CDC’s Vaccines for Children Program Recipients Did Not Conduct Site Visits at Some Providers as Required, A-09-22-01000
- Issuer
- Office of Inspector General
- Document type
- Report
- Date
- 2020-07-01
Summary
An audit report, Report No. A-09-22-01000, issued in September 2023 by the Department of Health and Human Services Office of Inspector General on site visits in CDC's Vaccines for Children (VFC) program. The report finds that recipients conducted enrollment site visits as required but did not conduct compliance site visits in a timely manner at 11,499 of 39,120 enrolled and active providers (29 percent). It also reports that recipients did not conduct storage and handling site visits at either of the 2 CDC-approved depot providers or at a minimum of 5 percent of providers, and did not verify followup actions for 33,316 of 127,594 issues (26 percent). The report recommends that CDC work with recipients on a plan and timeline for overdue site visits and develop an action plan to enforce site visit requirements, and states that CDC concurred.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Full text
Department of Health and Human Services
OFFICE OF
INSPECTOR GENERAL
CDC’S VACCINES FOR CHILDREN
PROGRAM RECIPIENTS DID NOT
CONDUCT SITE VISITS AT SOME
PROVIDERS AS REQUIRED
Inquiries about this report may be addressed to the Office of Public Affairs at
Public.Affairs@oig.hhs.gov.
Amy J. Frontz
Deputy Inspector General
for Audit Services
September 2023
A-09-22-01000
Office of Inspector General
https://oig.hhs.gov
The mission of the Office of Inspector General (OIG) is to provide objective oversight to promote the
economy, efficiency, effectiveness, and integrity of the Department of Health and Human Services (HHS)
programs, as well as the health and welfare of the people they serve. Established by Public Law
No. 95-452, as amended, OIG carries out its mission through audits, investigations, and evaluations
conducted by the following operating components:
Office of Audit Services. OAS provides auditing services for HHS, either by conducting audits
with its own audit resources or by overseeing audit work done by others. The audits examine the
performance of HHS programs, funding recipients, and contractors in carrying out their respective
responsibilities and provide independent assessments of HHS programs and operations to reduce waste,
abuse, and mismanagement.
Office of Evaluation and Inspections. OEI’s national evaluations provide HHS, Congress,
and the public with timely, useful, and reliable information on significant issues. To promote impact,
OEI reports also provide practical recommendations for improving program operations.
Office of Investigations. OI’s criminal, civil, and administrative investigations of fraud and
misconduct related to HHS programs and operations often lead to criminal convictions, administrative
sanctions, and civil monetary penalties. OI’s nationwide network of investigators collaborates with the
Department of Justice and other Federal, State, and local law enforcement authorities. OI works with
public health entities to minimize adverse patient impacts following enforcement operations. OI also
provides security and protection for the Secretary and other senior HHS officials.
Office of Counsel to the Inspector General. OCIG provides legal advice to OIG on HHS
programs and OIG’s internal operations. The law office also imposes exclusions and civil monetary
penalties, monitors Corporate Integrity Agreements, and represents HHS’s interests in False Claims Act
cases. In addition, OCIG publishes advisory opinions, compliance program guidance documents, fraud
alerts, and other resources regarding compliance considerations, the anti-kickback statute, and other
OIG enforcement authorities.
Notices
THIS REPORT IS AVAILABLE TO THE PUBLIC
at https://oig.hhs.gov
Section 8M of the Inspector General Act, 5 U.S.C. App., requires
that OIG post its publicly available reports on the OIG website.
OFFICE OF AUDIT SERVICES FINDINGS AND OPINIONS
The designation of financial or management practices as
questionable, a recommendation for the disallowance of costs
incurred or claimed, and any other conclusions and
recommendations in this report represent the findings and
opinions of OAS. Authorized officials of the HHS operating
divisions will make final determination on these matters.
