1 
  INTRODUCTION 
The  2020  Top  Management  and  Performance  Challenges  Facing  HHS  is  an  annual 
publication of the Department of Health and Human Services (HHS or the Department) Office of 
Inspector General (OIG).  In this edition, OIG has identified six top management and performance 
challenges (TMCs) the Department faces as it strives to fulfill its mission to enhance the health and well-
being of all Americans, by providing for effective health and human services and by fostering sound, sustained 
advances in the sciences underlying medicine, public health, and social services.  These top six challenges reflect 
overarching issues that affect multiple HHS programs and responsibilities.  These are not the only challenges that 
confront HHS, and OIG reports are a key resource that highlight specific opportunities to improve HHS programs and 
operations.  
HHS is responsible for a $2.4 trillion portfolio, and its programs impact the lives of virtually all Americans.  To identify 
the six TMCs, we integrated OIGs oversight, enforcement, data analytics, and risk analysis work.  For each TMC, we 
describe the dimensions of the challenge, highlight the progress the Department has made in addressing the 
challenge, and identify what remains to be done.  
Throughout this document, we highlight the unprecedented challenges the Department faces because of the 
emergence of novel coronavirus disease 2019 (COVID-19).  As the lead Federal agency for medical support and 
coordination during public health emergencies, HHS has numerous significant responsibilities to assist communities 
throughout the United States (U.S.) to prepare for, respond to, and recover from the fast-moving COVID-19 
pandemic.    HHSs  responsibilities  include work ing with  Federal,  State,  T ribal, and  local  and  international 
governments to effectively respond; supporting the development of vaccines, treatments, and other research on 
COVID-19; assisting the health care system by providing flexibility, resources, and funding; ensuring the safety of the 
health  care  workforce  and  protecting the  health  and  well-being of the  public.  Challenges  related  to  the 
Departments COVID-19 response are primarily addressed in TMC 1 for public health.  However, the COVID-19 
response affects nearly every aspect of Department operations, and challenges related to it are also addressed in 
other TMCs.  
COVID-19 Challenges 
Throughout the TMCs, we highlight the unprecedented challenges the Department faces in its response to 
the COVID-19 pandemic. 
 TMC 1:  Mitigating the loss of life and negative health consequences associated with
COVID-19, while promoting the operation of essential programs and services.
 TMC 2:  Ensuring responsible stewardship, transparency, and accountability of COVID-19
funds.
 TMC 3:  Ensuring telehealth and other flexibilities implemented during the public health
emergency work as intended.
 TMC 4: Protecting the health and safety of people especially vulnerable to COVID-19 and
ensuring access to, safety, and efficacy of COVID-19 immunizations and treatments.
 TMC 5:  Ensuring that public and private stakeholders have access to timely, accurate, and
secure data related to the COVID-19 response and recovery.
 TMC 6:  Fostering effective coordination among Federal, State, Tribal, and private sector
stakeholders to combat COVID-19.
1   
Management and performance challenges are inherently cross-cutting.  The TMCs reflect how multiple HHS Staff 
Divisions (StaffDivs) and Operating Divisions (OpDivs) are addressing these pressing issues.  For example, the 
challenge of financial integrity highlighted in TMC 2 has natural intersections with the challenge of delivering value, 
quality, and improved outcomes in Medicare and Medicaid, the subject of TMC 3.  Given that challenges cross both 
internal HHS boundaries and externally with Federal and State agencies, coordination among HHS agencies and 
across government is integral to addressing these challenges.     
In addition to this annual publication, OIG maintains a list of significant unimplemented OIG recommendations, 
including legislative recommendations, to address vulnerabilities.  These recommendations are drawn from OIGs 
audits and evaluations.  OIG identifies the top unimplemented recommendations that if implemented would, in 
OIGs view, most positively affect HHS programs in terms of cost savings, program effectiveness and efficiency, and 
public health and safety.   
More information on OIGs work, including the reports mentioned in this publication, is on our website at 
https://oig.hhs.gov.  
   
2 
   
 
 
 
 
 
1  4 
Protecting the Health and 
Safeguarding Public Health 
Safety of HHS Beneficiaries 
2  5
Harnessing Data To Improve 
Ensuring the Financial 
Health and Well-Being of 
Integrity of HHS Programs   
Individuals 
3  6
Delivering Value, Quality, 
Improving Collaboration To 
and Improved Outcomes in 
  Better Serve Our Nation 
Medicare and Medicaid 
 
3 
   
Table of Contents 
INTRODUCTION ............................................................................................................................................................. 1 
Table of Contents .......................................................................................................................................................... 4 
TMC 1: Safeguarding Public Health ............................................................................................................................... 6 
TMC 2: Ensuring the Financial Integrity of HHS Programs ........................................................................................... 12 
TMC 3: Delivering Value, Quality, and Improved Outcomes in Medicare and Medicaid ............................................ 20 
TMC 4: Protecting the Health and Safety of HHS Beneficiaries ................................................................................... 25 
TMC 5: Harnessing Data To Improve Health and Well-Being of Individuals ................................................................ 30 
TMC 6: Improving Collaboration To Better Serve Our Nation ..................................................................................... 57 
Endnotes ...................................................................................................................................................................... 41 
 
 
 
4 
  Acronyms 
ACF  Administration for Children and Families  HRSA  Health Resources 
and Services 
ACO  Accountable Care Organization 
Administration 
ADHD  Attention Deficit Hyperactivity Disorder 
HHS  U.S. Department of Health and 
AHRQ  Agency for Healthcare Research and Quality  Human Services 
AI  Artificial Intelligence  IHS  Indian Health Service 
AI/AN  American Indian/Alaska Native  IT  Information Technology 
API  Application Programming Interface  MA  Medicare Advantage 
ASPR  Office of the Assistant Secretary for  MAO  Medicare Advantage Organization 
Preparedness and Response 
MAT  Medication Assisted Treatment 
CCDF  Child Care and Development Fund 
MCO  Medicaid Managed Care Organization 
CDC  Centers for Disease Control and Prevention 
NIH  National Institutes of Health 
CHIP  Childrens Health Insurance Program 
OCR  Office for Civil Rights 
CMS  Centers for Medicare & Medicaid 
OGA  Office of Global Affairs 
Services 
OIG  Office of Inspector General 
CTO  Office of Chief Technology Officer 
OMB  Office of Management and Budget 
DHS  Department of Homeland Security 
ONC  Office of National Coordinator for Health  
DME  Durable Medical Equipment 
Information Technology 
DOJ  U.S. Department of Justice 
ORR  Office of Refugee Resettlement 
EHR  Electronic Health Record 
OUD  Opioid Use Disorder 
EID  Emerging Infectious Diseases 
PCS  Personal Care Services 
FBI  Federal Bureau of Investigation  
PERM  Payment Error Rate Measurement 
FDA  Food and Drug Administration 
PPE  Personal Protective Equipment 
FFS  Fee-For-Service 
PSO  Patient Safety Organizations 
FPS  Fraud Prevention System 
SAMHSA  Substance Abuse and Mental Health 
FY  Fiscal Year  Services Administration 
GAO  U.S. Government Accountability Office  SNF  Skilled Nursing Facility 
HC3  Health Sector Cybersecurity Coordination  TANF  Temporary Assistance for Needy Families 
Center 
TEFCA  Trusted Exchange Framework and Common 
HEAL  Helping to End Addiction Long-term  Agreement 
Initiative 
T-MSIS  Transformed Medicaid Statistical 
HIPAA  Health Insurance Portability and  Information System 
Accountability Act of 1996 
UAC  Unaccompanied Alien Children 
 
 
5 
     
 
1: Safeguarding Public 
Health 
HHSs core mission is to enhance the health and well-being of 
all Americans.  The emergence and spread of COVID-19 has  KKKKEEEEYYYY    TTTTAAAAKKKKEEEEAAAAWWWWAAAAYYYYSSSS    
greatly exacerbated the Departments challenge to ensure 
public health and safety.  HHS must act vigilantly to mitigate  VVIII. I.I. I . RRRReeeelllleeeevvvvaaaannnntttt    AAAAggggeeeennnncccciiiieeeessss::::    AAAAllllllll    HHHHHHHHSSSS        
the loss of life and negative health consequences associated  VVIIVI.II ..I  I. EEEElllleeeemmmmeeeennnnttttssss    ooooffff    tttthhhheeee    CCCChhhhaaaalllllllleeeennnnggggeeee::::        
with  COVID-19,  while  continuing  to  operate  a  range  of       SSSSttttrrrreeeennnnggggtttthhhheeeennnniiiinnnngggg    eeeemmmmeeeerrrrggggeeeennnnccccyyyy    
programs  and  services  that  are  essential  to  protecting  pppprrrreeeeppppaaaarrrreeeeddddnnnneeeessssssss    aaaannnndddd    rrrreeeessssppppoooonnnnsssseeee    
individuals and communities.  This includes facilitating the safe  ccccaaaappppaaaabbbbiiiilllliiiittttiiiieeeessss    
delivery of necessary medical care unrelated to COVID-19 (e.g.,       PPPPrrrroooovvvviiiiddddiiiinnnngggg    aaaaddddeeeeqqqquuuuaaaatttteeee    oooovvvveeeerrrrssssiiiigggghhhhtttt    
routine  screenings,  vaccinations,  and  mental  health  and  ooooffff    FFFFDDDDAAAA----rrrreeeegggguuuullllaaaatttteeeedddd    pppprrrroooodddduuuuccccttttssss    
substance  use  disorder  services),  ensuring  that  medical       TTTTaaaacccckkkklllliiiinnnngggg    tttthhhheeee    ooooppppiiiiooooiiiidddd    eeeeppppiiiiddddeeeemmmmiiiicccc    
products regulated by the Food and Drug Administration (FDA)  wwwanhhhdiiilll eeee   neeesnnnusssruuuinrrriiignnn ggga   caaaccccecccseeessss tssso   ttt ooo   
are safe and effective, and working to identify and combat  ttttrrrreeeeaaaattttmmmmeeeennnntttt    
health  disparities.    To  operate  effective  public  health 
programs, the Department must ensure that its agencies coordinate with each other, as well as with partners at all 
levels of government.  (See TMC 6 for more information on the Departments challenge of coordinating with internal 
and external partners.)   
Strengthening emergency preparedness and response capabilities 
Public health emergencies can severely strain public health and medical infrastructure and lead to serious illness and 
loss of life.  HHS has a lead role in preparing for, responding to, and recovering from the adverse health effects of 
public health emergencies, including infectious disease outbreaks, natural disasters, and chemical, biological, and 
radiological nuclear events.  HHS is uniquely positioned to provide guidance, funding, and support to assist 
communities throughout the U.S. so that they can respond to and deliver health services in response to emergencies, 
as well as to support sustained recovery efforts.   
A key challenge is having adequate planning prior to a public health emergency and mechanisms in place to 
efficiently and rapidly deploy assets and provide relief to those in need of HHS resources and assistance during a 
public  health  emergency.    HHS  plays  a  critical  role  in  identifying,  acquiring,  developing,  distributing,  and 
administering medical countermeasures (e.g., vaccines, therapeutics, and diagnostics) to effectively prevent and 
treat infectious diseases.  Among HHSs offices, the Centers for Disease Control and Prevention (CDC) is responsible 
for responding to health threats and providing critical scientific information to protect Americans, the Biomedical 
Advanced  Research  and  Development  Authority  (BARDA)  within  the  Office  of  the  Assistant  Secretary  for 
Preparedness and Response (ASPR) promotes the development and acquisition of medical countermeasures, 
including supporting the transition of medical countermeasures from research through advanced development 
towards consideration for approval by the FDA and inclusion into the Strategic National Stockpile.  The National 
Institutes of Health (NIH) is responsible for research related to the development of medical countermeasures.  FDA 
is responsible for regulating the safety and effectiveness of such medical countermeasures and ensuring the safety 
and availability of the U.S. blood supply and tissue donations.  And, the Office of Global Affairs (OGA) is responsible 
for leading international engagements to support both preparedness and response for public health emergencies.   
6 
     
 
In addition to coordinating emergency planning and response efforts 
effectively with its program offices, HHS works with States and localities to 
facilitate planning and preparedness to address a wide range of health and human 
service needs, including management and distribution of medical supplies, establishment 
of alternative care sites, and distribution of vaccines and antiviral drugs.  (See TMC 6)   HHS 
should support health care coalitions and other entities in their efforts to plan for and coordinate 
emergency response among diverse entities (such as hospitals, public health agencies, emergency medical 
services, and emergency management).1  Community planning is essential to managing and distributing medical 
equipment and supplies.  Past OIG work highlighted the importance of identifying sufficient storage space, 
maintaining and replacing equipment, and determining the logistics of transporting the equipment when needed.2   
OIG is conducting work examining HHSs response to the current COVID-19 pandemic.  Existing OIG work on prior 
outbreaks of communicable diseases illustrates the importance of ongoing HHS readiness to detect, assess, and 
respond to new disease outbreaks and other emergencies.  For instance, a 2019 OIG report about HHSs response 
to the 2014 Ebola outbreak recommended that HHS develop departmentwide objectives and a strategic framework 
for responding to international public health emergencies.3   HHS concurred with the recommendations in the report 
and indicated that it  continues to coordinate on these efforts and will provide additional updates.    
In addition, health care facilities must have emergency plans in place to keep individuals and staff safe from harm.  
Prior OIG work has identified opportunities for health care facilities to improve emergency preparedness and 
response planning during infectious disease outbreaks and disasters.4  For example, during Hurricane Sandy, OIG 
identified gaps in nursing home emergency preparedness and response.5  Similarly, during the Ebola outbreak in 
2014, many hospitals reported that they were unprepared to receive cases and experienced challenges, such as 
difficulty using Federal guidance, to sustain preparedness.6  More recently, OIGs March 2020 survey of hospitals 
caring for patients known or suspected to have COVID-19 identified challenges with testing and caring for patients, 
keeping staff safe, and maintaining or expanding their facilities capacity to treat patients with COVID-19.7  ASPR, 
CDC, and the Centers for Medicare & Medicaid Services (CMS) recently took steps to provide practical advice to 
hospitals and coordinate guidance, and these efforts should continue. 
As  the  COVID-19  emergency  continues  to  evolve and scientific  studies  provide  a deeper  understanding  of 
transmission risk, long-term health effects, and other impacts, HHS faces the challenge of ensuring it is a continuous 
learning organization that uses up-to-date information to sustain and strengthen its emergency response.  This 
includes addressing the availability of timely testing, providing guidance to reduce the risk of transmission, and 
identifying, developing, and deploying medical countermeasures (such as safe and effective therapeutics or 
vaccines).  HHS has the significant challenge of adapting as the pandemic evolves to minimize negative health 
impacts on all Americans.  As part of addressing this challenge, HHS must account for racial, socioeconomic, 
geographic, and other disparities and the effects that such disparities have on public health.  Additionally, HHS must 
continue to plan for other emergencies, such as hurricanes, wildfires, and other natural disasters, which have and 
may continue to occur simultaneously with the COVID-19 pandemic. 
Providing adequate oversight of FDA-regulated products 
FDA is charged with ensuring the safety, effectiveness, and security of human and animal drugs, biological products, 
and medical devices; ensuring the safety of the nations food supply, cosmetics and products that emit radiation; 
and regulating tobacco products.  These functions are critical to ensuring that Americans can trust the expansive 
array of products in FDAs purview.8  FDA has the added challenge of facilitating emergency response efforts related 
to the current COVID-19 emergency.  The American public relies on FDA to expeditiously assess new medical 
7 
     
