Open Recommendations

We recommend that management:
• Implement audit logging monitoring controls to reduce the risk that inappropriate and/or unusual activity that may compromise the integrity and availability of systems and data goes undetected and resolved.
• Design, document, and implement controls to remove system application access within an acceptable timeframe following a user’s separation date.
• Design, document, and implement controls to grant system application access upon requested and approved business need and maintain evidence of such user access requests.

We recommend that management:
• Implement audit logging monitoring controls to reduce the risk that inappropriate and/or unusual activity that may compromise the integrity and availability of systems and data goes undetected and resolved.
• Enforce independent review of personnel’s system access and redesign existing policies and procedures in order to perform the review of all personnel’s access each fiscal year.
• Design, document, and implement preventive controls to remove system application access within an acceptable timeframe following a user’s separation date.

The Chief Information Officer should continue to comply with Treasury’s preliminary guidance on generative AI by identifying accesses to external domains and internet platforms from traffic logs and updating rulesets to restrict further access to these sites so the IRS is not inadvertently revealing sensitive and non-public information outside of the IRS.

The Chief Data and Analytics Officer should accelerate standing up the new governance structure and processes to ensure the safe, secure, and trustworthy development and use of artificial intelligence.

We recommend that the Utah Department of Health and Human Services improve its estate recovery program by establishing formal written estate recovery policies and procedures, to include policies and procedures regarding documentation to support its performance of estate recovery procedures for deceased Medicaid enrollees.

We recommend that the Utah Department of Health and Human Services improve its estate recovery program by implementing formal procedures to periodically review open cases and establish a timeframe for doing so.

We recommend that the Utah Department of Health and Human Services improve its estate recovery program by verifying that system edits are functioning properly and improving those system edits as necessary, and by verifying that caseworkers perform and document all applicable estate recovery procedures (including determining the amount of Medicaid paid claims, determining whether the enrollee had a surviving spouse or child(ren), and performing asset research) for deceased Medicaid enrollees.

We recommend that the Centers for Medicare & Medicaid Services take the following actions, which could have saved Medicare an estimated $190.1 million in payments made to acute-care
hospitals for outpatient services provided to hospice enrollees and could have saved enrollees an estimated $43.6 million in deductibles and coinsurance that may have been incorrectly
collected from them or from someone on their behalf during our audit period:

Improve system edit processes to help reduce improper payments for outpatient services provided by acute-care hospitals to hospice enrollees.

We recommend that the Centers for Medicare & Medicaid Services take the following actions, which could have saved Medicare an estimated $190.1 million in payments made to acute-care hospitals for outpatient services provided to hospice enrollees and could have saved enrollees an estimated $43.6 million in deductibles and coinsurance that may have been incorrectly collected from them or from someone on their behalf during our audit period:

Educate acute-care hospitals to understand that each hospice enrollee's hospice election statement addendum is available on request, and educate hospices to provide the addendum if requested to help an acute-care hospital assess whether…

We recommend that the Centers for Medicare & Medicaid Services take the following actions, which could have saved Medicare an estimated $190.1 million in payments made to acute-care hospitals for outpatient services provided to hospice enrollees and could have saved enrollees an estimated $43.6 million in deductibles and coinsurance that may have been incorrectly collected from them or from someone on their behalf during our audit period:

Continue to educate hospices that they should be providing to enrollees virtually all necessary services that palliate or manage terminal illnesses and related conditions either directly or through arrangements.

We recommend that the Centers for Medicare & Medicaid Services take the following actions, which could have saved Medicare an estimated $190.1 million in payments made to acute-care hospitals for outpatient services provided to hospice enrollees and could have saved enrollees an estimated $43.6 million in deductibles and coinsurance that may have been incorrectly collected from them or from someone on their behalf during our audit period:

Educate acute-care hospitals to analyze not only whether outpatient services palliated or managed enrollees' terminal illnesses but also whether outpatient services palliated or managed a condition related to a terminal illness.

We recommend that the Centers for Medicare & Medicaid Services take the following actions, which could have saved Medicare an estimated $190.1 million in payments made to acute-care hospitals for outpatient services provided to hospice enrollees and could have saved enrollees an estimated $43.6 million in deductibles and coinsurance that may have been incorrectly
collected from them or from someone on their behalf during our audit period:

Clarify the language in the Manual (chapter 11, section 50), and in other CMS or MAC guidance documents or educational initiatives, if necessary, to specifically mention "related conditions" so that the language is…

We recommend that the Centers for Medicare & Medicaid Services take the following actions, which could have saved Medicare an estimated $190.1 million in payments made to acute-care
hospitals for outpatient services provided to hospice enrollees and could have saved enrollees an estimated $43.6 million in deductibles and coinsurance that may have been incorrectly collected from them or from someone on their behalf during our audit period:

Direct MACs or other appropriate contractors, such as Recovery Audit Contractors, to: (1) analyze Medicare claims data to identify acute-care hospitals that have aberrant billing patterns for condition code 07, and conduct Targeted…

Revise examiner guidance to ensure supervisory personnel consider significant delays in required financial filings and any associated perspectives of external auditors when assessing UFIRS ratings.

Revise the FDIC’s Internal Formal and Informal Actions Procedures to include specific process and documentation requirements related to circumstances in which an approved formal enforcement action is replaced with a less severe action.

Develop detailed guidance that clarifies what information should be considered when assessing whether it is appropriate to approve a brokered deposit waiver for “Adequately Capitalized” IDIs.

Incorporate the BIA results into USITC's overall contingency planning efforts, as well decisions regarding risk, priorities, security, and the budget.

We recommend that the Health Resources and Services Administration require the six hospices identified in our report as having used PRF payments for unallowable expenditures, totaling $8,306,519, to return the PRF payments to the Federal Government or ensure that the hospices properly replace the unallowable expenditures with allowable unreimbursed lost revenues or eligible expenses, if applicable.

We recommend that the Health Resources and Services Administration work with the hospice identified in our report as having used $3,967,025 of its PRF payments for potentially unallowable expenditures to determine what amounts should have been allocated and require the hospice to return unallowable amounts to the Federal Government or ensure that the hospice properly replaces these unallowable expenditures with unreimbursed lost revenues or eligible expenses, if applicable.

We recommend that the Maine Department of Health and Human Services, Office of Child and Family Services provide additional training to caseworkers and supervisors as appropriate, to achieve compliance with requirements for the immediate screening, risk and safety assessment, and investigation of reports of child abuse and neglect.

We recommend that the Maine Department of Health and Human Services, Office of Child and Family Services develop written policies and procedures that require its supervisors to review and approve documentation of caseworker interviews with children and adults.

We recommend that the Maine Department of Health and Human Services, Office of Child and Family Services develop written policies and procedures that require its supervisors to monitor aging reports on a weekly basis to promptly identify delays in the investigation process.

We recommend that the Maine Department of Health and Human Services, Office of Child and Family Services develop written policies and procedures that outline the steps a caseworker must take to override a report from screened-out to screened-in and manually input a response time.

We recommend that the Maine Department of Health and Human Services, Office of Child and Family Services develop written policies and procedures that requires supporting documentation to be maintained within Katahdin to demonstrate that written notification letters were sent.

Develop a centralized system and institute a phone log system to modernize and streamline the chartering application process.