Department of Health and Human Services (GAO-21-527PR)

Summary

A letter from the Comptroller General, GAO-21-527PR, dated May 19, 2021, to Secretary Xavier Becerra on priority open recommendations for the Department of Health and Human Services (HHS). It reports that government-wide 77 percent of GAO recommendations made 4 years earlier were implemented, and that as of May 2021 HHS had 458 open recommendations with an implementation rate of 64 percent. In its April 2020 letter GAO designated 55 recommendations as priorities for HHS, and HHS has since implemented eight of them. The letter identifies the remaining priority recommendations.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

441 G St. N.W. Comptroller General
Washington, DC 20548 of the United States

May 19, 2021

The Honorable Xavier Becerra
Secretary
U.S. Department of Health and Human Services
200 Independence Ave., SW
Washington, D.C. 20201

Priority Open Recommendations: Department of Health and Human Services

Dear Mr. Secretary:

The purpose of this letter is to provide an update on the overall status of the U.S. Department of
Health and Human Services’ (HHS) implementation of GAO’s recommendations and call your
personal attention to areas where recommendations should be given high priority. 1 In November
2020, we reported that on a government-wide basis, 77 percent of our recommendations made
4 years ago were implemented. 2 As of May 2021, HHS had 458 open recommendations with an
implementation rate of 64 percent. Implementing all open recommendations could significantly
improve HHS’s operations.

In our April 2020 letter to the Department, we designated 55 recommendations as priorities for
HHS, and HHS has since implemented eight of them. In doing so, HHS has taken steps to
improve the quality of care in the Indian Health Service’s federally operated facilities,
implemented initiatives to improve the accuracy and completeness of Medicaid data to expedite
their use for program oversight, strengthened controls over the determination of eligibility for the
premium tax credit used to help individuals purchase health insurance coverage through health
insurance marketplaces, and developed guidance, policies, and procedures to improve
implementation of information security controls among qualified entities and researchers. In
addition to the eight priority recommendations HHS implemented, four are no longer included in
this letter, for example, because they became a lower priority as a result of statutory or
programmatic changes, as discussed below in the relevant sections.

We ask your attention to the 43 priority recommendations remaining from those we identified in
the 2020 letter. We also are adding 18 new priority recommendations related to the response to,
and recovery from, the Coronavirus Disease 2019 (COVID-19) pandemic and other public
health emergency preparedness issues, public health and human services program oversight,
Food and Drug Administration (FDA) oversight, and the Medicaid program, bringing the total

1Priority recommendations are those that GAO believes warrant priority attention from heads of key departments or

agencies. They are highlighted because, upon implementation, they may significantly improve government operation;
for example, by realizing large dollar savings; eliminating mismanagement, fraud, and abuse; or making progress
toward addressing a high-risk or duplication issue.
2GAO, Performance and Accountability Report: Fiscal Year 2020, GAO-21-4SP (Washington, D.C.: Nov. 16, 2020).
number of priority recommendations to 61. (See enclosure for a more comprehensive
description of all 61 recommendations).

The 61 priority recommendations fall into the following 9 areas.

COVID-19 response and other public health emergency preparedness. The COVID-19
pandemic highlights the critical need for an effective national response to public health
emergencies. We have identified 17 priority recommendations that will help improve HHS’s
preparedness to address the ongoing and evolving challenges of the COVID-19 pandemic—as
well as any future public health emergencies. For example:

• In January 2021, we recommended that HHS develop and make publically available a
comprehensive national COVID-19 testing strategy that incorporates all six
characteristics of an effective national strategy. This includes, for example, clear
designation of organizational roles, responsibilities, and coordination as well as resource
needs and benchmarks to measure progress. In making this recommendation, we noted
that the national strategy could build upon existing strategy documents that HHS has
previously produced. HHS partially concurred with our recommendation. In particular,
while HHS agreed that the department should take steps to directly incorporate some of
the elements of an effective national strategy, officials expressed concerns that
producing the strategy at this time would be overly burdensome on federal, state, and
local entities responding to the COVID-19 pandemic, and may be outdated by the time it
was finalized or potentially obsolete given the rate of technological advancement. We
maintain that a comprehensive and public national strategy is an important and
worthwhile investment in resources so that all participants have the necessary
information to support an informed and coordinated testing response to accomplish
shared goals. We also maintain this can be done efficiently and flexibly, without
imposing unnecessary burden.

• In September 2020, we recommended that HHS, with support from the Department of
Defense, establish a time frame for documenting and sharing a national plan for
distributing and administering COVID-19 vaccines. We noted in our report that HHS, in
developing such a plan, should ensure that it is consistent with best practices for project
planning and scheduling and that this plan should specify an approach for coordinating
efforts across federal agencies and nonfederal entities. HHS neither agreed nor
disagreed with our recommendation. In September and October 2020, HHS’ Centers for
Disease Control and Prevention (CDC) released initial planning documents, and in
January 2021, the White House issued a national COVID-19 response strategy that
broadly outlined various channels for vaccine distribution. In addition, CDC provided a
high-level description of its activities in a March 2021 COVID-19 vaccine distribution
strategy and noted that more details would be included in future reports to Congress.
CDC indicated that it expects to release its next report to Congress in May 2021, and we
will evaluate this report once it is issued to determine whether it fully implements our
recommendation.

• In September 2020, we recommended that HHS, in consultation with the Centers for
Medicare & Medicaid Services (CMS) and CDC, develop a strategy to capture more
complete data on confirmed COVID-19 cases and deaths in nursing homes retroactively
back to January 1, 2020, and to clarify the extent to which nursing homes have reported
data before May 8, 2020. HHS partially agreed with our recommendation. Specifically,

Page 2 GAO-21-527PR HHS Priority Recommendations
HHS agreed that collecting more complete data would be useful for determining the total
number of nursing homes affected, the extent of morbidity and mortality, and changes in
incidence over time. Further, HHS noted that having complete data would be useful in
the review of policies and practices put in place during the pandemic. However, HHS
said that, because retroactively collecting the data may be overly burdensome on health
care providers, it does not believe devoting substantial agency or health care provider
resources during the pandemic would be prudent. We maintain the importance of
developing a strategy to collect data from this critical time period of early COVID-19
spread in nursing homes and that HHS could begin by incorporating data previously
reported to CDC or to state or local public health offices, which would ease the burden
on nursing homes.

Public health and human services program oversight. We have identified 11 priority
recommendations that would strengthen oversight of public health and human services
programs, such as the HHS program that provides care to noncitizen children without lawful
immigration status or parents or guardians in the United States, known as unaccompanied
children. For example:

• In February 2020, we recommended that HHS and the Department of Homeland
Security (DHS) collaborate to address information sharing gaps to ensure that HHS
receives information needed to make decisions for unaccompanied children, including
those apprehended with an adult. HHS and DHS concurred with our recommendation
and, as of May 2021, DHS officials said they plan to meet regularly with HHS to
coordinate their efforts, which includes development of an interagency portal for
information sharing. Further, in March 2021, DHS components and HHS signed a
memorandum of agreement on unaccompanied children information sharing. HHS
officials also told us that HHS is developing a new data system, which would be
integrated with the portal and allow HHS to retrieve data on a child's status in a more
automated manner. DHS and HHS reported that they would provide an update on the
status of their efforts by September 2021. Until DHS and HHS implement procedures
aimed at improving the efficiency and accuracy of the interagency unaccompanied
children referral and placement process, information-sharing gaps will remain. We will
continue to monitor and evaluate HHS’s actions to determine the extent to which they
fully address our recommendation.

FDA oversight. We have identified five priority recommendations that would help FDA ensure
the safety of medical products and food imported into the United States, including addressing
any backlog of inspections caused by the COVID-19 pandemic. For example:

• In January 2021, we recommended that the Commissioner of FDA should, as inspection
plans for future fiscal years are developed, ensure that such plans identify, analyze, and
respond to the issues presented by the backlog of inspections that could jeopardize the
goal of risk-driven inspections. FDA concurred with our recommendation and as of
January 2021, stated that the agency is actively tracking the list of sites that need to be
inspected. To fully implement our recommendation, FDA should provide documentation
that its inspection plans identify, analyze, and respond to the issues presented by the
backlog of inspections.

• In September 2017, we recommended that the Commissioner of FDA coordinate and
communicate with the U.S. Department of Agriculture Food Safety and Inspection
Service (FSIS) in developing methods to test for drug residue in imported seafood,

Page 3 GAO-21-527PR HHS Priority Recommendations
including catfish, and in establishing corresponding maximum residue levels—the
highest level of drug residue allowed in imported seafood before it is considered
potentially harmful to human health. FDA concurred with our recommendation and has
taken some steps to implement it, including convening quarterly meetings to discuss the
establishment of drug residue limits in seafood. However, we found that agencies
continue to use different testing methods, which results in the agencies using different
maximum residue levels for some drugs. Without the coordination we recommended, the
agencies do not have reasonable assurance that they are consistently protecting
consumers from unsafe drug residues. To fully implement our recommendation, FDA
should coordinate with FSIS on (1) the development of testing methods that both
agencies can use on imported seafood, including catfish, and (2) establishing maximum
residue levels that would allow the agencies to consistently apply similar standards.

• In December 2016, we recommended that the Commissioner of FDA assess the
effectiveness of its foreign offices’ contributions to ensuring the safety of imported
products. FDA concurred with our recommendation. FDA reported developing new
performance measures for these offices as well as a monitoring and evaluation plan in
2018, but as of March 2021 has not reported additional progress. To fully implement our
recommendation, FDA should systematically track information to measure whether the
offices’ activities—such as inspections, import alerts, and warning letters—specifically
contribute to drug safety-related outcomes. In addition, as part of our ongoing work in
this area, we will continue to obtain updated information on the role of FDA’s foreign
offices in ensuring the safety of drugs entering the United States.

National efforts to prevent, respond to, and recover from drug misuse. Drug misuse—the
use of illicit drugs and the misuse of prescription drugs—has been a longstanding and persistent
problem in the United States and is on GAO’s High-Risk List. We have identified one priority
recommendation that would address some of the challenges related to treating neonatal
abstinence syndrome (NAS)—a withdrawal condition with symptoms including excessive crying
and difficulty breathing. Specifically:

• In October 2017, we recommended that the Secretary of HHS expeditiously develop a
plan—one that includes priorities, time frames, clear roles and responsibilities, and
methods for assessing progress—to effectively implement the NAS-related
recommendations that HHS identified in its Protecting Our Infants Act: Final Strategy. 3
HHS concurred with our recommendation and finalized a plan in 2019 for implementing
the Strategy. The plan includes priorities, time frames, and clear roles and
responsibilities for implementing NAS-related recommendations in the Strategy.
However, the plan does not specifically identify methods for assessing HHS’s progress
toward implementing the Strategy’s recommendations. In November 2019, HHS stated
that the department holds quarterly conference calls to share updates on progress
toward implementing the Strategy and that formal written updates will be collected at the
end of each year. To fully implement our recommendation, HHS needs to provide

3In May 2017, HHS published the Protecting Our Infants Act: Report to Congress, which—among other things—

presents a strategy that identifies key recommendations related to addressing NAS. Specifically, HHS’s strategy—
known as the Protecting Our Infants Act: Final Strategy—made 39 recommendations related to the prevention,
treatment, and related services for NAS and prenatal opioid use. See Substance Abuse and Mental Health Services
Administration, “Protecting Our Infants Act: Report to Congress,” May 2017.

Page 4 GAO-21-527PR HHS Priority Recommendations
documentation—such as the formal written updates—showing how the department
assesses its progress in implementing the Strategy’s recommendations.