 
products or new uses of legally marketed medical products (such as 
drugs or vaccines) that treat or offer protection from negative health effects 
associated with COVID-19, without sacrificing assurances of safety and efficacy.  This 
challenge also encompasses approving and facilitating the widespread availability of 
COVID-19 tests. 
Drug, biologic, and medical device safety 
FDAs responsibility to ensure the safety and effectiveness of medical products begins before approval 
and continues after the product is marketed.  This includes overseeing manufacturing facilities; reviewing 
drugs, devices, and biologics for safety and effectiveness; authorizing the use of investigational medical 
products; and conducting postmarket surveillance.  The public relies on FDA to be expeditious in evaluating 
products and thoughtful in its decisions regarding approval for marketing in the U.S.   
FDAs task of assessing products becomes more difficult as manufacturing processes and products become 
more intricate.  The drug, biologic, and medical device supply chain is becoming increasingly complex, and 
many drugs used in the U.S. are manufactured overseas.  In 2019, FDA reported that approximately 53 
percent of the finished dosage from manufacturing facilities and 72 percent of active pharmaceutical 
ingredient manufacturing facilities of human drugs for the U.S. market were located outside of the U.S.9  
OIG has identified vulnerabilities with FDAs oversight of manufacturing and distributing drugs, including  
high-risk drugs such as compounded drugs.10  This presents FDA with many challenges as medical products 
move through the supply chain and are at risk of diversion, theft, counterfeiting, and adulteration.  When 
problematic products are identified, it is imperative for FDA to be able to trace the path drugs follow from 
manufacturer to patient. 
The rapid speed at which science and technology are evolving presents new concerns for FDA to address 
via its oversight role.  Further, managing the cybersecurity risks associated with networked devices is 
increasingly difficult as more medical devices use internet connectivity.  Networked medical devices 
approved by FDA can be susceptible to cybersecurity threats, such as ransomware and unauthorized remote 
access, if the devices lack adequate security controls.11  These networked devices include hospital-room 
infusion pumps, diagnostic imaging, and pacemakers.   
In 2018, OIG released two reports assessing FDAs oversight of premarket and postmarket cybersecurity 
risks to medical devices.12  An underlying issue identified in both reports was the opportunity for FDA to 
take further action in addressing cybersecurity threats to reduce risk to patients and the health care 
industry.  FDA has made administrative changes to improve its premarket and postmarket processes, but 
FDA should continue to take steps to enhance its ability to receive relevant information as well as securely 
share it with key stakeholders.  (See TMC 5 on data for additional actions FDA has taken related to 
cybersecurity.) 
Food safety 
FDA has the complex responsibility of keeping the foods that it regulates safe.  An estimated 1 in 6 
Americans get sick from contaminated foods each year, and 3,000 die.13  Foodborne illnesses are largely 
preventable, and the American public relies on FDA, working with partners including CDC, to ensure the 
safety of both human and animal food.14  The Department must ensure that FDA continues to modernize 
the food safety system and responds effectively when issues are identified.  FDA should conduct risk-based 
inspections of domestic and foreign food facilities within the timeframes required by the Food Safety 
8 
     
 
Modernization Act, identify instances of failure to comply with 
good  manufacturing  practices,  and  take  necessary  steps  when 
health  risks  are  identified,  including  administrative  and  enforcement 
actions when warranted.15  FDA has made organizational changes with the goal 
of improving incident response through, for example, instituting its Coordinated 
Outbreak Response and Evaluation Network, and should continue to improve the timeliness 
and effectiveness of its processes, such as food recalls, to optimize its ability to protect the public 
from outbreaks of foodborne illnesses. 
Tobacco 
FDA is also in charge of regulating tobacco products and has made a commitment to reduce harm from 
tobacco products, particularly among youth.  FDA must undertake this effort amid increasing concerns 
surrounding the growing use and detrimental health effects of electronic nicotine delivery systems, such as 
vape pens and e-cigarettes.  Working with CDC, FDA faces the challenge of better understanding the science 
of tobacco products and the most effective use of its authorities to regulate their manufacturing, marketing, 
and sale.    It remains a priority for FDA to address the public health crisis of youth e-cigarette use by, among 
other things, focusing product review and enforcement on youth-appealing products and investing in 
campaigns to educate youth about the dangers of e-cigarette use.    
Tackling the opioid epidemic and ensuring access to treatment 
In 2017, the President declared the opioid crisis a public health emergency.  While the Nation has made progress 
with addressing the opioid crisis, significant challenges remain.  In 2018, approximately 2 million people had an 
opioid use disorder (OUD),16 and an estimated 69.5 percent of all drug overdose deaths involved an opioid.17  
Although the overall rate of drug overdose deaths involving opioids decreased from 2017 to 2018, it increased in 
five states.  Additionally, in 2018 the overall rate of overdose deaths from synthetic opioids increased by 10 percent 
and two-thirds of opioid overdose deaths involved synthetic opioids (excluding methadone).18  There are also new 
and highly dangerous patterns of use, including polysubstance use of both methamphetamines and illicit fentanyl or 
fentanyl analogs.19   
HHS developed a five-point strategy in 2017 to combat the opioid crisis and must continue working toward 
addressing the problem and adjusting its approach as appropriate.  HHSs OpDivs have an essential role to play in 
preventing substance use disorders and facilitating the delivery of safe and effective treatment, including continuity 
of care during the coronavirus outbreak.  The Department should continue to use the tools available across its 
programs to address the opioid epidemic while being mindful of patients needs to access appropriate pain 
management, which may include the use of opioid analgesics.  
Moreover, the impacts of COVID-19 on peoples daily lives present new, complicating obstacles to effectively 
providing care related to mental health and substance use disorders.  The pandemic and related stressors are 
thought to put people at risk for developing substance use disorders or relapsing, and those with OUD may 
experience negative respiratory and pulmonary health effects that make them particularly vulnerable to COVID-19.20  
Of additional concern, chronic respiratory disease is known to increase the risk of fatal overdose among people 
taking opioids, and COVID-19 could similarly increase the risk of overdose for people who have OUD.21  Ensuring 
access to effective treatment remains crucial to combating the opioid epidemic, and the COVID-19 pandemic may 
create additional obstacles to effectively running opioid treatment programs and providing care. 
9 
     
 
The opioid crisis is partially fueled by opioids prescribed by licensed 
medical professionals, dispensed by licensed pharmacies, and paid for by 
Federal funds.  OIG identified 71,260 Medicare Part D beneficiaries who, in 2017, 
were prescribed opioids in quantities, or from sources, suggesting that they were at 
serious risk of misuse or overdose.  In 2018, most of this same beneficiary population received 
high quantities of opioids, 11 percent had an overdose or adverse effect, and only a small subset 
received naloxone or medication-assisted treatment (MAT) through Medicare.22  Ensuring access to 
appropriate pain management therapies and combating opioid abuse remains a high priority, and CMS should 
continue to expand its role in ensuring that beneficiaries receive treatment for opioid use disorder.  In particular, 
CMS should educate beneficiaries and providers about access to MAT drugs and naloxone. 
The Indian Health Service (IHS) also has an important role in preventing and detecting opioid misuse or abuse.  A 
2019 OIG report found that IHS hospitals did not fully use the States prescription drug monitoring programs when 
prescribing or dispensing opioids at certain IHS hospitals.23  In addition, the hospitals did not use available data to 
identify risks in their prescribing and dispensing practices, such as giving patients opioid doses as high as 500 daily 
morphine milligram equivalents; and giving opioids and benzodiazepines at the same time, which puts patients at 
greater risk of a potentially fatal overdose.  IHS could improve the quality of care for prescribing and dispensing 
opioids to the American Indian/Alaska Native (AI/AN) population by fully utilizing States prescription drug 
monitoring programs.   
Additionally, FDA has an important role to ensure the safe use of opioids.  FDA approves new drugs before they are 
marketed in the U.S., assessing the benefits and risks that a drug can be taken safely and effectively.24  FDA also 
monitors the safety of marketed drugs as new information becomes available.  Through this framework, FDA has a 
range tools and authorities:  encourage the development of abuse-deterrent formulations of opioids to reduce the 
risk that such products may be  abused; employ tools to mitigate risks associated with approved drugs, including the 
Risk Evaluation and Mitigation Strategy program; pursue measures that include withdrawing drugs from the market 
when  there  are  serious  safety  concerns;  and  support  the  treatment  of  OUDs  with  FDA-approved  drugs
buprenorphine, methadone, or naltrexoneas well as the development of additional therapies to treat OUD.25  
Ensuring access to treatment 
HHS must work diligently across all of its programs to ensure access to effective, specialized OUD treatment.  
HHS continues to manage and oversee investments to address OUDs.  From 2016 to 2019, HHS awarded 
more than $9 billion in grant funding to States, Tribes, and local communities to increase access to 
prevention, treatment, and recovery services.  For example, in FY 2019, NIH awarded $945 million for 
grants, contracts, and cooperative agreements across 41 States through the Helping to End Addiction Long-
term Initiative (NIH HEAL Initiative), which aims to improve treatments for chronic pain, curb the rates of 
OUD and overdose, and achieve long-term recovery from opioid addiction.26  To address OUD and mortality, 
it is vital for the public to be able to access specialized and effective, quality substance use disorder 
treatments, including MAT.  People suffering from an OUD are at risk for withdrawal and relapse and 
without effective treatment, may seek out illicit opioids, such as heroin.  However, only a fraction of the 2.1 
million people with OUDs received treatment in 2018 (19.7 percent).27  MAT combines the use of 
medications with counseling and behavioral therapies, which can be an effective treatment for OUDs.  A 
2020 OIG review found access to buprenorphine services remains challenging in many localities and 
recommended Substance Abuse and Mental Health Services Administration (SAMHSA) geographically 
target its efforts to increase providers who can treat patients in need of buprenorphine services in high-
need counties.28   
10 
     
 
There  is  a  great  need  for  treatment,  especially  in  areas 
disproportionately affected by the opioid epidemic, including the 
AI/AN population and rural communities.  HHS must ensure that money to 
address the opioid epidemic is efficiently and effectively spent for its intended 
purpose.  OIG found that States have been slow to spend their awards under the State 
Targeted Response to the Opioid Crisis; of the total $1 billion in the grant program, $304 
million remains unspent after 2 years.29  Additionally, OIGs audit of the Health Resources and 
Services Administrations (HRSA) Access Increases in Mental Health and Substance Abuse Services 
(AIMS) grant found that HRSA followed its policies and procedures for awarding AIMS grants but did not 
always follow its policies and procedures when monitoring health centers compliance with supplemental 
funding requirements.30  It is paramount that HHSs OpDivs, including SAMHSA and HRSA, work with 
grantees and subgrantees to ensure grant dollars are used effectively for their intended purposes.  
Additionally, HHS must continue to implement the Substance Use-Disorder Prevention that Promotes Opioid 
Recovery and Treatment for Patients and Communities Act, which, among other things, requires Medicare 
to cover certain treatment services provided by opioid treatment programs, including methadone. 
 
 
 
11 
  2: Ensuring the Financial 
Integrity of HHS Programs 
HHS is the largest civilian agency in the Federal government, with 
KEY TAKEAWAYS 
a $2.4 trillion budget, representing one-third of the total Federal 
budget.31  HHSs Medicare program is the Nations largest health 
I. Relevant Agency: All HHS
insurer by expenditures, handling more than 1 billion claims per 
II.  Elements of the Challenge:
year.  Medicaid is the largest health insurer in terms of lives   Controlling costs by ensuring
covered, with 76.5 million beneficiaries in Medicaid and the  prudent pricing for goods and 
Childrens  Health  Insurance  Program  (CHIP) enrolled  services 
individuals.32  Medicare and Medicaid are the Departments   Reducing improper payments
largest programs; funding for these programs (including State   Combating fraud, waste, and
funding) represents 37 cents of every dollar spent  on health 
abuse 
care.33  Almost 140 million beneficiaries, or more than 40 percent   Monitoring and reporting on
of Americans, rely on these programs for their health insurance, 
the integrity of HHS programs 
including senior citizens, individuals with disabilities, low-income 
families  and  individuals,  and  patients  with  end-stage  renal 
disease.34  CMS bears the responsibility at HHS for administering these programs.  Medicare expenditures totaled 
$796 billion in 2019.35  The Federal Medicaid budget totaled $411.3 billion in FY 2019 (with an additional $17.5 billion 
for CHIP).36  As many providers faced fiscal uncertainty due to COVID-19, CMS took steps to provide increased 
flexibility and advance payments to mitigate the financial effects of the pandemic.  
HHS is also the largest grant-making and second-largest contracting agency in the Federal government.  In FY 2020, 
HHS awarded $244.7 billion in grants (excluding CMS)37 and $160.7 billion in contracts.38  Responsible stewardship 
that ensures the transparency and accountability of HHS funds is paramount to making sure that HHS beneficiaries 
and the American public get the true benefit of this substantial financial investment.   
The Department must protect the fiscal integrity of HHS funds and ensure that beneficiaries have access to the 
services they need, especially in light of looming financial shortfalls in the Medicare program,39, 40 the expansion of 
Medicaid services to a larger population, and the increased dollar amounts that HHS is responsible for distributing 
and overseeing via grants and other mechanisms.  HHS must not only manage the efficient and effective use of funds 
internally, but also oversee the thousands of external funding recipients use of Federal funds  to fulfill the 
Departments mission.  Further, responsible stewardship, transparency, and accountability of the significant amount 
of funds provided to HHS for the COVID-19 response are needed to ensure that HHS beneficiaries and the American 
taxpayers receive the biggest return on their financial investment. 
Controlling costs by ensuring prudent payment for goods and services 
Whether HHS is paying for medical services, prescription drugs, or human service programs, managing what the 
Department pays and recognizing and remedying payment policies that inadvertently incentivize improper billing or 
inflate prices are critical to controlling costs.  
Medicare 
Medicare should act as a prudent payer on behalf of taxpayers and beneficiaries, including instituting 
12     
 
