Open Recommendations

We recommend that Palmetto Government Benefits Administrator, LLC decrease its Excess Plan Medicare segment pension assets by $9,196 and recognize $737,271 as the Excess Plan Palmetto Medicare segment pension assets as of January 1, 2017.

We recommend that Palmetto Government Benefits Administrator, LLC improve policies and procedures to ensure that going forward, it calculates Medicare segment pension assets in accordance with Federal requirements.

Rec. C.1: The DoD OIG recommended that the Assistant Secretary of Defense for Manpower and Reserve Affairs, in coordination with the Director of Manpower and Personnel for the National Guard Bureau, establish and implement a plan to identify whether the Challenge Program is achieving long-term benefits of providing opportunities for cadets to be productive citizens. The plan should include a process for collecting data beyond 1 year.

CMS should encourage MAOs to perform program integrity oversight using ordering NPIs.

We recommend EEOC's Office of Information Technology (OIT) review and remediate criticalrisk and high-risk vulnerabilities in accordance with EEOC OIT’s assessment of risk. Where risk acceptance is required for vulnerabilities based on EEOC's network operation, we recommend thatEEOC formally document the risk acceptance along with any associated mitigation activities.

We recommend that OPM modify FEHBP contract lanugage for all applicable records retention clauses to require the retention and accessibility of claims for 10 years plus the current year in a manner of OPM/HI's choosing.

We recommend OPM modify or add language in Section 1.9 of all FEHBP contracts to inlcude all relevant sections and attachments of CL 2017-13, or modify all FEHBP contracts to add relevant language stating that all CLs are an addendum to the contract language and enforceable as a contract requirement.

We recommend OPM modify or add language to the appropriate Section of the FFS and ER-HMO FEHBP contracts to state that all FWA-related recoveries must be deposited into the working capital or investment account within 30 days and returned to or accounted for in the FEHBP contingency reserve fund account within 60 days after receipt by the carrier.

We recommend that OPM add language to all FEHBP contracts requiring carriers to notify the OIG's Office of Investigations regarding their intention to share FEHBP fraudulent activity with outside parties, and obtain approval from OIG's Office of Investigations before sharing this information.

We recommend that OPM modify the ER-HMO and FFS contracts to require that vendors under Large Provider Agreements return all FWA-related recoveries to the carrier within 30 days, whereby carriers must deposit these recoveries into their working capital or investment account within 30 days. Once deposited into one of these accounts, the carrier must return the recoveries to the contingency reserve fund.

We recommend that OPM modify Section 2.3(g) and 2.3(g)(ii) to provide expectations for how carriers are to proactively identify overpayments and to define what it means by egregious errors.

We recommend that OPM modify Section 2.3(g) requring carriers to report on their collection efforts, including how promptly the carrier initiated collection once the erroneous payment was identified and the causes of the claim payment errors.

We recommend that OPM review the current recovery process in Section 2.3(g)(1) through (5) and consider whether the use of benefit offsets, after the first written notification is sent, would be more cost efficient.

We recommend that OPM modify FEHBP contracts to clarify the Agency's authority to recoup projected improper payments identified by statistical sampling.

We recommend modifying Section 2.6(g), in the amendment to the Coordination of Benefits section of the FFS contract, to allow for the recovery of low dollar claims that result from claims system errors.

We recommend the Assistant Secretary for Mine Safety and Health: Update system controls to improve compliance of MSHA violations with the Mine Act and MSHA guidance in the following instances: a. Verify only authorized violation types used; b. Include all required phrases automatically in the “Condition or Practice” entry when the inspector selects 103(a) citations, 104(g)(1) orders, 104(e)(1)/104(e)(2) orders, or 107(a) orders; c. Ensure 104(d) orders and 104(g)(1) orders cite eligible CFR sections; d. Verify the correlations between the CFR or Mine Act sections of 104(b) orders and the original violation; e. Verify 104(d)(1) orders, 104(d)(2) orders, 104(e)(1) orders, and…

We recommend the Assistant Secretary for Mine Safety and Health: Improve the violations termination process by decreasing the percentage of future untimely terminations, improving the use of 104(b) orders, and not allowing due dates to be extended unless for specific, justified reasons listed on the violation form.

We recommend the Assistant Secretary for Mine Safety and Health: Develop a metric to measure performance and an internal control to verify timely uploading of violations from the inspector’s laptop/tablet into MCAS.

We recommend the Assistant Secretary for Mine Safety and Health: Complete periodic reviews to determine whether MSHA personnel are meeting the timely upload and recording of violations in MCAS, terminating violations by the due date, and effectively using 104(b) orders.

We recommend the Assistant Secretary for Mine Safety and Health: Work with the Solicitor’s Office and the Federal Mine Safety and Health Review Commission to implement a process to ensure violations listed in settlement agreements or court decisions still comply with the Mine Act and Mathies test.

1. We recommend that Sunrise Hospital & Medical Center refund to the Medicare contractor $23,606,895 ($23,615,809 less $8,914 that the Hospital has already repaid) in net estimated overpayments for the audit period for claims that it incorrectly billed that are within the 4-year reopening period.