Improper payments in Medicaid and Medicare. Estimates of improper payments in the
Medicaid and Medicare programs continue to be unacceptably high and totaled about $130
billion in fiscal year 2020. We have identified seven priority recommendations that could reduce
improper payments by minimizing program risks, expanding the use of prior authorization, and
conducting prepayment claim reviews, among other things. For example:

• In May 2018, we recommended that the Administrator of CMS take steps to mitigate the
program risks not accounted for in the Medicaid managed care Payment Error Rate
Measurement, such as overpayments and unallowable costs. To the extent that
overpayments and unallowable costs are unidentified and not removed from the cost
data used to set capitation rates, they may lead to inflated Medicaid managed care
payments and minimize the appearance of program risks in Medicaid managed care.
HHS concurred with our recommendation and stated that it was in the process of
developing a strategy to reduce risk in Medicaid managed care. To implement our
recommendation, CMS needs to implement its strategy.

• In April 2018, we recommended that the Administrator of CMS take steps, based on the
results of evaluations, to continue using prior authorization in Medicare. HHS concurred
with our recommendation. Between 2019 and 2020, CMS made some progress toward
implementing our recommendation by, for example, adding 18 items to its prior
authorization list and resuming or starting five demonstrations. As of March 2021, HHS
stated that it will continue evaluating the prior authorization programs. To fully implement
our recommendation, CMS needs to take additional steps to evaluate the use of prior
authorization by, for example, determining cost savings from its actions. CMS also
needs to take additional steps to expand the use of prior authorization, which could
include identifying new opportunities for prior authorization for items and services with
high unnecessary utilization and high improper payment rates.

• In April 2016, we recommended that CMS seek legislative authority to allow Recovery
Auditors to conduct prepayment claim reviews, a step that could better ensure proper
Medicare payments and protect Medicare funds. HHS disagreed with our
recommendation. HHS noted that other claim review contractors conduct prepayment
reviews and that CMS has implemented other programs as part of its strategy to move
away from the “pay and chase” process of recovering overpayments, such as enhanced
provider enrollment screening. However, we maintain that fully implementing our
recommendation is warranted. We found that prepayment reviews better protect agency
funds compared with post-payment reviews. Moreover, CMS conducted a demonstration
in which the Recovery Auditors conducted prepayment reviews and concluded that the
demonstration was a success.

Medicaid program. We have identified eight priority recommendations in this area that would,
among other things, improve oversight of the funding sources for the nonfederal share of
payments to providers and improve transparency of Medicaid demonstrations. For example:

• In December 2020, we recommended that the Administrator of CMS collect and
document complete and consistent provider-specific information about Medicaid
payments to providers and states' sources of funding for the nonfederal share of these
payments. HHS neither agreed nor disagreed with our recommendation but

Page 5 GAO-21-527PR HHS Priority Recommendations
acknowledged the need for additional state Medicaid financing and payment data to
oversee the Medicaid program. HHS also noted that CMS has taken initial steps to
improve the collection of financing and payment information through a revised data
collection form and will explore additional actions to do so. In addition, Congress passed
and the President signed into law requirements in December 2020 for additional state
reporting on Medicaid supplemental payments. To fully implement our recommendation,
HHS needs to demonstrate how its ongoing and planned actions in this area, which
could include actions in response to the December 2020 law described above, will
ensure complete, consistent, and sufficiently documented information about sources of
funding for the nonfederal share and payments to providers.

• In April 2019, we recommended that the Administrator of CMS develop a policy for
ensuring transparency when states propose significant amendments to section 1115
demonstrations, which allow states to test and evaluate new approaches for delivering
Medicaid services. CMS concurred with our recommendation. In December 2020, CMS
officials said the agency plans to develop criteria for determining whether an amendment
application proposes a substantial change to an existing demonstration and to include
this in guidance in 2021. We will evaluate this guidance when it is issued to determine
whether it fully addresses our recommendation.

We removed the priority designation from one open recommendation related to CMS oversight
of Medicaid supplemental payments that became a lower priority as a result of a statutory
change and because the agency could address our primary concern by implementing another
related priority recommendation. 4

Medicare program. We have identified eight priority recommendations that would help CMS
improve the Medicare program’s payment policy and design. For example:

• In June 2016, we recommended that the Administrator of CMS account for any Medicaid
payments that offset uncompensated care (UC) costs when determining the amount of
Medicare UC payments an individual hospital should receive. HHS initially concurred
with our recommendation. However, in 2018 and again in March 2021, HHS indicated it
was reconsidering whether to implement our recommendation because officials stated
that it may not be appropriate to offset Medicare UC payments by Medicaid payments
that help offset UC costs. We maintain that CMS should implement our recommendation
because it would (1) ensure that Medicare UC payments are based on accurate levels of
UC costs, (2) result in CMS better targeting billions of dollars in Medicare UC payments
to hospitals with the most UC costs, and (3) avoid Medicare UC payments to hospitals
with little or no UC costs.

• In January 2012, we recommended that CMS take steps to improve the accuracy of the
adjustment made to Medicare Advantage (MA) payments to account for differences in
diagnostic coding practices between MA and Medicare fee-for-service. These
differences in diagnostic coding could lead to beneficiaries in MA plans being assigned
inappropriately high risk scores by CMS, which would result in higher than necessary
payments. For instance, we found that shortcomings in CMS’s adjustment resulted in

4Specifically, we removed the priority designation from one recommendation related to CMS guidance regarding state

reporting of supplemental payments due to a statutory change requiring states to report information about
supplemental payments to the Secretary of HHS. We will monitor CMS’s implementation of the new reporting
requirement through another priority recommendation related to supplemental payments.

Page 6 GAO-21-527PR HHS Priority Recommendations
excess payments to MA plans totaling an estimated $3.2 billion to $5.1 billion over a 3-
year period, from 2010 through 2012. HHS concurred with our recommendation and
applied the statutory minimum adjustment to MA payments for calendar year 2021. CMS
made other changes to its methodology for calculating the diagnostic coding adjustment,
which likely have improved accuracy of the adjustment. However, a modified
methodology that, for example, incorporates more recent data and accounts for all
relevant years of coding differences would better ensure an accurate adjustment in
future years. To fully implement our recommendation, CMS needs to provide evidence of
the sufficiency of its coding adjustment or re-calculate its adjustment using an updated
methodology. Until CMS takes these steps, the agency is at continued risk of making
excess payments to MA plans.

Health information technology and cybersecurity. We identified three priority
recommendations that would improve HHS’s ability to address cyber-related risks. For example:

• In July 2019, we recommended that the Secretary of HHS (1) develop a cybersecurity
risk management strategy and (2) establish a process for conducting an organization-
wide cybersecurity risk assessment. HHS concurred with both recommendations. In
March 2021, HHS stated that its cybersecurity risk management strategy was
undergoing internal review and that the department was developing a process for an
organization-wide cybersecurity risk assessment. However, HHS did not provide an
estimated date of completion for either the internal review of the risk management
strategy or the development of the risk assessment process. To implement our
recommendations, HHS needs to ensure that its strategy includes key elements,
including a statement of risk tolerance and information on how the department intends to
assess, respond to, and monitor cybersecurity risks. In addition, HHS needs to establish
a risk assessment process to allow the agency to consider the totality of risk derived
from the operation and use of its information systems.

We removed the priority designation from two open recommendations in this area in light of our
ongoing work or because additional guidance that HHS needs to implement our
recommendation has not been issued. 5 HHS could address our primary concerns by
implementing other priority recommendations in this area.

Health insurance premium tax credit payment integrity. The Patient Protection and
Affordable Care Act (PPACA) established health insurance marketplaces where consumers can
select private health insurance plans. For individuals who meet certain requirements, PPACA
provides subsidies, including a premium tax credit (PTC), to help cover costs. With those
subsidies and other costs, PPACA represents a significant, long-term fiscal commitment for the

5Specifically, we removed the priority designation from one recommendation related to HHS’s establishment of

electronic public health situational awareness network capabilities that were mandated by the Pandemic and All-
Hazards Preparedness Reauthorization Act of 2013, as our current work in this area may result in recommendations
with higher priority.

In addition, we removed the priority designation from another recommendation related to CMS’s plan to discontinue
its use of knowledge-based online identity verification approaches. The National Institute of Standards and
Technology (NIST) has implemented our priority recommendation to develop additional guidance for agencies and
plans to revise this guidance by 2022. The absence of additional guidance from NIST impedes HHS’s ability to
implement our recommendation in the near future. These two recommendations will remain open until HHS takes
appropriate action; however, on their own, these recommendations are not our highest priority.

Page 7 GAO-21-527PR HHS Priority Recommendations
federal government. We identified one priority recommendation that would ensure the integrity
of PTC payments. Specifically:

• In July 2017, we recommended that HHS should annually report improper payment
estimates and error rates for the advance PTC program. HHS concurred with our
recommendation. In March 2021, CMS reported that it intends to publish an advance
PTC improper payment rate in the agency’s fiscal year 2022 agency financial report for
payments made by the federally-facilitated exchange during benefit year 2020. However,
CMS said that developing an advance PTC improper payment rate for payments made
by state-based exchanges will be a multi-year process. To fully implement our
recommendation, HHS needs to finalize and implement its methodology for producing
advance PTC improper payment estimates and publicly report these estimates in its
annual financial report.

We closed one recommendation related to tracking cost-sharing reduction subsidies for health
plans sold through health insurance marketplaces created by the Patient Protection and
Affordable Care Act, even though HHS had not implemented it, because cost-sharing reduction
subsidies are no longer paid.

------

Implementing our priority recommendations could help improve the efficiency and effectiveness
of key federal health care programs and funding, including those relevant to the nation’s
ongoing response to COVID-19. Further, implementing our priority recommendations could be
done in conjunction with efforts to address high-risk areas related to HHS. In March 2021, we
issued our biennial update to our High-Risk List, which identifies government operations with
greater vulnerabilities to fraud, waste, abuse, and mismanagement or the need for
transformation to address economy, efficiency, or effectiveness challenges. 6

The following three high-risk areas center directly on HHS: (1) protecting public health through
enhanced oversight of medical products, (2) strengthening Medicaid program integrity, and (3)
Medicare program and improper payments. Three additional high-risk areas are shared among
multiple agencies, including HHS: (1) improving federal oversight of food safety; (2) national
efforts to prevent, respond to, and recover from drug misuse; and (3) enforcement of tax laws.
In addition, we identified HHS’s leadership and coordination of public health emergencies as an
emerging issue in our High-Risk List. 7

Several other government-wide high-risk areas also have direct implications for HHS and its
operations. These include (1) improving the management of IT acquisitions and operations, (2)
improving strategic human capital management, (3) managing federal real property, (4)
ensuring the cybersecurity of the nation, and (5) government-wide personnel security clearance
process. We urge your attention to the HHS, shared, and government-wide high-risk issues as
they relate to HHS. Progress on high-risk issues has been possible through the concerted
actions and efforts of Congress, the Office of Management and Budget, and the leadership and
staff in agencies, including within HHS.

6GAO, High-Risk Series: Dedicated Leadership Needed to Address Limited Progress in Most High-Risk Areas, GAO-

21-119SP (Washington, D.C.: Mar. 2, 2021).
7GAO-21-119SP. See pages 14-17 for more information on the emerging issue related to HHS’s Leadership and

Coordination of Public Health Emergencies.

Page 8 GAO-21-527PR HHS Priority Recommendations
Copies of this report are being sent to the Director of the Office of Management and Budget and
appropriate congressional committees including the Committees on Appropriations; Budget;
Finance; Health, Education, Labor, and Pensions; and Homeland Security and Governmental
Affairs, United States Senate; and the Committees on Appropriations; Budget; Energy and
Commerce; Oversight and Reform; and Ways and Means, House of Representatives. In
addition, the report will be available on the GAO website at http://www.gao.gov.