Report in Brief
Date: September 2023
Report No. A-09-22-01000
Why OIG Did This Audit CDC’s Vaccines for Children Program Recipients
The Vaccines for Children (VFC)
program provides vaccines at no cost Did Not Conduct Site Visits at Some Providers
to children whose parents or as Required
guardians may not be able to afford
them, which helps ensure that all
children have a better chance of
What OIG Found
CDC’s VFC program recipients conducted enrollment site visits for all newly
receiving recommended vaccinations
enrolled and reenrolling VFC providers as required. However, recipients did
on schedule. The Centers for Disease
not meet all program requirements for conducting compliance site visits and
Control and Prevention (CDC)
storage and handling site visits. Specifically, recipients did not: (1) conduct
requires that program recipients
compliance site visits in a timely manner at 11,499 of 39,120 enrolled and
conduct three types of provider site
active providers (29 percent), (2) conduct storage and handling site visits at
visits (enrollment, compliance, and
either of the 2 CDC-approved depot providers, (3) conduct storage and
storage and handling), which allow
handling site visits for at least 5 percent of their providers, and (4) verify that
recipients to determine whether
providers completed followup actions by the deadlines for 33,316 of 127,594
vaccines are stored, handled, and
issues (26 percent) identified during compliance and storage and handling
administered in accordance with the
site visits.
laws and policies governing the VFC
program. However, multiple State
CDC officials stated that staffing constraints and the COVID-19 pandemic were
auditors’ reports identified overdue
reasons that program recipients did not conduct site visits at some providers
site visits, site visits that were not
as required. CDC officials also stated that, during the COVID-19 pandemic,
conducted, and overdue followup
CDC and recipients were focused on the priority of COVID-19 vaccination
actions for compliance issues.
program development and vaccine distribution, some providers were
temporarily closed, and travel was restricted. In addition, we found that CDC
Our objective was to determine
did not have internal written policies and procedures for CDC’s monitoring and
whether CDC’s VFC program
oversight activities, including oversight of recipients’ site visits at providers.
recipients conducted site visits at
Finally, CDC’s Provider Education, Assessment, and Reporting online system
enrolled and active VFC providers
did not have interactive reminders or alerts related to overdue site visits and
according to program requirements.
followup actions. Because recipients did not conduct site visits as required or
verify that providers completed followup actions to address identified
How OIG Did This Audit compliance issues, CDC and recipients could not ensure that providers were
We identified 39,120 providers and complying with VFC program requirements.
2 CDC-approved depot providers that
were enrolled and active at any point
from July 1, 2020, through June 30,
What OIG Recommends and CDC Comments
We recommend that CDC: (1) work with program recipients to implement a
2021. We reviewed 3 years’ worth of
plan and timeline to conduct the required site visits that are overdue and
data for all enrollment, compliance,
verify the completion of followup actions that had not been completed by the
and storage and handling site visits
deadlines and (2) develop an action plan to enforce site visit requirements by
and reviewed the data for more than
CDC’s planned date of July 1, 2023. The report lists two more procedural
127,000 followup actions associated
recommendations. CDC concurred with our recommendations and described
with these site visits.
actions that it had taken or planned to take to address our recommendations,
including working with recipients that have overdue site visits to develop an
implementation plan and timeline for conducting those site visits and
developing an action plan to provide guidance to recipients for site visits.
The full report can be found at https://oig.hhs.gov/oas/reports/region9/92201000.asp.
TABLE OF CONTENTS
INTRODUCTION ............................................................................................................................... 1
Why We Did This Audit ....................................................................................................... 1
Objective ............................................................................................................................. 1
Background ......................................................................................................................... 1
Vaccines for Children Program ............................................................................... 1
VFC Program Management..................................................................................... 2
Program Recipients’ Site Visits and Related Followup Actions .............................. 3
CDC’s Provider Education, Assessment, and Reporting Online System ................. 4
Impact of COVID-19 Pandemic on the VFC Program .............................................. 5
How We Conducted This Audit ........................................................................................... 6
FINDINGS ......................................................................................................................................... 6
Program Recipients Did Not Conduct Compliance Site Visits in a Timely Manner
at Some Providers ............................................................................................................ 7
Program Recipients Did Not Conduct Storage and Handling Site Visits
at Either of the CDC-Approved Depot Providers ............................................................. 8
Most Program Recipients Did Not Conduct Storage and Handling Site Visits
at a Minimum of 5 Percent of Providers .......................................................................... 8
Program Recipients Did Not Verify That Providers Completed Followup Actions
by the Deadline ................................................................................................................ 9
Site Visits Were Not Conducted and Followup Actions Were Not Completed
Because of Recipients’ Staffing Constraints and CDC’s Lack of Written Policies........... 10
CONCLUSION ................................................................................................................................. 11
RECOMMENDATIONS ................................................................................................................... 11
CDC COMMENTS AND OFFICE OF INSPECTOR GENERAL RESPONSE............................................ 11
APPENDICES
A: Audit Scope and Methodology ..................................................................................... 13
B: CDC Comments ............................................................................................................. 15
CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits
at Some Providers as Required (A-09-22-01000)
INTRODUCTION
WHY WE DID THIS AUDIT
The Vaccines for Children (VFC) program provides vaccines at no cost to children whose parents
or guardians may not be able to afford them, which helps ensure that all children have a better
chance of receiving recommended vaccinations on schedule. The Centers for Disease Control
and Prevention (CDC) provides funding for the VFC program through a cooperative agreement
with program recipients—i.e., State health departments and certain local and territorial public
health agencies. One of CDC’s requirements is that program recipients conduct site visits at
VFC providers. Site visits allow recipients to determine whether vaccines are stored, handled,
and administered in accordance with the laws and policies governing the VFC program.
