Introduction 
The 2019 Top Management and Performance Challenges Facing HHS is an annual 
publication of the Department of Health and Human Services (HHS or the Department) 
Office of Inspector General (OIG).  In this edition, OIG has identified six top management 
and performance challenges (TMCs) facing the Department as it strives to fulfill its mission to 
enhance the health and well-being of all Americans, by providing for effective health and human 
services and by fostering sound, sustained advances in the sciences underlying medicine, public health, and 
social services.  This year, OIG synthesized new and past challenges and reorganized them into six TMCs.  These 
top six challenges reflect overarching issues that affect multiple HHS programs and responsibilities.  These are not 
the only challenges that face HHS, and OIG reports are a key resource that highlight specific opportunities to 
improve HHS programs and operations.  
HHS is responsible for a portfolio of more than $1 trillion, and its programs impact the lives of virtually all 
Americans.  To identify the six TMCs, we integrated OIGs oversight, risk analysis, data analytics, and enforcement 
work.  For each TMC, we describe the dimensions of the challenge, highlight the progress that the Department has 
made in addressing the challenge, and identify what remains to be done.     
Management and performance challenges are inherently cross-cutting and the TMCs reflect how multiple HHS 
Operating Divisions (OpDivs) may be affected by these pressing issues.  For example, the challenge of financial 
integrity highlighted in TMC 1 has natural intersections with the challenge of delivering value, quality, and 
improved outcomes in Medicare and Medicaid, the subject of TMC 2.  This document identifies those 
intersections.  Given that challenges cross both internal HHS boundaries and sometimes externally across 
Departments at the Federal and State levels, coordination among HHS agencies and across Government is integral 
to addressing these challenges.       
In addition to this annual publication, OIG maintains a list of significant unimplemented OIG recommendations, 
including legislative recommendations, to address vulnerabilities.  These recommendations are drawn from OIGs 
audits and evaluations.  OIG identifies the top unimplemented recommendations that, in OIGs view, would most 
positively affect HHS programs in terms of cost savings, program effectiveness and efficiency, and public health 
and safety.1  
More information on OIGs work, including the reports mentioned in this publication, is available on our website at 
https://oig.hhs.gov.  
1 
     
 
   
1  4 
Ensuring the Financial 
Safeguarding Public Health
 
Integrity of HHS Programs
 
2  5
Delivering Value, Quality,  Harnessing Data To Improve 
and Improved Outcomes in  Health and Well-Being of 
Medicare and Medicaid   Individuals 
   
3  6
Working Across Government 
Protecting the Health and 
To Provide Better Service to 
Safety of HHS Beneficiaries
 
  HHS Beneficiaries 
 
2 
     
 
 
 
 
Table of Contents 
Introduction ................................................................................................................................................................... 1 
Acronyms ....................................................................................................................................................................... 4 
Ensuring the Financial Integrity of HHS Programs ......................................................................................................... 5 
Delivering Value, Quality, and Improved Outcomes in Medicare and Medicaid ........................................................ 12 
Protecting the Health and Safety of HHS Beneficiaries ............................................................................................... 17 
Safeguarding Public Health .......................................................................................................................................... 21 
Harnessing Data To Improve Health and Well-Being of Individuals ............................................................................ 26 
Working Across Government To Provide Better Service to HHS Beneficiaries ........................................................... 32 
 
 
 
 
3 
     
 
Acronyms 
 
ACF  Administration for Children and Families  HHA  Home Health Agency 
ACO  Accountable Care Organization  HHS  Department of Health and Human 
Services 
AI/AN  American Indian/Alaska Native 
HUD  Department of Housing and Urban 
API  Application Programming Interface 
Development  
AHRQ  Agency for Healthcare Research and Quality 
IHS  Indian Health Service 
ARPO  Appalachian Regional Prescription Opioid  
IT  Information Technology 
ASPR  Office of the Assistant Secretary for  
MA  Medicare Advantage 
Preparedness and Response 
FY  Fiscal Year 
CCDF  Child Care and Development Fund 
GAO  Government Accountability Office 
CDC  Centers for Disease Control and Prevention 
MAC  Medicare Administrative Contractor 
CHIP  Childrens Health Insurance Program 
MAO  Medicare Advantage Organization 
CMS  Centers for Medicare & Medicaid Services 
MAT  Medication-Assisted Treatment 
CY  Calendar Year 
MCO  Managed Care Organization 
DATA  Digital Accountability and Transparency Act 
of 2014  NIH  National Institutes of Health 
DEA  Drug Enforcement Agency   OCR  Office of Civil Rights 
DHS  Department of Homeland Security   OIG  Office of Inspector General 
DME  Durable Medical Equipment  OMB  Office of Management and Budget 
DOJ  Department of Justice  ONC  Office of the National Coordinator for 
Health Information Technology 
ED  Emergency Department 
ORR  Office of Refugee Resettlement 
EHR  Electronic Health Record 
OS  Office of the Secretary 
FAR  Federal Acquisition Regulation 
OUD  Opioid Use Disorder 
FBI  Federal Bureau of Investigation  
PCS  Personal Care Services 
FDA  Food and Drug Administration 
TMC  Top Management Challenge 
FEMA  Federal Emergency Management Agency  
SAMHSA  Substance Abuse and Mental Health 
FFS  Fee-For-Service 
Services Administration 
FPS  Fraud Prevention System 
SNF  Skilled Nursing Facility 
FHIR  Fast Health Interoperability Resource  
TANF  Temporary Assistance for Needy Families 
FSMA  Food Safety Modernization Act 
T-MSIS  Transformed Medicaid Statistical 
HIPAA  Health Insurance Portability and   Information System  
Accountability Act of 1996 
UAC  Unaccompanied Alien Children 
HRSA  Health Resources and Services  
Administration 
4 
     
 
1: Ensuring the Financial 
Integrity of HHS Programs 
 
T
he Department of Health and Human Services (HHS or the 
Department) is the largest civilian agency in the Federal  RELEVANT OPDIVS 
 
Government, with a $1.2 trillion budget in fiscal year (FY) 
All HHS  
2019, representing more than one-third of the total Federal budget.  
KEY ELEMENTS 
HHSs Medicare program is the Nations largest health insurer, 
  Controlling costs by ensuring 
handling more than 1 billion claims per year.  Medicare and 
proper payment for goods and 
Medicaid, the Departments largest programs, comprise 49 percent 
services 
of the U.S. health care insurance economy.  More than 136 million 
  Reducing improper payments  
beneficiaries, or more than 40 percent of Americans, rely on these 
  Combating fraud, waste, and 
programs for their health insurance, including senior citizens, 
abuse in HHS programs 
individuals with disabilities, low-income families and individuals, 
and patients with end-stage renal disease.2  CMS bears the    Monitoring and reporting on 
the integrity of HHS programs 
responsibility at HHS for administering these programs.  Federal 
Medicare expenditures totaled $644.8 billion in FY 2019; Federal 
 
Medicaid spending totaled $418.7 billion in FY 2019 (with an additional $18.6 billion for the Childrens Health 
Insurance Program (CHIP)).3     
HHS is also the largest grant-making and fourth-largest contracting agency in the Federal Government.  In FY 2018, 
HHS awarded $109 billion in grants (excluding CMS) and $25 billion in contracts.  Responsible stewardship that 
ensures the transparency and accountability of HHS funds is paramount to making sure that HHS beneficiaries and 
the American public get the true benefit of this substantial financial investment.   
The Department must protect the fiscal integrity of HHS funds and ensure that beneficiaries have access to the 
services they need, especially in light of looming financial shortfalls in the Medicare program,4 , 5 the expansion of 
Medicaid services to a larger population, and the increased use of grants as funding tools to achieve program 
results.  HHS should take steps to control costs by ensuring proper pricing for goods and services; reducing 
improper payments; and preventing, detecting, and prosecuting fraud in HHS programs.  The Department must not 
only manage both the efficient and effective use of funds internally but also oversee the thousands of external 
funding recipients use of Federal funds to fulfill HHSs mission.   
Controlling costs by ensuring proper payment for goods and services 
Whether HHS is paying for medical services, prescription drugs, or complex information technology (IT) solutions, 
managing what the Department pays and recognizing and remedying payment policies that inadvertently 
incentivize improper billing or inflate prices are critical to controlling costs.  
Medicare 
Medicare should act as a prudent payer on behalf of taxpayers and beneficiaries, including instituting 
payment policies delivering greater value.  (See TMC 2 for more information on value-based payment 
models.)  In certain contexts, Medicare payment policies, which are generally set by statute, result in 
Medicare and beneficiaries paying more for care provided in certain settings than for the same care 
5 
     
 
provided in other settings.  For example, Medicare could have 
potentially saved $4.1 billion over a 6-year period if swing-bed 
services at critical access hospitals had been paid for at the same rates as 
at skilled nursing facilities (SNFs).6  Likewise, Medicare pays hospitals different 
amounts for the same care depending on whether the hospital admits beneficiaries 
as inpatients or treats them as outpatients.  Some payment policies create financial 
inequities that actually may drive up Medicare costs without improving care for beneficiaries.7, 8 
For example, the OIG found that Medicare payments to SNFs for therapy greatly exceeded SNFs costs 
for that therapy, creating an environment that provides incentives to bill for unnecessary therapy.9 
Prescription drug programs  
Vulnerabilities exist in HHSs payment strategies for prescription drugs and biologicals.  HHS programs 
accounted for 40 percent ($136 billion) of the total U.S. prescription drug expenditures in 2017.  Increases 
in prescription drug prices have contributed to the growth in total prescription drug spending.  Increases 
in drug prices may limit patients access to needed prescription drugs if the out-of-pocket costs become 
unaffordable.  The way that Medicare and Medicaid pay for drugs, in addition to fundamental differences 
in how the Medicare Part B and Part D programs are structured, can result in additional costs for 
programs and their beneficiaries.  In the Part D program, for example, OIG found that although there was 
a 17-percent decrease in Medicare Part D prescriptions for brand-name drugs from 2011 to 2015, there 
was a 77-percent increase in total reimbursement for these drugs, leading to greater overall Part D 
spending and higher beneficiary out-of-pocket costs.10  In the Part B program, OIG found that Medicare 
would have saved millions of dollars if dispensing fees for several drugs had been aligned with the rates 
that Part D and State Medicaid programs paid.11  In addition, CMS includes prices for higher-cost versions 
of drugs that are not covered under Medicare Part B when setting Part B payment amounts.  OIG found 
that, because CMS included noncovered versions when setting payment for two Part B drugs, Medicare 
and beneficiaries paid an extra $366 million from 2014 through 2016.12  HHS must endeavor to limit the 
impact of high prices on programs and beneficiaries while protecting access to medically necessary drugs.  
Additionally, the Department should be prepared to address coverage and reimbursement challenges of 
emerging technologies, such as biosimilars and gene therapies like chimeric antigen receptor T-cell 
therapy. 
Contracts 
Better controls in HHSs contracting process could strengthen competition and pricing for HHS-purchased 
goods and services.  OIG has identified vulnerabilities in acquisition planning and monitoring of 
procurement and contracts.  For instance, key HHS contracts may not always undergo Contract Review 
Board oversight before being awarded, and when awarding contracts, CMS has not always performed 
thorough reviews of contractors past performance.13  Similarly, in the past, CMS and other OpDivs have 
frequently chosen contract types that place the risk of cost increases solely on the Government.14   
Reducing improper payments  
Due to their size, HHS programs account for some of the largest estimated improper payments in the Federal 
Government.  Medicare, Medicaid, and CHIP accounted for $86.1 billion, or 99.6 percent, of the $86.4 billion in 
improper payments that HHS reported in its FY 2018 Agency Financial Report.15  Furthermore, insufficient HHS 
oversight of grant programs and contracts poses risks of significant improper payments and payments for 
unallowable costs.     
6 
     
 
Medicare 
Traditional Medicare fee-for-service (FFS) accounted for $31.6 
billion, or about 37 percent, of the improper payments that HHS reported.  
Notably, this improper payment rate decreased from 9.5 percent, or $36.2 
billion, in FY 2017 to 8.1 percent in FY 2018.16  This represents positive momentum 
upon which the Department and CMS can build.  However, some types of providers and 
suppliers pose heightened risk to the financial security of Medicare.17  For instance, OIG and CMS 
have identified especially high rates of improper payments for home health, hospice, and SNF care, 
durable medical equipment (DME), chiropractic services, and certain hospital services.18  HHS and CMS 
have taken corrective actions for the Medicare FFS program focusing on specific service areas with high 
improper payment rates.  Although this years reduction in the improper payment rate was driven by a 
reduction in improper payments for home health and SNF claims, CMS should take further action to 
reduce improper payments among certain provider and supplier types and in geographic locations that 
present a high risk to the financial security of Medicare.  Further, CMS should ensure that it is prepared to 
detect and prevent improper payments in burgeoning areas, such as telemedicine and genetic testing. 
Medicaid 
Medicaid is a Federal-State financing partnership with the 50 States, 5 territories, and the District of 
Columbia, each offering its own program variations reflecting State and local needs and preferences.  
CMSs Payment Error Rate Measurement (PERM) program measures improper payments in Medicaid and 
CHIP in all 50 States and the District of Columbia using a 17-State 3-year rotation.  In FY 2018, the 
improper payment rate for the Medicaid program was 9.8 percent.19  OIG audits have identified 
substantial improper payments to providers across a variety of Medicaid services, including school-based, 
non-emergency medical transportation, targeted case management, and personal care services.20  CMS 
has engaged with State Medicaid agencies to develop corrective action plans that address State-specific 
reasons for improper payments identified through the PERM program.  OIG work has also identified that 
States are not always correctly determining eligibility of individuals to receive Medicaid benefits, resulting 
in potential improper payments.  Given that CMS will resume the Medicaid eligibility component 
measurement and report updated national eligibility estimates for FY 2019, the improper payment rate 
may significantly increase for this fiscal year.  
Grants and contracts 
Administering grant programs and contracts requires HHS to implement internal controls to ensure 
program goals are met and funds are used appropriately.  For grant programs, this includes oversight and 
guidance to award recipients.  HHS is responsible for providing up-to-date policies to grant recipients and 
helping States and other grantees address their own financial management and internal control issues.  
Without proper internal controls, funds may be misspent, duplication of services may occur, and sub-
recipients may not be adequately monitored.  OIG has identified grantee-level concerns in several HHS 
programs, including some Office of Refugee Resettlement (ORR) Unaccompanied Alien Children (UAC) 
Program grantees reporting unallowable costs and lacking effective systems for administering program 
funds;21 and States not sufficiently overseeing their Child Care and Development Fund (CCDF) program 
payments.22   
As a critical element of ensuring that grant funds are used appropriately, HHS must track and report 
improper payment rates for its risk-susceptible grant programs, in keeping with the Improper Payments 
Information Act of 2002.23  However, since the inception of these reporting requirements, HHS has not 
7 
     
 
reported an improper payment estimate for the Temporary 
Assistance for Needy Families (TANF) program.  States receive block 
grants ($16.5 billion annually) to design and operate TANF programs.  
HHS has stated that it does not believe it has the statutory authority to collect 
from States the data necessary for calculating an improper payment rate for the 
TANF program.  The Office of Management and Budget (OMB) has identified TANF as a 
risk-susceptible program that must report estimated rates and amounts of improper payments.  
HHS must continue to pursue needed legislative remedies to develop an appropriate methodology for 
measuring TANF payment accuracy and report an improper payment estimate for TANF. 
In terms of the Departments oversight of contracts, HHS has taken steps to enhance its acquisition 
systems and better monitor contract closeouts and contract payments.  Moreover, CMS has increased its 
efforts in examining workload statistics for benefit integrity contractors and improving performance 
outcomes.  However, OIG has identified problems with the Departments processes for contract 
closeouts.  CMS relies extensively on contractors to carry out its mission and spends billions of dollars 
each year in contracts.  Because improper payments may be identified and recovered during the closeout 
process, it is imperative that contracts are closed in accordance with Federal Acquisition Regulation (FAR) 
requirements.  The closeout process, generally, is the last chance for improper contract payments to be 
detected and recovered, and delayed closeout poses a financial risk to agency funds.  OIG found that a 
large backlog of unfinalized indirect cost rates may have contributed to the untimely closeout of CMS 
contracts totaling $25 billion.24  Although CMS has taken steps to improve its closeout and contract 
management processes, the Department needs to take additional actions to ensure that it is meeting FAR 
requirements.   
Combating fraud, waste, and abuse in HHS programs 
Fraud, waste, and abuse divert needed program resources to 
inappropriate, unauthorized, or illegal purposes.  Effectively fighting fraud, 
waste, and abuse requires vigilance and sustained focus on preventing 
problems from occurring in the first place, detecting problems promptly 
when they occur, and rapidly remediating detected problems through 
investigations, enforcement, and corrective actions.  To accomplish this, 
HHS must have controls to ensure the proper use of resources and to 
detect and prevent fraud.  The Department should also apply a robust 
program integrity strategy to protect current and future HHS programs. 
Program integrity strategies 
HHS programs must be designed with program integrity in mind.  
These strategies must take into account the various methods that 
HHS uses to implement its programs, including how public and 
private partners can help in meeting the Departments mission.  
Additionally, these strategies must include systems and processes to detect and prevent fraud, as well as 
plans for addressing fraud when it occurs. 
Systems and processes for detecting and preventing fraud 
With respect to detecting and preventing fraud and improper payments, CMSs Fraud Prevention System 
(FPS) serves as an important tool that should be improved to increase its effectiveness.  Since 2011, the 
8 
     
