2017 Top Management and Performance Challenges 
 
Top Management and Performance Challenges Facing HHS: Introduction 
 
The Office of Inspector General (OIG) has identified 10 top management 
2017 Top Management and 
and performance challenges facing the Department of Health and 
Performance Challenges 
Human Services (HHS) as it strives to fulfill its mission to enhance the 
health and well-being of Americans by providing effective health and  1.  Ensuring Program Integrity 
in Medicare 
human services and by fostering sound, sustained advances in the 
sciences underlying medicine, public health, and social services.  These  2.  Ensuring Program Integrity 
top challenges arise across HHS programs and cover critical HHS  in Medicaid 
responsibilities that include delivering quality services and benefits, 
3.  Curbing the Opioid Epidemic 
exercising sound fiscal management, safeguarding public health and 
4.  Improving Care for 
safety, and enhancing cybersecurity.  The Department should be mindful 
Vulnerable Populations 
of these challenges and opportunities to address them as it undertakes 
its efforts to reimagine HHS as part of the Federal Governments  5.  Ensuring Integrity in 
comprehensive plan to reform Government.  Managed Care and Other 
  Programs Delivered Through 
Private Insurers  
HHS is responsible for a $1.1 trillion portfolio, and its programs impact 
the lives of virtually all Americans.  In this context, management and  6.  Improving Financial and 
performance challenges are plentiful and consequential.  To identify the  Administrative Management 
10 top challenges, we synthesized our oversight, risk analysis, data  and Reducing Improper 
analytics, and enforcement work.  The section on each challenge  Payments 
includes a short list of key OIG reports and other products related to  7.  Protecting the Integrity of 
that challenge; additional OIG work can be found on our webpage at  Public Health and Human 
https://oig.hhs.gov.   Services Grants  
 
8.  Ensuring the Safety of Food, 
Additionally, OIG maintains a list of recommendations it has made to 
Drugs, and Medical Devices 
address vulnerabilities detected in its audits and evaluations and tracks 
9.  Ensuring Program Integrity 
whether these recommendations have been implemented.  From among 
and Quality in Programs 
these, OIG identifies the top unimplemented recommendations that, if 
Serving American Indian and 
implemented, are likely to garner significant savings and improvements 
Alaska Native Populations 
in efficiency and effectiveness.1 
10. Protecting HHS Data, 
 
Systems, and Beneficiaries 
The top 10 challenges include four areas of priority for OIG: 
from Cybersecurity Threats 
  fighting opioid and prescription drug abuse, 
  protecting the health and safety of children served by HHS 
programs, 
  preventing improper payments and fraud in home-based services, and 
  partnering with States to enhance Medicaid program integrity. 
   
                                                           
1 See OIGs Compendium of Unimplemented Recommendations, May 2017.  Available at 
https://www.oig.hhs.gov/reports-and-publications/compendium/files/compendium2017.pdf  
  Top Management and Performance Challenges | 1  2017 Top Management and Performance Challenges 
 
Top Management Challenge #1: Ensuring Program Integrity in Medicare 
 
Why This Is a Challenge 
In fiscal year (FY) 2016, Medicare spent $679 billion and provided  Key Components of the Challenge 
health coverage to 56.8 million beneficiaries.  Spending under 
  Reducing improper payments  
Medicare is expected to increase significantly over time as a result of 
growth in the number of beneficiaries and increases in per capita    Combating fraud 
health care costs.  The 2017 Annual Report by Medicares Board of 
  Fostering prudent payment 
Trustees estimates that the Trust Fund for Medicare Part A (hospital  policies  
insurance) will be depleted by 2029.  It also projects that spending for 
  Implementing health care 
Medicare Part B (medical insurance) will grow by almost 7 percent over 
reforms and the promise of 
the next 5 years, outpacing the U.S. economy, which is projected to 
health information 
grow by 5 percent during that same time.  
technology (Health IT) 
 
In addition to challenges inherent in managing a program of this size, scope, and impact, HHS faces the 
added challenges of navigating within a rapidly evolving health care landscape and implementing 
significant legislative changes to Medicare.  The 21st Century Cures Act, which was signed into law in 
December 2016, and the Medicare Access and CHIP Reauthorization Act of 2015 (MACRA) incentivized 
changes to the ways health care is delivered and paid for and promoted the adoption and appropriate 
use of electronic health record (EHR) technology to share information across providers.  More broadly, 
the Department is navigating the transformation from a volume-based health care system to a value-
based, more accountable system. 
 
To ensure that Medicare effectively serves beneficiaries well into the future, HHS must foster sound 
financial stewardship and program integrity.  This includes protecting Medicare dollars from fraud, 
waste, and abuse; implementing prudent payment policies; and helping Medicare, providers, and 
beneficiaries achieve the goals of health care reforms and the promise of Health IT. 
 
Key Components of the Challenge 
Reducing Improper Payments.  Reducing improper payments to providers is a critical element in 
protecting Medicares financial integrity.  In FY 2016, the Centers for Medicare & Medicaid Services 
(CMS) reported an improper payment rate of 11 percent, corresponding to $41 billion, for Medicare 
Fee-for-Service, i.e., Medicare Parts A and B.  (For more information on measuring and reporting 
improper payment rates, see TMC #6.)  Some types of providers and suppliers pose heightened risk to 
the financial integrity of Medicare.  For instance, OIG and CMS have identified high rates of improper 
payments for home health care, hospice care, and certain hospital services.  Additionally, OIG estimated 
that Medicare improperly paid hundreds of millions of dollars for chiropractor services that did not meet 
Medicare requirements.    
 
  Top Management and Performance Challenges | 2  2017 Top Management and Performance Challenges 
 
Identifying and recovering overpayments remains a critical tool for 
reducing improper payments.  OIG has consistently found that  OIG Focus Area: Reducing 
Medicare contractors have difficulty identifying, collecting, and  Improper Payments for Home 
tracking overpayments.  For example, OIG found that in 2014  Health Services 
Medicare Administrative Contractors collected only 20 percent of 
The Medicare home health 
the overpayments that they sought to collect, based on referrals 
benefit has long been recognized 
from benefit integrity contractors.  Also, CMS is not using all tools 
as vulnerable to fraud, waste, and 
available to recover misspent funds.  For instance, Federal law 
abuse.  Home health care 
requires Medicare durable medical equipment (DME) suppliers and 
represents a significant 
home health agencies to obtain surety bonds.  Federal law also 
component of Medicare 
authorizes HHS to require surety bonds for additional high-risk 
expenditures.  In 2016, Medicare 
providers.  However, CMS has implemented this requirement only 
paid for more than 11,000 home 
for DME suppliers.   
health services, totaling 
 
approximately $18.24 billion.  In 
Combating Fraud.  Stopping fraud in Medicare is vital to 
FY 2018, OIG will prioritize work 
safeguarding health care resources and protecting beneficiaries.  
that identifies ways the 
OIG has identified common fraud schemes, such as billing for 
Department can reduce improper 
unnecessary services or services not provided; billing for more 
payments for home health by 
expensive services than needed or provided; paying kickbacks to 
reducing Medicare spending in 
recruiters, providers, and patients; and medical identity theft. 
geographic hot spots.  
Program areas susceptible to widespread fraud include home health, 
hospice services, DME, ambulance transportation, and clinical 
laboratory testing.  
 
To address fraud, CMS needs accurate information about the individuals and entities with which it does 
business, and it must take appropriate steps to avoid doing business withand exposing beneficiaries 
tountrustworthy actors or providers who are deemed ineligible to bill Medicare.  For example, shortly 
after CMS implemented enhanced provider enrollment screening, OIG found weaknesses in Medicare 
contractors administration of this process that could leave Medicare vulnerable to enrolling 
unscrupulous providers.    
 
Fostering Prudent Payment Policies.  Medicare should act as a prudent payer on behalf of taxpayers and 
beneficiaries by instituting economical payment policies.  However, in certain contexts, Medicare 
payment policies result in Medicare and beneficiaries paying more for care provided in certain settings 
than for the same care provided in other settings.  For example, Medicare could potentially save 
$4.1 billion over a 6-year period if swing-bed services at critical access hospitals were paid for at the 
same rates as at skilled nursing facilities (SNFs).  Medicare also pays hospitals different amounts for the 
same care depending on whether the hospital admits beneficiaries as inpatients or treats them as 
outpatients.  Beneficiaries coinsurance costs and eligibility for Medicare-covered SNF costs following 
discharge also vary depending on their status as hospital inpatients or outpatients, even if they receive 
the same care during their stay.    
 
Further, some payment policies create financial incentives that may drive up Medicare costs without 
improving care for beneficiaries.  For example, OIG found that Medicare payments to SNFs for therapy 
greatly exceeded SNFs costs for that therapy, creating incentives to bill for unnecessary therapy.  
Indeed, OIGs work showed that SNFs have increasingly billed for the highest levels of therapy even 
  Top Management and Performance Challenges | 3  2017 Top Management and Performance Challenges 
 
though the characteristics of their beneficiaries did not change.  In another example, OIG found that 
Medicare payments for hospice care to beneficiaries in assisted living facilities have risen much more 
quickly than payments for hospice care in other settings and that hospices have financial incentives to 
target beneficiaries in assisted living facilities.  In 2012, Medicare paid hospices about $1,100 per week 
per beneficiary receiving care in assisted living facilities, yet hospices typically provided fewer than 
5 hours of visits per week per beneficiary.   
 
Implementing Health Care Reforms and the Promise of Health IT.  Health care delivery has been 
evolving in recent years, driven most recently by major legislative changes such as those in the 21st 
Century Cures Act and MACRA.  MACRA revamped Medicares physician reimbursement system by 
creating the Quality Payment Program (QPP) to replace the Sustainable Growth Rate formula and 
Physician Quality Reporting System for most Medicare physicians and other clinicians.  The QPP 
introduces into physician reimbursement two mechanisms linked to quality and efficiency: (1) a Merit-
Based Incentive Payment System (MIPS) and (2) advanced alternative payment models (Advanced 
APMs).  Within this complex program, CMS must manage clinicians transition to MIPS and craft 
Advanced APMs.  In so doing, CMS must be mindful of administrative burden and the specialized needs 
of many small and rural providers.  Physicians must prepare for significant changes in reimbursement 
methodology, reporting, anddepending on circumstancesdelivery of care and workflow.   
 
CMS continues to manage a range of programs that address system reforms aimed at improving quality 
of care in Medicare and Medicaid and reduce costs.  These programs include, for example, the Medicare 
Shared Savings Program (MSSP) and a variety of models tested under the authority of the CMS 
Innovation Center.  Recent OIG work examining performance of the MSSP in its first 3 years concluded 
that accountable care organizations showed potential to improve quality and reduce costs, and that 
further study of successful strategies would be warranted to inform continued operation of the 
program.  Managing a broad range of changes to Medicare poses management challenges for CMS.  
New payment structures, business arrangements among providers, and incentives all give rise to risk-
management challenges.  In pursuing innovative models to improve the health care system, CMS must 
take steps to prevent programs and policies from having unintended consequences, such as misaligned 
incentives or abusive practices. 
 
Connecting those involved in health care, as well as in human services, is important in a value-driven 
health care system.  Leveraging the benefits of Health IT to ensure the appropriate flow of complete, 
accurate, timely, and secure information and to improve patient care is also critical.  HHS faces 
challenges in achieving a connected health system in which data flow freely, as appropriate.  These 
challenges include ensuring that Health IT companies and providers do not inappropriately block the 
flow of information; preventing inappropriate payments to participants who do not meet program 
requirements; ensuring that EHRs are not used as tools for fraud; encouraging adoption and use of 
Health IT by those not eligible for existing incentive programs; ensuring that patient safety benefits are 
realized; and encouraging the use of exchanged data.  To avoid potential gaps in policy and oversight 
that could undermine the promise of Health IT, HHS must ensure coordination among internal agencies 
and other Federal partners that have overlapping responsibility for various aspects of Health IT.  (For 
information on the cybersecurity challenges impacting Health IT, see TMC #10.) 
 
 
 
  Top Management and Performance Challenges | 4  2017 Top Management and Performance Challenges 
 
Progress in Addressing the Challenge 
Reducing Improper Payments.  CMS is taking action to reduce improper payments, including notifying 
providers and suppliers serving Medicare beneficiaries in Part A and Part B of their responsibility to 
report and return overpayments within 60 days of an overpayment being identified.  To ensure that 
items and services are provided in compliance with Medicare requirements, CMS has implemented prior 
authorization demonstrations, models, and programs that cover power mobility devices; repetitive, 
scheduled nonemergent ambulance transports and nonemergent hyperbaric oxygen; and certain other 
DME, prosthetics, orthotics, and supplies.  Additionally, CMS continues to make available and market 
educational products and messages about proper billing and documentation requirements to reduce 
improper payments.  
 
Combating Fraud.  OIG, HHS, and the U.S. Department of Justice have made substantial strides in 
fighting Medicare fraud.  From 2014 to 2016, the joint Health Care Fraud and Abuse Control (HCFAC) 
program returned $5 for every $1 invested.  In FY 2016, HCFAC-funded audits and investigations by OIG 
resulted in expected recoveries of $2.5 billion.  In July 2017, OIG, along with our State and Federal law 
enforcement partners, participated in the largest health care fraud takedown in history.  More than 400 
defendants in 41 Federal districts were charged with participating in fraud schemes involving about $1.3 
billion in false billings to Medicare and Medicaid.  Effectively leveraging data is critical to successfully 
combating fraud.  For example, HHS uses data to identify and prevent potential fraud via its Fraud 
Prevention System.  OIG uses data analytics to target and support our audits and investigations and to 
evaluate the scope and patterns of suspected fraud across the Medicare program.   
 
HHS has taken steps to enhance its use of program integrity tools.  For example, CMS reports that it 
requires inspectors for national site-visit contractors to complete annual CMS-approved training and 
testing, terminating those inspectors who do not do so.  CMS also reported that it is currently enhancing 
the training materials to provide specific guidance on determining whether facilities are operational.  
More broadly, CMS is in the process of unifying its program integrity oversight of Medicare Part A and 
Part B and Medicaid.  The new Unified Program Integrity Contractors will oversee these programs in 
distinct jurisdictions across the country as the contracts continue to be awarded.  Medicare billing and 
payments have decreased in certain services and geographic areas known for fraud risks.  For example, 
following law enforcement activities and CMS administrative actions, billing and payments for 
community mental health services declined significantly from 2009 to 2016 in fraud hot spots.  In 
addition, Medicare payments for home health services have decreased across the country by more than 
$1 billion per year since CMS capped outlier payments in 2010.  CMS reports that it has also continued 
to use its authority to suspend Medicare payments to providers during investigations based on 
a credible allegation of fraud or on the basis of reliable information that an overpayment exists, 
imposing 291 new payment suspensions during FY 2016. 
 
Additionally, the Department has fostered relationships among Federal and State agencies as well as 
between government agencies and the private sector.  These partnerships are valuable to the detection 
of fraud and to enforcement successes.  For example, public- and private-sector partners in the 
Healthcare Fraud Prevention Partnership (the Partnership), facilitated by CMS, share data and 
information to detect and prevent fraud.  The Partnership has completed several studies to address 
fraud, waste, and abusesuch as targeting false storefronts or phantom providersthat have yielded 
successful results for participating partners.  
 
  Top Management and Performance Challenges | 5  2017 Top Management and Performance Challenges 
 
In addition, CMS is replacing the Social Security number on Medicare cards with a new, randomly 
assigned unique identifier to help prevent fraud, combat identify theft, and safeguard taxpayer dollars.  
CMS reports that it will begin mailing new cards to Medicare beneficiaries in April 2018 to meet the 
statutory deadline for replacing all existing Medicare cards by April 2019.  CMS also recently started 
running fraud prevention advertisements that highlight the importance of safeguarding the Medicare 
card.   
 
Fostering Prudent Payment Policies.  HHS has been instituting changes to promote more prudent 
payment policies in some health care settings.  For example, Medicare is required by law to stop paying 
certain new hospital-owned, off-campus, provider-based departments that charge higher hospital 
rates than freestanding facilities that perform the same services for less.  CMS projects that this will save 
Medicare approximately $50 million in 2017.  CMS is also studying the extent to which Medicare 
payment rates for therapy at SNFs should be reduced by evaluating claims data and outlining potential 
new payment models for SNFs.  CMS has solicited public comments on options to consider in their 
research on SNF payment rates for therapy. 
 
The Medicare appeals process is experiencing a sustained increase in the number of appeals.  For 
example, the number of requests for an Administrative Law Judge hearing or review increased 1,222 
percent from FY 2009 through FY 2014.  This increase has created a significant backlog of appeals at the 
third and fourth levels of appeal.  The Benefits and Improvement and Protection Act of 2000 requires 
that Medicare appeals be adjudicated within 90 days of receipt.  The average processing time for each 
Medicare appeal is now 1,082 days.  As of June 30, 2017, HHS reported that OMHA has a backlog of 
approximately 580,000 Medicare appeals.   
 
HHS has developed a three-pronged strategy to address the backlog: 
 
1)  Invest new resources at all levels of appeal to increase adjudication capacity and implement new 
strategies to alleviate the current backlog. 
2) Take administrative actions to reduce the number of pending appeals and encourage resolution of 
cases earlier in the process. 
3) Propose legislative reforms that provide additional funding and new authorities to address the 
appeals volume. 
Implementing Health Care Reforms and the Promise of Health IT.  Through the QPP, CMS continues to 
make steady progress in implementing substantial payment reforms.  Since January 1, 2017, CMS 
reports that it has engaged more than 100 stakeholder organizations and over 47,000 people to raise 
awareness, solicit feedback, and help clinicians prepare for participation.  CMS plans to maintain its 
focus on the clinicians perspective as it develops IT systems that support and streamline clinician 
participation, crafts flexible and transparent MIPS policies, and facilitates participation in Advanced 
APMs. 
 
