Open Recommendations

We recommend that OPM implement policies and procedures to standardize the review of disputed claims, provide the policies and procedures to applicable OPM personnel, and implement a plan to review and update the policies and procedures regularly.

We recommend that OPM implement a disputed claims process training program for new and current employees to ensure all personnel involved in the disputed claims review, regardless of assigned FEHB Group, are reviewing disputed claims timely and consistently.

We recommend that OPM immediately implement written policies and procedures for the administration and use of FDC to ensure: - All FDC users are tracking disputed claim cases in the system consistently. - Disputed claim cases are consistently opened and closed in FDC among all users. - Disputed claim cases remain open in FDC during the 30-day FEHBP member response window, and OPM's 90-day review time frame includes the FEHBP member additional information letter process in cases where the FEHBP member responds timely. - The date of the FEHBP member additional information letter and the FEHBP member response date (if…

We recommend that OPM update Section 8, Part 4 of the FEHBP benefit brochures to align with 5 CFR Section 890.105(e)(4), 48 CFR Section 1652.204-72(e)(4), and the FEHBP carrier Contract language Section 2.8(e)(4).

We recommend that OPM implement a disputed claims quality assurance program to ensure that the disputed claims data is regularly reviewed for: - Consistent and timely logging and addressing of FEHBP member correspondence. - The identification of concerning trends with providers, procedures, prescriptions, etc. - Consistent reviews of like-kind claims. - OPM's adherence to the implemented policies and procedures. - Consistent handling of IMR reviews, especially in cases where the carrier provided at least one IMR itself. - Prompt identification and correction of human errors.

We recommend that OPM implement internal controls to ensure that FOIA/PA requests can be met within the statutory deadlines.

We recommend that OPM implement an internal control process to monitor Privacy Act requirements, as they relate to the Disputed Claims process, so that SORNs and other Privacy Act requirements are fulfilled in a timely manner.

We recommend that OPM implement sufficient controls, including written policies and procedures, to ensure that FEHBP members' identities are verified and disputed claims records are not disclosed without consent as specified in the Privacy Act.

We recommend that OPM evaluate the disputed claims data that relate to the decommissioned HITS and ensure that applicable paper files and electronic files are stored per the terms of 36 CRF, Chapter XII, Subchapter B, Records Management and OPM's RMP for the applicable disposition schedule.

We recommend that OPM update the record retention period, ensuring that it provides sufficient time for the processing and resolution of a disputed claim.

We recommend that OPM catalog the disputed claims cases where the same Y codes were applied to unique cases, and that OPM develop a unique record identifier for cases with the same Y code so that they can be clearly differentiated until the record retention requirements have expired.

We recommend that OPM develop written policies and procedures that define the role of the Y code in the disputed claims process and the specific case data to be utilized by applicable OPM personnel to identify unique disputed claims cases.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

[REDACTED]

Update the Vulnerability Disclosure Policy (VDP) to include all internet-accessible systems. Once OIT has updated the VDP, the SEC should immediately report to the Cybersecurity and Infrastructure Security Agency (CISA) regarding:a. Any valid or credible reports of newly discovered or not publicly known vulnerabilities (including misconfigurations) on SEC systems that use commercial software or services that affect or are likely to affect other parties in government or industry.b. Vulnerability disclosure, coordination, or remediation activities that the SEC believes CISA can assist with or should be aware of, particularly as they relate to outside organizations.c. Any other situation in which the…

Develop and implement vulnerability disclosure-handling procedures that describe the SEC’s process for implementing its VDP, in accordance with Department of Homeland Security Binding Operational Directive 20-01.

[REDACTED]

Update the SEC’s system security plans with the latest baseline controls for all FISMA-reportable systems to ensure the SEC is assessing and monitoring the controls in accordance with the level of risk associated with each information security system.

[REDACTED]

We recommend that the Ohio Department of Health work with CMS to develop standardized life safety training for nursing home staff.