Recommendations Tracker
HHS-OIG provides independent and objective oversight that promotes economy, efficiency, and effectiveness in HHS programs and operations. To drive this positive change, we produce reports and identify recommendations for improvement. We have developed this public-facing page for tracking all of our open recommendations.
Use the Top Unimplemented View below to read OIG's Top Unimplemented Recommendations. In OIG’s view, these top recommendations for HHS programs, if implemented, would have the greatest impact in terms of cost savings, program effectiveness and efficiency, and public health and safety. Learn more
Summary of All Recommendations
Updated Monthly · Last updated on December 17, 2025
1,189
Unimplemented
recommendations
3,163
Implemented and Closed
recommendations since FY 2017
Views
OIG Recommendations Grouped by Report
Showing 161–180 of 1,352 reports, containing 4,352 recommendations
Sorted by latest release date
-
Kansas’s Implemented Electronic Visit Verification System Could Be Improved
24-A-07-099.01We recommend that the Kansas Department of Health and Education improve its electronic visit verification system by developing and implementing procedures to verify that in-home PCS claims are recorded and verified in its EVV system, and implementing edits to verify that tasks recorded on in-home PCS claims match allowable tasks approved in the PCSP.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 09/30/2025
- Next Update Expected
- 03/30/2026
- Legislative Related
- No
24-A-07-099.02We recommend that the Kansas Department of Health and Education improve its use of the EVV system by verifying that exceptions are reviewed and remedied, requiring that providers use the scheduling function within the EVV system or else directing the EVV contractor to remove the corresponding exception for instances when the scheduling function is not used, training providers on how to address and minimize the occurrence of informational exceptions, and establishing formal requirements governing service workers' use of the web portal.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 09/30/2025
- Next Update Expected
- 03/30/2026
- Legislative Related
- No
24-A-07-099.03We recommend that the Kansas Department of Health and Education verify that providers are complying with the State agency's established policies and procedures to maintain documentation showing that service workers are registered, screened, and employable pursuant to background check requirements.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 09/30/2025
- Next Update Expected
- 03/30/2026
- Legislative Related
- No
24-A-07-099.04We recommend that the Kansas Department of Health and Education verify that MCOs are complying with the State agency's established policies and procedures to complete and reassess functional needs assessments, including the needs evaluation tool, every 12 months, and upload these documents into the care management system for retention.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 09/30/2025
- Next Update Expected
- 03/30/2026
- Legislative Related
- No
-
Certain For-Profit Nursing Homes May Not Have Complied With Federal Requirements Regarding the Infection Preventionist Position
24-A-01-098.01We recommend that the Centers for Medicare & Medicaid Services instruct the SSAs to follow up with the 24 nursing homes that may not have complied with Federal requirements to verify that they have taken corrective actions.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 06/18/2025
- Next Update Expected
- 12/18/2025
- Legislative Related
- No
24-A-01-098.02We recommend that the Centers for Medicare & Medicaid Services share the results of this audit with the SSAs and encourage them to focus their oversight on verifying that nursing homes designate an IP and that the IPs complete specialized training prior to filling that position.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 06/18/2025
- Next Update Expected
- 12/18/2025
- Legislative Related
- No
-
Illinois MMIS and E&E System Had Adequate Security Controls in Place, but Some Improvements Are Needed
24-A-18-097.01We recommend that the Illinois Department of Healthcare and Family Services remediate the four security control findings identified by OIG.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 11/13/2025
- Next Update Expected
- 06/02/2026
- Legislative Related
- No
24-A-18-097.02We recommend that the Illinois Department of Healthcare and Family Services develop and implement flaw remediation policies and procedures for effectively identifying vulnerabilities, prioritizing them based on potential impact and exploitability, and remediating them within a defined timeframe as required by NIST SP 800-53, SI-2, Flaw Remediation, or other standards governing security of Federal systems and information.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 11/13/2025
- Next Update Expected
- 06/02/2026
- Legislative Related
- No
24-A-18-097.03We recommend that the Illinois Department of Healthcare and Family Services enhance its testing procedures to include performing more robust technical testing of web-facing systems and emulation of an adversary's tactics and techniques on a defined reoccurring basis, in order to better assess the effectiveness of NIST SP 800-53 controls.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 11/13/2025
- Next Update Expected
- 06/02/2026
- Legislative Related
- No
-
Medicare Advantage Compliance Audit of Diagnosis Codes That MMM Healthcare, LLC, (Contract H4003) Submitted to CMS
24-A-04-095.01We recommend that MMM Healthcare, LLC, refund to the Federal Government the $165,312 of net overpayments.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- $165,312
