Open Recommendations

We recommend that Thailand's Ministry of Public Health develop and implement policies and procedures that address the retention of employee timesheets and FFR and audit reporting requirements for Federal awards.

We recommend that the Alabama Medicaid Agency refund to the Federal government $5,039,433 (Federal Share) in overpayments.

We recommend that the Alabama Medicaid Agency improve TCM program oversight by giving additional guidance to TCM providers regarding: billing of services, to verify that they are allowable and nonduplicative; case manager hiring practices, to verify adherence with the State plan's qualification requirements; target group eligibility screening processes, so that only eligible individuals receive TCM services; and the maintenance of supporting documentation for billed services.

We recommend that the Missouri Department of Health and Senior Services require Area Agencies on Aging (AAAs) to track expenditures for supplemental awards by funding source, when required by Federal guidance, especially in instances of pandemic-related or other disaster relief funding. Specifically, none of the 10 AAAs in Missouri could give us separate accounting records that delineated the CARES Act expenditures to support the charges against the Federal award for these nutrition services.

We recommend that the Missouri Department of Health and Senior Services consider implementing additional monitoring activities whenever the State receives large supplemental funding disbursements.

We recommend ACF update and maintain a complete and accurate inventory of information systems hosted in the cloud.

We reccomend ACF remediate the 19 security control findings in accordance with NIST SP 800-53.

We recommend ACF update its cloud security procedures to include detailed steps for operational staff to effectively implement cloud security baselines in accordance with HHS requirements.

We reccomend ACF leverage cloud security assessment tools to identify misconfigurations and weakcybersecurity controls in its cloud infrastructure.

We recommend ACF conduct testing of its cloud information systems that includes the emulation of anadversary's tactics and techniques on a defined reoccurring basis.

We recommend that the Alabama Medicaid Agency remediate the six control findings OIG identified.

We recommend Alabama evaluate its current vulnerability scanning tools and update if necessary in order to better detect system flaws (e.g., common web server vulnerabilities) in its MMIS and E&E system and software components.

We recommend Alabama require its developers to follow secure coding standards and best practices, at a minimum, such as those recommended by NIST SP 800-218 or the Open Web Application Security Project (OWASP), when developing web applications.

We recommend Alabama implement procedures to periodically verify that its developers are adhering to secure coding standards and remediating vulnerabilities before releasing code to production.

We recommend Alabama perform more robust technical testing of web-facing systems that includes the emulation of an adversary's tactics and techniques on a defined reoccurring basis in order to better assess the effectiveness of NIST 800-53 controls.

CMS should provide a standard notice template to help nursing homes provide complete and accurate information to residents facing discharge and Ombudsmen.

CMS should require nursing homes to systematically document facility-initiated discharges in information available to CMS and States to enhance oversight.

CMS should take steps to encourage more behavioral health providers to serve Medicare and Medicaid enrollees.

CMS should explore options to expand Medicare and Medicaid coverage to additional behavioral health providers.

CMS should use network adequacy standards to drive an increase in behavioral health providers in Medicare Advantage and Medicaid.

CMS should increase monitoring of Medicare and Medicaid enrollees' use of behavioral health services and identify vulnerabilities.

Establish formal procedures for obtaining and reviewing appropriate supporting documentation to ensure sales and investments are accurately reported.

Establish a plan to reduce wait times for optometry appointments.

Include a timestamp on the classification documentations for initial classification of each detainee and ensure staff maintain all classification paperwork, to include reclassification, in the detainee’s file.

Collect medical grievances within 24 hours of submission by a detainee and ensure staff maintain a copy of all paper medical grievances in the detainee’s medical file.