 
FPS has continuously run predictive algorithms and other 
sophisticated analytics nation-wide against Medicare FFS claims 
prior to payment to identify, prevent, and stop fraudulent claims.  
However, OIG found that the FPS is not as effective in preventing fraud, waste, 
and abuse in Medicare as it could be and recommended that CMS should make better 
use of the performance results within its FPS to refine and enhance its predictive analytic 
models.25 
In the Medicare and Medicaid programs, States must keep bad actors intent on committing fraud from 
participating in the programs.  With respect to Medicaid in particular, significant problems remain for 
ensuring all high-risk Medicaid providers undergo criminal background checks.  Further, States are not 
sharing provider enrollment data with Federal and State partners to streamline the Medicaid enrollment 
process.  Sharing these data would reduce the chance for error within any one of the State and Federal 
databases and help in identifying fraud schemes and other vulnerabilities that cross State lines.26  CMS 
should continue to work directly with States to implement tools such as fingerprint-based criminal 
background checks for high-risk providers.  Further, CMS should develop a central repository or one-stop 
shop with provider information that all States and Medicare can use. 
Medicare and Medicaid 
Schemes to steal money from Medicare and Medicaid take many forms and vary depending on setting 
and services provided.  These fraud schemes can be as simple as billing for services not provided and 
identity theft or as complex as kickbacks, improper prescribing, deceptive marketing, and money 
laundering.  The perpetrators of fraud schemes range from highly respected physicians to individuals with 
no prior experience in the health care industry to organized criminal enterprises.   
Managed care continues to play an increasingly important role in Medicare and Medicaid.  Unlike in FFS, 
where CMS (Medicare) or the State (Medicaid) pays providers directly for each covered service received 
by a beneficiary, under managed care, CMS or the State pays a population-based fee to a managed care 
plan for each person enrolled in the plan.  In turn, the plan pays providers for services a beneficiary may 
require that are included in the plans contract with CMS or the State.  Managed care is the primary 
delivery system for Medicaid, covering at least some services for more than 80 percent of all enrollees.27  
In Medicare, one-third of beneficiaries are enrolled in Medicare Advantage organizations (MAOs).  HHS 
faces a significant challenge in protecting managed care programs and other non-traditional models 
against fraud, waste, and abuse.  
OIG has found weaknesses in MAOs and Medicaid managed care organizations (MCOs) efforts to identify 
and address fraud and abuse by their providers.28  CMS requires MAOs and Medicaid MCOs to implement 
compliance plans that include measures to prevent, detect, and correct instances of fraud, waste, and 
abuse and non-compliance with CMSs program requirements.  However, these plans vary widely among 
the MAOs, as does the detection of suspected fraud.  In Medicaid managed care, program integrity 
responsibilities are even more dispersed, as they are shared among CMS, States, and MCOs.  This makes 
effective oversight by CMS more complex and challenging.   
CMS is working to validate the completeness and accuracy of MAO and Medicaid MCO encounter data 
and recently has released best practices guidance for MAOs to improve encounter data submission.  CMS 
is also working with States to provide technical assistance and education to identify and share best 
practices for improving Medicaid MCO identification and referral of cases of suspected fraud or abuse.  
9 
     
 
CMS should take further actions to ensure the completeness, 
validity, and timeliness of Medicaid encounter data.  Further, CMS 
should work with its contractors and with States to make improvements 
in efforts to identify and address fraud and abuse.  Additionally, CMS should 
work to ensure that appropriate information and referrals are sent to law 
enforcement.   
Grants and contracts 
Without adequate oversight and internal controls, grants and contracts are vulnerable to fraud schemes, 
including embezzlement.29 HHS has worked to strengthen some of its program integrity efforts focused on 
grant programs.  For instance, it issued guidance to HHS awarding OpDivs about facilitating a review of 
prospective grantees prior to awarding grants.30  This information enhances awarding OpDivs assessment 
of prospective grant recipients integrity and potential performance.  
Fraud involving prescription opioids 
Opioid-related fraud encompasses a broad range of criminal activity, from prescription drug diversion to 
addiction treatment schemes.  OIG investigations show that opioid drug diversion (the redirection of 
legitimate drugs for illegitimate purposes) is on the rise.  Diverted opioid drugs are at high risk to be used 
inappropriately and create significant harm, including increased risk of overdose.  Also at high risk for 
diversion are potentiator drugs (drugs that exaggerate euphoria and escalate the potential for misuse 
when combined with opioids) and drugs indicated to treat opioid use disorders (OUDs) (particularly 
buprenorphine).  
OpDivs should improve efforts to identify and investigate potential fraud and abuse in prescription drug 
programs.  For instance, CMS should collect comprehensive data from Medicare Part D plan sponsors.  
CMS should ensure that national Medicaid data are adequate to detect suspected fraud or abuse.  The 
lack of reliable national Medicaid data hampers enforcement efforts.  (See TMC 5.)  CMS and States 
should follow up on prescribers with questionable prescribing patterns to ensure that Medicare Part D 
and Medicaid are not paying for unnecessary drugs that are being diverted for resale or recreational use.  
OIG has also recommended that the Indian Health Service (IHS) improve its internal controls against 
opioid-related fraud, including controls at entry points to sensitive areas of its hospitals to protect its 
pharmacy inventory from unauthorized access.31  In addition, the Department must guard against fraud in 
OUD treatment programs, including, for example, the submission of fraudulent insurance claims for 
purported OUD treatment and testing services.32   
Monitoring and reporting on the integrity of HHS programs 
HHS must ensure the completeness, accuracy, and timeliness of financial and program information provided to 
other entities, both internal and external to the Federal Government.  Responsible stewardship of HHS programs is 
vital to operating a financial management and administrative infrastructure that employs appropriate safeguards 
to minimize risk and provide oversight for the protection of resources.  Although HHS continues to maintain a 
clean opinion on their basic financial statements that culminate the results of their programs, addressing 
weaknesses in financial management systems and meeting the requirements of the Digital Accountability and 
Transparency Act (DATA Act) of 2014 remain challenges for HHS. 
Addressing weaknesses in financial management systems 
Financial management systems help OpDivs ensure operational effectiveness and efficiency, financial 
reporting reliability, and compliance with applicable laws and regulations.  OIG continues to find 
10 
     
 
significant deficiencies in internal controls over segregation of 
duties, configuration management for approved changes to HHS 
financial systems, and access to HHS financial systems.33  HHS must take 
additional actions to address and resolve these issues, including continuing to 
work to control user access, ensuring proper approval of and documentation 
supporting system changes, and ensuring appropriate segregation of duties so that no one 
employee can both enter and approve information entered into HHS financial management 
systems.34   
Meeting the requirements of the DATA Act of 2014 
The DATA Act required agencies to use Government-wide data standards to report financial and award 
information into USAspending.gov.  For FYs 2017, 2019, and 2021, the DATA Act also requires the 
Inspector General of each agency to determine the accuracy, completeness, timeliness, and quality of 
these data.  In FY 2018, OIG performed an additional audit to follow-up on prior issues and monitor and 
provide feedback on the progress made by the Department.  For FY 2018, OIGs audit of compliance with 
the DATA Act found that HHS complied with data standards but continued to rely on a manual, labor-
intensive process.35  HHS needs to continue to automate the standardization and transmission of data to 
the Department of Treasury.   
   
11 
     
 
2: Delivering Value, Quality, 
and Improved Outcomes in 
Medicare and Medicaid 
 
T 
he transition to innovative, value-based, consumer-
empowered care is a top Administration36 and Departmental  RELEVANT OPDIVS 
priority.  HHS continues to enact reforms in Medicare and 
CMS, ONC, OS 
Medicaid to promote quality, efficiency, and value of care.  These 
KEY ELEMENTS 
reforms come with an array of operational and program integrity 
  Aligning program incentives 
challenges, as well as promising opportunities for better health 
with health outcomes 
outcomes, lower costs, improved transparency and choices for 
  Addressing integrity 
consumers, and reduced administrative burden on providers.37   
problems across models 
Medicare and Medicaid, the two largest programs in the Department,    Delivering on the promise of 
are also among the most complex.  Both programs offer benefits in  innovative technology to 
multiple formats (FFS, managed care, and newer payment models);  improve health outcomes 
cover a broad array of health conditions, providers, services, and 
settings; and operate pursuant to intricate statutory directives and 
regulatory schemes.  Increasingly, beneficiaries are enrolling in Medicare and Medicaid managed care options.   
The transition to value in the Medicare and Medicaid programs is well underway, with continued growth expected.  
The Health Care Payment Learning & Action Network, an HHS-sponsored public-private partnership, estimated 
that for FY 2017, 90 percent of providers in Medicare FFS were paid based, at least in part, on quality and value, 
with 38 percent being paid under an alternate payment model or a population-based payment; the comparable 
numbers for Medicaid were 32 percent and 25 percent, respectively.38  HHS has introduced, and continues to 
introduce, a range of new models, including accountable care organizations (ACOs), medical homes, bundled 
payment models, primary care models, and others.  Many of these models are designed as all-payer models to 
align with developments in the private sector.  Most recently, HHS announced a major set of initiatives to reform 
payment and delivery of kidney care, including new payment models, technologies, and care options for patients. 
Both Medicare (FFS, Part C, and Part D) and Medicaid have proven susceptible to fraud, waste, and abuse, with 
estimates of improper payments ranging from 8.1 percent (Medicare FFS) to 9.8 percent (Medicaid) of total 
expenditures, totaling $86 billion in FY 2018.39  For the past 16 years, the Government Accountability Office (GAO) 
has included both programs on its list of high-risk Government programs.  OIG work has long demonstrated a 
range of vulnerabilities in both Medicare and Medicaid: 
  Flaws in program design and administration (e.g., improper payments) (see TMC 1), 
  Misaligned program incentives and confusing or insufficient program guidance, 
  Deficiencies in how providers deliver care to beneficiaries (e.g., poor quality and unsafe care (see TMC 3) 
or inappropriate utilization), 
  Gaps in provider enrollment systems and available data needed for proper oversight (see TMCs 1 and 5), 
and  
12 
     
 
  Problems in ensuring that eligible beneficiaries have 
adequate access to covered services in both FFS and managed care. 
There are three specific elements of this challenge: (1) aligning program incentives 
with improved health outcomes, (2) strengthening program integrity, and (3) delivering on 
the promise of innovative technology.  Each element is integral to delivering greater value 
(including savings), quality, and improved outcomes for Medicare and Medicaid, their beneficiaries, and 
taxpayers.  
Aligning program incentives with health outcomes 
Developing effective incentives and policies to drive better health outcomes is difficult given the complexities of 
medicine, the programs themselves, and the populations served by these programs.  HHS faces obstacles in 
correctly measuring the value of care.  Designing measures that effectively incentivize high-quality care without 
being overly prescriptive or burdensome to providers is challenging, and the science of quality measurement 
continues to evolve.   
The Department is undertaking initiatives to streamline, improve, and target quality measures more precisely and 
to move from process measures to outcome measures.  Through its Meaningful Measures initiative, CMS reports it 
rolled back 20 percent of measures because they were topped out, duplicative, or overly burdensome.40  Where 
applicable, CMS must clearly define actionable and meaningful quality measures and ensure their reliability, 
accuracy, and utility.  CMS and other OpDivs currently using quality measurements should continue to align efforts 
to reduce unnecessary provider burden and strengthen quality measurement.  Moving forward, HHS will need to 
ensure that its programs use effective, evidence-based measures for quality improvement.  Under the new 
Executive Order on Health Care Price Transparency and Quality, HHS is producing a health quality roadmap in 
coordination with the Secretaries of Defense and Veterans Affairs that will include a strategy for developing 
common quality measures, aligning inpatient and outpatient measures, and eliminating low-value quality 
measures.  The Department is also exploringvia a Regulatory Sprint to Coordinated Care led by the Deputy 
Secretarywhether better care coordination and value-based care can be fostered through changes to existing 
regulations that some view as barriers to care coordination, including certain fraud and abuse regulations 
administered by CMS and OIG, as well as certain Substance Abuse and Mental Health Services Administration 
(SAMHSA) and Office for Civil Rights (OCR) regulations.   
OIG work examining the Medicare Shared Savings Program over the first 3 years of the program revealed that 
ACOs participating in the Medicare Shared Savings Program reduced Medicare spending and achieved a net 
spending reduction of nearly $1 billion for 9.7 million beneficiaries.  ACOs improved their performance on most (82 
percent) of the individual quality measures and outperformed FFS providers on most (81 percent) of the quality 
measures.  ACOs participating in the program longer were more likely to reduce spending and by greater amounts 
than other ACOs.  This suggests that more established ACOs can achieve greater cost savings and quality over 
time.41  OIG conducted site visits to successful ACOs and identified strategies used by ACOs to reduce Medicare 
spending and improve quality of care.  Examples of these strategies include engaging beneficiaries in improving 
their health outcomes, managing beneficiaries with costly or complex care needs, reducing avoidable 
hospitalizations, controlling costs and improving quality in skilled nursing and home health care, addressing 
behavioral health needs and social determinants of health, and using technology to increase information sharing 
among providers.42  Based on this work, OIG recommendedand CMS concurredthat CMS take steps to support 
and share successful ACO strategies.  These strategies may be adaptable in other value-based models.43 
13 
     
 
New payment structures, business arrangements among providers, 
and incentives all give rise to risk-management challenges.  In pursuing 
innovative models to improve the health care systemwhether in FFS or 
managed careCMS must take steps to prevent unintended consequences, such as 
misaligned incentives or abusive practices.  Moreover, notwithstanding identified successes, 
CMS must maintain a steady focus on quality.  For example, an OIG review of Medicare Part B 
dialysis services at a health care group in Puerto Rico found noncompliance with Federal requirements 
for which the deficiencies could have had a significant impact on the quality of care provided to Medicare 
beneficiaries and could have resulted in the provision of inadequate or unnecessary dialysis services.  OIG provided 
recommendations for strengthening policies and procedures to meet quality requirements.44  (See TMC 3 for 
further discussion of quality-of-care challenges.)    
Addressing integrity problems across models 
The transition to a value-driven health system could mitigate some of the fraud and abuse vulnerabilities resulting 
from volume-based incentives and poorly coordinated care.  However, familiar risks will continue to exist and new 
risks will likely emerge.  Examples of risks in a value-based system (e.g., one where providers assume financial risk 
for patients cost of care) could include providers inappropriately reducing costs by stinting on care, discriminating 
against expensive patients, or manipulating or falsifying data used to measure performance, outcomes, or acuity.  
Managed care suffers from similar program integrity problems.  More will need to be done across FFS and 
managed care programs to assess and identify emerging risks so that they can be mitigated.   
As health care transitions from paying for procedures to paying for outcomes, the programs will concurrently face 
risks associated with volume-driven and value-driven payment and care.  Indeed, many providers will be paid 
under models that combine multiple types of incentives, such as a shared savings payment in combination with FFS 
payments, and some providers will continue to be paid primarily or exclusively on a volume-basis.  Managed care 
programs also are not immune from risks created by mixed incentives.  OIGs oversight and enforcement work 
addressing program integrity in managed care demonstrate the opportunities for downstream fraud and abuse, 
such as by providers paid on an FFS basis, notwithstanding that the Government pays on a population basis (e.g., a 
capitated payment).  (See TMC 1 for further discussion of program integrity in managed care.) 
A further, significant program integrity concern arises in connection with services furnished in home- and 
community-based settings, which patients often prefer and can be less costly.  Value-based care models are 
expected increasingly to promote care in these settings through home visits by practitioners and care managers, 
remote monitoring, and other technologies.  CMS is expanding beneficiaries access to telehealth.  OIG work in 
areas such as hospice care, home health, and personal care services consistently demonstrates that patients and 
the programs may be vulnerable to fraud and abuse in home- and community-based settings.  Moreover, there is 
heightened risk that new technologies, when misused, could enable wrongdoers to commit broader and new types 
of fraud. 
Managing and mitigating multifaceted risks to ensure that patients, providers, and taxpayers realize the full 
benefits of innovative value-based care will require sustained effort, resources, flexibility, and continual 
prioritization by CMS and the Department.  In testing and implementing value-based care models, CMS must 
continue to focus on program integrity risks, incorporate safeguards to reduce them, and promptly correct 
identified issues.  Focusing on these risks is especially important for models that introduce new payment 
incentives, which might lead to new fraud schemes, and for models for which waivers of payment, coverage, or 
fraud and abuse laws may have been issued.  
14 
     
 
Across Medicare and Medicaid, whether in the traditional FFS, 
managed care, or emerging new models, CMS must remain attentive to 
tailoring effective program integrity strategies that prevent and detect problems 
and hold wrongdoers accountable.  Attention must be paid to the range of fraud, waste, 
and abuse risks, including improper payments, compliance with program requirements, 
provider eligibility and qualifications, data integrity and availability, transparency and accuracy of 
information available to consumers, patient safety, substandard care, and access to care.  These risks are 
covered in more detail in TMCs 1, 3, and 5.   
Delivering on the promise of innovative technology to improve health outcomes 
Leveraging digital and health technology to foster efficient, high-quality, safe care is critical to a value-driven 
health care system, as is ensuring the appropriate flow of complete, accurate, timely, and secure information.  For 
example, recent OIG work examining how Medicare Shared Savings Program ACOs use health IT showed that, 
although ACOs have used health IT to aid in care coordination in a variety of ways, the full potential of health IT 
has not been realized.45 
HHS faces challenges in achieving a connected health care system to support better coordinated and value-based 
care in which patients dataincluding conventional health care data and newer types of data related to social 
determinants, demographics, and personal trackersflow freely across provider settings, with appropriate privacy 
and security protections.  As health-related apps and technologies proliferate with the delivery of care, 
beneficiaries will need access to new and integrated information.  This information should enable them to choose 
reliable apps and technologies to assure themselves that providers they may be engaging with via an app or 
technology are trustworthy.  (See TMC 5.)  
HHS also faces challenges in ensuring that evolving technologies achieve their intended results, enhancing patient 
access to quality care and providers ability to furnish such care.  The recent billion-dollar law enforcement action 
known as Operation Brace Yourself illustrated how telehealth technology used for remote physician consultations 
can make a familiar fraud schemecharging Medicare for DME that patients do not needbigger with less effort.  
HHS must provide appropriate oversight of rapidly evolving technologies, such as telehealth, networked medical 
devices, robotics, genomic testing, and remote monitoring.  In many cases, new technologies and apps are being 
developed by individuals and entitiesoften engineers or scientistsunschooled in the complex regulations 
governing health care and unaware of the range of program integrity risks their inventions may face.  These new 
participants in the health care ecosystem will need 
education, guidance, and appropriate oversight.   
HHS faces a growing challenge in understanding 
and, as appropriate, overseeing providers use of 
artificial intelligence and machine learning in the 
delivery of health care, such as in diagnostics, as 
well as for administrative functions, such as coding 
and claims submission.  Artificial intelligence and 
machine learning are introducing new paradigms 
that will likely require fresh thinking about compliance and fraud prevention.  Relatedly, HHS will need to assess 
how it can use artificial intelligence, machine learning, and other technologies to foster program integrity, value, 
and quality of care in Medicare, Medicaid, and other HHS programs.  Finally, HHS will need to ensure that rural 
beneficiaries and underserved populations are not left out of a technology-enriched, value-driven health system.  
(See TMC 4 for further information about the Food and Drug Administrations (FDAs) role in emerging technology.) 
15 
     
 
Realizing the promise of value-based care and payment 
structures 
To achieve better care at lower cost, HHS must maintain a steady focus on developing 
and refining effective, innovative, evidence-driven models while being proactive in 
preventing and detecting fraud, waste, and abuse.  HHS must pay special attention to 
effectiveness and program integrity in nascent areas such as the intersection of health care with social 
determinants of health and new uses of digital technology.  This is vitally important given the current and 
anticipated growth in the cost and number of beneficiaries in Medicare and Medicaid.  Meeting this challenge will 
enable the Department to expand the reach of dollars devoted to these programs, thereby abating some of the 
anticipated rise in cost of these programs over the next decades and improving the lives and health outcomes of 
the beneficiaries they serve. 
 
