Open Recommendations

We recommend that the Centers for Medicare & Medicaid Services revise its billing guidance to specify that OTPs should not bill add-on HCPCS codes for take-home supplies of medication for the same episode of care that was already covered by a weekly bundle that included medication, and instruct MACs to implement edits in their claims processing systems to identify improperly billed claims for take‑home medication.

We recommend that the Centers for Medicare & Medicaid Services instruct MACs, based upon the results of this audit, to notify appropriate providers (i.e., those for whom CMS determines this audit constitutes credible information of potential overpayments) so that the providers can exercise reasonable diligence to identify, report, and return any overpayments, up to $17,817,121, in accordance with the 60-day rule and identify any of those returned overpayments as having been made in accordance with this recommendation.

We recommend that the Centers for Medicare & Medicaid Services develop billing requirements for OTPs to include OUD diagnosis codes on claims for OUD treatment services to indicate that enrollees have OUD diagnoses, and consider working with MACs to implement a system edit to ensure that OTP payments are made for enrollees only when OUD diagnosis codes are included on claims.

Continue its efforts to prioritize projects that address the complexities required across EL tiers to meet the intermediate (EL2) maturity level in accordance with OMB M-21-31.

Revise its policies and procedures to document and implement a lessons learned process based on risk events within the ISCM and Risk Management areas. System security personnel should be instructed to record, analyze, and revise control activities to improve NASA's security posture.

Continue to implement the necessary entity-wide oversight to improve enforcement mechanisms and controls to ensure all standard baselines and vulnerabilities are monitored and remediated in accordance with Federal and Agency requirements.

Ensure that the security controls in control families PM, PT, and SR are updated and defined within the Agency's ISCM strategy.

Document the NMI process in NASA's ISCM Strategy to ensure its hardware inventory monitoring process is accurate, complete, and fully aligns with NASA's other continuous monitoring guidance and integrates processes, associated outputs, and incorporates results to provide situational awareness.

The Director, Field Collection, SB/SE Division, should improve new revenue officer training by adding direct contact scenarios pertaining to taxpayers’ statements concerning their right to representation.

Update the vulnerability remediation process, including monitoring corrective actions for vulnerabilities identified during the scanning process, monitoring vendor patch releases and end-of-life notifications, and monitoring patching tools to ensure patches are applied in a timely manner

Enhance the software management process to monitor vendor end-of-life notifications and implement upgrade or removal plans before the vendor support ends. The software management process should ensure that software is either upgraded or removed from all systems, and the vulnerability scanning process should identify individual systems that were missed by the software management process

Update the vulnerability remediation process, including monitoring corrective actions for vulnerabilities identified during the scanning process, monitoring vendor patch releases and end-of-life notifications, and monitoring patching tools to ensure patches are applied in a timely manner.

Enhance the software management process to monitor vendor end-of-life notifications and implement upgrade or removal plans before the vendor support ends. The software management process should ensure that software is either upgraded or removed from all systems, and the vulnerability scanning process should identify individual systems that were missed by the software management process.

The Charles George VA Medical Center Director evaluates processes for mental health consult scheduling, including community care referrals, and ensures patients are offered timely appointments, per Veterans Health Administration policies.

(U) Rec. 1: Report is Classified.

(U) Rec. 2: Report is Classified.

Determine the allowability of the questioned transactions and recover $2,892,004, if applicable.

Create an internal control or system edit to ensure Social Security Administration employees contact a beneficiary and complete a Form SSA-455, Disability Update Report, before they mark a continuing disability review mailer as deferred.

Enhance the quality review process to ensure continuing disability review mailers are processed correctly.

We recommend that the Chief Operating Officer require SEAD to periodically evaluate its outreach efforts and makeappropriate changes to its outreach practices.

We recommend that the Chief Operating Officer establish a coordinated effort between the different FSA offices to ensureoutreach is provided to all underserved communities appropriately.

We recommend that the Chief Operating Officer use the additional demographic data from the 2024-2025 FAFSA to makedecisions when identifying and conducting outreach to individuals in underserved communities.

We recommend that the Chief Operating Officer require SEAD to coordinate with partners to understand whichunderserved communities the partner serves.

The Office of Programs should develop and document a comprehensive set of controls over the entirety of the 12(o) lien process and consolidate those controls into a singular location so that they are both easily referenced and tested.

The Office of Programs should implement a comprehensive tracking system for 12(o) liens to ensure that all 12(o) liens are identified, monitored, and collected.