Open Recommendations

We reccomend ACF leverage cloud security assessment tools to identify misconfigurations and weakcybersecurity controls in its cloud infrastructure.

We recommend ACF conduct testing of its cloud information systems that includes the emulation of anadversary's tactics and techniques on a defined reoccurring basis.

We recommend that the Alabama Medicaid Agency remediate the six control findings OIG identified.

We recommend Alabama evaluate its current vulnerability scanning tools and update if necessary in order to better detect system flaws (e.g., common web server vulnerabilities) in its MMIS and E&E system and software components.

We recommend Alabama require its developers to follow secure coding standards and best practices, at a minimum, such as those recommended by NIST SP 800-218 or the Open Web Application Security Project (OWASP), when developing web applications.

We recommend Alabama implement procedures to periodically verify that its developers are adhering to secure coding standards and remediating vulnerabilities before releasing code to production.

We recommend Alabama perform more robust technical testing of web-facing systems that includes the emulation of an adversary's tactics and techniques on a defined reoccurring basis in order to better assess the effectiveness of NIST 800-53 controls.

CMS should provide a standard notice template to help nursing homes provide complete and accurate information to residents facing discharge and Ombudsmen.

CMS should require nursing homes to systematically document facility-initiated discharges in information available to CMS and States to enhance oversight.

CMS should take steps to encourage more behavioral health providers to serve Medicare and Medicaid enrollees.

CMS should explore options to expand Medicare and Medicaid coverage to additional behavioral health providers.

CMS should use network adequacy standards to drive an increase in behavioral health providers in Medicare Advantage and Medicaid.

CMS should increase monitoring of Medicare and Medicaid enrollees' use of behavioral health services and identify vulnerabilities.

Establish formal procedures for obtaining and reviewing appropriate supporting documentation to ensure sales and investments are accurately reported.

Establish a plan to reduce wait times for optometry appointments.

Include a timestamp on the classification documentations for initial classification of each detainee and ensure staff maintain all classification paperwork, to include reclassification, in the detainee’s file.

Collect medical grievances within 24 hours of submission by a detainee and ensure staff maintain a copy of all paper medical grievances in the detainee’s medical file.

The District Director identifies reasons for noncompliance with timely documentation requirements of high-risk client contacts and outcomes in the electronic record and High Risk Suicide Flag SharePoint site, ensures requirements are met, and monitors compliance.

Establish thresholds for when to communicate electronically with passengers during en route delays and the frequency of updates about those delays. To track and assess performance, establish goals for how well the Customer Communications Team meets those thresholds.

Work with the Digital Technology department to establish a process to regularly report to Marketing and Operations department officials and senior leadership on the Customer Communications Team’s performance meeting the new goals for sending communications to customers about en route delays.

Measure and report performance to senior leadership on the call abandonment rate and the number of calls on hold for long periods. Assess the costs and benefits of improving in these two areas and use that assessment to establish goals to assess performance over time.

Work with relevant stakeholders to determine whether to continue using the feedback loop and, if so, how to increase its effectiveness, including a) determining which categories of cases to prioritize or remove, b) better ensuring cases are sent to the correct staff, and c) minimizing redundancy with other sources to the extent practical.

The Director ensures staff keep patient care areas safe and clean.

We recommend that the Kansas Department of Health and Environment improve its estate recovery program by confirming that all deceased Medicaid recipients who are subject to estate recovery are identified and by providing relevant information on those recipients to the contractor in a timely manner so as to give the contractor adequate time to file liens and initiate probate.

We recommend that the Kansas Department of Health and Environment improve its oversight of the estate recovery contractor's performance by: verifying that the contractor files liens and initiates probate in a timely manner; confirming that the contractor's current process for MMIS claims verification is accurate; and verifying that the contractor performs applicable estate recovery procedures (including the opening of cases, sending of notices, and independent asset research) for deceased Medicaid recipients.