 
 
16 
     
 
3: Protecting the Health and 
Safety of HHS Beneficiaries 
 
H 
HS programs provide critical services to diverse populations  RELEVANT OPDIVS 
across a broad range of care settings.  Some such services are 
ACF, CMS, IHS, SAMHSA 
directly provided by HHS personnel, some delivered via HHS 
KEY ELEMENTS 
grant programs and others rendered by professionals of the 
  Ensuring safety and quality of 
beneficiarys choosing, who then claim reimbursement from Federal 
health care paid for by Federal 
programs.  Services include health care services, educational services, 
health insurance programs 
child care services, and even physical custody for select populations.  
Ensuring that intended beneficiaries receive appropriate services and    Protecting the health and 
safety of children served by 
are not subjected to abuse or neglect represents a major challenge for 
HHS programs 
the Department. 
  Preventing abuse and neglect 
Ensuring safety and quality of health care paid for by 
Federal health insurance programs 
HHS operates the Medicare program to insure about 60 million elderly or disabled Americans.  In partnership with 
the States, the Medicaid and CHIP programs insure about 75 million and 7 million beneficiaries, respectively.  IHS 
serves about 2.6 million members of 573 federally recognized Tribes.  These programs cover specific health care 
services, which may include hospital care, physician services, prescription drugs, hospice care, home and 
community-based care, DME, and skilled nursing care.   
Delivering covered services 
Ensuring access to care that meets quality and safety standards remains a challenge.  Even when Federal 
health care programs cover care, many beneficiaries do not actually receive the care they need.  For 
example, OIG found that over 500,000 children with attention deficit hyperactivity disorder (ADHD) who 
were Medicaid-enrolled did not receive timely follow-up care, and that over 50,000 such children did not 
receive behavioral therapy as recommended by professional guidelines.46  At the other end of the life 
cycle, OIG found that more than 80 percent of hospice providers, a growing sector of health care serving 
beneficiaries and their families at an extremely vulnerable time near end-of-life, had quality-of-care 
deficiencies.47  Additionally, fixed daily payment structures may incentivize hospices to enroll beneficiaries 
for longer time periods but scrimp on care.  Oversight work also revealed that patients experience 
significant rates of adverse events (patient harm as a result of medical care) in health care facilities.  
Specifically, OIG found that 27 percent of Medicare beneficiaries were harmed during their stays in acute 
care hospitals, and that harm rates were even higher for post-acute settings: 29 percent in rehabilitation 
hospitals, 33 percent in skilled nursing facilities, and 46 percent in long-term-care hospitals.48  In addition 
to the high harm rates, OIG found that hospitals did not identify when harm occurred in their facilities, in 
part due to confusion over HHS and other Government guidance regarding how to define and report 
adverse events.49  OIG is currently conducting a study to update the harm rate for Medicare beneficiaries 
in hospitals.  This review will assess progress made in reducing harm in the decade since the prior study 
was released in 2010.50  OIG also has work underway to measure the rate of adverse events for patients 
at IHS Hospitals.  (See TMC 6 for more information on challenges associated with adverse events.)   
17 
     
 
The Department continues efforts to improve the quality of 
covered services.  The Department has worked to improve 
information available to beneficiaries and their families when selecting a 
care provider.  One example is CMSs efforts to improve nursing home care.  
CMSs Five-Star Quality Rating System facilitates informed comparison of nursing 
homes.  CMS has announced plans to revamp its Hospital Quality Star Rating System to 
enable better informed decision-making for beneficiaries seeking hospital care.   
Also, CMS enforcement actions have stopped some poor-performing nursing homes from rendering 
worthless services.  One nursing home chain charged with rendering grossly substandard care to 
Medicare and Medicaid beneficiaries agreed to repay $18 million and abide by the terms of a Corporate 
Integrity Agreement to ensure that it delivers appropriate care going forward.51  Further, after a series of 
OIG reports about quality of care problems in IHS-operated hospitals,52 IHS created a new Quality 
Framework and Office of Quality to provide better guidance and oversight to its facilities and clinical 
staff.53    
Although the Department has made progress, more work remains to be done to improve access to and 
quality of all types of care.  Among the top priorities as identified by OIG work are improving hospice care, 
including strengthening the survey process and better educating beneficiaries and their families and 
caregivers,54 and improving the health and safety of nursing home residents by ensuring facility correction 
of deficiencies.55  To continue improvements at IHS, OIG has recommended that IHS prioritize developing 
and implementing a staffing program to ensure sufficient qualified staff, including those at remote 
facilities; enhance training for staff and hospital leaders; intervene quickly and effectively when quality 
problems are identified; and establish better procedures, including improved external communication.56   
Protecting the health and safety of children served by HHS programs  
HHS operates or funds many programs providing additional services beyond health care for children, including 
child care, education, and residential care.  The Head Start program promotes school readiness for nearly 1 million 
children from low-income families and the CCDF provides child care for about 1.3 million children from low-income 
families.  The importance of properly vetting staff for these programs is discussed below.   
Operating the UAC Program 
Through the UAC Program, ORR assumes custody of children who enter the United States without 
immigration status and have no parent or guardian in the United States able to provide for their physical 
and mental well-being.  The child may have arrived in the United States alone, or in certain circumstances, 
may have been separated from their parents or legal guardians at the border.  This program merits 
specific discussion, as it uniquely tasks the Department with assuming physical and legal custody for 
children, and the comprehensive responsibility for their welfare thus entailed.  Through the UAC Program, 
ORR places unaccompanied or separated children in shelters and other facilities operated by grantees or 
contractors.  These facilities provide food and shelter, as well as medical and mental health care and other 
services.  Children remain in these placements until a sponsor (usually a parent or family member) is 
found to whom the child may be safely released, the childs immigration status is resolved, or the child 
turns 18 years old and ages out of the program.  Since ORR began operating the UAC Program in 2002, it 
has served more than 175,000 children.   
In recent years, ORR has been called upon to care for more children, including children who did not come 
to the United States alone but were separated from their parent or guardian at or after arrival.  HHS 
18 
     
 
reported to a court as part of a lawsuit that 2,737 children 
had been separated by the Department of Homeland Security 
(DHS) and remained in ORR care as of June 2018.  OIG reported in 
January 2018 that possibly thousands of children had been separated and 
released by ORR before the court order and that children had been separated from 
their parents for longer than had previously been reported.  ORR had not been tracking 
this figure and the exact number of separated children is still not known, although HHS and DHS 
are now working to identify all of the children separated from their parents since July 2017.  OIG also 
reported that children continue to be separated by DHS from their parents, and ORR does not always 
receive adequate information.57  Lack of data about separated children complicates HHSs ability to 
ensure appropriate placement and reunite children with their families in a timely manner.  These factors 
may cause children to spend more time in HHS custody.  Issues related to identifying and vetting 
appropriate sponsors may also prolong childrens time in HHS care facilities.  Also, at one influx care 
facility, OIG found failures in conducting required staff background checks and insufficient clinical staff to 
serve childrens mental health needs.58 
The Department must work to ensure that UAC Program-funded facilities meet all safety requirements 
and provide adequate medical and mental health care.  As discussed further below, HHS must also 
enhance efforts to ensure that all staff with access to children have passed required background checks.   
Preventing abuse and neglect 
HHS funds and oversees many types of services for a broad range of beneficiaries.  Countless HHS-funded 
providers are in a position of trust and in close contact with beneficiaries, often behind closed doors and at 
especially-vulnerable times in the beneficiarys life.  The vast majority of providers seek to serve beneficiaries best 
interests.  However, some providers may cause beneficiaries harm and HHS must protect its beneficiaries from 
abuse and neglect.  For example, a former IHS pediatrician is currently in prison in one State and standing trial in 
another State for sexually assaulting boys he treated as patients.  That incident commanded extensive attention 
and the Department has committed to collaborating with a Presidential Task Force on Protecting Native American 
Children in the IHS system established in March 2019.59  The Task Force is charged with examining IHS systems that 
may have failed in the past and recommending improvements to better protect children from abuse.  Better 
attention to protecting vulnerable beneficiaries of all ages in all HHS care settings is also needed. 
Vetting providers and staff 
Although even the most thorough vetting cannot completely prevent all potential predators from abusing 
Federal programs to gain access to victims, background checks are a useful tool.  OIG identified failure to 
conduct required background checks for UAC facility staff whose jobs entail access to children.60  Failure 
to conduct adequate background checks has been a problem in domestic child care programs as well.  OIG 
found that some States have not fully implemented CCDF requirements to conduct comprehensive 
criminal background checks on current and prospective staff.61  Implementation of background checks for 
long-term-care providers remains a challenge as well.62  Along with demonstrating job-specific 
competency and qualifications, ensuring that staff pass all required background checks is an important 
safety measure. 
The Department should improve efforts to ensure staff pass required background checks before they have 
access to patients in various health care settings and to children in the UAC Program, Head Start, and 
CCDF.  The Department is also working to support States implementation of the CCDF background check 
19 
     
 
requirements.  The Department should continue to work with 
States to ensure that implementation of the Child Care and 
Development Block Grant Act of 2014 background check requirements 
align with the statutorily required effective dates and the allowable timelines 
described in the CCDF Final Rule. 
Identifying and reporting abuse and neglect 
Beneficiaries in many care settings are at risk of abuse and neglect.  About 1.8 million Medicare 
beneficiaries receive care in SNFs each year.63  Home and community-based services allow many Medicaid 
beneficiaries the opportunity to avoid undesired facility care.  However, some beneficiaries have been 
abused or neglected by individuals, including some family members that Federal health care programs 
paid to care for the beneficiary at home.  Group homes provide care to many especially vulnerable 
people, including adults with developmental disabilities.  OIG work found extensive failures to properly 
handle critical incidents, including suspected abuse and neglect, of group home residents.64  OIG has also 
identified substantial failures to report incidents of potential abuse or neglect of Medicare beneficiaries 
living in SNFs who require treatment in hospital emergency departments.65  All States have enacted 
mandatory reporting laws that require certain individuals, like school teachers or nursing home staff, to 
report suspected abuse or neglect of vulnerable individuals.  However, many instances of abuse and 
neglect go unreported, making it harder to help victims and hold wrongdoers accountable.66   
The Department has created several resources to better address abuse and neglect of residents of group 
homes.  These resources include model practices for (1) State incident management and investigation, (2) 
State incident management audits, (3) State mortality reviews, and (4) State quality assurance.67   
It is important to prevent ongoing harm by identifying providers and facilities subjecting beneficiaries to 
abuse or neglect.  States and other partners should use claims data to better identify unreported abuse 
and neglect.  OIG created a resource guide to help accomplish this goal.68  Additional efforts would help 
to improve reporting.  For example, CMS should compile a list of diagnosis codes that indicate potential 
abuse or neglect, conduct periodic data extracts, and encourage States to better use data to facilitate 
compliance with mandatory reporting laws.   
CMS should also work to ensure that Federal mandatory reporting laws suffice to protect beneficiaries in 
all care settings and are adequately enforced.  Protecting beneficiaries from abuse and neglect is a critical 
responsibility requiring attention and cooperation from all stakeholders.    
20 
     
 
4: Safeguarding Public 
Health 
 
A 
s HHS pursues its mission of enhancing the health and 
RELEVANT OPDIVS 
well-being of all Americans, there are challenges to 
ensuring public health and safety.  These include opioid  ASPR, CDC, CMS, FDA, HRSA, IHS, 
abuse and misuse, risks associated with public health emergencies  SAMHSA 
caused by communicable diseases and natural disasters, dangers  KEY ELEMENTS 
from unsafe food, and medical devices vulnerable to cyberattacks.  
  Tackling the opioid epidemic 
To best serve the American public, the Department must leverage 
while ensuring access to 
the skills and tools it has at its disposal to reduce the ill-effects of 
treatment 
opioid use disorders (OUDs) through prevention, treatment, and 
  Strengthening emergency 
recovery support, prioritize emergency planning and response, and 
preparedness and response 
ensure that food, drugs, and devices are safe.  Additionally, 
capabilities 
Americans rely on HHS to recognize and respond to emerging issues 
  Safeguarding the Nation's food 
such as concerning trends and evidence of detrimental health 
supply 
impacts associated with the use of e-cigarettes and other electronic 
  Providing adequate oversight 
nicotine delivery systems (vaping).  Because challenges to public 
of medical device safety and 
health are often complex, the Department must ensure that 
security 
operating divisions coordinate with each other, as well as partners 
   
within and outside of Government, to effectively promote public 
health and safety.  (See TMC 6 for more information on the Departments challenge of coordinating with internal 
and external partners.) 
Tackling the opioid epidemic while ensuring access to treatment 
The Nation is struggling with an opioid crisis that is, at least partially, fueled by opioids prescribed by licensed 
medical professionals, dispensed by licensed pharmacies, and paid for by Federal funds.  Approximately 2 million 
people have an OUD,69 and two out of three overdose 
deaths involve an opioid.70  In 2017 alone, there were an 
estimated 47,600 opioid-related overdose deaths in the 
United States.71  Although the opioid epidemic is 
pervasive nationally, data suggest that the Appalachian 
region, in particular, has higher opioid prescribing rates 
and overdose death rates,72 and that the American 
Indian/Alaska Native (AI/AN) population is disproportionately harmed by opioid misuse73,74 and overdose deaths.75  
Additionally, synthetic opioids such as fentanyl and tramadol present a significant, growing threat and have been 
associated with more deaths than other types of opioids.76   
In 2017, the President directed the Acting HHS Secretary to declare the opioid crisis a national public health 
emergency, authorizing the Department to use emergency authority to address the opioid epidemic.  The 
Department plays a critical role in ensuring that opioids are prescribed and dispensed appropriately and according 
to program policies.77  HHS developed a five-point strategy to combat the opioid crisis78 and must continue 
working toward addressing the problem, adjusting its approach as appropriate.  HHS OpDivs should continue to 
21 
     
 
use the tools available in their programs to address the opioid 
epidemic while being mindful of patients needs to access appropriate pain 
management, which may include the use of opioid analgesics. 
Although opioid misuse and abuse remains a problem, OIG found some potential 
improvements in utilization patterns and access to treatment for substance abuse in Medicare 
Part D, including a decrease in Medicare beneficiaries receiving opioids, an increase in beneficiaries 
receiving medication-assisted treatment (MAT) for OUD, and an increase in prescriptions for naloxonea 
drug that can prevent overdose deaths.79  Ensuring access to appropriate pain management therapies and 
combating opioid abuse remains a high priority.  CMS and Part D sponsors should implement effective drug 
management programs for at-risk beneficiaries.   
Further, IHS could improve the quality of care for prescribing and dispensing opioids to the AI/AN population by 
fully utilizing States prescription drug monitoring programs.  A 2019 OIG report80 identified that IHS hospitals did 
not fully use the States prescription drug monitoring programs when prescribing or dispensing opioids at certain 
IHS hospitals.  In addition, the hospitals did not use available data to identify risks in their prescribing and 
dispensing practices, such as giving patients (1) opioid doses of as high as 500 daily morphine milligram 
equivalents; and (2) opioids and benzodiazepines at the same time, which puts patients at greater risk of a 
potentially fatal overdose.  Making data-supported decisions and conducting data analysis will be crucial to 
identifying risks and reducing the occurrence of adverse events.  (See TMC 5.) 
Additionally, through the FDA, the Department approves new drugs before they are marketed in the United States 
and takes into account benefits and risks to assure safety and efficacy.81  FDA also monitors the safety of marketed 
drugs as new information becomes available.  Through this framework, the FDA can encourage the development of 
abuse-deterrent formulations of opioids that may be less susceptible to abuse; employ tools, including the Risk 
Evaluation and Mitigation Strategy program, to mitigate risks associated with approved drugs; and pursue 
measures that include withdrawal from the market when there are serious safety concerns.82   
The treatment of OUDs is a priority.  Only a fraction of the 2.1 million people with OUDs received specialty 
treatment in 2018 (19.7 percent).83  It is important for the public to be able to access effective, quality treatments.  
Research suggests that MAT medications, in combination with counseling and behavioral therapies, can be an 
effective treatment for OUDs.  Three drugsmethadone, buprenorphine, and naltrexoneare approved to treat 
OUDs.  Access to MAT is a priority as patients suffering from an OUD are at risk for withdrawal and relapse and 
may seek out illicit opioids, such as heroin.  As such, the Department must work diligently to ensure access to 
these medications.84 
The Department continues to manage and oversee investments to address OUDs.  SAMHSA awarded more than 
$930 million85 through the State Opioid Response grants to support a comprehensive response to the opioid 
epidemic and expand access to treatment and recovery support services; HRSA awarded nearly $400 million for 
community health centers, rural organizations, and academic institutions to establish and expand access to OUD 
treatment.86  Although treatment must be prioritized nationally, the Department should ensure that resources are 
devoted to areas disproportionately affected by the opioid epidemic, including the AI/AN population and rural 
communities.  Recognizing the potential danger of abrupt opioid withdrawal and the patient safety imperative of 
tapering or discontinuing opioids thoughtfully, the Department released a Guide for Clinicians on the Appropriate 
Dosage Reduction or Discontinuation of Long-Term Opioid Analgesics.87 
22 
     
