Open Recommendations

We recommend that the Alabama Medicaid Agency refund to the Federal government $5,039,433 (Federal Share) in overpayments.

We recommend that the Alabama Medicaid Agency improve TCM program oversight by giving additional guidance to TCM providers regarding: billing of services, to verify that they are allowable and nonduplicative; case manager hiring practices, to verify adherence with the State plan's qualification requirements; target group eligibility screening processes, so that only eligible individuals receive TCM services; and the maintenance of supporting documentation for billed services.

We recommend that the Missouri Department of Health and Senior Services require Area Agencies on Aging (AAAs) to track expenditures for supplemental awards by funding source, when required by Federal guidance, especially in instances of pandemic-related or other disaster relief funding. Specifically, none of the 10 AAAs in Missouri could give us separate accounting records that delineated the CARES Act expenditures to support the charges against the Federal award for these nutrition services.

We recommend that the Missouri Department of Health and Senior Services consider implementing additional monitoring activities whenever the State receives large supplemental funding disbursements.

We recommend ACF update and maintain a complete and accurate inventory of information systems hosted in the cloud.

We reccomend ACF remediate the 19 security control findings in accordance with NIST SP 800-53.

We recommend ACF update its cloud security procedures to include detailed steps for operational staff to effectively implement cloud security baselines in accordance with HHS requirements.

We reccomend ACF leverage cloud security assessment tools to identify misconfigurations and weakcybersecurity controls in its cloud infrastructure.

We recommend ACF conduct testing of its cloud information systems that includes the emulation of anadversary's tactics and techniques on a defined reoccurring basis.

We recommend that the Alabama Medicaid Agency remediate the six control findings OIG identified.

We recommend Alabama evaluate its current vulnerability scanning tools and update if necessary in order to better detect system flaws (e.g., common web server vulnerabilities) in its MMIS and E&E system and software components.

We recommend Alabama require its developers to follow secure coding standards and best practices, at a minimum, such as those recommended by NIST SP 800-218 or the Open Web Application Security Project (OWASP), when developing web applications.

We recommend Alabama implement procedures to periodically verify that its developers are adhering to secure coding standards and remediating vulnerabilities before releasing code to production.

We recommend Alabama perform more robust technical testing of web-facing systems that includes the emulation of an adversary's tactics and techniques on a defined reoccurring basis in order to better assess the effectiveness of NIST 800-53 controls.

CMS should provide a standard notice template to help nursing homes provide complete and accurate information to residents facing discharge and Ombudsmen.

CMS should require nursing homes to systematically document facility-initiated discharges in information available to CMS and States to enhance oversight.

CMS should take steps to encourage more behavioral health providers to serve Medicare and Medicaid enrollees.

CMS should explore options to expand Medicare and Medicaid coverage to additional behavioral health providers.

CMS should use network adequacy standards to drive an increase in behavioral health providers in Medicare Advantage and Medicaid.

CMS should increase monitoring of Medicare and Medicaid enrollees' use of behavioral health services and identify vulnerabilities.

Rec. 1.a: The DoD OIG recommended that the Assistant Secretary of the Army (Manpower and Reserve Affairs), in coordination with the Office of the Deputy Chief of Staff, G-9, develop and implement a plan, including but not limited to updating guidance, to ensure compliance with the requirement that Brigade commanders perform historical comparisons of Defense Organizational Climate Survey results and command climate assessment action plans, to identify year-to-year trends with harassment risk factors.

Rec. 1.b: The DoD OIG recommended that the Assistant Secretary of the Army (Manpower and Reserve Affairs), in coordination with the Office of the Deputy Chief of Staff, G-9, develop and implement a plan, including but not limited to updating guidance, to ensure compliance with the requirement that Brigade commanders include Defense Organizational Climate Survey response results from company and battalion Soldiers in their command climate assessments and command climate assessment action plans.

Rec. 1.c: The DoD OIG recommended that the Assistant Secretary of the Army (Manpower and Reserve Affairs), in coordination with the Office of the Deputy Chief of Staff, G-9, develop and implement a plan, including but not limited to updating guidance, to ensure compliance with the requirement that Military Equal Opportunity officials maintain all command climate assessments and command climate assessment action plans for 5 years, and as a best practice, require those documents be maintained in accordance with Federal and DoD records management requirements, in a location accessible to brigade command teams.

Rec. 2: The DoD OIG recommended that the Assistant Secretary of the Army (Manpower and Reserve Affairs), in coordination with the Office of the Deputy Chief of Staff, G-9, develop and implement a plan to ensure that command climate assessment action plans include initiatives tied to specific objectives, goals, and milestones for completion; and list the individuals responsible for implementing those initiatives; and outline a follow up plan to determine whether those initiatives are addressing Soldier reported issues.

Rec. 3: The DoD OIG recommended that the Assistant Secretary of the Army (Manpower and Reserve Affairs), in coordination with the DoD Office of People Analytics, take actions sufficient to ensure that bullying and hazing questions are included on all Defense Organizational Climate Surveys.