COVID-19 vaccines were not administered as part of the VFC program but were administered as
part of a separate COVID-19 vaccine program.
Multiple State auditors’ reports identified overdue site visits, site visits that were not
conducted, and overdue followup actions for compliance issues discovered during site visits of
VFC providers. 1 Therefore, we conducted this audit to determine whether program recipients
nationwide complied with VFC program requirements for site visits at enrolled and active
providers. 2
OBJECTIVE
Our objective was to determine whether CDC’s VFC program recipients conducted site visits at
enrolled and active VFC providers according to program requirements.
BACKGROUND
Vaccines for Children Program
Authorized by section 1928 of the Social Security Act, the VFC program is an entitlement
program (a right granted by law) for eligible children. A child is eligible for the VFC program if
the child is younger than 19 years of age and is one of the following: eligible for the Medicaid
1
The State auditors’ reports were for the States of California, Connecticut, and Illinois for fiscal year ended
June 30, 2019. In addition, a prior Office of Inspector General report Vaccines for Children Program: Vulnerabilities
in Vaccine Management (OEI-04-10-00430), issued June 5, 2012, examined the extent to which selected VFC
providers and program recipients adhered to CDC’s requirements for vaccine management.
2
To enroll in the VFC program, a provider must have an enrollment site visit, and to remain active in the program,
the provider must order vaccines every 12 months.
CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits
at Some Providers as Required (A-09-22-01000) 1
program, uninsured, underinsured, or an American Indian or Alaska Native (Social Security Act
§ 1928(b)(2)(A)). 3
The VFC program provides vaccines at no cost to children who might not otherwise be
vaccinated because of inability to pay. This program helps ensure that all children have a better
chance of getting their recommended vaccines on schedule and has helped prevent disease and
save lives. The vaccines provided protect children against chickenpox, diphtheria, measles,
rubella, tetanus, pertussis, and other diseases.
In fiscal years 2020 and 2021, CDC’s funding for the VFC program totaled more than $4.5 billion
and $3.8 billion, respectively, for vaccine direct assistance (purchase of vaccines) and for
program operations and infrastructure (program oversight, quality improvement, and vaccine
management). CDC awards funding to program recipients for VFC program operations and
infrastructure through cooperative agreements. CDC also refers to program recipients as
“awardees,” “grantees,” and “immunization programs.” (In this report, we use “program
recipients” or “recipients.”) Cooperative agreement funding is awarded by budget periods,
which run from July 1 through June 30.
VFC Program Management
CDC is responsible for policy development and implementation of the VFC program. CDC
administers the VFC program at the national level through its National Center for Immunization
and Respiratory Diseases (NCIRD). Within NCIRD, the Immunization Services Division’s Program
Operations Branch provides policy guidance and oversight for the VFC program, provides
technical assistance to program recipients on all program components, and monitors program
recipients’ performance.
CDC buys vaccines at a discount and distributes them to VFC providers at the direction of
program recipients. To manage the VFC program, recipients perform many tasks, including
recruiting and enrolling providers in the program, evaluating performance, providing quality
assurance, completing surveys, and conducting site visits at providers.
A VFC provider is any health care provider location that is licensed or otherwise authorized by a
State to administer pediatric vaccines and is enrolled in the VFC program. CDC-approved
depots are considered VFC providers; however, they only store vaccines and do not administer
them.
3
“Underinsured” means the child has health insurance but that insurance does not cover vaccines or does not
cover certain vaccines or covers vaccines but has a fixed dollar limit or cap for vaccines. Once that fixed dollar
amount is reached, a child is then eligible for the VFC program. Underinsured children are eligible to receive
vaccines only at Federally Qualified Health Centers or Rural Health Clinics.
CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits
at Some Providers as Required (A-09-22-01000) 2
There are 61 program recipients for the 50 States, the District of Columbia, 5 territories, and
5 cities.4 We identified 39,122 VFC providers that participated in the VFC program during our
audit period.