 
The Department can also help save lives through enabling people to 
access medications that reverse the effects of opioids and illicit drugs.  
Research shows policies that make it easier to access naloxone may be saving 
lives.88  HHS is in the process of implementing the SUPPORT for Patients and 
Communities Act of 2018 that proposes several strategies to combat the opioid crisis, 
including reducing improper opioid prescribing and expanding access to prevention, treatment, 
and recovery services.  For example, it requires CMS to recommend ways to lower consumer prices for 
opioid overdose-reversal medications such as naloxone and requires HHS to establish a grant program to 
implement best practices regarding treatment for individuals who experience an overdose, including emergency 
treatment and the use of recovery coaches. (See TMC 1 for more information on program integrity considerations 
associated with grants.) 
Strengthening emergency preparedness and response capabilities 
HHS has a lead role in preventing, preparing for, and responding to the adverse health effects of public health 
emergencies.  (See TMC 6 for more information about HHSs role in the Federal Governments emergency 
preparedness and response efforts.)  Communicable 
diseases, outbreaks, and natural disasters constitute public 
health emergencies that can severely strain public health 
and medical infrastructure and lead to serious illness and 
loss of life.  Prior to and during a public health emergency, it 
is important to have adequate planning (such as preparing 
for a medical surge) and mechanisms in place to efficiently 
and rapidly deploy assets and provide relief to those in need 
of vital health and human services resources in the 
aftermath of an emergency.  Prior OIG work has identified 
gaps in emergency preparedness and response planning for 
health care facilities during disasters and pandemics.89  The Departments continued efforts to improve 
preparedness and response are important as it is uniquely positioned with the opportunity to continuously assist 
communities throughout the United States so that they can respond to and deliver health services in the 
immediate aftermath of natural disasters, as well as support sustained recovery efforts. 
Additionally, recent outbreaks of communicable diseases (e.g., measles, hepatitis, and Ebola) are an ongoing 
challenge and demonstrate the need for the Department to rapidly detect, diagnose, and assess these threats.  A 
2019 OIG report determined whether HHS's response efforts to the 2014 Ebola outbreak were effective and 
efficient and found that HHS (1) had no strategic framework in place to coordinate global health security at the 
international or departmental levels before the Ebola outbreak, (2) was not prepared to deploy the resources 
needed for such a large-scale international response, and (3) did not have in place internal or external 
communication channels for responding to an international public health emergency.90  It is important for HHS to 
have the ability to readily develop, distribute, and administer medical countermeasures (i.e., vaccines, 
therapeutics, and diagnostics) to effectively prevent and treat infectious diseases.  States and localities should 
ensure planning and preparedness in areas including medical surge and vaccine and antiviral drug distribution and 
dispensing.91 
   
23 
     
 
Safeguarding the Nations food supply 
An estimated 1 in 6 Americans get sick from contaminated foods each year, 
and 3,000 die.92  Individuals with weakened immune systems, such as older and 
younger populations, may be particularly susceptible to foodborne illnesses.  Foodborne 
illnesses are largely preventable, and the American public relies on FDA, working with partners 
including the Centers for Disease Control and Prevention (CDC), to ensure that the food we eat is 
safe.93  The passage of the FDA Food Safety Modernization Act (FSMA) placed renewed emphasis on the 
importance of preventing foodborne illnesses and FDA has made progress in implementing that statute.  FDA has 
prioritized creating a more effective and efficient food safety system.  One means by which it aims to do this is by 
increasing the role of the States in improving produce safety.94  Still, with an increasingly global food supply, 
keeping food safe presents a constant challenge.  
The Department must ensure that FDA continues to modernize the food safety system and responds effectively 
when issues are identified.  FDA should use the array of tools at its disposal to protect the American public.  It 
should conduct risk-based inspections of domestic and foreign food facilities within the timeframes required by 
FSMA, identify instances of failure to comply with good manufacturing practices, and take necessary steps when 
health risks are identified, including administrative and enforcement actions when warranted.95  FDA has made 
organizational changes with the goal of improving incident response through, for example, instituting its 
Coordinated Outbreak Response and Evaluation Network, and should continue to optimize its ability to protect the 
public from outbreaks of foodborne illnesses. 
Providing adequate oversight of medical device safety and security 
FDA is responsible for approving new medical devices that it determines are safe and effective, and assuring that 
approved products remain safe and effective.96  As technology advances, FDA performs this task in an increasingly 
complex environment.  Beneficial aspects of innovative medical devices, such as the ability to communicate widely 
with other devices, may increase the risk of cybersecurity threats.  (See TMC 5 for more information on 
cybersecurity.)  FDA has the difficult task of staying at the forefront of emerging technology, amassing the 
technical knowledge to understand the science that supports advances in medical device function, and anticipating 
the potential impacts of new technologies.  FDA reports that it has undertaken several initiatives to enhance the 
Agencys approach to medical device safety, and is working closely with patients, providers, and device developers 
to make sure that it is appropriately balancing risk and benefit. 
The 21st Century Cures Act (the Cures Act) aims to help accelerate medical product development and bring new 
innovations and advances to patients.97  Among the expedited product development programs established by the 
Cures Act is the Breakthrough Devices program.  Under that program, manufacturers of medical devices that meet 
certain criteria may obtain priority review by FDA.  For example, a medical device designed to provide more 
effective treatment or diagnosis of a life-threatening or irreversibly debilitating disease or condition may be 
eligible for Breakthrough Device designation.98  Recently, FDA granted breakthrough status to an artificial 
intelligence-enabled medical device intended to diagnose and improve clinical management of patients with Type 
2 diabetes with fast-progressing kidney disease.99  
The speed at which science and technology are evolving means that the development and regulation of medical 
devices presents new safety and effectiveness concerns.  For example, artificial intelligence-enabled devices that 
communicate with other medical devices may be subject to cybersecurity risks100 or interoperability difficulties, 
which could adversely affect patient safety and medical device performance.  (See TMC 5.)  One area of challenge 
for FDA thus will be to review medical device applications as expeditiously as possible while being mindful of 
24 
     
 
factors that could adversely affect the safety and effectiveness of 
medical devices.  (See TMC 2 for HHSs challenges in overseeing evolving 
technologies in Medicare and Medicaid.) 
Post-market surveillance of medical devices continues to be a management challenge for 
FDA.101  Each year, the agency receives several hundred thousand reports of medical devices 
suspected of being associated with death, injury or malfunction.  By regulation, these reports must be 
submitted in a timely manner to FDA.102  In 2009, OIG reported that manufacturers and medical device user 
facilities often submitted tardy and incomplete adverse event reports and that FDA failed to employ adverse 
event reports in a systematic manner to detect and address safety concerns.103  FDA reports that it is evolving 
beyond its current passive post-market surveillance system and moving to an active surveillance system that relies 
on real-world evidence and timely receipt of robust safety information, which it believes will better protect 
patients and help enable the Devices Program to act quickly with manufacturers and health care providers to make 
timelier decisions to keep patients safe.  A key element of implementing this strategy will be the multi-stakeholder 
effort to establish the new national system for gathering real world evidence through the National Evaluation 
System for health Technology (NEST).  Implementing a national surveillance system would also not be possible 
without the FDAs establishment in recent years of a unique device identification (UDI) system, in which medical 
devices are marked on their labels with a unique code th at can be used to track the device through its distribution 
and use in patients.   
25 
     
 
5: Harnessing Data To 
Improve Health and  
Well-Being of Individuals 
 
I 
mproving how the Federal Government manages, shares, and 
RELEVANT OPDIVS 
secures its data is a priority for both Congress and the 
All HHS  
Administration.104  HHS is prioritizing Leveraging the Power of 
KEY ELEMENTS 
Data as one of its six strategic shifts for its ReImagine HHS effort.105  
Collectively, these initiatives recognize the significant value of    Expanding HHS's capacity to 
Federal data and the importance of having a coordinated approach  use data in policy making, 
to use data to deliver on mission, serve the public, and steward  program management, and 
resources while respecting privacy and confidentiality.106   deployment of emerging 
Additionally, HHSs authorities and influence that shape how an  technologies    
individuals data are used and protected by other private and public    Providing data to HHS partners 
entities are increasingly important in a technology-enriched health  and promoting the public data 
and human service delivery system.  Failure to modernize HHS data  access and sharing  
practices will limit the capability of HHS and its OpDivs to fulfill their    Protecting data from misuse 
missions.  HHS and its 11 OpDivs and associated programs have  or unlawful disclosure  
made progress in doing so, but challenges remain in how it 
manages, shares, and secures data.   
Expanding HHSs capacity to use data in policy making, program management, and 
deployment of emerging technologies    
Data play a central role in every HHS program or policy mission.107  HHS operations depend on the effective 
collection and use of a large amount of sensitive and important data about individuals, health care providers, key 
public health assets, and other entities and actors, which are vital to improving the health and welfare of 
individuals in the Nation.  The Department and its programs are increasingly digitally oriented and able to 
generate, receive, and transmit data in large volumes associated with important programmatic functions.   
However, having large amounts of data does not mean that the data can be used efficiently and effectively.  HHS 
faces challenges in how it manages and leverages that data across its programs.  Although most OpDivs primarily 
collect data to administer their own programs, the use of data across programs and OpDivs in remains a challenge.  
Data are often housed within a single OpDiv (data silo) and not easily shared with other parts of HHS even 
though OpDiv missions often overlap.108  These silos may limit the capability of HHS to use data for evidence-based 
decision making and better manage its programs and OpDivs.  Data silos may also impede deployment of emerging 
technologies, such as machine learning, that have enormous potential to improve the efficiency and effectiveness 
of the Department.  When OpDivs and programs cannot access data from each other, they miss opportunities to 
improve the effectiveness of programs.  For example, OIG recommended that CMS provide its Medicare Drug 
Integrity Contractor with centralized access to Medicare Part C encounter data to enable the contractor to more 
effectively and proactively identify potential fraud, waste, and abuse.109  Eliminating or reducing data silos within 
the Department and increasing appropriate access across programs will be an essential step to improving program 
26 
     
 
management and evidence-based decision-making, as well as seeding 
the ground for HHS to benefit from emerging technologies.   
Improving data governance to enhance program management  
One critical step to improving HHSs capacity to utilize its data is the adoption of a better data 
governance approach.  The need to improve data governance is not unique to the Department and 
is a priority and a requirement for Federal agencies.110  It is also part of HHS Strategic Plan and the Digital 
Strategy at HHS.111  The Department is taking steps to improve its data governance and more effectively use the 
data it has.  Under the ReImagine HHS Leveraging the Power of Data initiative and implementation of the 
Foundations for Evidence-Based Policymaking Act of 2018, the Department is developing an enterprise-wide data 
sharing strategy to increase combined analysis of disparate data sets to achieve better insights.112  Although 
progress has been made, the Departments challenge will be to operationalize its plans notwithstanding the 
continued effect of data silos, restrictions related to the privacy and use of certain data, and legacy technology and 
data systems that do not easily support data sharing.  
HHS must ensure any progress it makes on improving governance of its internally generated data must also apply 
to data that are generated by external entities but received and managed by the Department.  Without quality 
data that can provide visibility on how its programs are operating, HHS will have limited capabilities to improve its 
program management.  For example, OIG raised concerns about the national Medicaid data set named the 
Transformed Medicaid Statistical Information System (T-MSIS).113  CMS made progress by ensuring that all 50 
States, the District of Columbia, Puerto Rico, and the U.S. Virgin Islands report data and work with States to 
improve the quality of data submissions.  However, concerns still exist about the completeness and reliability of 
the T-MSIS data.  Most recently, OIG found a national review of opioid prescribing in Medicaid using T-MSIS is not 
yet possible because not all at-risk beneficiaries and providers can be identified.  Because existing T-MSIS data do 
not allow identification of all at-risk beneficiaries and potentially inappropriate providers, data enhancements are 
needed to enable a national review of opioid prescribing in Medicaid.114  Further, limitations of T-MSIS data 
impede identification of individual beneficiaries for national opioid analysis.115  Similar data quality and governance 
challenges exist across other Departmental programs that collect external data from grantees or other 
organizations.116   
Building Advanced Capacity To Use Data 
Improving how HHS, its programs, and its employees use data is a critical component of the 2018 HHSs 
Data Strategy.  Better use of data may improve evidence-based policy making, improve internal 
administrative functions, and support the deployment of emerging technologies, all of which are part of 
the larger Federal and Departmental strategies to promote efficient and appropriate data use.117   
In certain areas, the Department made progress.  For example, in response to OIG work related to 
improving Departmental oversight of grantees, HHS established the Audit Tracking and Analysis System, a 
Department-wide source of adverse information from grantee audits and facilitated Department-wide 
information sharing about grantees with past performance issues.118  However, HHS struggles to use and 
leverage its own data to improve its program management in several areas, such as financial and payment 
systems information and reporting operations.  (See TMC 1.)  
HHSs ability to use new technologies that can make the Department more effective and efficient is 
dependent on how well data can be gathered and curated from multiple OpDivs.  Technologies such as 
machine learning and artificial intelligence must function on top of large data sets.  To effectively deploy 
those tools, HHS will have to rely on data from across its programs, which will require complex technical 
27 
     
 
coordination among diverse types of data, some of which have 
technical limitations.119  The Department is making progress by 
exploring solutions through several recent pilots, demonstrations, and 
other limited scope projects.120  These use cases can help HHS learn how data 
can be used in a short-time frame and that can serve as quick feedback loop to inform 
the next pilot or demonstration.   
In December 2017, HHS hosted a Opioid Code-a-Thon to develop data-driven solutions to combat 
the opioid epidemic.  The Code-a-Thon involved use and analysis of 10 HHS databases from 5 different 
OpDivs, and more than 70 data sets in total from other Federal agencies, State and local governments, 
and publicly available data.  The competition resulted in the development of new tools to address the 
opioid crisis.121  According to HHS, the Code-A-Thon also provided insights into the data it has and what 
other steps it should take to improve its data governance that might facilitate development of other 
solutions to the opioid crisis.122   
The challenge for HHS will be to go from strategies and pilot tests to fully incorporating lessons learned 
into the Departments operations.  There are significant barrierslegal, cultural, and resource 
limitationsthat strategies and pilots alone will not resolve.  To overcome these barriers and fully 
harness data to improve the health and welfare of the Nation, the Department will need to undertake 
multiyear efforts and implement sustained change management across its OpDivs. 
Increasing Data Access and Sharing with HHS Partners and the Public  
There is an increasing recognition that Federal agency stakeholders123 and the public can also use Federal 
data assets for the public good.124  Much of HHSs data are publicly available but may not be easy to use 
or may have other barriers that limit stakeholders and the publics access or use.  Those barriers present 
a challenge to providing increased access of HHS data that could lead to innovation and improvement in 
health and welfare.  HHS also has significant authority, incentives, and influence to change the way data 
are shared in the health care system, public health, emergency preparedness and response, medical 
research, and other sectors that are vital to the Nation.  Despite that significant influence, many of these 
sectors do not easily and regularly share data to the detriment of patients, individuals, and the public.    
Expanding and Improving Access to HHS Data  
Many HHS external stakeholders rely on effective dissemination of data collected by Departmental 
programs.  However, most public access to HHS data does not benefit from contemporary approaches, 
such as the use of application programming interfaces (APIs).  Although data might be available, they may 
not be well understood or in easily accessed formats.  OpDivs are attempting to expand access to these 
important assets, but progress has been slow.  In January 2018, FDA announced a pilot to provide more 
access to summary portions of the clinical study report for pivotal drug trials establishing the safety and 
effectiveness of the drug.  However, only one drug sponsor agreed to participate in the FDA pilot 
program.125  The CMS Blue Button 2.0 initiative to improve beneficiaries access to their Medicare 
information through apps has made progress by adding more app developers to the program, but 
widespread use by beneficiaries has yet to take off.126  (See TMC 2 for more information on the challenge 
of using technology to improve health outcomes for patients.) 
In other areas, the Department sustained progress.  Through the National Institutes of Health (NIH) 
initiative All of Us, HHS is leading an effort to collect 1 million or more volunteers medical history, lifestyle 
information, and genetic information to support advances in medical research.  These data will be shared 
28 
     
 
with research partners to advance breakthroughs in precision 
medicine.127  To realize the full potential of these data, NIH utilized 
modern approaches to collect and then disseminate data to its research 
partners.128  At CMS, OIG found that almost all the Open Payments program 
data reported by CMS met requirements.  These data help to promote transparency 
by making available to the public the financial relationships that providers (physicians and 
teaching hospitals) have with certain other entities (applicable drug manufacturers and group 
purchasing organizations).129  Additionally, OIG created a data toolkit that stakeholders, like State 
Medicaid programs, can use to identify their beneficiaries at high risk of opioid misuse and facilitate 
intervention to prevent harm.130  These successes must be replicated across HHS to remove barriers to 
other HHS program data and allow HHS partners to more effectively use that data.  
Making data sharing between health care providers, patients, and payers commonplace   
Several OpDivs have authority or influence to shape how data are shared within the industries they 
regulate, among HHS partners, and with individuals and patients.  Most notable is HHSs potential to 
improve the availability and interoperability of electronic health information.  Yet, the health care system 
and patients have not realized the benefits of modern approaches to improve the appropriate flow of 
electronic health information.  Promoting interoperability is part of the four Secretarial priorities and HHS 
will need to continue utilizing its significant leverage to expedite progress.131   
Routine and robust health information exchange between providers remains a challenge.  Less than half 
of physicians using an electronic health record (EHR) to electronically send or receive patient health 
information.132  Only 14 percent of physicians electronically send patient health information to behavioral 
health and long-term-care providers.133  The factors limiting increased interoperability and exchange are 
numerous and complicated.  Several Departmental initiatives depend on improving the interoperability of 
electronic health information, including the transition to value-based care and payment.  (See TMC 2.)  
Making real progress so that the health care system and patients can benefit from the improved flow of 
data will take sustained engagement within HHS, with HHS partners, and with external stakeholders such 
as organizations that set data standards.  
Recently, HHS has taken significant steps using regulatory authorities and its influence to improve and 
potentially standardize the way in which health information can be accessed, used, and exchanged.  In 
2019, the Office of the National Coordinator for Health Information Technology (ONC) proposed rules 
directly related to improving interoperability and helping cement data standards and data exchange 
mechanisms.  For example, ONC is incorporating Fast Health Interoperability Resource (FHIR) standards 
into its health IT certification program.  ONC also proposed standardized use of APIs for certified health IT.  
In a coordinated effort, CMS proposed rules to improve the interoperability of health information at many 
entities it regulates through the use standard, open APIs.134  This was a significant step to improving data 
exchange.  CMS is also piloting novel approaches to provide Medicare claims data to providers through 
the Data at the Point of Care initiative.135  
29 
     
