact the OIG if you need further information.

This recommendation contains information about IT deficiencies which, if made public, could endanger NARA systems. Please contact the OIG if you need further information.

This recommendation contains information about IT deficiencies which, if made public, could endanger NARA systems. Please contact the OIG if you need further information.

This recommendation contains information about IT deficiencies which, if made public, could endanger NARA systems. Please contact the OIG if you need further information.