I appreciate HHS’s commitment to these important issues. If you have any questions or would
like to discuss any of the issues outlined in this letter, please do not hesitate to contact me or A.
Nicole Clowers, Managing Director, Health Care at ClowersA@gao.gov or 202-512- 7114.
Contact points for our Offices of Congressional Relations and Public Affairs may be found on
the last page of this report. Our teams will continue to coordinate with your staff on all 458 open
recommendations. Thank you for your attention to these matters.

Sincerely yours,

Gene L. Dodaro
Comptroller General
of the United States

Enclosure – 1

cc: Sean McCluskie, Chief of Staff, Department of Health and Human Services
JooYeun Chang, Acting Assistant Secretary, Administration for Children and Families
Norris Cochran, Acting Assistant Secretary for Financial Resources
Rebecca Haffajee, Acting Assistant Secretary for Planning and Evaluation
Nikki Bratcher-Bowman, Acting Assistant Secretary for Preparedness and Response
Rochelle Walensky, Director, Centers for Disease Control and Prevention
Liz Richter, Acting Administrator, Centers for Medicare and Medicaid Services
Janet Woodcock, Acting Commissioner, Food and Drug Administration
Diana Espinosa, Acting Administrator, Health Resources and Services Administration
Elizabeth Fowler, Acting Director, Indian Health Service
The Honorable Shalanda Young, Acting Director, Office of Management and Budget

Page 9 GAO-21-527PR HHS Priority Recommendations
Enclosure

Priority Open Recommendations to the Department of Health and Human Services (HHS)

Coronavirus Disease 2019 (COVID-19) Response and Other Public Health Emergency
Preparedness

COVID-19: Critical Vaccine Distribution, Supply Chain, Program Integrity, and Other Challenges
Require Focused Federal Attention. GAO-21-265. Washington, D.C. January 28, 2021.

Recommendation: The Secretary of HHS should develop and make publicly available a
comprehensive national COVID-19 testing strategy that incorporates all six
characteristics of an effective national strategy. Such a strategy could build upon existing
strategy documents that HHS has produced for the public and Congress to allow for a
more coordinated pandemic testing approach.

Actions Needed: HHS partially concurred with our recommendation. In January 2021,
HHS agreed that the department should take steps to more directly incorporate some
elements of an effective national strategy, but expressed concern that producing such a
strategy at this time could be overly burdensome on the federal, state, and local entities
that are responding to the pandemic, and that a plan would be outdated by the time it
was finalized or potentially rendered obsolete by the rate of technological advancement. 8
Additionally, HHS stated that, to be of value to the whole of nation response to COVID-
19, testing plans need to establish guidelines and use metrics that are operationally
relevant, which necessitates strategic flexibility in testing plans to guide those managing
the response in the use of available resources to address local and state conditions
rather than a single static nationwide plan.

As of March 2021, HHS had not implemented our recommendation. While the White
House issued a broader COVID-19 National Strategy on January 21, 2021 that includes
increasing testing capacity among its seven goals, it does not include all the
characteristics of an effective strategy for testing. 9 For example, it does not contain
specific performance metrics to be used to measure progress. We maintain that a
comprehensive and public national strategy is an important and worthwhile investment in
resources so that all participants have the necessary information to support an informed
and coordinated testing response to accomplish shared goals. We also maintain this can
be done efficiently and flexibly, without imposing unnecessary burden.

Recommendation: To improve the federal government's response to COVID-19 and
preparedness for future pandemics, the Secretary of HHS should immediately establish
an expert committee or use an existing one to systematically review and inform the
alignment of ongoing data collection and reporting standards for key health indicators.

8The six characteristics of an effective national strategy are: (1) clear purpose, scope, and methodology; (2) problem

definition and risk assessment; (3) goals, subordinate objectives, activities, and performance measures; (4)
resources, investments, and risk management; (5) organizational roles, responsibilities, and coordination; and (6)
integration and implementation. Each characteristic has several sub-elements. See GAO, Combating Terrorism:
Evaluation of Selected Characteristics in National Strategies Related to Terrorism, GAO-04-408T (Washington, D.C.:
Feb. 3, 2004).
9See White House, National Strategy for the COVID-19 Response and Pandemic Preparedness, January 21, 2021.

Page 10 GAO-21-527PR HHS Priority Recommendations
This committee should include a broad representation of knowledgeable health care
professionals from the public and private sectors, academia, and nonprofits.

Actions Needed: HHS partially agreed with our recommendation. HHS agreed that it
should establish a dedicated working group or other mechanism with a focus on
addressing COVID-19 data collection shortcomings. However, HHS said because of
resource constraints and the ongoing response to the pandemic, it could not commit to
immediately doing so. As of March 2021, HHS had not implemented our
recommendation. Given the current state of the COVID-19 pandemic and the expanded
need for complete and consistent data to assist the federal response and inform the
general public (including data on vaccines), we reiterate the importance of immediately
establishing an expert committee. Further, we maintain that HHS could use an existing
committee, which would help streamline the process and leverage existing resources, to
help inform the federal government’s response to the pandemic with more complete and
consistent COVID-19 data.

Directors: Jessica Farb and Mary Denigan-Macauley, Health Care

Contact information: FarbJ@gao.gov, DeniganMacauleyM@gao.gov, 202-512-7114

COVID-19: Federal Efforts Could Be Strengthened by Timely and Concerted Actions. GAO-20-
701. Washington, D.C.: September 21, 2020.

Recommendation: The Secretary of HHS in coordination with the Administrator of the
Federal Emergency Management Agency (FEMA)—who head agencies leading the
COVID-19 response through the Unified Coordination Group—should immediately
document roles and responsibilities for supply chain management functions transitioning
to HHS, including continued support from other federal partners, to ensure sufficient
resources exist to sustain and make the necessary progress in stabilizing the supply
chain, and address emergent supply issues for the duration of the COVID-19 pandemic.

Actions Needed: HHS disagreed with our recommendation and, as of March 2021,
noted, among other things, the work that the department had done to manage the
medical supply chain and increase supply availability. We acknowledge those efforts, but
maintain that our recommendation is warranted.

Recommendation: The Secretary of HHS in coordination with the Administrator of
FEMA—who head agencies leading the COVID-19 response through the Unified
Coordination Group—should further develop and communicate to stakeholders plans
outlining specific actions the federal government will take to help mitigate remaining
medical supply gaps necessary to respond to the remainder of the pandemic, including
through the use of Defense Production Act authorities.

Recommendation: The Secretary of HHS—who heads one of the agencies leading the
COVID-19 response through the Unified Coordination Group—consistent with their roles
and responsibilities, should work with relevant federal, state, territorial, and tribal

Page 11 GAO-21-527PR HHS Priority Recommendations
stakeholders to devise interim solutions, such as systems and guidance and
dissemination of best practices, to help states enhance their ability to track the status of
supply requests and plan for supply needs for the remainder of the COVID-19 pandemic
response.

Recommendation: The Secretary of HHS, with support from the Secretary of Defense,
should establish a time frame for documenting and sharing a national plan for
distributing and administering COVID-19 vaccine, and in developing such a plan ensure
that it is consistent with best practices for project planning and scheduling and outlines
an approach for how efforts will be coordinated across federal agencies and nonfederal
entities.

Actions Needed: HHS neither agreed nor disagreed with our recommendation. In a
March 2021 COVID-19 vaccine distribution strategy, HHS’ Centers for Disease Control
and Prevention (CDC) provided a high-level description of its activities and noted that
more details would be included in future reports to Congress. CDC indicated that it
expects to release its next report to Congress in late May 2021, and we will evaluate this
report once it is issued to determine whether it fully implements our recommendation.

Recommendation: The Secretary of HHS, in consultation with the Centers for Medicare
& Medicaid Services (CMS) and CDC, should develop a strategy to capture more
complete data on confirmed COVID-19 cases and deaths in nursing homes retroactively
back to January 1, 2020, and to clarify the extent to which nursing homes have reported
data before May 8, 2020. To the extent feasible, this strategy to capture more complete
data should incorporate information nursing homes previously reported to CDC or to
state or local public health offices.

Actions Needed: HHS partially concurred with our recommendation. As of March 2021,
no specific action had been taken by HHS, although agency officials stated that they
continue to consider how to implement our recommendation. We maintain that collecting
data on COVID-19 cases and deaths from nursing homes retroactively would better
inform the government’s continued response and recovery, and we maintain that HHS
could ease the burden by incorporating data previously reported to CDC or to state or
local public health offices.

Recommendation: As CDC implements its COVID-19 Response Health Equity
Strategy, the Director of CDC should take steps to help ensure CDC's ability to
comprehensively assess the long-term health outcomes of persons with COVID-19,
including by race and ethnicity.

Actions Needed: CDC concurred with our recommendation. In response to our
recommendation, CDC noted in October 2020 that the agency was convening a team to
develop a plan to monitor the long-term health outcomes of persons with COVID-19 by
identifying health care surveillance systems that can electronically report health
conditions to state and local health departments. As of May 2021, the agency had
various efforts underway with external partners to assess long-term health outcomes. To

Page 12 GAO-21-527PR HHS Priority Recommendations
fully implement our recommendation, CDC needs to provide public documentation of its
efforts to understand the long-term effects of COVID-19 illness, including documentation
of funded studies and analyses of electronic health record data.

Directors: John E. Dicken, Alyssa Hundrup, and Mary Denigan-Macauley, Health Care

Contact information: DickenJ@gao.gov, HundrupA@gao.gov,
DeniganMacauleyM@gao.gov, 202-512-7114

Public Health Preparedness: HHS Should Take Actions to Ensure It Has an Adequate Number
of Effectively Trained Emergency Responders. GAO-20-525. Washington, D.C.: June 18, 2020

Recommendation: The Assistant Secretary for Preparedness and Response (ASPR)
should develop a National Disaster Medical System (NDMS) responder workforce target
that accounts for the critical skills and competencies that are needed to meet current and
future programmatic results, such as a workforce target that considers (1) a nationwide
event or multiple concurrent events, (2) the needs of at-risk individuals, and (3) the
availability of other medical responders.

Actions Needed: HHS concurred with this recommendation. ASPR officials stated that
they will work to develop a strategic documented workforce target that considers (1) a
nationwide event or multiple concurrent events, (2) the needs of at-risk individuals, and
(3) the availability of other medical responders. They also stated that ASPR's ability to
realize this workforce target will be subject to the availability of funding. As of March
2021, ASPR officials said they continue to work on implementing this recommendation.
To implement our recommendation, ASPR needs to develop an NDMS responder
workforce target that accounts for the critical skills and competencies needed to meet
current and future programmatic events.

Director: Mary Denigan-Macauley, Health Care

Contact information: DeniganMacauleyM@gao.gov, 202-512-7114

Infectious Disease Modeling: Opportunities to Improve Coordination and Ensure Reproducibility.
GAO-20-372. Washington, D.C.: May 13, 2020

Recommendation: The Secretary of HHS should develop a mechanism to routinely
monitor, evaluate, and report on coordination efforts for infectious disease modeling
across multiple agencies.

Actions Needed: HHS concurred with this recommendation. As of February 2021, HHS
stated that it is developing a process to coordinate its efforts in infectious disease
modeling across its components; including efforts to monitor, evaluate and report on that
coordination. To implement this recommendation, HHS needs to finalize a process that
includes efforts to monitor, evaluate and report on coordination across multiple agencies.

Recommendation: The Secretary of HHS should direct CDC to establish guidelines that
ensure full reproducibility of CDC's research by sharing with the public all permissible
and appropriate information needed to reproduce research results, including, but not
limited to, model code.

