Recommendations Tracker
HHS-OIG provides independent and objective oversight that promotes economy, efficiency, and effectiveness in HHS programs and operations. To drive this positive change, we produce reports and identify recommendations for improvement. We have developed this public-facing page for tracking all of our open recommendations.
Use the Top Unimplemented View below to read OIG's Top Unimplemented Recommendations. In OIG’s view, these top recommendations for HHS programs, if implemented, would have the greatest impact in terms of cost savings, program effectiveness and efficiency, and public health and safety. Learn more
Summary of All Recommendations
Updated Monthly · Last updated on Aug. 14, 2026
1,068
Unimplemented
recommendations
3,491
Implemented and Closed
recommendations since FY 2017
Views
OIG Recommendations Grouped by Report
Showing 21–40 of 1,419 reports, containing 4,559 recommendations
Sorted by latest release date
-
Medicare Advantage Organizations Overturned Nearly All Appealed Prior Authorization Denials for Skilled Nursing Facility Admission, Raising Concerns About Initial Denials
26-E-09-024.01CMS should take action to address any breakdowns in the initial reviews of SNF admission requests that are driving the extremely high overturn rate of SNF admission denials.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 12/07/2026
- Legislative Related
- No
26-E-09-024.02CMS should assess the reasons for variation in SNF denial rates across MAOs and contractors and take action as appropriate.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 12/07/2026
- Legislative Related
- No
26-E-09-024.03CMS should assess reasons for the differences in SNF denial rates between nursing home residents and other enrollees and take action as warranted.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 12/07/2026
- Legislative Related
- No
-
California Made at Least $13.9 Million More in Medicaid Reimbursements for Clinical Diagnostic Laboratory Services Than Was Allowed by Federal and State Requirements
26-A-01-071.01We recommend that the State agency refund $7,576,103 to the Federal Government.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- $7,576,103
- Last Update Received
- -
- Next Update Expected
- 12/07/2026
- Legislative Related
- No
26-A-01-071.02We recommend that the State agency work with CMS to determine whether potential overpayments of $16,477,416 (Federal share) complied with Federal and State requirements and refund the Federal share of any overpayments to the Federal Government.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 12/07/2026
- Legislative Related
- No
26-A-01-071.03We recommend the State agency review payments made after our audit period to identify any additional overpayments and refund the Federal share to the Federal Government. Additionally, the State agency should clearly identify any additional overpayments refunded as having been made in accordance with this recommendation.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 12/07/2026
- Legislative Related
- No
26-A-01-071.04We recommend that the State agency evaluate and strengthen its existing policies and procedures for reviewing and updating rates in its claims processing system to ensure that the amounts claimed for clinical diagnostic laboratory services do not exceed the amount that would be paid under the Medicare program or the amounts allowed by State requirements.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 12/07/2026
- Legislative Related
- No
-
Community Behavioral Health Did Not Comply With Requirements When Denying Prior Authorization Requests
26-A-03-072.01We recommend that CBH update its policies and procedures to include: (1) a requirement to reconcile discrepancies between addresses of record and addresses given to treatment providers and (2) a process for determining when a change of residency occurs and notifying the CAO accordingly.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 12/07/2026
- Legislative Related
- No
26-A-03-072.02We recommend that CBH implement a process for identifying service requests that are considered approved because a decision notification was not sent within the 21-day window.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 12/07/2026
- Legislative Related
- No
26-A-03-072.03We recommend that CBH coordinate with the State agency to implement a revised initial denial notice that informs enrollees that they have the right to be provided, upon request and free of charge, all documents, records, and other information relevant to the adverse benefit determination as required by 42 CFR section 438.404(b)(2).- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 12/07/2026
- Legislative Related
- No
26-A-03-072.04We recommend that CBH revise the language it uses in the denial notice to clarify when services are denied as requested but CBH recommends alternate services that do not require a prior authorization, as opposed to services being completely denied with no alternate services recommended.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 12/07/2026
- Legislative Related
- No
26-A-03-072.05We recommend that CBH update its policies to comply with its HealthChoices Agreement by requiring staff to document the following for enrollees under 21 years of age: (1) steps taken to contact the enrollee's representative to request that the enrollee's representative ask the provider to communicate with CBH, and (2) efforts to reach the provider before issuing denial notices.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 12/07/2026