- Last Update Received
- 09/30/2025
- Next Update Expected
- 03/30/2026
- Legislative Related
- No
24-A-04-095.02We recommend that MMM Healthcare, LLC, continue to improve its policies and procedures to prevent, detect, and correct noncompliance with Federal requirements for diagnosis codes that are used to calculate risk-adjusted payments.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 09/30/2025
- Next Update Expected
- 03/30/2026
- Legislative Related
- No
-
Massachusetts Generally Completed Medicaid Eligibility Actions During the Unwinding Period in Accordance With Federal and State Requirements
24-A-02-096.01We recommend that the Massachusetts' Executive Office of Health and Human Services redetermine eligibility for the three sampled enrollees whose eligibility was incorrectly determined and take appropriate action.- Status
- Closed Implemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 12/13/2024
- Legislative Related
- No
24-A-02-096.02We recommend that the Massachusetts' Executive Office of Health and Human Services provide periodic training to caseworkers about verifying and documenting enrollees' income and residency during the renewal process.- Status
- Closed Implemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 12/13/2024
- Legislative Related
- No
24-A-02-096.03We recommend that the Massachusetts' Executive Office of Health and Human Services revise policies and procedures to be consistent with CMS guidance related to preparing unwinding data reports and any future reports of a similar nature.- Status
- Closed Implemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 12/13/2024
- Legislative Related
- No
-
Medicare Improperly Paid Hospitals an Estimated $79 Million for Enrollees Who Had Received Mechanical Ventilation
24-A-09-094.01We recommend that the Centers for Medicare & Medicaid Services direct the MACs to recover from hospitals the portion of the $382,032 in identified overpayments for the sampled claims during our audit period that are within the 4-year reopening period in accordance with CMS's policies and procedures.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- $382,032
- Last Update Received
- 02/22/2025
- Next Update Expected
- 08/24/2025
- Legislative Related
- No
24-A-09-094.02We recommend that the Centers for Medicare & Medicaid Services educate hospitals on correctly counting the hours of mechanical ventilation and submitting claims with correct procedure and diagnosis codes, which could have saved an estimated $79,354,175 for our audit period.- Status
- Closed Implemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- $79,354,175
- Last Update Received
- -
- Closed Date
- 03/20/2025
- Legislative Related
- No
-
Opioid Treatment Programs in Washington State Did Not Fully Comply With Federal and State Requirements, Which May Have Put Medicaid Enrollees at Risk for Poor Treatment Outcomes
24-A-09-093.01We recommend that the Washington State Health Care Authority work with its contracted MCOs and the Department of Health to ensure that OTPs comply with Federal and State requirements for providing and documenting OTP services, including ensuring that OTPs complete required tests for enrollee admissions and adequately document enrollee admissions.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 12/16/15
- Next Update Expected
- 04/06/2026
- Legislative Related
- No
24-A-09-093.02We recommend that the Washington State Health Care Authority work with its contracted MCOs and the Department of Health to ensure that OTPs comply with Federal and State requirements for providing and documenting OTP services, including ensuring that OTPs adequately document treatment plans.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 12/16/15
- Next Update Expected
- 04/06/2026
- Legislative Related
- No
24-A-09-093.03We recommend that the Washington State Health Care Authority work with its contracted MCOs and the Department of Health to ensure that OTPs comply with Federal and State requirements for providing and documenting OTP services, including ensuring that OTPs provide take-home medications in accordance with Federal and State requirements.- Status
- Closed Implemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 10/02/2025
- Legislative Related
- No
24-A-09-093.04We recommend that the Washington State Health Care Authority work with its contracted MCOs and the Department of Health to ensure that OTPs comply with Federal and State requirements for providing and documenting OTP services, including ensuring that OTPs adequately document opioid treatment services.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 12/16/15
- Next Update Expected
- 04/06/2026
- Legislative Related
- No
24-A-09-093.05We recommend that the Washington State Health Care Authority work with its contracted MCOs and the Department of Health to ensure that OTPs comply with Federal and State requirements for providing and documenting OTP services, including ensuring that OTPs adequately document the results of drug screens.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 12/16/15
- Next Update Expected
- 04/06/2026
- Legislative Related
- No
24-A-09-093.06We recommend that the Washington State Health Care Authority work with its contractedMCOs and the Department of Health to ensure that OTPs comply with Federal and State requirements for providing and documenting OTP services, including ensuring that OTPs adequately document checks of Washington State PDMP prescription data to identify enrollees' prescriptions.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 12/16/15
- Next Update Expected
- 04/06/2026
- Legislative Related
- No
