Open Recommendations

Develop, document, and communicate an overall SCRM strategy, implementation plan, and related policies and procedures to guide and govern supply chain risk management activities. If AmeriCorps intends to limit its IT purchases to GSA vendors, it should so state, and indicate who, if anyone, must approve exceptions. (New)

FHFA’s Office of Technology and Information Management (OTIM) should request an assessment to be completed by December 1, 2022, and that assessment will be used to determine if OTIM has sufficient resources (staff, technology, etc.) to update, test, and execute the contingency plan requirements.

Update the configuration settings on the servers to be in compliance with Commission IT Policy and ensure only essential capabilities are being provided.

Direct the Health Information Management program office in coordination with the Office of Community Care and facility chiefs of staff to ensure facilities are conducting post payment audits of billed acupuncture and chiropractic services to verify non VA providers are properly supporting their claims and to develop processes for corrective actions based on audit results.

Direct the Health Information Management program office, in coordination with the Office of Community Care and facility chiefs of staff, to ensure facilities are conducting postpayment audits of billed evaluation and management services to verify non VA providers are properly supporting their claims, including a focus on providers who frequently bill high level evaluation and management services and/or submit charges during periods when global surgery packages are in effect, and develop processes for corrective actions based on audit results.

We recommend that the Centers for Medicare & Medicaid Services expand the IRF transfer payment policy to apply to early discharges to home health care. If this expanded policy had been in place, Medicare could have saved $993,134,059 in 2017 and 2018.

Use Treasury’s DNP analysis to systemically flag COVID-19 EIDL and Emergency EIDL grant recipients who were found in Treasury’s DNP system and not previously reported by OIG. Review the applications and determine whether they are deemed ineligible. If the applicant is deemed ineligible, recover any disbursed funds, and flag the application as ineligible.

For all COVID-19 EIDLs and Emergency EIDL grants identified and flagged as potentially ineligible above, include those transactions in SBA’s 2021 improper payments estimation process.

In order to mitigate risks to the Station's structural integrity, ensure the risks associated with cracks and leaks in the Service Module Transfer Tunnel are identified and mitigated prior to agreeing to an ISS life extension.

We recommend the Director of CISA develop an implementation plan to conduct periodic assessments for monitoring theprogress of goals and activities and complete annual updates on action items, as required by the Cyber Action Plan and associated 2015 and 2018memorandums.

We recommend the Director of CISA conduct centralized tracking and completion of signed closeout summaries to reconcile the ongoing,outstanding, and open tasks and activities, as required by the Cyber Action Plan and associated 2015 and 2018 memorandums.

We recommend the Director of CISA establish performance measures to ensure the effectiveness and completion of the CyberAction Plan and associated 2015 and 2018 memorandum activities.

We recommend the Director of CISA establish the DHS governance structure and ensure it consists of an Executive Committee thatmeets at least semi-annually and a Steering Committee that meets at least quarterly, as required.

We recommend that the Centers for Medicare & Medicaid Services update its PDE guidance to address margin under sponsor delivery models in which a sponsor owns a pharmacy.

Develop information reports to identify beneficiaries in death suspense for prolonged periods and instruct management to ensure technicians take appropriate actions on the cases.

Verify and post death information, where appropriate, for the remaining beneficiaries in the State Death population.

Establish systems criteria to identify Old-age, Survivors and Disability Insurance beneficiaries in Address Suspense who are likely deceased, such as identifying beneficiaries suspended for prolonged periods who do not have activity on any Social Security Administration (SSA) records since their suspension. Once established, SSA should update policy to instruct technicians to search for death information.

Develop systems controls to alert technicians when SSA receives death information from sources, such as Centers for Medicare and Medicaid Services and the Department of the Treasury (Treasury), for beneficiaries in suspended payment status.

Revise policy to instruct technicians to conduct additional searches for death information when developing suspension actions.

Clarify policy for establishing dates of death for beneficiaries suspended based on a report from Treasury of a returned payment for death.

Review the SCRM NIST guidance and update the SCRM plan, policies, and procedures to fully address supply chain risk management controls and practices.

We recommend that the Office of Intergovernmental and External Affairs develop and distribute to staff a quick reference document that includes: o key staff responsibilities for coordinating and vouchering both invitational and staff travel in accordance with the FTR and the HHS Travel Policy Manual and the resources available to staff for ensuring that travel card transactions are compliant with these Federal travel regulations and o a requirement that staff and supervisors read and sign the HHS Traveler Agreement.

We recommend that the Office of Intergovernmental and External Affairs establish an oversight program that includes the following: o approving officials reviewing and signing travel authorizations and vouchers only after verifying that the types of expenses claimed are authorized and allowable, the amounts claimed are accurate, and the required receipts are attached to the voucher, o Program Coordinators verifying that all cardholders take the initial IBA card training course, and o Program Coordinators regularly using the online reporting capabilities provided by the servicing bank to monitor for potential travel card misuse and delinquency trends.

CMS should provide training for nursing homes on Federal requirements for facility-initiated discharge notices.

CMS should assess the effectiveness of its enforcement of inappropriate facility-initiated discharges.