Open Recommendations

The VA Loma Linda Healthcare System Director confirms that a mechanism is in place to monitor primary care patient aligned care team staffing and panel sizes at the non-VHA-operated clinics to ensure staff are available to care for enrolled patients.

Ensure Ralston House develops and implements written policies and procedures to ensure personnel costs charged to the subaward are based on records that accurately reflect the VOCA work performed.

Ensure that Ralston House maintains an adequate accounting system in compliance with the DOJ Grants Financial Guide, including separately and accurately tracking all federal financial assistance.

We recommend that the Centers for Medicare & Medicaid Services establish procedures to improve communication among all stakeholders involved in setting new CDLT rates during a PHE.

We recommend that the Centers for Medicare & Medicaid Services improve its procedures, which may require seeking legislative authority, for setting and adjusting rates for new CDLTs during a PHE by providing the MACs with the flexibility needed to set and adjust payment rates that would cover the laboratory costs of providing services when responding to a PHE.

We recommend that the Administration for Strategic Preparedness and Response develop internal written policies and procedures for the JFA process that align with Federal requirements and include the use of allocation methodologies that accurately reflect the benefiting offices' use of the product or service.

We recommend that the Administration for Strategic Preparedness and Response review the FY 2018 and 2019 JFA allocation methodologies along with the methodologies used during subsequent FYs to determine whether the costs were allocated to each office based on appropriate methodologies, and correct any improper allocations to avoid potential Antideficiency Act violations.

We recommend that the Administration for Strategic Preparedness and Response maintain documentation of the work performed by employees whose salaries are paid using BARDA funds to ensure that appropriations are used for their intended purposes in accordance with Federal requirements.

We recommend that the Administration for Strategic Preparedness and Response review the 10 remaining sampled employees that we could not interview to determine whether any salaries were improperly charged to BARDA appropriations and identify potential Antideficiency Act violations.

We recommend that the Administration for Strategic Preparedness and Response report any Antideficiency Act violations identified.

We recommend that Thailand's Ministry of Public Health develop and implement policies and procedures that address the retention of employee timesheets and FFR and audit reporting requirements for Federal awards.

We recommend that the Alabama Medicaid Agency refund to the Federal government $5,039,433 (Federal Share) in overpayments.

We recommend that the Alabama Medicaid Agency improve TCM program oversight by giving additional guidance to TCM providers regarding: billing of services, to verify that they are allowable and nonduplicative; case manager hiring practices, to verify adherence with the State plan's qualification requirements; target group eligibility screening processes, so that only eligible individuals receive TCM services; and the maintenance of supporting documentation for billed services.

We recommend that the Missouri Department of Health and Senior Services require Area Agencies on Aging (AAAs) to track expenditures for supplemental awards by funding source, when required by Federal guidance, especially in instances of pandemic-related or other disaster relief funding. Specifically, none of the 10 AAAs in Missouri could give us separate accounting records that delineated the CARES Act expenditures to support the charges against the Federal award for these nutrition services.

We recommend that the Missouri Department of Health and Senior Services consider implementing additional monitoring activities whenever the State receives large supplemental funding disbursements.

We recommend ACF update and maintain a complete and accurate inventory of information systems hosted in the cloud.

We reccomend ACF remediate the 19 security control findings in accordance with NIST SP 800-53.

We recommend ACF update its cloud security procedures to include detailed steps for operational staff to effectively implement cloud security baselines in accordance with HHS requirements.

We reccomend ACF leverage cloud security assessment tools to identify misconfigurations and weakcybersecurity controls in its cloud infrastructure.

We recommend ACF conduct testing of its cloud information systems that includes the emulation of anadversary's tactics and techniques on a defined reoccurring basis.

We recommend that the Alabama Medicaid Agency remediate the six control findings OIG identified.

We recommend Alabama evaluate its current vulnerability scanning tools and update if necessary in order to better detect system flaws (e.g., common web server vulnerabilities) in its MMIS and E&E system and software components.

We recommend Alabama require its developers to follow secure coding standards and best practices, at a minimum, such as those recommended by NIST SP 800-218 or the Open Web Application Security Project (OWASP), when developing web applications.

We recommend Alabama implement procedures to periodically verify that its developers are adhering to secure coding standards and remediating vulnerabilities before releasing code to production.

We recommend Alabama perform more robust technical testing of web-facing systems that includes the emulation of an adversary's tactics and techniques on a defined reoccurring basis in order to better assess the effectiveness of NIST 800-53 controls.