Open Recommendations

We recommend ICE’s Acting Executive Associate Director of Homeland Security Investigations correct the character limit anddata transfer issues in the Visa Security Program Tracking System.

We recommend CBP’s Executive Assistant Commissioner of the Office of Field Operations develop and implement a plan to track, if possible — or estimate, if tracking is not possible — the costs of National Targeting Center activities associated with the Visa Security Program and report those costs to U.S. Immigration and Customs Enforcement.

Implement the necessary staffing changes recommended by the NDB Working Group.

Ensure that all NDB employees comply with the NDB SOP related to proper facility access controls.

Identify and reimburse the BHP Trust Fund all improper payments resulting from system defects identified in our report (we estimated improper and potentially improper payments during our audit period to be $69,853,415 ($69,862,030 less $8,615)).

Implement system changes to ensure that BHP enrollees with a pending coverage end-date are transferred from BHP to Medicaid upon the end of their 5-year bar.

Update policy to establish timeframes for staff to resolve non-wage-related alerts before SSA overwrites IRS non-wage income data in its systems and/or administrative finality rules apply.

If SSA does not implement recommendation 3, then it should retain the IRS non-wage income data in its systems beyond 2 years, so it is available for staff to process cases involving fraud or similar fault.

We recommend SSA revise the Code of Federal Regulations (C.F.R.) and/or the Program Operations Manual System (POMS) to provide (a) detailed guidance related to financial oversight of the Disability Determination Services (DDS) and (b) specific instruction to the DDSs to uniformly carry out their financial management responsibilities. In addition, SSA should specify what actions it will take (in compliance with the Social Security Act) to remedy DDSs’ recurring financial management findings and lack of fiscal control procedures.

We recommend SSA determine additional actions it can take in response to DDS’ recurring financial management deficiencies.

(U) Rec. A.1.b: The DoD OIG recommended that the Secretaries of the Military Departments test and evaluate the high-altitude electromagnetic pulse survivability of mission-critical systems to ensure that threshold requirements are met; identify vulnerabilities; and develop and implement risk mitigation tactics, techniques, and procedures or materiel solutions. For programs that utilize hardening as a method for high-altitude electromagnetic pulse survivability, ensure the system requirements documents identify a Hardness Maintenance and Hardness Surveillance requirement and that a Hardness Maintenance and Hardness Survivability program is implemented.

(U) Rec. A.1.b: The DoD OIG recommended that the Secretaries of the Military Departments test and evaluate the high-altitude electromagnetic pulse survivability of mission-critical systems to ensure that threshold requirements are met; identify vulnerabilities; and develop and implement risk mitigation tactics, techniques, and procedures or materiel solutions. For programs that utilize hardening as a method for high-altitude electromagnetic pulse survivability, ensure the system requirements documents identify a Hardness Maintenance and Hardness Surveillance requirement and that a Hardness Maintenance and Hardness Survivability program is implemented.

(U) Rec. A.1.c.1: The DoD OIG recommended that the Secretaries of the Military Departments identify legacy chemical, biological, radiological, and nuclear mission-critical systems. Specifically, develop a plan to assess each legacy system's high-altitude electromagnetic pulse survivability limitations.

(U) Rec. A.1.c.2: The DoD OIG recommended that the Secretaries of the Military Departments identify legacy chemical, biological, radiological, and nuclear mission-critical systems. Specifically, to the extent practicable, coordinate and implement a standardized assessment plan with the Office of the Assistant Secretary of Defense for Nuclear, Chemical, and Biological Programs.

(U) Rec. A.1.c.3: The DoD OIG recommended that the Secretaries of the Military Departments identify legacy chemical, biological, radiological, and nuclear mission-critical systems. Specifically, for those legacy systems assessed as inadequate, develop materiel solutions or tactics, techniques, and procedures to mitigate the risks as directed by DoD Instruction 3150.09 and provide resource shortfalls and recommended priorities to the Office of the Assistant Secretary of Defense for Nuclear, Chemical, and Biological Defense Programs.

(U) Rec. B.1: The DoD OIG recommended that the Director of the Test Resource Management Center develop a plan to improve electromagnetic pulse test facility capabilities in coordination with the Services and electromagnetic pulse testing facilities to ensure testing gaps are accounted for and addressed to meet the requirements of MIL-STD-2169D.

We recommend that the Centers for Medicare & Medicaid Services provide States with matched T-MSIS enrollment data that identify Medicaid beneficiaries who were concurrently enrolled in a Medicaid managed care program in two States.

We recommend that the Centers for Medicare & Medicaid Services assist States with utilizing the data as needed to reduce future capitation payments made on behalf of beneficiaries concurrently enrolled in two States.

We recommend that the Centers for Medicare & Medicaid Services: direct the MACs to recover the $331,448 from the CAHs for 12,156 claims for which the health care practitioners had not reassigned their billing rights to the CAHs and $83,412 in cost-sharing overcharges to Medicare beneficiaries that are within the 4-year reopening period;

We recommend that the Centers for Medicare & Medicaid Services direct the MACs to recover the $575,990 from the health care practitioners for 7,857 claims for which health care practitioners had reassigned their billing rights to the CAHs and $197,909 in cost-sharing overcharges to Medicare beneficiaries that are within the 4-year reopening period.

We recommend that the Centers for Medicare & Medicaid Services coordinate with the MACs to develop and implement claim system edits or alternative means to prevent and detect overpayments for professional service payments.

CLA recommends that the National Institutes of Health management implement the recommendations below to enhance cybersecurity controls over its grant program. 1. Assess its grant award programs to determine which grants should require additional cybersecurity protections due to research potentially including sensitive and confidential data or NIH intellectual property or both.

2. Based on results of NIH's risk assessment of grant applicants, include in the funding opportunity announcements or grant terms and conditions or both the cybersecurity controls that should be implemented.

3. Strengthen the NIHGPS to establish clear and measurable standards for cybersecurity protections.

4. Strengthen its pre-award process to identify and address how cybersecurity risk will be assessed.