Open Recommendations

We recommend that the Centers for Medicare & Medicaid Services strengthen its processes for reviewing inspection results reported on Care Compare by providing technical assistance and additional training to State survey agencies that are not following procedures in the State Operations Manual and ASPEN Central Office Procedures Guide for reporting deficiencies in ASPEN.

We recommend that the Centers for Medicare & Medicaid Services strengthen its processes for reviewing inspection results reported on Care Compare by including in its manual quality assurance check a verification that nursing home inspection results are accurately reported.

We recommend that HumanaChoice refund to the Federal Government the $480,295 of net overpayments.

We recommend that HumanaChoice identify, for the high-risk diagnoses included in this report, similar instances of noncompliance that occurred before or after our audit period and refund any resulting overpayments to the Federal Government.

We recommend that HumanaChoice examine its existing compliance procedures to identify areas where improvements can be made to ensure that diagnosis codes that are at high risk for being miscoded comply with Federal requirements and take the necessary steps to enhance those procedures.

Ensure all cloud-based systems are appropriately authorized by Federal officials,including selection and assessment of all relevant security controls;

Ensure all cloud-based systems are appropriately reported for inclusion in the Department’s cloud inventory.

Submit agency authorizations to the FedRAMP Project Management Office for cloud-based systems that are FedRAMP-authorized

Modify continuous monitoring plans, policies, and procedures to include monitoring results from FedRAMP, where applicable.

Ensure all cloud-based systems are appropriately authorized by Federal officials, including selection and assessment of all relevant security controls;

Ensure all cloud-based systems are appropriately reported for inclusion in the Department’s cloud inventory.

Submit agency authorizations to the FedRAMP Project Management Office for cloud-based systems that are FedRAMP-authorized.

Modify continuous monitoring plans, policies, and procedures to include monitoring results from FedRAMP, where applicable.

AmeriCorps enhance its process of performing enterprise risk management assessments to determine the respective risk posture of its systems to include the entity-wide performance metrics for measuring the effectiveness of its:• Data exfiltration and enhanced network defenses;• Incidence detection and analysis process; and• Incidence handling process. (New)

The Office of Chief Financial Officer develops an automated process to calculate evacuation allowance payments.

Develop an oversight mechanism to retain receipts and monthly reconciliations to ensure record retention. (Finding 1)

Develop an oversight mechanism to hold cardholders and Approving Officials accountable for timely completion and approval of monthly statement reconciliation and consider disciplinary actions for repeat offenders. (Finding 1)

Revise purchase request and approval controls to implement a mechanism to hold cardholders accountable to obtain Approving Official’s approval prior to making purchases. (Finding 2)

Verify purchase transactions were for allowable expenses and consider remediation action of any unallowable or unauthorized charges. (Findings 2 and 3)

Develop and document a mechanism to hold the Agency Program Coordinator accountable for proper oversight of the overall purchase card program including periodic review of the supporting documentations, certificates of training, monthly reconciliation, and purchase request forms maintained by the Approving Officials. (Findings 1, 2, 3, 4)

Provide training for Approving Officials to ensure proper retention of required supporting documentations such as the evidence of cardholder’s reconciliation of statements, Approving Official’s approval of the statement, signed purchase request forms, copies of receipt/invoices, and certificate of training. (Findings 1, 2, 3, 4)

Implement a mechanism to hold travelers accountable to obtain travel approval prior to travel dates. (Finding 5)

Verify travel card transactions were for allowable expenses and consider remediation action of any unallowable or unauthorized charges. (Findings 5 and 7)

Develop an oversight mechanism to enforce its controls record retention of travel receipts and timely submission of travel authorizations and vouchers in accordance with Federal Travel Regulation and AmeriCorps policies and procedures. (Finding 5 and 6)

Research and verify that the travels were for official business purposes and maintain proper documentations to support the travel related charges. (Finding 7)