Open Recommendations

STB should address missing or unavailable supporting documentation with its shared service provider to ensure that document retrieval tools are available and are working properly to allow retrieval of all stored documents.

STB should obtain replacement documentation for employee forms and other documentation that have been determined to be incomplete or irretrievable from databases and other electronic sources following management's initial and periodic routine reviews.

STB management should implement and enforce its existing policies and procedures requiring the periodic review of all open obligations to ensure that closeout of completed contracts, including the de-obligation of funds and return of the balances for any advanced payments, is performed regularly and timely.

Clearly identify and publicly publish MSHA's jurisdiction, including obtaining any needed legal opinion from the U.S. Department of Labor Office of the Solicitor on the U.S. territories and the Federated States of Micronesia, the Republic of the Marshall Islands, and the Republic of Palau, requesting any needed legislative changes.

Revise MSHA's implementation plan for when it will begin inspecting mines within American Samoa, Guam, and the Commonwealth of the Northern Mariana Islands and begin implementing the plan. The revised plan should address: (1) when enforcement of the Mine Act and MSHA regulations will begin; (2) how inspections will occur in future years (e.g., travel from a specific MSHA district or setting up a field office nearby); (3) whether additional training will occur and how (e.g., in-person, virtual, hybrid, via grants, et cetera); and (4) how funding will be obtained to conduct required MSHA activities in FY 2025

Develop and implement a plan to enforce the Mine Act in the Federated States of Micronesia, the Republic of the Marshall Islands, and the Republic of Palau, having first obtained legal authority verifying they are still under MSHA's jurisdiction. If the legal authority opines MSHA has jurisdiction over them, MSHA's plan should address: (1) whether future legislative changes to the Mine Act are needed and requests to Congress; (2) when enforcement of the Mine Act and MSHA regulations will begin; (3) how inspections will occur in future years (e.g., travel from a specific MSHA district or setting up a field…

Verify mines within American Samoa, Guam, and the Commonwealth of the Northern Mariana Islands have properly submitted their Part 50 data to MSHA.

Update the status history for all mines within American Samoa, Guam, and the Commonwealth of the Northern Mariana Islands, including to reflect the periods for which they were operational. This should include adjustments needed after verifying the mines properly submitted their Part 50 data.

Update the mine status criteria to address the types of support (e.g., mine visit observation, closure notice submitted by operator, MSHA analysis of Part 50 data, et cetera) needed to put a mine in "abandoned" status and require support be documented in the related mine file.

Develop guidance for what to do with mines that have been issued a mine identification number and remained in "new mine" status for long periods of time because they never started operations.

Correct mine statuses for any mines that do not adhere to guidance and criteria updates made in response to this alert memorandum, which includes updating the mine status criteria requirements and developing guidance for mines remaining in "new mine" status for long periods of time.

Develop guidance on when mine identification numbers can be deactivated and reactivate any mine identification numbers in MSHA's system that do not adhere to that guidance.

Remove the exclusion of CAVs limitation from the public "inspections" dataset or transparently state any existing limitation(s) on the download description section of MSHA's website.

Develop and implement a culture transformation plan to ensure the integrity and ethical values expected are enforced throughout MSHA.

We recommend that management:
• Implement audit logging monitoring controls to reduce the risk that inappropriate and/or unusual activity that may compromise the integrity and availability of systems and data goes undetected and resolved.
• Design, document, and implement preventive controls to remove system application access within an acceptable timeframe following a user’s separation date.
• Enforce existing policies to ensure that all users are included within quarterly user access reviews.

We recommend that management:
• Implement audit logging monitoring controls to reduce the risk that inappropriate and/or unusual activity that may compromise the integrity and availability of systems and data goes undetected and resolved.
• Design, document, and implement controls to remove system application access within an acceptable timeframe following a user’s separation date.
• Design, document, and implement controls to grant system application access upon requested and approved business need and maintain evidence of such user access requests.

We recommend that management:
• Implement audit logging monitoring controls to reduce the risk that inappropriate and/or unusual activity that may compromise the integrity and availability of systems and data goes undetected and resolved.
• Enforce independent review of personnel’s system access and redesign existing policies and procedures in order to perform the review of all personnel’s access each fiscal year.
• Design, document, and implement preventive controls to remove system application access within an acceptable timeframe following a user’s separation date.

The Chief Information Officer should continue to comply with Treasury’s preliminary guidance on generative AI by identifying accesses to external domains and internet platforms from traffic logs and updating rulesets to restrict further access to these sites so the IRS is not inadvertently revealing sensitive and non-public information outside of the IRS.

The Chief Data and Analytics Officer should accelerate standing up the new governance structure and processes to ensure the safe, secure, and trustworthy development and use of artificial intelligence.

We recommend that the Utah Department of Health and Human Services improve its estate recovery program by establishing formal written estate recovery policies and procedures, to include policies and procedures regarding documentation to support its performance of estate recovery procedures for deceased Medicaid enrollees.

We recommend that the Utah Department of Health and Human Services improve its estate recovery program by implementing formal procedures to periodically review open cases and establish a timeframe for doing so.

We recommend that the Utah Department of Health and Human Services improve its estate recovery program by verifying that system edits are functioning properly and improving those system edits as necessary, and by verifying that caseworkers perform and document all applicable estate recovery procedures (including determining the amount of Medicaid paid claims, determining whether the enrollee had a surviving spouse or child(ren), and performing asset research) for deceased Medicaid enrollees.

We recommend that the Centers for Medicare & Medicaid Services take the following actions, which could have saved Medicare an estimated $190.1 million in payments made to acute-care
hospitals for outpatient services provided to hospice enrollees and could have saved enrollees an estimated $43.6 million in deductibles and coinsurance that may have been incorrectly
collected from them or from someone on their behalf during our audit period:

Improve system edit processes to help reduce improper payments for outpatient services provided by acute-care hospitals to hospice enrollees.

We recommend that the Centers for Medicare & Medicaid Services take the following actions, which could have saved Medicare an estimated $190.1 million in payments made to acute-care hospitals for outpatient services provided to hospice enrollees and could have saved enrollees an estimated $43.6 million in deductibles and coinsurance that may have been incorrectly collected from them or from someone on their behalf during our audit period:

Educate acute-care hospitals to understand that each hospice enrollee's hospice election statement addendum is available on request, and educate hospices to provide the addendum if requested to help an acute-care hospital assess whether…

We recommend that the Centers for Medicare & Medicaid Services take the following actions, which could have saved Medicare an estimated $190.1 million in payments made to acute-care hospitals for outpatient services provided to hospice enrollees and could have saved enrollees an estimated $43.6 million in deductibles and coinsurance that may have been incorrectly collected from them or from someone on their behalf during our audit period:

Continue to educate hospices that they should be providing to enrollees virtually all necessary services that palliate or manage terminal illnesses and related conditions either directly or through arrangements.