CMS is also developing additional Advanced APMs for the QPP, including recommendations received 
from the Physician-Focused Payment Model Technical Advisory Committee, which reviews and assesses 
stakeholder-submitted proposals for physician-focused payment models.  Additionally, CMS has issued 
  Top Management and Performance Challenges | 6  2017 Top Management and Performance Challenges 
 
a Request for Information from the public for the development and testing of new models through the 
Innovation Center, including those involving State programs and managed care. 
 
HHS continues developing programs and policies that foster the development, adoption, and effective 
use of Health IT to support the appropriate flow of complete, accurate, timely, and secure information, 
including in connection with Medicare.  HHS has sought to advance the national conversation about 
important Health IT issues to ensure that the potential benefits of Health IT investments are realized.2  
As of August 2017, more than 639,000 eligible professionals and hospitalsincluding critical access 
hospitalswere actively registered in the EHR incentive programs.3  HHS has also finalized a rule to 
implement the MACRA provisions that replaced the Medicare EHR Incentive Program for eligible 
professionals with a performance category within MIPS.  Additionally, HHS has issued an array of tools 
to empower patients to access their electronic health information, with the goal of improving patient 
outcomes, health care delivery, and social services.4  HHS is also in the process of implementing various 
provisions of the 21st Century Cures Act that will facilitate the appropriate flow of complete, accurate, 
timely, and secure data.    
 
What Needs To Be Done 
Reducing Improper Payments.  CMS should do more to reduce improper payments among the provider 
and supplier types and in the geographic locations that present a high risk to the financial integrity of 
Medicare.  This includes focusing on provider types that OIG and CMS have found to have extremely 
high rates of improper payments, such as chiropractors and home health providers, as well as high-risk 
hospital services.    
 
HHS should continue to address and resolve program integrity weaknesses that OIG has identified.  For 
example, CMS should implement the requirement for home health agencies to obtain surety bonds to 
ensure that Medicare can recoup at least some of its overpayments and to potentially deter ill-intended 
providers.  Additionally, CMS should prevent Medicare payments for services to incarcerated 
beneficiaries by developing and implementing a system that collects the information necessary 
to identify which beneficiaries are incarcerated.  
 
Combating Fraud.  Program integrity requires vigilance and sustained focus on preventing problems 
from occurring, quickly detecting problems that do occur, and swiftly addressing problems by holding 
                                                           
2 Three years ago, the Office of the National Coordinator for Health Information Technology (ONC) issued a document entitled 
"Connecting Health and Care for the Nation: A 10-Year Vision to Achieve an Interoperable Health IT Infrastructure 
(http://healthit.gov/sites/default/files/ONC10yearInteroperabilityConceptPaper.pdf).  Known as the 10-Year Vision Paper, 
this document describes plans to expand the sharing of information for health beyond EHRs and identifies privacy and security 
protections for health information as a building block for a nationwide, interoperable health information infrastructure.  More 
recently, ONC issued a document entitled Connecting Health and Care for the Nation: A Shared Nationwide Interoperability 
Roadmap, Draft version 1.0 (https://www.healthit.gov/sites/default/files/hie-interoperability/nationwide-interoperability-
roadmap-final-version-1.0.pdf), which supports the vision laid out in the 10-Year Vision Paper.  ONC has also issued a report to 
Congress on information blocking (https://www.healthit.gov/sites/default/files/reports/info_blocking_040915.pdf); a Health 
IT Safety Center Roadmap (http://www.healthitsafety.org/uploads/4/3/6/4/43647387/roadmap.pdf); and an updated Federal 
Health IT Strategic Plan for 20152020 (http://www.healthit.gov/sites/default/files/9-5-federalhealthitstratplanfinal_0.pdf). 
3 CMS, State Breakdown of Registration by Medicaid and Medicare Providers through August 31, 2017, October 2017.   
4 The Office of Civil Rights (OCR) issued a factsheet (http://www.hhs.gov/hipaa/for-
professionals/privacy/guidance/access/index.html); OCR and ONC released educational videos 
(https://www.healthit.gov/access); and ONC issued a patient engagement playbook (https://www.healthit.gov/playbook/pe/). 
  Top Management and Performance Challenges | 7  2017 Top Management and Performance Challenges 
 
any wrongdoers accountable and implementing appropriate risk-mitigation tools.  Although progress 
has been made in some vital areas, more must be done to safeguard the Medicare program from fraud, 
waste, and abuse.  CMS should fully employ available program integrity tools to prevent payment to 
fraudulent providers.  For example, CMS must continue improving its oversight and the performance of 
contractors implementing Medicare provider enrollment safeguards.  CMS should also make better use 
of the performance results within its Fraud Prevention System to refine and enhance its predictive 
analytic models.  
 
Fostering Prudent Payment Policies.  Certain reforms to the Medicare payment structures for hospitals, 
SNFs, and hospices may require legislative changes, and HHS should work with the Administration and 
Congress to consider policy options.  However, CMS can take some actions within existing authorities to 
mitigate financial risks and quality-of-care risks under the current systems.  For example, CMS should 
reform the payment policy for hospices to align payments to costs and address the financial incentives 
for hospices to target beneficiaries likely to have long stays.  CMS should also adjust Medicare payments 
to SNFs to eliminate any increases in payments for therapy that is unrelated to beneficiary 
characteristics and use data analytics to target oversight to SNFs that may be inappropriately billing for 
therapy. 
 
Health Care Reforms and the Promise of Health IT.  To continue managing the transition to the QPP, 
CMS must address a variety of issues impacting a diverse set of stakeholders.  Physician representatives 
have identified the following challenges: complex reporting and measurement; limited scope and 
availability of APMs; needs for provider education; daunting timelines; significant infrastructure 
investments needed to meet new business and reporting requirements; and administrative burden.  
CMS should allocate sufficient resources to ensure issuance of timely and clear program regulations and 
guidance that address physician representatives concerns.  In addition to supporting physician 
readiness, CMS must ensure that it has well-functioning, physician-oriented websites; fully operational 
back-end payment and data systems for the QPP; and robust program integrity systems to ensure the 
accuracy of submitted data.  CMS also needs to develop quality measures as outlined in the Quality 
Measure Development Plan and monitor for any unintended impacts that the quality measures have on 
Medicare beneficiaries. 
 
As CMS manages new Medicare models, it should continue to focus on program-integrity risks of those 
models and incorporate safeguards to reduce them.  It should also assess the effectiveness of the 
safeguards it employs, promptly correcting identified issues.  This is especially important for models that 
introduce new payment incentives, which might lead to new fraud schemes, and for models for which 
waivers of payment, coverage, or fraud and abuse laws may have been issued.  CMS should also ensure 
that models achieve their intended outcomes with regard to quality of care and efficiency.  Further, 
where applicable, CMS must clearly define actionable and meaningful quality measures, ensuring their 
reliability and accuracy.  
 
New models and value-based designs rely significantly on data, EHRs, and technology.  CMS must ensure 
that data collected and provided are complete, accurate, timely, and secure and that evolving 
technologies, such as telemedicine, achieve their intended results.  HHS must address barriers to the 
appropriate flow of complete, accurate, timely, and secure data among providers, beneficiaries, and 
other stakeholders.  To the extent that resources, cost, and quality performance are measured on the 
basis of Medicare Parts A and B claims data, CMS must ensure the soundness and reliability of such data.  
  Top Management and Performance Challenges | 8  2017 Top Management and Performance Challenges 
 
CMS should adopt sound record-retention and documentation practices for all models while being 
mindful of minimizing the burdens placed on those implementing the practices.  
 
Key OIG Resources 
  OIG Testimony, Medicare and Medicaid Program Integrity: Combating Improper Payments and 
Ineligible Providers, May 2016.   
(https://oig.hhs.gov/testimony/docs/2016/maxwell-testimony05242016.pdf) 
  OIG Online Portfolio: Home Health, February 2016. (https://oig.hhs.gov/reports-and-
publications/portfolio/home-health/index.asp) 
  OIG Report, The Medicare Payment System for Skilled Nursing Facilities Needs To Be Reevaluated, 
September 2015. (https://www.oig.hhs.gov/oei/reports/oei-02-13-00610.pdf) 
  OIG Report, Medicare Could Have Saved Billions at Critical Access Hospitals If Swing-Bed Services 
Were Reimbursed Using the Skilled Nursing Facility Prospective Payment System Rates, March 2015. 
(https://oig.hhs.gov/oas/reports/region5/51200046.asp)  
  OIG Report, Medicare Shared Savings Program Accountable Care Organizations Have Shown 
Potential for Reducing Spending and Improving Quality, August 2017. 
(https://oig.hhs.gov/oei/reports/oei-02-15-00450.asp)  
  OIG Report, The Centers for Medicare & Medicaid Services Could Improve Performance Measures 
Associated With the Fraud Prevention System, September 2017. 
(https://oig.hhs.gov/oas/reports/region1/11500509RIB.pdf) 
  OIG Report, Medicare Paid Hundreds of Millions in Electronic Health Record Incentive Payments That 
Did Not Comply With Federal Requirements, June 2017. 
(https://oig.hhs.gov/oas/reports/region5/51400047.pdf)  
   
  Top Management and Performance Challenges | 9  2017 Top Management and Performance Challenges 
 
Top Management Challenge #2: Ensuring Program Integrity in Medicaid  
 
Why This Is a Challenge 
With almost 69 million enrolled individuals, Medicaid serves more  Key Components of the Challenge 
enrollees than any other Federal health care program and represents one-
  Ensuring compliance with 
sixth of the national health care economy.  Medicaid is jointly 
fiscal controls  
administered and funded by CMS at the Federal level and by States.  CMS 
  Leveraging fraud prevention 
reported that combined Federal and State Medicaid expenditures were 
tools 
$574 billion for FY 2016.   
    Improving national Medicaid 
Effectively overseeing Medicaid continues to be a top management  data to support program 
challenge for HHS.  Challenges include longstanding program integrity  integrity 
vulnerabilities, including limitations in national Medicaid data that make it 
more difficult to detect and address improper payments and fraud.  CMS needs to partner with and 
support States in efficiently and effectively delivering high-quality Medicaid benefits to those who are 
eligible and protecting the programs and enrollees from fraud, waste, and abuse.  At the same time, 
CMS must also oversee States adherence to Medicaid rules governing eligibility, payment, program 
integrity, and FederalState cost-sharing.  In addition, the vast majority of Medicaid beneficiaries are 
enrolled in privately run managed care plans.  OIG has identified challenges to ensuring that these 
beneficiaries have access to high-quality care and that Medicaid funds are expended properly.  (For 
information on challenges specific to Medicaid managed care, see TMC #5.) 
 
Key Components of the Challenge 
Ensuring Compliance with Fiscal Controls.  Reducing improper payments to providers is a critical 
element in protecting the financial integrity of the Medicaid program.  In FY 2016, HHS reported an 
improper payment rate in the Medicaid program of 10.5 percent.  (For more information on HHS 
measurement and reporting of improper payments, see TMC #6.)  OIG audits have identified substantial 
improper payments to providers across a variety of Medicaid services, including school-based services, 
nonemergency medical transportation, targeted case management services, and personal care services 
(PCS).  OIG has also uncovered improper payments made on behalf of individuals ineligible for Medicaid, 
deceased beneficiaries, and beneficiaries with multiple Medicaid identification numbers.  
 
Drug manufacturers whose products are covered by Medicaid are required to report certain product 
and pricing information to CMS and pay rebates to States according to a statutorily defined formula.  
CMS and States share responsibility for ensuring that manufacturers pay all rebates to which the States 
and Federal Government are entitled.  Ensuring that manufacturers report product and pricing 
information correctly is a challenge for HHS.  Manufacturer misreporting can result in manufacturers 
underpaying rebates, which inappropriately increases Federal and State Medicaid costs.  For example, 
the drug manufacturer Mylan recently entered into a $465 million settlement with the United States to 
resolve allegations that it misclassified a drug in a way that led to underpaying Medicaid rebates.  
Overseeing States collection of manufacturer rebates is also a challenge for HHS.  OIG has identified 
instances in which States have not billed for or collected Medicaid rebates for physician-administered 
drugs, forgoing money owed to those States and the Federal Government. 
 
CMS also faces challenges in ensuring that States appropriately apply criteria for Medicaid eligibility and 
for waiver programs.  This is crucial to ensuring that CMS pays States the correct Federal share of 
  Top Management and Performance Challenges | 10  2017 Top Management and Performance Challenges 
 
Medicaid expenditures.  For States that opted to expand Medicaid coverage, CMS faces the added 
challenge of ensuring that States do not incorrectly categorize enrollees as newly eligible, which would 
inappropriately shift costs from the State to the Federal Government.  For example, OIG found that one 
States failure to verify Medicaid eligibility data resulted in $105 million in Federal payments for 
potentially ineligible beneficiaries.  OIG has also found that States have claimed unallowable and 
unsupported Federal Medicaid payments under waiver programs for home and community-based 
services (HCBS).  While waiver programs can offer important flexibilities for States, CMS is challenged to 
oversee the financial integrity of these varied programs. 
 
Further, the shared nature of Medicaid financing provides opportunities for States to shift costs to the 
Federal Government.  OIG has identified a number of State policies that may distort the Federal share of 
Medicaid expenditures, causing the Federal Government to pay an increased amount of Medicaid 
expenditures.  These include the improper use of provider taxes, intergovernmental transfers, 
supplemental payments, and inflated payment rates that may increase Federal funding that States 
receive.  Such policies may distort the statutorily defined Federal share of Medicaid expenditures and 
undermine the FederalState partnership. 
 
Leveraging Fraud Prevention Tools.  OIG has consistently found that there are opportunities to improve 
program integrity in Medicaid and better protect the program and its beneficiaries from fraud and harm 
by health care providers.  The most effective way to prevent provider fraud is to keep bad actors from 
enrolling in the program.  However, States are not screening high-risk providers with all of the tools at 
their disposal, including site visits and fingerprint-based criminal background checks.  OIG has also raised 
concerns about the varying standards, and in some cases minimal vetting, for Medicaid PCS providers 
and providers in group homes that furnish care to the elderly and persons with disabilities.  This leaves 
the Medicaid program vulnerable to financial fraud, and even more concerning, it leaves Medicaid 
beneficiaries vulnerable to abuse and neglect.  (For more information about quality of care and safety 
concerns for beneficiaries receiving personal care services, see TMC #4.)  Some States are not collecting 
and maintaining accurate ownership information about the Medicaid providers they are paying.  
Moreover, States do not currently have access to comprehensive data on providers that other States 
have terminated, leaving them vulnerable to enrolling unscrupulous providers already identified in 
another State. 
 
Improving National Medicaid Data to Support Program Integrity.  Data is an essential tool for detecting 
fraud, waste, and abuse; however, national Medicaid data have deficiencies that hinder timely and 
accurate fraud detection.  One concern is that not all States are submitting data to the national 
Medicaid database known as the Transformed Medicaid Statistical Information System (T-MSIS).  
Despite an original deadline of July 2014, as of September 2017, CMS reported that 48 States have 
started submitting T-MSIS data, and 40 of these States have submitted all required data, including 
historical data.  Getting all of the States to submit data to T-MSIS is not the only challenge.  Concerns 
about the completeness and reliability of the data remain. Data must be complete and reliable to 
be of use to States, CMS, and other stakeholders in making comparisons across all States and 
identifying nationwide trends and vulnerabilities.   
 
The lack of national Medicaid data hampers States, CMS, and other stakeholders ability to quickly 
detect potential fraud, waste, or quality concerns at the State, multi-State, and national levels.  
Unscrupulous providers may commit fraud or harm beneficiaries across multiple States.  Fraud schemes 
  Top Management and Performance Challenges | 11  2017 Top Management and Performance Challenges 
 
affecting multiple States are very difficult to detect without comprehensive national data.  Localized 
schemes can also be harder to detect without national data.  Utilization or spending patterns may not 
appear problematic until compared against another States experience or national averages.  
Recognizing such schemes in one State can alert other States to indicators of fraudulent or abusive 
practices that may be occurring in their jurisdiction.  This information can lead to referrals to State law 
enforcement agencies like the State Medicaid Fraud Control Units (MFCUs) or joint investigations across 
State lines.   
 
Progress in Addressing the Challenge 
Ensuring Compliance with Fiscal Controls.  With regard to improper payments to Medicaid providers, 
CMS has engaged with State Medicaid agencies to develop corrective action plans that address 
State-specific reasons for improper payments as a part of CMSs Payment Error Rate Measurement 
program, which measures Medicaid improper payments.  CMS has facilitated national best-practices 
calls to share ideas across States, provided State education through the Medicaid Integrity Institute, 
offered ongoing technical assistance, and provided additional guidance as needed to address the root 
causes of improper payments.  CMS has indicated that it continues to provide guidance to States on 
their procedures for calculating and claiming costs under waiver programs for HCBS.   
 
CMS has also taken actions to curtail inappropriate State financing mechanisms that inflate the Federal 
share of Medicaid costs.  For example, CMS issued guidance to State Medicaid directors and State health 
officials to clarify the rules for health care provider taxes.   
  