 
Challenges with the flow of electronic health information can also 
impede patient access to their own data.  In 2018, only 51 percent of 
patients were offered access to their data through online patient portals; of those 
patients who were offered access, only 30 percent viewed their medical record.136  
These challenges related to improving the flow of electronic health information to providers 
and patients may also affect other Departmental coordinated care initiatives.  (See TMC 
2.)Protecting data from misuse or unlawful disclosure Managing, using, and sharing data must be 
complemented by appropriately securing data.  External 
threats to the confidentiality, integrity, and availability of 
HHS-held data are persistent and growing.  Similar to data 
governance and sharing challenges, several aspects of 
cybersecurity within the Department are siloed within its 
OpDivs and programs.  As a result, deployment of effective 
cybersecurity can be highly variable across the Departments 
OpDivs.  Further increasing the challenge is the vital nature 
of many of the Departments programs, operations, and 
data.  Interruption of these programs caused by a 
cyberattack may have significant negative effects on the 
health and welfare of the Nation.  Outside of the 
Departments systems, many of the HHSs partners, 
grantees, and the health care system at large are subject to 
an increasing amount of cyber threats.  Any doubts the 
public may have about HHSs ability to protect sensitive, 
personal health data may hinder the full potential of Federal 
initiatives that seek to leverage technology to create 
medical treatments of the future.   
Improving HHSs cybersecurity posture 
The Department has made progress in improving its overall cybersecurity posture, but certain weaknesses 
persist and pose challenges.  Recent OIG work found that the Departments enterprise-wide information 
security program was not effective but had improved in some areas.137  Other OIG work that examined 
eight Departmental OpDivs identified vulnerabilities in configuration management, access control, data 
input control, and software patching.138  This work highlights the challenge the Department faces to 
simultaneously improve the security across OpDivs while also helping provide resources and support so 
that OpDivs can take action to improve their own cybersecurity.  (See TMC 4 for more information about 
FDAs role regarding cybersecurity of medical devices.) 
HHS also faces other data security challenges outside of cyberthreats.  For example, HHS has recognized 
the threat of foreign government action aimed at unduly influencing and capitalizing on medical research 
programs funded and overseen by the Department.  HHSs challenge in responding to these threats is the 
need to protect these programs while also supporting an open, collaborative research approach that is 
critical to scientific advances.139  The Department has made progress recognizing the threats, studying the 
potential impact on its programs, and exploring recommendations to improve its security posture.140  
30 
     
 
Promoting the security and privacy of the health care 
system 
HHSs responsibilities for ensuring cybersecurity also extend to the health 
care system.  The statistics on the impact and persistence of cyberattacks 
demonstrate the magnitude of the problem facing HHS and the health care industry.  
HHS reported that in 2016, $6.2 billion was lost in the U.S. health care system due to data 
breaches and that 4 in 5 U.S.-based physicians have experienced some form of cyberattack.141  
Despite continued calls for action and additional awareness related to improving the health care 
systems cybersecurity, health care entities remain prime targets for cyberattacks and health care data 
are reported to be among the most valuable data for cybercriminals.  In addition to data and identity 
theft, cyberthreats can also pose safety risks by causing system outages needed for patient care or 
exploiting vulnerabilities in the growing number of connected medical devices and other medical 
equipment involved in direct patient care.  OIG found cybersecurity weakness at Medicaid managed care 
organizations and several State agencies.142  Additionally, OIG made recommendations on how FDA could 
integrate cybersecurity issues into its premarket review process for medical devices.143  
The Department made some progress to bolster cybersecurity in the health care industry.  HHS launched 
the Health Sector Cybersecurity Coordination Center to increase the amount and frequency of 
cybersecurity information sharing between the Federal Government and the Healthcare and Public Health 
(HPH) sector.144  HHS also worked with industry partners to publish a cybersecurity principles and 
practices document to educate health care entities on cybersecurity threats and practical steps they could 
take to mitigate risks.145  ONC and OCR developed a security risk assessment tool designed to help 
providers identify where health information might be a risk within their organization.146  FDA entered into 
an agreement with DHS to encourage greater coordination between the agencies to identify, address, and 
mitigate cybersecurity vulnerabilities in medical devices.147  The Department also proposed rules to 
protect donations of cybersecurity technology within the health care industry to promote increased 
adoption of cybersecurity.  These developments demonstrate HHS's commitment to working across the 
health care sector to better prepare for and remediate continuously evolving cyber threats. 
The Department also plays a significant role in ensuring the privacy of sensitive individual data, such as 
personal health information, genetic information, and more.  Most notably, OCR established and enforces 
the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rules requirements.  
However, the bulk of the Privacy Rules requirements were established nearly 20 years ago and may not 
adequately address modern issues related to individual privacy concerns with health information.  For 
example, an individuals electronic health information that is on the patients personal electronic device 
and not in the possession of a HIPAA-covered entity or business associate is not subject to the privacy 
protections of the HIPAA Privacy Rule.  At the same time, individual demand to have easy access to their 
health information where and when they want it is increasing.  This demand creates a challenge for HHS 
to create and promote better access for patients while reconciling the limits of existing privacy 
protections.  Patient health information that falls outside of the typical framework covered by the Privacy 
Rule may be at risk of being misused.  The Departments challenge is to keep up with changes in the 
health care industry and with non-traditional health care entities that may impact patient privacy.  The 
Department has made progress by issuing guidance and frequently asked questions related to mobile 
apps, use of APIs, and working with the Federal Trade Commission to build a w eb-based tool for 
developers of health-related mobile apps.   
31 
     
 
6: Working Across 
Government To Provide Better 
Service to HHS Beneficiaries 
 
B 
ig problems require big solutions.  HHS faces some of the 
RELEVANT OPDIVS 
largest and most complex problems that challenge our 
Government and the American public.  These problems  All HHS  
commonly transcend a single HHS program.  Often, HHSs mission is  KEY ELEMENTS 
only one piece of a larger puzzle, and HHS shares responsibility with    Building and sustaining 
multiple entities, including other Federal departments, States, and 
effective partnerships 
industry partners.  Nearly all HHS programs require strong partnership    Managing greater 
from multiple entities, within and outside of HHS.  This coordination 
integration and efficiency 
can add complexity to HHSs work but also provides greater gains, 
among HHS partners 
marshalling all available resources to improve the Nations health and 
  Ensuring that HHS and its 
well-being.   
partners are accountable for 
ongoing coordination  
The potential benefits of effective collaboration are great, both in 
ensuring program efficiency and providing better service to HHS 
beneficiaries and the public.  HHS and the Administration recognize that complex issues require coordinated 
solutions and see the Department as a leader in forging these partnerships.  The Administration pre-designated 
HHS as the Quality Service Management Office for grants management across Federal Government in response to 
its Cross-Agency Priority Goal 5 (Sharing Quality Services).148  Pending final approval by OMB, HHS will be called 
upon to provide leadership and best practices to other Federal agencies in the area of grants management. 
Likewise, HHS responded to the Administrations 2017 
directive to reorganize Government149 to make it more 
efficient, effective and accountable through its ReImagine 
HHS effort.  ReImagine HHS outlined several core 
objectives for the Department, including Optimizing 
Coordination across HHS.  The ReImagine HHS initiative 
also laid out specific shifts in strategy across the 
Department, several of which highlight the need for 
greater coordination and information sharing across HHS 
and with partner agencies and Departments.150  To achieve 
these goals and optimize its operations, HHS must 
prioritize coordination and work to identify opportunities, 
overcome barriers, and seek accountability and improved 
outcomes.  The need for coordinated responses will only 
grow in the years to come as health care and other human 
services become more complex and intertwined with other Federal, State, and private-sector programs.  For 
example, CMS estimates that national health expenditures will grow rapidly during 20202027, reaching nearly $6 
trillion by 2027.151  Given that much of this growth is expected to be in the Medicare and Medicaid programs, HHS 
will continue to lead in managing policy that affects publicly and privately funded health care.   Coordination is so 
32 
     
 
integral to success at HHS that it crosses many of the programs 
discussed in each TMC.  Several TMCs highlight the broad and complex 
nature of HHSs work and the need to consider related issues outside of a single 
program or mission of a single agency.  For example, the quality of care for HHS 
beneficiaries, described in TMC 3, is affected by not only the availability and quality of health 
services but also human services such as child care and health care education.  Likewise, delivery of 
quality care through Medicaid depends on accurate and complete data from States, as referenced in  
TMC 5.        
Building on HHS coordination efforts 
Recent OIG work reveals the importance of effective and collaborative management within HHS and with HHS 
partners.  In some areas, HHS has focused on collaboration and brought substantial gains, such as its extensive 
work within the Department and with law enforcement to combat opioid misuse and fraud.  In other areas, HHS 
must work urgently to improve its coordination efforts, such as its management of ORRs UAC Program and 
programs to promote patient safety.   
Confronting the opioid crisis 
Fighting the Nations opioid epidemic is an example of a collaborative and coordinated activity across 
many Federal, State, and local agencies.  HHS has multiple programs and offices involved in fighting the 
opioid epidemic: CDC sets opioid equivalent dosage guidelines; CMS gives guidance to providers on 
prescribing opioids; SAMHSA issues grants for OUD treatment; and OIG investigates and excludes 
providers who illegally prescribe and distribute opioids.  (See TMCs 3 and 4 on HHSs efforts to combat the 
opioid epidemic.)  HHSs external partners in the fight include the Department of Justices (DOJs) Criminal 
Division, the Federal Bureau of Investigation (FBI), the Drug Enforcement Administration (DEA), as well as 
State and local law enforcement agencies.  
This is a collaborative effort for which HHS and its partners have enjoyed some success.  For the first time 
in 30 years, the number of opioid-related deaths is decreasing.152  In 2018, there was a significant 
decrease in the number of Part D beneficiaries who were prescribed opioids.153  These improvements are 
due in part to better and more available anti-overdose drugs,154 as well as aggressive law enforcement 
action to stop bad actors from providing opioids to people addicted to opioids.   
A 2019 OIG study found that 36 percent of Medicare Part D beneficiaries in 5 Appalachian-region States 
received a prescription opioid in 2017; almost 49,000 beneficiaries received high amounts of opioids; and 
nearly 6,000 beneficiaries were at serious risk of opioid misuse (received extreme amounts of opioids or 
appeared to be doctor shopping).155  OIG has worked with HHS, DOJ, and other law enforcement partners 
to prosecute people who illegally prescribe, dispense, or divert opioids.  In October 2018, DOJ, in 
partnership with OIG, FBI, and DEA, launched the Appalachian Regional Prescription Opioid (ARPO) Strike 
Force.156  As part of this Strike Force effort, OIG worked in cooperation with DEA, U.S. Attorneys, the FBI, 
and State Medicaid Fraud Control Units to investigate prescribing practices of physicians in the 
Appalachian Region.157  These investigations have resulted in numerous indictments and arrests of 
doctors and nurse practitioners who were illegally prescribing opioids.  In 2019, enforcement actions 
targeting the Appalachian Region yielded charges against 60 people, including 53 medical professionals, 
for allegedly illegally prescribing and distributing more than 32 million opioid pills to over 24,000 
people.158  In addition to taking bad providers off the street, the Strike Force team worked with CDC, DOJ, 
33 
     
 
and State public health officials to ensure that patients 
received access to needed medical care and did not experience 
interruption of care due to the law enforcement operation.   
The UAC Program   
One of the most visible examples of HHS program activities requiring coordination and 
information sharing among multiple agencies is ORRs UAC Program.  (See TMC 3 for more 
information.)  HHS is not the only Department with responsibility for children served by the UAC 
Program.  These children usually are referred to ORR by the DHS, Customs and Border Patrol, and 
transported to ORR-funded facilities by Immigration and Customs Enforcement.  Much attention is 
focused on the lack of coordination between HHS and these DHS programs regarding the identification, 
transfer, case management, and placement of unaccompanied children, particularly unaccompanied 
children who were separated from their parents at the border.159  Without strong and collaborative 
planning, coordination, and execution, HHS faces challenges in effectively providing care and identifying 
sponsors for these unaccompanied children.  HHS must continue to improve its information gathering and 
communication practices to ensure that separated children are reunited with their families in a timely 
manner.  Enhanced communication and cooperation with DHS, DOJ, and other Government partners are 
critical 
Emergency preparedness and response    
Although assistance in responding to natural disasters and other public health emergencies is widely 
recognized as the responsibility of the Federal Emergency Management Agency (FEMA) within DHS and 
the Department of Housing and Urban Development (HUD), HHS provides important emergency 
preparedness and response services.  (See TMC 4 for more on HHSs emergency preparedness 
challenges.)  It is the lead Federal department responsible for providing medical support and coordination 
during public health emergencies, such as disease outbreaks.160  Three OpDivs share this responsibility: 
Office of the Assistant Secretary for Preparedness and Response (ASPR), CDC, and CMS.  ASPR coordinates 
HHSs response to public health emergencies with other Federal agencies, such as FEMA.161  ASPR also 
coordinates and oversees Healthcare Coalitions, which are groups of providers and public health entities 
that work together to prepare for, respond to, and recover from emergencies and maintains the Strategic 
National Stockpile for vaccines, medicines, and supplies.162  CDC conducts research about emergencies, 
provides critical guidance to providers, Government, and the public,.163,   CMS oversees health care 
facilities participating in Medicare and Medicaid by requiring a set of minimum health and safety 
standards, including recently updated standards for emergency preparedness.164, 165 
OIG studies have repeatedly identified the need for improved coordination in emergency preparedness 
and response, both within and outside the Department.  A 2019 OIG report determined whether HHS's 
response efforts to the 2014 Ebola outbreak were effective and efficient and found that HHS (1) had no 
strategic framework in place to coordinate global health security at the international or departmental 
levels before the Ebola outbreak, (2) was not prepared to deploy the resources needed for such a large-
scale international response, and (3) did not have in place internal or external communication channels 
for responding to an international public health emergency.166  Similarly, a 2018 OIG report assessed 
hospital preparedness for infectious diseases in the years since the 2014 Ebola outbreak, and found that 
coordination between ASPR, CDC, and CMS was sometimes lacking.167  Hospital administrators reported 
that their staff had difficulty interpreting guidance from multiple government entities and understanding 
their role in serving the public during a crisis.   
34 
     