24-A-09-093.07We recommend that the Washington State Health Care Authority work with its contracted MCOs and the Department of Health to ensure that OTPs comply with Federal and State requirements for providing and documenting OTP services, including ensuring that OTPs adequately document enrollee assessments.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 12/16/15
- Next Update Expected
- 04/06/2026
- Legislative Related
- No
24-A-09-093.08We recommend that the Washington State Health Care Authority work with its contracted MCOs and the Department of Health to ensure that OTPs comply with Federal and State requirements for providing and documenting OTP services, including ensuring that OTPs demonstrate through documentation that treatment plans and progress notes are reviewed by qualified staff.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 12/16/15
- Next Update Expected
- 04/06/2026
- Legislative Related
- No
24-A-09-093.09We recommend that the Washington State Health Care Authority work with its contracted MCOs and the Department of Health to ensure that OTPs comply with Federal and State requirements for providing and documenting OTP services, including ensuring that OTPs complete and adequately document annual medical examinations.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 12/16/15
- Next Update Expected
- 04/06/2026
- Legislative Related
- No
24-A-09-093.10We recommend that the Washington State Health Care Authority work with its contracted MCOs and the Department of Health to ensure that OTPs comply with Federal and State requirements for providing and documenting OTP services, including ensuring that OTPs identify in the enrollee records the staff members who provided SUD assessments.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 12/16/15
- Next Update Expected
- 04/06/2026
- Legislative Related
- No
-
Alaska Medicaid Fraud Control Unit: 2023 Inspection
24-E-12-026.01Revise its procedures for screening referrals to incorporate the expertise of each professional discipline and to reflect current Unit priorities and workloads.- Status
- Open Unimplemented
- Responsible Agency
- MFCU
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 01/29/2025
- Legislative Related
- No
24-E-12-026.02Take steps to improve communication and collaboration across professional disciplines throughout the investigative phase of cases.- Status
- Closed Implemented
- Responsible Agency
- MFCU
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 04/18/2025
- Legislative Related
- No
24-E-12-026.03Revise its procedures for opening, assigning, and closing cases to better enable cases to be completed in an appropriate timeframe.- Status
- Open Unimplemented
- Responsible Agency
- MFCU
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 01/29/2025
- Legislative Related
- No
24-E-12-026.04Implement a comprehensive case management system to manage its investigative case information in an efficient and secure manner.- Status
- Open Unimplemented
- Responsible Agency
- MFCU
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 01/29/2025
- Legislative Related
- No
24-E-12-026.05Take steps to improve the accuracy and completeness of case information and performance data in its electronic case management system.- Status
- Open Unimplemented
- Responsible Agency
- MFCU
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 01/29/2025
- Legislative Related
- No
24-E-12-026.06Take steps to maintain case files in a consistent and effective manner.- Status
- Closed Implemented
- Responsible Agency
- MFCU
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 04/18/2025
- Legislative Related
- No
24-E-12-026.07Take steps to improve its ability to staff its administrative functions consistently and appropriately.- Status
- Open Unimplemented
- Responsible Agency
- MFCU
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 01/29/2025
- Legislative Related
- No
24-E-12-026.08Take steps to expand upon the Unit's efforts to encourage referrals to the Unit.- Status
- Closed Implemented
- Responsible Agency
- MFCU
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 04/18/2025
- Legislative Related
- No
24-E-12-026.09Establish procedures for regularly communicating and coordinating with OIG's Office of Investigations and the U.S. Attorney's Office- Status
- Open Unimplemented
- Responsible Agency
- MFCU
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 01/29/2025
- Legislative Related
- No
24-E-12-026.10Develop procedures to improve the accuracy of its inventory list and verify that all Unit property is properly secured.- Status
- Open Unimplemented
- Responsible Agency
- MFCU
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 01/29/2025
- Legislative Related
- No
24-E-12-026.11Revise its policies and procedures for periodic supervisory reviews and conduct and document the reviews in accordance with its updated policies.- Status
- Closed Implemented
- Responsible Agency
- MFCU
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 04/18/2025
- Legislative Related
- No
24-E-12-026.12Modify its supervisory structure so that all Unit staff are under the supervision of the Unit Director or another Unit supervisor.- Status
- Closed Implemented
- Responsible Agency
- MFCU
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 04/18/2025
- Legislative Related
- No
24-E-12-026.13Include acknowledgments of Federal funding in its press releases and other public documents.- Status
- Closed Implemented
- Responsible Agency
- MFCU
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 04/18/2025
- Legislative Related
- No
-
Heluna Health May Not Have Used California’s CDC COVID-19 Funds in Accordance With Award Requirements