Leveraging Fraud Prevention Tools.  CMS has issued guidance, 
known as the Medicaid Provider Enrollment Compendium, to assist  OIG Focus Area: Partnering With 
States in strengthening their provider screening and enrollment  MFCUs to Combat Medicaid Fraud 
processes.  In particular, CMSs guidance allows States to rely on 
Medicare provider screening results for providers who participate in  MFCUs are key partners in battling 
both Medicare and Medicaid.  CMS also worked with the Federal  fraud, waste, and abuse in Medicaid.  
Bureau of Investigation to issue guidance to help States implement  OIG administers grants to MFCUs, 
fingerprint-based criminal background checks for high-risk providers.   the State agencies authorized to 
In addition, beginning in 2018 the 21st Century Cures Act will require  fight waste, fraud, and abuse and to 
States, upon terminating a provider from the Medicaid program, to  prevent patient neglect and 
submit certain data to CMSs database of terminated providers,  exploitation.  OIG also partners with 
which will improve the effectiveness of this database.  In 2016, CMS  MFCUs in joint investigations and 
published a Request for Information in seeking stakeholder input on  provides them technical assistance.  
policy options to address program integrity concerns in personal  In FY 2018, OIG will continue to 
care and other home and community-based services.  Overall,  prioritize work that maximizes the 
Medicaid fraud-enforcement efforts by OIG and the MFCUs, which  effectiveness of MFCUs.  
OIG oversees, have continued to hold wrongdoers accountable,   
recover stolen taxpayer dollars, and send a strong message to deter 
would-be fraudsters.  In FY 2016, MFCUs reported more than 1,500 convictions, nearly 1,000 civil 
settlements and judgments, and almost $1.9 billion in criminal and civil recoveries. 
 
Improving National Medicaid Data to Support Program Integrity.  CMS continues to work with all State 
Medicaid agencies to submit complete, accurate, and timely data to T-MSIS.  According to CMS, as of 
September 2017, the number of States submitting any T-MSIS data had increased to 48, representing 94 
  Top Management and Performance Challenges | 12  2017 Top Management and Performance Challenges 
 
percent of the total Medicaid population, and CMS indicated that it expects all States to submit T-MSIS 
data by the end of 2017.  CMS also reported efforts underway to improve T-MSIS data quality, including 
working with States to improve the quality of their data submissions and convening a technical expert 
panel to make recommendations to improve T-MSIS data quality.  In addition, CMS reported that it is 
working to develop research-ready T-MSIS analytic files to make the data more consumable by a wide 
array of users. 
 
What Needs To Be Done 
The Medicaid program can and should be designed to minimize fraud, waste, and abuse by following 
core program integrity principles.  Better protection of Medicaid now and in the future requires 
continual vigilance to keep up with changes in the environment and constantly evolving fraud schemes. 
 
Ensuring Compliance With Fiscal Controls.  CMS should continue to engage with State Medicaid 
agencies to develop corrective action plans and provide specific guidance to States regarding services 
and benefits most vulnerable to improper payments.  OIG is currently assessing CMSs oversight of drug 
classifications and other aspects of the Medicaid drug rebate program and identifying opportunities for 
improvement as needed.  CMS should work with States to ensure that they are applying Medicaid 
eligibility criteria correctly and should conduct sufficient oversight to prevent and detect any 
inappropriate assignment of enrollees to the higher Federal matching rate.  In addition, CMS should 
closely review State Medicaid plans and plan amendments to identify any potentially inappropriate 
cost-shifting from States to the Federal Government.   
 
Leveraging Fraud Prevention Tools.  CMS should continue to work with States to leverage fraud-
prevention tools.  Providing guidance was an important step.  CMS should also continue to work directly 
with those States thatdespite the guidancehave not yet implemented tools like site visits or 
fingerprint-based criminal background checks for high-risk providers.  In addition, CMS should develop a 
central repository or one-stop shop with provider information that all States and Medicare can use.  
This could reduce data-collection duplication and burdens on States and providers and improve the 
completeness and accuracy of the data available to all of these programs.   
 
Improving National Medicaid Data to Support Program Integrity.  CMS and the States need to make 
complete, reliable, and timely T-MSIS data a management priority.  In doing so, CMS should establish 
and adhere to a deadline for when T-MSIS data will be available for program analysis and other 
management functions.  CMS should monitor States progress toward complete, reliable, and timely 
data submissions and use its available enforcement authorities when appropriate.   
 
Key OIG Resources 
  OIG Testimony, Combating Waste, Fraud, and Abuse in Medicaids Personal Care Services 
Program, May 2017. (https://oig.hhs.gov/testimony/docs/2017/grimm-testimony-05022017.pdf) 
  OIG Testimony, Medicaid Oversight: Existing Problems and Ways to Strengthen the Program, 
January 2017. (https://oig.hhs.gov/testimony/docs/2017/maxwell-testimony01312017.pdf) 
  OIG Testimony, Examining Medicaid and CHIPs Federal Medical Assistance Percentage, 
February 2016. (https://oig.hhs.gov/testimony/docs/2016/hagg-fmap-hearing-02-05-2016.pdf)  
  OIG Report, Providers Terminated from One State Medicaid Program Continued Participating in 
Other States, August 2015. (https://oig.hhs.gov/oei/reports/oei-06-12-00030.pdf) 
  Top Management and Performance Challenges | 13  2017 Top Management and Performance Challenges 
 
  OIG Report, T-MSIS Data Not Yet Available for Overseeing Medicaid, June 2017.  
(https://oig.hhs.gov/oei/reports/oei-05-15-00050.pdf) 
  Top Management and Performance Challenges | 14  2017 Top Management and Performance Challenges 
 
Top Management Challenge #3: Curbing the Opioid Epidemic 
Why This Is a Challenge 
Opioid abuse and related overdoses are a national epidemic.  
Key Components of the Challenge 
According to the Centers for Disease Control and Prevention 
(CDC), more than 33,000 people died in 2015 from    Addressing inappropriate 
prescribing of opioids 
overdoses involving opioids, both prescription and illicit, an 
  Combating fraud and 
increase from approximately 28,000 deaths in 2014.5  Yet 
diversion of prescription 
despite the increase in the number of people suffering from 
opioids and potentiator drugs   
opioid use disorder, only about one-fifth of individuals receive 
  Addressing inadequate access 
specialty treatment, and even fewer receive medication-assisted 
to treatment 
treatment (MAT). 6, 7 
  Addressing misuse of grant 
  funds 
Across multiple operating divisions and programs, HHS has many    Fighting fraud by treatment 
opportunities to help curb this epidemic.  Medicare provides  providers of opioid use 
prescription drug coverage for 41 million Part D beneficiaries  disorder  
and Medicaid for almost 69 million beneficiaries.  The U.S. Food 
and Drug Administration (FDA) oversees the approval and safe use of prescription drugs.  Agencies such 
as the National Institutes of Health (NIH), the Substance Abuse and Mental Health Services 
Administration (SAMHSA), the Health Resources and Services Administration (HRSA), and the CDC award 
grants to support health care providers, researchers, and States in their efforts to combat the epidemic. 
 
Key Components of the Challenge 
Addressing Inappropriate Prescribing of Opioids.  OIG found that many patients in Medicare Part D 
received concerning amounts of opioids in 2016.  Specifically, half a million Medicare Part D 
beneficiaries (without a cancer diagnosis and not in hospice care) received opioids with an average daily 
morphine equivalent dosing (MED) greater than 120 mg for at least 3 months, exceeding the 90-mg 
MED level that CDC recommends staying below.  While many beneficiaries receive opioids to treat 
legitimate health needs, these numbers raise concern that a significant number of beneficiaries may be 
receiving levels of prescribed opioids that are medically unnecessary and unsafe.  OIG has also found 
that FDA lacks comprehensive data to assess whether its Risk Evaluation and Mitigation Strategies 
(REMS), set up to improve drug safety, are indeed meeting their goal.  FDA has asked drug companies to 
establish a number of such programs for various drugs, including opioids; however, REMS performance 
remains a concern.   
                                                           
5 Rose A. Rudd, Puja Seth, Felicita David, and Lawrence Scholl, Increases in Drug and Opioid-Involved Overdose 
Deaths  United States, 20102015, Morbidity and Mortality Weekly Report (MMWR), Centers for Disease Control 
and Prevention ePub, December 30, 2016.  Available at 
https://www.cdc.gov/mmwr/volumes/65/wr/mm655051e1.htm. 
6 National Institutes of Health, Substance Abuse and Mental Health Services Administration National Survey on 
Drug Use and Health 2016 Detailed Tables, 2017.  Available at 
https://www.samhsa.gov/data/sites/default/files/NSDUH-DetTabs-2016/NSDUH-DetTabs-2016.htm. 
7 Anjalee Sharma, et al., Update on Barriers to Pharmacotherapy for Opioid Use Disorders, Current Psychiatry 
Reports 19(6): 35, 2017.  Available at https://link.springer.com/article/10.1007%2Fs11920-017-0783-9. 
 
  Top Management and Performance Challenges | 15  2017 Top Management and Performance Challenges 
 
 
Combating Fraud and Diversion of Prescription Opioids and Potentiator Drugs.  Prescription opioids 
indicated to treat pain and those indicated to treat opioid use disorder (buprenorphine in particular) are 
at high risk of diversion.  Also at risk for diversion are potentiator drugs, which exaggerate euphoria 
when combined with opioids and escalate the potential for opioid overdose.  These nonopioid drugs can 
be prescription or over-the-counter medications and may be indicated to treat conditions very different 
from pain, such as HIV, psychiatric disorders, and even colds.  OIG and State MFCUs have growing 
caseloads of Medicare and Medicaid drug-diversion investigations involving opioids and potentiator 
drugs.   
 
Addressing Inadequate Access to Treatment.  According to SAMHSA, 1.9 million people had disorders 
related to their nonmedical use of prescription pain relievers in 2015.8  Medicare and Medicaid 
beneficiaries make up a large proportion of those with opioid use disorders.9  With such high numbers of 
individuals in need, access to treatment of overdose and underlying opioid use disorders is a priority.  
Naloxone, an effective treatment for opioid overdoses, may not be readily available in an overdose 
emergency, and challenges exist in ensuring that people have access to quality treatment programs.  In 
particular, an estimated 80 percent of people do not receive treatment for their underlying opioid use 
disorder.10   
 
Addressing Misuse of Grant Funds.  Through Federal grants, HHS commits substantial financial 
resources to combat the opioid epidemic.  HHS awards grants for a range of efforts such as furthering 
pain management research; expanding access to opioid treatment programs; improving data access and 
quality to assist with prevention efforts; and providing education and training to health care 
practitioners.  Ensuring that these funds are used for their intended purposes is paramount, and HHS 
faces challenges in protecting the integrity of grant programs.  For instance, OIG has identified cases in 
which individuals falsified grant applications and used for personal gain grant funds that were intended 
to fight drug abuse. 
 
Fighting Fraud by Treatment Providers of Opioid Use Disorder.  Fraud committed by providers of 
treatment for opioid use disorder is a growing concern.  Fraud schemes include the delivery of mental 
health services by unqualified providers and billing Medicare or Medicaid for medically unnecessary lab 
tests, such as urine drug screens recurring at a higher frequency than what is reasonable for that test.  
Such schemes may also involve billing for medically unnecessary drugs such as opioids or expensive 
specialty medications.  Fraud in these settings can put beneficiaries at risk and diverts scarce funds 
needed to meet growing demand for legitimate treatment. 
 
                                                           
8 SAMHSA, Behavioral Health Trends in the United States: Results from the 2014 National Survey on Drug Use and 
Health, 2015.  Available at https://www.samhsa.gov/data/sites/default/files/NSDUH-FRR1-2014/NSDUH-FRR1-
2014.pdf. 
9 According to CMS, more than 6 of every 1,000 Medicare beneficiaries and 8.7 of every 1,000 Medicaid 
beneficiaries have an opioid use disorder.  See Centers for Medicare & Medicaid Services (CMS), Opioid Misuse 
Strategy 2016, January 5, 2017.  Available at https://www.cms.gov/Outreach-and-
Education/Outreach/Partnerships/Downloads/CMS-Opioid-Misuse-Strategy-2016.pdf. 
10 National Institutes of Health, National Institute on Drug Abuse, Drug Facts: Nationwide Trends, June 2015.  
Available at https://www.drugabuse.gov/publications/drugfacts/nationwide-trends. 
 
  Top Management and Performance Challenges | 16  2017 Top Management and Performance Challenges 
 
Progress in Addressing the Challenge 
Effectively coordinating efforts across HHS programs and operating divisions and prioritizing initiatives 
are key to combating this complex public health emergency.  To improve coordination and to focus 
efforts, the Department established the HHS Opioid Strategy, which aims to improve access to 
treatment and recovery services and support alternative improvements in pain management.  Many 
operating divisions have also established their own strategic plans to help fight the opioid crisis.  
  
Addressing Inappropriate Prescribing of Opioids.  In 
recognition that prescribing practices can exacerbate the 
OIG Focus Area: Protecting Beneficiaries 
misuse and abuse of prescription opioids, CDC has issued 
From Opioid and Prescription Drug 
Guideline for Prescribing Opioids for Chronic Pain to aid 
Abuse 
providers in treating chronic pain outside of active cancer 
treatment, palliative care, and end-of-life care.  In turn, FDA 
OIG prioritizes program enforcement and 
has been expanding its efforts to ensure safe use of opioids 
oversight activities that protect 
through its REMS authorities and encouraging the efforts of 
beneficiaries from prescription drug 
pharmaceutical companies to develop formulations of 
abuse.  Leveraging its enforcement 
opioids that are more resistant to abuse.  (For more 
authorities, OIG worked with other law 
information about FDAs roles in overseeing prescription drug 
enforcement partners to charge 120 
safety, see TMC #8.) 
defendants with opioid-related crimes 
 
during a national takedown in July 2017.  
Combating Fraud and Diversion of Prescription Opioids and 
So far this year, OIG has also issued 
Potentiator Drugs.  To identify and address suspected fraud, 
exclusion notices to 295 providers for 
CMS conducts data analysis through its National Benefit 
conduct related to opioid diversion and 
Integrity Medicare Drug Integrity Contractor to identify 
abuse.  OIGs oversight work will 
outliersincluding those related to opioid prescriptions
continue to review issues related to 
and to make referrals for investigation.  For Medicaid, CMS 
opioids in HHS programs. 
compiles and publishes information that it collects from State 
 
Medicaid agencies and Medicaid MCOs about their drug 
utilization review program and processes, which could include employing Prescription Drug Monitoring 
Programs (PDMP) requirements and the use of lock-in programs, which restrict at-risk beneficiaries to 
particular pharmacies or prescribers.  CMS officials reported developing a substance use disorder (SUD) 
tool for CMSs and State Medicaid agencies use with T-MSIS data.  This SUD tool will provide a standard 
method of assessing the care and treatment of Medicaid beneficiaries with SUD using a common data 
set.  Through grants issued by CDC and SAMHSA, HHS has also been supporting States development of 
PDMPs. 
 
CMS also reported taking steps in the Part D program to address overutilization of potentiator drugs 
that are often abused in conjunction with opioids.  These steps included encouraging Part D sponsors in 
its 2017 Call Letter to evaluate their claims data and use drug utilization management tools to help 
address the concurrent use of opioids and benzodiazepines.  According to CMS, it started reporting 
concurrent opioid and benzodiazepine use to Part D sponsors in October 2016.  CMS reported to OIG 
that it expects Part D sponsors to consider benzodiazepine use within their opioid overutilization review 
process and include this information in their discussions with prescribers. 
 
Addressing Inadequate Access to Treatment.  To improve access to the overdose treatment naloxone, 
FDA expedited approval of a nasal spray version of that drug.  HHS has also been working to improve 
  Top Management and Performance Challenges | 17  2017 Top Management and Performance Challenges 
 
access to treatment for opioid use disorders.  The Medication Assisted Treatment for Opioid Use 
Disorders final rule, published in July 2016, expands access to medication-assisted treatment services by 
allowing qualifying practitioners to request approval to treat up to 275 patients at a time with 
buprenorphine.  HHS has also been implementing provisions of the Comprehensive Addiction and 
Recovery Act (CARA) of July 2016 that aim to increase access to addiction treatment services by 
expanding the buprenorphine-prescribing privileges of select providers, including nurse practitioners 
and physician assistants.   
 
In addition, HHS has been supporting expansion of treatment options through a series of grant 
programs.  Most of SAMHSAs $500 million authorized under the 21st Century Cures Act for FY 2017 has 
been granted to support increased access to treatment.  In addition, much of HRSAs $94 million in grant 
funding for community health centers focused on treatment servicesincluding medication-assisted 
treatmentfor opioid use disorder. 
 
Addressing Misuse of Grant Funds.  Thus far, HHS efforts to address grant fraud have not been specific 
to opioids, but rather extend broadly to all types of grants.  (For more information on HHS efforts to 
prevent grant fraud, see TMC #7.)   
 
Fighting Fraud by Treatment Providers of Opioid Use Disorder.  HHS published a final rule in September 
2016 that outlined annual reporting requirements for providers with increased patient limits for 
medication-assisted treatment using buprenorphine, including reporting on diversion control plans.  (For 
more information about overall HHS efforts to prevent health care fraud in Medicare and Medicaid, see 
TMCs #1, #2, and #6.)   
 