Page 13 GAO-21-527PR HHS Priority Recommendations
Actions Needed: CDC concurred with this recommendation. In February 2021, CDC
stated its modelers aim to make forecasts and other modeling products reproducible and
accessible. CDC further stated it is focused on transparency and accessibility in its
modeling efforts, noting that it broadly disseminates modeling findings to state and local
partners. However, CDC has not taken steps to update its guidelines for ensuring and
maximizing the quality, objectivity, utility, and integrity of information disseminated to the
public. Such guideline modifications could include language relating to model
reproducibility, such as model code. To implement this recommendation, CDC needs to
provide evidence of updated guidelines that share with the public all permissible
appropriate information to ensure the full reproducibility of its research.

Director: Timothy M. Persons, Chief Scientist

Contact information: PersonsT@gao.gov, 202-512-6888

National Biodefense Strategy: Additional Efforts Would Enhance Likelihood of Effective
Implementation. GAO-20-273. Washington, D.C.: Feb. 19, 2020.

Recommendation: The Secretary of HHS should direct the Biodefense Coordination
Team to establish a plan that includes change management practices—such as
strategies for feedback, communication, and education—to reinforce collaborative
behaviors and enterprise-wide approaches and to help prevent early implementation
challenges from becoming institutionalized.

Actions Needed: HHS agreed with our recommendation and, in April 2021, described
actions it has taken to implement it, but did not provide supporting documentation that
would allow GAO to assess the extent to which these actions respond to the report
findings and the recommendation. To fully implement the recommendation, HHS will
need to provide evidence of the plan it created to enhance change management
including a strategy for communication and evidence of the feedback mechanisms it is
using, such as tools used to conduct annual after action reviews of the data collection
process and demonstrate how corrective actions based on that feedback have been
implemented.

Recommendation: The Secretary of HHS should direct the Biodefense Coordination
Team to clearly document guidance and methods for analyzing the data collected from
the agencies, including ensuring that nonfederal resources and capabilities are
accounted for in the analysis.

Actions Needed: HHS agreed with our recommendation and, in April 2021, described
actions it has taken to implement it, but did not provide supporting documentation that
would allow GAO to assess the extent to which these actions respond to the report
findings and meet the intent of the recommendation. For example, HHS described that
standard operating procedures are in development to further codify the annual
assessment process. To fully implement this recommendation, HHS will need to provide
evidence of these standard operating procedures—and the procedures must outline how
the Biodefense Coordination Team plans to account for nonfederal capabilities in its
annual assessment. HHS also needs to provide other guidance documents established
for the annual assessment that clearly articulate the methods to be used.

Recommendation: The Secretary of HHS should direct the Biodefense Coordination
Team to establish a resource plan to staff, support, and sustain its ongoing efforts.

Page 14 GAO-21-527PR HHS Priority Recommendations
Actions Needed: HHS agreed with our recommendation and, in April 2021, described
actions it has taken to implement it, but did not provide supporting documentation that
would allow GAO to assess the extent to which these actions respond to the report
findings and meet the intent of the recommendation. For example, HHS submitted a
budget request for $5 million to support implementation of the National Biodefense
Strategy. To fully implement this recommendation, HHS will need to provide a detailed
plan on how such budget requests will be used to staff, support, and sustain ongoing
implementation efforts. This is particularly important because the Biodefense
Coordination Team is comprised of over a dozen member departments and agencies,
and the budget request made by HHS does not detail specific resources that may be
required of other member departments.

Recommendation: The Secretary of HHS should direct the Biodefense Coordination
Team to clearly document agreed upon processes, roles, and responsibilities for making
and enforcing enterprise-wide decisions.

Directors: Chris P. Currie, Homeland Security and Justice and Mary Denigan-Macauley,
Health Care

Contact information: CurrieC@gao.gov, 404-679-1875 and
DeniganMacauleyM@gao.gov, 202-512-7114

Disaster Response: HHS Should Address Deficiencies Highlighted by Recent Hurricanes in the
U.S. Virgin Islands and Puerto Rico. GAO-19-592. Washington, D.C.: September 20, 2019.

Recommendation: ASPR should work with support agencies to develop and finalize
memorandums of agreement that include information on the capabilities and limitations
of these agencies to meet emergency support functions (ESF) #8 core capabilities. 10

Actions Needed: ASPR disagreed with this recommendation, and reiterated that
disagreement in March 2021. HHS proposed the continued use of interagency liaison
officers at the HHS emergency operations center, as they can provide real-time updates
on available resources during a response. We agree that HHS should continue this
practice; however, as evidenced by the capabilities misalignment we identified in our
report, this action was not adequate during the response to Hurricanes Irma and Maria in
the U.S. Virgin Islands and Puerto Rico, respectively. Further, as we reported, ASPR
officials acknowledged that more needs to be done to better understand the resources
available from its support agencies. We maintain that it is essential for ASPR to take

10The National Response Framework establishes an all-hazards response structure to coordinate federal resources

during hurricanes and other emergencies and disasters and is divided into 14 ESFs, which are functional areas that
are most frequently needed during a national response. ESF #8 relates to the public health and medical services
response.

Page 15 GAO-21-527PR HHS Priority Recommendations
steps to ensure it has a sufficient understanding of each ESF #8 support agency's
potential capabilities and limitations.

Recommendation: ASPR should develop a response personnel strategy to ensure, at a
minimum, a lead ASPR liaison officer is consistently at the local emergency operations
center(s) during an ESF #8 response and another liaison, if not more, is at strategic
location(s) in the area.

Actions Needed: ASPR agreed with this recommendation. As of March 2021, ASPR
officials stated that their incident response framework includes a long-term goal of
creating an incident response team that will establish an initial ESF #8 presence at local
emergency operations centers and manage resources and capabilities. If implemented,
this strategy may allow ASPR to provide more liaisons on the ground during a response
and address the staffing deficiency we identified in our report. To fully implement this
recommendation, ASPR officials will need to provide us with evidence that this team has
been used successfully to ensure at least one liaison is consistently stationed at
emergency operations centers.

Director: Mary Denigan-Macauley, Health Care

Contact information: DeniganMacauleyM@gao.gov, 202-512-7114

Public Health and Human Services Program Oversight

Unaccompanied Children: Actions Needed to Improve Grant Application Reviews and Oversight
of Care Facilities. GAO-20-609. Washington, D.C.: Sep. 15, 2020.

Recommendation: The Director of the Office of Refugee Resettlement (ORR) should
take steps to develop, and ensure that officials reviewing grant applications implement, a
process to verify the accuracy and completeness of information reported by grant
applicants on state licensing status, eligibility, allegations and concerns.

Actions Needed: HHS agreed with this recommendation. As of April 2021, ORR
developed and finalized a guide for project officers reviewing grant applications that
included an assessment of licensing information included in the application. HHS's
guidance document poses a few basic questions about the applicant's licensing status
and instructs the project officer to request documentation from an applicant whose
license has been restricted, suspended, or revoked. However, it does not specify any
other steps the project officer should take to verify the licensing information included in
the application, such as searching the state licensing agency's website or contacting the
licensing agency directly when licensing information is not available online. To fully
implement this recommendation, HHS needs to provide evidence of guidance instructing
project officers to take these or similar steps, and provide documentation showing this
guidance has been incorporated into the project officer training curriculum.

Recommendation: The Director of ORR should ensure that the grant review process
includes a documented review of applicants' past performance on ORR grants for those
that have previously received grants to care for unaccompanied children. This could
include, for example, a systematic review of previous quarterly and annual performance

Page 16 GAO-21-527PR HHS Priority Recommendations
reports and a review of corrective actions issued by all ORR monitoring staff to all ORR-
funded facilities previously operated by the applicant.

Actions Needed: HHS agreed with this recommendation. As of April 2021, HHS stated
that ORR was developing guidance for project officers on conducting and documenting
reviews of grantee performance. HHS provided a copy of guidance that directs staff to
review a grantee’s quarterly performance reports to determine whether the grantee’s
funding should be continued for another budget period and to document this review. To
fully implement this recommendation, HHS needs to provide evidence that project
officers review past grantee performance when existing grantees apply for new grants,
and provide documentation showing that this guidance has been incorporated into the
project officer training curriculum.

Director: Kathryn Larin, Education, Workforce, and Income Security

Contact information: LarinK@gao.gov, 202-512-7215

Southwest Border: Actions Needed to Improve DHS Processing of Families and Coordination
between DHS and HHS. GAO-20-245. Washington, D.C.: Feb.19, 2020.

Recommendation: The Secretary of HHS, jointly with the Secretary of Homeland
Security, should collaborate to address information sharing gaps identified in this report
to ensure that ORR receives information needed to make decisions for unaccompanied
alien children (UAC), including those apprehended with an adult.

Actions Needed: HHS and DHS concurred with our recommendation. As of March
2021, HHS and DHS had signed a memorandum of agreement regarding
unaccompanied children information sharing, which outlined the use of a new data
system HHS is developing that would be integrated with an interagency portal being
developed by DHS. Connecting this data system to the portal would allow HHS to
retrieve data regarding a child's status in a more automated manner. As of May 2021,
DHS officials said they plan to meet regularly with HHS to coordinate their efforts. DHS
and HHS reported that they would provide an update on the status of their efforts by
September 2021. Until DHS and HHS implement procedures aimed at improving the
efficiency and accuracy of the interagency unaccompanied children referral and
placement process, information-sharing gaps will remain. We will continue to monitor
and evaluate HHS’s actions to determine the extent to which they fully address our
recommendation.

Director: Rebecca Gambler, Homeland Security and Justice

Contact information: GamblerR@gao.gov, 202-512-8777

Head Start: Action Needed to Enhance Program Oversight and Mitigate Significant Fraud and
Improper Payment Risks. GAO-19-519. Washington, D.C.: Sept. 13, 2019.

Recommendation: The Director of the Office of Head Start (OHS) should perform a
fraud risk assessment for the Head Start program, to include assessing the likelihood
and impact of fraud risks it faces.

Actions needed: HHS concurred with our recommendation, and told us in March 2021
that the Administration for Children and Families is on track to complete the initial Fraud

Page 17 GAO-21-527PR HHS Priority Recommendations
Risk Assessment for OHS by the end of 2021. Such an assessment could help OHS
better identify and address the fraud risk vulnerabilities we identified. We will assess
these actions once completed to determine the extent to which they fully implement our
recommendation.

Director: Seto J. Bagdoyan, Forensic Audits and Investigative Service

Contact information: BagdoyanS@gao.gov, 202-512-6722

Nursing Homes: Improved Oversight Needed to Better Protect Residents from Abuse. GAO-19-
433. Washington, D.C.: June 13, 2019.

Recommendation: The Administrator of CMS should require that abuse and perpetrator
type be submitted by state survey agencies in CMS's databases for deficiency,
complaint, and facility-reported incident data, and that CMS systematically assess trends
in these data.

Actions Needed: HHS concurred with our recommendation. In March 2021, HHS said
CMS is developing the ability to review survey trends related to alleged perpetrator and
alleged abuse types and aims to implement our recommendation by June 2021. To fully
implement our recommendation, the Administrator of CMS should require that abuse
and perpetrator type be submitted by state survey agencies in CMS's databases for
deficiency, complaint, and facility-reported incident data, and that CMS systematically
assess trends in these data.

Recommendation: The Administrator of CMS should require state survey agencies to
immediately refer complaints and surveys to law enforcement (and, when applicable, to
Medicaid Fraud Control Units) if they have a reasonable suspicion that a crime against a
resident has occurred when the complaint is received.

