Open Recommendations

We recommend that the PBS Commissioner address the specific vulnerabilities the OIG identified for the child care centers.

We recommended that the PBS Commissioner conduct a comprehensive assessment to identify security vulnerabilities at each child care center located in a GSA-controlled building and expedite action to upgrade these buildings to the minimum security standards. If PBS cannot address vulnerabilities identified in these buildings, the child care centers should be moved to safer locations.

Determine the allowability of the questioned transactions and recover $1,135,453, if applicable.

(a) Ensure that OIT monitors and promptly installs patches and antivirus updates across the enterprise when they are available from the vendor. Enhancements should include:Pending since FY 2017. (b) Implement a process to track patching of network devices and servers by the defined risk-based patch timelines in CNCS policy. (c) Monitor and record actions taken by the contractor to ensure vulnerability remediation for network devices and servers is addressed or the exposure to unpatchable vulnerabilities is minimized. (d) Replacement of information system components when support for the components is no longer available from the developer, vendor or manufacturer. (e) Enhance…

Ensure that OIT evaluates if the internet connections at the National Civilian Community Corps Campuses and Regional Offices are sufficient to allow patches to be deployed to all devices within the defined risk-based patch timeline in CNCS policy. If the internet connections are determined to be inadequate, develop and implement a plan to enhance the current internet connections.

Develop and implement a written process to perform periodic reconciliations between CMDB and the FasseTrack system.

Physically or mechanically disable the networking capability of the laptop used for member badging at the NCCC Pacific Region Campus.

Document and implement a process to validate that physical counselor files from the NCCC Southwest Region Campus are disposed of within six years after the date of the member’s graduation in accordance with the AmeriCorps NCCC Manual.

Federal regulations define rehabilitative services as services recommended by a licensed practitioner for maximum reduction of physical or mental disability and restoration of a beneficiary to their best possible functional level. State regulations for PACT, which the State agency defines in its Medicaid State plan as a rehabilitative program, stipulate that the prior authorization of services shall cover all dates that services were provided to ensure proper reimbursement. Although State regulations stipulate that a prior authorization should cover all dates of service, they do not specify a timeframe for which authorized services are eligible for Medicaid reimbursement. Essentially, this results…

Of the 100 sampled State agency claims for Federal Medicaid reimbursement of payments for PACT services, 50 complied with Federal and State requirements, but the remaining 50 did not. The below deficiencies were found and many of the claims had more than one deficiency. *Services not adequately supported or documented *Plan of care requirements not met *Required clinical disciplines not included on PACT team *Prior authorization requirements not met *No documentation of compliance with boarding home requirements *Documentation did not support 2 hours of face-to-face contact *No nursing assessment

Of the 100 sampled State agency claims for Federal Medicaid reimbursement of payments for PACT services, 50 complied with Federal and State requirements, but the remaining 50 did not. The deficiencies occurred because the State agency did not inform PACT providers of all Federal and State requirements for providing PACT services, and its monitoring procedures were not adequate to identify all instances when providers did not claim PACT services in accordance with these requirements. In fact, the monitoring procedures did not include checking whether some requirements were met. As a result, PACT providers did not follow requirements for providing PACT…

Of the 100 sampled, State agency claims for Federal Medicaid reimbursement of payments for PACT services, 50 complied with Federal and State requirements, but the remaining 50 did not. These deficiencies occurred because providers were not aware of all PACT requirements or did not adhere to the requirements.

Review IRDF’s use of prolonged administrative segregation and seek alternative housing when appropriate.

Ensure that, for detainees in administrative segregation, IRDF provides outdoor recreation and access to privileges similar to those offered to detainees in the general population, in compliance with 2011 PBNDS requirements.

Require IRDF staff to complete daily face-to-face medical visits with detainees in administrative segregation to ensure detainee welfare.

Review the IRDF facility conditions we identified as deficient to ensure corrective action in compliance with 2011 PBNDS requirements.

Require IRDF staff to provide written responses to medical grievances and provide copies to the detainees who filed the grievances.

More clearly identify time, duration, and location for facility visits to ensure detainees’ regular access to assigned ICE ERO deportation officers.