payment policies delivering greater value.  (See TMC 3 for more 
information on value-based payment models.)  In certain contexts, 
Medicare payment policies, which are generally set by statute by Congress, 
may result in Medicare and beneficiaries paying more for care provided in certain 
settings than for the same care provided in other settings.  For example, Medicare 
could have potentially saved $4.1 billion over a 6-year period if swing-bed services at critical 
access hospitals had been paid for at the same rates as at skilled nursing facilities (SNFs).41  
Likewise, Medicare pays hospitals different amounts for the same care depending on whether the 
hospital admits beneficiaries as inpatients or treats them as outpatients.   
Prescription drug programs  
Vulnerabilities exist in HHSs payment strategies for prescription drugs and biologicals.  HHS programs 
accounted for 43 percent ($143 billion) of the total U.S. prescription drug expenditures in 2018.42  Increased 
costs may limit patients ability to afford needed prescription drugs, in some cases causing patients to skip 
or split doses of medication or forgo purchasing medications altogether.  The way that Medicare and 
Medicaid pay for drugs can result in additional costs for programs and their beneficiaries.  In the Part D 
program, for example, OIG found that although there was a 17-percent decrease in Medicare Part D 
prescriptions  for  brand-name  drugs  from  2011  to  2015,  there  was  a  77-percent  increase  in  total 
reimbursement for these drugs, leading to greater overall Part D spending and higher beneficiary out-of-
pocket costs.43  In the Part B program, OIG found that Medicare would have saved millions of dollars if 
dispensing fees for several drugs had been aligned with the rates that Part D and State Medicaid programs 
paid.44  In addition, CMS includes prices for higher-cost versions of drugs that are not covered under 
Medicare Part B when setting Part B payment amounts.  OIG found that, because CMS included non-
covered versions when setting payment for two Part B drugs, Medicare and beneficiaries paid an extra $366 
million from 2014 through 2016.45  HHS must endeavor to limit the impact of high prices on programs and 
beneficiaries while protecting access to medically necessary drugs.  Additionally, the Department should be 
prepared to address coverage and reimbursement challenges of emerging technologies.  
Preventing and reducing improper payments  
An improper payment is any payment that should not have been made or that was made in an incorrect amount 
(including  overpayments  and  underpayments)  under  statutory,  contractual,  administrative,  or  other  legally 
applicable requirements.46  Reducing improper paymentssuch as payments to ineligible recipients or duplicate 
paymentsis critical to safeguarding Federal funds.  Due to their size, HHS programs account for some of the largest 
estimated improper payments in the Federal government.  Medicare and Medicaid accounted for 59 percent, or 
$103.6 billion, of all governmentwide estimated improper payments reported in FY 2019.47  Furthermore, insufficient 
HHS oversight of grant programs and contracts poses risks of significant improper payments.     
Medicare 
Original Medicare fee-for-service (FFS), Medicare Part C (also known as Medicare Advantage (MA)), and 
Medicare Part D accounted for $46.2 billion, or 43 percent, of the estimated improper payments that HHS 
reported in FY 2019.48  Notably, the Medicare FFS improper payment rate estimate decreased from 8.1 
percent ($31.6 billion) in FY 2018 to 7.3 percent ($28.9 billion) in FY 2019.49  This represents positive 
momentum upon which the Department and CMS can build.  However, some types of providers and 
suppliers pose heightened risk to the financial security of Medicare.  For instance, OIG and CMS have 
identified especially high rates of improper payments for home health, hospice, and SNF care; durable 
13 
     
 
medical equipment (DME); chiropractic services; and certain 
hospital services.50  HHS and CMS have taken corrective actions for 
the Medicare FFS program focusing on specific service areas with high 
improper payment rates.  This years reduction in the improper payment rate 
was driven by a reduction in improper payments for home health, Part B, and DME 
claims.  However, CMS should take further action to reduce improper payments among 
certain provider and supplier types and in geographic locations that present a high risk to the 
financial security of Medicare.  Further, CMS should ensure that it is prepared to detect and prevent 
improper payments in burgeoning areas, such as telemedicine and genetic testing. 
Moreover, improper payments to MA plans pose a significant vulnerability for CMS and cost taxpayers 
billions of dollars.  In FY 2019, the improper payment rate for MA was 7.9 percent, for a total of $16.7 billion 
in improper payments.  Unlike in FFS, where CMS pays providers directly for each covered service received 
by a beneficiary, under managed care, CMS makes a capitated payment to a managed care plan for each 
person enrolled in the plan.  In turn, the plan pays providers for services a beneficiary may require that are 
included in the plans contract with CMS.  CMS risk-adjusts payments to pay MA Organizations (MAOs) 
different amounts for beneficiaries with different expected health care costs.  This helps to ensure that 
beneficiaries with greater health care needs have continued access to MA plans.  However, OIG has found 
that improper payments in MA are largely driven by improper risk adjustment payments (See below for 
more information about risk adjustment vulnerabilities.)51, 52 
Medicaid 
Medicaid is a Federal-State financing partnership with the 50 States, 5 territories, and the District of 
Columbia, each offering its own program variations reflecting State and local needs and preferences.  CMSs 
Payment Error Rate Measurement (PERM) program measures improper payments in Medicaid and CHIP in 
all 50 States and the District of Columbia and produces a national improper payment rate for each program.  
The estimated improper payment rate increased significantly, from 9.8 percent in FY 2018 to 14.9 percent 
in FY 2019 (CHIP increased from 8.6 percent to 15.8 percent), largely due to changes in how CMS measured 
and reported beneficiary eligibility errors.53  Medicaid accounted for approximately $57.4 billion in 
estimated improper payments in FY 2019.  CMS attributes these increases to high levels of observed 
eligibility errors, including States maintaining insufficient documentation to substantiate that income and 
other  information  was  appropriately  verified,  failures  to  conduct  timely  and  appropriate  annual 
redeterminations, and claiming beneficiaries under incorrect eligibility categories that provide a higher 
Federal matching rate than was appropriate.54   
OIG work has found that States are not always correctly determining eligibility of individuals to receive 
Medicaid benefits, resulting in potential improper payments.  OIG audits have also identified substantial 
improper payments to providers across a variety of Medicaid services, including school-based, non-
emergency medical transportation, targeted case management, and personal care services (PCS).55  CMS 
has engaged with State Medicaid and CHIP agencies to develop corrective action plans that address State-
specific reasons for improper payments identified through the PERM program and as part of other Medicaid 
fiscal oversight efforts.  Given that CMS continues to use the updated Medicaid eligibility measurements 
for additional states in FY 2020, the improper payment rate is likely to see similar, significant increases for 
this fiscal year and in the near future.  As such, it will be imperative that CMS focus its efforts to examine 
and reduce the Medicaid and CHIP improper payment rates. 
 
14 
     
 
Grants and contracts 
Administering  grant  programs  and  contracts  requires  HHS  to 
implement internal controls to ensure program goals are met and funds are 
used appropriately.  For grant programs, this includes oversight and guidance to 
award recipients.  HHS is responsible for providing up-to-date policies to grant recipients 
and helping States and other grantees address their own financial management and internal 
control issues.  Without proper internal controls, funds may be misspent, duplication of services may 
occur, and sub-recipients may not be adequately monitored.  OIG has identified grantee-level concerns in 
several HHS programs, including some Office of Refugee Resettlement (ORR) Unaccompanied Alien Children 
(UAC) Program grantees reporting unallowable costs and lacking effective systems for administering 
program funds.56  Additionally, OIG found that HHS has taken minimal action to improve policies and 
procedures for ensuring Small Business Innovation Research Program awardee eligibility and has taken no 
action to improve policies and procedures for preventing duplicative funding.57 
As a critical element of ensuring that grant funds are used appropriately, HHS must track and report 
improper payment rates for its risk-susceptible grant programs, in keeping with the Payment Integrity 
Information Act of 2019.58  However, since the inception of these reporting requirements, HHS has not 
reported  an  improper  payment  estimate  for  the  Temporary  Assistance  for  Needy  Families  (TANF) 
program.59  States receive block grants ($16.5 billion annually) to design and operate TANF programs.60  
HHS has stated that it does not believe it has the statutory authority to collect from States the data 
necessary for calculating an improper payment rate for the TANF program.  The Office of Management and 
Budget (OMB) has identified TANF as a risk-susceptible program that must report estimated rates and 
amounts of improper payments.  HHS must continue to pursue legislative remedies to develop an 
appropriate methodology for measuring TANF payment accuracy and report an improper payment estimate 
for TANF. 
In terms of the Departments oversight of contracts, HHS has taken steps to enhance its acquisition systems 
and better monitor contract closeouts and contract payments.  Moreover, CMS has increased its efforts in 
examining workload statistics for benefit integrity contractors and improving performance outcomes.  
Although  CMS  has  taken  steps  to  improve  its  contract  management  and  closeout  processes,  the 
Department needs to take additional actions to ensure that it is meeting other Federal requirements.  For 
example, OIG found that CMS did not identify and report potential Antideficiency Act violations for 12 
contracts used to establish the Federal Marketplace under the Affordable Care Act.61  Additionally, OIG 
found that CMS did not administer and manage strategic communications services contracts in accordance 
with Federal requirements and made recommendations to both HHS and CMS to address the significant 
deficiencies we identified.62   
COVID-19 funding 
As of October 2020, the total HHS COVID-19 appropriation was $251 billion, including $175 billion in 
Provider Relief Funds.  Provider Relief Fund monies are for hospitals and other health care providers on the 
front lines of the coronavirus response.  This funding is intended to support health-care-related expenses 
or lost revenue attributable to COVID-19 and to ensure that uninsured Americans can receive testing and 
treatment for COVID-19.  By October 2020, HHS had allocated approximately $145 billion for Provider Relief 
Fund payments, including $50 billion for Medicare providers; $15 billion for Medicaid, CHIP, and dental 
providers; $59.8 billion in targeted allocations to high impact areas, safety net hospitals, rural providers, 
Tribal facilities, clinics and urban health centers, skilled nursing facilities, and nursing homes; and $20 billion 
15 
     
 
for  general  distribution,  including  providers  previously 
ineligible for payment, such as those who began practicing in 2020.63  
HHS  has  developed  financial  assistance  policy  guidance  and  tracking 
mechanisms to support the COVID-19 supplemental funding appropriations.64  
Efficient and effective management and administration will be essential to ensuring 
that COVID-19 response programs achieve their intended purposes and provide relief to 
intended individuals and entities.   
Combating fraud, waste, and abuse in HHS programs 
Fraud, waste, and abuse divert needed program resources to inappropriate, unauthorized, or illegal purposes.  
Effectively fighting fraud, waste, and abuse requires vigilance and sustained focus on preventing problems from 
occurring in the first place, detecting problems promptly when they occur, and rapidly remediating detected 
problems through investigations, enforcement, and corrective actions.  To accomplish this, HHS must have controls 
to ensure the proper use of resources to detect and prevent fraud.  The Department should also apply a robust 
variety of program integrity strategies to protect HHS programs.  These strategies must include systems and 
processes to detect and prevent fraud, as well as plans for addressing fraud when it occurs. 
Fraud involving COVID-19 funds 
As noted above, HHS has been appropriated $251 billion in COVID-19 funding.  Moreover, as of October 
2020, CMS had made accelerated and advanced payments to Medicare providers totaling $108 billion and 
is paying providers for certain services at enhanced rates applicable during the public health emergency.  
CMS also temporarily suspended or reduced the scope of many program integrity safeguards, such as 
provider enrollment screening.  While these steps may be appropriate to ensure access to care, they also 
raise the risks of fraud by those seeking to exploit the emergency. Regardless of the source of funds, HHS 
must effectively and efficiently manage the use of funds internally, award and manage contracts related to 
COVID-19 funding in accordance with contracting requirements, and appropriately oversee thousands of 
external funding recipients use and accounting of Federal funds.  HHS should ensure that funds are paid 
only to eligible recipients in correct amounts and used in accordance with program requirements.  
Additionally, the Department must identify and fight fraud that would divert funds intended for COVID-19 
response and recovery.  This includes taking action to protect individuals from being defrauded under the 
guise of the public health emergency.  Effective internal controls and the collection, maintenance, and 
analysis of relevant data are key to ensuring that funds are used for their intended purposes.   
Further, as with all HHS grant programs, it will be critical that the Department provide up-to-date policies 
to COVID-19 related grant recipients and help States and other grantees address their own financial 
management and internal control issues.  Without proper internal controls, funds may be misspent, 
duplication of services may occur, and sub-recipients may lack adequate monitoring.   
Medicare and Medicaid 
CMS must be vigilant in identifying and addressing fraud in its programs.  Schemes to steal money from 
Medicare and Medicaid take many forms and vary depending on setting and services provided.  These fraud 
schemes can be as simple as billing for services not provided and identity theft, or as complex as kickbacks, 
improper prescribing, deceptive marketing, and money laundering.  The perpetrators of fraud schemes 
range, from highly respected physicians to organized criminal enterprises with no legitimate role in health 
care.    
16 
     