24-A-04-090.01We recommend that Heluna Health refund $3,585,834 to the Federal government.- Status
- Open Unimplemented
- Responsible Agency
- CDC
- Response
- Concur
- Potential Savings
- $3,585,834
- Last Update Received
- 02/19/2025
- Next Update Expected
- 08/19/2025
- Legislative Related
- No
24-A-04-090.02We recommend that Heluna Health develop and implement a policy that requires California Department of Public Health (CDPH) to provide adequate supporting documentation to ensure the costs claimed are allowable and allocable.- Status
- Open Unimplemented
- Responsible Agency
- CDC
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 02/19/2025
- Next Update Expected
- 08/19/2025
- Legislative Related
- No
24-A-04-090.03We recommend that Heluna Health work with CDC to determine the allowable portion of $366,850,858 related to local health jurisdiction (LHJ) start-up costs and refund to the Federal Government any unallowable amount.- Status
- Open Unimplemented
- Responsible Agency
- CDC
- Response
- Concur
- Potential Savings
- $366,850,858
- Last Update Received
- 02/19/2025
- Next Update Expected
- 08/19/2025
- Legislative Related
- No
-
California Made Capitation Payments for Enrollees Who Were Concurrently Enrolled in a Medicaid Managed Care Program in Another State
24-A-05-089.01We recommend that the California Department of Health Care Services resume and enhance procedures that are in accordance with current Federal requirements to identify and disenroll enrollees who are residing and enrolled in Medicaid managed care in another State.- Status
- Closed Implemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 09/26/2024
- Legislative Related
- No
24-A-05-089.02We recommend that the California Department of Health Care Services work with CMS to consider the potential use of T-MSIS data to identify potential cases of concurrent enrollment.- Status
- Closed Implemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 03/25/2025
- Legislative Related
- No
-
West Virginia Medicaid Fraud Control Unit: 2023 Inspection
24-E-12-023.01Eliminate access to sensitive case material for unauthorized staff.- Status
- Closed Implemented
- Responsible Agency
- MFCU
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 04/07/2025
- Legislative Related
- No
24-E-12-023.02Take steps to ensure that its new case management system allows for the accurate reporting of performance data.- Status
- Closed Implemented
- Responsible Agency
- MFCU
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 04/07/2025
- Legislative Related
- No
24-E-12-023.03Take steps to report adverse actions to the NPDB within the required timeframe.- Status
- Open Unimplemented
- Responsible Agency
- MFCU
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 01/23/2025
- Legislative Related
- No
24-E-12-023.04Take steps to report all convictions to OIG within the required timeframe.- Status
- Open Unimplemented
- Responsible Agency
- MFCU
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 01/23/2025
- Legislative Related
- No
24-E-12-023.05Implement a method to monitor the State's responses to the Unit's program recommendations.- Status
- Closed Implemented
- Responsible Agency
- MFCU
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 04/07/2025
- Legislative Related
- No
24-E-12-023.06Work with the Bureau of Medicaid Services to ensure the return of the Federal Government's share of all recoveries.- Status
- Open Unimplemented
- Responsible Agency
- MFCU
- Response
- Non-Concur
- Potential Savings
- -
- Last Update Received
- -
- Next Update Expected
- 01/23/2025
- Legislative Related
- No
-
HHS Office of the Secretary Needs to Improve Key Security Controls to Better Protect Certain Cloud Information Systems
24-A-18-088.01We recommend that the HHS Office of the Secretary develop a procedure to ensure cloud system inventories are accurate and completed in accordance with HHS security requirements.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 08/06/2025
- Next Update Expected
- 02/06/2026
- Legislative Related
- No
24-A-18-088.02We recommend that the HHS Office of the Secretary remediate the 12 control findings in accordance with NIST SP 800-53.- Status
- Closed Implemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 10/01/2024
- Legislative Related
- No
24-A-18-088.03We recommend that the HHS Office of the Secretary implement a strategy that includes leveraging cloud security assessment tools that identify misconfigurations and other control weaknesses in its cloud services, and remediate weak controls in a timely manner.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 03/07/2025
- Next Update Expected
- 09/07/2025
- Legislative Related
- No
24-A-18-088.04We recommend that the HHS Office of the Secretary develop and implement a policy and process to ensure qualified staff are assigned as System Security Officers for its cloud systems.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 02/12/2025
- Next Update Expected
- 08/26/2025
- Legislative Related
- No
-
ASPR Did Not Consistently Comply With Federal Requirements for Awarding Research and Development Contracts
24-A-03-087.01We recommend that the Administration for Strategic Preparedness and Response note on the CPARS assessment report for the original contractor that the contractor failed to submit the novation to report the sale of the business interests and transfer of the contract.- Status
- Closed Implemented
- Responsible Agency
- ASPR
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 03/04/2025
- Legislative Related
- No
24-A-03-087.02We recommend that the Administration for Strategic Preparedness and Response provide technical assistance or education to the new contractor regarding novation procedures.- Status