We recommend that the Centers for Medicare & Medicaid Services instruct the Medicare contractors to review the $2,263,465 in improper payments for claims with dates of service after the beneficiaries’ dates of death and initiate recoupment for the amounts identified as improper payments.

We recommend that the Centers for Medicare & Medicaid Services instruct the Medicare contractors to review deductible amounts that may have been incorrectly collected from beneficiaries or from someone on their behalf and take appropriate actions to resolve these amounts.

We recommend that Novitas Solutions, Inc. educate providers on how to correctly calculate the prorated mileage for phlebotomy travel allowance payments.

We recommend that Novitas Solutions, Inc. educate providers on their responsibility to bring any previously paid claims to their MAC's attention if they were paid using the wrong rate.

We recommend that Novitas Solutions, Inc. educate providers on their responsibility to maintain adequate documentation to support payment for phlebotomy travel allowance payments.

We recommend that Novitas Solutions, Inc. work with the Centers for Medicare & Medicaid Services to clarify guidance to providers, which could have resulted in savings totaling an estimated $2,373,676 during our audit period.

We recommend that the New York Department of Health refund $614,530 to the Federal Government.

Rec. 1.a: The DoD OIG recommended that the Defense Health Agency Director continue to monitor morphine milligrams equivalent per day by beneficiary, examine data for unusually high opioid prescriptions, and if appropriate, hold providers accountable for overprescribing opioids.

Conduct a detailed review of all payroll processed in 2018 and 2019 to identify payroll over and underpayments and complete this review within six months of the issuance of this report.

To the extent consistent with the law, reimburse employees that were identified as underpaid and attempt to recover payment from all employees that were identified as overpaid in the above review.

Ensure that LSC unallowable costs are charged to funding sources other than LSC and reflected within the financial software to provide an audit trail.

Recommendation is not publicly available.

Recommendation is not publicly available.

Recommendation is not publicly available.

Recommendation is not publicly available.

Recommendation is not publicly available.

Recommendation is not publicly available.

Recommendation is not publicly available.

Recommendation is not publicly available.

Recommendation is not publicly available.

Recommendation is not publicly available.

IHS should extend policies to address more types of perpetrators, victims, and abuse;

IHS should conduct additional outreach to Tribal communities to inform them of patient rights, solicit community concerns, and address barriers to reporting of patient abuse.

IHS should ensure that the new incident reporting system is effective and addresses the risks identified in the current system;

IHS should designate a central owner in IHS headquarters to ensure clear roles and responsibilities for shared ownership in implementing patient protection policies, and managing and responding to abuse reports;

IHS should continue to actively promote an organizational culture of transparency and work to resolve barriers to staff reporting of abuse

Perform a comprehensive review of FAA's root cause analysis training to ensure it meets Agency expectations. Modify training, as appropriate, based on the review and require inspectors to complete the course(s) or offer inspectors access to industry-based training programs.

Bureau of the Fiscal Service (Fiscal Service) management should finalize policies and procedures to review audit logs of production DB2 servers.

Bureau of the Fiscal Service (Fiscal Service) management should implement an oversight process to ensure that designated Fiscal Service personnel: a. Reviews the security logs for the UNIX and DB2 servers hosting the Payment Information Repository (PIR), Judgment Fund Internet Claim System (JFICS), and Security Payment System (SPS) applications on a pre-defined frequency, as indicated in the Fiscal Service Baseline Security Requirements (BLSR). b. Formally documents completion of their reviews and any escalations to the Information System Security Office (ISSO), and c. Retains the audit logs and documentation of its reviews for 18 months, as required by the BLSR.

Bureau of the Fiscal Service (Fiscal Service) management should periodically review Fiscal Service management's implementation and operation of the review the security audit logs for the UNIX and DB2 servers hosting the Payment Information Repository (PIR), Judgment Fund Internet Claim System (JFICS), and Secure Payment System (SPS) applications to determine that Fiscal Service management completes the reviews on a pre-defined basis, documents completion of the reviews and escalations, and maintains such documentation.