Open Recommendations

We recommend that the New York State Department of Health work with the New York State Office of Mental Health to improve monitoring activities by increasing the number of case files reviewed when conducting provider site visits to ensure that service plans and subsequent service plan reviews are timely signed and maintained, community rehabilitation claims meet Medicaid reimbursement standards, and services are appropriately authorized. We recommend that the New York State Department of Health work with the New York State Office of Mental Health to improve monitoring activities by providing formal guidance or training to providers to clarify requirements related…

We recommend that New York State Department of Health refund $19,888,031 to the Federal Government.

Use the death information already in its records to input death information on 2.5 million numberholders’ Numident records.

Use death information in Centers for Medicare & Medicaid Services and various state death data files to input death information on approximately 498,000 Numident records.

Develop a methodology to annotate death information onto the Numident records of the approximately 15.8 million remaining non-current payment status beneficiary numberholders identified by our audit.

We recommend that the Centers for Medicare & Medicaid Services work with the DME MACs to do the following, which if in effect during our audit period could have saved Medicare as much as $30,051,107 for wheelchair repairs: review accumulated costs for wheelchair repairs that exceed the federally recommended cost limit, and for those wheelchairs that the DME MACs determine will not remain serviceable for their entire 5-year RUL, enforce Federal requirements by requiring the suppliers that transferred ownership of the wheelchairs purchased on a rental basis to enrollees to furnish replacement wheelchairs to those enrollees at no cost to…

We recommend that the Centers for Medicare & Medicaid Services work with the DME MACs to do the following, which if in effect during our audit period could have saved Medicare as much as $30,051,107 for wheelchair repairs: implement system edits to identify for review claims for repairs made to wheelchairs during their 5-year RUL when the accumulated costs of repairs have exceeded a certain cost limit.

We recommend that the Centers for Medicare & Medicaid Services work with the DME MACs to do the following, which if in effect during our audit period could have saved Medicare as much as $30,051,107 for wheelchair repairs: strengthen Medicare requirements to ensure that DME MACs review accumulated costs of repairs made to wheelchairs (including wheelchairs purchased on a lump-sum basis) during their 5-year RUL that exceed a certain cost limit and use this cost limit as a basis for determining when wheelchairs furnished by suppliers will not remain serviceable for their entire 5-year RUL.

We recommend that the Centers for Medicare & Medicaid Services work with the DME MACs to do the following, which if in effect during our audit period could have saved Medicare as much as $30,051,107 for wheelchair repairs: take appropriate action for suppliers that consistently bill for repairs made to wheelchairs during their 5-year RUL that exceed the federally recommended cost limit or the cost limit used as the basis for determining when wheelchairs furnished by suppliers will not remain serviceable for their entire 5-year RUL (e.g., by educating suppliers on proper billing and recovering improper payments).

FMC should develop, document, and approve a Log Retention Policy.

The FMC should develop and document an approved Risk Assessment Policy that utilizes NIST SP 800-30 (Guide for Conducting Risk Assessments) in its development.

(U) Rec. 1: The DoD OIG recommended that the Under Secretary of Defense for Intelligence and Security, through the Defense Intelligence Enterprise Manager for Analysis, provide guidance to the combatant commands and the Defense Intelligence Enterprise on the requirement for a tradecraft evaluation program in order to comply with Intelligence Community Directive 203, "Analytic Standards."

(U) Rec. 3: The DoD OIG recommended that the Under Secretary of Defense for Intelligence and Security issue policy guidance to ensure that the Service intelligence centers and combatant command Joint Intelligence Operations Centers provide ICD 203 training to their respective command's senior analysts and staff members responsible for analytical and editorial review of junior analysts' production items.

Document in special management unit records the reason detainees refuse to return to general population to ensure facility staff do not use disciplinary segregation as a punitive measure for detainees who require protection.

Ensure health screenings are conducted within the first 12 hours after a detainee arrives at the facility, before classifying or determining housing assignment.

Establish a log to maintain a permanent record of all sick call requests, including but not limited to the detainee’s name, A number, a brief description of the complaint, and how the issue was resolved.

Establish and implement a peer review program for nursing staff, and onboard needed mental health staff to contribute to timely medical care.

We recommend that the FWS address the questioned costs related to unfunded retirement and retiree health totaling $2,250,417 (Federal share) in consultation with appropriate U.S. Department of the Interior offices to determine if the costs are allowable pursuant to Federal regulations and award terms and conditions.

Implement registration and inventorying procedures for the CPSC’s information systems.

Develop, document, and implement a process for determining and defining system boundaries in accordance with National Institute of Standards and Technology guidance.

Define and document the taxonomy of the CPSC’s information system components, and classify each information system component as, at minimum, one of the following types: information technology system (e.g., proprietary and/or owned by the CPSC), application (e.g., commercial off-the-shelf, government off-the-shelf, or custom software), laptops and/or personal computers, service (e.g., external services that support the CPSC’s operational mission, facility, or social media).

Develop and implement a formal strategy to address information security risk management requirements as prescribed by the National Institute of Standards and Technology guidance.

Complete an assessment of information security risks related to the identified deficiencies and document a corresponding priority listing to address identified information security deficiencies and their associated recommendations. A corrective action plan should be developed that documents the priorities and timing requirements to address these deficiencies.

Develop and implement an Enterprise Risk Management program based on National Institute of Standards and Technology, Enterprise Risk Management Playbook, and Office of Management and Budget Circular A-123, Section II guidance. This includes establishing a cross-departmental risk executive (function) led by senior management to provide both a departmental and organization level view of risk to thetop decision makers within the CPSC.

Implement solutions to perform scenario analysis and model potential responses, including modeling the potential impact of a threat exploiting a vulnerability and the resulting impact to organizational systems and data.