Open Recommendations

IHS should assign a centralized team (e.g., headquarters, area office) to: Securely configure and monitor wireless access points at all IHS hospitals.

IHS revise the IHM manual to require area offices to submit completed annual reviews to IHS headquarters;

IHS should assign a centralized team (e.g., headquarters, area office) to: Monitor and track end-of-service-life IT equipment that cannot be maintained centrally (e.g., switches or routers). IHS hospitals and area offices should provide a tracking spreadsheet to IHS headquarters on a periodic basis that highlights equipment that is reaching or has reached end of service life and replace such equipment or provide management approved justification for its continued use.

IHS should: Ensure that physical IT controls are included in each hospital’s risk assessment.

IHS work with hospitals to remediate the IT vulnerabilities identified.

IHS should ensure that all hospitals: Store backup tapes off-site in accordance with Federal guidelines.

IHS should ensure that all hospitals: Have a complete risk assessment, to include all IT assets, for all risks, both physical and information security, in accordance with IHS and NIST guidance.

IHS should assign a centralized team (e.g., headquarters, area office) to: Ensure patches are deployed timely to all IHS end points in accordance with NIST guidance and IHS policies and procedures.

USAID's Office of Acquisition and Assistance Cost, Audit and Support Division determine the allowability of $4,407,986 in direct questioned costs ($49,945 ineligible, $4,358,041 unsupported) on pages 2, and 12 through 30 of the report, and recover any amount that is unallowable.

We recommend that the State agency work with providers to improve their facilities, staffing, and training.

We recommend that the State agency improve its oversight and monitoring of providers by considering unannounced site visits and by enhancing its certification tool as it pertains to reviewing participant records.

CMS should take the steps necessary to seek statutory authority to include information from accrediting organizations on Hospice Compare.

CMS should educate hospices about common deficiencies and those that pose particular risks to beneficiaries

CMS should increase oversight of hospices with a history of serious deficiencies

CMS should include on Hospice Compare the survey reports from State agencies

CMS should include on Hospice Compare the survey reports from accrediting organizations, once authority is obtained

CMS should expand the deficiency data that accrediting organizations report to CMS and use these data to strengthen its oversight of hospices

CMS should monitor surveyors' use of Immediate Jeopardy citation

We recommend the Federal Coordinating Officer for FEMA-4339-PR conduct a comprehensive analysis of Cobra contract costs in accordance with PA grant guidelines and disallow any costs that are not reasonable.

We recommend that the New York State Department of Health refund $65,468,943 to the Federal Government.

Embassy Port-au-Prince should close out procurement files in accordance with Department standards.