Open Recommendations

Develop and implement a culture transformation plan to ensure the integrity and ethical values expected are enforced throughout MSHA.

We recommend that management:
• Implement audit logging monitoring controls to reduce the risk that inappropriate and/or unusual activity that may compromise the integrity and availability of systems and data goes undetected and resolved.
• Design, document, and implement controls to remove system application access within an acceptable timeframe following a user’s separation date.
• Design, document, and implement controls to grant system application access upon requested and approved business need and maintain evidence of such user access requests.

The Chief Information Officer should continue to comply with Treasury’s preliminary guidance on generative AI by identifying accesses to external domains and internet platforms from traffic logs and updating rulesets to restrict further access to these sites so the IRS is not inadvertently revealing sensitive and non-public information outside of the IRS.

The Chief Data and Analytics Officer should accelerate standing up the new governance structure and processes to ensure the safe, secure, and trustworthy development and use of artificial intelligence.

We recommend that the Utah Department of Health and Human Services improve its estate recovery program by establishing formal written estate recovery policies and procedures, to include policies and procedures regarding documentation to support its performance of estate recovery procedures for deceased Medicaid enrollees.

We recommend that the Utah Department of Health and Human Services improve its estate recovery program by implementing formal procedures to periodically review open cases and establish a timeframe for doing so.

We recommend that the Utah Department of Health and Human Services improve its estate recovery program by verifying that system edits are functioning properly and improving those system edits as necessary, and by verifying that caseworkers perform and document all applicable estate recovery procedures (including determining the amount of Medicaid paid claims, determining whether the enrollee had a surviving spouse or child(ren), and performing asset research) for deceased Medicaid enrollees.

We recommend that the Centers for Medicare & Medicaid Services take the following actions, which could have saved Medicare an estimated $190.1 million in payments made to acute-care
hospitals for outpatient services provided to hospice enrollees and could have saved enrollees an estimated $43.6 million in deductibles and coinsurance that may have been incorrectly
collected from them or from someone on their behalf during our audit period:

Improve system edit processes to help reduce improper payments for outpatient services provided by acute-care hospitals to hospice enrollees.

We recommend that the Centers for Medicare & Medicaid Services take the following actions, which could have saved Medicare an estimated $190.1 million in payments made to acute-care hospitals for outpatient services provided to hospice enrollees and could have saved enrollees an estimated $43.6 million in deductibles and coinsurance that may have been incorrectly collected from them or from someone on their behalf during our audit period:

Educate acute-care hospitals to understand that each hospice enrollee's hospice election statement addendum is available on request, and educate hospices to provide the addendum if requested to help an acute-care hospital assess whether…

We recommend that the Centers for Medicare & Medicaid Services take the following actions, which could have saved Medicare an estimated $190.1 million in payments made to acute-care hospitals for outpatient services provided to hospice enrollees and could have saved enrollees an estimated $43.6 million in deductibles and coinsurance that may have been incorrectly collected from them or from someone on their behalf during our audit period:

Continue to educate hospices that they should be providing to enrollees virtually all necessary services that palliate or manage terminal illnesses and related conditions either directly or through arrangements.

We recommend that the Centers for Medicare & Medicaid Services take the following actions, which could have saved Medicare an estimated $190.1 million in payments made to acute-care hospitals for outpatient services provided to hospice enrollees and could have saved enrollees an estimated $43.6 million in deductibles and coinsurance that may have been incorrectly collected from them or from someone on their behalf during our audit period:

Educate acute-care hospitals to analyze not only whether outpatient services palliated or managed enrollees' terminal illnesses but also whether outpatient services palliated or managed a condition related to a terminal illness.

We recommend that the Centers for Medicare & Medicaid Services take the following actions, which could have saved Medicare an estimated $190.1 million in payments made to acute-care hospitals for outpatient services provided to hospice enrollees and could have saved enrollees an estimated $43.6 million in deductibles and coinsurance that may have been incorrectly
collected from them or from someone on their behalf during our audit period:

Clarify the language in the Manual (chapter 11, section 50), and in other CMS or MAC guidance documents or educational initiatives, if necessary, to specifically mention "related conditions" so that the language is…

We recommend that the Centers for Medicare & Medicaid Services take the following actions, which could have saved Medicare an estimated $190.1 million in payments made to acute-care
hospitals for outpatient services provided to hospice enrollees and could have saved enrollees an estimated $43.6 million in deductibles and coinsurance that may have been incorrectly collected from them or from someone on their behalf during our audit period:

Direct MACs or other appropriate contractors, such as Recovery Audit Contractors, to: (1) analyze Medicare claims data to identify acute-care hospitals that have aberrant billing patterns for condition code 07, and conduct Targeted…

We recommend that the Health Resources and Services Administration require the six hospices identified in our report as having used PRF payments for unallowable expenditures, totaling $8,306,519, to return the PRF payments to the Federal Government or ensure that the hospices properly replace the unallowable expenditures with allowable unreimbursed lost revenues or eligible expenses, if applicable.

We recommend that the Health Resources and Services Administration work with the hospice identified in our report as having used $3,967,025 of its PRF payments for potentially unallowable expenditures to determine what amounts should have been allocated and require the hospice to return unallowable amounts to the Federal Government or ensure that the hospice properly replaces these unallowable expenditures with unreimbursed lost revenues or eligible expenses, if applicable.

We recommend that the Maine Department of Health and Human Services, Office of Child and Family Services provide additional training to caseworkers and supervisors as appropriate, to achieve compliance with requirements for the immediate screening, risk and safety assessment, and investigation of reports of child abuse and neglect.

We recommend that the Maine Department of Health and Human Services, Office of Child and Family Services develop written policies and procedures that require its supervisors to review and approve documentation of caseworker interviews with children and adults.