Program Recipients’ Site Visits and Related Followup Actions
CDC’s Immunization Program Operations Manual requires that: (1) recipients and providers
adhere to VFC requirements and guidance for all areas as outlined in CDC’s VFC Operations
Guide (Operations Guide) and (2) recipients conduct site visits at VFC providers (Unit II,
chapter C). To ensure the quality of VFC vaccines and the integrity of the VFC program, the
Operations Guide requires recipients to conduct:
Enrollment site visits educate
• an enrollment site visit for all new and reenrolling
providers on implementing VFC
VFC providers before they receive VFC vaccines, program requirements and assess
providers’ storage and handling
• compliance site visits for all enrolled and active equipment. Compliance site visits
VFC providers within 12 months of enrollment evaluate whether providers are
and every 24 months thereafter, 5 complying with and understand
program requirements. Storage and
• scheduled storage and handling site visits at handling site visits assess providers’
CDC-approved depot providers every 12 months, compliance with and knowledge of
requirements for storing and handling
and
vaccines.
• unannounced storage and handling site visits at a
minimum of 5 percent of VFC providers during each cooperative agreement budget
period.
Site visits allow recipients to determine provider compliance with VFC program requirements,
including requirements for vaccine eligibility screening and documentation, accountability, and
management. Site visits also evaluate whether vaccines are stored, handled, and administered
properly. 6 The goal is to ensure that VFC-eligible children are receiving properly managed and
viable vaccines. Recipients also use site visits to identify areas in which providers are doing well
and areas needing additional followup, and to provide training for providers on program
requirements.
4
The five territories are the Commonwealth of Puerto Rico, U.S. Virgin Islands, American Samoa, Guam, and the
Northern Mariana Islands. The five cities are Chicago, Houston, New York City, Philadelphia, and San Antonio.
5
Recipients are not required to conduct compliance site visits at CDC-approved depots.
6
Proper storage and handling of vaccines ensures that they are kept at the correct temperatures. Vaccines
exposed to too much heat, cold, or light may lose their potency, which can render them less effective or even
useless, and unable to provide immunity for vaccinated individuals.
CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits
at Some Providers as Required (A-09-22-01000) 3
After a compliance or storage and handling site visit has been conducted, the recipient must
discuss the outcome with the provider and agree on a plan with followup actions and deadlines
for addressing identified compliance issues or opportunities for improvement. Followup
actions are mandatory corrective actions that providers must implement within a given
timeframe. Examples of followup actions include but are not limited to documenting screening
of patient eligibility for vaccines, documenting the temperature of vaccine storage units,
removing expired vaccines from storage units, and placing appropriate thermometers in
storage units.
CDC’s Provider Education, Assessment, and Reporting Online System
The Operations Guide requires that program recipients use CDC’s Provider Education,
Assessment, and Reporting (PEAR) online system to document provider site visits and any
compliance issues identified during those visits. PEAR contains reviewer guides that recipients
must use to conduct site visits, with a series of questions that recipients must address during
each visit. For each question, onsite or followup actions are specified to address identified
compliance issues. Each followup action includes a due date for completion, ranging from
immediate (onsite actions) to 6 months after the site visit. Followup actions may require action
by either the provider or the recipient, or both. An example of a required recipient action
would be conducting a followup site visit to verify completion of a followup action by the
provider.
PEAR serves as an oversight management tool for both CDC and program recipients, as
discussed in the following sections.
CDC’s Management of the VFC Program Using the PEAR Online System
PEAR serves as an oversight management tool for CDC. According to CDC officials, as part of its
oversight of the VFC program, CDC performed annual testing of PEAR to ensure data validity
and system integrity, performed an annual review of PEAR dashboards (which are graphical,
real-time representations of data in PEAR) and reports, and routinely analyzed PEAR data.
Additionally, before the COVID-19 pandemic, as part of its oversight, CDC conducted regular
technical assistance site visits at all 61 recipients annually to review each recipient’s data,
dashboards, and reports, and addressed overdue site visits and followup actions.
Program Recipients’ Management of the VFC Program Using the PEAR Online System
PEAR also serves as an oversight management tool for recipients. PEAR collects relevant VFC
data to support overall program activities and is used to document recipients’ quality assurance
activities, capture recipients’ compliance with various policies and reporting requirements, and
note provider noncompliance when applicable. CDC requires recipients to use PEAR to:
(1) document followup actions for compliance issues identified during site visits and (2) monitor
and evaluate program performance. PEAR enables recipients to track providers’ progress on
followup actions and to maintain information on other contacts (e.g., by email or phone) with
CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits
at Some Providers as Required (A-09-22-01000) 4
VFC providers unrelated to site visits. Recipients can use the PEAR dashboards and reports
to monitor provider and program level issues and trends.