- Legislative Related
- No
26-A-03-072.06We recommend that the State agency revise the denial notice template in the HealthChoices Agreement to include a statement that the enrollee has the right to be provided, upon request and free of charge, all documents, records, and other information relevant to the adverse benefit determination.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 12/07/2026
- Legislative Related
- No
-
The Office of Refugee Resettlement Needs To Improve Its Monitoring of Unlicensed Unaccompanied Alien Children Program Care Providers’ Compliance With Background Check Requirements
26-A-06-070.01We recommend that ORR conduct required abbreviated monitoring visits at unlicensed facilities approximately every 90 days.- Status
- Open Unimplemented
- Responsible Agency
- ACF
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 12/04/2026
- Legislative Related
- No
26-A-06-070.02We recommend that ORR put mechanisms in place to verify that all required background checks at unlicensed care providers are conducted.- Status
- Open Unimplemented
- Responsible Agency
- ACF
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 12/04/2026
- Legislative Related
- No
-
Lehigh Valley Hospital Received At Least $17.8 Million in Medicare Overpayments
26-A-03-069.01We recommend that the Hospital refund to the Federal government the estimated $17,838,422 in net overpayments for incorrectly billed claims, excluding amounts presumed to be unrecoverable under the Section 1870 waiver of liability provision.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- $17,838,422
- Last Update Received
- -
- Next Update Expected
- 12/03/2026
- Legislative Related
- No
26-A-03-069.02We recommend that the Hospital consider conducting one or more internal audits or investigations for claims beyond our audit period, based on the risks identified by this audit, to identify any similar overpayments the Hospital might have received and return any identified overpayments to the Medicare program.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 12/03/2026
- Legislative Related
- No
26-A-03-069.03We recommend that the Hospital provide additional training to clinical and billing personnel on its policies and procedures related to the following: Two-Midnight Rule; the medical necessity of inpatient services; IRF admissions; IRF documentation requirements ; and Inpatient and outpatient coding.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 12/03/2026
- Legislative Related
- No
-
CMS Should Improve Its Policies and Procedures for the Oversight of States’ Reported Medicaid Expenditures to Better Protect the Financial Integrity of the Medicaid Program
26-A-06-068.01We recommend that CMS develop and implement additional training for analysts to improve the clarity, accuracy, and consistency of their documentation for reviewing CMS-64s.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 12/02/2026
- Legislative Related
- No
26-A-06-068.02We recommend that CMS revise its policies and procedures related to deferred payments to align the deferral resolution timelines with Federal regulations.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 12/02/2026
- Legislative Related
- No
26-A-06-068.03We recommend that CMS modify its policies and procedures to specify which CMS departments are responsible for tracking and resolving disallowed payments.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 12/02/2026
- Legislative Related
- No
26-A-06-068.04We recommend that CMS modify its Review Guide to include a step that requires analysts to determine the status of disallowed payments.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 12/02/2026
- Legislative Related
- No
-
CMS Potentially Overpaid Medicare Advantage Organizations $462 Million Based on Certain Unsupported Acute Stroke Diagnosis Codes
26-A-02-067.01We recommend that CMS implement a procedure to prevent overpayments to MA organizations when acute stroke diagnosis codes are submitted by MA organizations on a physician data record and the enrollee does not have an acute stroke diagnosis on an inpatient or outpatient hospital data record during the same service year (e.g., CMS filter of EDS data to identify and address these diagnosis codes or instructions to MA organizations to implement a control to prevent the submission of these diagnosis codes), which could have resulted in cost savings of $462 million.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- $461,958,186
- Last Update Received
- -
- Next Update Expected
- 11/27/2026
- Legislative Related
- No
-
Connecticut Did Not Always Ensure Selected Nursing Homes Complied With Federal and State Background Check Requirements
26-A-01-066.01We recommend that DPH strengthen its monitoring activities to ensure that nursing homes comply with requirements that prohibit the employment of individuals with disqualifying backgrounds, such as expanding the timeframe covered by recertification surveys.- Status
- Closed Implemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 08/07/2026
- Legislative Related
- No
26-A-01-066.02We recommend that DPH ensure that all required background checks have been conducted for the 9 selected nursing homes that employ the 46 individuals in our sample who were missing 1 or more background checks.- Status
- Closed Implemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 08/07/2026
- Legislative Related
- No
