We recommend that IHS revise the IHM to include the type of action a provider should take and what documentation to include in the patient's EHR when a UDS is unfavorable.

We recommend that IHS increase oversight of IT systems by IHS management, including consideration of centralizing its key IT systems (including RPMS), services, and cybersecurity functions (e.g., patch management, unsupported network equipment and contingency planning) by conducting a cost-benefit analysis and risk assessment of adopting the Cloud First Policy and other means of centralization (e.g., headquarters, area offices). Specifically, determine if a cloud solutions or other modernization approaches are most effective and cost efficient in addressing persistent cybersecurity vulnerabilities and increasing network resiliency.

We recommend that IHS implement a strategic and phased approach to centralization of IT systems, services and cybersecurity functions.

We recommend that IHS work with hospitals to develop policies and procedures to review the EHRs of patients with opioid prescriptions from non-IHS providers and document the results of the review in the EHR, particularly for those patients who had previously violated their COT agreements.

We recommend that IHS work with hospitals to ensure all opioids are in a locked cabinet, safe, drawer, or other appropriate secure container at all times.

We recommend that IHS work with hospitals to analyze opioid data to make decisions and oversee providers to minimize prescribing practices that exceed daily MME guidelines established by IHS, co-prescribe opioids and benzodiazepines, and use opioids for acute pain.

We recommend that IHS work with area offices to renegotiate the MOU with Oklahoma and other States that have restrictive MOU language to allow for PDMP self-audits and collection by clinical directors.

We recommend that IHS should assign a centralized team (e.g., headquarters, area office) to: Ensure patches are deployed timely to all IHS end points in accordance with NIST guidance and IHS policies and procedures.

We recommend that IHS should assign a centralized team (e.g., headquarters, area office) to: Securely configure and monitor wireless access points at all IHS hospitals.

We recommend that IHS should ensure that all devices on IHS's network are scanned for vulnerabilities, scan reports reviewed by appropriate computer personnel, track vulnerability remediation, and ensure that vulnerabilities are remediated in a timely way.

We recommend that IHS should ensure that all hospitals: Store backup tapes off-site in accordance with Federal guidelines.