Impact of the COVID-19 Pandemic on the VFC Program
CDC officials described to us the impact Figure 1: The Number of Site Visits That Program
of the COVID-19 pandemic on the VFC Recipients Conducted Significantly Decreased
program, especially with respect to Starting in March 2020 and Gradually Increased
recipients’ ability to conduct site visits. Over the Remainder of 2020 and in 2021
Staffing constraints, travel restrictions,
re-prioritizing of resources, and
temporary provider closures were all
reasons that CDC offered to explain why
recipients delayed site visits. According
to CDC officials, because of CDC’s own
staffing constraints, CDC delayed its
work on developing internal written
policies and procedures for program
oversight. Key staff were deployed for
multiple extended periods to support
COVID-19-related activities, which
required delaying or suspending routine
calls with recipients and annual site
visits to provide technical assistance to
recipients.
CDC suspended all provider site visits by
recipients in mid-March 2020 but
required recipients to submit plans for
ensuring providers’ proper storage and
handling of vaccines. In mid-May 2020,
CDC allowed recipients to resume
in-person site visits at their discretion.
In addition, CDC authorized hybrid site
visits in July 2020 and virtual site visits in
August 2020. 7 Figure 1 shows the
number of site visits of each type
conducted from July 1, 2018, through
June 30, 2021, by quarter. The
variations in the number of site visits
conducted reflected the changes in
CDC’s guidance.
7
A hybrid visit is a compliance site visit that is conducted partly in-person (onsite) and partly remotely. A virtual
visit is an enrollment, compliance, or storage and handling site visit conducted entirely remotely.
CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits
at Some Providers as Required (A-09-22-01000) 5
HOW WE CONDUCTED THIS AUDIT
We reviewed CDC’s operations manuals and guidance related to VFC program requirements for
site visits at providers. We identified 39,122 providers, consisting of 39,120 providers that
administered VFC vaccines and 2 CDC-approved depot providers, that were enrolled and active
at any point from July 1, 2020, through June 30, 2021 (audit period). 8 To determine whether
the 61 program recipients conducted the required site visits at providers, we reviewed 3 years’
worth of PEAR data (July 1, 2018, through June 30, 2021) for all enrollment, compliance, and
storage and handling site visits conducted at the identified providers. We determined the “due
date” of a provider’s next required site visit and calculated the number of days of delay for an
overdue site visit. To determine whether providers completed followup actions by the PEAR
system-assigned deadlines, we reviewed the PEAR data for 127,594 followup actions associated
with these site visits. We analyzed the status of these followup actions and identified the
number of days between the assigned deadlines and the actual completion dates.
We conducted this performance audit in accordance with generally accepted government
auditing standards. Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions
based on our audit objectives. We believe that the evidence obtained provides a reasonable
basis for our findings and conclusions based on our audit objectives.
Appendix A contains the details of our audit scope and methodology.
FINDINGS
CDC’s VFC program recipients conducted enrollment site visits for all newly enrolled and
reenrolling VFC providers as required. However, recipients did not meet all program
requirements for conducting compliance site visits and storage and handling site visits.
Specifically:
• Recipients did not conduct compliance site visits in a timely manner at 11,499 of
39,120 enrolled and active providers (29 percent).
• Recipients did not conduct storage and handling site visits at either of the
two CDC-approved depot providers.
• Most recipients (43 of 61 recipients) did not conduct storage and handling site visits for
at least 5 percent of their providers.
8
CDC indicated that there were three CDC-approved depot providers. However, we determined that one of the
CDC-approved depot providers that was enrolled and active during our audit period was not included in the PEAR
data because the program recipient did not accurately enroll the provider. CDC officials stated that the recipient
was working to correct the enrollment error.
CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits
at Some Providers as Required (A-09-22-01000) 6
• Recipients did not verify that providers completed followup actions by the deadlines for
33,316 of 127,594 issues (26 percent) identified during compliance and storage and
handling site visits.