 
Managed Care   
HHS faces a significant challenge in protecting managed care programs 
and other non-traditional models against fraud, waste, and abuse.  Managed 
care is the primary delivery system for Medicaid, covering at least some services 
for more than 80 percent of all enrollees.65  In Medicare, one-third of beneficiaries are 
currently enrolled in MAOs.  OIG has found weaknesses in MAOs and Medicaid managed care 
organizations (MCOs) efforts to identify and address fraud and abuse by their providers.66  CMS 
requires MAOs and Medicaid MCOs, prepaid inpatient health plans (PIHPs), and prepaid ambulatory health 
plans (PAHPs) (hereinafter referred to as managed care plans) to implement compliance plans that include 
measures to prevent, detect, and correct instances of fraud, waste, and abuse and non-compliance with 
CMSs program requirements.  However, these plans vary widely among the MAOs, as does the detection 
of suspected fraud.  In Medicaid managed care, program integrity responsibilities are even more dispersed, 
as they are shared among CMS, States, and managed care plans.  This makes effective oversight by CMS 
more complex and challenging.   
Further, the MA program is vulnerable to fraud, waste, or abuse perpetrated by MAOs to inappropriately 
inflate the payments that they receive from Medicare or to inappropriately deny care that they are 
obligated to provide.  OIG found that billions of dollars in estimated MA risk-adjusted payments supported 
solely through chart reviews or diagnoses reported only on health risk assessments raise concerns about 
the completeness of payment data submitted to CMS, the validity of diagnoses on chart reviews and health 
risk assessments, and the quality of care provided to beneficiaries.67, 68  OIG has made recommendations 
to CMS to improve its oversight of MA plans so that plans will ensure practices drive better care and not 
just higher profits and enact policies and procedures to improve the integrity and usefulness of payment 
data.   
Additionally, significant concerns have been raised that the capitated payment model used in MA may 
provide a potential incentive for MAOs to inappropriately deny access to services and payment in an 
attempt to increase their profits.  An MAO that inappropriately denies authorization of services for 
beneficiaries or payments to health care providers may contribute to physical or financial harm and also 
misuses Medicare program dollars that CMS paid for beneficiaries health care.  OIG found that high 
numbers of overturned denials upon appeal and persistent performance problems identified by CMS audits 
raise concerns that some beneficiaries and providers may not be getting services and payment that MAOs 
are required to provide.69   
To strengthen CMSs oversight of the MA program, OIG has recommended that CMS make improvements 
to MA encounter data.70  CMS has taken action to address potential errors in the data and ensure that 
billing provider identifiers are active and valid on all records.  However, CMS must also provide targeted 
oversight of MAOs that have submitted a higher percentage of records with potential errors, track how 
MAOs respond to edits that reject data, and establish and monitor performance thresholds related to 
MAOs' submission of records with complete and valid data.71  Additionally, CMS is working to validate the 
completeness and accuracy of Medicare and Medicaid managed care plan encounter data and release best 
practices guidance for MAOs to improve encounter data submission.   
In addition, to improve Medicaid managed care plan identification and referral of cases of suspected fraud 
or abuse, CMS is working with States to provide technical assistance and education on best practices.  CMS 
should take further actions to ensure the completeness, validity, and timeliness of Medicaid encounter 
17 
     
 
data.  Further, the agency should work with its contractors and 
with States to improve efforts to identify and address fraud and 
abuse.    Additionally,  CMS  should  work  to  ensure  that  appropriate 
information and referrals are sent to law enforcement.   
Grants and contracts 
Without adequate oversight and internal controls, HHS grants and contracts are vulnerable to fraud 
schemes, including embezzlement.72  HHS has worked to strengthen some of its program integrity efforts 
focused on grant programs.  For instance, it issued guidance and developed tools to help HHS awarding 
OpDivs examine prospective grantee risk prior to awarding grants.73  This information enhances awarding 
OpDivs assessment of prospective grant recipients integrity and potential performance.  
Fraud involving prescription opioids 
Opioid-related fraud encompasses a broad range of criminal activity, from prescription drug diversion to 
addiction treatment schemes.  OIG investigations show that opioid drug diversion (the redirection of 
legitimate drugs for illegitimate purposes) is on the rise.  Diverted opioid drugs are at high risk to be used 
inappropriately and create significant harm, including increased risk of overdose.  Also at high risk for 
diversion are potentiator drugs (drugs that exaggerate euphoria and escalate the potential for misuse when 
combined with opioids) and drugs indicated to treat OUDs (particularly buprenorphine).  
OpDivs should improve efforts to identify and investigate potential fraud and abuse in prescription drug 
programs.  For instance, CMS should collect comprehensive data from Medicare Part D plan sponsors.  CMS 
should also require pharmacies that bill Medicare Part D to enroll in the Medicare program.  Currently, 
CMSs three key tools for safeguarding against fraudenrollment, revocation, and preclusionapply to 
pharmacies only when they bill Medicare Parts B or C, not when they bill Medicare Part D.74  Further, CMS 
should ensure that national Medicaid data are adequate to detect suspected fraud or abuse.  The lack of 
reliable national Medicaid data hampers enforcement efforts.  (See TMC 5.)  CMS and States should follow 
up on prescribers with questionable prescribing patterns to ensure that Medicare Part D and Medicaid are 
not paying for unnecessary drugs that are being diverted for resale or recreational use.  OIG has also 
recommended that IHS improve its internal controls against opioid-related fraud, including controls at entry 
points to sensitive areas of its hospitals to protect its pharmacy inventory from unauthorized access.75  In 
addition, the Department must guard against fraud in OUD treatment programs, including the submission 
of fraudulent insurance claims for purported OUD treatment and testing services.76   
Systems and processes for detecting and preventing fraud 
With respect to detecting and preventing fraud and improper payments, CMSs Fraud Prevention System 
(FPS) serves as an important tool that should be improved to increase its effectiveness.  Since 2011, the FPS 
has continuously run predictive algorithms and other sophisticated analytics nation-wide against Medicare 
FFS claims prior to payment to identify, prevent, and stop fraudulent claims.  However, OIG found that the 
FPS is not as effective in preventing fraud, waste, and abuse in Medicare as it could be and recommended 
that CMS should make better use of the performance results within its FPS to refine and enhance its 
predictive analytic models.77 
An effective provider enrollment screening process is an important tool for preventing Medicaid and 
Medicare fraud.  It plays a vital role in identifying unscrupulous providers and preventing them from 
enrolling in Medicaid and Medicare.  OIG work has found that Medicaid is vulnerable to being defrauded 
18 
     
 
by  high-risk  providers  that  were  not  properly  screened.  
Specifically, OIG found 13 States had not implemented fingerprint-
based criminal background checks for their high-risk Medicaid providers 
as of January 2019.  We also found that unscrupulous providers could exploit 
loopholes  in  the  provider  enrollment  process  to  enroll  in  Medicaid  without 
undergoing these checks.78  In addition, OIG found 23 States had not enrolled all providers 
serving  Medicaid  beneficiaries  in  their  respective  Medicaid  programs,  exposing  them  to 
potentially harmful providers that had not been screened for fraud, waste, and abuse.79  Furthermore, 
OIG work found that nearly 1,000 terminated providersor 11 percent of all terminated providerswere 
inappropriately enrolled in State Medicaid programs.80  Despite legislative requirements in the 21st Century 
Cures Act designed to strengthen Medicaid program integrity, terminated providers continue to serve 
Medicaid beneficiaries.  CMS should: (1) ensure that all States fully implement fingerprint-based criminal 
background checks for high-risk Medicaid providers, (2) work with States to ensure that they have the 
controls required to prevent unenrolled providers from participating in Medicaid, and (3) follow up with 
States to remove terminated providers that OIG identified as inappropriately enrolled in Medicaid. 
Monitoring and reporting on the integrity of HHS programs 
HHS must ensure the completeness, accuracy, and timeliness of financial and program information provided to other 
entities, both internal and external to the Federal government.  Responsible stewardship of HHS programs is vital to 
operating a financial management and administrative infrastructure that employs appropriate safeguards to 
minimize risk and provide oversight for the protection of resources.  Although HHS continues to maintain a clean 
opinion on their basic financial statements addressing weaknesses in financial management systems and resolving 
issues related to reporting requirements of the Digital Accountability and Transparency Act of 201481 remain 
challenges for HHS.  OIG has recommended that HHS continue to focus its efforts on resolving issues related to its IT 
system controls and completing data cleanup activities.   
In addition, financial management systems help OpDivs ensure operational effectiveness and efficiency, financial 
reporting reliability, and compliance with applicable laws and regulations.  OIG continues to find significant 
deficiencies in internal controls over segregation of duties, configuration management for approved changes to HHS 
financial systems, and access to HHS financial systems.82  HHS must take additional actions to address and resolve 
these issues, including continuing to work to control user access, ensuring proper approval of and documentation 
supporting system changes, and ensuring appropriate segregation of duties so that no one employee can both enter 
and approve information entered into HHS financial management systems.83   
 
 
 
19 
     
 
3: Delivering Value, 
Quality, and Improved 
Outcomes in Medicare and Medicaid 
HHS continues to reform Medicare and Medicaid to promote quality, 
efficiency, and value of care.  Changes affect virtually every type of  KKKKEEEEYYYY    TTTTAAAAKKKKEEEEAAAAWWWWAAAAYYYYSSSS    
health care service and come with an array of operational and 
VVIII. II..I  . RRRReeeelllleeeevvvvaaaannnntttt    AAAAggggeeeennnnccccyyyy::::    CCCCMMMMSSSS    
program integrity challenges.  The changes also offer opportunities 
VVIIVI.II I..I  . EEEElllleeeemmmmeeeennnnttttssss    ooooffff    tttthhhheeee    CCCChhhhaaaalllllllleeeennnnggggeeee::::        
for better health outcomes, better quality of care, lower costs, 
     AAAAlllliiiiggggnnnniiiinnnngggg    pppprrrrooooggggrrrraaaammmm    iiiinnnncccceeeennnnttttiiiivvvveeeessss    
improved transparency and choices for consumers, and reduced 
wwwwiiiitttthhhh    hhhheeeeaaaalllltttthhhh    oooouuuuttttccccoooommmmeeeessss    
administrative burden on providers.84   
     SSSSttttrrrreeeennnnggggtttthhhheeeennnniiiinnnngggg    pppprrrrooooggggrrrraaaammmm    
Medicare  and  Medicaid  are  the  two  largest  and  most  complex  iiiinnnntttteeeeggggrrrriiiittttyyyy    
programs at HHS.  Both programs offer benefits in multiple formats       DDDDeeeelllliiiivvvveeeerrrriiiinnnngggg    oooonnnn    tttthhhheeee    pppprrrroooommmmiiiisssseeee    ooooffff    
(FFS, managed care, and newer payment models); cover a broad  iiiinnnnnnnnoooovvvvaaaattttiiiivvvveeee    tttteeeecccchhhhnnnnoooollllooooggggyyyy    ttttoooo    
array of health conditions, providers, services, and settings; and  iiiimmmmpppprrrroooovvvveeee    hhhheeeeaaaalllltttthhhh    oooouuuuttttccccoooommmmeeeessss    
operate pursuant to intricate statutory directives and regulatory 
schemes.  To reduce disease spread and expedite the delivery of medically needed care during the COVID-19 public 
health emergency, CMS and OIG have implemented targeted flexibilities addressing coverage and payment for items 
and services, as well as application of fraud and abuse authorities to specified types of business arrangements.85  
These flexibilities introduce additional regulatory risks and compliance challenges for stakeholders implementing 
them and the Department overseeing their effectiveness. 
An increasing number of Medicare and Medicaid beneficiaries are enrolling in managed care options, and an 
increasing number of providers are participating in value-based health care models.  The Health Care Payment 
Learning & Action Network, an HHS-sponsored public-private partnership, estimated that for calendar year 2018, 90 
percent of providers in Medicare FFS were paid based, at least in part, on quality and value, with 41 percent being 
paid under an alternate payment model or a population-based payment.  The comparable figures for Medicaid were 
34 percent and 23 percent, respectively.86  Continued growth in value-based care is expected.  CMSs Innovation 
Center continues to test and introduce new models across the health care spectrum, from hospitals to hospices, 
from integrated delivery systems to small primary care practices, and from urban areas to sparsely populated rural 
areas.  Examples of models designed to accelerate development and testing of new payment and delivery service 
models include the Accountable Health Communities Model focused on unmet social needs; an Artificial Intelligence 
(AI) Health Outcomes Challenge to demonstrate how AI tools can be used to predict unplanned hospital and SNF 
admissions and adverse events; and the Direct Provider Contracting Models to test direct contracting between 
payers and physician practices.  Recently announced models focus on patients needing insulin and patients with 
OUD, among others.  Some models involve partnerships with states; some are all-payer models designed to align 
with private sector initiatives.  Among its permanent value-based programs, CMS administers the Quality Payment 
Program for physician reimbursement and the Medicare Shared Savings Program for accountable care organizations 
(ACOs).  CMS paused timelines and modified some model and program requirements because of the COVID-19 public 
health emergency.    
20 
     
 
Both Medicare (FFS, Part C, and Part D) and Medicaid have proven 
susceptible to fraud, waste, and abuse, with FY 2019 estimates of improper 
payments ranging from 7.3 percent (Medicare FFS) to 14.9 percent (Medicaid) of 
total  expenditures.    Improper  payments  for  Medicare  and  Medicaid  totaled 
approximately  $103.6  billion.87,  88    Both  programs  have  been  on  the  U.S.  Government 
Accountability Offices (GAOs) list of high-risk government programs for years.  OIGs enforcement 
work shows that wrongdoers defraud Medicare and Medicaid through schemes ranging from false billings 
to kickbacks.  OIGs oversight work demonstrates a range of vulnerabilities, including: 
  Flawed program design and administration (e.g., improper payments) (see TMC 2), 
  Misaligned program incentives and confusing or insufficient program guidance, 
  Deficient delivery of care to beneficiaries (e.g., poor quality and unsafe care (see TMC 4) or inappropriate 
utilization), 
  Gaps in provider enrollment systems and available data needed for proper oversight (see TMCs 2 and 5), 
and  
  Challenges with adequate access for beneficiaries to covered services in both FFS and managed care. 
 
