Open Recommendations

Ensure compliance with segregation standards, including the use of restraints, access to recreation, legal calls, laundry services forbedding and clothing, mail, legal materials, and the law library.

Update NARA 1572, Preventing Theft and Vandalism of NARA Holdings in NARA Facilities, and its Supplement(s) to include documented procedures that include simplified reporting of internal incidents of loss, theft, or damage of NARA holdings.

We recommend that the Massachusetts Executive Office of Health and Human Services, Office of Medicaid continue to coordinate with DDS and DPPC to ensure that all reasonable suspicions of abuse and neglect are properly identified, reported, and investigated as needed.

We recommend that the Massachusetts Executive Office of Health and Human Services, Office of Medicaid require periodic training for DDS and group home staff on reporting reasonable suspicions of abuse and neglect.

HHS OCIO work with all OpDivs to ensure that: All systems on the network have a valid ATO. OpDivs should ensure that security authorization policies and procedures are fully developed and disseminated to the appropriate personnel to ensure that all OpDiv personnel understand the requirements for completing the ATO process.

HHS OCIO work with all OpDivs to ensure that: ISCM strategy and procedures should clearly define critical reporting metrics for reports utilized by internal and external stakeholders. Additionally, OpDivs should coordinate reporting efforts with the OCIO to ensure the definitions and reporting requirements are consistently implemented.

Continue implementation of an automated CDM solution that provides a centralized, enterprise-wide view of risks across all of HHS.

Update the ISCM strategy to include a more specific roadmap; including target dates, for ISCM deployment across the HHS enterprise.

HHS should perform an enterprise risk assessment over known control weaknesses (e.g., Authority to Operate, incomplete OpDiv provided system inventories, lack of OpDiv adherence to HHS information security policies) due to their federated environment and document an appropriate risk response (e.g., accept, avoid, mitigate, share, or transfer).

HHS OCIO work with all OpDivs to: Ensure that all operational systems have SSPs and FIPS 199 categorizations completed for information systems in accordance with HHS policy.

HHS OCIO work with all OpDivs to: Ensure that all OpDivs are completing security controls system assessments and POA&Ms at least quarterly or more frequently as defined by the OpDiv.

HHS OCIO work with all OpDivs to: Develop a management approved Configuration Management policy that addresses purpose, scope, roles, responsibilities, management commitment and coordination among organizational entities. This document should be tailored to the OpDivs' needs and be reviewed and updated according to HHS policy (at least every 3 years).

HHS OCIO work with the OpDivs to ensure that all DpDivs: Update and implement its personnel security policies to clearly articulate the personnel screening process along with the required access agreements that need to be completed prior to being granted system access. In addition, OpDivs should update and implement their procedures for retrieving and archiving user access agreements for internal control purposes.

HHS OCIO work with the OpDivs to ensure that all OpDivs: Develop and implement an ICAM strategy and authenticator management policy to ensure all information systems undergo a digital identity risk assessment to determine which systems require strong authentication. Once a risk assessment is complete, OpDivs should ensure that authentication mechanisms are implemented for all information systems.

HHS OCIO work with the OpDivs to ensure that all OpDivs: Establish a process for the review of privileged users on an annual basis to ensure compliance with HHS Policy. In addition, OpDivs should ensure that this process is created to identify: User access is still needed, User rights subscribe to the principle of least privileged, User actions are captured and monitored appropriately as dictated by HHS policy.

Update POS and MCS to include alerts to notify SSA employees of potential incorrect actions and required subsequent actions.

Update the Title II Redesign System to ensure it generates an alert when SSA has terminated benefits to a child upon attaining age 18; however, the benefit record indicates the individual is a full-time student after they attain age 18.

We recommend that the California Department of Health Care Services verify that deficiencies identified during annual provider-licensing inspections were corrected and that OTPs implemented their corrective action plans

We recommend that the California Department of Health Care Services consider performing additional postservice prepayment monitoring and postservice postpayment utilization reviews.

We recommend that the California Department of Health Care Services implement a system edit for identifying claims with an unreasonable number of counseling service units in 1 day and take appropriate action for the claims identified

We recommend that the California Department of Health Care Services revise the Drug Medi-Cal Billing Manual or provide additional guidance to OTPs regarding the allowable number of counseling service units and work with counties to ensure that their OTP billing manuals do not conflict with State regulations

We recommend that the California Department of Health Care Services take actions to ensure that OTPs comply with Federal and State requirements for providing and claiming reimbursement for OTP services.

We recommend that the California Department of Health Care Services take actions to ensure that OTPs provide the number of counseling services specified in a beneficiary’s treatment plan or document the reasons that counseling services were not provided as specified in the treatment plan.

We recommend that the California Department of Health Care Services take actions to ensure that OTPs maintain documentation supporting that a complete physical evaluation of a patient was performed, including the results of drug use, tuberculosis, and syphilis tests and the identity of the person who performed the physical evaluation.

We recommend that the California Department of Health Care Services take actions to ensure that OTPs have their physicians review and countersign beneficiaries’ treatment plans within the 14-day period as required.