CDC officials stated that staffing constraints and the COVID-19 pandemic were reasons that
recipients did not conduct site visits at some providers as required. CDC officials also stated
that, during the COVID-19 pandemic, CDC and recipients were focused on the priority of
COVID-19 vaccination program development and vaccine distribution, some providers were
temporarily closed, and travel was restricted. In addition, we found that CDC did not have
internal written policies and procedures for CDC’s monitoring and oversight activities, including
oversight of recipients’ site visits at providers. Finally, CDC’s PEAR online system did not have
interactive reminders or alerts related to overdue site visits and followup actions. Because
recipients did not conduct site visits as required or verify that providers completed followup
actions to address identified compliance issues, CDC and recipients could not ensure that
providers were complying with VFC program requirements.
PROGRAM RECIPIENTS DID NOT CONDUCT COMPLIANCE SITE VISITS IN A TIMELY MANNER
AT SOME PROVIDERS
According to the Operations Guide, recipients must conduct compliance site visits that cover
different compliance areas at each VFC provider at least every 24 months. These areas include
provider information (e.g., the names of key staff and the number of VFC-eligible children
served by the provider), patient eligibility, documentation (e.g., screening and eligibility, billing
records, temperature logs, and vaccine-ordering records), storage and handling of vaccines, and
inventory management. The first compliance site visit for newly enrolled or reenrolled
providers must be completed within 12 months of enrollment.
Recipients did not conduct the required compliance site visits in a timely manner at 11,499 of
the 39,120 providers (29 percent) that were enrolled and active during our audit period.
Specifically, recipients did not conduct the required compliance site visits at 10,365 providers
within the 24-month timeframe and did not conduct the first compliance visit at 1,134
providers within 12 months of the provider’s enrollment. 9
9
Of the 10,365 providers, 455 should have had a compliance site visit before CDC allowed suspension of site visits
(in March 2020) in response to the COVID-19 pandemic. Of the 1,134 providers, 263 should have had their first
compliance site visit before CDC allowed suspension of site visits.
CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits
at Some Providers as Required (A-09-22-01000) 7
Figure 2 shows the number of overdue compliance site visits by the number of days the site
visits were late. 10
Figure 2: The Number of Overdue Compliance Site Visits Conducted by Program Recipients
2,500
2,213
1,960
Number of Overdue Visits
2,000
1,555 1,560
1,500
1,168 1,096
1,025
922
1,000
500
-
1-50 51-100 101-150 151-200 201-250 251-300 301-365 >365
Number of Days Late
PROGRAM RECIPIENTS DID NOT CONDUCT STORAGE AND HANDLING SITE VISITS
AT EITHER OF THE CDC-APPROVED DEPOT PROVIDERS
According to the Operations Guide, recipients are required to perform a scheduled storage and
handling site visit at each CDC-approved depot provider every 12 months to ensure compliance
with storage and handling requirements.
For each of the two CDC-approved depot providers that were enrolled and active during our
audit period, recipients did not conduct the required storage and handling site visits within the
12-month timeframe. Specifically, neither of these depot providers had any storage and
handling site visits in the 3-year period from July 1, 2018, through June 30, 2021.
MOST PROGRAM RECIPIENTS DID NOT CONDUCT STORAGE AND HANDLING SITE VISITS
AT A MINIMUM OF 5 PERCENT OF PROVIDERS
According to the Operations Guide, recipients are required to conduct unannounced storage
and handling site visits at a minimum of 5 percent of VFC providers during each cooperative
10
To determine the “due date” of a provider’s next required compliance site visit, we used: (1) the provider’s
enrollment date and added 12 months for a newly enrolled or reenrolled provider or (2) the date of the provider’s
prior compliance site visit and added 24 months. We then determined the number of days of delay for an overdue
site visit by counting the number of days that had elapsed between the due date and the actual date of the first
compliance site visit if one had been conducted or the provider’s unenrollment date if applicable or June 30, 2021
(the last date of site visits in the 3-year period), whichever was earlier.
CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits
at Some Providers as Required (A-09-22-01000) 8
agreement budget period. Because of the COVID-19 pandemic, CDC allowed recipients to
conduct scheduled storage and handling site visits in lieu of unannounced visits, effective
August 28, 2020.
Of the 61 recipients, 43 did not conduct storage and handling site visits at a minimum of
5 percent of their providers. To meet the requirement, these 43 recipients should have
conducted storage and handling site visits at 1,268 providers. However, the recipients
conducted storage and handling site visits at 277 providers. Of those 43 recipients, 23 did not
conduct any storage and handling site visits during our audit period, which was the same as the
cooperative agreement budget period. (See Figure 3.)