Actions Needed: HHS concurred with our recommendation. In March 2021, HHS said
CMS will require state survey agencies to immediately refer complaints upon receipt and
surveys to law enforcement (and, when applicable, to Medicaid Fraud Control Units) if
they have a reasonable suspicion that a crime against a resident has occurred, and aims
to implement this requirement by June 2021. We will evaluate CMS’s implementation of
this requirement upon completion to determine the extent to which it fully addresses our
recommendation.

Director: John E. Dicken, Health Care

Contact information: DickenJ@gao.gov, 202-512-7114

Improper Payments: Selected Agencies Need Improvements in Their Assessments to Better
Determine and Document Risk Susceptibility. GAO-19-112. Washington, D.C.: Jan. 10, 2019.

Recommendation: The Secretary of HHS should revise HHS’s process for conducting
improper payment risk assessments for Head Start to help ensure that it results in a
reliable assessment of whether the program is susceptible to significant improper
payments. This should include preparing sufficient documentation to support its risk
assessments.

Page 18 GAO-21-527PR HHS Priority Recommendations
Actions needed: HHS concurred with our recommendation. In March 2021, HHS stated
that it has revised its risk assessment process, including the questionnaire and scoring
methodology, and implemented a new tool, the Risk Assessment Portal (RAP) to
capture responses. According to HHS, the revised questionnaire and RAP tool facilitates
a systematic approach to conducting a reliable assessment of any HHS program,
including Head Start, to determine whether the program is susceptible to significant
improper payments. The RAP tool enables programs to add information through an
expanded modal screen and allows users to attach supplemental documentation
supporting their risk assessment and questionnaire responses. HHS also developed
RAP User and Reference Guides to support the end user and documents the process
HHS uses to provide a reasonable basis for making to risk determinations. HHS needs
to provide us with documentation that supports the corrective actions HHS stated it has
taken so we can assess and determine if those actions fully implement this
recommendation.

Recommendation: The Secretary of HHS should revise HHS’s procedures for
conducting improper payment risk assessments to help ensure that all programs and
activities are assessed for susceptibility to significant improper payments at least once
every 3 years, as required by the Improper Payments Information Act of 2002, as
amended. 11

Actions needed: HHS concurred with our recommendation. In March 2021, HHS stated
that it has used its new, risk-based methodology for two years to recommend programs
for assessment. According to HHS, the results of this methodology, and the coverage
recommended each year, are documented annually. The HHS Office of Inspector
General reviewed the fiscal year 2019 methodology as part of the annual inspector
general review of HHS's improper payment reporting under the Improper Payments
Elimination and Recovery Act of 2010 and provided no feedback or recommendations
for improvement. HHS also stated that it plans to refine the methodology as needed and
ensure annually that leaders are aware of which programs are above the threshold and
should be assessed for susceptibility to significant improper payments. HHS needs to
provide us with documentation that supports the corrective actions HHS stated it has
taken so we can assess and determine if those actions fully implement this
recommendation.

Director: Beryl H. Davis, Financial Management and Assurance

Contact information: DavisBH@gao.gov, 202-512-2623

Drug Discount Program: Federal Oversight of Compliance at 340B Contract Pharmacies Needs
Improvement. GAO-18-480. Washington, D.C.: June 21, 2018.

Recommendation: The Administrator of the Health Resources and Services
Administration (HRSA) should issue guidance to covered entities on the prevention of

11On March 2, 2020, the Payment Integrity Information Act of 2019 (PIIA) repealed the Improper Payments

Information Act of 2002, the Improper Payments Elimination and Recovery Act of 2010, and the Improper Payments
Elimination and Recovery Improvement Act of 2012. Although PIIA repealed the legal provisions underlying our
recommendation, it also enacted substantially similar requirements as a new subchapter in Title 31 of the U.S. Code.
We therefore have not altered the status of this recommendation.

Page 19 GAO-21-527PR HHS Priority Recommendations
duplicate discounts under Medicaid managed care, working with CMS as HRSA deems
necessary to coordinate with guidance provided to state Medicaid programs.

Recommendation: The Administrator of HRSA should incorporate an assessment of
covered entities' compliance with the prohibition on duplicate discounts, as it relates to
Medicaid managed care claims, into its audit process after guidance has been issued
and ensure that identified violations are rectified by the entities.

Actions needed: HHS concurred with our recommendations, though as of March 2021,
it has not taken steps to implement them. To implement our recommendations, HHS
should issue guidance to covered entities on the prevention of duplicate discounts under
Medicaid managed care. After this guidance has been issued, HHS should also
incorporate into its audit process an assessment of covered entities’ compliance with the
prohibition of duplicate discounts.

Director: Debra A. Draper, Health Care

Contact information: DraperD@gao.gov, 202-512-7114

Unaccompanied Alien Children: Actions Needed to Ensure Children Receive Required Care in
DHS Custody. GAO-15-521. Washington, D.C.: July 14, 2015.

Recommendation: To increase the efficiency and improve the accuracy of the
interagency UAC referral and placement process, the Secretaries of DHS and HHS
should jointly develop and implement a documented interagency process with clearly
defined roles and responsibilities, as well as procedures to disseminate placement
decisions, for all agencies involved in the referral and placement of UAC in HHS
shelters.

Actions needed: HHS and DHS concurred with our recommendation. As of March
2021, HHS and DHS had signed a memorandum of agreement regarding
unaccompanied children information sharing. The agreement outlined the use of a new
data system HHS is developing that would be integrated with an interagency portal being
developed by DHS. Connecting this data system to the portal would allow HHS to
retrieve data regarding a child's status in a more automated manner. As of May 2021,
DHS officials said they plan to meet regularly with HHS to coordinate their efforts. DHS
and HHS reported that they would provide an update on the status of these efforts by
September 2021. To fully implement our recommendation, DHS and HHS should ensure
that they have implemented procedures aimed at improving the efficiency and accuracy
of the interagency unaccompanied children referral and placement process.

Director: Rebecca Gambler, Homeland Security and Justice

Contact information: GamblerR@gao.gov, 202-512-8777

Food and Drug Administration Oversight

COVID-19: Critical Vaccine Distribution, Supply Chain, Program Integrity, and Other Challenges
Require Focused Federal Attention. GAO-21-265. Washington, D.C.: January 28, 2021

Page 20 GAO-21-527PR HHS Priority Recommendations
Recommendation: The Commissioner of the Food and Drug Administration (FDA)
should, as inspection plans for future fiscal years are developed, ensure that such plans
identify, analyze, and respond to the issues presented by the backlog of inspections that
could jeopardize the goal of risk-driven inspections.

Actions Needed: FDA concurred with our recommendation and as of January 2021,
stated that it is actively tracking the list of sites that need to be inspected. To fully
implement our recommendation, FDA should provide documentation that its inspection
plans identify, analyze, and respond to the issues presented by the backlog of
inspections.

High-risk area: Protecting Public Health through Enhanced Oversight of Medical
Products

Director: Mary Denigan-Macauley, Health Care

Contact information: DeniganMacauleyM@gao.gov, 202-512-7114

Imported Seafood Safety: FDA and USDA Could Strengthen Efforts to Prevent Unsafe Drug
Residues. GAO-17-443. Washington, D.C.: Sept. 15, 2017.

Recommendation: The Commissioner of FDA should coordinate and communicate with
the U.S. Department of Agriculture (USDA) Food Safety and Inspection Service (FSIS)
in developing drug residue testing methods and corresponding maximum residue levels
for imported seafood that may also be applicable to imported catfish.

Actions Needed: FDA concurred with our recommendation and has taken some steps
to implement it, including convening quarterly to discuss the establishment of drug
residue limits in seafood. However, we found that agencies continue to use different
testing methods, which results in the agencies using different maximum residue levels
from some drugs. As of January 2021, according to FDA officials, FDA and FSIS do not
have any plans to work on a multi-residue method that both agencies can use. To
implement our recommendation, FDA should coordinate with FSIS on (1) the
development of testing methods that both agencies can use on imported seafood,
including catfish, and (2) establishing maximum residue levels that would allow the
agencies to consistently apply similar standards.

High-risk area: Improving Federal Oversight of Food Safety

Director: Steve Morris, Natural Resources & Environment

Contact information: MorrisS@gao.gov, 202-512-3841

Drug Safety: FDA Has Improved Its Foreign Drug Inspection Program, but Needs to Assess the
Effectiveness and Staffing of Its Foreign Offices. GAO-17-143. Washington, D.C.: Dec. 16,
2016.

Recommendation: To help ensure that FDA's foreign offices are able to fully meet their
mission of helping to ensure the safety of imported products, as the agency continues to
test performance measures and evaluate its Office of International Program’s strategic
workforce plan, the Commissioner of FDA should assess the effectiveness of the foreign
offices' contributions to drug safety by systematically tracking information to measure

Page 21 GAO-21-527PR HHS Priority Recommendations
whether the offices' activities specifically contribute to drug safety-related outcomes,
such as inspections, import alerts, and warning letters.

Actions Needed: FDA concurred with our recommendation and in July 2018 reported
developing new performance measures for foreign offices as well as a monitoring and
evaluation plan. As of March 2021, FDA has not provided evidence of progress toward
implementing our recommendation. To fully implement our recommendation, FDA
should systematically track information to measure whether the offices’ activities—such
as inspections, import alerts, and warning letters—specifically contribute to drug safety-
related outcomes.

High-risk area: Protecting Public Health through Enhanced Oversight of Medical
Products

Director: Mary Denigan-Macauley, Health Care

Contact information: DeniganMacauleyM@gao.gov, 202-512-7114

Food Safety: Additional Actions Needed to Help FDA's Foreign Offices Ensure Safety of
Imported Food. GAO-15-183. Washington, D.C.: Jan. 30, 2015.

Recommendation: To help ensure the safety of food imported into the United States,
the Commissioner of FDA should complete an analysis to determine the annual number
of foreign food inspections that is sufficient to ensure comparable safety of imported and
domestic food. If the inspection numbers from that evaluation are different from the
inspection targets mandated in the Food Safety Modernization Act (FSMA), FDA should
report the results to Congress and recommend appropriate legislative changes.

Actions Needed: FDA concurred with our recommendation. As of March 2021, FDA
officials said that they cannot meet the number of foreign inspections required under
FSMA due to capacity constraints, and FDA's current strategy for the safety of imported
food relies on multiple programs—in addition to foreign inspections—that could take a
number of years to be fully implemented. As these new FSMA programs initiate and
mature over time, FDA officials said they will comprehensively weigh outcomes and
oversight from these programs and produce a data-driven assessment on the
appropriate number or range of foreign inspections that provide appropriate oversight of
the safety of the imported food supply. To fully implement our recommendation, FDA
should report this information to Congress and GAO.

High-risk area: Improving Federal Oversight of Food Safety

Director: Steve Morris, Natural Resources & Environment

Contact information: MorrisS@gao.gov, 202-512-3841

Food Safety: FDA and USDA Should Strengthen Pesticide Residue Monitoring Programs and
Further Disclose Monitoring Limitations. GAO-15-38. Washington, D.C.: Oct. 7, 2014.

Recommendation: To better inform users of the annual monitoring report about the
frequency and scope of pesticide tolerance violations, the Secretary of HHS should
direct the Commissioner of FDA to disclose in the agency's annual pesticide monitoring
program report which pesticides with Environmental Protection Agency (EPA)-

Page 22 GAO-21-527PR HHS Priority Recommendations
established tolerances the agency did not test for in its pesticide monitoring program and
the potential effect of not testing for those pesticides.

Actions Needed: FDA concurred with this recommendation. In a March 2021 update,
FDA acknowledged that some pesticides with EPA-established tolerances were not part
of FDA’s testing scope in its September 2020 annual pesticide residue monitoring report.
In addition, FDA does not know the extent to which exposure to these pesticides may
occur in the foods that FDA regulates. FDA included in this report an appendix listing all
pesticides analyzed by FDA pesticide methods in that fiscal year. To fully implement our
recommendation, FDA must disclose in its annual pesticide residue monitoring report
which pesticides with EPA-established tolerances the agency did not test for in its
pesticide monitoring program.

