Open Recommendations

We recommend that the HHS OCIO work with the ODPIVs ensure that: Role-based training is obtained for all users with significant security responsibilities before granting access to the system and annually thereafter.

We recommend that the HHS OCIO: Require each OPDIV to develop a POA&M to implement activities required to achieve an effective maturity level for contingency planning, pending HHS risk assessment.

We recommend that the HHS OCIO work with the OPDIV to: Implement threat profiling techniques within the defined framework that helps management understand where the OPDIV’s high-value assets are located, who could be interested in taking control of them, and what attack vectors and under which scenarios they would likely be used to exploit vulnerabilities to succeed in their pursuits.

The Information Security and Privacy Policy (IS2P) is HHS’ primary policy document governing cybersecurity which is pending a rewrite to address the upcoming requirements in NIST 800-53 revision 5. When this update occurs to the IS2P, HHS should: - Specify required cybersecurity control maturity levels in addition to identifying the selection of NIST controls. - Describe HHS’ Cybersecurity Shared Responsibility Model, including the key roles under centralized, federated and hybrid strategies for control implementation. Include responsibilities of the OCIO, the OPDIVs, and third-party stakeholders (including contractors). - Communicate that a Managed and Measurable or the optimal maturity level, based on…

We recommend that the HHS OCIO work with the OPDIVs to: Implement the enterprise-wide configuration management plan, working with system owners to align system configuration management plans with the enterprise plan.

We recommend that the HHS OCIO work with the ODPIVs ensure that: A process be designed and implemented that ensures the collection and maintenance of artifacts evidencing the successful completion of annual RBT for all users with significant security responsibilities.

We recommend that the HHS OCIO work with the OPDIVs to ensure that all ODPIVs: Create and implement a process to require privileged users to sign a privileged user rules of behavior agreement for all systems prior to provisioning privileged access to those systems.

We recommend that the HHS OCIO: Work with the OPDIVs to ensure that all PIAs are reviewed, approved and signed by the appropriate HHS personnel at a minimum within three (3) years of the last PIA approval date.

HHS should continue to provide department-wide guidance and DHS-supplied Continuous Diagnostics and Mitigation (CDM) tools to each OPDIV for the implementation of their ISCM programs.

We recommend that the HHS OCIO work with the ODPIVs ensure that: OPDIVs’ security management improve their processes to consistently and accurately track training to ensure that everyone has taken the training prior to granting them system access. Obtain and retain training certificates as evidence of completed training.

We recommend that the HHS OCIO work with the OPDIVs to: - Review the monthly reconciliation report, currently provided by the HHS OCIO, to ensure that discrepancies on the POA&M exception report are corrected to enable accurate OPDIV and Department-level reporting.

HHS should commit to creating and implementing a Cybersecurity Maturity Migration Strategy to advance the cybersecurity program from its current maturity state to an effective state across HHS. This strategy should include the following: - Perform a risk assessment and identify the optimal maturity level that achieves cost-effective security based on your missions and risks faced, risk appetite, and risk tolerance level. - Identify gaps between the current state at each OPDIV and the criteria required to reach the optimal level across HHS’ enterprise-wide cybersecurity program and develop security controls to implement effective security. - Ensure the requirements for all…

We recommend that the HHS OCIO work with the OPDIVs to ensure that all ODPIVs: Establish a repository to retain signed copies of privileged user rules of behavior agreements for holders of privileged access for all systems.

We recommend that OPM evaluate any study conducted pursuant to Recommendation 1 and, with due diligence, formulate recommendations and a plan for agency action based on the best interests of the government, the FEHBP, and its enrollees.

Using the results of recommendations one (1) and two (2) :a. Implement an automated solution to help maintain an up-to-date, complete, accurate, and readily available Agency-wide view of the security configurations for all its GSS components; Cybersecurity Team exports metrics and vulnerability reports and sends them to the CISO and CIO’s Office monthly for review. Develop a centralized dashboard that Cybersecurity Team and the CISO can populate for real-time assessments of compliance and security policies.b. Collaborate with DNFSB Cybersecurity Team Support to establish performance metrics in service level agreements to measure, report on, and monitor the risks related to contractor…

NIH should update its training materials routinely to include informationabout breaches of peer reviewer confidentiality and possibleundue foreign influence.

NIH should require all peer reviewers to attend periodic trainings aboutpeer review integrity.

NIH should conduct targeted, risk-based oversight of peer reviewers using analysis of information about threats to research integrity.

NIH should consult with Federal law enforcement and national securityexperts to determine what additional steps it might take toidentify and address potential risks to the confidentiality of thepeer review process, including possible undue foreign influence.

Ensure future process changes are implemented according to change management best practices noted by GAO.

The Office ofInformation Technology (OIT), in partnership with OFP and OFO, should re-evaluate IMS requirements, and requirementsfor the framework of its successor system, to determine what additional reporting functionalities are needed in order to analyze data about staff and office productivity. A Voice of the Customer exercise or a user requirement meeting could serve as starting point to gather current requirements from IMS main users (OFP and OFO) and to determine what other current systems need to be integrated to make them function in alignment with IMS (Power BI, Complainant Portal).