Figure 3: Most Program Recipients Did Not Meet the 5-Percent Requirement
PROGRAM RECIPIENTS DID NOT VERIFY THAT PROVIDERS COMPLETED FOLLOWUP ACTIONS
BY THE DEADLINE
According to the Operations Guide, recipients are required to use PEAR to document recipient
or provider followup actions for compliance issues identified during a site visit. Recipients
should also review planned and required provider followup actions in PEAR that are overdue or
have not been implemented.
Recipients did not verify that providers completed by the deadline 33,316 of the 127,594
followup actions required for issues identified during compliance and storage and handling site
visits. As shown in Figure 4 on the next page, of overdue followup actions, approximately
43 percent were completed within 1 week after the deadline. However, more than 8,000
followup actions were not completed in the first 5 weeks after the deadline, and more than
200 followup actions were not completed until 1 or 2 years after the deadline. 11
11
In Figure 4, the 1,075 followup actions that were not completed by the deadline had not been completed as of
January 28, 2022, which was the date that CDC retrieved the data.
CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits
at Some Providers as Required (A-09-22-01000) 9
Figure 4: The Number of Overdue Followup Actions Completed by Providers
16,000 14,284
14,000
12,000
10,000
8,197
8,000
6,000
3,770
4,000 2,306 1,874 1,567
2,000 1,075
227 16
0
SITE VISITS WERE NOT CONDUCTED AND FOLLOWUP ACTIONS WERE NOT COMPLETED
BECAUSE OF RECIPIENTS’ STAFFING CONSTRAINTS AND CDC’s LACK OF WRITTEN POLICIES
CDC officials stated that recipients’ staffing constraints (e.g., a hiring freeze, high rate of staff
turnover within immunization programs, and reassigning staff to work on COVID-19-related
areas) were significant reasons that recipients did not conduct compliance site visits and
storage and handling site visits, both before and during the COVID-19 pandemic. CDC officials
also stated that, during the COVID-19 pandemic, CDC and recipients were focused on the
priority of COVID-19 vaccination program development and vaccine distribution, some
providers were temporarily closed, and travel was restricted. For 3 years since the pandemic
started in March 2020, CDC has not enforced site visit requirements, even though these
requirements have been in effect and CDC authorized alternatives to conducting site visits in-
person (e.g., allowing recipients to make hybrid and virtual site visits and allowing recipients to
schedule storage and handling visits in lieu of unannounced visits). 12
In addition, CDC did not have internal written policies and procedures for CDC’s monitoring and
oversight activities related to the VFC program, including oversight of recipient site visits at
providers to ensure that requirements are met. CDC started developing these internal policies
before the COVID-19 pandemic, but as of April 2023, these internal policies had not been
issued. According to CDC officials, this work was delayed because of competing priorities of the
pandemic. Furthermore, although PEAR could generate dashboards and reports that provided
information on site visits and followup actions, there were no interactive reminders or alerts to
inform and remind CDC and recipients about: (1) overdue site visits and recipients’ progress
12
On January 11, 2023, CDC officials stated that they planned to start enforcing the site visit requirements on
July 1, 2023.
CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits
at Some Providers as Required (A-09-22-01000) 10
toward meeting the 5-percent requirement and (2) followup actions that had not been
completed by the deadlines.
CONCLUSION
Program recipients’ site visits evaluate whether providers are complying with and understand
overall VFC program requirements. Site visits are intended to ensure the quality of VFC
vaccines and the integrity of the VFC program. Proper storage and handling of vaccines is
important in preventing the loss of vaccines due to exposure to temperatures outside of
allowable limits and ensuring their effectiveness. Because recipients did not conduct
compliance and storage and handling site visits as required or verify that providers had
completed followup actions to address identified compliance issues, CDC and recipients could
not ensure that providers were complying with VFC program requirements.
RECOMMENDATIONS
We recommend that the Centers for Disease Control and Prevention:
• work with program recipients to implement a plan and timeline to: (1) conduct
the required site visits that are overdue and (2) verify the completion of followup
actions that had not been completed by the deadlines;
• develop an action plan to enforce site visit requirements by CDC’s planned date
of July 1, 2023;
• complete the development and implementation of internal written policies and
procedures for VFC program oversight activities, including oversight of program
recipients’ site visits to ensure that requirements are met; and
• update its Provider Education, Assessment, and Reporting online system to
include interactive reminders or alerts related to overdue site visits and followup
actions.