26-A-01-066.03We recommend that DPH ensure that all training materials on how to conduct background checks for new employees are made available to nursing homes.- Status
- Closed Implemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 08/07/2026
- Legislative Related
- No
-
Unclear Medicare Requirements Led to Differing Interpretations of Inpatient Rehabilitation Facility Documentation, Coverage, and Billing Requirements
26-A-04-065.01We recommend that CMS revise or clarify IRF documentation requirements related to the: (1) development and individualization of the POC, (2) leadership of IDT meetings by rehabilitation physicians, (3) review at IDT meetings of enrollee progress toward rehabilitation goals and identification of any problems that could impede such progress, and (4) functional status of enrollees during the preadmission screening.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 11/11/2026
- Legislative Related
- No
26-A-04-065.02We recommend that CMS revise or clarify IRF coverage requirements to define: (1) what constitutes a reasonable expectation that an enrollee requires supervision by a rehabilitation physician, (2) what it means to have active and ongoing therapeutic intervention from multiple disciplines, and (3) what it means to be sufficiently stable to actively participate in an intensive rehabilitation therapy program.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 11/11/2026
- Legislative Related
- No
26-A-04-065.03We recommend that CMS revise or clarify IRF-PAI signature requirements.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Non-Concur
- Potential Savings
- -
- Last Update Received
- 06/03/2026
- Next Update Expected
- 12/04/2026
- Legislative Related
- No
26-A-04-065.04We recommend that CMS offer training and learning sessions to assist IRFs with regulation compliance.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 11/11/2026
- Legislative Related
- No
-
Utilization Trends and Medicare Part B Billing for Office-Based Peripheral Vascular Procedures Raise Questions About Program Integrity
26-E-01-021.01CMS should monitor billing to identify peripheral vascular procedures that may be medically unnecessary, which may indicate fraud, waste, or abuse.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 11/03/2026
- Legislative Related
- No
26-E-01-021.02CMS should follow up on the physicians OIG identified with concerning billing for peripheral vascular procedures.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 11/03/2026
- Legislative Related
- No
-
Most Nursing Homes Throughout the United States Do Not Have Adequate or Reliable Emergency Power Systems
26-A-02-064.01We recommend that CMS share the results of this report with nursing homes and emphasize the importance of having adequate and reliable emergency power systems.- Status
- Closed Implemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 08/11/2026
- Legislative Related
- No
-
Medicare Payments for Positive Airway Pressure Devices Used for the Treatment of Obstructive Sleep Apnea Generally Complied With Medicare Requirements
26-A-05-063.01We recommend that CMS establish and implement internal controls to prevent improper payments for replacement PAP devices, which amounted to an estimated $15.2 million for our audit period.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 10/22/2026
- Legislative Related
- No
26-A-05-063.02We recommend that CMS provide outreach and education to suppliers on coverage requirements for PAP devices used in treating OSA to prevent improper payments.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 10/22/2026
- Legislative Related
- No
-
CMS Could Strengthen Medicare Program Safeguards To Prevent and Detect Potentially Improper Payments for Virtual Check-in and E-visit Services
26-A-05-062.01We recommend that CMS develop the following system edits for billing communication technology-based services that could have saved the Medicare program up to $2.3 million during our audit period: (1) edits to identify payments for further review for (a) virtual check-in services that occur within 7 days after or 24 hours prior to an E/M service and are billed with the same diagnosis code and (b) e-visits that occur and are billed separately with the same diagnosis code but should be billed only once within 7 days; and (2) edits to identify and reject claims where virtual check-in services and E/M services are billed on the same claim.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 10/22/2026
- Legislative Related
- No
26-A-05-062.02We recommend that CMS strengthen the HCPCS code descriptions for virtual check-ins in the PFS to clarify the meaning of "related or same medical condition" and "soonest available appointment" to ensure accurate billing of virtual check-ins.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 10/22/2026
- Legislative Related
- No
26-A-05-062.03We recommend that CMS further educate providers on the proper billing requirements for virtual check-in and e-visit services.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 10/22/2026
- Legislative Related
- No
-
CMS Has Limited Oversight of Selected Compounded Drugs Prescribed to Medicare Part D Enrollees
26-A-05-061.01We recommend that CMS work with sponsors, as appropriate, to ensure sponsors' claims for Part D compounded drugs are accurately reported on PDE records consistent with CMS guidance.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 10/16/2026
- Legislative Related
- No
