Open Recommendations

(U) Rec. 1.b.ii: The DoD OIG recommended that the Under Secretary of Defense (Acquisition and Sustainment), by no later than the next periodic review process, identify and recommend updates to the DoD issuances identified in Recommendation 1.a. or the creation of new issuances to assign roles and responsibilities across the Joint Logistics Enterprise. At a minimum, the recommended updates should task existing logistics executive agents and offices of primary responsibility with coordinating and standardizing Joint Logistics Enterprise data, planning factors, tools, and logistics support area processes within their areas of responsibility.

(U) Rec. 1.b.iii: The DoD OIG recommended that the Under Secretary of Defense (Acquisition and Sustainment), by no later than the next periodic review process, identify and recommend updates to the DoD issuances identified in Recommendation 1.a. or the creation of new issuances to assign roles and responsibilities across the Joint Logistics Enterprise. At a minimum, the recommended updates should assign new executive agents and offices of primary responsibility to coordinate and standardize data, planning factors, tools, and logistics support area processes for areas within the Joint Logistics Enterprise that do not currently have an executive agent or office of…

CMS should Issue new guidance on the appropriate use of MAO clinical criteria in medical necessity reviews.

CMS should Update its audit protocols to address the issues identified in this report, such as MAO use of clinical criteria, and/or examine particular service types.

CMS should direct MAOs to take additional steps to identify and address vulnerabilities that can lead to manual review errors and system errors.

Establish a grievance tracking system to ensure timely responses to all detainee grievances filed at South Texas, with a completegrievance log.

Ensure compliance with segregation standards, including the use of restraints, access to recreation, legal calls, laundry services forbedding and clothing, mail, legal materials, and the law library.

The executive director of the Electronic Health Record Modernization Program Management Office complies with internal guidance and ensures the development of an integrated master schedule for the Electronic Health Record Modernization program that complies with standards adopted from GAO for scheduling.

The executive director of the Electronic Health Record Modernization Program Management Office takes action to improve stakeholder coordination in the development of the program schedules to ensure activities from all relevant VA entities are included.

The executive director of the Electronic Health Record Modernization Program Management Office develops procedures for when and how staff should perform an initial schedule risk analysis for the program and conduct periodic updates as needed.

The executive director of the Electronic Health Record Modernization Program Management Office ensures consistency between contract language and program office plans or other guidance identifying the entity or individuals responsible for developing and maintaining the program’s work breakdown structure and integrated master schedule.

Update NARA 1572, Preventing Theft and Vandalism of NARA Holdings in NARA Facilities, and its Supplement(s) to include documented procedures that include simplified reporting of internal incidents of loss, theft, or damage of NARA holdings.

We recommend that the Massachusetts Executive Office of Health and Human Services, Office of Medicaid continue to coordinate with DDS and DPPC to ensure that all reasonable suspicions of abuse and neglect are properly identified, reported, and investigated as needed.

We recommend that the Massachusetts Executive Office of Health and Human Services, Office of Medicaid require periodic training for DDS and group home staff on reporting reasonable suspicions of abuse and neglect.

HHS OCIO work with all OpDivs to ensure that: All systems on the network have a valid ATO. OpDivs should ensure that security authorization policies and procedures are fully developed and disseminated to the appropriate personnel to ensure that all OpDiv personnel understand the requirements for completing the ATO process.

HHS OCIO work with all OpDivs to ensure that: ISCM strategy and procedures should clearly define critical reporting metrics for reports utilized by internal and external stakeholders. Additionally, OpDivs should coordinate reporting efforts with the OCIO to ensure the definitions and reporting requirements are consistently implemented.

Continue implementation of an automated CDM solution that provides a centralized, enterprise-wide view of risks across all of HHS.

Update the ISCM strategy to include a more specific roadmap; including target dates, for ISCM deployment across the HHS enterprise.

HHS should perform an enterprise risk assessment over known control weaknesses (e.g., Authority to Operate, incomplete OpDiv provided system inventories, lack of OpDiv adherence to HHS information security policies) due to their federated environment and document an appropriate risk response (e.g., accept, avoid, mitigate, share, or transfer).

HHS OCIO work with all OpDivs to: Ensure that all operational systems have SSPs and FIPS 199 categorizations completed for information systems in accordance with HHS policy.

HHS OCIO work with all OpDivs to: Ensure that all OpDivs are completing security controls system assessments and POA&Ms at least quarterly or more frequently as defined by the OpDiv.

HHS OCIO work with all OpDivs to: Develop a management approved Configuration Management policy that addresses purpose, scope, roles, responsibilities, management commitment and coordination among organizational entities. This document should be tailored to the OpDivs' needs and be reviewed and updated according to HHS policy (at least every 3 years).

HHS OCIO work with the OpDivs to ensure that all DpDivs: Update and implement its personnel security policies to clearly articulate the personnel screening process along with the required access agreements that need to be completed prior to being granted system access. In addition, OpDivs should update and implement their procedures for retrieving and archiving user access agreements for internal control purposes.

HHS OCIO work with the OpDivs to ensure that all OpDivs: Develop and implement an ICAM strategy and authenticator management policy to ensure all information systems undergo a digital identity risk assessment to determine which systems require strong authentication. Once a risk assessment is complete, OpDivs should ensure that authentication mechanisms are implemented for all information systems.

HHS OCIO work with the OpDivs to ensure that all OpDivs: Establish a process for the review of privileged users on an annual basis to ensure compliance with HHS Policy. In addition, OpDivs should ensure that this process is created to identify: User access is still needed, User rights subscribe to the principle of least privileged, User actions are captured and monitored appropriately as dictated by HHS policy.