To ensure effectiveness of Medicare and Medicaid in delivering value, the Department should focus on three facets 
of the challenge: (1) aligning program incentives with quality and health outcomes, (2) strengthening program 
integrity, and (3) delivering on the promise of innovative technology.   
Aligning program incentives with quality and health outcomes 
Developing effective incentives and policies to drive better health outcomes is difficult given the complexities of 
medicine, the programs themselves, and the varying needs of the populations served by these programs.  HHS faces 
obstacles in correctly measuring the value of care.  Designing measures that effectively incentivize high-quality care 
and improved outcomes without being overly prescriptive or burdensome to providers is challenging, and the 
science of quality measurement continues to evolve.   
The Department is undertaking initiatives to streamline, improve, and target quality measures more precisely and 
to move from process measures to outcome measures.  Through its Meaningful Measures initiative, CMS reports it 
rolled back 20 percent of measures because they were topped out, duplicative, or overly burdensome.89  Pursuant 
to Executive Order 13877 on Health Care Price Transparency and Quality, in May 2020, HHS published a National 
Health Quality Roadmap, in consultation with the Secretaries of Defense and Veterans Affairs, to improve patient 
outcomes through enhanced effectiveness and efficiency in the health care quality system supported by Federal 
investments.  The roadmap identifies specific strategies and planned actions to drive change through establishment 
of coordinated governance and oversight; modernized data collection, reporting, and sharing; and reforming how 
measures are used in Federal quality programs.90   
Moving forward, HHS should ensure that its programs use effective, evidence-based measures to improve quality of 
care and beneficiary outcomes.  CMS must clearly define actionable and meaningful quality and outcomes measures 
for its programs and ensure their reliability, accuracy, and utility.  CMS should continue, where appropriate, to align 
its efforts with other OpDivs using quality measurements to reduce unnecessary provider burden and strengthen 
quality measurement.  Accuracy and completeness of reported quality and performance information is also critical 
for payment purposes. 
21 
     
 
CMS should take steps to support and develop high-performing ACOs.  
OIG work examining ACOs strategies for transitioning to value-based care 
identified lessons learned from the Medicare Shared Savings Program.  These 
lessons addressed engaging beneficiaries in improving their health outcomes, managing 
beneficiaries  with  costly  or  complex  care  needs,  reducing  avoidable  hospitalizations, 
controlling costs and improving quality in skilled nursing and home health care, addressing behavioral 
health needs and social determinants of health, and using technology to increase information sharing 
among providers.91  Based on this work, OIG recommendedand CMS concurredthat CMS support and share 
successful ACO strategies.  These strategies may be adaptable in other value-based models.    
The Department has been engaged in the Regulatory Sprint to Coordinated Care led by the Deputy Secretary to 
reform regulations administered by CMS, OIG, SAMHSA, and the Office for Civil Rights (OCR) to promote value and 
quality through better coordinated care for patients and broader sharing of patient information for patient care.  To 
date, CMS and OIG have issued proposed regulations, SAMHSA has issued final regulations, and OCR has issued a 
request for information.92  Once final rules are issued, HHS should monitor results to ensure that the regulations 
operate as intended to promote beneficial arrangements and practices, and are not subject to abuse. 
New payment structures, care delivery methods, business arrangements among providers, and incentives all give 
rise to risk-management challenges in Medicare and Medicaid.  Notwithstanding identified successes, CMS must 
maintain a steady focus on quality of care and health outcomes.  This is particularly true during the COVID-19 public 
health emergency when normal guardrails and conditions have been adjusted to address exigent public health 
circumstances and when providers may temporarily be unable to meet optimal care guidelines.  (See TMC 4 for 
further discussion of quality-of-care challenges.)  
Strengthening program integrity 
HHS must be attentive across FFS and managed care programs to assess, identify, and mitigate program integrity 
risks.  The nature of fraud and abuse risk differs depending on how Medicare and Medicaid pay for services.  
Traditional FFS risks, arising from volume-sensitive payments, include inappropriate utilization, increased program 
costs, and improper patient steering.  In managed care, a capitated payment system leads to risks such as: stinting 
on care to reduce costs, discriminating against expensive patients, or manipulating or falsifying data used to measure 
performance, outcomes, or acuity, as well as to receive improper payments.  In nontraditional health care models 
that marry FFS payments with value-based payments, such as shared savings or partial capitation payments, 
elements of both FFS and managed care risks may be present.  In evaluating and managing risks for a specific model, 
CMS must consider the range of incentives in the model.  Managed care is not immune from risks created by mixed 
incentives.  OIGs oversight and enforcement work has revealed opportunities for downstream fraud and abuse in 
managed care by providers paid by plans on an FFS basis. (See TMC 2 for further discussion of program integrity in 
managed care.)    
In testing and implementing value-based care models, CMS must continue to focus on program integrity risks, 
incorporating safeguards to reduce them and strategies to correct them.  Focusing on program integrity risk is 
especially important for models that introduce new payment incentives, which could lead to new fraud schemes, 
and for models for which waivers of customary payment, coverage, or fraud and abuse laws have been issued.  
Additional risks may arise from novel flexibilities granted because of the COVID-19 public health emergency.  HHS 
should mitigate risks when designing flexibilities, monitor implementation of flexibilities for any abuse, and take 
prompt action to correct problems and hold wrongdoers accountable. 
22 
     
 
Value-based  care  models  increasingly  promote  care  in  home  and 
community settings through in-person home visits, remote monitoring, and 
other technologies.  These services can be less costly and are often preferred by 
patients.  OIG work in areas such as hospice care, home health, and PCS consistently 
demonstrates that patients and the programs may be vulnerable to fraud and abuse in home- 
and community-based settings.  Moreover, home-based services may not meet quality of care 
requirements.  For example, recent OIG work showed that hospices lacked oversight of their registered 
nurses, resulting in nurses failing to meet requirements to visit beneficiaries homes to assess quality of care 
provided by hospice aides.93   
During the COVID-19 public health emergency, HHS determined that virtual services could be safer for patients and 
issued broad flexibilities for providers to furnish telehealth and other virtual care in settings and under conditions 
not typically allowed.  HHS should monitor and assess services furnished and billed under these flexibilities for 
compliance with requirements, payment accuracy, and quality of care to ensure the flexibilities work as intended.  
As it considers how and whether to incorporate such services into the regular programs before or after the public 
health emergency abates, HHS should be attuned to program integrity risks such as unknown or unqualified 
providers furnishing virtual services, providers offering and billing for services not suitable for virtual care, 
substandard services, unsecured technology or data transmission, and improper incentives to beneficiaries to 
receive virtual care or provide their Medicare billing number to those purporting to furnish virtual services.  
Additional risks to program integrity across Medicare and Medicaid, including improper payments, compliance with 
program requirements, provider eligibility and qualifications, data integrity and availability, transparency and 
accuracy of information available to consumers, patient safety, substandard care, and access to care, are covered in 
more detail in TMCs 2, 4, and 5.   
Delivering on the promise of innovative technology to improve health outcomes 
Leveraging digital and health technology to foster efficient, high-quality, safe care is critical to a value-driven health 
care system, as is ensuring the appropriate flow of complete, accurate, timely, and secure information.  For example, 
OIGs work examining how ACOs use health information technology (IT) showed that, although ACOs have used 
health IT to aid in care coordination, the full potential of health IT has not been realized.94   
HHS faces challenges in achieving a connected health care system to support better coordinated and value-based 
care in which patients dataincluding conventional health care data and newer types of data related to social 
determinants, demographics, and personal trackersflow freely across provider settings, with appropriate privacy 
and security protections.  As health-related apps and technologies proliferate with the delivery of care, beneficiaries 
will need access to new and integrated information.  This information should enable beneficiaries to choose reliable 
apps and technologies and to assure themselves that providers they engage with via an app or technology are 
trustworthy.  (See TMC 5.)  HHS will need to ensure that rural beneficiaries and underserved populations are not left 
out of a technology-enriched, value-driven health system. 
The Department also faces challenges in ensuring that evolving technologies are effective, enhance patient access 
to quality care, and support providers ability to furnish such care.  The law enforcement action known as Operation 
Brace Yourself illustrated how telephone-based remote physician consultations can make a familiar fraud scheme
charging Medicare for DME that patients do not needbigger with less effort.  HHS must provide appropriate 
oversight of rapidly evolving technologies, such as telehealth, networked medical devices, robotics, genomic testing, 
and remote monitoring.  In many cases, new technologies and apps are being developed by individuals and entities
often engineers or scientistsunschooled in the complex regulations governing health care and unaware of the 
23 
     
 
range of program integrity risks their inventions may face.  These new 
participants in the health care system will need education, guidance, and 
appropriate oversight.   
HHS faces a growing challenge in understanding and, as appropriate, overseeing providers 
use of AI and machine learning in the delivery of health care, such as in diagnostics, as well as for 
administrative functions, such as coding and claims submission.  AI and machine learning are introducing 
new paradigms that likely require fresh thinking about quality of care, compliance, and fraud prevention.  
Relatedly, HHS will need to assess how it can use AI, machine learning, and other technologies to foster program 
integrity, value, and quality of care in Medicare, Medicaid, and other HHS programs.  (See TMC 1 for further 
information about FDAs role in emerging technology.) 
In sum: realizing the promise of value-based care and payment structures 
To achieve better care at lower cost, HHS must maintain a steady focus on developing and refining effective, 
innovative, evidence-driven models while being proactive in preventing and detecting fraud, waste, and abuse.  HHS 
must pay special attention to effectiveness and program integrity in nascent areas such as the intersection of health 
care with social determinants of health and new uses of digital technology.  This is vitally important given the current 
and anticipated growth in the cost and number of beneficiaries in Medicare and Medicaid.  Meeting this challenge 
will enable the Department to expand the reach of dollars devoted to these programs, thereby abating some of the 
anticipated rise in cost of these programs over the next decades and improving the lives and health outcomes of the 
beneficiaries they serve. 
 
 
24 
     
 
4: Protecting the Health 
and Safety of HHS Beneficiaries 
HHS programs provide critical services to diverse populations across 
KKKKEEEEYYYY    TTTTAAAAKKKKEEEEAAAAWWWWAAAAYYYYSSSS    
a broad range of settings, including hospitals, child care facilities, and 
beneficiaries own homes.  Some services are directly provided by 
VVIII. I.I. I . RRRReeeelllleeeevvvvaaaannnntttt    AAAAggggeeeennnncccciiiieeeessss::::    AAAACCCCFFFF,,,,    
HHS personnel, some delivered via HHS grant programs, and others 
CCCCMMMMSSSS,,,,    IIIIHHHHSSSS,,,,    HHHHRRRRSSSSAAAA,,,,    SSSSAAAAMMMMHHHHSSSSAAAA    
rendered by professionals of the beneficiarys choosing, who then 
VVIIVI.II ..I  I. EEEElllleeeemmmmeeeennnnttttssss    ooooffff    tttthhhheeee    CCCChhhhaaaalllllllleeeennnnggggeeee::::        
claim reimbursement from Federal programs.  Services include health 
     EEEEnnnnssssuuuurrrriiiinnnngggg    ssssaaaaffffeeeettttyyyy    aaaannnndddd    
care, education, child care, and even physical custody for select 
qqqquuuuaaaalllliiiittttyyyy    ooooffff    ccccaaaarrrreeee    ffffoooorrrr    
populations.    Ensuring  that  intended  beneficiaries  receive 
bbbbeeeennnneeeeffffiiiicccciiiiaaaarrrriiiieeeessss    ooooffff    FFFFeeeeddddeeeerrrraaaallll    
appropriate services that meet standards for quality, are free from 
hhhheeeeaaaalllltttthhhh    ccccaaaarrrreeee    pppprrrrooooggggrrrraaaammmmssss    
abuse or neglect, and are not exposed to infectious agents represents 
     PPPPrrrrooootttteeeeccccttttiiiinnnngggg    tttthhhheeee    hhhheeeeaaaalllltttthhhh    
a major challenge for the Department.  As the Department supports 
aaaannnndddd    ssssaaaaffffeeeettttyyyy    ooooffff    cccchhhhiiiillllddddrrrreeeennnn    
the current race to develop treatments for and immunizations to 
sssseeeerrrrvvvveeeedddd    bbbbyyyy    HHHHHHHHSSSS    
protect  against  COVID-19,  there  will  be  challenges  to  ensure 
pppprrrrooooggggrrrraaaammmmssss    
equitable distribution of risks and benefits of participation in clinical 
     PPPPrrrreeeevvvveeeennnnttttiiiinnnngggg    aaaabbbbuuuusssseeee    aaaannnndddd    
trials, as well as access to and safety and efficacy of immunizations 
nnnneeeegggglllleeeecccctttt    
and treatments. 
Ensuring safety and quality of care for beneficiaries of Federal health care programs 
HHS operates the Medicare program to serve about 62 million elderly or disabled Americans.  In partnership with 
the States, the Medicaid program serves almost 68 million beneficiaries, and the CHIP program serves 6.7 million 
beneficiaries.  IHS provides direct services for about 2.6 million members of 574 Federally recognized Tribes.  These 
programs cover specific health care services, which may include hospital care, physician services, prescription drugs, 
hospice care, home- and community-based care, DME, and skilled nursing care.   
Delivering covered services 
Ensuring access to care that meets quality and safety standards remains a challenge.  Even when Federal 
health care programs cover care, many beneficiaries do not actually receive the care they need.  For 
example, OIG found that over 500,000 children with attention deficit hyperactivity disorder (ADHD) who 
were Medicaid-enrolled did not receive timely follow-up care, and that over 50,000 such children did not 
receive behavioral therapy as recommended by professional guidelines.95  At the other end of the life cycle, 
OIG found that more than 80 percent of hospice providers, a growing sector of health care serving 
beneficiaries and their families at an extremely vulnerable time near end-of-life, had quality-of-care 
deficiencies.96  Additionally, fixed daily payment structures may incentivize hospices to enroll beneficiaries 
for longer time periods but scrimp on care.   
Quality of care 
Oversight work revealed that patients experience significant rates of adverse events (patient harm as a 
result of medical care) in health care facilities.  Specifically, OIG found that 27 percent of Medicare 
beneficiaries were harmed during their stays in acute care hospitals, 29 percent in rehabilitation hospitals, 
25 
     