 
Patient safety   
As described in TMC 3, OIG has conducted extensive work regarding 
protecting the safety of patients undergoing medical care, including a 
20082018 series of reports that found alarming rates of patient harm as the 
result of medical care.168  HHSs responsibility for making health care safe and avoiding 
adverse events lies with CMS in overseeing facility compliance with health care standards 
and with the Agency for Healthcare Research and Quality (AHRQ) in conducting patient safety 
research and issuing guidance to providers.  In these reports, OIG recommended that AHRQ and CMS 
work more closely together, and work with providers, to identify patient harm and develop technical 
assistance for the facilities and clinicians providing care.  In response, AHRQ and CMS took action 
together, and with other HHS operating divisions, to develop new quality and safety measures and revise 
guidance to providers.         
Federal Marketplace   
Another example of a lack of coordination within HHS and with multiple stakeholders occurred during the 
roll-out of the Federal Marketplace under the Patient Protection and Affordable Care Act of 2010.169  In a 
case study released in 2016, OIG found poor coordination and communication between the HHS Office of 
the Secretary (OS) and CMS contributed to the failed launch of the Federal Marketplace website 
HealthCare.gov.170  The website project was transferred early in its development from a division within OS 
to CMS, and the transfer occurred without proper planning and coordination or a clear handoff of 
leadership.  As the project progressed, CMS officials failed to adequately convey to OS that they were 
encountering deep and widespread problems with the policy, technology, and contracts associated with 
the website build.   
As a result, the Department did not intervene and continued to plan for a website release date and 
functionality that CMS could not effectively meet.  The website could not accommodate the volume of 
traffic it received and was plagued by performance problems in the first months of its operation.  The OIG 
report identified lessons learned from this project and core management principles to apply to all 
Government programs, technological or otherwise: clear leadership; effective communication; willingness 
to adjust; and accountability for performance and meeting objectives.  Attention to these areas helped 
CMS recover from the failed launch, develop a functioning system, and salvage the first open enrollment 
period.  Better collaboration allowed CMS to leverage Departmental expertise and other resources, 
identify and address problems more quickly, make informed decisions, and provide clearer direction to 
the public.  Going forward, CMS will continue to need close coordination with other Federal agencies and 
with States to ensure that marketplaces operate in accordance with requirements and meet emerging 
challenges. 
Indian Health Service     
OIG found similar themes in a 2019 case study of the IHS closure and reopening of the Rosebud Hospital 
Emergency Department (ED), an IHS-run facility in South Dakota.171  IHS has many partners in providing 
health care to AI/AN communities, including CMS (requiring that hospitals maintain basic standards), the 
AI/AN tribes, and the surrounding (often rural) communities.  (See TMC 3 for more information on quality 
standards.)  CMS found Rosebud Hospital was not in compliance with its ED standards, and CMS planned 
to terminate the hospitals certification to receive Medicare and Medicaid reimbursements.  The hospital 
was unable to bring its ED operations back into compliance, so IHS closed the ED temporarily.  The closure 
proved highly problematic for other hospitals in the area, in that IHS did not adequately notify them of 
35 
     
 
the closure, and the hospitals were ill-prepared to receive 
Rosebud Hospitals emergency patients.  After failed attempts to 
resolve the issues, IHS entered into a Systems Improvement Agreement 
with CMS and sought additional resources and support from the Department, 
including the Health Resources and Services Administration (HRSA).  The Rosebud ED 
reopened following these collaborative efforts but has continued to struggle in maintaining 
compliance with CMS standards.  The success of rural IHS services will depend on ongoing 
collaboration within and outside HHS, including Federal departments and agencies responsible for 
AI/AN programs, such as the Bureau of Indian Affairs in the Department of the Interior.  A 2017 report by 
the Council of the Inspectors General on Integrity and Efficiency outlined management deficiencies that 
Inspectors General from HHS, Interior, and other Departments found in AI/AN programs, some of which 
were similar to Rosebuds problems with staffing and infrastructure.172  (See TMC 3 for more on concerns 
regarding quality of care at IHS facilities.)  
Improving coordination in ongoing and future multi-agency efforts 
HHS cannot accomplish its mission to enhance and protect the health and well-being of all Americans without 
strong partnerships and improved coordination.  As HHS continues to find solutions to the Departments many 
challenges, it should draw on its prior accomplishments and failures in coordinating complex, multi-agency 
projects and develop a roadmap for success.  In developing this roadmap, HHS should focus on three key areas: (1) 
sustaining effective partnerships, (2) managing and planning for greater integration and efficiency among its 
partners, and (3) ensuring that all partners are accountable for ongoing coordination and information sharing.   
To fully assess these areas, HHS must address some difficult questions: What information does HHS need from its 
partners?  How do all entities develop a common plan and communicate effectively?  What barriers to 
collaboration exist, including competing interests and practical issues such as IT compatibility?  Which agency is 
responsible for which part, and how do agencies hold themselves and each other accountable?       
After developing this path, HHS should aspire to leverage effective coordination to address problems and reach for 
new, ambitious goals, such as raising standards for health and well-being, improving holistic outcomes for 
beneficiaries served by multiple programs, and developing more effective preventive care and other health 
management programs.  HHS recognizes the need for coordination and higher shared goals.  Such goals are 
achievable and would allow HHS to best serve its mission and the American public.
36 
     
 
Endnotes   
                                                                 
1 OIG, Solutions to Reduce Fraud, Waste, and Abuse in HHS Programs: OIGs Top Unimplemented 
Recommendations, July 2019.  Available at https://oig.hhs.gov/reports-and-
publications/compendium/files/compendium2019.pdf.   
 
2 CMS, CMS Fast Facts July 2019.  Available at https://www.cms.gov/research-statistics-data-and-
systems/statistics-trends-and-reports/cms-fast-facts/index.html 
 
3HHS, Budget in Brief, FY 2020.  Available at https://www.hhs.gov/sites/default/files/fy-2020-budget-in-brief.pdf. 
 
4 According to the 2019 Annual Report of the Board of Trustees of the Federal Hospital Insurance and Federal 
Supplementary Medical Insurance Trust Funds, the Trustees stated that the Federal Hospital Insurance Trust Fund 
is expected to be depleted in 2026 and that spending for the Federal Supplementary Medical Insurance Trust Fund 
will exceed the projected average annual growth rate of Gross Domestic Product over the next 5 years. 
 
5 GAO, U.S. Governments 2018 and 2017 Consolidated Financial Statement.  Available at 
https://www.gao.gov/products/GAO-19-294R. 
 
6 OIG, Medicare Could Have Saved Billions at Critical Access Hospitals if Swing-Bed Services Were Reimbursed Using 
the Skilled Nursing Facility Prospective Payment System Rates, A-05-12-00046, March 2015.  Available at 
https://oig.hhs.gov/oas/reports/region5/51200046.asp. 
 
7 OIG, Vulnerabilities Remain Under Medicare's 2-Midnight Hospital Policy, OEI-02-15-00020, December 2016.  
Available at https://oig.hhs.gov/oei/reports/oei-02-15-00020.asp. 
 
8 OIG, CMS Improperly Paid Millions of Dollars for Skilled Nursing Facility Services When the Medicare 3-Day 
Inpatient Hospital Stay Requirement Was Not Met, A-05-16-00043, February 2019.  Available at 
https://oig.hhs.gov/oas/reports/region5/51600043.asp. 
 
9 OIG, The Medicare Payment System for Skilled Nursing Facilities Needs To Be Reevaluated, OEI-02-13-00610, 
September 2015.  Available at https://oig.hhs.gov/oei/reports/oei-02-13-00610.asp.  
10 OIG, Increases in Reimbursement for Brand Name Drugs in Part D, OEI-03-15-00080, June 2018.  Available at 
https://oig.hhs.gov/oei/reports/oei-03-15-00080.asp. 
 
11 The specific drugs at issue were inhalation drugs administered through DME and supplying fees for 
immunosuppressive drugs associated with an organ transplant, oral anticancer chemotherapeutic drugs and oral 
antiemetic drugs used as a part of an anticancer chemotherapeutic regimen.  See OIG, Medicare Part B Prescription 
Drug Dispensing and Supplying Fee Payment Rates Are Considerably Higher Than the Rates Paid by Other 
Government Programs, A-06-12-00038, September 2014.  Available at 
https://oig.hhs.gov/oas/reports/region6/61200038.asp. 
 
12 OIG, Issue Brief: Excluding Noncovered Versions When Setting Payment for Two Part B Drugs Would Have 
resulted in Lower Drug Costs for Medicare and its Beneficiaries, OEI-12-17-00260, November 2017.  Available at 
https://oig.hhs.gov/oei/reports/oei-12-17-00260.pdf. 
 
13 OIG, Federal Marketplace: Inadequacies in Contract Planning and Procurement, OEI-03-14-00230, January 2015.  
Available at https://oig.hhs.gov/oei/reports/oei-03-14-00230.pdf.  
 
37 
     
 
                                                                                                                                                                                                               
14 OIG, Federal Marketplace: Inadequacies in Contract Planning and Procurement, OEI-03-14-00230, January 2015.  
Available at https://oig.hhs.gov/oei/reports/oei-03-14-00230.pdf. 
 
15 HHS, 2018 Agency Financial Report.  Available at https://www.hhs.gov/sites/default/files/fy-2018-hhs-agency-
financial-report.pdf. 
 
16 CMS, 2018 Medicare Fee-for-Service Supplemental Improper Payment Data.  Available at 
https://www.cms.gov/Research-Statistics-Data-and-Systems/Monitoring-Programs/Medicare-FFS-Compliance-
Programs/CERT/CERT-Reports-
Items/2018MedicareFFSSupplementalImproperPaymentData.html?DLPage=1&DLEntries=10&DLSort=0&DLSortDir
=descending 
 
17 OIG, U.S. Department of Health and Human Services Met Many Requirements of the Improper Payments 
Information Act of 2002 but Did Not Fully Comply for Fiscal Year 2018, May 2019.  Available at 
https://oig.hhs.gov/oas/reports/region17/171952000.asp. 
 
18 OIG, Online Portfolio: Home Health, February 2016.  Available at https://oig.hhs.gov/reports-and-
publications/portfolio/home-health/. 
 
OIG, Vulnerabilities in the Medicare Hospice Program Affect Quality Care and Program Integrity: An OIG Portfolio, 
OEI-02-16-00570, July 2018.  Available at https://oig.hhs.gov/oei/reports/oei-02-16-00570.asp 
OIG, CMS Improperly Paid Millions of Dollars for Skilled Nursing Facility Services When the Medicare 3-Day 
Inpatient Hospital Stay Requirement Was Not Met, February 2019.  Available at 
https://oig.hhs.gov/oas/reports/region5/51600043.asp. 
 
OIG, Medicare Improperly Paid Suppliers for Durable Medical Equipment, Prosthetics, Orthotics, and Supplies 
Provided to Beneficiaries During Inpatient Stays, November 2018.  Available at 
https://oig.hhs.gov/oas/reports/region9/91703035.asp. 
 
OIG, Medicare Improperly Paid Providers for Items and Services Ordered by Chiropractors, July 2018.  Available at 
https://oig.hhs.gov/oas/reports/region9/91703002.asp. 
 
OIG, Medicare Improperly Paid Hospitals Millions of Dollars for Intensity-Modulated Radiation Therapy Planning 
Services, August 2018.  Available at https://oig.hhs.gov/oas/reports/region9/91602033.asp. 
 
19 CMS, 2018 PERM Medicaid Improper Payment Rates.  Available at https://www.cms.gov/Research-Statistics-
Data-and-Systems/Monitoring-Programs/Medicaid-and-CHIP-
Compliance/PERM/PERMErrorRateFindingsandReport.html. 
 
20 OIG, Vulnerabilities Exist in State Agencies' Use of Random Moment Sampling To Allocate Costs for Medicaid 
School-Based Administrative and Health Services Expenditures, December 2018.  Available at 
https://oig.hhs.gov/oas/reports/region7/71804107.asp. 
 
Nonemergency Medical Transportation: 
OIG, Michigan Did Not Always Comply With Federal and State Requirements for Claims Submitted for the 
Nonemergency Medical Transportation Brokerage Program, June 2018.  Available at 
https://oig.hhs.gov/oas/reports/region5/51600021.asp. 
 
OIG, Minnesota Did Not Always Comply With Federal and State Requirements for Claims Submitted for the 
Nonemergency Medical Transportation Brokerage Program, September 2017.  Available at 
https://oig.hhs.gov/oas/reports/region5/51500026.asp. 
 
 
38 
     
 
                                                                                                                                                                                                               
OIG, Oklahoma Did Not Adequately Oversee Its Medicaid Nonemergency Medical Transportation Program, August, 
2017.  Available at https://oig.hhs.gov/oas/reports/region6/61600007.asp.  
 
OIG Work Plan: Medicaid Targeted Case Management.  Available at https://oig.hhs.gov/reports-and-
publications/workplan/summary/wp-summary-0000235.asp. 
 
OIG Personal Care Services Portfolio: https://oig.hhs.gov/newsroom/media-materials/2016/mpcs.asp. 
 
21 OIG, Featured Topic: Unaccompanied Children.  Available at https://oig.hhs.gov/reports-and-
publications/featured-topics/uac/. 
 
22 OIG, More Effort Is Needed to Protect the Integrity of the Child Care and Development Fund Block Grant Program, 
OEI-03-16-00150, July 2016.  Available at https://oig.hhs.gov/oei/reports/oei-03-16-00150.asp. 
 
23 OIG, U.S. Department of Health and Human Services Met Many Requirements of the Improper Payments 
Information Act of 2002 but Did Not Fully Comply for Fiscal Year 2018, May 2019.  Available at 
https://oig.hhs.gov/oas/reports/region17/171952000.asp. 
 
24 OIG, CMS Has Not Performed Required Closeouts of Contracts Worth Billions, OEI-03-12-00680, December 2015.  
Available at https://oig.hhs.gov/oei/reports/oei-03-12-00680.asp. 
 
25 OIG, The Centers for Medicare & Medicaid Services Could Improve Performance Measures Associated With the 
Fraud Prevention System, A-01-15-00509, September 2017.  Available at 
https://oig.hhs.gov/oas/reports/region1/11500509.pdf. 
 
26 OIG, Problems Remain for Ensuring That All High Risk Medicaid Providers Undergo Criminal Background Checks, 
July 2019.  Available at https://oig.hhs.gov/oei/reports/oei-05-18-00070.asp 
 
27 CMS, Medicaid Managed Care Enrollment and Program Statistics, 2017.  Available at 
https://www.medicaid.gov/medicaid/managed-care/downloads/enrollment/2017-medicaid-managed-care-
enrollment-report.pdf. 
 
28 OIG, Weaknesses Exist in Medicaid Managed Care Organizations' Efforts To Identify and Address Fraud and 
Abuse, OEI-02-15-00260, July 2018.  Available at https://oig.hhs.gov/oei/reports/oei-02-15-00260.pdf. 
 
29 OIG has found that some Tribes and Tribal organizations have not adequately protected funds under the Indian 
Self-Determination and Education Assistance Act and other programs, resulting in embezzlement and theft of 
Federal funds. 
 
30 HHS codified the Uniform Guidance at 45 CFR part 75, which prescribes instructions and other pre-award 
matters for the granting agency to use in the announcement and application process for awards made on or after 
December 26, 2014.  The Uniform Guidance stipulates that the use of certain sections is required only for 
competitive Federal awards but may also be used by the HHS awarding agency for non-competitive awards where 
appropriate or required by Federal statute.   
31 OIG, Two Indian Health Service Hospitals Had System Security and Physical Controls for Prescription Drug and 
Opioid Dispensing but Could Still Improve Controls, A-18-1630540, November 2017.  Available at 
https://oig.hhs.gov/oas/reports/region18/181630540.pdf. 
 
32 See, e.g., Examining Efforts to Prevent Opioid Overutilization and Misuse in Medicare and Medicaid, Testimony 
of Maureen Dixon, pp. 45 (May 2019).  Available at https://oig.hhs.gov/testimony/docs/2018/dixon-
testimony052918.pdf. 
 
 
39 
     
 
                                                                                                                                                                                                               
33 HHS, 2018 Agency Financial Report.  Available at https://www.hhs.gov/sites/default/files/fy-2018-hhs-agency-
financial-report.pdf. 
 
34 Ibid. 
 
35 OIG, U.S. Department of Health and Human Services Met the Requirements of the Digital Accountability and 
Transparency Act of 2014, With Key Areas That Require Improvement, October 2018.  Available at 
https://www.oig.hhs.gov/oas/reports/region17/171854000.asp. 
 
36 Executive Order on Improving Price and Quality Transparency in American Healthcare To Put Patients First, June 
2017.  https://www.whitehouse.gov/presidential-actions/executive-order-improving-price-quality-transparency-
american-healthcare-put-patients-first/. 
 
37 This TMC focuses on Medicare and Medicaid.  The Department funds other vital health services, such as IHS, 
substance abuse treatment facilities, and Federally Qualified Health Centers, which are addressed in other TMCs.  
(See TMCs 1, 3, and 4.) 
 
38 The Healthcare Payment Learning & Action Network, APM Measurement: Progress of Alternate Payment Models 
Methodology and Results Report, 2018, http://hcp-lan.org/workproducts/apm-methodology-2018.pdf.  Pursuant 
to the LAN framework, the higher figure represents categories 2, 3, and 4 models and the lower figure represents 
only categories 3 and 4.  The report also includes data for Medicare Advantage and commercial insurance.   
 
39 HHS, FY 2018 Agency Financial Report, November 2018.  Available at https://www.hhs.gov/sites/default/files/fy-
2018-hhs-agency-financial-report.pdf.  
 
40 Speech: Remarks by Administrator Seema Verma at the 2019 CMS Quality Conference, January 29, 2019.  
Available at https://www.cms.gov/newsroom/press-releases/speech-remarks-administrator-seema-verma-2019-
cms-quality-conference. 
 
41 OIG, Medicare Shared Savings Program Accountable Care Organizations Have Shown Potential for Reducing 
Spending and Improving Quality, OEI-02-15-00450, August 2017.  Available at https://oig.hhs.gov/oei/reports/oei-
02-15-00450.pdf. 
 
42 OIG, ACOs' Strategies for Transitioning to Value-Based Care: Lessons From the Medicare Shared Savings Program, 
OEI-02-15-00451, July 2019.  Available at https://oig.hhs.gov/oei/reports/oei-02-15-00451.pdf.  
 
43 See also CMS, Care Coordination Toolkit.  Available at:  https://innovation.cms.gov/Files/x/aco-carecoordination-
toolkit.pdf. 
 
44 OIG, Dialysis Services Provided by Atlantis Health Care Group of Puerto Rico, Inc., Did Not Comply With Medicare 
Requirements Intended To Ensure the Quality of Care Provided to Medicare Beneficiaries, A-02-16-01009, 
December 2018.  Available at https://oig.hhs.gov/oas/reports/region2/21601009.pdf.  
 
45 OIG, Using Health IT for Care Coordination: Insights From Six Medicare Accountable Care Organizations, OEI-01-
16-00180, May 2019.  Available at https://oig.hhs.gov/oei/reports/oei-01-16-00180.pdf.  
46 OIG, Many Medicaid-Enrolled Children Treated for ADHD Did Not Receive Recommended Followup Care, OEI-07-
17-00170, August 2019.  Available at https://oig.hhs.gov/oei/reports/oei-07-17-00170.pdf.     
 
