Open Recommendations

We recommend the FEMA Office of the Chief Information Officer implement a standardized process to conduct and monitor privileged and service account reviews in accordance with FEMA requirements.

We recommend the FEMA Office of the Chief Information Officer remove the unnecessary privileges that allowed additional users to access the sensitive security account we identified.

We recommend the FEMA Office of the Chief Information Officer implement automated tools or additional controls and policies to change service account passwords as required and prevent interactive logon.

We recommend the FEMA Office of the Chief Information Officer implement automated tools or additional controls and policies to change service account passwords as required and prevent interactive logon standards where possible or submit requests for waivers or risk acceptance to the DHS Chief Information Security Officer to forgo this setting on affected FEMA service accounts.

We recommend that OPM's Contracting Officer require the Carrier to return $11,251,490 to the FEHBP for pass-through transparent drug pricing that was not received from the PBM for CYs 2015 through 2019.

We recommend that OPM's Contracting Officer assess the Carrier $1,228,855 for LII on the questioned costs due back to the FEHBP for this finding, calculated through December 31, 2022. The LII should be adjusted to account for the date the questioned costs are returned to the program.

We recommend that OPM's Contracting Officer require the Carrier to return $816,814 to the FEHBP for its portion of the PBM's non-specific drug discounts that were not received due to the Carrier's failure to move its FEHBP experience-rated group to a transparent PBM arrangement with pass-through pricing for CYs 2015 through 2019.

We recommend that OPM's Contracting Officer assess the Carrier $100,559 for LII on the questioned costs due back to the FEHBP for this finding, calculated through December 31, 2022. The LII should be adjusted to account for the date the questioned costs are returned to the program.

We recommend that OPM's Contracting Officer assess the Carrier $56,697 for LII on the questioned costs due back to the FEHBP for this finding, calculated through December 31, 2022. The LII should be adjusted to account for the date the questioned costs are returned to the program.

We recommend that OPM's Contracting Officer require the Carrier to return $957,512 to the FEHBP for the underpayment of drug manufacturer rebates and corresponding administrative fees that were withheld by the PBM for CYs 2015 through 2019.

We recommend that OPM's Contracting Officer assess the Carrier $90,895 for LII on the questioned costs due back to the FEHBP for this finding, calculated through December 31, 2022. The LII should be adjusted to account for the date the questioned costs are returned to the program.

We recommend that the Carrier return $45,986 to the FEHBP for the Federal group's portion of the penalties that were paid by the PBM to the Carrier for missed performance guarantees from CYs 2015 through 2019.

We recommend that OPM's Contracting Officer assess the Carrier $5,595 for LII on the questioned costs due back to the FEHBP for this finding, calculated through December 31, 2022. The LII should be adjusted to account for the date the questioned costs are returned to the program.

We recommend that the Florida Agency for Health Care Administration resume and enhance procedures that are in accordance with Federal requirements and the State's unwinding plan to identify and disenroll enrollees who are residing and enrolled in Medicaid managed care in another State when the PHE ends.

We recommend that the Florida Agency for Health Care Administration work with CMS to consider the potential use of T-MSIS data to identify potential cases of concurrent enrollment.

We recommend that OPM request that NFC revise the CLER system platform to establish an excessive discrepancy code fail count threshold and oversee the system to hold both agency payroll offices and Carriers accountable for making progress to resolve all discrepancy codes within an established period of time.

We recommend that OPM conduct a comprehensive overview of the 2809/834 Companion Guides and 834 layouts to address dependent terminations due to tier reductions and changes to ensure all possible value combinations advise Carriers of the applicability of the 31-day EOC as required under the Standard Contract terms.

We recommend that OPM review its current and archived FEHB CLs on its website, OPM.gov, to ensure that all CLs are posted and available for Carriers and other users.

We recommend that OPM develop procedures to monitor and enforce progress towards resolution of the CLER for fail counts of 4 or higher for code 160. This includes ensuring payroll offices and Carriers are aware of and resolving the enrollment discrepancies. OPM should also consistently adjust Carrier Plan Performance Assessments for excessive discrepancy code 160 fail counts as a method of enforcing the terms of the Standard Contract.

We recommend that OPM conduct a comprehensive overview of the paper SF 2809 and the OPM 2809 Form to ensure all necessary information is reported for Carriers to process dependent terminations and determine 31-day EOC applicability as required under the Standard Contract terms.

(U) Rec. 3: The DoD OIG recommended that the Chief Information Officer for the Air Force require that the authorizing officials for the Tailored Multitenancy Integrated Service and Cloud One systems reevaluate the authorizations to operate, including a review of all required documentation to consider the risks associated with using the authorized commercial cloud service offering, such as the documentation supporting the Federal Risk and Authorization Management Program and DoD authorization processed and continuous monitoring activities, as required by the DoD Cloud Computing Security Requirements Guide.

Determine the allowability of the questioned transactions and recover $3,546,767, if applicable.

The Chief, Appeals, should establish a process with the appropriate Business Operating Divisions (BOD) to identify, track, and update forms, letters, publications, notices, websites, and social media that still require the new IRS Independent Office of Appeals name.

Update DOL entity-wide and system-level security policies, procedures, and plans to comply with NIST SP 800-53, Rev. 5.