- Closed Implemented
- Responsible Agency
- ASPR
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 03/04/2025
- Legislative Related
- No
24-A-03-087.03We recommend that the Administration for Strategic Preparedness and Response implement a review process to verify that Federal acquisition awarding procedures and contract funding are fully completed before contract performance begins.- Status
- Closed Implemented
- Responsible Agency
- ASPR
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 03/04/2025
- Legislative Related
- No
24-A-03-087.04We recommend that the Administration for Strategic Preparedness and Response correct the Recording Statute violation for the contract that was not properly finalized by ratifying the original contract and properly recording an obligation.- Status
- Closed Implemented
- Responsible Agency
- ASPR
- Response
- Concur
- Potential Savings
- $14,000
- Last Update Received
- -
- Closed Date
- 03/04/2025
- Legislative Related
- No
24-A-03-087.05We recommend that the Administration for Strategic Preparedness and Response correct the time violation for the improperly created purchase order by using no-year funds or multi-year funds available for obligation and report an Antideficiency Act violation if the time violation cannot be corrected.- Status
- Closed Implemented
- Responsible Agency
- ASPR
- Response
- Concur
- Potential Savings
- $14,000
- Last Update Received
- -
- Closed Date
- 03/04/2025
- Legislative Related
- No
24-A-03-087.06We recommend that the Administration for Strategic Preparedness and Response create policies and procedures for the maintenance and organization of electronic contract files.- Status
- Open Unimplemented
- Responsible Agency
- ASPR
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 01/17/2025
- Next Update Expected
- 09/04/2025
- Legislative Related
- No
24-A-03-087.07We recommend that the Administration for Strategic Preparedness and Response implement a periodic documentation review process to assess completeness of contract files and provide training to address deficiencies identified from the review.- Status
- Open Unimplemented
- Responsible Agency
- ASPR
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 03/04/2025
- Next Update Expected
- 09/04/2025
- Legislative Related
- No
-
Medicare Advantage Compliance Audit of Specific Diagnosis Codes That Independent Health Association, Inc. (Contract H3362) Submitted to CMS
24-A-07-085.01We recommend that Independent Health Association, Inc. refund to the Federal Government the $646,217 of overpayments.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- $646,217
- Last Update Received
- 10/01/2025
- Next Update Expected
- 04/01/2026
- Legislative Related
- No
24-A-07-085.02We recommend that Independent Health Association, Inc. identify, for the high-risk diagnoses included in this report, similar instances of noncompliance that occurred before and after our audit period and refund any resulting overpayments to the Federal Government.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 10/01/2025
- Next Update Expected
- 04/01/2026
- Legislative Related
- No
24-A-07-085.03We recommend that Independent Health Association, Inc. continue its examination of its existing compliance procedures to identify areas where improvements can be made to ensure that diagnosis codes that are at high risk for being miscoded comply with Federal requirements (when submitted to CMS for use in CMS's risk adjustment program) and take the necessary steps to enhance those procedures.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 10/01/2025
- Next Update Expected
- 04/01/2026
- Legislative Related
- No
-
Review of the Department of Health and Human Services’ Compliance with the Federal Information Security Modernization Act of 2014 for Fiscal Year 2023
24-A-18-086.01Refine their enterprise architecture system inventory and software/hardware asset inventories to ensure the inclusion of the information systems and components active on the HHS network. HHS should utilize these inventories to monitor assets continuously and identify and remediate vulnerabilities timely to better manage the risks to these assets.- Status
- Closed Unimplemented
- Responsible Agency
- OS
- Response
- Non-Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 01/23/2025
- Legislative Related
- No
24-A-18-086.02We recommend that HHS require OpDivs to implement a cybersecurity risk management strategy to assess and respond to identified risks within the agency, watch for new risks, and monitor risks and confirm implementation. The strategy should define a standardized process to accept and monitor risks that cannot be adequately mitigated.- Status
- Closed Unimplemented
- Responsible Agency
- OS
- Response
- Non-Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 01/23/2025
- Legislative Related
- No
24-A-18-086.03We recommend that HHS confirm that all organization-wide and system-level risk assessments have been completed in an accurate and timely manner and include data points such as the threat vectors, likelihood, and tolerance level. This will help with the ability to address risks at the organization consistently and promptly.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 01/13/2025
- Next Update Expected
- 07/23/2025
- Legislative Related
- No
24-A-18-086.04We recommend that HHS require OpDivs to implement an effective SCRM program that meets the defined standards across HHS and confirm implementation is consistent with established standard. HHS should ensure that all OpDivs are appropriately assessing vendors and submitting data points to assist with tracking and monitoring components on the network.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Non-Concur