What Needs To Be Done 
In addition to deploying the grant funding for opioid use disorder treatment authorized under the 
21st Century Cures Act, HHS should continue implementing new authorities under CARA that would help 
address the opioid epidemic.  For example, CARA established new authority for Medicare Part D plan 
sponsors to develop lock-in programs, which help to protect beneficiaries from the harm of 
inappropriate utilization and protect the program from drug diversion.  In addition, as discussed with 
OIG, CMS should continue to monitor available literature, clinical guidelines, information from other 
stakeholders, and internal data to proactively identify other opioid potentiators that may increase the 
risk of overdose when used together with opioids.  Once identified, CMS should raise awareness on 
emerging trends and expand its policy and the Overutilization Monitoring System to include these drugs. 
 
As access to treatment for opioid use disorders is expanded, HHS must also ensure that treatment 
programs and providers comply with program requirements.  For example, in 2016 SAMHSA finalized 
regulations to increase access to providers of treatment for opioid use disorder.  SAMHSA will need to 
oversee compliance with all these requirements.  Likewise, SAMHSA will need to oversee the integrity 
and effectiveness of $1 billion in funding for the State Targeted Response to the Opioid Crisis Grants.   
 
In addition, HHS should improve access to data about drug utilization and prescribing patterns.  CMS 
should strive toward the development of complete and reliable national Medicaid data to enhance 
fraud-fighting efforts through better detection of questionable billing of opioids and potentiator drugs.  
(For more information on challenges for Medicaid, see TMC #2.)  FDA should continue to evaluate the 
effectiveness of its opioids REMS programs and adjust them accordingly.  Relevant HHS agencies should 
  Top Management and Performance Challenges | 18  2017 Top Management and Performance Challenges 
 
also continue supporting efforts to integrate PDMP data into the broader health care system, as these 
data enable providers to assess a patients risk for abuse and misuse.  In doing so, HHS will need to 
ensure appropriate safeguards to protect the privacy and security of these data.  (For more information 
on data security issues, see TMC #10.) 
 
In August 2017, the Presidents Commission on Combating Drug Addiction and the Opioid Crisis made a 
number of recommendations.11  To the extent that these recommendations are followed, they may 
further expand HHS efforts to combat this crisis.  OIG calls for HHS to include appropriate program 
integrity safeguards as it expands and implements new programs to attempt to curb the opioid 
epidemic.    
 
Key OIG Resources 
  OIG Data Brief, Opioids in Medicare Part D: Concerns About Extreme Use and Questionable 
Prescribing, July 2017. (https://oig.hhs.gov/oei/reports/oei-02-17-00250.pdf) 
  OIG Data Brief, High Part D Spending on Opioids and Substantial Growth in Compounded Drugs 
Raise Concerns, June 2016. (https://oig.hhs.gov/oei/reports/oei-02-16-00290.pdf) 
  OIG Data Brief, Questionable Billing and Geographic Hotspots Point to Potential Fraud and Abuse in 
Medicare Part D, June 2015. (https://oig.hhs.gov/oei/reports/oei-02-15-00190.pdf) 
  OIG Report, Early Outcomes Show Limited Progress for the Transformed Medicaid Statistical 
Information System, September 2013. (https://oig.hhs.gov/oei/reports/oei-05-12-00610.pdf) 
  OIG Fact Sheet, 2017 National Health Care Fraud Takedown, July 2017.  
(https://oig.hhs.gov/newsroom/media-materials/2017/2017HealthCareTakedown_FactSheet.pdf 
  OIG Report, FDA Lacks Comprehensive Data To Determine Whether Risk Evaluation and Mitigation 
Strategies Improve Drug Safety, February 2013.   
(https://oig.hhs.gov/oei/reports/oei-04-11-00510.pdf) 
   
                                                           
11 Commission on Combating Drug Addiction and the Opioid Crisis, Draft Interim Report, July 31, 2017.  Available at 
https://www.whitehouse.gov/sites/whitehouse.gov/files/ondcp/commission-interim-report.pdf. 
 
  Top Management and Performance Challenges | 19  2017 Top Management and Performance Challenges 
 
Top Management Challenge #4: Improving Care for Vulnerable Populations 
 
Why This Is a Challenge 
HHS programs provide critical health and human services to many  KKeeyy  CCoommppoonneennttss  ooff  tthhee  CChhaalllleennggee  
vulnerable populations, including individuals who receive nursing home 
   AAddddrreessssiinngg  ssuubbssttaannddaarrdd  
care, group home care, hospice care, or home and community-based 
nnuurrssiinngg  hhoommee  ccaarree  
services (HCBS), as well as children from low-income families in foster 
   RReedduucciinngg  pprroobblleemmss  iinn  hhoossppiiccee  
care.  HHS must ensure that these individuals have access to and receive 
ccaarree  
high-quality services and are protected from abuse or neglect.   
     MMiittiiggaattiinngg  rriisskkss  ttoo  pinadtiiveindtusa ilns  
HHS faces challenges in serving these vulnerable populations.  For  hreocmeiev-i nagn dh ocmome manudn ity-based 
example, many of these services are delivered through programssuch  sceormvimceusn  i ty-based services   
as Medicaid, the National Aging Network, and the Child Care and     EEnnssuurriinngg  aacccceessss  ttoo  ssaaffee  aanndd  
Development Fundthat are not operated directly by HHS.  As such,  aapppprroopprriiaattee  sseerrvviicceess  ffoorr  
HHS has less transparency into the programs and less direct influence.    cchhiillddrreenn  
(For more information about limitations in Medicaid data, see TMC #2.)  
Furthermore, even where HHS has direct oversight levers, such as through the survey and certification 
process for nursing homes, OIGs work shows that the Department has not always taken action to 
ensure that deficiencies are corrected. 
 
Key Components of the Challenge 
Addressing Substandard Nursing Home Care.  Nursing facilities continue to experience problems 
ensuring quality of care and safety for people residing in them.  OIG identified instances of substandard 
care causing preventable adverse events, finding that an estimated 22 percent of Medicare beneficiaries 
had experienced an adverse event during their nursing home stay.  OIG has also raised concerns about 
the potentially inappropriate use of powerful antipsychotic drugs for nursing home residents.  In 
addition, CMS has often failed to require nursing facilities to correct all deficiencies identified during the 
survey process, and OIG has identified nursing home staff who do not meet relevant licensure 
requirements.   
 
Further, OIG continues to raise concerns about nursing home residents being at risk of abuse and 
neglect.  In some instances, nursing home care is so substandard that providers may have liability under 
the False Claims Act.  OIG recently alerted CMS to instances of nursing facilities failures to identify and 
report abuse and neglect as required and deficiencies in procedures for enforcing these requirements.  
OIG alerted CMS about 134 Medicare beneficiaries treated in 2015 and 2016 for injuries that may have 
been caused by abuse or neglect while the beneficiary was receiving care in a nursing home. 
 
Reducing Problems in Hospice Care.  Hospice care provides comfort for terminally ill beneficiaries and 
supports family and other caregivers.  OIG observed problems in hospice care including inadequate 
oversight of certification surveys and staff licensure requirements, care planning failures, inadequate 
medical and nursing care, and fraudulent enrollments undertaken without beneficiary consent and 
enrollment of beneficiaries who were not terminally ill.  OIG found that some hospices billed Medicare 
for inappropriate general inpatient care (the second highest and most expensive level of hospice care), 
such as billing for care that was not provided and beneficiaries receiving care they did not need.  
  Top Management and Performance Challenges | 20  2017 Top Management and Performance Challenges 
 
Furthermore, OIG found that some hospice care plans lacked 
OIG Focus Area: Protecting the Health 
required information, and our review identified numerous 
and Safety of Children in HHS Programs 
instances of quality-of-care problems in the hospice general 
inpatient care setting.  Protecting the health and safety of 
  children receiving childcare through 
Mitigating Risks to Individuals Receiving HCBS.  HCBS, including  HHS programs is a top priority for OIG.  
personal care services (PCS), respite care, home-delivered meals,  Ensuring that Federal funds for these 
and many other services help beneficiaries stay in their  programs serve their intended purposes 
communities and avoid costly and sometimes nonpreferred  and are not mismanaged or stolen is 
institutional care.  PCS, a critical component of HCBS, encompass  also crucial.  Specifically, OIG is 
all HCBS populations, including people with mental disorders and  prioritizing work that identifies ways in 
physical, cognitive, or developmental disabilities.  Without effective  which HHS can improve program 
PCS, the goal of integrating beneficiaries into their communities  integrity for the Child Care 
may be unattainable.  These programs help promote beneficiary  Development Fund.  We will focus on 
choice and preferences, but vulnerabilities persist in the areas of  internal controls; program 
payment, compliance, and quality.  OIG and MFCUs have  effectiveness; and prevention of fraud, 
uncovered numerous instances of PCS fraud and abuse or neglect  waste, and abuse in this grant program. 
causing serious harm to HCBS recipients.  Some beneficiaries may  This initiative will include monitoring 
be unable to report the abuse and neglect.  In some cases, a  States implementation of criminal 
beneficiarys guardian may collude with an unscrupulous PCS  background checks for childcare 
attendant.  In one such case, the parents of a teenage boy with  providers at least every 5 years.   
disabilities accepted kickbacks from a PCS attendant who for many 
years billed Medicaid for thrice-weekly home visits but did not 
provide the boy with desperately needed services.  PCS claims often do not identify the dates of service 
or the PCS attendant who provided the service, which creates additional challenges for effective 
oversight and enforcement.  
 
Many Medicaid beneficiaries with developmental disabilities and older adults use group-home settings 
to continue living in their communities.  However, reports of abuse and even death in such settings raise 
significant concerns.  OIG has found that State agency and group-home staff lack adequate training to 
correctly identify and report critical incidents and reasonable suspicions of abuse or neglect. 
 
Ensuring Access to Safe and Appropriate Services for Children.  In partnership with the States, HHS 
operates Medicaid and the Childrens Health Insurance Program (CHIP) to provide medical care for 
nearly 36 million children, including children who are from financially needy families, reside in foster 
care, and have disabilities.  The Child Care and Development Fund (CCDF) supports childcare for about 
1.4 million children from low-income families while their guardians work or attend school.  Ensuring that 
these beneficiaries enjoy access to safely delivered, high-quality services remains a longstanding 
challenge for HHS.  OIG has identified vulnerabilities related to CCDF childcare providers who received 
neither a verified background check nor the necessary training.   
 
Ensuring access to appropriate and high-quality care for children in foster care and those covered by 
Medicaid continues to be a challenge.  OIG reviews revealed that many such children do not receive 
required medical or dental services.  Further, OIG has raised quality-of-care concerns related to 
inappropriate prescribing of antipsychotic drugs for children in foster care and covered by Medicaid.  
  Top Management and Performance Challenges | 21  2017 Top Management and Performance Challenges 
 
Additionally, OIG found that three out of four children covered by Medicaid did not receive all required 
dental services, with one in four children failing to see a dentist at all. 
 
The Department also faces challenges caring for children who enter the United States unaccompanied 
by a parent or guardian.  The Office of Refugee Resettlement, within the Administration for Children and 
Families (ACF), provides housing, medical care, and other services for unaccompanied alien children 
(UAC) and is responsible for placing many UAC with appropriate sponsors pending legal proceedings to 
resolve the UACs immigration status. 
 
Progress in Addressing the Challenge 
HHS continues its efforts to improve the quality of nursing home, hospice, and HCBS programs, as well 
as services for especially vulnerable children.  
 
Addressing Substandard Nursing Home Care.  Through its Nursing Home Compare program and 
Five-Star Quality Rating System, HHS strives to provide residents and families accurate information 
about nursing home quality to enable informed care choices.  Through the National Partnership to 
Improve Dementia Care in Nursing Homes and other initiatives, HHS continues efforts to reduce 
excessive use of antipsychotic drugs in nursing homes and has reported a 34 percent decrease in the use 
of these drugs among long-term nursing home residents since the programs inception.  HHS reports 
progress developing the Skilled Nursing Facility Value-Based Purchasing Program, planned for launch in 
FY 2019, to better link payment to quality and achieve quality goals such as reducing preventable 
hospital admissions.  HHS continues to work closely with law enforcement partners at the Department 
of Justice and through the Federal Elder Justice Interagency Working Group to promote better care for 
older adults and to prosecute providers that subject them to abuse or neglect.   
 
When a False Claims Act settlement resolves allegations of poor, substandard, or worthless quality of 
care, OIG may impose obligations on the provider through a quality of care corporate integrity 
agreement (CIA), which requires providers to retain an independent monitor to perform clinical and 
quality reviews and assessments of the delivery of quality health care.  OIG has entered into 
quality-of-care CIAs with more than 40 nursing home companies covering more than 1,000 facilities.  
 
Reducing Problems in Hospice Care.  HHS continues its efforts to help patients and families make 
informed hospice choices.  In August 2017, it launched the Hospice Compare website to facilitate public 
access to hospice quality data.  HHS also continues to undertake enforcement actions against hospice 
providers that fraudulently enroll Medicare beneficiaries.   
 
Mitigating Risks to Patients Receiving HCBS.  HHS continues to work with MFCUs and law enforcement 
partners to prevent, detect, and take enforcement action against fraudulent PCS providers.  In July 2016, 
CMS issued guidance for PCS agencies and attendants on preventing improper payments.  In August 
2016, CMS issued an informational bulletin that discussed States ability to implement basic training for 
home care workers in topics such as first aid and CPR certification.  CMS also issued an informational 
bulletin summarizing program integrity vulnerabilities in Medicaid PCS and highlighting safeguards 
States can employ. 
 
Ensuring Access to Safe and Appropriate Services for Children.  In 2014, Congress reauthorized the 
Child Care and Development Block Grant (CCDBG) Act.  The Act sets basic health and safety standards 
  Top Management and Performance Challenges | 22  2017 Top Management and Performance Challenges 
 
for CCDF-funded childcare and requires that staff undergo criminal background checks.  These staff 
background checks are required as of September 30, 2017, unless the Secretary of Health and Human 
Services grants the State an extension.  ACF is working with States to overcome various implementation 
challenges and operationalize the background check processes for childcare providers. 
 
CMS is also working with States to reduce inappropriate prescribing of antipsychotic drugs for children 
in foster care and those covered by Medicaid and to improve access to dental care for children in 
Medicaid.  According to CMS, these efforts include providing technical assistance to support States in 
measuring, monitoring, and authorizing treatment of antipsychotic drug use in children.  CMS is adding 
new measures related to antipsychotic drug use to the core set of childrens health care quality 
measures for voluntary use by States.  In addition, CMS reported that it engages with States that have 
lower reported rates of oral health services to collaborate with CMS, national oral health leaders, and 
other interested stakeholders through an effort called the Oral Health Initiative 2.0.   
 
What Needs To Be Done 
Addressing Substandard Nursing Home Care.  OIG has recommended numerous strategies for HHS to 
strengthen its oversight of nursing homes and improve nursing home care.  For example, HHS should 
monitor how often nursing home residents are hospitalized and develop additional resources to help 
providers avoid adverse events.  In addition, HHS should improve internal controls and offer better 
guidance and training for surveyors to ensure that nursing homes with recorded quality and safety 
issues correct their deficiencies and prevent their recurrence.   
 
Federal law requires that crimes, like abuse or neglect, against residents in federally funded nursing 
homes be reported to law enforcement and the Department.  HHS should take the following steps to 
ensure that such incidents are identified and reported: (1) implement procedures to use claims for 
emergency room treatment of nursing home patients to identify potential abuse or neglect or other 
serious events, and (2) appropriately delegate and operationalize the authority to impose civil monetary 
penalties or exclusion from participation in Federal health care programs against individuals or entities 
that fail to fulfill their reporting obligations.   
 
Reducing Problems in Hospice Care.  CMS should improve hospice oversight by (1) increasing physician 
involvement in decisions regarding general inpatient care, (2) establishing additional remedies for poor-
performing hospices, (3) educating providers and beneficiaries about hospice enrollment requirements, 
and (4) developing and disseminating model text for hospice election statements.  HHS should also 
continue developing policies that effectively link payment to quality.  In addition, CMS should monitor 
hospice providers and claims and refer suspected fraud to OIG, as appropriate. 
 
Mitigating Risks to Patients Receiving HCBS.  Ensuring high-quality HCBS and enabling beneficiaries to 
avoid or delay institutionalization relies heavily on appropriate PCS.  OIG has recommended that HHS 
should (1) establish minimum Federal qualifications and screening standards for PCS workers, (2) require 
States to enroll or register all PCS attendants and assign them unique numbers, and (3) require that PCS 
claims identify the dates of service and the PCS attendant who provided the service.  In addition to PCS, 
States and HCBS providers, including those that deliver services in group homes, must better protect 
beneficiaries from abuse and neglect and establish better training and more effective policies and 
procedures to ensure critical incidents are reported to relevant authorities as required.  Specifically, 
States need access to relevant Medicaid data for injuries that require emergency room visits or hospital 
  Top Management and Performance Challenges | 23  2017 Top Management and Performance Challenges 
 
admissions in order to detect whether beneficiaries were involved with critical incidents and whether 
those incidents were reported and investigated within required timeframes.  In addition, policies and 
procedures must be followed and results reported to State and Federal stakeholders to ensure 
accountability at the State and provider levels.   
 