 
33  percent  in  SNF,  and  46  percent  in  long-term-care 
hospitals.97  OIG also found that hospitals did not identify when harm 
occurred in their facilities, in part due to confusion over HHS and other 
government guidance regarding how to define and report adverse events.98  OIG 
is currently conducting a study to update the harm rate for Medicare beneficiaries in 
hospitals.  The review will assess progress made in reducing harm in the decade since the 
prior study was released in 2010.99  OIG also has work underway to measure the rate of adverse 
events for patients at IHS Hospitals and work looking at substandard care in labor and delivery services 
at IHS Hospitals.  (See TMC 6 for more information on cross-government efforts to keep patients safe.)   
The Department continues efforts to improve the quality of covered services as well the information 
available to beneficiaries and their families when selecting a care provider.  One example is CMSs efforts 
to improve nursing home care.  CMSs Five-Star Quality Rating System facilitates informed comparison of 
nursing homes.  Besides selecting appropriate nursing homes, beneficiaries and families need access to 
better information about other types of providers, such as hospices.100  CMS has announced plans to 
revamp its Hospital Quality Star Rating System to enable better informed decision-making for beneficiaries 
seeking hospital care.  Especially given some curtailment of visitation during the COVID-19 pandemic, 
accurate information about nursing home quality is critically important to inform patients and families 
choices.  Given the important role friends and families usually play in identifying and reporting quality 
issues, as this information source may be diminished during the pandemic, OIG launched an education and 
outreach campaign to promote nursing homes attention to quality and inform patients, staff, and others 
how to report quality of care concerns.   
As the COVID-19 pandemic has taken a heavy toll on beneficiaries in nursing homes, longstanding staffing 
and quality of care concerns remain pressing, as well as new infection control imperatives.  OIG continues 
its series of audits to assess nursing homes compliance with health and safety regulations.  CMS 
enforcement actions have stopped some poor-performing nursing homes from rendering deficient services.  
One nursing home chain charged with rendering grossly substandard care to Medicare and Medicaid 
beneficiaries agreed to repay $18 million and abide by the terms of a Corporate Integrity Agreement to 
ensure that it delivers appropriate care going forward.101  Further, after a series of OIG reports about quality 
of care problems in IHS-operated hospitals,102 IHS created a new Quality Framework and Office of Quality 
to provide better guidance and oversight to its facilities and clinical staff.103  IHS is also working to establish 
a  nationwide  compliance  program  to  address  several OIG  recommendations  and improve  care  for 
beneficiaries.  However, some longstanding challenges, such as recruiting and retaining qualified staff, 
persist.  As discussed below, there is also a pressing need to protect patients, especially children, from 
predators within the ranks of health care and other service providers.   
Although the Department has made progress, more work remains to improve access to, and quality of, all 
types of care.  Among the top priorities, as identified by OIG work, are improving hospice care, including 
strengthening the survey process and better educating beneficiaries and their families and caregivers,104 
and  improving  the  health  and  safety  of  nursing  home  residents  by  ensuring  facility  correction  of 
deficiencies.105  To continue improvements at IHS, OIG has recommended that IHS prioritize developing and 
implementing a staffing program to ensure there is sufficient qualified staff, including those at remote 
facilities; enhance training for staff and hospital leaders; intervene quickly and effectively when quality 
problems are identified; and establish better procedures, including improved external communication.106   
26 
     
 
Protecting the health and safety of children served by 
HHS programs  
HHS operates or funds many programs that provide child care, education, and residential 
care, in addition to health care for children, including some especially vulnerable children, such 
as children living in foster care and children in the UAC Program.  The Head Start program promotes 
school  readiness  for  nearly  1  million  children  from  low-income  families,  and  the  Child  Care  and 
Development Fund (CCDF) provides child care for about 1.3 million children from low-income families.  The 
importance of properly vetting program staff to ensure childrens safety is discussed below.   
Operating the UAC Program 
Through the UAC Program, ORR assumes custody of children who enter the U.S. without immigration status 
and have no parent or guardian in the U.S. able to provide for their physical and mental well-being.  The 
child may have arrived in the U.S. alone, or in certain circumstances, may have been separated from their 
parents or legal guardians at the border.  The UAC Program merits specific discussion, as it uniquely tasks 
the  Department  with  assuming  physical  and  legal  custody  for  children,  and  the  comprehensive 
responsibility for their welfare thus entailed.  Through the UAC Program, ORR places unaccompanied or 
separated children in State-licensed shelters and other facilities operated by grantees or contractors.  These 
facilities provide food and shelter, as well as medical and mental health care and other services.  Children 
remain in these placements until a sponsor (usually a parent or family member) is found to whom the child 
may be safely released, the childs immigration status is resolved, or the child turns 18 years old and ages 
out of the program.  Since ORR began operating the UAC Program in 2002, it has served more than 400,000 
children.   
In recent years, ORR has been called upon to care for more children, including children who did not come 
to the U.S. alone but were separated from their parent or guardian at or after arrival.  HHS reported to a 
court as part of a lawsuit that 2,737 children had been separated by the Department of Homeland Security 
(DHS) and remained in ORR care as of June 2018.  Following OIGs January 2019 report finding that 
significantly more children had been separated from their parents than had previously been reported, the 
government identified an additional 1,556 children who had been separated.  Neither ORR nor DHS had 
kept adequate records about separated families, impeding efforts to identify and reunite them.   As of 
October 2020, a court-appointed steering committee reported that it was unable to locate parents of 545 
children; efforts to do so are continuing.  OIG also reported, and subsequent court filings confirmed, that 
children continued to be separated by DHS from their parents for reasons such as the parents criminal 
history; however, ORR did not always receive adequate information about parents of separated children.107 
Lack  of  complete  and  accurate  data  about separated  children  complicates  HHSs  ability  to  ensure 
appropriate placement.  These factors may cause children to spend more time in HHS custody.  Issues 
related to identifying and vetting appropriate sponsors may also prolong childrens time in HHS care 
facilities.  OIG also found failures in conducting required staff background checks and insufficient clinical 
staff to serve childrens mental health needs,108 lack of oversight over facilities use of inspection checklists 
to ensure security measures,109 and shortcomings in incident reporting systems to protect childrens 
safety.110 
The Department must work to ensure that UAC Program-funded facilities meet all safety requirements, 
including new infection control priorities related to the current COVID-19 pandemic, and provide adequate 
27 
     
 
medical and mental health care.  As discussed further below, 
HHS must also enhance efforts to ensure that all staff with access to 
children have passed required background checks.   
Preventing abuse and neglect 
HHS funds and oversees many types of services for a broad range of beneficiaries.  Countless HHS-
funded providers hold positions of trust that bring them into close contact with beneficiaries, often behind 
closed doors and at especially vulnerable times in the beneficiaries lives.  The vast majority of providers seek to 
serve beneficiaries best interests.  However, some providers may cause beneficiaries harm, and HHS must protect 
its beneficiaries from abuse and neglect.  For example, a former IHS pediatrician is currently serving a prison sentence 
for sexually assaulting boys he treated as patients.  This disturbing case commanded extensive attention, and the 
Department has committed to collaborating with a Presidential Task Force on Protecting Native American Children 
in the IHS system established in March 2019.111  The Task Force released a report in July 2020 detailing its 
investigation of institutional and systemic breakdowns that failed to protect children from abuse.112  Better attention 
to protecting vulnerable beneficiaries of all ages in all HHS care settings is also needed.113 
Vetting providers and staff 
Although even the most thorough vetting cannot completely prevent all potential predators from abusing 
Federal programs to gain access to victims, background checks are a useful tool.  OIG identified failure to 
conduct required background checks for UAC facility staff whose jobs entail access to children.114  Failure 
to conduct adequate background checks has been a problem in other HHS child care programs as well.  OIG 
found that some States have not fully implemented CCDF requirements to conduct comprehensive criminal 
background checks on current and prospective staff.115  Additionally, some IHS-funded tribally run health 
centers failed to conduct required background checks on employees working with American Indian 
children.116  Implementation of background checks for long-term-care providers remains a challenge as 
well.117  Along with demonstrating job-specific competency and qualifications, ensuring that staff pass all 
required background checks is an important safety measure. 
The Department should improve efforts to ensure staff pass required background checks before they have 
access to patients in various health care settings and to children in the UAC Program, Head Start, and CCDF 
funded programs.  The Department is also working to support States implementation of the CCDF 
background check requirements.  The Department should continue to work with States to ensure that 
implementation  of  the  Child  Care  and  Development  Block  Grant  Act  of  2014  background  check 
requirements align with the statutorily required effective dates and the allowable timelines described in 
the CCDF Final Rule. 
Identifying and reporting abuse and neglect 
Beneficiaries in all care settings are at risk of abuse and neglect.  About 1.8 million Medicare beneficiaries 
receive care in SNFs each year.118  Home and community-based services allow many Medicaid beneficiaries 
the opportunity to avoid undesired facility care.  However, some beneficiaries have been abused or 
neglected by individuals, including some family members that Federal health care programs paid to care 
for the beneficiary at home.  Group homes provide care to many especially vulnerable people, including 
adults with developmental disabilities.  OIGs work found extensive failures to properly handle critical 
incidents, including suspected abuse and neglect of group home residents.119  OIG has also identified 
substantial failures to report incidents of potential abuse or neglect of Medicare beneficiaries living in SNFs 
28 
     
 
who require treatment in hospital emergency departments.120  
All States have enacted mandatory reporting laws that require 
certain individuals, like school teachers or nursing home staff, to report 
suspected abuse or neglect of vulnerable individuals.  However, many instances 
of abuse and neglect go unreported, making it harder to help victims and hold 
wrongdoers accountable.121  During the ongoing COVID-19 pandemic, with many students 
not going to school and many patients not able to receive visitors, ensuring well-functioning 
processes to identify and report abuse is particularly important. Continued oversight and contact with 
family and friends can be particularly important to ensure quality of care in nursing homes.  OIG is reviewing 
continuity of on-site oversight by CMS and State Survey Agencies during the pandemic.  Also, CMS issued 
guidance to help nursing homes resume in-person visitation while minimizing the risk of COVID-19 
transmission.   
The Department has created several resources to better address abuse and neglect of residents of group 
homes.  These resources include model practices for: (1) State incident management and investigation, (2) 
State incident management audits, (3) State mortality reviews, and (4) State quality assurance.122  The 
model practices offer strategies designed to better protect group home residents and several States have 
adopted these model practices. 
It is important to prevent ongoing harm by identifying providers and facilities subjecting beneficiaries to 
abuse or neglect.  States and other partners should use claims data to better identify unreported abuse and 
neglect.  OIG created a resource guide to help accomplish this goal.123  OIG has also explored Medicaid 
claims data as an additional way to identity potential child abuse and neglect.124  Additional efforts would 
help to improve reporting.  For example, CMS should compile a list of diagnosis codes that indicate potential 
abuse or neglect, conduct periodic data extracts, and encourage States to better use data to facilitate 
compliance with mandatory reporting laws.   
CMS should also work to ensure that Federal mandatory reporting laws suffice to protect beneficiaries in 
all care settings and are adequately enforced.  Protecting beneficiaries from abuse and neglect is a critical 
responsibility requiring attention and cooperation from all stakeholders.  
   
29 
     
 
5: Harnessing Data To 
Improve Health and Well-Being 
of Individuals
 
Improving  how  the  Federal  government  manages,  shares,  and 
KKKKEEEEYYYY    TTTTAAAAKKKKEEEEAAAAWWWWAAAAYYYYSSSS    
secures  its  data  is  a  priority  for  both  Congress  and  the 
Administration.125  The COVID-19 pandemic has underscored the 
VVIII. II..I  . RRRReeeelllleeeevvvvaaaannnntttt    AAAAggggeeeennnnccccyyyy::::    AAAAllllllll    HHHHHHHHSSSS        
need for significant and sustained efforts to modernize data practices 
VVIIVI.II I..I  . EEEElllleeeemmmmeeeennnnttttssss    ooooffff    tttthhhheeee    CCCChhhhaaaalllllllleeeennnnggggeeee::::        
across  the  Department.    The  response  to  COVID-19  is  directly 
     EEEExxxxppppaaaannnnddddiiiinnnngggg    HHHHHHHHSSSS''''ssss    ccccaaaappppaaaacccciiiittttyyyy    ttttoooo    
dependent on data that HHS collects or generates.  Ensuring that 
uuuusssseeee    aaaannnndddd    sssshhhhaaaarrrreeee    ddddaaaattttaaaa    ttttoooo    ssssuuuuppppppppoooorrrrtttt    
government officials, researchers, the public, and other stakeholders 
eeeevvvviiiiddddeeeennnncccceeee----bbbbaaaasssseeeedddd    ppppoooolllliiiiccccyyyymmmmaaaakkkkiiiinnnngggg,,,,    
can access timely, accurate data is critical.  Data that HHS generates 
pppprrrrooooggggrrrraaaammmm    mmmmaaaannnnaaaaggggeeeemmmmeeeennnntttt    aaaannnndddd    
or collects are used to support nearly all COVID-19 response efforts, 
pppprrrrooooggggrrrraaaammmm    iiiimmmmpppprrrroooovvvveeeemmmmeeeennnntttt                
including tracking spread within nursing facilities, allocating health 
     PPPPrrrroooovvvviiiiddddiiiinnnngggg    ddddaaaattttaaaa    ttttoooo    HHHHHHHHSSSS    
care  resources  across  the  country,  and  distributing  health  care 
ppppaaaarrrrttttnnnneeeerrrrssss    aaaannnndddd    pppprrrroooommmmoooottttiiiinnnngggg    tttthhhheeee    
Provider Relief Funds.   
ppppuuuubbbblllliiiicccc    ddddaaaattttaaaa    aaaacccccccceeeessssssss    aaaannnndddd    sssshhhhaaaarrrriiiinnnngggg        
     PPPPrrrrooootttteeeeccccttttiiiinnnngggg    ddddaaaattttaaaa    ffffrrrroooommmm    mmmmiiiissssuuuusssseeee    
HHSs capabilities to operationalize and change how it internally uses 
oooorrrr    uuuunnnnllllaaaawwwwffffuuuullll    ddddiiiisssscccclllloooossssuuuurrrreeee        
and shares data for the COVID-19 response was in part aligned with 
the focus HHS has placed on  Leveraging the Power of Data as one 
of its six strategic shifts for its ReImagine HHS effort.126  Under this initiative and other associated Federal 
government action actions, HHS recognized the need to transform the way HHS internally shares, analyzes, and 
derives new insights by leveraging data across HHS agencies....127  The pandemic accelerated that need, and the 
Department built new systems to improve and centralize some data functions in support of the COVID-19 response, 
including HHS Protect.128  The implementation of HHS Protect faces significant challenges including standardized 
and consistent reporting to HHS Protect by hospitals,129 potential data accuracy, and the public use of data,130 all of 
which highlight many longstanding issues associated with collecting, managing, and sharing data across HHS OpDivs.  
Continued modernization of HHS data practices is needed for HHS and its OpDivs to fulfill their missions, especially 
in support of the COVID-19 response.    
HHSs authorities shape how an individuals data are used and protected by other private and public entities.  These 
authorities are increasingly important in a technology-enriched health and human service delivery system.  HHS 
made progress on this front, but COVID-19 has presented a new challenge by amplifying demand for easier access 
to data.  As many health care providers, State and local governments, and others switched to remote and virtual 
interactions to slow the spread of COVID-19, the need to continue to improve data interoperability and security was 
evident.  Data access needs to follow where people are, not where data happens to be.  HHS will need to sustain 
efforts to ensure early progress turns into lasting structural improvement across the health and human service 
systems.    
30 
     