- Potential Savings
- -
- Last Update Received
- 01/13/2025
- Next Update Expected
- 07/23/2025
- Legislative Related
- No
24-A-18-086.05We recommend that HHS require OpDivs to assess and inventory privileged user accounts across the agency by an established due date and confirm completion. HHS should confirm that OpDivs policies are defined to require privileged user account monitoring in both logging and activity reviews, preferably at an automated level.- Status
- Closed Unimplemented
- Responsible Agency
- OS
- Response
- Non-Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 01/23/2025
- Legislative Related
- No
24-A-18-086.06We recommend that the HHS OCIO monitor and confirm that the OpDivs conduct an annual review of the System Security & Privacy Plan and annually perform risk assessments for all operational systems, according to organizational policy.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 01/13/2025
- Next Update Expected
- 07/23/2025
- Legislative Related
- No
24-A-18-086.07We recommend that the HHS OCIO monitor and confirm that the OpDivs appropriately track software license information and maintain an accessible, up-to-date inventory for all its software licenses.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 01/13/2025
- Next Update Expected
- 07/23/2025
- Legislative Related
- No
24-A-18-086.08We recommend that the HHS OCIO monitor and confirm that the OpDivs perform the SAR and ATO in accordance with the organization's policy.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 12/16/2024
- Next Update Expected
- 06/17/2025
- Legislative Related
- No
24-A-18-086.09We recommend that the HHS OCIO monitor and confirm that the OpDivs utilize automated solutions to provide a portfolio view of cybersecurity risk at the organization is consistently implemented in accordance with NIST standards.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 01/13/2025
- Next Update Expected
- 07/23/2025
- Legislative Related
- No
24-A-18-086.10We recommend that the HHS OCIO confirm OpDivs define and implement an OpDiv level supply chain risk management strategy based on HHS departmental policy and NIST standards.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 01/13/2025
- Next Update Expected
- 07/23/2025
- Legislative Related
- No
24-A-18-086.11We recommend that the HHS OCIO ensure that OpDivs' vulnerabilities are tracked and remediated in a timely manner and create POA&Ms for any vulnerabilities in accordance with the organization's policy.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 01/13/2025
- Next Update Expected
- 07/23/2025
- Legislative Related
- No
24-A-18-086.12We recommend that the HHS OCIO ensure that all OpDivs' baseline configurations are documented and tracked for each system in the OpDiv.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 12/13/2024
- Next Update Expected
- 06/16/2025
- Legislative Related
- No
24-A-18-086.13We recommend that the HHS OCIO ensure that all OpDivs' TIC 3.0 program use cases are reviewed for relevance and capabilities that are new to the latest revision of the TIC guidance are consistently implemented in accordance with HHS Policy for the Implementation of TIC and OMB M-19-26.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 01/13/2025
- Next Update Expected
- 07/23/2025
- Legislative Related
- No
24-A-18-086.14We recommend that the HHS OCIO ensure that all OpDivs acquire the resources to fully implement MFA or an alternative strong authentication and implement multi-factor authentication or an alternative strong authentication for both privileged and non-privileged users on all operational systems.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 01/13/2025
- Next Update Expected
- 07/23/2025
- Legislative Related
- No
24-A-18-086.15We recommend that the HHS OCIO ensure that all OpDivs provision, manage, and review privileged user accounts for operational systems.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 01/13/2025
- Next Update Expected
- 07/23/2025
- Legislative Related
- No
24-A-18-086.16We recommend that the HHS OCIO ensure that all OpDivs are properly implementing remote session timeouts of 30 minutes (or less) for operating systems.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 12/13/2024
- Next Update Expected
- 06/17/2025
- Legislative Related
- No
24-A-18-086.17We recommend that the HHS OCIO ensure that all OpDivs consistently implement access policies and procedures in accordance with the organization's Risk Management Safeguards policy across the organization.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 01/13/2025
- Next Update Expected
- 07/23/2025
- Legislative Related
- No
24-A-18-086.18We recommend that the HHS OCIO ensure that all OpDivs' operational systems have an approved and up-to-date PIA in accordance with the HHS Policy of Privacy Impact Assessment.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 12/13/2024
- Next Update Expected
- 06/16/2025
- Legislative Related
- No
24-A-18-086.19We recommend that the HHS OCIO ensure that all OpDivs implement data encryption methods to protect data determined to be PII or sensitive by the systems and enhanced network defenses in accordance with NIST standards.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 01/13/2025
- Next Update Expected
- 07/23/2025
- Legislative Related
- No
24-A-18-086.20We recommend that the HHS OCIO require and confirm that all OpDivs have a process in place to evaluate their workforce gaps. Furthermore, confirm that all OpDivs are implementing a compliant security training strategy as defined by overarching HHS policy.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 01/13/2025