To assist States in developing and implementing better policies and procedures, OIGin partnership 
with the Administration for Community Living and HHS Office for Civil Rightsis developing model 
practices for group homes.  The model practices provide States with a roadmap for how to create a 
compliance oversight program that better protects the health and safety of individuals receiving HCBS in 
group homes.  The model practices focus on four critical compliance areas: (1) incident management 
and investigation, (2) mortality review, (3) quality assurance, and (4) auditing.    
 
Ensuring Access to Safe and Appropriate Services for Children.  ACF must fully implement its new 
authorities to ensure safer CCDF-funded childcare.  ACF must ensure that States have the required 
health and safety policies and procedures in place to better protect children receiving CCDF services.  
HHS should also work to better ensure childrens access to appropriate and high-quality Medicaid-
covered medical and dental services.  This includes ensuring the quality of the care provided to children 
receiving antipsychotic drugs.   
 
Key OIG Resources 
  OIG Report, Early Alert: The Centers for Medicare and Medicaid Services Has Inadequate Procedures 
to Ensure that Incidents of Potential Abuse or Neglect at Skilled Nursing Facilities Are Identified and 
Reported in Accordance with Applicable Requirements, August 2017.  
(https://oig.hhs.gov/oas/reports/region1/11700504.pdf) 
  OIG Report, Adverse Events in Skilled Nursing Facilities: National Incidence among Medicare 
Beneficiaries, February 2014. (http://oig.hhs.gov/oei/reports/oei-06-11-00370.asp) 
  OIG Report, Maine Did Not Comply with Federal and State Requirements for Critical Incidents 
Involving Medicaid Beneficiaries with Developmental Disabilities, August 2017. 
(https://oig.hhs.gov/oas/reports/region1/11600001.pdf) 
  Investigative Advisory on Medicaid Fraud and Patient Harm Involving Personal Care Services, 
October 2016. (https://oig.hhs.gov/reports-and-publications/portfolio/ia-mpcs2016.pdf.) 
  OIG Testimony, Combating Waste, Fraud, and Abuse in Medicaids Personal Care Services 
Program, May 2017. (https://oig.hhs.gov/testimony/docs/2017/grimm-testimony-05022017.pdf) 
  OIG Report, Some Florida Family Childcare Homes Did Not Always Comply With State Health and 
Safety Requirements, March 2016. (https://oig.hhs.gov/oas/reports/region4/41408034.pdf) 
  Top Management and Performance Challenges | 24  2017 Top Management and Performance Challenges 
 
Top Management Challenge #5: Ensuring Integrity in Managed Care and Other 
Programs Delivered Through Private Insurers 
 
Why This Is a Challenge 
Millions of enrollees in HHS programs receive health care coverage 
Key Components of the Challenge 
through private insurance companies and sponsors who contract with 
  Combating fraud, waste, and 
CMS or States to deliver benefits and services.  In Medicare, 
abuse by health care providers 
approximately 18.6 million Medicare beneficiaries were enrolled in 
billing managed care plans 
Medicare Advantage (MA) in 2016, more than a threefold increase since 
2004, and 39 million beneficiaries received Part D (prescription drug)    Ensuring integrity and 
benefits through plans sponsored by private companies.  The majority of  compliance by managed care 
Medicaid beneficiaries are enrolled in Medicaid MCOs.  In addition,  and Part D sponsors 
more than 10 million people received health insurance through private    Overseeing the health 
plans on health insurance marketplaces (marketplaces) in 2017.   insurance marketplaces 
 
HHS faces challenges in ensuring the integrity of these programs.  
Improper billing and fraud by health care providers is not limited to 
Medicare and Medicaid Fee-for-Service programsMA organizations, Medicare Part D sponsors, and 
Medicaid MCOs also face these risks.  An added challenge in combating health care fraud in these 
programs is the diffuse structure and responsibilities across HHS, private entities, and States.  Further, 
HHS must oversee the MA organizations and Part D sponsors themselves to ensure that these entities 
are not inappropriately increasing the per capita payments they receive from Medicare and that they 
are providing beneficiaries with sufficient access to health care providers, services, and prescriptions as 
required.  For Medicaid, HHS oversees the States oversight of MCOs.  Administering the marketplaces 
also requires extensive coordination among many Federal, State, and private entities. 
 
Key Components of the Challenge 
Combating Fraud, Waste, and Abuse by Health Care Providers Billing Managed Care Plans.  Improper 
billing and fraud by health care providers is a concern.  For example, CMS requires MA organizations and 
Part D sponsors to implement compliance plans that include measures to prevent, detect, and correct 
instances of fraud, waste, and abuse.  However, these plans vary widely across sponsors, and so does 
detection of suspected fraud.  For example, in 2012 several Part D sponsors reported no instances of 
potential fraud or abuse, while other sponsors reported identifying up to 13,000 instances of potential 
fraud.  Furthermore, reporting this information to CMS is voluntary, and many sponsors choose not to 
report.  Therefore, CMS lacks visibility into many MA organizations and Part D sponsors detection of 
suspected fraud and abuse incidents.  In Medicaid managed care, program integrity responsibilities are 
even more dispersed, as they are shared among CMS, States, and MCOs, making effective oversight by 
HHS more complex and challenging.   
 
Limitations in MA and Medicaid MCO encounter data (information about each service provided to 
beneficiaries) also hinder efficient and effective oversight to prevent fraud, waste, or abuse.  OIG found 
that MA encounter data show promise for program oversight, but some improvements are needed.  For 
example, CMS does not require MA organizations to include the identifiers of ordering or referring 
providers in their encounter data and requires identifiers for rendering providers only under certain 
circumstances.  These provider identifiers are critical for using MA encounter data to identify patterns of  
  Top Management and Performance Challenges | 25  2017 Top Management and Performance Challenges 
 
questionable billing and to pursue fraud investigations.  OIG has also raised concerns about incomplete 
encounter data in Medicaid managed care.  States have historically experienced difficulties collecting 
encounter data from MCOs.  In 2011, OIG found that 19 of 38 States did not report some or all of their 
required MCO encounter data to CMS.  (For additional information on problems with national Medicaid 
data, see TMC #2.)  
 
Ensuring Integrity and Compliance by Managed Care and Part D Sponsors.  HHS must be vigilant about 
risks posed to HHS funds and beneficiaries by the MA organizations, Part D sponsors, and Medicaid 
MCOs contracted to deliver health care services.  These entities have incentives to maximize the 
capitated payments they receive from Medicare or Medicaid while minimizing their costs in providing 
health care services.12  In 2016, CMS estimated a gross improper payment rate of $16 billion to MA 
organizations, the majority of which was attributable to unsupported diagnoses.  Medicare pays higher 
capitated payments on behalf of sicker beneficiaries than for healthier beneficiaries.  In May 2017, the 
Department of Justice filed a complaint against the largest MA organization alleging that it obtained 
inflated Medicare payments based on untruthful and inaccurate information about the health status of 
beneficiaries.  In May 2017, an MA organization agreed to pay $32.5 million to resolve allegations 
related to inflated Medicare payments as well as allegations that the organization misrepresented the 
scope and content of its network of providers. 
 
Ensuring that beneficiaries have sufficient access to health care providers through the provider networks 
of their respective MCOs is also a concern.  In a study of Medicaid MCOs, OIG found that more than half 
of providers listed as participating in Medicaid MCOs were unable to offer appointments and more than 
a third were not at the location listed in the MCOs plan.   
 
Likewise, protecting beneficiaries from inappropriate denials of services or prescriptions by private 
entities is also a challenge.  Capitated payment models create incentives to keep health care costs low 
by providing fewer services or prescription drugs; in some cases, the services or drugs could be fewer 
than beneficiaries medically need.  This presents risks to beneficiaries health and misuses program 
dollars paid to those entities to provide needed health care.  CMS audits have uncovered inappropriate 
denials of care or prescriptions by MA and Part D sponsors.  These audits frequently cite entities for 
failing to explain to beneficiaries why they denied a request or how the beneficiary can appeal the 
denial. 
 
Overseeing the Health Insurance Marketplaces.  The marketplaces involve complex regulatory, 
operational, and technological challenges for HHS.  Among these are effective communication and 
coordination between and among internal and external parties with marketplace responsibilities, 
including within HHS and with contractors, issuers, and partners in State and Federal Government.  As 
the program and its operations evolve, new oversight challenges may arise.   
 
Sound oversight of the marketplaces needs to include the following key program integrity areas:  
(1) paymentsensuring that taxpayer funds are being expended correctly and for their intended 
                                                           
12 For example, a Florida doctor was sentenced to 46 months in prison in 2016 for defrauding an MA organization 
by misdiagnosing patients to inflate payments.  Combating fraud, waste, and abuse by providers in managed care 
differs from fee-for-service because CMS and managed care or Part D plan sponsors share responsibilities.                                                                  
 
  Top Management and Performance Challenges | 26  2017 Top Management and Performance Challenges 
 
purposes; (2) enrollmentmaking certain that the right people are getting the right benefits; 
(3) managementensuring that HHS administration of the program is efficient and effective; and 
(4) securitysafeguarding consumers personal information.  OIGs work has identified management 
challenges and recommendations addressing these areas.  These challenges include insufficient 
payment controls that could lead to wasteful spending; vulnerabilities in ensuring accurate eligibility 
determinations at the Federal and State-based marketplaces; and challenges for HHS management, 
including contract administration, contingency planning, and weaknesses in IT security controls. 
 
Progress in Addressing Challenge 
Combating Fraud, Waste, and Abuse by Health Care Providers Billing Managed Care Plans.  CMS 
officials report that it is working to improve coordination, information sharing, and availability of reliable 
data to the Federal, State, and private entities with program integrity responsibilities.  CMS has issued 
guidance on sharing information between CMS contractors and other program integrity stakeholders, 
such as State agencies, to more effectively coordinate efforts to identify and investigate fraud.  CMS is 
also making progress in validating the completeness and accuracy of MA encounter data.  Similarly, CMS 
continues to work with States to get complete, accurate, and timely Medicaid data.  The agency issued a 
Medicaid managed care rule in 2016 giving States guidelines to work with MCOs on improving 
encounter data.  CMS reports that it has also worked with States on T-MSIS to prioritize the need for 
complete and accurate encounter data.  Further, the agency began requiring more consistent reporting 
of program integrity issues, such as recoupment of overpayments, from Medicaid MCOs.  Finally, CMS 
issued requirements that MA providers enroll in Medicare through the same screening process as 
Medicare Fee-for-Service beginning January 1, 2019, which may help to prevent bad actors from 
entering the program. 
 
Ensuring Integrity and Compliance by Managed Care and Part D Sponsors.  CMS audits of 
MA organizations and Part D sponsors are an important program integrity tool.  CMS has initiated 
dozens of audits to verify the accuracy of enrollee diagnoses (the basis for capitated payment increases 
or decreases) submitted by MA organizations.  In addition, CMS conducts annual compliance audits of a 
subset of MA organizations and Part D sponsors, which include reviews of compliance program 
effectiveness and coverage determinations, appeals, and grievances.   
 
CMS reports that it has made progress in reviewing Medicaid managed care rates to ensure that they 
are actuarially sound.  These rates have been reviewed more closely since 2015, and CMS reports 
working with States to address issues identified in the course of these reviews.  
 
CMS is also working to ensure that MA, Part D, and Medicaid beneficiaries have adequate access to 
health care providers through their plans.  CMS requires State Medicaid agencies to develop and 
implement provisions that ensure beneficiaries have adequate access to Medicaid-covered services. 
State standards for provider networks are to be based on reasonable travel time and distance from 
enrollees homes and provider sites, and States must monitor enrollees access to care.  CMS published 
a toolkit as a resource guide to assist State Medicaid staff with ensuring adequate provider networks 
and to highlight effective or promising practices to monitor beneficiaries access to providers through 
their managed care plans.  CMS has also developed a tool to help assess network adequacy in MA plans 
and has proposed expanding its reviews of whether beneficiaries in MA plans have sufficient access to 
providers.  
 
  Top Management and Performance Challenges | 27  2017 Top Management and Performance Challenges 
 
Overseeing the Health Insurance Marketplaces.  CMS has made some progress in addressing the 
internal controls and management challenges that OIG has identified in the marketplaces.  For example, 
CMS has implemented an automated financial management system for the Federal Marketplace.  CMS 
has also improved its acquisition planning for Federal Marketplace contracts, and it has addressed some 
challenges in overseeing State-based marketplaces.  This includes conducting annual open-enrollment 
readiness reviews of State-based marketplaces and creating a procedures manual for CMS employees to 
oversee and monitor the challenges specific to these marketplaces.  CMS has developed an integrity 
program for the Federal Marketplace that addresses monitoring consumer complaints to identify 
potential fraud and abuse, conducting license verification on agents and brokers, and identifying areas 
of high risk that warrant further investigation and analysis.   
 
What Needs To Be Done 
Combating Fraud, Waste, and Abuse by Health Care Providers Billing Managed Care Plans.  HHS 
should continue to partner with MA organizations, Part D sponsors, and State Medicaid agencies to 
ensure that payments for health care services are appropriate and to combat fraud by health care 
providers.  This includes facilitating effective coordination and information sharing as well as 
maintaining accurate, complete, and timely national data to support effective oversight.  For instance, 
CMS should require Part D sponsors and MA organizations to report on their identification of and 
response to potential fraud incidents.  CMS should also require MA organizations to include identifiers 
for all ordering and referring providers and rendering providers in their encounter data to support fraud 
detection through data analytics. 
 
Ensuring Integrity and Compliance by Managed Care and Part D Sponsors.  CMS should continue to 
monitor MA organizations and Part D sponsors compliance with program requirements through audits 
and other oversight tools and take appropriate corrective and enforcement actions as needed.  CMS 
should specifically focus on reducing and recouping overpayments resulting from MA organizations 
misreporting of beneficiaries diagnoses, which could save billions of dollars each year, and ensuring that 
MA plans and Part D plans are not inappropriately restricting beneficiary access to needed services, 
prescriptions, or providers. 
 
Overseeing Health Insurance Marketplaces.  CMS should continue to fix the internal controls and 
management deficiencies that OIG has identified, including working with States to address weaknesses 
in State marketplaces.  In operating and overseeing the marketplaces, HHS should keep program 
integrity and sound management principles at the forefront. 
 
Key OIG Resources   
  OIG Report, Access to Care: Provider Availability in Medicaid Managed Care, December 2014.  
(https://oig.hhs.gov/oei/reports/oei-02-13-00670.pdf) 
  OIG Report, Early Outcomes Show Limited Progress for the Transformed Medicaid Statistical 
Information System, September 2013. (https://oig.hhs.gov/oei/reports/oei-05-12-00610.pdf) 
  OIG Report, MEDIC Benefit Integrity Activities in Medicare Parts C and D, January 2013.  
(https://oig.hhs.gov/oei/reports/oei-03-11-00310.pdf) 
  OIG Testimony, Fraud, Waste, and Abuse Under the Affordable Care Act, January 2017. 
(https://oig.hhs.gov/testimony/docs/2017/robinson-testimony01312017.pdf)  
  Inventory of OIG Reports on Health Insurance Marketplaces, 2013 to Present.  
(https://www.oig.hhs.gov/reports-and-publications/aca/)    
  Top Management and Performance Challenges | 28  2017 Top Management and Performance Challenges 
 
Top Management Challenge #6: Improving Financial and Administrative 
Management and Reducing Improper Payments  
  Key Components of the Challenge 
  Addressing weaknesses in 
Why This Is a Challenge 
financial management 
HHS is the largest civilian agency within the Federal Government.  In 
systems 
FY 2016, HHS reported total budgetary resources of approximately 
$1.1 trillion.  Responsible stewardship of HHS programs is vital, and    Addressing Medicare trust 
operating a financial management and administrative infrastructure that 
fund issues/social insurance  
employs appropriate safeguards to minimize risk and provide oversight 
for the protection of resources remains a challenge for HHS.  HHS must    Reducing improper payments 
also ensure the completeness, accuracy, and timeliness of any financial 
  Addressing concerns about 
and program information provided to other entities, both internal and 
contracts management 
external to the Federal Government. 
    Implementing the Digital 
Key Components of the Challenge  Accountability and 
Addressing Weaknesses in Financial Management Systems.  OIG  Transparency (DATA) Act  
continues to report a material weakness in HHSs financial management 
systems related to inadequate internal controls over segregation of 
duties in employees job responsibilities, configuration management for approved changes to HHS 
financial systems, and access to HHS financial systems.  OIG continues to report that HHS does not 
substantially comply with requirements for financial system management because of these issues.  
Under the Federal Financial Management Improvement Act of 1996, Federal agencies must establish 
and maintain financial management systems and OIGs must report on compliance by their respective 
agency.  These systems are intended to help agencies ensure the effectiveness and efficiency of 
operations, reliability of financial reporting, and compliance with applicable laws and regulations. 
 