47 OIG, 2019: Vulnerabilities in Hospice Care.  https://oig.hhs.gov/newsroom/media-materials/2019/hospice/.   
 
 
40 
     
 
                                                                                                                                                                                                               
48 OIG, Adverse Events in Hospitals: National Incidence Among Medicare Beneficiaries, OEI-06-09-00090, November 
2010.  Available at https://oig.hhs.gov/oei/reports/oei-06-09-00090.pdf.  Adverse Events in Skilled Nursing 
Facilities: National Incidence Among Medicare Beneficiaries, OEI-06-11-00370, February 2014.  Available at 
https://oig.hhs.gov/oei/reports/oei-06-11-00370.pdf.  Adverse Events in Inpatient Rehabilitation Facilities (IRF): 
National Incidence Among Medicare Beneficiaries, OEI-06-14-00110, July 2016.  Available at 
https://oig.hhs.gov/oei/reports/oei-06-14-00110.pdf.  Adverse Events in Long-term Care Hospitals: National 
Incidence Among Medicare Beneficiaries, OEI-06-14-00530, November 2018.  Available at 
https://oig.hhs.gov/oei/reports/oei-06-14-00530.pdf.  
 
49 OIG, Hospital Incident Reporting Systems Do Not Capture Most Patient Harm, OEI-06-09-00091, January 2012.  
Available at https://oig.hhs.gov/oei/reports/oei-06-09-00091.asp. 
 
50 OIG, Adverse Events In Hospitals: National Incidence Among Medicare Beneficiaries10-Year Update, OEI-06-18-
00400, estimated November 2020.   
 
51 OIG Corporate Integrity Agreement.  
https://oig.hhs.gov/fraud/cia/agreements/Vanguard_Healthcare_LLC_Vanguard_Healthcare_Services_LLC_Boulev
ard_Terrace_LLC_Glen_Oaks_LLC_Imperial_Gardens_Health_and_Rehabilitation_Vanguard_of_Manchester_%20L
LC_Vanguard_Financial_Svcs_LLC_etal_01092019.pdf. 
 
52 OIG, Indian Health Service Hospitals: More Monitoring Needed to Ensure Quality Care, OEI-06-14-00010, October 
2016.  Available at https://oig.hhs.gov/oei/reports/oei-06-14-00010.pdf.  Longstanding Challenges Warrant 
Focused Attention To Support Quality Care, OEI-06-14-00011, October 2016.  Available at 
https://oig.hhs.gov/oei/reports/oei-06-14-00011.pdf.  
 
53 IHS, Quality at IHS.  Available at https://www.ihs.gov/quality/. 
 
54 OIG, Vulnerabilities in the Medicare Hospice Program Affect Quality Care and Program Integrity: An OIG 
Portfolio, OEI-02-16-00570, July 2018.  Available at https://www.oig.hhs.gov/oei/reports/oei-02-16-00570.pdf.  
 
55 OIG, CMS Guidance to State Survey Agencies on Verifying Correction of Deficiencies Needs To Be Improved To 
Help Ensure the Health and Safety of Nursing Home Residents, A-09-18-02000, February 2019.  Available at 
https://oig.hhs.gov/oas/reports/region9/91802000.pdf.  
 
56 OIG, Indian Health Service Hospitals: More Monitoring Needed to Ensure Quality Care, OEI-06-14-00010, October 
2016.  Available at https://oig.hhs.gov/oei/reports/oei-06-14-00010.pdf.  Longstanding Challenges Warrant 
Focused Attention To Support Quality Care, OEI-06-14-00011, October 2016.  Available at 
https://oig.hhs.gov/oei/reports/oei-06-14-00011.pdf.  Rosebud Hospital, Indian Health Service Management of 
Emergency Department Closure and Reopening, A Case Study, OEI-06-17-00270, July 2019.  Available at 
https://oig.hhs.gov/oei/reports/oei-06-17-00270.pdf. 
 
57 OIG, Separated Children Placed in Office of Refugee Resettlement Care, OEI-BL-18-00511, January 2019.  
Available at https://www.oig.hhs.gov/oei/reports/oei-BL-18-00511.pdf.   
 
58 OIG, The Tornillo Influx Care Facility: Concerns About Staff Background Checks and Number of Clinicians on Staff, 
A-12-19-20000.  Available at https://oig.hhs.gov/oas/reports/region12/121920000.pdf. 
 
59 DOJ, U.S. Attorneys Office, District of Montana, White House Announces Presidential Task Force on Protecting 
Native American Children in the Indian Health Service System.  Available at https://www.justice.gov/usao-
mt/pr/white-house-announces-presidential-task-force-protecting-native-american-children-indian. 
 
60 OIG, The Tornillo Influx Care Facility: Concerns About Staff Background Checks and Number of Clinicians on Staff.  
Available at https://oig.hhs.gov/oas/reports/region12/121920000.pdf.   
 
41 
     
 
                                                                                                                                                                                                               
 
61 OIG, All Six States Reviewed Had Partially Implemented New Criminal Background Check Requirements for 
Childcare Providers, and Five of the States Anticipate Full Implementation by Fiscal Year 2020, A-05-19-00015, 
August 2019.  Available at https://oig.hhs.gov/oas/reports/region5/51900015.asp. 
 
62 National Background Check Program for Long-Term-Care Providers: Assessment of State Programs Concluded in 
2017 and 2018 https://oig.hhs.gov/oei/reports/oei-07-18-00290.pdf.  And National Background Check Program for 
Long-Term-Care Providers: Assessment of State Programs Concluded Between 2013 and 2016.  Available at 
https://oig.hhs.gov/oei/reports/oei-07-16-00160.pdf.   
 
63CMS, CMS Fast Facts, July 2019.  https://www.cms.gov/research-statistics-data-and-systems/statistics-trends-
and-reports/cms-fast-facts/index.html.  
 
64 Joint Report: Ensuring Beneficiary Health and Safety in Group Homes Through State Implementation of 
Comprehensive Compliance Oversight.  Available at https://oig.hhs.gov/reports-and-publications/featured-
topics/group-homes/group-homes-joint-report.pdf.   
 
65 OIG, Incidents of Potential Abuse and Neglect at Skilled Nursing Facilities Were Not Always Reported and 
Investigated, A-01-16-00509, June 2019.  Available at https://oig.hhs.gov/oas/reports/region1/11600509.pdf. 
 
66 OIG, CMS Could Use Medicare Data To Identify Instances of Potential Abuse or Neglect, A-01-17-00513, June 
2019.  Available at https://oig.hhs.gov/oas/reports/region1/11700513.pdf.  
 
67CMCS Informational Bulletin: Health and Welfare of Home and Community Based Services (HCBS) Waiver 
Recipients, June 2018.  Available at https://www.medicaid.gov/federal-policy-guidance/downloads/cib062818.pdf. 
 
68 A Resource Guide for Using Diagnosis Codes in Health Insurance Claims to Help Identify Unreported Abuse or 
Neglect.  Available at 
https://oig.hhs.gov/oas/reports/region1/11900502.asp?utm_source=website&utm_medium=asp&utm_campaign
=abuse-neglect-guide.  
 
69 SAMHSA, Key Substance Use and Mental Health Indicators in the United States: 
Results from the 2018 National Survey on Drug Use and Health.  Available at 
https://www.samhsa.gov/data/sites/default/files/cbhsq-
reports/NSDUHNationalFindingsReport2018/NSDUHNationalFindingsReport2018.pdf.  
 
70 Hedegaard H, Minino AM, Warner M, Drug overdose deaths in the United States, 19992017, NCHS Data Brief, 
no. 329, National Center for Health Statistics, 2018.  Available at 
https://www.cdc.gov/nchs/products/databriefs/db329.htm.  
 
71 Scholl L, Seth P, Kariisa M, Wilson N, Baldwin G. Drug and Opioid-Involved Overdose Deaths  United States, 
20132017.  MMWR Morb Mortal Wkly Rep 2019; 67: 14191427.  Available at: 
https://www.cdc.gov/mmwr/volumes/67/wr/mm675152e1.htm?s_cid=mm675152e1_w 
 
72 OIG, Data Brief: Concerns About Opioid Use in Medicare Part D in the Appalachian Region, OEI-02-18-00224, 
April 2019.  Available at https://oig.hhs.gov/oei/reports/oei-02-18-00224.pdf.   
 
See also: National Association of Counties and Appalachian Regional Commission, Opioids in Appalachia: The Role 
of Counties in Reversing a Regional Epidemic, May 2019.  Available at 
https://www.naco.org/sites/default/files/documents/Opioids-Full.pdf.   
 
OIG, Data Brief: Opioids in Ohio Medicaid: Review of Extreme Use and Prescribing, OEI-05-18-00010, July 2018.  
Available at https://oig.hhs.gov/oei/reports/oei-05-18-00010.pdf. 
 
42 
     
 
                                                                                                                                                                                                               
 
73 CDC, Illicit Drug Use, Illicit Drug Use Disorders, and Drug Overdose Deaths in Metropolitan and Nonmetropolitan 
AreasUnited States, October 2017.  Available at https://www.cdc.gov/mmwr/volumes/66/ss/pdfs/ss6619.pdf.   
 
74 SAMHSA, Survey Results from the 2016 National Survey on Drug Use and Health: Detailed Tables, Table 1.65B.  
Available at https://www.samhsa.gov/data/sites/default/files/NSDUH-DetTabs-2016/NSDUH-DetTabs-2016.pdf.   
 
75 CDC, National Center for Health Statistics, Multiple Cause of Death 19992017 on CDC WONDER Online 
Database.  Data request results available at https://wonder.cdc.gov/controller/saved/D77/D48F904 for 1999-2000 
and at https://wonder.cdc.gov/controller/saved/D77/D48F902 for 2016-2017 (both requests created on December 
18, 2018).  See also: Seth P, Rudd R, Noonan R, and Haegerich T, Quantifying the Epidemic of Prescription Opioid 
Overdose Deaths, Am J Public Health, 2018; 108(4): 500502.  Available at 
https://ajph.aphapublications.org/doi/abs/10.2105/AJPH.2017.304265.   
 
76 Scholl L, Seth P, Kariisa M, Wilson N, Baldwin G, Drug and Opioid-Involved Overdose DeathsUnited States, 2013
2017, MMWR, ePub: 21 December 2018.  Available at 
https://www.cdc.gov/mmwr/volumes/67/wr/mm675152e1.htm?s_cid=mm675152e1_w. 
 
77 For example, OIG has identified issues with the prescribing and dispensing of opioids at IHS hospitals.  OIG, IHS 
Needs To Improve Oversight of Its Hospitals' Opioid Prescribing and Dispensing Practices and Consider Centralizing 
Its Information Technology Functions, A-18-17-11400, July 2019.  Available at 
https://oig.hhs.gov/oas/reports/region18/181711400.pdf. 
 
78 HHS, Strategy to Combat Opioid Abuse, Misuse, and Overdose.  Available at 
https://www.hhs.gov/opioids/sites/default/files/2018-09/opioid-fivepoint-strategy-20180917-508compliant.pdf. 
 
79 OIG, Opioid Use Decreased in Medicare Part D, While Medication-Assisted Treatment Increased, OEI-02-19-
00390.  Available at https://oig.hhs.gov/oei/reports/OEI-02-19-00390.pdf.   
 
81 FDA, Opioid Analgesic Drugs: Considerations for Benefit-Risk Assessment Framework 
Guidance for Industry.  Available at https://www.fda.gov/media/128150/download.  
 
82 FDA, FDA requests removal of Opana ER for risks related to abuse.  Available at https://www.fda.gov/news-
events/press-announcements/fda-requests-removal-opana-er-risks-related-abuse. 
 
83 SAMHSA, Key Substance Use and Mental Health Indicators in the United States: 
Results from the 2018 National Survey on Drug Use and Health.  Available at 
https://www.samhsa.gov/data/sites/default/files/cbhsq-
reports/NSDUHNationalFindingsReport2018/NSDUHNationalFindingsReport2018.pdf.  
 
84 See HHS, Telemedicine and Prescribing Buprenorphine for the Treatment of Opioid Use Disorder, September 
2008.  Available at https://www.hhs.gov/opioids/sites/default/files/2018-09/hhs-telemedicine-hhs-statement-
final-508compliant.pdf. 
 
85 HHS Awards Over $1 Billion to Combat the Opioid Crisis, September 2018.  Available at 
https://www.hhs.gov/about/news/2018/09/19/hhs-awards-over-1-billion-combat-opioid-crisis.html. 
 
86 HHS Awards Nearly $400 Million to Combat the Opioid Crisis, August 2019.  Available at 
https://www.hhs.gov/about/news/2019/08/08/hhs-awards-nearly-400-million-to-combat-opioid-
crisis.html?utm_campaign=enews20190815&utm_medium=email&utm_source=govdelivery.  
 
 
43 
     
 
                                                                                                                                                                                                               
87 HHS, HHS Guide for Clinicians on the Appropriate Dosage Reduction or Discontinuation of Long-Term Opioid 
Analgesics, October 2019.  Available at https://cms-drupal8-op-
prod.cloud.hhs.gov/opioids/sites/default/files/2019-10/Dosage_Reduction_Discontinuation.pdf. 
 
88 CDC, Still Not Enough Naloxone Where Its Most Needed, August 2019.  Available at 
https://www.cdc.gov/media/releases/2019/p0806-naloxone.html.  See also: Abouk R, Pacula RL, and Powell D, 
Association Between State Laws Facilitating Pharmacy Distribution of Naloxone and Risk of Fatal Overdose, JAMA 
Intern Med. 2019; 179(6): 805-811.  Available at https://www.ncbi.nlm.nih.gov/pubmed/31058922. 
89 See, e.g., OIG, The Response to Superstorm Sandy Highlights the Importance of Recovery Planning for Child Care 
Nationwide, OEI-04-14-00410, December 2015.  Available at https://oig.hhs.gov/oei/reports/oei-04-14-00410.pdf.  
OIG, HHS Public Health and Medical Services Emergency Support Preparedness, OEI-04-11-0260, November 2012.  
Available at https://oig.hhs.gov/oei/reports/oei-04-11-00260.pdf. 
 
90 OIG, HHS Did Not Always Efficiently Plan and Coordinate Its International Ebola Response Efforts, A-04-16-03567, 
August 2019.  Available at https://oig.hhs.gov/oas/reports/region4/41603567.pdf. 
 
91 For example, during the Ebola crisis, many hospitals reported that they were unprepared to receive cases and 
experienced challenges, such as difficulty using Federal guidance, to sustain preparedness.  Since the Ebola crisis, 
hospitals have reported taking actions to improve preparedness, but challenges to sustaining preparedness still 
exist.  Hospitals Reported Improved Preparedness for Emerging Infectious Diseases After the Ebola Crisis, OEI-06-
15-00230, October 2018.  Available at https://oig.hhs.gov/oei/reports/oei-06-15-00230.pdf. 
 
92 CDC and Food Safety.  Available at https://www.cdc.gov/foodsafety/cdc-and-food-safety.html/. 
 
93 FDAs responsibility for safeguarding the nations food supply pertains to FDA-regulated food; the U.S. 
Department of Agriculture plays a lead role in regulating aspects of some meat, poultry, and egg products. 
 
94 U.S. Department of Health and Human Services FY 2020 Annual Performance Plan and Report.  Available at 
https://www.hhs.gov/sites/default/files/fy2020-performance-plan.pdf. 
 
95 OIG, Challenges Remain in FDA's Inspections of Domestic Food Facilities, September 2017.  Available at 
https://oig.hhs.gov/oei/reports/oei-02-14-00420.pdf. See also:  OIG, The Food and Drug Administration's Food-
Recall Process Did Not Always Ensure the Safety of the Nation's Food Supply, December 2017.  Available at 
https://oig.hhs.gov/oas/reports/region1/11601502.pdf.   
 
96 OIG, The Food and Drug Administration's Policies and Procedures Should Better Address Postmarket 
Cybersecurity Risk to Medical Devices, A-18-16-30530, October 2018.  Available at 
https://oig.hhs.gov/oas/reports/region18/181630530.asp.  
97 https://www.fda.gov/media/105635/download 
 
98 https://www.fda.gov/medical-devices/how-study-and-market-your-device/breakthrough-devices-program 
 
99 https://www.fdanews.com/articles/191213-fda-issues-breakthrough-designation-for-kidney-disease-test 
 
100 See, e.g., OIG, FDA Should Further Integrate Its Review of Cybersecurity Into the Premarket Review Process for 
Medical Devices, OEI-09-16-00220, September 2018.  Available at https://oig.hhs.gov/oei/reports/oei-09-16-
00220.pdf. 
 
101 OIG, The Food and Drug Administration's Policies and Procedures Should Better Address Postmarket 
Cybersecurity Risk to Medical Devices, A-18-16-30530, October 2018.  Available at 
https://oig.hhs.gov/oas/reports/region18/181630530.asp. 
 
 
44 
     
 
                                                                                                                                                                                                               
102 21 CFR Part 803. 
 
103 OIG, Adverse Event Reporting for Medical Devices, OEI-01-08-00110, October 2009.  Available at 
https://oig.hhs.gov/oei/reports/oei-01-08-00110.pdf 
 
104 The Foundation for Evidence Based Policymaking Act of 2018, P.L. 111-435 (Jan. 14, 2019); Presidential 
Management Agenda, Data, Accountability, and Transparency.  Available at 
https://www.performance.gov/PMA/Presidents_Management_Agenda.pdf.  
 
105 ReImagine HHS is a transformation effort to improve the Departments ability to enhance the health and 
wellbeing of all Americans. In spring 2017, OMB released Memorandum M-17-22, requiring all Cabinet-level 
agencies to develop a plan to become more effective, efficient, and accountable.  In response, HHS formed 
ReImagine HHS.  Leveraging the Power of Data is also part of the HHS priority goal action plan for Combined 
Data Analyses.  Available at 
https://www.performance.gov/health_and_human_services/June_2019_HHS_Combined_Data_Analyses.pdf. 
 