- Next Update Expected
- 07/23/2025
- Legislative Related
- No
24-A-18-086.21We recommend that the HHS OCIO ensure that all OpDivs are inheriting and consistently implementing policies and procedures defined by HHS department level policy.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 01/13/2025
- Next Update Expected
- 07/23/2025
- Legislative Related
- No
24-A-18-086.22We recommend that the HHS OCIO continuously monitor to ensure that all OpDivs inherit and consistently implement policies or procedures to govern their incident response strategy.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 01/13/2025
- Next Update Expected
- 07/23/2025
- Legislative Related
- No
24-A-18-086.23We recommend that the HHS OCIO continuously monitor to ensure that all OpDivs define common threat vector taxonomy for classifying incidents and its processes for detecting, analyzing, and prioritizing incidents in accordance with NIST standards, USCERT Federal Incident Notification Guidelines and OMB guidance across the organization.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 01/13/2025
- Next Update Expected
- 07/23/2025
- Legislative Related
- No
24-A-18-086.24We recommend that the HHS OCIO work with the OpDivs to require and confirm that all OpDivs' operational systems have a complete and up-to-date BIA.- Status
- Closed Implemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 01/17/2025
- Legislative Related
- No
24-A-18-086.25We recommend that the HHS OCIO work with the OpDivs to require and confirm that all OpDivs' operational systems conduct Contingency Plan testing and exercises as required by their risk rating. Any testing and exercises conducted should be followed with after-action reports as necessary.- Status
- Closed Implemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 01/23/2025
- Legislative Related
- No
24-A-18-086.26We recommend that the HHS OCIO work with the OpDivs to confirm that all OpDivs' policies and procedures covering Contingency Plan testing are in accordance with policy requirements by Departmental policy, NIST standards, and OMB guidance.- Status
- Open Unimplemented
- Responsible Agency
- OS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 12/13/2024
- Next Update Expected
- 07/17/2025
- Legislative Related
- No
-
The National Institutes of Health Has Made Progress But Could Further Improve Its Closeout Process for Grants and Similar Awards
24-A-04-084.01We recommend that the National Institutes of Health formalize the recently implemented FRPPR monitoring control into NIH policy.- Status
- Open Unimplemented
- Responsible Agency
- NIH
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 12/17/2024
- Next Update Expected
- 07/02/2025
- Legislative Related
- No
24-A-04-084.02We recommend that the National Institutes of Health facilitate timely unilateral closeout within 1 year of the PPE date by implementing a policy that requires the unilateral closeout process be completed early enough to allow for final closeout within 1 year of the PPE date; and providing additional training to staff involved in the closeout process to increase staff awareness (i.e., sending monitoring reports to ICs for awards eligible for unilateral closeout).- Status
- Open Unimplemented
- Responsible Agency
- NIH
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 12/17/2024
- Next Update Expected
- 07/02/2025
- Legislative Related
- No
24-A-04-084.03We recommend that the National Institutes of Health create policies and procedures for reporting award recipients in SAM.gov that do not submit the required final reports within 1 year of the award PPE date.- Status
- Open Unimplemented
- Responsible Agency
- NIH
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 12/17/2024
- Next Update Expected
- 07/02/2025
- Legislative Related
- No
24-A-04-084.04We recommend that the National Institutes of Health retroactively report all recipients with unilateral closeout actions in calendar year 2023 in SAM.gov.- Status
- Closed Implemented
- Responsible Agency
- NIH
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 01/02/2025
- Legislative Related
- No
-
Many States Lack Information To Monitor Maltreatment in Residential Facilities for Children in Foster Care
24-E-07-018.01ACF should provide guidance and technical assistance to States to build data collection and monitoring capabilities that are foundational to effective oversight of maltreatment in residential facilities.- Status
- Open Unimplemented
- Responsible Agency
- ACF
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 02/12/2025
- Next Update Expected
- 02/20/2026
- Legislative Related
- No
24-E-07-018.02ACF should help States to improve their abilities to monitor patterns of maltreatment and performance across chains of residential facilities operating in multiple States.- Status
- Open Unimplemented
- Responsible Agency
- ACF
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 02/12/2025
- Next Update Expected
- 02/20/2026
- Legislative Related
- No
24-E-07-018.03ACF should take steps to improve inter-State communication when children are placed in out-of-State residential facilities.- Status
- Open Unimplemented
- Responsible Agency
- ACF
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 02/12/2025
- Next Update Expected
- 02/20/2026
- Legislative Related
- No
24-E-07-018.04ACF should work with States to improve reporting of placement data in NCANDS.- Status
- Closed Implemented
- Responsible Agency
- ACF
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 02/20/2025
- Legislative Related
- No
-
North Carolina Did Not Report and Return All Medicaid Overpayments for the State’s Medicaid Fraud Control Unit Cases