3. We recommend that Sunrise Hospital & Medical Center strengthen controls to ensure that: (1) all IRF beneficiaries meet Medicare criteria for acute inpatient rehabilitation and all required documentation is included in the medical records, (2) all inpatient beneficiaries meet Medicare requirements for inpatient hospital services, (3) outlier payments are calculated correctly by billing the correct units of service and charges on the claim and staff are properly trained, (4) the use of bypass modifiers is supported in the medical records and staff are properly trained, and (5) HCPCS codes are supported in the medical records and staff are properly…

We recommend that the DOI select and implement a CDM SWAM tool that is compatible with the DOI's computer environment.

We recommend that the DOI establish, implement, and continuously review and update approved software lists (blacklists and whitelists) to ensure that unapproved, unsupported, or potentially malicious software is not present on bureau computer networks.

Enforce standard operating procedures requiring clearly defined performance goals and include performance targets in all future SBDC and WBC cooperative agreements and grants to objectively measure performance results

Collect and analyze the CARES Act entrepreneurial development cooperative agreement recipient’s performance results and establish a framework for setting goals for technical assistance programs in response to future disasters. Retain the analysis in program files for future guidance.

We recommend the Executive Associate Director of Enforcement and RemovalOperations direct the Phoenix Enforcement and Removal Field Officeresponsible for LPCC to: Ensure compliance and remedial action is taken toaddress LPCC’s use of force incidents and allegations of detainee mistreatmentby staff when warranted.

Disallow the $592,737 in questioned match costs to recover the $254,014 in Federal costs from LearningWorks for the program years 2017 and 2018 due to inadequate documentation to support its in-kind match contributions: donated classroom and office space, and teaching and administrative staff hours;

Conduct an assessment of LearningWorks’ match contribution for its third-year funding to determine whether it met its match requirement, disallow any unsupported match contributions and recover any Federal funds that were overpaid as a result of LearningWorks’ failure to meet its match requirements.

Oversee the Maine Commission when coordinating with LearningWorks to revise its policies to define supporting documentation for the usage and valuation of donated spaces for in-kind contributions;

Instruct the Maine Commission to evaluate compliance of LearningWorks procedures on internal controls for time recordkeeping for donated personnel time at its service sites to provide reasonable assurance that charges are accurate, allowable, and allocable; and necessary.

Provide training to the Maine Commission staff and offer training to LearningWorks and other subgrantees concerning acceptable valuation and documentation of in-kind match costs.

Require the Maine Commission to develop and implement oversight or quality control of all fiscal monitoring performed by its staff.

Coordinate with the Maine Commission to develop guidance explaining and illustrating what constitutes acceptable documentation to support in-kind contributions;

Rec. 1: The DoD OIG recommended that the Director of the Federal Voting Assistance Program develop and implement agreements, such as memorandums of understanding, with all external stakeholder agencies to enhance outreach and ensure a collaborative and efficient effort to support Uniformed and Overseas Citizen Absentee Voter Act voters and their eligible family members, including those in deployed, dispersed, and tenant organizations.

CMS should Review States’ managed care payment data in T-MSIS and ensure that States have corrective action plans to improve data completeness and quality, as appropriate.

CMS should make public its reviews of States’ managed care payment data.

CMS should clarify and expand its initiative on payment data.

Use the fully defined ISA to: a. Assess enterprise, business process, and information system level risks;b. Formally define enterprise, business process, and information system level risk tolerance and appetite levels necessary for prioritizing and guiding risk management decisions;c. Conduct an organization wide security and privacy risk assessment; and,d. Conduct a supply chain risk assessment.

Using the results of recommendations one (1) and two (2)above:a. Collaborate with the DNFSB’s Cybersecurity Team to establish performance metrics in service level agreements to measure, report on, and monitor the risks related to contractor systems and services being monitored by IT Operations;b. Utilize guidance from the National Institute of Standards in Technology (NIST) Special Publication (SP) 800-55 (Rev. 1) – Performance Measurement Guide for Information Security to establish performance metrics to more effectively manage and optimize all domains of the DNFSB information security program;c. Implement a centralized view of risk across the organization; and,d. Implement formal procedures for prioritizing…

Implement automated mechanisms (e.g. machine-based, or user-based enforcement) to support the management of privileged accounts, including for the automatic removal/disabling of temporary, emergency, and inactive accounts, as appropriate.

Develop and implement a plan to address the challenges presented by the Unit’s organizational structure.

Establish minimum criteria for referrals of patient abuse and neglect to be sent to the MFCU.

Establish a process to coordinate on cases and improve collaboration with Federal partners.

Take steps to ensure that Unit staff report all convictions and adverse actions to Federal partners within the appropriate timeframes.

Take steps to ensure that newly hired investigators complete new employee trainings.

Take steps to ensure that supervisory reviews of case files are conducted and documented in accordance with Unit policy.

We recommend EEOC ensure that emailed policy memos are promptly updated in the appropriate EEOC Directives Transmittal Order.

We recommend EEOC management update its policies and procedures to include all required safeguards and internal controls to be compliant with the Government Charge Card Abuse Prevention Act of 2012. In addition, EEOC should create a monitoring control to review the policy when changes or updates are made to federal law or Office of Management and Budget or General Services Administration guidance.

Standardize documentation required in alien files that Customs and Border Protection needs to include for transfer of aliens from Customs and Border Protection to Immigration and Customs Enforcement, Enforcement and Removal Operations custody that will apply to all field offices.