 
Expanding HHSs capacity to use and share data to 
support evidence-based policy making, management, and 
program improvement    
Data play a central role in every HHS program or policy mission.131  The COVID-19 pandemic has 
highlighted how data are essential in the success of HHS programs and stakeholder engagement.  
HHS operations depend on the effective collection and use of a large amount of sensitive and important data 
about individuals, health care providers, key public health assets, and other entities and actors.  These data are 
vital to improving the health and welfare of individuals in the Nation.  The Department and its programs are 
increasingly able to collect, store, and analyze data from disparate sources and able to provide new pathways within 
HHS to improve access to data.    
However, having large amounts of data does not mean that the data can be used efficiently and effectively.  HHS 
faces challenges in how it manages and leverages that data across its programs.  Although most OpDivs primarily 
collect data to administer their own programs, the use of data across programs and OpDivs remains a challenge.  
Data are often housed within a single OpDiv (data silo) and not easily shared with other parts of HHS, even though 
OpDiv missions often overlap.132  These restrictions potentially impair the Federal governments response to COVID-
19 by limiting how HHS and its partners gain insight about COVID-19.133  As part of the pandemic response, HHS, 
other Federal agencies, State, local, and Tribal officials must work together on a nearly constant basis.  Through OGA, 
the  Department  also  engages  with  international  stakeholders  during  a  public  health  emergency.    These 
collaborations require timely access to data that can flow across data silos within HHS, to different levels of 
government, and key stakeholders.  HHS has stated that it built HHS Protect to centralize and report out data on 
COVID-19 quickly and improve the sharing, parsing, housing, and accessing of relevant COVID-19 data.134  The 
Department continues to work on HHS Protect to address implementation difficulties that led to confusion among 
hospitals and public health officials.135  Although HHS Protect was established in exigent circumstances during a 
pandemic under short timelines, the challenges it faces are likely indicative of future challenges that HHS may 
encounter as it continues to modernize its data practices.   
Data silos may also impede deployment of emerging technologies, such as machine learning, that have enormous 
potential to improve the efficiency and effectiveness of the Department.  These technologies are often dependent 
on large, standardized data sets and will require collaboration across the Department.  Eliminating or reducing data 
silos within the Department and increasing appropriate access across programs will be an essential step to improving 
program management and evidence-based decision-making, as well as seeding the ground for HHS to benefit from 
emerging technologies.   
Improving data governance to enhance program management  
One critical step to improving HHSs capacity to utilize its data is the adoption of a better data governance 
approach.  Effective data governance can improve communication and transparency by making data more 
available and useable.  However, data governance practices are not consistent across HHS.  The need to 
improve data governance is not unique to the Department and is a priority and a requirement for Federal 
agencies.136  It is also part of HHS Strategic Plan and the Digital Strategy at HHS.137  The Department is taking 
steps to improve its data governance and more effectively use its data.  In 2019, the Office of Chief 
Technology Officer (CTO) released a report detailing a vision of how to improve internal sharing and data 
analysis.138  Additionally, under the Reimagine Data Insights Initiative, HHS launched a proof of concept 
data-sharing platform called Unifi.  The platform is designed to address a number of internal data-sharing 
issues, including automating workflow for data access requests, making open source data analytic toolkits 
31 
     
 
available, and providing dashboards and other reports to allow 
for more transparency about HHS data.  Although progress has been 
promising, the Departments challenge will be to operationalize its plans 
notwithstanding: the continued effect of data silos, restrictions related to the 
privacy and use of certain data, and legacy technology and data systems that do not 
easily  support  data  sharing.   HHS  must  ensure  any  progress  it  makes  on  improving 
governance of its internally generated data must also apply to data that are generated by external 
entities but received and managed by the Department.  This challenge will play a significant role as CDC 
moves forward with the Public Health Data Modernization Initiative to update antiquated systems and 
support improvement of State and local health departments data capacities.139  As HHS, CMS, CDC, and 
other OpDivs moved quickly to implement additional COVID-19 reporting requirements for health care 
providers and other entities, some of these efforts encountered challenges that are consistent with data 
collection and reporting issues in other HHS programs.   
For example, OIG has raised concerns about the completeness and quality of data submissions by States for 
the national Medicaid data set named the Transformed Medicaid Statistical Information System (T-MSIS).140  
CMSs recent progress related to T-MSIS may be helpful in providing lessons learned.  Nearly all State 
Medicaid programs now report data directly to T-MSIS, and CMS has worked with States to improve the 
quality of data submissions and to release T-MSIS data to researchers.  However, concerns still exist about 
the completeness and reliability of the T-MSIS data.  CMS has issued guidance to States to improve T-MSIS 
reporting of certain variables, but additional guidance and testing is needed.141  Similar data quality and 
governance challenges will be important to proactively address as HHS modernizes how it collects and uses 
external data from grantees or other organizations.142   
Building advanced capacity to use data to improve programs 
Improving how HHS, its programs, and its employees use data is a critical component of the 2018 HHSs 
Data Strategy and the 2019 CTO report on internal data sharing.  Better use of data may improve evidence-
based policy making, improve internal administrative functions, and support the deployment of emerging 
technologies, all of which are part of the larger Federal and Departmental strategies to promote efficient 
and appropriate data use.143   
HHSs ability to use new technologies that can make the Department more effective and efficient is 
dependent on how well data can be gathered and curated from multiple OpDivs.  For example, the CDC 
Data Modernization Initiative includes plans to deploy next-generation tools to improve public health 
surveillance.144  Technologies such as machine learning and AI must function on top of large data sets.  To 
effectively deploy those tools, HHS will have to rely on data from across its programs, which will require 
complex technical coordination among diverse types of data, some of which have technical limitations.145  
The Department is making progress by exploring solutions through Unifi, pilots, initiatives, limited scope 
projects, and internal training focused on improving data science skills within HHS.146   
The challenge for HHS will be to go from strategic pilot tests and training to fully incorporating advanced 
data capabilities into the Departments operations.  There are significant barrierslegal, cultural, and 
resource limitationsthat strategic pilots and training alone will not resolve.  To overcome these barriers 
and fully harness data to improve the health and welfare of the Nation, the Department will need to 
continue multiyear efforts and implement sustained change management across its OpDivs. 
32 
     
 
Increasing data access and sharing with HHS partners and 
the public  
There is an increasing recognition that Federal agency stakeholders147 and the 
public can also use Federal data assets for the public good.148  That value continues 
to be demonstrated throughout the response to COVID-19 as data collected or generated 
by HHS provides necessary information to the public.  Much of HHSs data are publicly available 
but may not be easy to use or may have other barriers, such as a lack of standardization, that limit 
stakeholders and the publics access or use.149  Those barriers present a challenge to providing increased 
access to HHS data that are vital for public health and welfare and that could lead to innovation and 
improvement in health and human service systems.  HHS also has significant authority, incentives, and 
influence to change the way data are shared in the health care system, public health, emergency 
preparedness and response, medical research, and other sectors that are vital to the Nation.  Despite that 
significant influence, many of these sectors do not easily or regularly share data, to the detriment of 
patients, individuals, and the public.    
Expanding and improving access to HHS data  
Many HHS external stakeholders rely on effective dissemination of data collected by Departmental 
programs.  Most importantly for the COVID-19 response, many State and local public health departments 
utilize HHS data to track the spread of COVID-19.  However, the complex public health surveillance system 
and the underlying data infrastructure overseen by HHS faces challenges in providing COVID-19 data to the 
public and other external stakeholders.  For example, in July 2020, HHS changed COVID-19 reporting 
processes for hospitals from the CDC National Healthcare Safety Network to HHS Protect to streamline data 
for the COVID-19 response.150  The change caused confusion on how the public and other stakeholders 
could obtain hospital COVID-19 data previously made public by CDC and there were delays in HHS Protect 
making updated data publicly available.  HHS also had successes.  CMS, through the Data.CMS.gov platform, 
made COVID-19 nursing home data available after it updated reporting requirements.151  Both examples 
demonstrate potential challenges and the value of HHS using modern approaches to make data publicly 
available.   
Currently, most public access to HHS data does use contemporary approaches, such as the use of 
application programming interfaces (APIs).  Although data might be available, they may not be well 
understood or in easily accessed formats.  OpDivs are planning and have made some progress to expand 
access to these important assets.  In May 2020, NIH made beta access available to its All of Us Researcher 
Workbench.152  NIH utilized a modern, iterative approach providing researchers access to the All of Us data 
earlier in the data collection process to facilitate continued development of the research platform based 
on feedback from researchers.  In September 2019, FDA released a Technology Modernization Action 
Plan.153  Among other goals, FDA aims to improve how it uses data to carry out its mission and improve 
communication and collaboration with other government and external stakeholders.  These approaches 
and plans must be replicated across HHS to remove barriers to other HHS program data and allow HHS 
partners to more effectively use that data.  
Making data sharing between health care providers, patients, and payers commonplace   
Several OpDivs have authority or influence to shape how data are shared within the industries they 
regulate, among HHS partners, and with individuals and patients.  Most notable is HHSs potential to 
improve the availability and interoperability of electronic health information.  Yet, the health care system 
33 
     
 
and  patients  have  not  fully  realized  and  benefited  from 
modern approaches to improve the appropriate flow of electronic 
health  information.    Promoting  interoperability  is  part  of  the  four 
Secretarial priorities and HHS will need to continue utilizing its significant 
leverage to expedite progress.154   
Routine and robust health information exchange between providers remains a challenge, 
although there are signs of recent progress.  In 2018, 46 percent of acute care hospitals electronically 
performed all four interoperability functions: find patient health information, send, receive, and integrate 
patient summary of care records from sources outside their health system.155  This is up from 23 percent of 
hospitals in 2014.  Among the interoperability functions, the largest increase was in hospitals that can 
integrate data rising from 40 percent to 62 percent over the same timeframe.156  Interoperability of 
electronic health records (EHR) also plays a crucial role in providing data for the response to COVID-19.  
Many agencies in HHS, including CDC, FDA, the Office of National Coordinator for Health Information 
Technology (ONC); external standards organizations; and individual developers moved quickly to develop 
and issue interoperability standards related to COVID-19 data.157  The level of effort and engagement 
needed to issue these COVID-19 standards highlights that the factors limiting increased interoperability and 
exchange more broadly are numerous and complicated.  Several Departmental initiatives depend on 
improving the interoperability of electronic health information, including the transition to value-based care 
and payment (See TMC 3).  Making real progress so that the health care system and patients can benefit 
from the improved flow of data will take sustained engagement within HHS, with HHS partners, and with 
external stakeholders such as organizations that set data standards.  
Recently, HHS has taken significant steps using regulatory authorities and its influence to improve and 
potentially standardize the way in which health information can be accessed, used, and exchanged.  In 2020, 
ONC finalized rules directly related to improving interoperability and helping cement data standards and 
data exchange mechanisms.158  In a coordinated effort, CMS finalized rules to improve the interoperability 
of health information at many entities it regulates through the use of standard, open APIs.159  Additionally, 
the CMS pilot to provide Medicare claims data to providers via API in the Data at the Point of Care pilot 
involved provider organizations that included over 100,000 providers.160  ONC also moved to the next stage 
of implementing the Trusted Exchange Framework and Common Agreement (TEFCA) by selecting a 
recognized coordinating entity to develop, update, implement, and maintain TEFCA.161  While TEFCA holds 
promise for improving how health information is exchanged, many hurdles remain.  Overcoming themwill 
require close coordination between government, the recognized coordinating entity, and industry.  The 
challenge for HHS will be translating these new authorities into more widespread improvements across the 
health care industry.  This will require further engagement to ensure progress is not limited to those health 
care entities with resources to implement modern technologies and data practices.   
Protecting data from misuse or unlawful disclosure  
Managing, using, and sharing data must be complemented by appropriately securing data.  External threats to the 
confidentiality, integrity, and availability of HHS-held data are persistent and growing.  Similar to data governance 
and sharing challenges, several aspects of cybersecurity within the Department are siloed within its OpDivs and 
programs.  As a result, deployment of effective cybersecurity can be highly variable across the Departments OpDivs.  
Further increasing the challenge is the vital nature of many of the Departments programs, operations, and data.  
Interruption of these programs caused by a cyberattack may have significant negative effects on the health and 
welfare of the Nation.  This is especially true given HHSs central role in the COVID-19 response.  Cyber threats to 
34 
     