24-A-06-083.01We recommend that the North Carolina Department of Health and Human Services report and return the Federal share for the seven unreported cases, totaling $30,352,630 ($20,134,402 Federal share).- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- $20,134,402
- Last Update Received
- 10/02/2025
- Next Update Expected
- 04/02/2026
- Legislative Related
- No
24-A-06-083.02We recommend that the North Carolina Department of Health and Human Services strengthen internal controls by expanding written policies and procedures to include procedures for requesting, recording, and reporting all MFCU-determined Medicaid overpayments within prescribed regulatory timeframes, and ensuring they received all case files.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 10/02/2025
- Next Update Expected
- 04/02/2026
- Legislative Related
- No
24-A-06-083.03We recommend that the North Carolina Department of Health and Human Services work with the MFCU to determine the Medicaid overpayments for cases after our audit period and ensure that all overpayments are reported on the Form CMS-64.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 10/02/2025
- Next Update Expected
- 04/02/2026
- Legislative Related
- No
-
NIH Did Not Close Contracts in Accordance With Federal Requirements, Resulting in the Increased Risk of Fraud, Waste, and Abuse
24-A-04-082.01We recommend that the National Institutes of Health complete the administrative closeout requirements for the 29 contracts totaling more than $1.9 billion identified in our audit.- Status
- Closed Implemented
- Responsible Agency
- NIH
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 09/10/2025
- Legislative Related
- No
24-A-04-082.02We recommend that the National Institutes of Health incorporate, by reference, the administrative closeout requirements from the FAR and HHSCCD into the NIH Policy Manual.- Status
- Open Unimplemented
- Responsible Agency
- NIH
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 12/01/2025
- Next Update Expected
- 06/01/2026
- Legislative Related
- No
24-A-04-082.03We recommend that the National Institutes of Health update the NIH Policy Manual to address migration of contract file records to new contract management systems; preservation of all contract file records when employees depart the agency; and prevention of contract records from being destroyed before contract closeout has occurred.- Status
- Open Unimplemented
- Responsible Agency
- NIH
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 12/01/2025
- Next Update Expected
- 06/01/2026
- Legislative Related
- No
24-A-04-082.04We recommend that the National Institutes of Health establish control activities for monitoring the performance of contract personnel's compliance with administrative closeout requirements.- Status
- Open Unimplemented
- Responsible Agency
- NIH
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- 12/01/2025
- Next Update Expected
- 06/01/2026
- Legislative Related
- No
-
CMS Could Strengthen Program Safeguards To Prevent and Detect Improper Medicare Payments for Short Inpatient Stays
24-A-09-081.01To strengthen program safeguards for preventing and detecting improper payments for short inpatient stays and recovering overpayments for claims that do not comply with Medicare requirements, we recommend that the Centers for Medicare & Medicaid Services work with its contractors to add information to inpatient claims indicating any stay that did not span two or more midnights because of an unforeseen circumstance (e.g., a condition code).- Status
- Closed Unimplemented
- Responsible Agency
- CMS
- Response
- Non-Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 08/25/2025
- Legislative Related
- No
24-A-09-081.02To strengthen program safeguards for preventing and detecting improper payments for short inpatient stays and recovering overpayments for claims that do not comply with Medicare requirements, we recommend that the Centers for Medicare & Medicaid Services work with its contractors to develop a list of ICD-10 procedure codes associated with the HCPCS codes on the inpatient only procedures list.- Status
- Open Unimplemented
- Responsible Agency
- CMS
- Response
- Partial Concur
- Potential Savings
- -
- Last Update Received
- 12/02/2025
- Next Update Expected
- 06/02/2026
- Legislative Related
- No
24-A-09-081.03To strengthen program safeguards for preventing and detecting improper payments for short inpatient stays and recovering overpayments for claims that do not comply with Medicare requirements, we recommend that the Centers for Medicare & Medicaid Services work with its contractors to implement prepayment edits for claims for short inpatient stays at risk for noncompliance with the two-midnight rule (i.e., short inpatient stays with risk factors such as canceled procedures or certain MS-DRGs).- Status
- Closed Implemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 11/17/2025
- Legislative Related
- No
24-A-09-081.04To strengthen program safeguards for preventing and detecting improper payments for short inpatient stays and recovering overpayments for claims that do not comply with Medicare requirements, we recommend that the Centers for Medicare & Medicaid Services work with its contractors to update policies and procedures for postpayment reviews to focus on claims for short inpatient stays identified as at risk for noncompliance with the two-midnight rule and recovery of overpayments (e.g., through additional reviews by RACs or other contractors).- Status
- Closed Implemented
- Responsible Agency
- CMS
- Response
- Concur
- Potential Savings
- -
- Last Update Received
- -
- Closed Date
- 10/23/2024
- Legislative Related
- No