CDC COMMENTS AND OFFICE OF INSPECTOR GENERAL RESPONSE
In written comments on our draft report, CDC concurred with our recommendations and
described actions that it had taken or planned to take to address our recommendations. CDC
stated that it will: (1) work with recipients that have overdue site visits to develop an
implementation plan and timeline for conducting those site visits; (2) develop an action plan to
provide guidance to recipients for site visits and followup actions; (3) complete and implement
internal written policies and procedures for VFC program oversight activities; and (4) make
enhancements to its PEAR online system, including sending automatic email alerts to recipients
and CDC staff regarding site visits and followup actions. In addition, CDC provided detailed
information to emphasize the impact of the COVID-19 pandemic on the VFC program.
CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits
at Some Providers as Required (A-09-22-01000) 11
After reviewing the information provided by CDC, we updated our description of the impact of
the COVID-19 pandemic on the VFC program on page 5 of the report.
CDC also provided technical comments on our draft report, which we addressed as appropriate.
CDC’s comments, excluding the technical comments, are included in their entirety as
Appendix B.
CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits
at Some Providers as Required (A-09-22-01000) 12
APPENDIX A: AUDIT SCOPE AND METHODOLOGY
SCOPE
We reviewed CDC’s operations manuals and guidance related to VFC program requirements for
site visits at providers. We identified 39,122 providers, consisting of 39,120 providers that
administered VFC vaccines and 2 CDC-approved depot providers, that were enrolled and active
at any point from July 1, 2020, through June 30, 2021. To determine whether the 61 program
recipients conducted the required site visits at providers, we reviewed 3 years’ worth of data
(July 1, 2018, through June 30, 2021) for all enrollment, compliance, and storage and handling
site visits conducted at the identified providers. We determined the “due date” of a provider’s
next required site visit and calculated the number of days of delay for an overdue site visit. To
determine whether providers completed followup actions by the deadlines, we also reviewed
the data for 127,594 followup actions associated with these site visits. We analyzed the status
of these followup actions and identified the number of days between the assigned deadlines
and the actual completion dates.
We did not assess the overall internal control structure of CDC. Rather, we limited our review
to CDC’s internal controls related to its oversight activities for ensuring that recipients
conducted required site visits. To determine the effectiveness of the design and
implementation of these internal controls, we interviewed CDC officials, reviewed CDC’s
operating manuals related to program requirements and the PEAR online system, and reviewed
provider and site visit data from PEAR. Our review of PEAR data allowed us to evaluate the
operating effectiveness of internal controls.
We conducted our audit from January 2022 to April 2023.
METHODOLOGY
To accomplish our objective, we:
• reviewed applicable Federal regulations and guidance;
• reviewed CDC’s operations manuals to identify VFC program requirements;
• reviewed CDC guidance issued in response to the COVID-19 pandemic;
• interviewed CDC officials to identify CDC’s oversight activities related to recipients’
conducting of provider site visits;
• obtained data from CDC’s PEAR online system for: (1) VFC providers who were enrolled
and active during our audit period, (2) site visits conducted at these providers, and
(3) providers’ followup actions related to these site visits;
CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits
at Some Providers as Required (A-09-22-01000) 13
• identified 39,122 providers, consisting of 39,120 providers that administered VFC
vaccines and 2 CDC-approved depot providers, that were enrolled and active at any
point during our audit period;
• reviewed 3 years’ worth of data for all enrollment, compliance, and storage and
handling site visits conducted at these identified providers;
• reviewed data for 127,594 followup actions associated with the site visits and providers
being reviewed; and
• discussed our findings with CDC officials.
We conducted this performance audit in accordance with generally accepted government
auditing standards. Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions
based on our audit objectives. We believe that the evidence obtained provides a reasonable
basis for our findings and conclusions based on our audit objectives.
CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits
at Some Providers as Required (A-09-22-01000) 14
APPENDIX B: CDC COMMENTS
CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits
at Some Providers as Required (A-09-22-01000) 15
CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits
at Some Providers as Required (A-09-22-01000) 16
CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits
at Some Providers as Required (A-09-22-01000) 17
CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits
at Some Providers as Required (A-09-22-01000) 18
File and source
- File
- A-09-22-01000-cdc-s-vaccines-for-children-program-recipients-did-not-conduct-site-visits-at-so.pdf
- Size
- 3,545,709 bytes
- SHA-256
- f1bcdf9a63f70350f8b2a05ea07984fb52725cb6779834574cc651a63f27754a
- Our copy
- A-09-22-01000-cdc-s-vaccines-for-children-program-recipients-did-not-conduct-site-visits-at-so.pdf
- Original
- oig.hhs.gov