Recommendations Tracker

CMS should require nursing homes to systematically document facility-initiated discharges in information available to CMS and States to enhance oversight.

CMS should explore options to expand Medicare and Medicaid coverage to additional behavioral health providers.

CMS should increase monitoring of Medicare and Medicaid enrollees' use of behavioral health services and identify vulnerabilities.

New Jersey Department of Human Services should refund $18,826,714 associated with deficiencies identified in the current audit.

We recommend that Indian Health Service consider upgrading the GRSSC's inventory system or implement other strategies to better coordinate the delivery of supplies to all customers.

We reccomend ACF remediate the 19 security control findings in accordance with NIST SP 800-53.

We reccomend ACF leverage cloud security assessment tools to identify misconfigurations and weak cybersecurity controls in its cloud infrastructure.

We recommend Alabama evaluate its current vulnerability scanning tools and update if necessary in order to better detect system flaws (e.g., common web server vulnerabilities) in its MMIS and E&E system and software components.

We recommend Alabama implement procedures to periodically verify that its developers are adhering to secure coding standards and remediating vulnerabilities before releasing code to production.

We recommend that the Delaware Division of Medicaid and Medical Assistance identify and recover unallowable capitation payments, which we estimate to be at least $4,246,759, made to MCOs during our audit period on behalf of deceased enrollees.

We recommend that the Delaware Division of Medicaid and Medical Assistance develop and implement quality assurance steps, including supervisory review, within its policies and procedures to verify that State agency personnel correctly enter enrollees' information into the MMIS system.

We recommend that the Centers for Medicare & Medicaid Services improve its oversight of States' compliance with MH/SUD parity requirements, including requiring States in which MCOs are responsible for the parity analysis to submit information MCOs provided regarding compliance with parity requirements to CMS for its review as part of the contract approval process and, if necessary, seeking additional regulatory authority to do so.

We recommend that the Centers for Medicare & Medicaid Services improve its oversight of States' compliance with MH/SUD parity requirements, including maintaining documentation of its communications with States related to compliance with MH/SUD parity requirements and actions taken to correct any identified deficiencies.

We recommend that the Centers for Medicare & Medicaid Services require States to improve their monitoring of MCOs' ongoing compliance with MH/SUD parity requirements by requiring MCOs to update parity analyses when benefits change or deficiencies are corrected.

We recommend that the Centers for Medicare & Medicaid Services require States to improve their monitoring of MCOs' ongoing compliance with MH/SUD parity requirements by conducting followup in a timely manner with MCOs that have identified noncompliance with parity requirements to verify that the MCOs take corrective actions to address the noncompliance.

We recommend that the Utah Department of Health revise flaw remediation procedures such that they fully implement the flaw remediation requirements defined in the CMS Acceptable Risk Safeguards (ARS), SI-02 Flaw Remediation (High; Moderate; Low) control.

We recommend that the Kansas Department of Health and Environment improve its oversight of the estate recovery contractor's performance by: verifying that the contractor files liens and initiates probate in a timely manner; confirming that the contractor's current process for MMIS claims verification is accurate; and verifying that the contractor performs applicable estate recovery procedures (including the opening of cases, sending of notices, and independent asset research) for deceased Medicaid recipients.

We recommend that the Pennsylvania Department of Human Services refund $368,870,827 to the Federal Government or provide documentation that can reasonably support its allocation of health services costs to Medicaid without using unverifiable IEP ratios.

We recommend that the Pennsylvania Department of Human Services ensure that school districts verify that providers are appropriately licensed before they provide health services to students.

We recommend that the Pennsylvania Department of Human Services revise its RMTSs to include the first month of the school year.

With respect to PRF payments that were already made to providers under the Phase 2 General Distribution, we recommend that the Health Resources and Services Administration identify other providers with subsidiary organizations that had revenues included in the providers' Federal tax returns. Determine whether the payments made to the subsidiary organizations were correctly accounted for when calculating payments for the providers under the Phase 2 General Distribution. In addition, determine the amount of and seek from these providers repayment of any overpayments. If it is not feasible to review all providers, HRSA could conduct a cost-benefit analysis for conducting manual reviews to identify providers and, if the benefit outweighs the cost, it could select some providers to review.

Should HRSA need to rapidly disburse similar payments to providers in response to a future national emergency, we recommend that HRSA consider working with CMS to use the information from CMS's Provider Enrollment, Chain, and Ownership System and use Federal tax returns (e.g., Schedule R of Form 990 for information on a tax-exempt provider's subsidiary organizations), in part, to develop a more complete dataset to show parent-subsidiary relationships (to the extent they are applicable) to safeguard taxpayer money, which could have saved approximately $159,379,359 during our audit period.

Should HRSA need to rapidly disburse similar payments to providers in response to a future national emergency, we recommend that HRSA consider establishing an application and attestation portal function that requests a provider to check that the revenue amount entered in the revenue field of its application for payment is entered correctly. For example, HRSA could modify its application and attestation portal by adding a step in which, after a provider enters its revenue amount, the portal generates a new screen that displays the entered amount and requests that the provider confirm the amount. (to the extent they are applicable) to safeguard taxpayer money.

CMS should reassess nurse aide training and certification requirements.

CMS should provide effective guidance and assistance to nursing homes on how to comply with updated infection control requirements.

We recommend that MediGold identify, for the high-risk diagnoses included in this report, similar instances of noncompliance that occurred before and after our audit period and refund any resulting overpayments to the Federal Government.

ACF should develop a reference guide to help case managers better evaluate sponsors' identity.

ACF should provide additional guidance for case managers on when to consider recommending discretionary home studies.

ACF should develop an effective monitoring mechanism to identify children who do not receive timely followup calls after their release to sponsors.

Brown & Company recommends that the NIH conduct a system-level risk assessment for the SRA in accordance with NIST SP 800-53 requirements and NIH polices.

We recommend that the Colorado Department of Health Care Policy & Financing work with CMS to develop a risk-based approach to identify nursing homes at which surveys would be conducted more frequently than once every 15 months, such as those with a history of multiple high-risk deficiencies or frequent management turnover.