High-risk area: Improving Federal Oversight of Food Safety

Director: Steve Morris, Natural Resources & Environment

Contact information: MorrisS@gao.gov, 202-512-3841

National Efforts to Prevent, Respond to, and Recover from Drug Misuse

Newborn Health: Federal Action Needed to Address Neonatal Abstinence Syndrome. GAO-18-
32. Washington, D.C.: Oct. 4, 2017.

Recommendation: The Secretary of HHS should expeditiously develop a plan—that
includes priorities, time frames, clear roles and responsibilities, and methods for
assessing progress—to effectively implement the neonatal abstinence syndrome (NAS)-
related recommendations identified in the Protecting Our Infants Act: Final Strategy.

Actions needed: HHS concurred with our recommendation. HHS’s Behavioral Health
Coordinating Council finalized a plan in 2019 for implementing the Strategy. The plan
includes priorities, timeframes, and clear roles and responsibilities for implementing
NAS-related recommendations in the Strategy. However, the plan does not specifically
identify methods for assessing HHS’s progress toward implementing the Strategy’s
recommendations. In November 2019, HHS officials stated that the department holds
quarterly conference calls to share updates on progress toward implementing the
Strategy and that formal written updates will be collected at the end of each year. As of
March 2021, we have not received any further updates. To fully implement our
recommendation, HHS needs to provide documentation—such as formal written
updates—showing how the department assesses its progress in implementing the
Strategy’s recommendations.

High-risk area: National Efforts to Prevent, Respond to, and Recover from Drug Misuse

Director: Mary Denigan-Macauley, Health Care

Contact information: DeniganMacauleyM@gao.gov, 202-512-7114

Page 23 GAO-21-527PR HHS Priority Recommendations
Improper Payments in Medicaid and Medicare

Medicare and Medicaid: CMS Should Assess Documentation Necessary to Identify Improper
Payments. GAO-19-277. Washington, D.C.: Mar. 27, 2019.

Recommendation: The Administrator of CMS should institute a process to routinely
assess, and take steps to ensure, as appropriate, that Medicare and Medicaid
documentation requirements are necessary and effective at demonstrating compliance
with coverage policies while appropriately addressing program risks.

Actions needed: HHS concurred with our recommendation. As of March 2021, CMS
noted that the agency had clarified and amended several Medicare documentation
requirements as part of an agency initiative to assess such requirements. CMS further
stated that Medicaid documentation requirements are generally established at the state
level and that the agency has taken steps to identify best practices for documentation
requirements and share them with states. However, to implement our recommendation,
CMS needs to take steps to assess documentation requirements in both programs to
better understand how the variation in the programs' requirements affects estimated
improper payment rates.

High-risk areas: Medicare Program & Improper Payments; Strengthening Medicaid
Program Integrity

Director: Carolyn L. Yocom, Health Care

Contact information: YocomC@gao.gov, 202-512-7114

Medicaid: CMS Needs to Better Target Risks to Improve Oversight of Expenditures. GAO-18-
564. Washington, D.C.: Aug. 6, 2018.

Recommendation: The Administrator of CMS should complete a comprehensive,
national risk assessment and take steps, as needed, to assure that resources to oversee
expenditures reported by states are adequate and allocated based on areas of highest
risk.

Actions needed: HHS concurred with our recommendation. However, CMS has
suspended steps to conduct a comprehensive national risk assessment. CMS developed
a standard tool to assess risk and staff capacity in October 2019, but the implementation
of this tool was suspended in November 2019 when the agency initiated a reorganization
of its regional office functions, including financial oversight. According to CMS, the
reorganization is intended to improve coordination between central and regional offices
so that financial operations are consistent across the nation. As of March 2021, the tool
remains suspended, and HHS officials have not informed us of any additional actions
taken to implement our recommendation. We will continue to monitor CMS’s action to
complete this assessment to implement our recommendation.

High-risk area: Strengthening Medicaid Program Integrity

Director: Carolyn L. Yocom, Health Care

Contact information: YocomC@gao.gov, 202-512-7114

Page 24 GAO-21-527PR HHS Priority Recommendations
Medicaid Managed Care: Improvements Needed to Better Oversee Payment Risks. GAO-18-
528. Washington, D.C.: July 26, 2018.

Recommendation: The Administrator of CMS should eliminate impediments to
collaborative audits in managed care conducted by audit contractors and states, by
ensuring that managed care audits are conducted regardless of which entity—the state
or the managed care organization (MCO)—recoups any identified overpayments.

Actions needed: HHS concurred with our recommendation and, as of March 2021, has
highlighted for states and audit contractors the importance of conducting collaborative
audits. In addition, CMS stated in September 2019 that it was evaluating several process
improvements as a result of feedback and recommendations received through a meeting
with states and audit contractors. However, it is unclear whether CMS’s actions have
removed impediments to audits of Medicaid MCOs or will cause the number of audits to
increase. To fully implement our recommendation, CMS needs to provide evidence that
the agency has removed impediments to audits of Medicaid MCOs by ensuring that they
are conducted regardless of whether the state or the MCO recoups identified
overpayments.

High-risk area: Strengthening Medicaid Program Integrity

Director: Carolyn L. Yocom, Health Care

Contact information: YocomC@gao.gov, 202-512-7114

Medicaid: CMS Should Take Steps to Mitigate Program Risks in Managed Care. GAO-18-291.
Washington, D.C.: May 7, 2018.

Recommendation: The Administrator of CMS should consider and take steps to
mitigate the program risks that are not measured in the Payment Error Rate
Measurement (PERM), such as overpayments and unallowable costs; such an effort
could include actions such as revising the PERM methodology or focusing additional
audit resources on managed care.

Actions needed: HHS concurred with our recommendation and, as of March 2021,
stated that it was in the process of developing a strategy to reduce risk in Medicaid
managed care. To implement our recommendation, CMS would need to implement its
strategy to mitigate the managed care program risks not measured in the PERM.

High-risk area: Strengthening Medicaid Program Integrity

Director: Carolyn L. Yocom, Health Care

Contact information: YocomC@gao.gov, 202-512-7114

Medicare: CMS Should Take Actions to Continue Prior Authorization Efforts to Reduce
Spending. GAO-18-341. Washington, D.C.: Apr. 20, 2018.

Recommendation: The Administrator of CMS should take steps, based on results from
evaluations, to continue prior authorization. These steps could include: (1) resuming the
paused home health services demonstration; (2) extending current demonstrations; or

Page 25 GAO-21-527PR HHS Priority Recommendations
(3) identifying new opportunities for expanding prior authorization to additional items and
services with high unnecessary utilization and high improper payment rates.

Actions needed: HHS initially neither agreed nor disagreed with our recommendation,
but as of March 2021, the agency concurred. CMS has taken steps to evaluate and
continue its prior authorization programs. Between 2019 and 2020, CMS made some
progress toward implementing our recommendation by, for example, adding 18 items to
its prior authorization list and resuming or starting five demonstrations. As of March
2021, HHS stated that it will continue evaluating the prior authorization programs. To
fully implement our recommendation, CMS needs to take additional steps to evaluate the
use of prior authorization by, for example, determining cost savings from its actions.
CMS also needs to take additional steps to expand the use of prior authorization, which
could include identifying new opportunities for prior authorization for items and services
with high unnecessary utilization and high improper payment rates.

High-risk area: Medicare Program & Improper Payments

Director: Jessica Farb, Health Care

Contact information: FarbJ@gao.gov, 202-512-7114

Medicare: Claim Review Programs Could Be Improved with Additional Prepayment Reviews
and Better Data. GAO-16-394. Washington, D.C.: Apr. 13, 2016.

Recommendation: In order to better ensure proper Medicare payments and protect
Medicare funds, CMS should seek legislative authority to allow the recovery auditors
(RA) to conduct prepayment claim reviews.

Actions needed: HHS disagreed with our recommendation and, as of March 2021, has
not taken steps to seek legislative authority to allow the RAs to conduct prepayment
claim reviews. We maintain that CMS should seek such authority.

High-risk area: Medicare Program & Improper Payments

Director: Jessica Farb, Health Care

Contact information: FarbJ@gao.gov, 202-512-7114

Medicare Advantage: Fundamental Improvements Needed in CMS’s Effort to Recover
Substantial Amounts of Improper Payments. GAO-16-76. Washington, D.C.: Apr. 8, 2016.

Recommendation: As CMS continues to implement and refine the contract-level risk
adjustment data validation (RADV) audit process to improve the efficiency and
effectiveness of reducing and recovering improper payments, the Administrator should
enhance the timeliness of CMS's contract-level RADV process by taking actions such as
the following: (1) closely aligning the time frames in CMS's contract-level RADV audits
with those of the national RADV audits the agency uses to estimate the Medicare
Advantage (MA) improper payment rate; (2) reducing the time between notifying MA
organizations of contract audit selection and notifying them about the beneficiaries and
diagnoses that will be audited; (3) improving the reliability and performance of the
agency's process for transferring medical records from MA organizations, including
assessing the feasibility of updating Electronic Submission of Medical Documentation for

Page 26 GAO-21-527PR HHS Priority Recommendations
use in transferring medical records in contract-level RADV audits; and (4) requiring that
CMS contract-level RADV auditors complete their medical record reviews within a
specific number of days comparable to other medical record review time frames in the
Medicare program.

Actions needed: HHS concurred with our recommendation and reaffirmed its
commitment to identifying and correcting improper payments in the MA program. HHS
stated that, as of March 2021, CMS had taken steps to improve the timeliness of the
contract-level RADV audit process, such as aligning the time frames in CMS’s contract-
level RADV audits with those of the national RADV audits. To implement our
recommendation, CMS will need to provide evidence that it has completed steps such as
these and that the agency’s actions have enhanced the timeliness of CMS's contract-
level RADV process. CMS stated that, as of March 2021, the agency was gathering
documentation to demonstrate that the recommendation had been implemented. We will
evaluate any documentation upon receipt to determine whether CMS’s actions fully
implement our recommendation.

High-risk area: Medicare Program & Improper Payments

Director: Jessica Farb, Health Care

Contact information: FarbJ@gao.gov, 202-512-7114

Medicaid Program

Medicaid: CMS Needs More Information on States' Financing and Payment Arrangements to
Improve Oversight. GAO-21-98. Washington, D.C.: Dec. 7, 2020.

Recommendation: The Administrator of CMS should collect and document complete
and consistent provider-specific information about Medicaid payments to providers,
including new state-directed managed care payments, and states' sources of funding for
the nonfederal share of these payments.

Actions needed: HHS neither agreed nor disagreed with our recommendation but
acknowledged the need for additional state Medicaid financing and payment data to
oversee the Medicaid program. HHS also noted that CMS has begun work to improve
the collection of financing and payment information through a revised data collection
form and that CMS would explore additional actions to do so. In addition, Congress
passed and the President signed into law requirements in December 2020 for additional
state reporting on Medicaid supplemental payments. To fully implement our
recommendation, HHS needs to demonstrate how its ongoing and planned actions in
this area, which could include actions in response to the December 2020 law described
above, will ensure complete, consistent, and sufficiently documented information about
sources of funding for the nonfederal share and payments to providers.

High-risk area: Strengthening Medicaid Program Integrity

Director: Carolyn L. Yocom, Health Care

Contact information: YocomC@gao.gov, 202-512-7114

Page 27 GAO-21-527PR HHS Priority Recommendations
Medicaid Providers: CMS Oversight Should Ensure State Implementation of Screening and
Enrollment Requirements. GAO-20-8. Washington, D.C.: Oct. 10, 2019.