Update POS and MCS to include alerts to notify SSA employees of potential incorrect actions and required subsequent actions.

Update the Title II Redesign System to ensure it generates an alert when SSA has terminated benefits to a child upon attaining age 18; however, the benefit record indicates the individual is a full-time student after they attain age 18.

We recommend that the California Department of Health Care Services verify that deficiencies identified during annual provider-licensing inspections were corrected and that OTPs implemented their corrective action plans

We recommend that the California Department of Health Care Services consider performing additional postservice prepayment monitoring and postservice postpayment utilization reviews.

We recommend that the California Department of Health Care Services implement a system edit for identifying claims with an unreasonable number of counseling service units in 1 day and take appropriate action for the claims identified

We recommend that the California Department of Health Care Services revise the Drug Medi-Cal Billing Manual or provide additional guidance to OTPs regarding the allowable number of counseling service units and work with counties to ensure that their OTP billing manuals do not conflict with State regulations

We recommend that the California Department of Health Care Services take actions to ensure that OTPs comply with Federal and State requirements for providing and claiming reimbursement for OTP services.

We recommend that the California Department of Health Care Services take actions to ensure that OTPs provide the number of counseling services specified in a beneficiary’s treatment plan or document the reasons that counseling services were not provided as specified in the treatment plan.

We recommend that the California Department of Health Care Services take actions to ensure that OTPs maintain documentation supporting that a complete physical evaluation of a patient was performed, including the results of drug use, tuberculosis, and syphilis tests and the identity of the person who performed the physical evaluation.

We recommend that the California Department of Health Care Services take actions to ensure that OTPs have their physicians review and countersign beneficiaries’ treatment plans within the 14-day period as required.

We recommend that the Federal Emergency Management Agency Administratorimmediately issue modified COVID-19 Funeral Assistance operating proceduresthat align with the Individual Assistance Program and Policy Guide provisions9 OIG requested relevant documentation during a November 16, 2021 meeting with FEMA onthis topic.www.oig.dhs.gov 7 OIG-22-36We recommend that the Federal Emergency Management Agency Administrator immediately issue modified COVID-19 Funeral Assistance operating procedures that align with the Individual Assistance Program and Policy Guide provisions on ineligible funeral assistance expenses and ensure all future cost reimbursements by FEMA in connection with the COVID-19 Funeral Assistance Program are necessary expenses associated with funeral services and/or burials.

Oversee a data integrity review at the Yuma Border Patrol station for a sampling of detainees’ custody logs for 1 month, to ensure that theinformation reflected is accurate. If the problem persists, please provide additional training to Yuma station agents on how to document detainees’ activity logs accurately.

The Under Secretary for Health ensures that the National Practitioner Data Bank facility reporting practices align with federal regulations and Veterans Health Administration policy.

(U) Rec. A.1.c: The DoD OIG recommended that the Director of the Defense Health Agency, in conjunction with the Secretaries of the Military Departments, establish a working group to address the staffing challenges identified by Military Medical Treatment Facilities during this evaluation. The working group should establish milestones to establish a central authority with the knowledge of the Services' requests for individual and large group deployments of medical staff coming out of Military Medical Treatment Facilities and the associated risks to health care delivery.

(U) Rec. A.1.d: The DoD OIG recommended that the Director of the Defense Health Agency, in conjunction with the Secretaries of the Military Departments, establish a working group to address the staffing challenges identified by Military Medical Treatment Facilities during this evaluation. The working group should establish milestones to assess the ability of Military Medical Treatment Facilities to rapidly receive augmentation of medical staff from the Reserve Components.

(U) Rec. A.2.b: The DoD OIG recommended that the Director of the Defense Health Agency, in coordination with the Secretaries of the Military Departments identify the medical personnel requirements within the Military Medical Treatment Facilities, including clinicians, nurses, and support staff, needed for future long-term pandemic response and biological incidents.

We recommend that the South Carolina Department of Health and Human Services work with the Department of Disabilities and Special Needs to ensure that providers follow the reporting requirements for critical events.

We recommend that the South Carolina Department of Health and Human Services work with the Department of Disabilities and Special Needs to provide training to providers on recognizing and reporting critical incidents according to reporting requirements.

We recommend that the South Carolina Department of Health and Human Services work with the Department of Disabilities and Special Needs to perform analytical procedures, such as data matches, on Medicaid claims data to identify any unreported critical incidents, and investigate as needed.

We recommend that the South Carolina Department of Health and Human Services work with the Department of Disabilities and Special Needs to impose sanctions on providers to compel compliance with timely reporting requirements for allegations of ANE and deaths.

We recommend that the South Carolina Department of Health and Human Services work with the Department of Disabilities and Special Needs to require that the IMC contact providers before the results of internal reviews are due to ensure that providers submit such results within required timeframes.

We recommend that the South Carolina Department of Health and Human Services work with the Department of Disabilities and Special Needs to develop and implement strategies and processes to prevent future ANE incidents and unexplained beneficiary deaths.

(U) Rec. 1.b: The DoD OIG recommended that the Deputy Assistant Secretary of Defense for Housing track the implementation of the environmental health and safety module and necessary updates to the enterprise Military Housing system to ensure completion in February 2022 as planned.

(U) Rec. 1.c: The DoD OIG recommended that the Deputy Assistant Secretary of Defense for Housing require the Army and Air Force to upload current and prior resident information associated with each privatized military housing unit once the inventory is complete.

[Description omitted; DOJ has determined that this recommendation contains information that is limited official use or classified.]