Recommendations Tracker

We recommend that the Centers for Medicare & Medicaid Services improve its procedures, which may require seeking legislative authority, for setting and adjusting rates for new CDLTs during a PHE by providing the MACs with the flexibility needed to set and adjust payment rates that would cover the laboratory costs of providing services when responding to a PHE.

We recommend that the Missouri Department of Health and Senior Services consider implementing additional monitoring activities whenever the State receives large supplemental funding disbursements.

We recommend that the Administration for Strategic Preparedness and Response review the FY 2018 and 2019 JFA allocation methodologies along with the methodologies used during subsequent FYs to determine whether the costs were allocated to each office based on appropriate methodologies, and correct any improper allocations to avoid potential Antideficiency Act violations.

We recommend that the Administration for Strategic Preparedness and Response review the 10 remaining sampled employees that we could not interview to determine whether any salaries were improperly charged to BARDA appropriations and identify potential Antideficiency Act violations.

We recommend that the Alabama Medicaid Agency improve TCM program oversight by giving additional guidance to TCM providers regarding: billing of services, to verify that they are allowable and nonduplicative; case manager hiring practices, to verify adherence with the State plan's qualification requirements; target group eligibility screening processes, so that only eligible individuals receive TCM services; and the maintenance of supporting documentation for billed services.

We recommend that the Administration for Children and Families fully implement the 30 required minimum controls identified in the UC Portal system security plan as being in various stages of implementation.

CMS should require nursing homes to systematically document facility-initiated discharges in information available to CMS and States to enhance oversight.

CMS should explore options to expand Medicare and Medicaid coverage to additional behavioral health providers.

CMS should increase monitoring of Medicare and Medicaid enrollees' use of behavioral health services and identify vulnerabilities.

New Jersey Department of Human Services should refund $18,826,714 associated with deficiencies identified in the current audit.

We recommend that Indian Health Service consider upgrading the GRSSC's inventory system or implement other strategies to better coordinate the delivery of supplies to all customers.

We reccomend ACF remediate the 19 security control findings in accordance with NIST SP 800-53.

We reccomend ACF leverage cloud security assessment tools to identify misconfigurations and weak cybersecurity controls in its cloud infrastructure.

We recommend Alabama evaluate its current vulnerability scanning tools and update if necessary in order to better detect system flaws (e.g., common web server vulnerabilities) in its MMIS and E&E system and software components.

We recommend Alabama implement procedures to periodically verify that its developers are adhering to secure coding standards and remediating vulnerabilities before releasing code to production.

We recommend that the Delaware Division of Medicaid and Medical Assistance identify and recover unallowable capitation payments, which we estimate to be at least $4,246,759, made to MCOs during our audit period on behalf of deceased enrollees.

We recommend that the Delaware Division of Medicaid and Medical Assistance develop and implement quality assurance steps, including supervisory review, within its policies and procedures to verify that State agency personnel correctly enter enrollees' information into the MMIS system.

We recommend that the Centers for Medicare & Medicaid Services improve its oversight of States' compliance with MH/SUD parity requirements, including requiring States in which MCOs are responsible for the parity analysis to submit information MCOs provided regarding compliance with parity requirements to CMS for its review as part of the contract approval process and, if necessary, seeking additional regulatory authority to do so.

We recommend that the Centers for Medicare & Medicaid Services improve its oversight of States' compliance with MH/SUD parity requirements, including maintaining documentation of its communications with States related to compliance with MH/SUD parity requirements and actions taken to correct any identified deficiencies.

We recommend that the Centers for Medicare & Medicaid Services require States to improve their monitoring of MCOs' ongoing compliance with MH/SUD parity requirements by requiring MCOs to update parity analyses when benefits change or deficiencies are corrected.

We recommend that the Centers for Medicare & Medicaid Services require States to improve their monitoring of MCOs' ongoing compliance with MH/SUD parity requirements by conducting followup in a timely manner with MCOs that have identified noncompliance with parity requirements to verify that the MCOs take corrective actions to address the noncompliance.

We recommend that the Utah Department of Health revise flaw remediation procedures such that they fully implement the flaw remediation requirements defined in the CMS Acceptable Risk Safeguards (ARS), SI-02 Flaw Remediation (High; Moderate; Low) control.

We recommend that the Kansas Department of Health and Environment improve its oversight of the estate recovery contractor's performance by: verifying that the contractor files liens and initiates probate in a timely manner; confirming that the contractor's current process for MMIS claims verification is accurate; and verifying that the contractor performs applicable estate recovery procedures (including the opening of cases, sending of notices, and independent asset research) for deceased Medicaid recipients.

We recommend that the Pennsylvania Department of Human Services refund $368,870,827 to the Federal Government or provide documentation that can reasonably support its allocation of health services costs to Medicaid without using unverifiable IEP ratios.

We recommend that the Pennsylvania Department of Human Services ensure that school districts verify that providers are appropriately licensed before they provide health services to students.

We recommend that the Pennsylvania Department of Human Services revise its RMTSs to include the first month of the school year.

With respect to PRF payments that were already made to providers under the Phase 2 General Distribution, we recommend that the Health Resources and Services Administration identify other providers with subsidiary organizations that had revenues included in the providers' Federal tax returns. Determine whether the payments made to the subsidiary organizations were correctly accounted for when calculating payments for the providers under the Phase 2 General Distribution. In addition, determine the amount of and seek from these providers repayment of any overpayments. If it is not feasible to review all providers, HRSA could conduct a cost-benefit analysis for conducting manual reviews to identify providers and, if the benefit outweighs the cost, it could select some providers to review.

Should HRSA need to rapidly disburse similar payments to providers in response to a future national emergency, we recommend that HRSA consider working with CMS to use the information from CMS's Provider Enrollment, Chain, and Ownership System and use Federal tax returns (e.g., Schedule R of Form 990 for information on a tax-exempt provider's subsidiary organizations), in part, to develop a more complete dataset to show parent-subsidiary relationships (to the extent they are applicable) to safeguard taxpayer money, which could have saved approximately $159,379,359 during our audit period.

Should HRSA need to rapidly disburse similar payments to providers in response to a future national emergency, we recommend that HRSA consider establishing an application and attestation portal function that requests a provider to check that the revenue amount entered in the revenue field of its application for payment is entered correctly. For example, HRSA could modify its application and attestation portal by adding a step in which, after a provider enters its revenue amount, the portal generates a new screen that displays the entered amount and requests that the provider confirm the amount. (to the extent they are applicable) to safeguard taxpayer money.