Open Recommendations

1. We recommend that Sunrise Hospital & Medical Center refund to the Medicare contractor $23,606,895 ($23,615,809 less $8,914 that the Hospital has already repaid) in net estimated overpayments for the audit period for claims that it incorrectly billed that are within the 4-year reopening period.

3. We recommend that Sunrise Hospital & Medical Center strengthen controls to ensure that: (1) all IRF beneficiaries meet Medicare criteria for acute inpatient rehabilitation and all required documentation is included in the medical records, (2) all inpatient beneficiaries meet Medicare requirements for inpatient hospital services, (3) outlier payments are calculated correctly by billing the correct units of service and charges on the claim and staff are properly trained, (4) the use of bypass modifiers is supported in the medical records and staff are properly trained, and (5) HCPCS codes are supported in the medical records and staff are properly…

We recommend that the BIA Division of Facilities Management and Construction ensure all funded and required minor improvement and repair projects have been completed and identify how much of the carried over $442,632 in restricted minor improvement and repair funds can and should be used to reconcile costs improperly paid from the BIE operations and maintenance fund.

We recommend that the DOI select and implement a CDM SWAM tool that is compatible with the DOI's computer environment.

We recommend that the DOI establish, implement, and continuously review and update approved software lists (blacklists and whitelists) to ensure that unapproved, unsupported, or potentially malicious software is not present on bureau computer networks.

Enforce standard operating procedures requiring clearly defined performance goals and include performance targets in all future SBDC and WBC cooperative agreements and grants to objectively measure performance results

Collect and analyze the CARES Act entrepreneurial development cooperative agreement recipient’s performance results and establish a framework for setting goals for technical assistance programs in response to future disasters. Retain the analysis in program files for future guidance.

We recommend the Executive Associate Director of Enforcement and RemovalOperations direct the Phoenix Enforcement and Removal Field Officeresponsible for LPCC to: Ensure compliance and remedial action is taken toaddress LPCC’s use of force incidents and allegations of detainee mistreatmentby staff when warranted.

Disallow the $592,737 in questioned match costs to recover the $254,014 in Federal costs from LearningWorks for the program years 2017 and 2018 due to inadequate documentation to support its in-kind match contributions: donated classroom and office space, and teaching and administrative staff hours;

Conduct an assessment of LearningWorks’ match contribution for its third-year funding to determine whether it met its match requirement, disallow any unsupported match contributions and recover any Federal funds that were overpaid as a result of LearningWorks’ failure to meet its match requirements.

Oversee the Maine Commission when coordinating with LearningWorks to revise its policies to define supporting documentation for the usage and valuation of donated spaces for in-kind contributions;

Instruct the Maine Commission to evaluate compliance of LearningWorks procedures on internal controls for time recordkeeping for donated personnel time at its service sites to provide reasonable assurance that charges are accurate, allowable, and allocable; and necessary.

Provide training to the Maine Commission staff and offer training to LearningWorks and other subgrantees concerning acceptable valuation and documentation of in-kind match costs.

Require the Maine Commission to develop and implement oversight or quality control of all fiscal monitoring performed by its staff.

Coordinate with the Maine Commission to develop guidance explaining and illustrating what constitutes acceptable documentation to support in-kind contributions;

Rec. 1: The DoD OIG recommended that the Director of the Federal Voting Assistance Program develop and implement agreements, such as memorandums of understanding, with all external stakeholder agencies to enhance outreach and ensure a collaborative and efficient effort to support Uniformed and Overseas Citizen Absentee Voter Act voters and their eligible family members, including those in deployed, dispersed, and tenant organizations.

CMS should Review States’ managed care payment data in T-MSIS and ensure that States have corrective action plans to improve data completeness and quality, as appropriate.

CMS should make public its reviews of States’ managed care payment data.

CMS should clarify and expand its initiative on payment data.

Use the fully defined ISA to: a. Assess enterprise, business process, and information system level risks;b. Formally define enterprise, business process, and information system level risk tolerance and appetite levels necessary for prioritizing and guiding risk management decisions;c. Conduct an organization wide security and privacy risk assessment; and,d. Conduct a supply chain risk assessment.

Using the results of recommendations one (1) and two (2)above:a. Collaborate with the DNFSB’s Cybersecurity Team to establish performance metrics in service level agreements to measure, report on, and monitor the risks related to contractor systems and services being monitored by IT Operations;b. Utilize guidance from the National Institute of Standards in Technology (NIST) Special Publication (SP) 800-55 (Rev. 1) – Performance Measurement Guide for Information Security to establish performance metrics to more effectively manage and optimize all domains of the DNFSB information security program;c. Implement a centralized view of risk across the organization; and,d. Implement formal procedures for prioritizing…

Implement automated mechanisms (e.g. machine-based, or user-based enforcement) to support the management of privileged accounts, including for the automatic removal/disabling of temporary, emergency, and inactive accounts, as appropriate.

Develop and implement a plan to address the challenges presented by the Unit’s organizational structure.

Establish minimum criteria for referrals of patient abuse and neglect to be sent to the MFCU.

Establish a process to coordinate on cases and improve collaboration with Federal partners.