26-A-05-061.02We recommend that CMS provide guidance to sponsors on enhancing their oversight of compounded drugs containing controlled substances and gabapentin, such as ensuring their quality assurance programs monitor full ingredient lists for compounded drugs.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 10/16/2026
- Legislative Related
- No
26-A-05-061.03We recommend that CMS provide guidance to sponsors regarding monitoring active pharmaceutical ingredients in bulk powder form used in compound drugs.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 10/16/2026
- Legislative Related
- No
-
Vibrent Health Claimed Unallowable Costs Under a National Institutes of Health Other Transaction Award
26-A-04-060.01We recommend that Vibrent Health work with NIH to refund the $1.9 million of unapproved fringe benefits and indirect costs.- Status
- Open Unimplemented
- Responsible Agency
- NIH
- Response
- Not Yet Due
- Potential Savings
- $1,900,000
- Last Update Received
- -
- Next Update Expected
- 10/01/2026
- Legislative Related
- No
26-A-04-060.02We recommend that Vibrent Health work with NIH to determine the allowability of costs associated with the at least $14.6 million of unreasonable costs that Vibrent paid to related-party subcontractors, and refund any costs that NIH deems to be unallowable.- Status
- Open Unimplemented
- Responsible Agency
- NIH
- Response
- Not Yet Due
- Potential Savings
- $14,600,000
- Last Update Received
- -
- Next Update Expected
- 10/01/2026
- Legislative Related
- No
26-A-04-060.03We recommend that Vibrent Health create an oversight function to independently ensure it complies with applicable terms and conditions of future Federal awards.- Status
- Open Unimplemented
- Responsible Agency
- NIH
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 10/01/2026
- Legislative Related
- No
-
Medicare Advantage Compliance Audit of Specific Diagnosis Codes That Priority Health (Contract H2320) Submitted to CMS
26-A-07-059.01We recommend that Priority Health refund to the Federal Government the $4,479,698 of estimated net overpayments.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- $4,479,698
- Last Update Received
- 04/27/2026
- Next Update Expected
- 10/27/2026
- Legislative Related
- No
26-A-07-059.02We recommend that Priority Health identify, for the high-risk diagnoses included in this report, similar instances of noncompliance that occurred after our audit period and refund any resulting overpayments to the Federal Government.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 04/27/2026
- Next Update Expected
- 10/27/2026
- Legislative Related
- No
26-A-07-059.03We recommend that Priority Health continue its examination of its existing compliance procedures to identify areas where improvements can be made to ensure that diagnosis codes that are at high risk for being miscoded comply with Federal requirements (when submitted to CMS for use in CMS's risk adjustment program) and take the necessary steps to enhance those procedures.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 04/27/2026
- Next Update Expected
- 10/27/2026
- Legislative Related
- No
-
Medicare Home Health Agency Provider Compliance Audit: VNS Health
26-A-02-057.01We recommend that VNS Health refund the $2,965,484 in estimated overpayments to the Medicare program, excluding amounts presumed to be unrecoverable under the Section 1870 waiver of liability provision.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- $2,965,484
- Last Update Received
- 07/23/2026
- Next Update Expected
- 01/23/2027
- Legislative Related
- No
26-A-02-057.02We recommend that VNS Health consider conducting one or more internal audits or investigations for claims after our audit period based on the risks identified by this audit to identify any similar overpayments the provider might have received and return any identified overpayments to the Medicare program.- Status
- Closed Implemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 07/23/2026
- Legislative Related
- No
26-A-02-057.03We recommend that VNS Health strengthen its review of medical record documentation to ensure compliance with Medicare billing requirements.- Status
- Closed Implemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 07/23/2026
- Legislative Related
- No
-
Review of the Department of Health and Human Services’ Compliance With the Federal Information Security Modernization Act of 2014 for Fiscal Year 2025
26-A-18-055.01We recommend that HHS develop a formal process for creating and maintaining cybersecurity profiles (current and target), including developing policies and procedures and implementing these policies and procedures at the Department level and at the Division level.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 09/23/2026
- Legislative Related
- No
26-A-18-055.02We recommend that HHS implement the Cybersecurity Risk Management Strategy at the Department level and confirm implementation of the CRMS at the Division level. All Divisions should inherit the HHS Department enterprise-wide risk management strategy or develop and implement their own. Additionally, HHS should confirm that all risks, including those incurred during organizational restructuring, are documented, evaluated, and accounted for according to the CRMS.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 09/23/2026
- Legislative Related
- No
26-A-18-055.03We recommend that HHS require and ensure Divisions implement SCRM policy and procedures.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 09/23/2026
- Legislative Related
- No