OIT developers should meet directly with software users, such as OFO attorneys and supervisory attorneys and OFP AJs and Supervisory AJs(SAJ)to determine additional requirements.

OFO and OFP, in partnership with OIT, should consider development of an IMS training guide or document that is consistently updated and reviewed following upgrades, enhancements or modifications of the software. This guide should include all necessary codes for every action item in the process and should be available for all product users. This guide should ensure that product users track all mandated steps in IMS. Given that each office’s staff has their own needs within IMS: One guide should be made for OFP legal techs, AJs, and SAJs. A separate guide should be available for OFO CCD staff, attorneys…

Assign a target amount of days for intake so that management can determine if changes implemented impact the efficiency of the process.

We recommend that the New York State Department of Health obtain and review the results of MCO site visits at adult day care facilities as part of its beneficiary health and safety monitoring activities.

We recommend that the New York State Department of Health ensure that MCOs work with their contracted adult day care services providers to correct the 476 instances of noncompliance with health and safety requirements identified in this report.

We recommend that the New York State Department of Health require MCOs to improve their site visit procedures to ensure compliance with health and safety requirements detailed in the State agency’s CMS-approved MCO contract and New York’s regulations on adult day care programs.

Establish controls that mitigate the risk of inmates communicating with unknown and un-vetted parties and take steps, including the utilization of available technological features as found in TRULINCS, to reduce the risk of mass emails being received by high-risk inmates, including terrorist inmates.

Review cellblock conversation monitoring policy, procedures, and capabilities to determine whether and how improvements can be made to achieve security goals, including improvement of audio monitoring systems.

Revisit its social communication monitoring policy for high-risk inmates, including terrorist inmates, to better ensure that all visits between terrorist inmates and their visitors are sufficiently monitored.

We recommend that BMA exercise reasonable diligence to identify and return any additional similar overpayments outside of our audit period, in accordance with the 60-day rule, and identify any returned overpayments as having been made in accordance with this recommendation

We recommend that BMA refund to the Federal Government the portion of the estimated $96,185 in improper payments for claims incorrectly billed to the Medicare program that are within the reopening period

We recommend that BMA for the remaining portion of the estimated $96,185 in improper payments for claims that are outside of the Medicare reopening period, exercise reasonable diligence to identify any additional similar improper payments in accordance with the 60-day rule, and identify any returned overpayments as having been made in accordance with this recommendation

We recommend that the U.S. Department of Health and Human Services, Assistant Secretary for Financial Resources continue the grant remediation process to close remaining pooled accounts in the PMS.

We recommend that the U.S. Department of Health and Human Services, Assistant Secretary for Financial Resources work with CMS to: 1. implement an electronic grant management system for CMCS and CCSQ, 2.assign clear roles and responsibilities related to grant closeout activities at CMCS, and 3. clarify CMCS’s ability to close out its grants.

Information is maintained in case files to support that eligibility determinations were performed in accordance with Federal and State requirements.

Redetermine, as appropriate, the current Medicaid eligibility of the sampled beneficiaries who may not have met Federal and State eligibility requirements

Ensure that: all eligibility requirements, including those pertaining to resources, are properly verified during annual redeterminations for all non-newly eligible beneficiaries

Ensure that the 55 developments without sufficient support for an exemption either support the exemption status or complete the required lead-based paint inspections and provide the documentation to the appropriate field office.

Ensure that the remaining 244 developments' exemption status is properly supported.

Ensure that the 382 potentially noncompliant developments are reported in its response tracking system and reviewed for compliance with the Lead Safe Housing Rule.

Implement a comprehensive case management system that allows for efficient access to case documents and information.

[Description omitted; DOJ has determined that this recommendation contains information that is limited official use or classified.]

[Description omitted; DOJ has determined that this recommendation contains information that is limited official use or classified.]

We recommend that CMS issue clarifying guidance to States to help ensure that they use all of the diagnosis codes that inpatient hospitals report to them to identify PPCs.

We recommend that CMS work with States to ensure that their systems and processes for identifying PPCs use all diagnosis codes reported by inpatient hospitals.

We recommend that CMS issue a revised State plan preprint that contains all of the provisions identified in Federal requirements, if CMS continues to require States to use the preprint.

We recommend that CMS issue clarifying guidance to States to help ensure that they correctly use the Medicare HAC list to identify PPCs.

We recommend that CMS issue clarifying guidance to States to help ensure that they acquire from all inpatient hospital providers the information necessary to determine whether Medicare crossover claims contain PPCs and fully understand how to determine whether a crossover claim containing a PPC requires a payment adjustment.

We recommend that CMS issue clarifying guidance to States to help ensure that they identify PPCs on inpatient claims from all inpatient hospitals.