Open Recommendations

2. Based on results of NIH's risk assessment of grant applicants, include in the funding opportunity announcements or grant terms and conditions or both the cybersecurity controls that should be implemented.

3. Strengthen the NIHGPS to establish clear and measurable standards for cybersecurity protections.

4. Strengthen its pre-award process to identify and address how cybersecurity risk will be assessed.

5. Strengthen its post-award process to confirm that cybersecurity protections have been implemented to adequately safeguard sensitive and confidential data.  

(U) Rec. 1: The DoD OIG recommended that the Commander of the United States Africa Command modify United State Africa Command Instruction 3200.21, "United States Africa Command Joint Targeting Instruction," June 1, 2020, to include the requirement to maintain specific documents for target development and targeting operations based on the procedures used to develop the target.

CMS should clarify that States should review their Medicaid managed care plans' MLR reports to verify the accuracy of reported data elements.

CMS should provide additional guidance to States regarding Medicaid managed care plans' reporting of non-claims costs in MLR reports.

CMS should design an annual MLR reporting template for States to provide to their Medicaid managed care plans.

CMS should clarify that States should verify the completeness of their Medicaid managed care plans' MLR reports.

We recommend that the Chief of Border Patrol develop and implement a comprehensive policy for use of different pathways for expedited processing during times of increased apprehension activity. The policy should require: x Issuing A-numbers for all migrants released into the United States to ensure DHS and other Federal agencies can track migrants throughout the immigration process; and x Ensuring processing pathways comply with existing law and policy.

Provide adequate documentation to support that the $2,588,362 in CDBG-DR funds for three unsupported project and program management services expenditures cited in this report was spent for supported, necessary, and reasonable costs. Any amount for which adequate support cannot be provided should be repaid from non-Federal funds.

Develop and implement guidance for Border Patrol sectors to address the expiration of the CDC order pursuant to Title 42.

Develop and implement contingency plans for increased apprehensions and processing.

Provide documentation, or a full and detailed explanation, of the process Michigan used to determine that the four education-related entities that received GEER grant funds were essential for carrying out emergency educational services, providing childcare and early childhood education, providing social and emotional support, or protecting education-related jobs.

Develop and implement a process to ensure that it documents the criteria and decisions made for awarding future GEER grant funds in accordance with applicable requirements.

Take appropriate action if the documentation and other information provided by Michigan in response to the above recommendations does not support that the State followed applicable requirements.

Timely design and implement a monitoring plan that will ensure that K–12 GEER and Early On program subgrantees’ use of GEER grant funds complies with the CARES Act and other applicable Federal requirements. The monitoring plan should include protocols to review, on at least a sample basis, and using a riskbased approach, supporting documentation for subgrantee expenditures charged to the GEER grant to provide assurance that funds were used for allowable purposes.

Develop and implement a process to review, on at least a sample basis, and using a risk-based approach, supporting documentation and award calculations for the FFF Path 1 scholarship awards.

We recommend that Regence BlueCross BlueShield of Oregon refund to the Federal Government the $1,890,855 of estimated net overpayments.

We recommend that Regence BlueCross BlueShield of Oregon identify, for the high-risk diagnoses included in this report, similar instances of noncompliance that occurred before or after our audit period and refund any resulting overpayments to the Federal Government.

We recommend that Regence BlueCross BlueShield of Oregon continue to examine its existing compliance procedures to identify areas where improvements can be made to ensure that diagnosis codes that are at high risk for being miscoded comply with Federal requirements (when submitted to CMS for use in CMS's risk adjustment program) and take the necessary steps to enhance those procedures.

Thoroughly review each COVID-19 EIDL, grant, and advance application submitted from foreign IP addresses that were approved and funded and verify eligibility. If ineligibility or evidence of potential fraud is found, SBA should stop any further or future disbursements, recover any disbursed funds, and refer fraudulent loans to OIG for investigation.

Examine controls related to foreign IP addresses and ensure these controls are more effective in future disaster processing systems.

We recommend that the New York State Department of Health refund the estimated $84,329,893 to the Federal Government for payments that did not comply with Federal and State requirements.

We recommend that the New York State Department of Health work with the transportation manager to review the payments to transportation providers that may not have complied with Federal and State requirements, resulting in an estimated $112,028,279 in Federal Medicaid reimbursement, and refund to the Federal Government any unallowable amounts.