26-A-18-055.04We recommend that HHS update the departmental policy to accurately define cybersecurity roles and responsibilities and define the processes to evaluate the performance of cybersecurity roles and responsibilities.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 09/23/2026
- Legislative Related
- No
26-A-18-055.05We recommend that HHS conduct the workforce skills assessment/gap analysis timely and periodically update the assessment/gap analysis to account for changes in the risk environment across HHS and the Divisions.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 09/23/2026
- Legislative Related
- No
26-A-18-055.06We recommend that HHS confirm that Divisions maintain comprehensive and accurate software and hardware asset and license inventories and employ the use of information system security continuous monitoring (ISCM) tools to monitor the security posture of assets in accordance with the defined standards across HHS. HHS should confirm that implementation of these inventories is consistent with established standards.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 09/23/2026
- Legislative Related
- No
26-A-18-055.07We recommend that HHS develop policies, procedures, and guidance for the creation and maintenance of data and metadata inventories. These policies, procedures, and guidance should be implemented throughout HHS. HHS should establish a process to monitor Divisions' adherence to department-level policies, procedures, and guidance.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 09/23/2026
- Legislative Related
- No
26-A-18-055.08We recommend that HHS require Divisions to implement common secure configurations and effective flaw remediation processes for all their systems according to Divisions standards or standards approved by HHS for the Division. Divisions should ensure that scanning for compliance and vulnerabilities is performed according to HHS policies and procedures and that all deviations and vulnerabilities are remediated within the defined timelines set by HHS. HHS should confirm that Divisions are meeting the established standards.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 09/23/2026
- Legislative Related
- No
26-A-18-055.09We recommend that HHS enforce HHS policies and procedures for provisioning and monitoring access of all privileged users and confirm implementation aligns with the policies and procedures. Privileged user access requests with the required approval should be documented and retained.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 09/23/2026
- Legislative Related
- No
26-A-18-055.10We recommend that HHS enforce policies and develop procedures for conducting and updating Business Impact Analyses (BIAs) and require implementation at the Department level and Division level. Divisions should implement as necessary and reference HHS policy as part of their contingency planning efforts to standardize the prioritization of business operations and functions.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Not Yet Due
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 09/23/2026
- Legislative Related
- No
-
Nursing Homes Inappropriately Diagnosed Residents with Schizophrenia to Mask the Misuse of Antipsychotic Drugs
26-E-02-015.01CMS should build on its efforts to reduce inappropriate schizophrenia diagnoses in nursing homes.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Non-Concur
- Potential Savings
- -
- Last Update Received
- 08/10/2026
- Next Update Expected
- 05/27/2027
- Legislative Related
- No
26-E-02-015.02CMS should expand its use of data to monitor nursing homes' use of schizophrenia diagnoses and target oversight.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Non-Concur
- Potential Savings
- -
- Last Update Received
- 08/10/2026
- Next Update Expected
- 05/27/2027
- Legislative Related
- No
26-E-02-015.03CMS should increase efforts to ensure that nursing home residents and their families are fully informed when antipsychotic drugs are given.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 04/13/2026
- Next Update Expected
- 05/27/2027
- Legislative Related
- No
-
Nursing Homes’ Inappropriate Use of Antipsychotic Drugs Poses a Risk to Residents
26-E-02-016.01CMS should further develop resources for nursing homes and increase transparency in order to reduce inappropriate use of antipsychotic drugs and improve dementia care in nursing homes.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Non-Concur
- Potential Savings
- -
- Last Update Received
- 08/10/2026
- Next Update Expected
- 05/27/2027
- Legislative Related
- No
26-E-02-016.02CMS should take steps to ensure that nursing home medical directors fulfill their role in reducing the inappropriate use of antipsychotic drugs.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Non-Concur
- Potential Savings
- -
- Last Update Received
- 04/13/2026
- Next Update Expected
- 05/27/2027
- Legislative Related
- No
26-E-02-016.03CMS should take steps to ensure that nursing home pharmacists fulfill their role in reducing the inappropriate use of antipsychotic drugs.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 04/13/2026
- Next Update Expected
- 05/27/2027
- Legislative Related
- No
26-E-02-016.04CMS should assist nursing homes to improve their policies and procedures pertaining to antipsychotic drug use.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Non-Concur
- Potential Savings
- -
- Last Update Received
- 08/10/2026
- Next Update Expected
- 05/27/2027
- Legislative Related
- No