Recommendation: The Administrator of CMS should expand its review of states'
implementation of the provider screening and enrollment requirements to include states
that have not made use of CMS's optional consultations. Similar to CMS's contractor site
visits, such reviews should include any necessary steps to address areas of
noncompliance for all types of enrolled providers, including those under contract with
managed care organizations.

Actions Needed: CMS concurred with our recommendation. In June 2020, CMS stated
that it planned to reach out to states that had not yet participated in optional
consultations to discuss their progress towards implementing these requirements and
outline steps the states should take to come into full compliance with the requirements.
However, in February 2021, CMS reported that all states opted to waive certain provider
screening and enrollment requirements in an effort to relieve the burden on providers
during the COVID-19 pandemic. CMS stated that the agency would recognize these
waivers until the end of the public health emergency. Consequently, as of March 2021,
CMS did not have further details on state compliance with provider enrollment
requirements, including states that have not used CMS’s optional consultations. To fully
implement our recommendation, CMS would need to complete and provide evidence of
its review of all states’ implementation of the provider screening and enrollment
requirements. We will continue to monitor CMS's progress.

High-risk area: Strengthening Medicaid Program Integrity

Director: Carolyn L. Yocom, Health Care

Contact information: YocomC@gao.gov, 202-512-7114

Medicaid: Additional CMS Data and Oversight Needed to Help Ensure Children Receive
Recommended Screenings. GAO-19-481. Washington, D.C.: Aug. 16, 2019.

Recommendation: The Administrator of CMS should work with states and relevant
federal agencies to collect accurate and complete data on blood lead screening for
Medicaid beneficiaries in order to ensure that CMS is able to monitor state compliance
with its blood lead screening policy and to assist states with planning improvements to
address states' compliance as needed.

Actions Needed: HHS concurred with our recommendation. In January 2021, CMS
provided states with the option to use a new data system—as states meet certain data
quality and completeness benchmarks—to generate the report that includes states'
blood lead screening data. CMS stated that this will improve the agency's and states'
ability to assess gaps in blood lead screening data. This is a positive step, yet any new
data system will also need to address known limitations in the current blood lead
screening data, such as the under-counting of blood lead screening tests not paid for by
Medicaid. To fully implement our recommendation, CMS should ensure that its new data
system addresses limitations in blood lead screening data to better monitor compliance
with the agency's blood lead screening policy.

High-risk area: Strengthening Medicaid Program Integrity

Page 28 GAO-21-527PR HHS Priority Recommendations
Director: Carolyn L. Yocom, Health Care

Contact information: YocomC@gao.gov, 202-512-7114

Medicaid Demonstrations: Approvals of Major Changes Need Increased Transparency. GAO-
19-315. Washington, D.C.: Apr. 17, 2019.

Recommendation: The Administrator of CMS should develop and communicate a
policy whereby applications for section 1115 demonstration amendments that may have
significant impact are subject to transparency requirements comparable to those for new
demonstrations and extensions.

Actions Needed: HHS concurred with our recommendation. As of March 2021, HHS
stated that it plans to implement a policy applying state public input processes and
application criteria to amendments proposing significant or substantial changes in the
same manner as for new demonstrations. In December 2020, CMS said the agency
plans to develop criteria for determining whether an amendment application proposes a
substantial change to an existing demonstration and to include this in guidance in 2021.
We will evaluate HHS guidance when it is issued to determine whether it fully addresses
our recommendation.

High-risk area: Strengthening Medicaid Program Integrity

Director: Carolyn L. Yocom, Health Care

Contact information: YocomC@gao.gov, 202-512-7114

Medicaid Assisted Living Services: Improved Federal Oversight of Beneficiary Health and
Welfare Is Needed. GAO-18-179. Washington, D.C.: Jan. 5, 2018.

Recommendation: The Administrator of CMS should establish standard Medicaid
reporting requirements for all states to annually report key information on critical
incidents, considering, at a minimum, the type of critical incidents involving Medicaid
beneficiaries and the type of residential facilities, including assisted living facilities,
where critical incidents occurred.

Actions needed: HHS neither agreed nor disagreed with our recommendation. As of
March 2021, CMS completed three national training courses for state officials regarding
the findings of its national survey of incident management systems. During these
trainings, CMS reported on the wide variation among state systems, including the types
of incidents identified as critical. CMS developed a proposed incident reporting template,
but converted it to an optional incident reporting tool that the agency may share with
states in providing technical assistance. To fully implement our recommendation, CMS
should establish standard Medicaid reporting requirements for all states to report critical
incidents annually.

High-risk area: Strengthening Medicaid Program Integrity

Director: Carolyn L. Yocom, Health Care

Contact information: YocomC@gao.gov, 202-512-7114

Page 29 GAO-21-527PR HHS Priority Recommendations
Medicaid: Federal Guidance Needed to Address Concerns about Distribution of Supplemental
Payments. GAO-16-108. Washington, D.C.: Feb. 5, 2016.

Recommendation: To promote consistency in the distribution of supplemental
payments among states and with CMS policy, the Administrator of CMS should issue
written guidance clarifying its policy that payments should not be made contingent on the
availability of local funding.

Actions needed: HHS initially stated it was considering options to address our
recommendation, and as of March 2021, the agency concurred. In December 2020,
Congress passed and the President signed into law requirements for additional state
reporting on Medicaid supplemental payments that may address our recommendation.
The new law includes a requirement for states to report the criteria used to determine
which providers are eligible to receive the supplemental payments. We will continue
monitoring implementation of the new reporting requirement to determine the extent to
which it fully implements our recommendation.

High-risk area: Strengthening Medicaid Program Integrity

Director: Carolyn L. Yocom, Health Care

Contact information: YocomC@gao.gov, 202-512-7114

Medicaid: CMS Oversight of Provider Payments Is Hampered by Limited Data and Unclear
Policy. GAO-15-322. Washington, D.C.: Apr. 10, 2015.

Recommendation: To improve CMS's oversight of Medicaid payments, the
Administrator of CMS should develop a policy establishing criteria for when such
payments at the provider level are economical and efficient.

Actions needed: HHS concurred with our recommendation. In December 2020,
Congress passed and the President signed into law requirements for additional state
reporting on Medicaid supplemental payments, including for states to describe how
these payments are economical and efficient. As of March 2021, we have not received
any further updates. We will continue monitoring the implementation of the new reporting
requirements to determine the extent to which they fully implement our recommendation.

High-risk area: Strengthening Medicaid Program Integrity

Director: Carolyn L. Yocom, Health Care

Contact information: YocomC@gao.gov, 202-512-7114

Medicaid and SCHIP: Recent HHS Approvals of Demonstration Waiver Projects Raise
Concerns. GAO-02-817. Washington, D.C.: July 12, 2002.

Recommendation: To meet its fiduciary responsibility of ensuring that section 1115
waivers are budget neutral, the Secretary of Health and Human Services should better
ensure that valid methods are used to demonstrate budget neutrality, by developing and
implementing consistent criteria for consideration of section 1115 demonstration waiver
proposals.

Page 30 GAO-21-527PR HHS Priority Recommendations
Actions needed: HHS disagreed with our recommendation. However, we have
reiterated the need for increased attention to fiscal responsibility in the approval of the
section 1115 Medicaid demonstrations in subsequent 2008 and 2013 reports. 12 As of
March 2021, HHS has taken some action to address this recommendation. In August
2018, HHS issued written guidance through a State Medicaid Directors Letter
documenting four key changes it made in 2016 to its budget neutrality policy. These
changes addressed some, but not all, of the questionable methods we identified in our
reports. To fully implement our recommendation, HHS should also address these other
questionable methods, such as setting demonstration spending limits based on
hypothetical costs—what the state could have paid—rather than payments actually
made by the state. We have found that the use of hypothetical costs has the potential to
inflate spending limits and thus threatens budget neutrality of demonstrations.

High-risk area: Strengthening Medicaid Program Integrity

Director: Carolyn L. Yocom, Health Care

Contact information: YocomC@gao.gov, 202-512-7114

Medicare Program

Hospital Uncompensated Care: Federal Action Needed to Better Align Payments with Costs.
GAO-16-568. Washington, D.C.: June 30, 2016.

Recommendation: To ensure efficient use of federal resources, the Administrator of
CMS should account for Medicaid payments a hospital has received that offset
uncompensated care (UC) costs when determining hospital UC costs for the purposes of
making Medicare UC payments to individual hospitals.

Actions needed: HHS initially concurred with our recommendation. However, in 2018
and again in March 2021, HHS indicated it was reconsidering whether to implement our
recommendation because officials stated that it may not be appropriate to offset
Medicare UC payments by Medicaid payments that help offset UC costs. CMS stated
that because Medicare UC payments are distributed based on hospitals’ relative (not
actual) UC costs, it may not be appropriate to account for Medicaid payments that
reduce hospital UC. We maintain that CMS should implement our recommendation
because it would (1) ensure that Medicare UC payments are based on accurate levels of
UC costs, (2) result in CMS better targeting billions of dollars in Medicare UC payments
to hospitals with the most UC costs, and (3) avoid Medicare UC payments to hospitals
with little or no UC costs.

High-risk area: Medicare Program & Improper Payments

Director: Carolyn L. Yocom, Health Care

Contact information: YocomC@gao.gov, 202-512-7114

12GAO, Medicaid Demonstration Waivers: Recent HHS Approvals Continue to Raise Cost and Oversight Concerns,

GAO-08-87 (Washington, D.C.: Jan. 31, 2008) and GAO, Medicaid Demonstration Waivers: Approval Process Raises
Cost Concerns and Lacks Transparency, GAO-13-384 (Washington, D.C.: June 25, 2013).

Page 31 GAO-21-527PR HHS Priority Recommendations
Medicare Advantage: CMS Should Fully Develop Plans for Encounter Data and Assess Data
Quality before Use. GAO-14-571. Washington, D.C.: July 31, 2014.

Recommendation: To ensure that MA encounter data are of sufficient quality for their
intended purposes, the Administrator of CMS should establish specific plans and time
frames for using the data for all intended purposes in addition to risk adjusting payments
to Medicare Advantage organizations (MAO).

Actions needed: HHS concurred with our recommendation. Although CMS reported
using MA encounter data for purposes other than risk adjustment, as of March 2021, the
agency had not fully developed specific plans and time frames for such uses. Although
CMS continues to develop additional uses for MA encounter data, the agency’s plans for
using the data for comprehensive oversight purposes remain limited. For example,
although CMS intends to use MA encounter data for program integrity purposes, it has
not yet developed specific plans and time frames to do so. To fully implement our
recommendation, CMS should establish specific plans and time frames for using MA
encounter data for all intended purposes in addition to risk adjusting payments to MAOs.

Recommendation: To ensure that MA encounter data are of sufficient quality for their
intended purposes, the Administrator of CMS should complete all the steps necessary to
validate the data, including performing statistical analyses, reviewing medical records,
and providing MAOs with summary reports on CMS's findings, before using the data to
risk adjust payments or for other intended purposes.

Actions needed: HHS concurred with our recommendation but, as of March 2021, had
not committed to completing data validation before using MA encounter data for risk
adjustment. To fully implement our recommendation, CMS needs to complete all
necessary steps to validate MA encounter data, including verifying the data by reviewing
medical records, before using the data for risk adjustment payments or other intended
purposes.

High-risk area: Medicare Program & Improper Payments

Director: Jessica Farb, Health Care

Contact information: FarbJ@gao.gov, 202-512-7114

End-Stage Renal Disease: CMS Should Improve Design and Strengthen Monitoring of Low-
Volume Adjustment. GAO-13-287. Washington, D.C.: Mar. 1, 2013.

