Open Recommendations

We recommend that the New York State Office of Mental Health refund the entire PATH grant amount, totaling $4,222,941, to the Federal Government

We recommend that the New York State Office of Mental Health implement policies and procedures for the PATH program to: -ensure that non-Federal contributions related to PATH are used for the applicable grant period to provide PATH services to eligible consumers, and -require written agreements for all PATH providers.

We recommend that the New York State Office of Mental Health strengthen its policies and procedures to ensure that: - PATH program services are only provided to eligible consumers; -PATH providers submit certifications before distributing PATH funds, -PATH providers accurately report the number of consumers served, and -it timely completes the financial closeout of its PATH program for the grant period to confirm its final FFR is accurate.

Develop and implement a supplement to Region 2’s emergency response plan to describe and address the specific geographic, logistical, and cultural norms applicable to disaster response in Puerto Rico and the U.S. Virgin Islands. This supplement should include local EPA staff roles andresponsibilities, as well as address the likely limitations to transportation, communications, and power in the aftermath of disasters.

In coordination with the Office of Water, implement America’s Water Infrastructure Act in Puerto Rico and the U.S. Virgin Islands by:(a) developing and implementing a strategy to provide training, guidance, and assistance to small drinking water systems as they improve their resilience and (b) establishing a process for small drinking water systems to apply for America’s Water Infrastructure Act grants. This process should include (1) implementing the EPA’s May 2020 guidance provided to small drinking water systems regarding resilience assessments and (2) establishing a public information campaign to inform small drinking water systems of the America’s Water Infrastructure Act grant…

We recommend that the Nebraska Department of Health and Human Services, Division of Medicaid and Long-Term Care refund $22,484 (Federal share) in overpayments to the Federal Government.

We recommend that the Nebraska Department of Health and Human Services, Division of Medicaid and Long-Term Care implement the necessary MMIS edits to prevent and detect duplicate payments.

Implement a software asset management capability for software and operating systems to ensure that software executes only from the authorized software inventory and all unauthorized software is blocked from executing on HUD's network.

Status

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

Implement multifactor authentication mechanisms for all nonprivileged users who access information systems that process, store, or transmit PII.

Status

The Office of the Chief Information Officer reported that it has implemented a new software security solution to implement multifactor authentication, starting with a pilot on 15 FHA systems. In October 2024, HUD received additional funds through the Technology Modernization Fund for this project enterprisewide.

Analysis

Implement multifactor authentication mechanisms for all privileged users who access information systems that process, store, or transmit PII.

Status

The Office of the Chief Information Officer reported that it has implemented a new software security solution to implement multifactor authentication, starting with a pilot on 15 FHA systems. In October 2024, HUD received additional funds through the Technology Modernization Fund for this project enterprisewide.

Analysis

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

Modify business procedures, using systems such as the Consolidated Claims Experience or other applications, to better inform claims specialists of necessary actions when SSI recipients do not provide required information and evidence for OASDI claims.

Test its disaster recovery plan at least annually.

We recommend that CMS require hospitals to use condition codes 49 or 50 on claims for a device-replacement procedure that resulted from a recall or premature failure, regardless of whether the hospital received a reportable credit prior to billing for the device replacement procedure.

We recommend that CMS, under the assumption that the prior recommendation will be implemented, instruct Medicare contractors to implement a postpayment review process to ensure that hospitals have adjusted claims, as required, for the device credits they received.

We recommend that CMS obtain device credit listings from manufacturers and determine whether providers reported the credits as required by Medicare regulations.

We recommend that CMS, as an alternative to our third, fourth, and fifth recommendations, consider eliminating the current Medicare requirements for reporting device credits by reducing IPPS and OPPS payments for cardiac device replacement procedures.

Office of the Chief Financial Officer (OCFO), in coordination with the Office of the Chief Information Officer (OCIO), the Office of the Chief Information Security Officer (OCISO), and component IT and financialmanagement, design and implement an effective internal control process to review service organization risks to ensure that ineffective ITGCs performed by service organizations are evaluated and appropriate compensating controls are designed and implemented by DHS and component management

Improve or reinforce existing policies, procedures, and related internal controls over financial information, including preparation of the Agency Financial Report.

Update policies and procedures to clearly define how the review of refund liquidations and administrative refunds is achieved.