Addressing Medicare Trust Fund Issues/Social Insurance.  The Statement of Social Insurance (SOSI) 
presents the actuarial present value of (1) contributions and tax income (excluding interest income), (2) 
scheduled expenditures, and (3) the difference between the two for all current and future participants 
(open group) of the Medicare program for the projection period, which covers 75 years.  The Statement 
of Changes in Social Insurance Amounts (SCSIA) reconciles the beginning and ending open group 
measures and presents the components of the changes for 2 years.  These statements cover the 
Medicare Fee-for-Service, Medicare Advantage, and Medicare Prescription Drug Benefit programs, and 
the amounts they disclose are based on current law.  The actuarial opinion expressed in the 2017 Annual 
Report of the Boards of Trustees of the Federal Hospital Insurance and Federal Supplementary Medical 
Insurance Trust Funds states: 
Absent an unprecedented change in health care delivery systems and payment mechanisms, the prices 
paid by the Medicare fee-for-service program for most health services will fall increasingly short of the 
costs of providing those services.  The Trustees assume that the various cost-reduction measures will 
occur as current law requires.  To achieve this outcome, healthcare providers would have to realize 
productivity adjustments at a faster rate than experienced historically.  As a result, the Medicare Board 
of Trustees have included in the Annual report to Congress an alternative scenario to illustrate, where 
possible, the potential understatement of Medicare costs and projection results.  Since 2010, OIG has 
  Top Management and Performance Challenges | 29  2017 Top Management and Performance Challenges 
 
noted the inherent difficulties in projecting growth in health care costs over time and issued a disclaimer 
of opinion on the SOSI & SCSIA based on these uncertainties.  
Reducing Improper Payments.  Reducing improper payments is a critical element in protecting the 
financial integrity of HHS programs.  Although not all improper payments constitute fraud, all improper 
payments pose a risk to the financial security of Federal programs.  Pursuant to the Improper Payments 
Information Act of 2002 (IPIA), as amended, Federal agencies are required to provide uniform, annual 
reporting on improper payments and their efforts to reduce them.  In the FY 2016 Agency Financial 
Report (AFR), HHS reported improper payments of nearly $100 billion for seven of the eight programs 
designated high risk and susceptible to improper payments.  Our audit of HHSs FY 2016 AFR, published 
in May 2017, found that HHS did not meet all IPIA requirements.  Specifically, OIG found that HHS did 
not report an improper payment estimate for the Temporary Assistance for Needy Families (TANF) 
program, as HHS does not believe it has the statutory authority to collect from States the data necessary 
for calculating such a rate.   
HHS has reported that the improper payment rate exceeded 10 percent for both Medicare 
Fee-for-Service and Medicaid.  In addition, three other programs that the Office of Management and 
Budget (OMB) has deemed susceptible to risk of improper payments (Medicare Advantage, CHIP, and 
foster care programs) did not meet their FY 2016 target error rates.  (See TMC #1 for a discussion of 
reducing Medicare improper payments and TMC #2 for a discussion of reducing Medicaid improper 
payments.) 
 
Addressing Concerns About Contracts Management.  HHS is one of the largest contracting agencies in 
the Federal Government.  Given the high dollar amount and complexity of its contracts, it is paramount 
that HHS have strong monitoring and oversight.  OIG has raised issues about acquisition planning and 
procurement, contract monitoring, and payments to contractors related to the Federal Marketplaces 
operated by CMS.  OIG has also identified issues regarding contract closeouts.  OIG found that CMS had 
not closed out contracts totaling $25 billion as required by the Federal Acquisition Regulation (FAR). 
Because the closeout process is typically the final opportunity for improper payments to be detected 
and recovered, delays in the closeout process pose a substantial financial risk.  Additionally, OIG has 
identified weaknesses in CMSs oversight and performance measurement for benefit integrity 
contractors. 
 
Implementing the DATA Act.  The DATA Act required OMB and the Department of the Treasury to 
establish Government-wide data standards for reporting financial and payment information by May 
2015.  Broadly, the DATA Act required that HHS begin using the Government-wide data standards to 
enter information into USASpending.gov by May 2017 in an effort to ultimately increase transparency 
and accountability.  OIGs readiness review of HHSs implementation of the DATA Act as of June 30, 
2016, found that although HHS made progress, it had not fully met the requirements of the four initial 
steps of Treasurys Agency 8-Step Plan.  Specifically, we found that HHS did not complete detailed 
project plans or determine how it will certify that the data are accurate and complete.  Given the 
difficulty of defining and developing common data elements across multiple reporting areas and the 
volume of diverse programs administered by HHS, OIG determined that HHS will face challenges 
implementing these uniform data standards and submitting information into USASpending.gov within 
the required timeframe. 
 
  Top Management and Performance Challenges | 30  2017 Top Management and Performance Challenges 
 
Progress in Addressing the Challenge 
Addressing Weaknesses in Financial Management Systems.  HHS has taken corrective actions to 
resolve the IT-related deficiencies reported in the AFR.  In FY 2016, senior leadership continued to take a 
role in monitoring activities across all HHS IT systems.  OIG noted improvements in key financial systems 
as a result of investments in the underlying IT infrastructure, remediation of risk over key financial 
systems, and the strengthening of the HHS process to develop corrective action plans, which led to the 
remediation of a number of prior audit findings.   
 
Addressing Medicare Trust Fund Issues/Social Insurance.  In FY 2016, HHS continued to present an 
illustrative alternate scenario to the current legal projections for Medicare in the footnote disclosures of 
the AFR to illustrate the potential magnitude on Medicare outlays if certain components of current law 
are not sustainable.  According to the Medicare Chief Actuary, the techniques and methodology used to 
evaluate the financial status of the Federal Hospital Insurance Trust Fund and the Federal 
Supplementary Medical Insurance Trust Fund are based on sound principles of actuarial practice.  With 
certain caveats, the principal assumptions used and the resulting actuarial estimates are individually and 
in the aggregate reasonable for the purpose of evaluating the financial status of the trust funds.  At this 
time, OIG is not aware of any projects before the Federal Accounting Standards Advisory Board to revise 
existing guidance related to SOSI.  OIG continues to expect to issue a disclaimer of opinion on the SOSI 
and SCSIA until the variances between income and expenditures between current law and the 
illustrative alternative scenario become much less significant.   
 
Reducing Improper Payments.  In its FY 2016 AFR, HHS reported a series of actions, including working 
with States to analyze Single Audit material noncompliance findings and performing a detailed risk 
assessment of the TANF program to assist States in reducing improper payments for TANF.  HHS has also 
stated that it recognizes the need for continual and focused effort to prevent, detect, and reduce 
improper payments in HHS programs.  For the Medicare Fee-for-Service program, CMS continued with 
existing efforts to analyze and address areas of highest risk.  CMS built on the Healthcare Fraud 
Prevention Partnership, worked with its Medicare contractors to develop medical review strategies, 
leveraged multiple efforts to increase provider education, clarified existing policy, and analyzed the 
results of the Fraud Prevention System.  For Medicaid, CMS worked with the States to develop State-
specific corrective action plans.  CMS also shared Medicare data to assist States with meeting Medicaid 
screening and enrollment requirements and provided ongoing guidance, education, and outreach.  CMS 
also offered training, technical assistance, and additional support for the States Medicaid program 
integrity.   
 
Addressing Concerns About Contracts Management.  In November 2015, HHS published a final rule that 
updated the HHS Acquisition Regulation (HHSAR) to supplement the FAR.  The HHSAR provides 
additional policy and procedural guidance to foster financial integrity and accountability across the 
acquisition lifecycle, from the concept of need through contract closeout.  CMS has prioritized closing 
out contracts.  In October 2014, CMS reported establishing a contract closeout goal of 2,250 contracts 
per year.  Since 2013, CMS officials reported they closed out a total of 9,740 contracts, resulting in de-
obligations of more than $209 million that were returned to the Department of the Treasury.  CMS 
continues to meet this goal and closed out 2,831 contracts in FY 2016 and 4,109 contracts in FY 2017. 
    
Implementing the DATA Act.  HHS believes that the actions it has taken enabled it to meet the May 
2017 due date for implementing the Government-wide data standards and submitting data in 
  Top Management and Performance Challenges | 31  2017 Top Management and Performance Challenges 
 
accordance with these standards into USASpending.gov.  HHS established a DATA Act Project 
Management Office (PMO) within the Office of the Assistant Secretary for Financial Resources.  The 
PMO included representatives from all of HHSs Operating Divisions.  The PMO has also been appointed 
by OMBs Office of Federal Financial Management (OFFM) as the executing agent of the financial 
assistance portion of the pilot required by Section V of the DATA Act.  OFFM maintains strategic 
oversight for the pilot, while HHS is tasked with providing tactical leadership and establishing a pilot 
program to inform Congress of recommendations on methods to standardize reporting elements across 
the Federal Government, eliminate unnecessary duplication in financial reporting, and reduce 
compliance costs for recipients of financial awards.    
 
What Needs To Be Done 
Addressing Weaknesses in Financial Management Systems.  HHS should continue to address and 
resolve financial management system weaknesses identified by OIG, the Government Accountability 
Office, and other auditors contracted by OIG or HHS.   
 
Addressing Medicare Trust Fund Issues/Social Insurance.  HHS should continue to work with the 
Medicare Chief Actuary to lessen the variances of income and expenses reported on the SOSI and SCSIA 
between current law and the illustrative alternate scenario.   
 
Reducing Improper Payments.  HHS must also continue to pursue needed legislative remedies to 
develop and report an improper payment estimate for TANF.  In addition, HHS must meet improper 
payments reduction targets and reduce improper payments to less than 10 percent for all programs.   
 
Addressing Concerns About Contracts Management.  CMS should improve coordination and 
collaboration across departmental staff with contract closeout responsibilities.  CMS must also ensure 
that required acquisition strategies are completed.  Further, CMS must strengthen its contracts 
oversight and performance measurement for benefit integrity contractors. 
 
Implementing the DATA Act.  HHS must ensure it has project plans that specifically detail how it 
implemented the Government data standards.  HHS must also ensure the items entered into 
USASpending.gov under these standards are accurate and complete.   
 
Key OIG Resources 
  OIG Report, U.S. Department of Health and Human Services Met Many Requirements of the 
Improper Payments Information Act of 2002 but Did Not Fully Comply for Fiscal Year 2015, 
May 2016. (https://oig.hhs.gov/oas/reports/region1/171652000.pdf) 
  OIG Report on Financial Statement Audit of Health and Human Services for Fiscal Year 2016, 
November 2016. (https://www.hhs.gov/about/agencies/asfr/finance/financial-policy-
library/agency-financial-reports/index.html) 
  OIG Report, CMS Has Not Performed Required Closeouts of Contracts Worth Billions, 
December 2015. (https://oig.hhs.gov/oei/reports/oei-03-12-00680.pdf) 
  OIG Report, CMS Did Not Identify All Federal Marketplace Contract Costs and Did Not Properly 
Validate the Amount to Withhold for Defect Resolution on the Principal Federal Marketplace 
Contract, September 2015. (https://oig.hhs.gov/oas/reports/region3/31403002.pdf)  
  OIG Report, Report of Findings and Recommendations for HHSs DATA Act Implementation, June 30, 
2016. (https://oig.hhs.gov/oas/reports/region17/171602018.pdf) 
  Top Management and Performance Challenges | 32  2017 Top Management and Performance Challenges 
 
Top Management Challenge #7: Protecting the Integrity of Public Health and 
Human Services Grants  
   
Why This Is a Challenge 
In FY 2016, HHS awarded more grants than any other Federal entitymore 
Key Components of the Challenge 
than $100 billion in grants, excluding Medicaid.  (For information on 
  Ensuring effective grants 
challenges related to Medicaid, see TMCs #2 and #5.)  Recent legislation 
management within the 
expands HHSs reach and increases expenditures through new grant 
Department 
programs.  In passing the 21st Century Cures Act, Congress authorized (and 
subsequently appropriated) billions of dollars in new Federal spending to    Ensuring program integrity and 
address national public health needs.  This included $1.8 billion for cancer  financial capability at the 
prevention, diagnosis, and treatment; $1.5 billion for neurological research;  grantee level 
$1.4 billion for the Precision Medicine Initiative;13 and $1 billion in grants to 
States for opioid prevention and treatment.  The Act also authorized funds for smaller grants to address 
other public health needs.  For example, it authorized $200 million over 4 years for grants for mental 
and behavioral health education training.  
 
Given the increased use of grant programs to address public health needs and crisessuch as the opioid 
epidemic and emergency preparedness and relief effortsit is crucial to safeguard these funds so they 
are used efficiently, effectively, and for their intended purposes.  All grant programs are susceptible to 
fraud, waste, and abuse, and the challenges of mitigating these risks may be heightened in public health 
crisis situations. 
 
The continued growth of Federal funding to State and local governments, including block grants for 
health and social programs, also creates challenges for HHS in verifying that appropriate controls are 
present and that reporting requirements are met.  HHS plays a critical role in ensuring the integrity of 
public health and human services programs by maintaining transparency and accountability for Federal 
funds.  Responsible stewardship of these funds while maintaining the desired flexibility is vital to public 
health and well-being as well as responsible use of tax dollars.  
 
Key Components of the Challenge 
Ensuring Effective Grants Management Within the Department.  Because HHS awards funds to such a 
diverse variety of non-Federal entities, it faces a number of challenges to ensure proper administration 
and program integrity of its grants.  Challenges include providing an infrastructure to best oversee 
grants across HHS, conducting effective antifraud activities, and overseeing States compliance with 
reported activities in their State plans.  HHS maintains multiple grant-awarding systems that do not 
interface.  As a result, HHS lacks the ability to readily capture a grantees performance and financial 
activities related to multiple HHS grant awards.  OIG has found that the existing grants management and 
varying grant-oversight processes within each grant-awarding agency hinder HHSs ability to effectively 
oversee grantees during all aspects of the grants cycle.  For example, HHS lacks a systematic method to 
share among its awarding agencies grantee information such as problematic grantees, risks posed by 
                                                           
13 The Precision Medicine Initiative is an emerging approach for disease prevention and treatment that takes into 
account people's individual variations in genes, environment, and lifestyle.  
 
  Top Management and Performance Challenges | 33  2017 Top Management and Performance Challenges 
 
new grantees, and adverse information from audits of grantees.  Further, while HHS maintains the 
Tracking Accountability in Government Grants System that awarding agencies can use to identify 
grantees they have in common, the system does not contain a detailed description of a grant award that 
might enable avoiding potential duplication and overlap of Federal funding from multiple HHS grants.  
OIG also found that because each HHS awarding agency uses different systems to manage their Federal 
grants, unintended consequences may result, such as increased administrative burden and costs and a 
hampered ability for HHS to effectively integrate program integrity into all aspects of its grants 
management activities. 
 
HHS faces heightened challenges in overseeing grants in areas recovering from natural disasters.  OIG 
has experience in reviewing grant oversight with the work we performed following Superstorm Sandy.  
For example, OIG found that after Superstorm Sandy guidance from ACF limited the effectiveness of 
State planning and hindered the use of funds for relief efforts.  Improving ACFs guidance could 
enhance the response to future disasters. 
 
Ensuring Program Integrity and Financial Capability at the Grantee Level.  A common problem 
uncovered by our reviews of HHS grantees is a lack of accountability for Federal funds.  This is often 
caused by inadequate financial management systems and internal controls.  When these weaknesses 
are exploited, financial stewardship of these funds is greatly diminished or absent.  Without sufficient 
internal controls, grants are vulnerable to financial mismanagement and fraud schemes, including 
embezzlement.  As an example, a recent investigation found that a former chief executive officer of a 
HRSA grantee engaged in a fraudulent scheme to embezzle approximately $17 million in Federal funds.  
The intended purpose of the grant was to provide quality health care for the homeless and low-income 
individuals.  Instead, the funds were diverted to the individuals multiple corporations for personal use.  
The individual was convicted on 98 counts of fraud, including conspiracy, wire fraud, bank fraud, and 
money laundering, and sentenced to 18 years in Federal prison.  In another example, we found that a 
grantee unlawfully spent nearly $8 million in Head Start funds without maintaining its required 
enrollment level.  Not only did the grantee not fulfill its program-enrollment obligations, it also misused 
an additional $2 million of Head Start funds.  The grantee did not monitor its partner agencies 
operations to ensure that children at the partners facilities in fact received Head Start services.  
 
Weak program integrity and internal controls may also result in nonmonetary vulnerabilities.  For 
example, audits of State agency oversight of childcare providers funded by the CCDF program 
highlighted the need to strengthen compliance with requirements for background screenings of 
individuals caring for children.  We also found that States receiving CCDF grants sometimes failed to 
perform important program integrity and antifraud activities, such as reviewing provider records for 
potential fraud, identifying potential duplicate payments, performing verification checks (such as 
verifying addresses) of childcare providers, and conducting onsite visits.  
 
Progress in Addressing the Challenge 
HHS has worked to strengthen some program integrity efforts.  To facilitate better information sharing 
about grantees, guidance has been issued to HHS awarding agencies that facilitates a review of 
prospective grantees prior to awarding grants.  This information enhances HHSs assessment of 
prospective grant recipients integrity and potential performance.  
 
  Top Management and Performance Challenges | 34  2017 Top Management and Performance Challenges 
 
In addition, information provided via the Federal Awardee Performance and Integrity Information 
System (FAPIIS) database will improve HHSs access to information pertaining to entities applying for or 
receiving Federal funds.  FAPIIS tracks contractor misconduct and performance by including information 
on contractor criminal, civil, and administrative proceedings in connection with Federal awards, 
suspensions and debarments, contracts terminated for fault, and past performance evaluations. 
 
Further, HHS awarding agencies have begun to reach out to OIG regarding allegations of fraud.  For 
example, HRSA officials referred allegations to OIG that resulted in significant criminal convictions and 
recoveries on behalf of HRSAs grant program and shut down a fraud scheme in which Federal funds 
were being stolen and diverted for personal use.    
 
To combat fraud, waste, and abuse in its grant programs, HHS continues to pursue suspension and 
debarment actions (in addition to other administrative remedies).  In addition, HHS has collaborated 
with OIG in presenting training on suspension and debarment and training for employees of HHS and 
Tribal facilities on how to identify and report potential fraud, waste, and abuse.    
 
