Open Recommendations

The Bureau of Overseas Buildings Operations, in coordination with Embassy Paramaribo, should address the roof leaks in the new embassy compound and mitigate the resulting health hazards within 180 days.

Encrypt PII data on personal and network drives in accordance with DOT Chief Information Officer Departmental Privacy Risk Management Policy.

Develop a plan and address identified high and medium vulnerabilities on any remaining legacy websites and verify that new websites are being assessed for vulnerabilities.

CMS should seek legislative authority to implement least costly alternative policies for Part B drugs under appropriate circumstances.

We recommend that SAMHSA reconcile each month the OIG stewardship reports (or the HHS electronic Single Audit recommendation listing for audits processed on or after October 1, 2018) with SAMHSA’s audit resolution records and follow up on any differences noted.

We recommend that SAMHSA promptly resolve the 188 outstanding audit recommendations that were past due as of September 30, 2016.

We recommend that SAMHSA finalize and follow its policies and procedures related to the audit resolution process to ensure that all management decisions are issued within the required 6-month resolution period.

We recommend that the State agency maintain the necessary documentation to determine whether it enrolled individuals who did not meet Federal and State Medicaid eligibility requirements, which could have resulted in up to $1,297,308,200 in potentially improper Federal Medicaid payments over the 6-month audit period

We recommend that the State agency take the necessary steps to ensure local district and marketplace staff consider all available, relevant information and data sources, as well as all Federal and State requirements when determining Medicaid eligibility, which could have reduced or eliminated an estimated $520,295,792 in overpayments caused by eligibility errors over the 6-month audit period.

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require the Puerto Rico DOE to provide to the Department documentation for purchases and contracts reviewed in this report that is consistent with Regulation 7040 and the Guide for expenditures charged to the Restart and Title I grants, including adequate justification of the procurement of professional services not subject to competition, or return to the Department funds charged to the grants.

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require the Puerto Rico DOE to establish controls to ensure that staff involved in the procurement of goods and nonpersonal services follow the requirements established in Regulation 7040, including any updates made in response to Puerto Rico Law 85, and provide training as applicable.

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require the Puerto Rico DOE to establish controls to ensure that staff involved in the procurement of professional services follow the requirements established in the Guide, and provide training as applicable.

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require the Puerto Rico DOE to timely implement its monitoring plan to properly monitor the Restart program to ensure appropriate use of funds and compliance with applicable laws and regulations.

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require the Puerto Rico DOE to segregate monitoring and program coordination duties to eliminate conflicts of interest and reduce the risk of fraud, waste, and abuse.

We recommend that the Assistant Secretary for the Office of Elementary and Secondary Education require the Puerto Rico DOE to implement the procedures created to report fraud, waste, and abuse.

IHS should work with hospitals to ensure that they follow the Indian Health Manual when prescribing and dispensing opioids;

IHS should ensure that all hospitals: Institute complete and updated contingency plans and test plans in accordance with Federal guidelines.

IHS should assign a centralized team (e.g., headquarters, area office) to: Securely configure and monitor wireless access points at all IHS hospitals.

IHS revise the IHM manual to require area offices to submit completed annual reviews to IHS headquarters;

IHS should assign a centralized team (e.g., headquarters, area office) to: Monitor and track end-of-service-life IT equipment that cannot be maintained centrally (e.g., switches or routers). IHS hospitals and area offices should provide a tracking spreadsheet to IHS headquarters on a periodic basis that highlights equipment that is reaching or has reached end of service life and replace such equipment or provide management approved justification for its continued use.

IHS should: Ensure that physical IT controls are included in each hospital’s risk assessment.

IHS work with hospitals to remediate the IT vulnerabilities identified.

IHS should ensure that all hospitals: Store backup tapes off-site in accordance with Federal guidelines.

IHS should ensure that all hospitals: Have a complete risk assessment, to include all IT assets, for all risks, both physical and information security, in accordance with IHS and NIST guidance.

IHS should assign a centralized team (e.g., headquarters, area office) to: Ensure patches are deployed timely to all IHS end points in accordance with NIST guidance and IHS policies and procedures.