Recommendation: To reduce the incentive for dialysis facilities to restrict their service
provision to avoid reaching the low-volume payment adjustment (LVPA) treatment
threshold, the Administrator of CMS should consider revisions such as changing the
LVPA to a tiered adjustment. 13

13To have been eligible to receive the LVPA in 2011, a dialysis facility must have provided fewer than 4,000 total

dialysis treatments during each of the 3 previous years, among meeting other CMS regulatory criteria. We stated in
our report that the design of the LVPA raised concerns because it provides facilities with an adverse incentive to
restrict their service provision to avoid reaching the 4,000 treatment threshold. Facilities that reach this threshold lose
eligibility for the next 3 calendar years.

Page 32 GAO-21-527PR HHS Priority Recommendations
Actions needed: HHS concurred with our recommendation and stated in March 2021
that the agency had extensive discussions with the Medicare Payment Advisory
Commission regarding the Commission's suggestions for modifying the LVPA. CMS also
stated that the agency was analyzing the design of the LVPA as part of its evaluation of
the End-Stage Renal Disease Prospective Payment System. To fully implement our
recommendation, CMS needs to provide documentation of the steps—such as those
described above—that the agency has taken to consider revisions to the LVPA.

High-risk area: Medicare Program & Improper Payments

Director: Jessica Farb, Health Care

Contact information: FarbJ@gao.gov, 202-512-7114

Medicare: Higher Use of Advanced Imaging Services by Providers Who Self-Refer Costing
Medicare Millions. GAO-12-966. Washington, D.C.: Sep. 28, 2012.

Recommendation: In order to improve CMS's ability to identify self-referred advanced
imaging services and help CMS address the increases in these services, the
Administrator of CMS should insert a self-referral flag on its Medicare Part B claims form
and require providers to indicate whether the advanced imaging services for which a
provider bills Medicare are self-referred or not.

Actions needed: HHS disagreed with our recommendation and, as of March 2021, had
no plans to take further action. CMS believes that a new checkbox on the claim form
identifying self-referral would be complex to administer and that providers may not
characterize referrals accurately. We maintain that such a flag on Part B claims would
likely be the easiest and most cost-effective way for CMS to identify self-referred
advanced imaging services and monitor the behavior of those providers who self-refer
these services.

Recommendation: In order to improve CMS's ability to identify self-referred advanced
imaging services and help CMS address the increases in these services, the
Administrator of CMS should determine and implement a payment reduction for self-
referred advanced imaging services to recognize efficiencies when the same provider
refers and performs a service.

Actions needed: HHS disagreed with our recommendation and, as of March 2021, had
no plans to take further action. CMS did not believe that a payment reduction would
address overutilization that occurs as a result of self-referral and that the agency’s
multiple procedure payment reduction policy for advanced imaging already captures
efficiencies inherent in providing multiple advanced imaging services by the same
physician. Further, CMS does not think a payment reduction for self-referred services
would be effective. We maintain that CMS should determine and implement a payment
reduction to recognize efficiencies for advanced imaging services referred and
performed by the same provider.

Recommendation: In order to improve CMS's ability to identify self-referred advanced
imaging services and help CMS address the increases in these services, the
Administrator of CMS should determine and implement an approach to ensure the
appropriateness of advanced imaging services referred by self-referring providers.

Page 33 GAO-21-527PR HHS Priority Recommendations
Actions needed: HHS initially stated that it would consider our recommendation, but as
of March 2021, the agency disagreed and had no plans to take further action. However,
we maintain that our recommendation is valid, in part because we found that providers
who began to self-refer advanced imaging services substantially increased their referral
of such services relative to other providers in 2010. To the extent that these additional
referrals are unnecessary, they pose an unacceptable risk for beneficiaries, particularly
in the case of computerized tomography (CT) services, which involve the use of ionizing
radiation. To implement our recommendation, CMS should determine and implement an
approach to ensure the appropriateness of advanced imaging services referred by self-
referring providers.

High-risk area: Medicare Program & Improper Payments

Director: Jessica Farb, Health Care

Contact information: FarbJ@gao.gov, 202-512-7114

Medicare Advantage: CMS Should Improve the Accuracy of Risk Score Adjustments for
Diagnostic Coding Practices. GAO-12-51. Washington, D.C.: Jan. 12, 2012.

Recommendation: To help ensure appropriate payments to MA plans, the
Administrator of CMS should take steps to improve the accuracy of the adjustment made
for differences in diagnostic coding practices between MA and Medicare fee-for-service.
Such steps could include, for example, accounting for additional beneficiary
characteristics, including the most current data available, identifying and accounting for
all years of coding differences that could affect the payment year for which an
adjustment is made, and incorporating the trend of the impact of coding differences on
risk scores.

Actions needed: HHS initially did not comment on our recommendation, but as of
March 2021, the agency concurred. CMS applied the statutory minimum adjustment to
MA payments for calendar year 2021. CMS made other changes to its methodology for
calculating the diagnostic coding adjustment (i.e., excluding diagnosis codes that were
differentially reported in Medicare fee-for-service and MA), which likely have improved
accuracy of the adjustment. However, a modified methodology that, for example,
incorporates more recent data and accounts for all relevant years of coding differences
would better ensure an accurate adjustment in future years. To fully implement our
recommendation, CMS needs to provide evidence of the sufficiency of its coding
adjustment or re-calculate its adjustment using an updated methodology. Until CMS
takes these steps, the agency is at continued risk of making excess payments to MA
plans.

High-risk area: Medicare Program & Improper Payments

Director: Jessica Farb, Health Care

Contact information: FarbJ@gao.gov, 202-512-7114

Page 34 GAO-21-527PR HHS Priority Recommendations
Health Information Technology and Cybersecurity

Cybersecurity: Agencies Need to Fully Establish Risk Management Programs and Address
Challenges. GAO-19-384. Washington, D.C.: July 25, 2019.

Recommendation: The Secretary of HHS should develop a cybersecurity risk
management strategy that includes the key elements identified in this report.

Actions needed: HHS concurred with our recommendation and, as of March 2021,
stated that its cybersecurity risk management strategy is undergoing internal review.
However, HHS did not provide a date that the review would be completed. To implement
our recommendation, HHS needs to ensure that its strategy includes key elements,
including a statement of risk tolerance and information on how the department intends to
assess, respond to, and monitor cybersecurity risks.

Recommendation: The Secretary of HHS should establish a process for conducting an
organization-wide cybersecurity risk assessment.

Actions needed: HHS concurred with our recommendation and, as of March 2021,
stated that a process for an organization-wide cybersecurity risk assessment is still
under development. However, the department did not provide an estimated date of
completion. To implement our recommendation, HHS needs to establish a risk
assessment process to allow the agency to consider the totality of risk derived from the
operation and use of its information systems.

High-risk area: Ensuring the Cybersecurity of the Nation

Director: Nick Marinos, Information Technology and Cybersecurity

Contact information: MarinosN@gao.gov, 202-512-9342

Critical Infrastructure Protection: Additional Actions Are Essential for Assessing Cybersecurity
Framework Adoption. GAO-18-211. Washington, D.C.: Feb. 15, 2018.

Recommendation: The Secretary of HHS, in cooperation with the Secretary of USDA,
should take steps to consult with respective sector partner(s), such as the sector
coordinating council, DHS, and National Institute of Standards and Technology (NIST),
as appropriate, to develop methods for determining the level and type of framework
adoption by entities across their respective sector.

Actions needed: HHS concurred with our recommendation and, as of March 2021,
stated that it would work with appropriate entities to assist in sector adoption. HHS
officials, in collaboration with NIST and a Joint Cybersecurity Working Group, developed
10 best practices (Health Industry Cybersecurity Practices) for the Healthcare and Public
Health Services sector—allowing stakeholders to identify how to use the framework. The
working group also discussed the challenges associated with measuring the use and
impact of the NIST framework. To fully implement our recommendation, HHS needs to
develop methods to determine the level and type of framework adoption. Implementing
our recommendation to gain a more comprehensive understanding of the framework's
use by critical infrastructure sectors is essential to the success of protection efforts.

High-risk area: Ensuring the Cybersecurity of the Nation

Page 35 GAO-21-527PR HHS Priority Recommendations
Director: Vijay D’Souza, Information Technology and Cybersecurity

Contact information: DSouzaV@gao.gov, 202-512-6769

Health Insurance Premium Tax Credit (PTC) Payment Integrity

Improper Payments: Improvements Needed in CMS and IRS Controls over Health Insurance
Premium Tax Credit. GAO-17-467. Washington, D.C.: July 13, 2017.

Recommendation: To improve annual reporting on PTC improper payments, control
activities related to eligibility determinations, and calculations of advance PTC, the
Secretary of HHS should direct the Administrator of CMS to annually report improper
payment estimates and error rates for the advance PTC program.

Actions needed: HHS concurred with our recommendation. In March 2021, CMS
reported that it intends to publish an advance PTC improper payment rate in CMS’s
fiscal year 2022 agency financial report for payments made by the federally-facilitated
exchange during benefit year 2020. CMS said that developing an advance PTC
improper payment rate for payments made by state-based exchanges will be a multi-
year process. To fully implement our recommendation, HHS needs to finalize and
implement its methodology for producing advance PTC improper payment rate estimates
and publicly report these estimates in its annual financial report.

High-risk area: Enforcement of Tax Laws

Director: Beryl H. Davis, Financial Management and Assurance

Contact information: DavisBH@gao.gov, 202-512-2623

(104780)

Page 36 GAO-21-527PR HHS Priority Recommendations
This is a work of the U.S. government and is not subject to copyright protection in the
United States. The published product may be reproduced and distributed in its entirety
without further permission from GAO. However, because this work may contain
copyrighted images or other material, permission from the copyright holder may be
necessary if you wish to reproduce this material separately.
The Government Accountability Office, the audit, evaluation, and investigative
GAO’s Mission arm of Congress, exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability of the
federal government for the American people. GAO examines the use of public
funds; evaluates federal programs and policies; and provides analyses,
recommendations, and other assistance to help Congress make informed
oversight, policy, and funding decisions. GAO’s commitment to good government
is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is
Obtaining Copies of through our website. Each weekday afternoon, GAO posts on its website newly
GAO Reports and released reports, testimony, and correspondence. You can also subscribe to
GAO’s email updates to receive notification of newly posted products.
Testimony
Order by Phone The price of each GAO publication reflects GAO’s actual cost of production and
distribution and depends on the number of pages in the publication and whether
the publication is printed in color or black and white. Pricing and ordering
information is posted on GAO’s website, https://www.gao.gov/ordering.htm.
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card, MasterCard,
Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.
Connect with GAO Subscribe to our RSS Feeds or Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.

Contact FraudNet:
To Report Fraud,
Website: https://www.gao.gov/about/what-gao-does/fraudnet
Waste, and Abuse in
Automated answering system: (800) 424-5454 or (202) 512-7700
Federal Programs
Orice Williams Brown, Managing Director, WilliamsO@gao.gov, (202) 512-4400,
Congressional U.S. Government Accountability Office, 441 G Street NW, Room 7125,
Relations Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800
Public Affairs U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, DC 20548

Stephen J. Sanford, Acting Managing Director, spel@gao.gov, (202) 512-4707
Strategic Planning and U.S. Government Accountability Office, 441 G Street NW, Room 7814,
External Liaison Washington, DC 20548

Please Print on Recycled Paper.

File and source

File: gao-21-527pr.pdf
Size: 440,808 bytes
SHA-256: 9f42784230b098765d7bfd32ff9ec69d7a6f9ce4bd36cfd4a4a0a581dff4cb22
Our copy: gao-21-527pr.pdf
Original: www.gao.gov