What Needs To Be Done 
Effective grants administration depends on strengthening the use of data and technology to allow HHS 
to assess risk prior to making grants and to track grantee compliance and performance after an award.  
Specifically, HHS should develop interoperable grants management systems to share information across 
grant programs.  HHS should also continue to work with States and other grantees to assess and 
strengthen their program integrity and fraud-fighting activities.  When the Department identifies 
mismanagement, waste, or abuse, it must continue to pursue appropriate administrative remedies, such 
as suspension and debarment, as well as continue to refer suspected fraud to OIG.  To fight fraud, OIG 
will continue to use all of our enforcement remedies, including a new enforcement tool authorized by 
the 21st Century Cures Act that empowers OIG to impose civil monetary penalties for fraudulent 
conduct in HHS grants, contracts, or other agreements.  
 
Key OIG Resources 
  OIG Report, Newark Preschool Council, Inc., Did Not Always Comply With Head Start Requirements, 
February 2017. (https://oig.hhs.gov/oas/reports/region2/21402024.asp) 
  OIG Report, HHS Oversight of Grantees Could Be Improved Through Better Information Sharing, 
September 2015. (https://oig.hhs.gov/oei/reports/oei-07-12-00110.asp)  
  OIG Report, More Effort Is Needed to Protect the Integrity of the Child Care and Development Fund 
Block Grant Program, July 2016. (https://oig.hhs.gov/oei/reports/oei-03-16-00150.pdf) 
  OIG Report, Cleveland Clinic Lerner College of Medicine Inappropriately Drew Down Hurricane Sandy 
Disaster Relief Act Funds and Did Not Always Implement Effective Internal Controls, March 2017. 
(https://oig.hhs.gov/oas/reports/region2/21502011.asp) 
  OIG Report, Superstorm Sandy Block Grants: Funds Benefited States Reconstruction and Social 
Service Efforts, Though ACFs Guidance Could Be Improved, September 2016.   
(https://oig.hhs.gov/oei/reports/oei-09-15-00200.asp)    
  Top Management and Performance Challenges | 35  2017 Top Management and Performance Challenges 
 
Top Management Challenge #8: Ensuring the Safety of Food, Drugs, and Medical 
Devices 
 
Why This Is a Challenge 
The FDA has a broad statutory mandate, and its responsibilities continue to 
Key Components of the Challenge 
grow.  FDA protects the public health by ensuring the safety, efficacy, 
quality, and security of human and veterinary drugs, biological products,    Ensuring food safety 
and medical devices, and by ensuring the safety of our Nations food 
  Ensuring the safety, efficacy, 
supply, cosmetics, and electronic products that emit radiation.  FDA also 
and quality of medical 
regulates the manufacture, marketing, and distribution of tobacco 
products  
products to protect the public health and to reduce tobacco use by 
minors.14  FDA regulates products accounting for approximately 20 percent    Overseeing the complex drug 
of all U.S. consumer spending.  FDA has the continuing challenge of  and medical device supply 
ensuring the safety and security of our Nations foods and medical  chain 
products (including drugs, biological products, and medical devices), which directly affect the health of 
every American.  The expansion of FDAs authorities through legislation, including the 21st Century 
Cures Act in 2016, the Drug Quality and Security Act in 2013, and the Food Safety Modernization Act in 
2010, add to the agencys mandate to protect the public health. 
 
Key Components of the Challenge 
Ensuring Food Safety.  Each year roughly 48 million people get sick from a foodborne illness, 128,000 
are hospitalized, and 3,000 die.15  FDA is responsible for ensuring the safety of almost all food products 
sold in the United States, with the exception of catfish, meat, poultry, and some egg products, which are 
regulated by the U.S. Department of Agriculture.  Oversight is complicated by the immense diversity of 
the global food supply: 20 percent of vegetables consumed in the United States come from abroad, as 
does 50 percent of fresh fruit and more than 80 percent of seafood.16   
 
FDA inspects food facilities to ensure food safety and compliance with regulations and may use various 
administrative tools and enforcement authorities as necessary to protect the public from unsafe or 
potentially unsafe food.  However, OIG has consistently found that FDA does not always take action 
after it discovers significant inspection violations at food facilities.  Additionally, OIG has found that 
FDAs actions are not always timely nor do they always result in the correction of these violations.  For 
example, in 2016 OIG issued an Early Alert based on a review of a judgmental sample of 30 food recalls 
with a preliminary finding that FDA lacked an efficient and effective process to ensure that firms initiate 
prompt, voluntary food recalls.   
 
Ensuring the Safety, Efficacy, and Quality of Medical Products.  FDAs responsibility to ensure safe, 
effective, and quality medical products begins long before a product is brought to market and continues 
after FDA approval.  FDA oversees more than 13,000 drug facilities and 25,000 medical device facilities.  
                                                           
14 See https://www.fda.gov/aboutfda/whatwedo/ 
15 Centers for Disease Control and Prevention, Food Safety, Foodborne Germs and Illnesses.  Available at 
https://www.cdc.gov/foodsafety/foodborne-germs.html 
16 U.S. Food and Drug Administration, Global Engagement.  Available at  
https://www.fda.gov/downloads/aboutfda/reportsmanualsforms/reports/ucm298578.pdf  
 
  Top Management and Performance Challenges | 36  2017 Top Management and Performance Challenges 
 
FDA is also responsible for authorizing the use of investigational medical products as well as ensuring 
the safety and efficacy of all prescription medical products before marketing in the United States.  In 
2016, FDA approved 22 novel drugs, 73 first-time generic drugs, and 91 novel medical devices.  FDA also 
oversees compounded drugs, which are not subject to FDAs premarket approval process, and continues 
to identify issues with the development of compounded products. 
 
FDA must also ensure that medical products remain safe and of acceptable quality once on the market.  
In 2016, OIG released a report concerning FDAs oversight of drug sponsors compliance with 
postmarketing requirements.  Some drug sponsors may be required to carry out postmarketing studies 
or clinical trials to assess known or potential serious risk.  OIG found that most sponsors are completing 
their studies according to schedule, although some studies were delayed at the time of our study.  OIG 
recommended that FDA address limitations in its data management system that can hinder FDAs ability 
to track studies.   
 
Overseeing the Complex Drug and Medical Device Supply Chain.  The drug and medical device supply 
chain is growing increasingly complex, not only domestically but globally.  Intricate global supply chains 
present FDA with many challenges as medical products move through the supply chain and are at risk of 
diversion, theft, counterfeiting, and adulteration.  To enhance the security of the drug supply chain, the 
Drug Supply Chain Security Act (DSCSA) requires trading partners in the drug supply chain to exchange 
certain information with each other in each drug product transaction and to identify and investigate 
suspect and illegitimate drug products.17  FDA can then use such tracing and investigational information 
to further investigate suspect and illegitimate drug products and potential diversion.  In 2017, OIG found 
that selected wholesalers were exchanging drug product tracing information and that about half of 
themincluding the three largest wholesalers that account for more than 80 percent of drug 
distribution revenuesexchange all information required under the DSCSA.  However, some 
wholesalers were missing a few of the required tracing information elements.   
 
Progress in Addressing the Challenge 
Ensuring Food Safety.  In response to OIGs June 2016 Early Alert on FDAs food-recall initiation process, 
FDA announced the establishment of the Strategic Coordinated Oversight of Recall Execution, a team of 
FDA senior leaders that examines cases that present a significant hazard to human health and makes 
decisions during the most challenging high-risk food-recall cases.  FDA also designed and implemented a 
plan to audit and monitor FDAs recall program across all regulated product areas.  Lastly, FDA 
implemented a strategic plan to identify priorities that optimize FDAs policies and procedures for recall 
of FDA-regulated products that pose a public health risk.   
 
In 2017, FDA also implemented many longstanding OIG recommendations targeted at ensuring that 
structure and function claims made by dietary supplements are truthful and not misleading.  FDA 
educated the dietary supplement industry about registration and labeling and improved the accuracy of 
the information in the dietary supplement registry by publishing updates to three guidance documents 
and developing additional resources.  FDA improved its notification system for dietary supplement 
structure/function claims by developing an e-portal system that allows for an organized, complete, and 
                                                           
17 Drug Quality and Security Act, P.L. No.113-54, Title II. 
 
  Top Management and Performance Challenges | 37  2017 Top Management and Performance Challenges 
 
accurate accounting of health benefit claims.  FDA also expanded its market surveillance of dietary 
supplements to enforce the use of disclaimers.   
 
Ensuring the Safety, Efficacy, and Quality of Medical Products.  In response to recommendations OIG 
made related to postmarketing requirements for drug sponsors, FDA followed up with sponsors to 
ensure they are carrying out these requirements.  Through this followup, FDA enhances public safety 
and quality of care as well as compliance and accountability.  
 
Overseeing the Complex Drug and Medical Device Supply Chain.  FDA continually engages in efforts to 
enhance drug and device traceability.  For example, FDA published guidance that outlines general 
parameters for the interoperable exchange of drug product tracing information, issued revised guidance 
on product tracing requirements for dispensers, and issued draft guidance on identifying trading 
partners pursuant to requirements of the DSCSA.   
 
FDA also continues to implement the unique device identification (UDI) system for medical devices.  
FDAs UDI system for medical devices should facilitate better detection of adverse events, improve 
product recalls, and enable robust postmarket surveillance.18  In 2013, FDA promulgated a final rule 
establishing a UDI system designed to adequately identify medical devices through distribution and 
use.19  In 2016, FDA supported capturing certain UDI information on Medicare claim forms to help 
identify safety concerns with medical devices.   
 
What Needs To Be Done 
Ensuring Food Safety.  FDA must ensure the safety of the Nations food supply by continuing to monitor 
food facilities and effectively using its administrative and enforcement tools.  FDA must establish 
timeframes to discuss with a firm the possibility of a voluntary recall of its violative products.  In 
addition, FDA must finalize its mandatory recall procedures and agency guidance to include the factors 
that staff should consider when determining whether there is a reasonable probability that a food could 
cause serious adverse health consequence or death. 
 
Ensuring the Safety, Efficacy, and Quality of Medical Products.  In addition to continuing its 
implementation of DSCSA, FDA must also implement the 21st Century Cures Act, which requires FDA to, 
among other things, establish new programs to accelerate innovation and increase access to medical 
products, increase patient involvement in the research and medical product development process, and 
operationalize its new hiring authority for scientific staff.   FDA must also continue its commitment to 
improving both its postmarket reporting processes and its technical oversight capacity.   
 
Overseeing the Complex Drug and Medical Device Supply Chain.  FDA must continue to implement 
requirements of the DSCSA to enhance drug and device traceability.  To ensure that all trading partners 
comply with this law, OIG recommends that FDA offer technical assistance where appropriate.    
    
 
 
                                                           
18 Food and Drug Administration Amendments Act of 2007, P.L. No. 110-85 (enacted Sept. 27, 2007). 
19 78 Fed. Reg. 58786 (Sept. 24, 2013) and 21 CFR part 803. 
 
  Top Management and Performance Challenges | 38  2017 Top Management and Performance Challenges 
 
Key OIG Resources  
  OIG Report, Challenges Remain in FDAs Inspections of Domestic Food Facilities, September 2017. 
(https://oig.hhs.gov/oei/reports/oei-02-14-00420.pdf) 
  OIG Report, Early Alert: The Food and Drug Administration Does Not Have an Efficient and Effective 
Food Recall Initiation Process, June 2016. (http://oig.hhs.gov/oas/reports/region1/11501500.asp) 
  OIG Report, FDA Is Issuing More Postmarketing Requirements, but Challenges With Oversight Persist, 
July 2016. (https://oig.hhs.gov/oei/reports/oei-01-14-00390.asp) 
  OIG Report, Drug Supply Chain Security: Wholesalers Exchange Most Tracing Information, August 
2017. (https://oig.hhs.gov/oei/reports/oei-05-14-00640.pdf) 
   
  Top Management and Performance Challenges | 39  2017 Top Management and Performance Challenges 
 
Top Management Challenge #9: Ensuring Program Integrity and Quality in 
Programs Serving American Indian and Alaska Native Populations 
 
Why This Is a Challenge 
In FY 2016, HHS administered 45 percent of all Federal funds that serve 
Key Components of the Challenge 
American Indian and Alaska Native (AI/AN) communitiesa total of  
$7 billion.  A number of HHS agencies administer programs for AI/ANs    Improving IHS quality of care, 
throughout the United States.  With an annual budget of approximately  management, and 
$6 billion, the Indian Health Service (IHS) is the largest of these  infrastructure  
programs and, in partnership with Tribes, provides or funds health care    Combating fraud and misuse 
to approximately 2.2 million AI/ANs who are members of the 567  of funds  
federally recognized Tribes located in 36 States served by 662 health 
  Ensuring adequate internal 
care facilities.  Other HHS agencies provide grants to Tribes for human 
controls and staff training for 
services programs, ranging from Head Start to the Low Income Home 
HHS grant programs in Indian 
Energy Assistance Program (LIHEAP).  HHS faces significant challenges to 
Country 
ensuring effective delivery of crucial services to AI/ANs and protecting 
funds from fraud, waste, and abuse.   
 
Key Components of the Challenge 
Improving IHS Quality of Care, Management, and Infrastructure.  AI/ANs often face health disparities 
in comparison to the national population.  For example, the infant mortality rate for AI/ANs is about 
25 percent higher than the national rate, and AI/ANs are almost twice as likely as the overall population 
to have diabetes.  Additionally, AI/ANs have disproportionately high rates of suicide and death from 
unintentional injuries.  IHS operates health care facilities to help meet these needs, including 26 Federal 
acute-care hospitals, many of which are in remote locations.  However, some IHS hospitals face 
longstanding challenges that affect their ability to provide quality care and comply with Medicare 
standards.  These challenges include recruiting and retaining essential staff, ensuring access to needed 
care and training resources, maintaining the clinical proficiency of professional staff serving a diverse 
caseload, and maintaining and upgrading outdated buildings and equipment.  Further, OIG has found 
that IHS has few systematic sources of information on its hospitals performance and a limited capacity 
to provide clinical support.  As a result, IHS may be missing opportunities to improve the quality of care 
at its hospitals.  In addition, we found that IHS monitors hospitals through its Area Offices, which have 
varying access to information about the quality of care and degree of oversight at hospitals.  Shortages 
of staffing and funding at Area Offices also limit the clinical support and guidance they can provide.  
Hospitals with limited resources struggle to implement IT improvements and update EHR systems.  In 
addition, IHS faces challenges in combating the opioid abuse epidemic.  (For more information about 
curbing the opioid epidemic, see TMC #3.)   
 
Combating Fraud and Misuse of Funds.  OIG has identified instances of fraud that put Federal funds and 
AI/AN communities at risk.  OIG investigations have revealed that some Tribes and Tribal organizations 
have not adequately protected funds provided under the Indian Self-Determination and Education 
Assistance Act (ISDEAA).  (ISDEAA provides Tribes with the option to assume IHS program funds to 
administer programs, services, functions, and activities themselves rather than having them be 
administered by IHS.)  In some cases, the funds were misappropriated or misused by individuals.  In the 
most egregious cases, funds had been converted to personal use, leaving the Tribes with dangerous 
shortages in health care funding for their members.   
  Top Management and Performance Challenges | 40  2017 Top Management and Performance Challenges 
 
In the resolution to one alarming case of fraud, in 2017 a business owner in Montana was sentenced in 
Federal court to 2 years in prison for multiple criminal offenses related to HHS and IHS programs.  The 
business owner was convicted of conspiracy, wire fraud, and bribery, all of which were associated with 
pay to play kickback schemes related to HHS and other Federal programs on a Montana Indian 
reservation.  The business owner was ordered to pay $4.58 million in criminal restitution and fines.   
 
OIG investigations have also found that some IHS pharmacies are particularly vulnerable to fraud and 
abuse related to controlled substances, including diversion and trafficking by employees, contract 
providers, and patients.  For example, in 2016 one IHS employee in Montana was sentenced to 3 years 
of Federal probation after admitting to stealing controlled substances from two IHS pharmacies as well 
as tampering with a consumer product by replacing the controlled substance the employee had stolen 
with tablets containing other substances. 
 
In addition, OIG has pursued cases against Tribes and Tribal organizations for submitting false claims and 
violating the civil monetary penalties law.  For example, in 2017 a Washington State Tribe entered into a 
settlement to resolve allegations that it had submitted false claims to Medicaid for mental health 
counseling services that the Tribes behavioral health unit did not actually provide. 
 
Ensuring Adequate Internal Controls and Staff Training for HHS Grant Programs in Indian Country.  
Insufficient internal controls and inadequate staff training create vulnerabilities for agencies, grantees, 
and beneficiaries.  OIG has uncovered insufficient internal controls, lack of documentation relating to 
employee misconduct, and prohibited personnel practices, including the hiring of excluded individuals to 
provide items or services to Federal program beneficiaries.  For example, we found that of the 
$5.7 million in LIHEAP grant funds that the ACF awarded to one North Dakota Tribal organization for 
Federal FYs 2010 through 2014, $1.2 million was not administered by the Tribal organization in 
compliance with Federal laws, regulations, and guidance.  The errors occurred because the Tribal 
organization did not have sufficient internal controls in place to prevent the errors and because their 
staff circumvented existing internal controls.  These funds could have been used to provide additional 
benefits to eligible LIHEAP beneficiaries.  (For more information about protecting the integrity of public 
health and human services grants, see TMC #7.) 
 