106 Federal Data Strategy: Principles and Practices.  Available at https://strategy.data.gov/.  
 
107 Office of the Assistant Secretary for Planning and Evaluation, Improving Data for Decision Making: HHS Data 
Collection Strategies for a Transformed Health System.  Available at https://aspe.hhs.gov/basic-report/improving-
data-decision-making-hhs-data-collection-strategies-transformed-health-system. 
 
108 Office of the Chief Technology Officer, The State of Data Sharing at the U.S. Department of Health and Human 
Services (Sept. 2018).  Available at https://www.hhs.gov/sites/default/files/HHS_StateofDataSharing_0915.pdf. 
 
109 OIG, The MEDIC Produced Some Positive Results but More Could Be Done to Enhance its Effectiveness, OEI-03-
17-00310, July 2018.  Available at https://oig.hhs.gov/oei/reports/oei-03-17-00310.pdf. 
 
110 Foundations for Evidence-Based Policymaking Act of 2018, P.L. 111-435 (Jan. 14, 2019);  Enterprise data 
governance is one of the four areas that is part of the Federal Data Strategy.  Available at 
https://strategy.data.gov/.  The Federal Data Strategy Action Plan requires all Federal agencies to make several 
data governance improvements, including establishing a data governance body.  Action 12: Constitute a Diverse 
Data Governance Body.  Available at https://strategy.data.gov/action-plan/#action-12-constitute-a-diverse-data-
governance-body. 
 
111 HHS Strategic Plan FY 20182022, Strategic Goal 5: Promote Effective and Efficient Management and 
Stewardship.  Available at https://www.hhs.gov/about/strategic-plan/strategic-goal-5/index.html#obj_5_3.  Digital 
Strategy at HHS.  Available at https://www.hhs.gov/web/governance/digital-strategy/index.html.  
 
112 HHS Agency Priority Goal Action Plan, Combined Data Analyses (June 2019).  HHSs goal is to develop and 
implement an enterprise-wide data governance model by September 30, 2019.  According to HHS Action plan, the 
enterprise-wide governance model will enable more efficient and effective processes for sharing inter-agency data 
beyond a data sets primary purpose.   
 
113 Building T-MSIS is a joint effort by the States and CMS to build a national Medicaid data set that addresses 
identified problems with prior Medicaid data sets.  CMS intends for T-MSIS to provide States and the Federal 
Government with a national Medicaid data repository that would, among other functions, support program 
management, financial management, and program integrity.  CMS, State Health Official Letter, August 10, 2018 
(SHO #18-008).  Available at https://www.medicaid.gov/federal-policy-guidance/downloads/sho18008.pdf. 
 
114 National Review of Opioid Prescribing in Medicaid is Not Yet Possible.  Available at 
https://www.oig.hhs.gov/oei/reports/oei-05-18-00480.pdf.    
 
 
45 
     
 
                                                                                                                                                                                                               
115 OIG Data Snapshot, National Review of Opioid Prescribing in Medicaid is Not Yet Possible, OEI-05-18-00480, 
August 2019.  Available at https://oig.hhs.gov/oei/reports/oei-05-18-00480.pdf. 
 
116 OIG work has shown that databases such as ACFs Program Information Report, FDA's Food Facility Registry and 
its National Drug Code Directory, HRSAs 340B covered-entity database, and IHS's Health Service Directory contain 
incomplete and inaccurate data. 
 
117 The Foundation for Evidence Based Policymaking Act of 2018 mandates HHS improve its capacity for using data 
for evidence building purposes; Federal Data Strategies, Promoting Efficient and Appropriate Data Use: Practices 
27-40.  Available at https://strategy.data.gov/practices/; U.S. Department of Health and Human Services, 2018 
HHS Data Strategy: Enhancing the HHS Evidence-Based Portfolio. 
 
118 OIG, HHS Oversight of Grantees Could Be Improved Through Better Information-Sharing, OEI-07-12-00110, Sept. 
2015.  Available at https://oig.hhs.gov/oei/reports/oei-07-12-00110.pdf.  In October 2018, HHS established an 
enterprise-wide Audit Tracking and Analysis System, which automates the assignment of single audit findings and 
tracks the status of single-audit resolution activities across HHS. OIG, Solutions to Reduce Fraud, Waste, and Abuse 
in HHS Programs: OIGs Top Recommendations (July 2019).  Available at https://oig.hhs.gov/reports-and-
publications/compendium/files/compendium2019.pdf. 
 
119 Most HHS data that can be shared are in machine-readable formats, but some data are not.  Without structured 
data that can be automatically read and formatted, sharing and use of data may require resource intensive 
preparation work.  Office of the Chief Technology Officer, The State of Data Sharing at the U.S. Department of 
Health and Human Services, page 12 (Sept. 2018). 
 
120 The CMS Innovation Center, Artificial Intelligence Health Outcomes Challenge.  Available at 
https://innovation.cms.gov/Files/x/aichallenge-pubnotice.pdf.  The Office of Chief Technology Officer, The 
Opportunity Project Health Sprint (Jan. 2019).  Available at https://www.hhs.gov/cto/blog/2019/1/17/top-health-
tech-sprint-unleashes-the-power-of-open-data-and-ai.html.  HHS Reimagine Acquisitions, BuySmarter.  Available at 
https://www.hhs.gov/sites/default/files/hhs-buysmarter-journey.pdf.   
 
121 For example, one of the winning tools at the Opioid Code-a-Thon developed a program to provide physicians 
with a visual representation of their opioid prescribing patterns compared with their peers.  The tool also allows 
physicians to visualize the prescribing patterns of other physicians in their area that they might refer their patients 
to.  HHS Opioid Code-a-Thon.  Available at https://www.hhs.gov/challenges/code-a-thon/index.html. 
 
122 Ibid.  
 
123 Examples of HHS stakeholders include Medicare providers, State Medicaid agencies, public health entities, 
researchers, universities, and other entities that may have similar missions or interests to that of the Department 
and its programs.  
 
124 The Foundations for Evidence-Based Policymaking Act of 2018  created a default presumption that Government 
data assets be available to the public in a machine-readable, open format, and under open licenses, and 
encouraging public use. P.L. 111-435  202 (Jan. 2019).  The third Federal Data Strategy Principle is promoting 
transparency: articulate the purposes and uses of federal data to engender public trust.  Comprehensively 
document processes and products to inform data providers and users.  Available at 
https://strategy.data.gov/principles/.  The 2018 HHS Data strategy Priority 1 is improving access to HHS data.  
Available at https://aspe.hhs.gov/system/files/pdf/261591/2018HHSDataStrategy.pdf.  
 
125 FDA, New Drugs Regulatory Program Modernization: Improving Approval Package Documentation and 
Communication, 84 Fed. Reg. 30733 (June 27, 2019). FDA, Clinical Data Summary Pilot Program (June 2019).  
Available at https://www.federalregister.gov/documents/2019/06/27/2019-13751/new-drugs-regulatory-
program-modernization-improving-approval-package-documentation-and.   
 
46 
     
 
                                                                                                                                                                                                               
 
126 CMS, Speech: Remarks by Administrator Seema Verma at the 2019 HIMSS Conference (Feb. 2019).  Available at 
https://www.cms.gov/newsroom/press-releases/speech-remarks-administrator-seema-verma-2019-himss-
conference. 
 
127 National Institutes of Health, All of Us Research Program.  Available at https://allofus.nih.gov/about/about-all-
us-research-program.  
 
128 NIHAll of Us Research Hub, Data Curation Process.  Available at https://www.researchallofus.org/data/data-
sources/methods/#study.  
 
129 OIG, Open Payments Data: Review of Accuracy, Precision, and Consistency in Reporting, OEI-03-15-00220, 
August 2018.  Available at https://oig.hhs.gov/oei/reports/oei-03-15-00220.pdf. 
 
130 OIG, Toolkit: Using Data Analysis To Calculate Opioid Levels and Identify Patients At Risk of Misuse or Overdose, 
OEI-02-17-00560, June 2018. Available at https://oig.hhs.gov/oei/reports/oei-02-17-00560.asp.  
 
131 HHS Secretary Priorities, Value-Based Care.  Available at 
https://www.hhs.gov/about/leadership/secretary/priorities/index.html#value-based-healthcare. 
 
132 ONC, ONC Data Brief: Trends in Individuals Access, Viewing and Use of Online Medical Records and Other 
Technology for Health Needs: 20172018, May 2019.  Available at 
https://www.healthit.gov/sites/default/files/page/2019-05/Trends-in-Individuals-Access-Viewing-and-Use-of-
Online-Medical-Records-and-Other-Technology-for-Health-Needs-2017-2018.pdf. 
 
133 Ibid. 
 
134 84 Fed. Reg. 7610 (March 4, 2019).  
135 CMS Press Release, CMS Advances MyHealthEData with New Pilot to Support Clinicians, July 2019.  Available at 
https://www.cms.gov/newsroom/press-releases/cms-advances-myhealthedata-new-pilot-support-clinicians.  
 
136 ONC, ONC Data Brief: Interoperability among Office-Based Physicians in 2015 and 2017, May 2019.  Available at 
https://www.healthit.gov/sites/default/files/page/2019-05/ONC-Data-Brief-47-Interoperability-among-Office-
Based-Physicians-in-2015-and-2017.pdf 
 
137 OIG, Review of the Department of Health and Human Services Compliance with Federal Information Security 
Modernization Act of 2014 for Fiscal Year 2018, A-18-18-11200, April 2019.  Available at 
https://oig.hhs.gov/oas/reports/region18/181811200.pdf.  
 
138 OIG, Summary Report for Office of Inspector General Penetration Testing of Eight HHS Operating Division 
Networks, A-18-18-08500, March 2019.  Available at https://oig.hhs.gov/oas/reports/region18/181808500.asp. 
 
139 NIH, ACD Working Group for Foreign Influences on Research Integrity, December 2018.  Available at 
https://acd.od.nih.gov/documents/presentations/12132018ForeignInfluences_report.pdf. 
 
140 OIG, Opportunities Exist for the National Institutes of Health to Strengthen Controls in Place to Permit and 
Monitor Access to Its Sensitive Data, A-18-18-09350, February 2019.  Available at 
https://oig.hhs.gov/oas/reports/region18/181809350.pdf.   
 
141 HHS, Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients, Jan. 2019.  Available at 
https://www.phe.gov/Preparedness/planning/405d/Documents/HICP-Main-508.pdf. 
 
 
47 
     
 
                                                                                                                                                                                                               
142 OIG, Summary of Security Vulnerabilities Identified at Two Arizona Managed Care Organizations and 
Inconsistent Treatment of Medicaid Data Security at the State Agency and Managed Care Organizations, A-18-17-
09302, November 2018; OIG, Alabama Did Not Adequately Secure Its Medicaid Data and Information Systems, A-
04-15-05065, September 2017.  For a list of other related OIG cybersecurity reports, see 
https://oig.hhs.gov/reports-and-publications/featured-topics/cybersecurity/.  
 
143 OIG, The Food and Drug Administration's Policies and Procedures Should Better Address Postmarket 
Cybersecurity Risk to Medical Devices, A-18-16-30530, October 2018.  Available at 
https://oig.hhs.gov/oas/reports/region18/181630530.pdf. 
 
144 HHS Press Release, HHS Announces the Official Opening of the Health Sector Cybersecurity Coordination Center, 
October 2018.  Available at https://www.hhs.gov/about/news/2018/10/30/hhs-announces-official-opening-
health-sector-cybersecurity-coordination-center.html.  
 
145 HHS, Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients, January 2019.  
Available at https://www.phe.gov/Preparedness/planning/405d/Documents/HICP-Main-508.pdf. 
 
146 Security Risk Assessment Tool.  Available at https://www.healthit.gov/topic/privacy-security-and-
hipaa/security-risk-assessment-tool. 
 
147 MOU 225-19-002, Memorandum of Agreement between the Department of Homeland Security, National 
Protection and Programs Directorate and the Department of Health and Human Services, Food and Drug 
Administration, Relating to Medical Device Cybersecurity Collaboration, October 2018.  Available at 
https://www.fda.gov/about-fda/domestic-mous/mou-225-19-002. 
 
148 U.S. General Services Administration and Office of Management and Budget, Cross-Agency Performance, 
Shared Services Priority Goal Overview, June 2019.  Available at https://www.performance.gov/CAP/sharing-
quality-services/ and https://www.performance.gov/CAP/action_plans/june_2019_Sharing_Quality_Services.pdf. 
149 OMB Memorandum 17-22 (April 12, 2017). 
 
150 For example, Bring Common Sense to Food Regulation, Reinvent Grants Management, Buy Smarter, Optimize 
Coordination Across HHS, and Leveraging the Power of Data.  ReImagine HHS Publication #1 (February 2019); 
https://intranet.hhs.gov/about-hhs/initiatives-and-programs/reimagine.  
 
151 CMS, Research Statistics Data and Systems, National Health Expenditure Projections: Forecast Summary, March 
11, 2019.  Available at https://www.cms.gov/Research-Statistics-Data-and-Systems/Statistics-Trends-and-
Reports/NationalHealthExpendData/Downloads/ForecastSummary.pdf. 
 
152 CDC, National Center for Health Statistics, Provisional Drug Overdose Death Counts, July 17, 2019.  Available at 
https://www.cdc.gov/nchs/nvss/vsrr/drug-overdose-data.htm. 
 
153 OIG, Opioid Use Decreased in Medicare part D, While Medication-Assisted Treatment Increased, OEI-02-19-
00390, July 2019.  Available at https://oig.hhs.gov/oei/reports/OEI-02-19-00390.pdf.   
 
154 Ibid. 
 
155 OIG, Concerns About Opioid Use in Medicare Part D in the Appalachian Region, OEI-02-18-00224, April 2019.  
Available at https://www.oig.hhs.gov/oei/reports/oei-02-18-00224.asp.  
156 The mission of the ARPO Strike Force is to identify and investigate health care fraud schemes in the Appalachian 
region and surrounding areas and to effectively and efficiently prosecute medical professionals and others 
involved in the illegal prescription and distribution of opioids. 
 
 
48 
     
 
                                                                                                                                                                                                               
157 DOJ, Press Release, Appalachian Regional Prescription Opioid (ARPO) Strike Force Takedown Results in Charges 
Against 60 Individuals, Including 53 Medical Professionals, April 27, 2019.  Available at 
https://www.justice.gov/opa/pr/appalachian-regional-prescription-opioid-arpo-strike-force-takedown-results-
charges-against.  
 
158 2019 Appalachian Regions Opioid Takedown.  Available at https://oig.hhs.gov/newsroom/media-
materials/2019/arpo/index.asp. 
 
159 OIG, Separated Children Placed in Office of Refugee Resettlement Care, OEI-BL-18-00511, January 2019.  
Available at https://oig.hhs.gov/oei/reports/oei-BL-18-00511.pdf.  
 
160 Federal Emergency Management Agency, Emergency Support Function #8Public Health and Medical Services 
Annex, January 2008.  Available at http://www.fema.gov/media-library-data/20130726-1825-25045-
8027/emergency_support_function_8_public_health___medical_services_annex_2008.pdf. 
161 Ibid. 
162 ASPR, 20172022 Health Care Preparedness and Response Capabilities.  Available at 
https://www.phe.gov/Preparedness/planning/hpp/reports/Documents/2017-2022-healthcare-pr-capablities.pdf.  
 
163 CDC, CDC: Mission, Role and Pledge, April 14, 2014.  Available at 
https://www.cdc.gov/about/organization/mission.htm. 
164 Social Security Act,  1861(e); 42 U.S.C.  1395x(e); 42 CFR  488.3(a). 
165 81 Fed. Reg. 63859 (Sept. 16, 2016).  
 
166 OIG, HHS Did Not Always Efficiently Plan and Coordinate Its International Ebola Response Efforts, A-04-16-
03567, August 2019.  Available at https://oig.hhs.gov/oas/reports/region4/41603567.pdf. 
167 OIG, Hospitals Reported Improved Preparedness for Emerging Infectious Disease After the Ebola Outbreak, OEI-
06-15-00230, October 2018.  Available at https://www.oig.hhs.gov/oei/reports/oei-06-15-00230.pdf.  
 
168 OIG, Adverse Events in Hospitals: National Incidence Among Medicare Beneficiaries, OEI-06-09-00090, 
November 2010.  Available at https://oig.hhs.gov/oei/reports/oei-06-09-00090.pdf.  
 
See also: OIG, Adverse Events in Skilled Nursing Facilities: National Incidence Among Medicare Beneficiaries, OEI-
06-11-00370, February 2014.  Available at https://oig.hhs.gov/oei/reports/oei-06-11-00370.pdf.  
See also: OIG, Hospital Incident Reporting Systems Do Not Capture Most Patient Harm, OEI-06-09-00091, January 
2012.  Available at https://oig.hhs.gov/oei/reports/oei-06-09-00091.pdf. 
 
169 P.L. No. 111-148 (Mar. 23, 2010), as amended by the Health Care and Education Reconciliation Act of 2010, P.L. 
No. 111-152 (Mar. 30, 2010), collectively referred to as the Affordable Care Act (ACA). 
 
170 OIG, Healthcare.gov: Case Study of CMS Management of the Federal Marketplace, OEI-06-14-00350, February 
2016.  Available at https://oig.hhs.gov/oei/reports/oei-06-14-00350.pdf. 
 
171 OIG, Rosebud Hospital, Indian Health Service Management of Emergency Department Closure and Reopening, A 
Case Study, OEI-06-17-00270, July 2019.  Available at https://oig.hhs.gov/oei/reports/oei-06-17-00270.pdf. 
 
172 CIGIE, Vulnerabilities and Resulting Breakdowns: A Review of Audits, Evaluations, and Investigations Focused on 
Services and Funding for American Indians and Alaska Natives, December 2017.  Available at 
https://www.ignet.gov/sites/default/files/files/ CIGIE_AIAN_Vulnerabilities_Report.pdf. 
49