We recommend that the Maine Department of Health and Human Services, Office of Child and Family Services develop written policies and procedures that require its supervisors to monitor aging reports on a weekly basis to promptly identify delays in the investigation process.

We recommend that the Maine Department of Health and Human Services, Office of Child and Family Services develop written policies and procedures that outline the steps a caseworker must take to override a report from screened-out to screened-in and manually input a response time.

We recommend that the Maine Department of Health and Human Services, Office of Child and Family Services develop written policies and procedures that requires supporting documentation to be maintained within Katahdin to demonstrate that written notification letters were sent.

Develop a centralized system and institute a phone log system to modernize and streamline the chartering application process.

Quantify and clarify the deferral process for organizing groups by establishing clear guidelines and milestones to ensure enhanced transparency and understanding.

Post detailed information about the NCUA’s charter deferral process on the agency’s website to clearly communicate expectations and provide organizing groups with a transparent and comprehensive understanding of deferrals within the charter application process.

Include and publish language in the updated version of the AS-701 to clarify the requirements to report lost, stolen, or missing assets or materials to the Postal Inspection Service.

Review the 187 loans that matched to a related COVID-19 EIDL or PPP loan with a fraud hold code for legitimacy and eligibility. If any of the 187 loans are found to be illegitimate, ineligible, or fraudulent, take appropriate action to 1) prevent disbursement of funds, 2) recover the funds, and 3) refer potentially fraudulent loans to OIG.

We recommend that the Centers for Medicare & Medicaid Services review noncompliant hospitals associated with our findings and, if CMS determines that the hospitals are noncompliant, execute CMS's enforcement measures, to include issuing warning notices, corrective action plans, and/or civil monetary penalties as applicable.

We recommend that the Centers for Medicare & Medicaid Services use the information in this report and consider implementing changes suggested by hospitals, including providing written guidance clarifying the definition of "shoppable services" and developing a training and compliance program that is tailored for smaller hospitals.

We recommend that the Centers for Medicare & Medicaid Services continue to strengthen its internal controls, to include allocating sufficient resources to maintain a robust program of reviews of the hospitals and their compliance with the HPT rule.

We recommend that USAID/Rwanda verify that Never Again Rwanda corrects the one instance of material noncompliance detailed on page 19 of the audit report.

Review and inventory its own records and work with grantees to develop a definitive and authoritative record of LSC-funded real property and supporting documents that is complete, accurate and consistently updated.

Compile a comprehensive list of LSC-funded real property for which no property interest agreements can be located and execute property interest agreements if necessary.

Implement the GrantEase real property module and use it as a tool to reconcile grantees’ LSC-funded real property and supporting documents with OCE’s records on an annual basis as part of the FSRM financial statement review.

Update its FSRM guidance to identify and clarify the Fiscal Analysts’ roles and responsibilities regarding completion of the FSRM sections related to LSC-funded real property and updates to OCE’s Oversight Chart.

Develop and implement a plan (with milestones) to provide training to LSC grantees on their responsibilities regarding LSC-funded real property, including retention of records, authorized use of property, and accurate annual reporting.

Require that grantees with inaccurate annual LSC-funded real property accountings work with their auditors to correct errors and certify to LSC that the errors have been corrected in the next fiscal year.

Work with Grantee H to determine whether its LSC-funded vacant lot is needed for current operations or, if not, to dispose of the vacant lot in accordance with Subpart E of 45 C.F.R. Part 1631

Ensure that OCE’s updated Policies and Procedures Manual accurately describes and addresses current regulations, as well as OCE’s responsibilities as they relate to grantees’ LSC-funded real property.

Review existing property interest agreements for all LSC-funded properties to assess whether the agreement conditions (i) identify the applicable requirements of 45 C.F.R. Part 1631 and (ii) include language to ensure that the parties include the cost of LSC-funded capital improvements when determining LSC’s interest in proceeds from disposition.

Issue guidance and negotiate with LSC grantees, if necessary, to amend existing property interest agreements, to ensure the agreements include the requirements of 45 C.F.R. Part 1631 and that LSC’s interest in real property related to LSC’s investment in capital improvements is protected.

Work with grantees without property interest agreements to identify LSC-funded capital improvement costs and assess whether the parties should negotiate agreements to protect LSC’s interest in properties that the grantees did not initially acquire with LSC funds.

Housing should refine access controls within the FHA Catalyst modules that are dynamic, are tailored to user actions, and require continuous reauthentication to ensure that users have access only to information needed.

Housing should coordinate with HUD's SOC to
a. Ensure that FHA Catalyst user behavior monitoring logs are regularly captured and adequately reviewed for discrepancies in user activities.
b. Establish program office responsibility for the log review process.
?

Develop a supply chain risk management strategy that includes (a) a supply chain risk appetite and tolerance, (b) an enterprise supply chain risk management governance structure, and (c) supply chain risk assessment processes that include migration strategies or controls.

Document and implement a baseline review and escalation process for data loss prevention alerts.

Reinforce the requirements for identifying and documenting system interconnections as part of the Board’s training on its cyber risk management application and require all relevant individuals to take the training.

Evaluate and implement options to enforce the agency’s existing guidance related to identifying and documenting system interconnections.

Develop and implement a mobile application scanning program that includes a vulnerability scanning solution and process to identify and remediate vulnerabilities.

Ensure that the Board’s Incident Notification and Breach Response Plan is reviewed, tested and approved annually.

Incorporate targeted phishing exercises into the Board’s security awareness and training program and processes.

Complete finalization of an agencywide data classification policy that accounts for the sensitivity of the data maintained by the CFPB.