Progress in Addressing the Challenge 
Improving IHS Quality of Care, Management, and Infrastructure.  IHS recently reported to OIG a broad 
range of efforts toward improvement.  IHS noted that it revised leadership and staffing for 
implementing its new Quality Framework and Office of Quality, with the goal of tracking compliance and 
quality efforts through a new accountability dashboard under development.  IHS has awarded a national 
hospital accreditation contract and is developing a formal governance structure within the IHS Directors 
office to oversee compliance throughout the agency.  With regard to internal oversight, IHS has made 
strides in establishing standards and expectations for how Area Offices and governing boards oversee 
and monitor hospitals and monitor adherence to those standards.  The agency now requires a 
standardized governance process for use by IHS hospital governing boards.  In addition, IHS has finalized 
agency-wide standards for patient wait times and is developing plans for system-wide monitoring by the 
end of 2017.  In addition, IHS has increased its focus on addressing the opioid epidemic, including 
carrying out activities related to the following priorities: provide treatment and recovery services, 
promote broader use of overdose reversal drugs, monitor opioid prescribing data, and support 
appropriate pain management.   
  Top Management and Performance Challenges | 41  2017 Top Management and Performance Challenges 
 
 
IHS is also providing opportunities for leadership training internally and through coordination with the 
Partnership to Advance Tribal Health, the Quality Improvement Organization (QIO) for IHS.  Additionally, 
IHS awarded a contract for a national provider credentialing system in 2017 and is updating its 
credentialing policy to reflect current standards and use of the new system.  IHS also implemented a 
global recruitment strategy that allows applications to be considered for multiple locations.  IHS is 
coordinating with CMS to implement the IHS and CMS Quality Improvement Network, QIO, and Hospital 
Engagement Network programs.  Further, IHS has begun planning for an agency-wide needs assessment 
for quality of care and compliance.  Finally, HHS created an Executive Council on Quality Care in 2016, 
led by the Deputy Secretary to identify opportunities from across the department that could be 
leveraged to support IHS in improving quality and safety.  The Council includes health quality experts 
from across HHS and is working collaboratively to identify opportunities to assist IHS in its improvement 
efforts.   
 
Protecting the Integrity of Programs Serving AI/ANs.  OIG is engaging in ongoing efforts to provide 
technical assistance to Tribal recipients of HHS funds.  For instance, OIG negotiated in 2017 the first-ever 
Voluntary Tribal Compliance Agreement with the Washington State Tribe mentioned earlier as part of 
the Tribes efforts to resolve allegations that it had submitted false claims to Medicaid for childrens 
mental health services.  With this type of agreement, OIG is helping the Tribe to implement a 
compliance program that includes retaining a compliance officer, establishing a compliance committee 
and relevant policies and procedures, providing pertinent training to employees, and appropriately 
screening employees upon hiring and then regularly thereafter.  Also, OIG conducted a training program 
for IHS and Tribal officials on health care and grants management compliance in South Dakota, with a 
focus on quality of care and service delivery, compliance programs and other tools for combating fraud 
and abuse, and internal controls and single audits.  In addition, in August 2017 OIG provided IHS 
headquarters managers training to mitigate grant fraud.  OIG is also working with Offices of Inspector 
General from other Federal departments to identify common risks and opportunities to strengthen 
program integrity across Federal programs serving AI/ANs. 
 
What Needs To Be Done 
Improving IHS Quality of Care, Management, and Infrastructure.  IHS should continue its efforts to 
improve oversight and quality of care at IHS hospitals.  This includes implementing a compliance 
program that provides internal controls to govern IHSs ethics and business policies and helps create a 
culture that promotes prevention, detection, and resolution of unlawful or unethical conduct.  Also, IHS 
should implement OIGs recommendation to conduct a needs assessment and continue its recent efforts 
to develop an agency-wide strategic plan with actionable initiatives and target dates.  In addition, IHS 
should establish standards for oversight activities by Area Offices and governing boards and should 
continue maturing its hospital performance metrics for the accountability dashboard.  IHS's plans for 
improvement are extensive, but these plans are early in implementation and contingent on the agencys 
ability to establish and staff new executive-level national oversight functions, including the new Office of 
Quality and Office of Strategic Workforce Development.  In addition, IHS should continue to take actions 
to curb opioid abuse, including periodically analyzing and reporting on purchasing and prescribing data 
for controlled substances within IHS facilities.    
 
Further, HHS must continue to harness expertise from across its agencies and stakeholder community to 
address IHSs challenges.  The HHS Executive Council on Quality Care should lead an examination of the 
  Top Management and Performance Challenges | 42  2017 Top Management and Performance Challenges 
 
quality of care delivered in IHS hospitals and use the findings to identify and implement innovative 
strategies to mitigate IHSs longstanding challenges.  In addition, CMS should conduct more frequent 
surveys of nonaccredited IHS hospitals. 
 
Protecting the Integrity of Programs Serving AI/ANs.  To ensure that HHS funds are protected and that 
AI/AN communities receive maximum value and benefit from services, Tribes and Tribal organizations 
should develop and implement policies, procedures, and internal controls to detect and prevent fraud, 
mismanagement of funds, and improper billing.  HHS reported that it is using annual audits to assess 
these issues.  In addition, programs serving AI/ANs should ensure that their staffs are adequately trained 
to comply with Federal requirements and Tribal policies and controls. 
   
Key OIG Resources 
  OIG Report, The Three Affiliated Tribes Improperly Administered Low-Income Home Energy 
Assistance Program Funds for Fiscal Years 2010 Through 2014, July 2017.  
(https://oig.hhs.gov/oas/reports/region7/71604230.asp) 
  OIG Training Session, Protecting Indian Health and Human Services Programs and their 
Beneficiaries: The Basics of Health Care and Grants Management Compliance, Crazy Horse, South 
Dakota, April 2017. (https://oig.hhs.gov/conference/) 
  OIG Companion Reports, Indian Health Service Hospitals: More Monitoring Needed to Ensure 
Quality Care in Indian Health Service Hospitals: Longstanding Challenges Warrant Focused 
Attention to Support Quality Care, October 2016. (https://oig.hhs.gov/oei/reports/oei-06-14-
00010.asp and https://oig.hhs.gov/oei/reports/oei-06-14-00011.asp) 
  OIG Report, Expenses Incurred by the Rocky Boy Health Board Were Not Always Allowable or 
Adequately Supported, March 2016. (https://oig.hhs.gov/oas/reports/region7/71504221.asp) 
  OIG Alert to Tribes and Tribal Organizations To Exercise Caution in Using Indian Self-Determination 
and Education Assistance Act Funds, November 2014.  
(https://oig.hhs.gov/compliance/alerts/guidance/20141124.pdf) 
  Podcasts, Voluntary Tribal Compliance Agreement, February 2017, and What Is OIG's Work in 
Indian Country?, August 2016. (https://oig.hhs.gov/newsroom/podcasts/)  
   
  Top Management and Performance Challenges | 43  2017 Top Management and Performance Challenges 
 
Top Management Challenge #10: Protecting HHS Data, Systems, and 
Beneficiaries From Cybersecurity Threats 
Why This Is a Challenge 
Key Components of the Challenge 
Data management, use, and security are essential to the 
effective and efficient operation of HHS and its programs.  As    Protecting HHSs data and 
HHS works to leverage the power of data, the Department will  systems 
maintain and use expanding amounts of sensitive data.  So, 
  Fostering a culture of 
too, will individuals and entitiessuch as States, contractors, 
cybersecurity beyond HHS  
providers, grant recipients, and beneficiariesinvolved in 
delivering or receiving benefits from the many HHS programs.  
Cybersecurity incidents and breaches pose a significant risk to the confidentiality, integrity, and 
availability of sensitive data.  This could cause a myriad of problems including impeding HHSs ability to 
offer essential programs and services, threatening major elements of our countrys critical 
infrastructure, and placing the health and safety of patients at risk.  The Department must ensure that it 
takes appropriate actions to protect all HHS data and systems from cybersecurity threats.  Similarly, HHS 
must protect its beneficiaries by fostering a culture of cybersecurity among its partners and 
stakeholders. 
 
The environment in which the Department must achieve these imperatives is complex.  For example, 
the sheer volume of data grows at an extremely rapid rate, which means there are significant and ever-
increasing amounts of data to protect.  Relatedly, data reside in many places and in the possession of 
private individuals and organizations who have a wide range of cybersecurity knowledge, experience, 
and resources.  The continuing expansion of the Internet of Things, including networked medical 
devices, further increases potential attack vectors.  These factors all impact the threat ecosystem. 
 
Additionally, dataparticularly health care dataare extremely valuable to cyber criminals.  Media 
reports have identified the value of electronic health records (EHRs) to be as much as 10 times that of a 
credit card number.  The threat facing the Department comes not just from individual actors, but also 
from organized groups representing or acting on behalf of criminal organizations and foreign nation 
states with sophisticated tools and resources.  Furthermore, many public and private individuals, 
organizations, and agencies operate aging equipment and outdated software, which can create 
challenges in terms of keeping up with technological advances and evolving cybersecurity threats.  For 
example, the WannaCry ransomware that critically impacted the United Kingdoms National Health 
Service in May 2017 and the NotPetya malware that halted a pharmaceutical companys production of 
some of its drugs in June 2017 offer cautionary warnings.  The Department and its public and private 
partners and stakeholders have taken some steps to address coordination and information sharing 
concerning cybersecurity threats, but they must continue to work to enhance capabilities.    
  Top Management and Performance Challenges | 44  2017 Top Management and Performance Challenges 
 
Key Components of the Challenge 
Protecting HHSs Data and Systems.  HHS must continually undertake efforts to protect its data and 
information systems and make certain that the Department is prepared to respond in the event of an 
incident.  Meanwhile, the Department is under constant attack as criminals attempt to infiltrate or 
disrupt HHS systems.20  OIG has identified cybersecurity vulnerabilities in multiple HHS systems and 
State Medicaid systems, including inadequacies in access controls, patch management, configuration 
management, encryption of data, and website security.  Such weaknesses could affect the Departments 
ability to protect against unauthorized access to sensitive information.  HHS is also responsible for 
complying with Executive Order 13800 (Strengthening the Cybersecurity of Federal Networks and 
Critical Infrastructure) as well as implementing the Continuous Diagnostics and Mitigation program in 
conjunction with the U.S. Department of Homeland Security (DHS).  When implementing technology, 
HHS must use modern IT practices, such as those highlighted by the Digital Services Playbook.  
Additionally, more and more of the Departments programs, such as the All of Us Research Program, are 
becoming technology dependent.  Ensuring the protection of the confidentiality, integrity, and 
availability of participants personal informationand the systems the initiatives rely onis paramount. 
 
Fostering a Culture of Cybersecurity Beyond HHS.  To protect the privacy and safety of those served by 
HHS programs, the Department must foster a culture that prioritizes cybersecurity among its partners 
and stakeholders.21  The Department can encourage such a culture through policy and partnerships.  
With respect to policy, the Department must determine when and how to appropriately use existing 
policy leverssuch as regulations, contract or grant requirements, financial incentives, or guidanceto 
encourage cybersecurity efforts without creating undue burden.  For example, FDA has opportunities to 
promote cybersecurity in fulfilling its responsibility to ensure the safety and effectiveness of medical 
devices.  Similarly, CMS has opportunities in the design and operation of its programs to further 
cybersecurity among participants.   
 
The Department must collaborate with public and private partners and stakeholders to further 
cybersecurity goals.  HHS is the Sector-Specific Agency for the Healthcare and Public Health Sector (HPH) 
and the Co-Sector-Specific Agency for the Food and Agriculture Sector.  In those roles, HHS is tasked 
with, among other things, coordinating with Federal partners, collaborating with critical infrastructure 
owners and operators, and offering support in identifying vulnerabilities and mitigating incidents.22  
These sectors face many cybersecurity-related issues, including those identified in the Health Care 
Industry Cybersecurity Task Force Report (the Task Force Report), released in June 2017.  The 
Department must determine how best to support partners and stakeholders efforts to enhance 
cybersecurity while being mindful of the wide diversity in the infrastructure and resources available to 
prepare for, detect, and respond to cybersecurity threats.   
                                                           
20 See, for example, Chase Gunter, Federal Computer Week (FCW), CIO: HHS faces 500 million hack attempts per 
week, June 20, 2017.  Available at https://fcw.com/articles/2017/06/20/hhs-cio-cyber-attacks.aspx. 
21 Executive Order 13636, Improving Critical Infrastructure Cybersecurity, and Presidential Policy Directive (PPD) 
21, Critical Infrastructure Security and Resilience. 
22 Ibid. 
 
  Top Management and Performance Challenges | 45  2017 Top Management and Performance Challenges 
 
Progress in Addressing the Challenge 
Protecting HHSs Data and Systems.  HHS has made progress in strengthening the privacy safeguards 
and security of its systems and information.  For example, HHS adopted DHSs Continuous Diagnostics 
and Mitigation program and is currently working on final implementation of Phase Two.  Additionally, 
HHS has taken steps to address vulnerabilities identified in OIG cybersecurity reports, including those 
referenced above.  
 
Fostering a Culture of Cybersecurity Beyond HHS.  Similarly, HHS made progress in fostering a culture of 
cybersecurity among public and private partners and stakeholders.  In 2016, FDA published final 
guidance addressing postmarket cybersecurity vulnerabilities for medical devices.  In addition, in 2016 
FDA entered into a new Memorandum of Understanding with the National Health Information Sharing 
and Analysis Center (NH-ISAC) and the Medical Device Innovation, Safety, and Security Consortium to 
share information on cybersecurity threats and foster the development of risk assessment 
frameworks.  Further, HHS has undertaken efforts to increase communication within the Department 
and across the HPH Sector by developing its new Healthcare Cybersecurity and Communications 
Integration Center (HCCIC).  According to the Department, the HCCIC is a necessary resource for health 
care providers and a sector-specific response to cybersecurity threats that will supplement DHSs 
National Cybersecurity and Communications Integration Center and provide direct benefits for health 
care cybersecurity.  Additionally, HHS awarded cooperative agreements to the NH-ISAC totaling 
$350,000 to support cybersecurity efforts by HPH Sector partners through the sharing of information 
and threat indicators.  Finally, the Department continued its efforts as a Sector-Specific Agency to 
improve sector-specific communication by, among other things, sharing important information with 
health care providers and associations during the May 2017 WannaCry incidents. 
 
What Needs To Be Done 
Protecting HHSs Data and Systems.  Cybersecurity threats are evolving, as evidenced by the recent rise 
of ransomware, and HHS must remain vigilant.  While HHS continues to undertake efforts to protect its 
own data and systems, more remains to be done.  To protect its data and systems, the Department must 
continue to take steps to address vulnerabilities previously identified by OIG and others.  OIGs work will 
continue to focus on HHS systems privacy and security to support HHSs efforts to mitigate the risk of 
unauthorized access or changes to or theft of its sensitive information.  In addition, across HHS, several 
key mission areas rely on aging or outdated technology.  These systems pose a risk to the successful 
execution of the HHS mission if they fail or are compromised.  As the Department updates or acquires 
new technology, HHS must also ensure that it aligns with technology priorities defined in legislation and 
administration policy.  This includes the full implementation of the Federal Information Technology 
Acquisition Reform Act, modernization of legacy systems, and adoption of modern IT management 
practices. 
 
Fostering a Culture of Cybersecurity Beyond HHS.  To further foster a culture of cybersecurity among 
partners and stakeholders to protect beneficiaries, HHS must use available policy levers to address 
Health IT security issues.  Ongoing work will continue to consider security issues related to networked 
medical devices, and future work may consider additional security issues that arise from the continuing 
expansion of the Internet of Things.  Furthermore, the Department must complete its review of 
recommendations included in the Task Force Report and determine how best to address those 
recommendations.   
   
  Top Management and Performance Challenges | 46  2017 Top Management and Performance Challenges 
 
Key OIG Resources 
  OIG Report, HealthCare.gov: Case Study of CMS Management of the Federal Marketplace, February 
2016. (https://oig.hhs.gov/oei/reports/oei-06-14-00350.pdf) 
  OIG Report, Hospitals Largely Reported Addressing Requirements for EHR Contingency Plans, 
July 2016. (https://oig.hhs.gov/oei/reports/oei-01-14-00570.asp) 
  OIG Summary Report, Wireless Penetration Test of Centers for Medicare & Medicaid Services Data 
Centers, August 2016. (https://oig.hhs.gov/oas/reports/region18/181530400.asp) 
  OIG Summary Report, Information Technology Control Weaknesses Found at the Commonwealth of 
Massachusetts Medicaid Management Information System, March 2017. 
(https://oig.hhs.gov/oas/reports/region6/61500057.asp) 
  OIG Summary Report, Virginia Did Not Adequately Secure Its Medicaid Data, May 2017. 
(https://oig.hhs.gov/oas/reports/region4/41505066.asp) 
  OIG Summary Report, Information Technology Control Weaknesses Found in the New Mexico Human 
Services Departments Medicaid Eligibility Systems, August 2017. 
(https://oig.hhs.gov/oas/reports/region6/61605000.asp) 
  OIG Summary Report, The State of North Carolina Did Not Ensure That Federal Information System 
Security Requirements Were Met for Safeguarding Its Medicaid Claims Processing Systems and Data, 
August 2017. (https://oig.hhs.gov/oas/reports/region7/71600469.asp) 
 
  Top Management and Performance Challenges | 47