 
HHS increased due to adversaries attempting to take advantage of the 
public  health  emergency  to  infiltrate  HHS  systems  or  impede  their 
performance,  which  included  a  large  distributed  denial-of-service  attack  that 
persisted for weeks.162  Outside of the Departments systems, many of HHSs partners 
and grantees, and the health care system at large, are subject to an increasing amount of cyber 
threats.  For example, in October 2020, HHS, CISA, and the Federal Bureau of Investigation (FBI) issued 
a cybersecurity advisory warning of the potential for increased and imminent cybercrime threat in the form 
of ransomware to hospitals and other health care providers.163  Public confidence in HHSs ability to protect 
crucial public health data or sensitive, personal health data is important for the success of Federal initiatives that 
seek to leverage technology to create medical treatments of the future.   
Improving HHSs cybersecurity posture 
The Department has made progress in improving its overall cybersecurity posture, but certain weaknesses 
persist and pose challenges.  Recent OIG work found that HHS continues to implement changes to 
strengthen the maturity of its enterprise-wide cybersecurity program but the program still has some 
weaknesses and deficiencies.164  Other OIG work that examined eight Departmental OpDivs identified 
vulnerabilities in configuration management, access control, data input control, and software patching.165  
This work highlights the challenge the Department faces to simultaneously improve the security across 
OpDivs while also helping provide resources and support so that OpDivs can take action to improve their 
own cybersecurity.  (See TMC 1 for more information about FDAs role regarding cybersecurity of medical 
devices.) 
HHS also faces data security challenges outside of cyberthreats.  For example, HHS has recognized the threat 
of foreign government action aimed at unduly influencing and capitalizing on medical research programs 
funded and overseen by the Department.  HHSs challenge in responding to these threats is the need to 
protect these programs while also supporting an open, collaborative research approach that is critical to 
scientific  advances.166    The  Department  has  made  progress  recognizing  threats,  working  with  law 
enforcement as appropriate, studying the potential impact on its programs, and working with grantees to 
mitigate risks.167  
Promoting the security and privacy of the health care system 
HHSs responsibilities for ensuring cybersecurity also extend to the health care system.  The strength of the health 
care systems cybersecurity defenses continues to be tested as cyberthreats continue to increase during the COVID-
19 pandemic.  Additionally, many health care providers rapidly shifted care to telehealth and other remote 
technology.  If telehealth and remote care utilization remain at levels seen during the pandemic, health care 
cybersecurity may also depend on where and how patients access care.  This may pose a significant challenge 
because health care entities remain prime targets for cyberattacks, and health care data are reported to be among 
the most valuable data for cybercriminals.  In addition to data and identity theft, cyberthreats can also pose safety 
risks by causing system outages needed for patient care or exploiting vulnerabilities in the growing number of 
connected medical devices and other medical equipment involved in direct patient care.   
The Department made some progress to bolster cybersecurity in the health care industry.  Since 2019, the HHS 
Health Sector Cybersecurity Coordination Center (HC3) has issued a number of products aimed at educating the 
health care industry on specific threats, mitigation efforts, and other educational materials.  The products describe 
trends and new cybersecurity threats designed to take advantage of the COVID-19 pandemic.168  FDA has continued 
to issue safety communications on medical device cyber vulnerabilities working in partnership with the Cybersecurity 
35 
     
 
Infrastructure Security Agency of DHS (CISA).169  The Department also 
proposed rules to protect donations of cybersecurity technology within the 
health care industry to promote increased adoption of cybersecurity.170  These 
developments demonstrate HHS's commitment to working across the health care sector 
to better prepare for and remediate continuously evolving cyber threats. 
The Department also plays a significant role in ensuring the privacy of sensitive individual data, such as 
personal health information, genetic information, and more.  Most OpDivs are stewards of sensitive personal 
information and are required to protect such information from improper disclosure, including by external entities.  
Given the size, complexity, and constant use of this data, OpDivs face challenges in ensuring that third parties access 
this information for legitimate purposes.  Most recently, OIG found that pharmacies were accessing a CMS Medicare 
beneficiary eligibility system for inappropriate purposes, including to evaluate marketing leads or by allowing 
marketing companies to use the pharmacies' information to access to the CMS system.  This put the privacy of 
beneficiaries personal health information at risk.  As HHS and OpDivs continue to collect more data, ensuring that 
external entities access and use this information for authorized purposes will be vital to protect the privacy and 
security of millions of individuals.   
Most notably, OCR established and enforces the Health Insurance Portability and Accountability Act of 1996 (HIPAA) 
Privacy Rules requirements.  However, the bulk of the Privacy Rules requirements were established nearly 20 years 
ago and may not adequately address modern issues related to privacy concerns associated with the use and 
disclosure of protected health information.  Some of the limitations associated with HIPAA were highlighted as the 
health care industry responded to COVID-19.  In response, OCR took several actions, including exercising its 
enforcement discretion to support greater flexibilities for the types of technology used for telehealth and issuing 
guidance about sharing patient health information on COVID-19 to emergency first responders.171  OCRs response 
to COVID-19 foreshadows the need for potential future actions to address privacy issues as the health care industry 
continues to modernize.  As health care providers and patients shift to using more telehealth, remote-based care, 
and emerging technologies, new challenges related to the privacy and security of patient health information will 
arise.  The Departments challenge is to keep up with changes in the health care industry and with nontraditional 
health care entities that may impact patient privacy.  The Department has made progress by issuing guidance and 
frequently asked questions related to mobile apps, use of APIs, and working with the Federal Trade Commission to 
build a web-based tool for developers of health-related mobile apps.172   
 
 
 
36 
     
 
6: Improving 
Collaboration To Better  
Serve Our Nation  
HHS faces some of the largest and most complex issues that challenge 
 KEY TAKEAWAYS 
our  government  and  the  Nation.    These  problems  commonly 
transcend a single HHS program.  Often, HHS's mission is only one 
I.  Relevant Agency: All HHS  
piece  in  a  larger  puzzle  of  overlapping  and  coordinating 
II.  Elements of the Challenge:  
responsibilities.   For  HHS  to  achieve  its  mission,  it  needs  to 
  Combating COVID-19  
collaborate effectively, including across HHS programs and other 
  Turning the tide on the opioid 
Federal  agencies,  as  well  as  outside  the  Federal  government, 
crisis 
including with Tribal, State and local governments, international 
  Protecting children 
entities, industry, and other stakeholders.    
  Keeping patients safe 
Improving HHSs collaboration can help Americans receive more 
efficient, higher-quality health and human services and benefit from greater advances in the sciences underlying 
them.  Cross-agency efforts led by the Department, such as the Rural Health Task Force and the Secretarys 
Intradepartmental Council on Native American Affairs, along with those related to Department management and 
data, provide opportunities for HHS programs to work more efficiently and in greater alignment.  Effective 
partnerships with other Federal agencies help ensure critical initiatives and resources are working in concert, such 
as those for emergency preparedness and response and law enforcement investigations.  Established networks of 
information exchange with other governments, such as through the Secretarys Tribal Advisory Committee, can 
better allow HHS programs to reflect community needs.  Collaboration with HHSs vast array of non-governmental 
stakeholdersfrom health care providers, to food and drug manufacturers, health systems, nursing homes, 
hospices, professional associations, scientists, and community nonprofits, just to name a fewis essential to 
delivering the best services and care to the American people, and supporting HHS programs in achieving their 
intended outcomes.   
Effective collaboration is vital to success at HHS.  This need for effective collaboration crosses many of the programs 
and challenges discussed in the other TMCs, highlighting the broad and complex nature of HHSs work.  For example, 
the importance of data access and sharing across stakeholders is discussed in TMC 5.  To run effective and efficient 
programs, HHS must consider issues and impacts outside of a single program or mission of any one of its agencies.   
Barriers to HHS collaboration include navigating a breadth of stakeholders with different goals and authorities, the 
scope and complexity of the problems that HHS needs partnerships to solve, and the ever-changing landscape of the 
health and human services sectors.  Overcoming these barriers requires the Department to engage in intentional 
and sustained efforts toward building effective partnerships both domestically and internationally, communicating 
effectively, managing collaborative work, and maintaining accountability.  Recent OIG work reveals the importance 
of effective and collaborative management within HHS and with HHSs partners, and areas for improvement.   
37 
     
 
Combating COVID-19  
The  COVID-19  pandemic  underscores  the  critical  importance  of  effective 
coordination in emergency preparedness and response.  The unprecedented nature of 
the pandemic quickly increased the need for collaboration among stakeholders, including 
related to temporary emergency expansions, Federal funds distribution, managing health care 
programs, nursing home safety, vaccine development, testing, personal protective equipment (PPE) and 
respirator availability from the national stockpile, and public health guidance.   
An OIG survey of hospitals responding to COVID-19, conducted in late March 2020, found that changing and 
sometimes inconsistent guidance from Federal, State, and local authorities on issues such as testing, use of PPE, and 
obtaining supplies from the national stockpile, posed challenges and confused hospitals and the public.173  Reports 
from OIG related to coordination in past emergencies have found that by consolidating outgoing communication 
and requests for data or information, Federal agencies can reduce burden on States and other stakeholders and that 
clearly defined roles can ensure that staff are not working at cross-purposes.   
The Department has taken steps to address challenges to emergency coordination efforts.  Related to cross-agency 
coordination, ASPR, CDC, and CMS implemented a joint OIG recommendation in May 2020 to continue to help 
hospitals sustain preparedness for emerging infectious diseases (EID) by coordinating guidance and providing 
practical advice for all hospitals.174  These agencies have taken actions to update EID preparedness guidance to 
ensure that it is clear and concise, develop strategies for updating information about EID threats, and provide 
practical advice that hospitals can easily employ.  These efforts have continued during the COVID-19 response. 
Turning the Tide on the Opioid Crisis 
The COVID-19 pandemic has further challenged HHS in achieving its goal of reducing opioid morbidity and mortality.  
The pandemic may be exacerbating the nations opioid epidemic and individuals with an opioid use disorder may be 
at greater risk for COVID-19 (see TMC 1).175  A number of OpDivs within HHS and other Federal agencies play a role 
in addressing opioid abuse and misuse, and coordination among them and other partners is vital to turn the tide on 
this crisis.  State sharing of prescription drug monitoring program data, for example, may help to improve safe 
prescribing practices and prevent prescription drug abuse and misuse.176 
Part of the framework of HHSs strategy to combat opioid abuse, misuse, and overdose is supporting stakeholder 
efforts to make MAT available to all individuals with OUD who meet the eligibility criteria.  To do so, HHS has a goal 
to increase the number of MAT providers.177  Aligned with this goal, OIG recommended that SAMHSA work with its 
State partners and grantees to determine the best strategies to expand access to buprenorphine services, 
particularly targeted to high-need counties with low-to-no patient capacity, and to partner with HRSA in ongoing 
efforts to address health professional shortage areas.178  Better collaboration is a key step in helping to reduce 
geographic disparities in access to MAT.  Improved stakeholder communication may also help make MAT more 
available.  In another recent report, OIG recommended that CMS educate Medicare Part D beneficiaries and 
providers about access to drugs for MAT and naloxone and partner with SAMHSA when developing these educational 
strategies.179   
Protecting Children 
In 2017 and 2018, the Department of Justice (DOJ) and DHS took steps to increase enforcement of immigration laws, 
culminating in the spring 2018 implementation of a zero-tolerance policy for certain immigration offenses.  Under 
that policy, large numbers of families entering the United States without authorization were separated by DHS.  
38 
     
 
Typically, adults were held in Federal detention while their children 
were transferred to the care ORR within HHS.  A June 20, 2018, Executive 
Order curtailed the policy but did not address reunification of families already 
separated.  On June 26, 2018, a Federal district court issued a preliminary injunction 
prohibiting  family  separations  (subject  to  some  exceptions)  and  ordered  the  Federal 
government to quickly reunify separated families who met certain criteria.  
In a review of challenges that HHS faced in responding to the zero-tolerance policy and with reunifying 
separated children with their parents,180 OIG identified shortfalls in internal HHS communication, collaboration 
across Federal agencies, and outreach to critical stakeholders.  These challenges impeded HHS in protecting children 
in its custody.  In the Department, key senior HHS officials did not act on OpDiv staff's repeated warnings that family 
separations were occurring and might increase, which impeded the Departments ability to provide prompt and 
appropriate care for separated children when the zero-tolerance policy was implemented.  For example, HHS could 
not always place separated children in HHS-funded care provider facilities in a timely manner due to the lack of 
sufficient bed capacity.   
Problems with inter-agency coordination also limited the Departments ability to plan for the care of children in its 
custody.  For instance, Federal agencies involved in immigration did not effectively share information in advance of 
the zero-tolerance policy, despite existing channels to facilitate high-level interagency coordination and engagement 
on important immigration issues.  Furthermore, HHS and DHS did not collaborate on systems to track separated 
families across agencies for later reunification, leaving HHS to struggle to identify separated children and reunite 
them with their parents.  Additionally, poorly communicated guidance from HHS complicated care provider facilities 
ability to care for children separated from their parents.   
An audit of facilities serving children who arrive in the United States unaccompanied, as well as children who are 
separated from their parents or legal guardians by immigration authorities, found shortfalls in operations that could 
put children at risk, including related to required FBI fingerprint and out-of-State Child Protective Services 
background checks for employees.181  OIG recommendations emphasized the importance of the Administration for 
Children and Families (ACFs) monitoring of, and communication with, these facilities to help ensure childrens 
safety.    
HHS oversees numerous other programs that provide direct services to children.  Program funding may pass from 
the Federal government, to States, and then to local implementing entities that are providing such services as foster 
care and child care.  OIG audits of State compliance with employee background check and other health and safety 
requirements in HHS programs found lapses that can put children at risk,182, 183 supporting the need for better 
coordination between HHS and States to keep children safe (see TMC 4 for more information on keeping children 
safe).   
Keeping patients safe 
Health care and mental health care providers, OUD treatment, and hospice and nursing home services are among 
those on the front-line of ensuring safety for beneficiaries receiving care through HHS programs and at HHS facilities.  
Reports from OIG have identified issues with HHS coordination with, and outreach to, external partners that may 
leave patients at risk of harm, including a series of reports finding deficiencies in State Agency oversight of nursing 
homes compliance with life safety and emergency preparedness requirements.184  
Recent cases of patient abuse by IHS employees have raised concerns about protecting the AI/AN population.  The 
convictions of a former IHS pediatrician in September 2018 and 2019 brought attention to the issue and shed light 
39 
     
 
on areas requiring improvement within IHS.185,  186  An OIG report 
examining  IHS's  patient  protection  policies  emphasized,  among  other 
recommendations, the need for the agency to reach out to Tribal communities to 
inform them of patient rights, solicit community concerns, and address barriers that may 
deter patients and their families from reporting abuse.187  A memorandum to IHS on past and 
ongoing OIG audits reported that Tribal health programs that received Indian Self-Determination and 
Education Assistance Act funds from the IHS were not conducting required FBI fingerprint background 
checks for all employees, contractors, and volunteers who have regular contact with Indian children.188  This 
creates an increased risk that an individual with a disqualifying criminal history in a different State could be hired 
into a position with regular contact with Indian children. 
In response to OIGs memorandum, IHS issued a letter to Tribal leaders identifying the need for immediate action 
and steps toward a collaborative response to address this vulnerability that may compromise the safety and well-
being of Indian children who receive treatment at IHS-funded Tribal health programs.189 
Patient Safety Organizations (PSOs) are designed to reduce the risk associated with patient care by establishing an 
environment where clinicians and health care organizations can voluntarily report and analyze data.  The Agency for 
Healthcare Research and Qualitys (AHRQs) voluntary PSO program is the first and only nationwide program that 
offers legal protections for providers to disclose and learn from patient safety events.  Many hospitals that 
participate in the PSO program find that it has improved patient safety.  However, challenges to progress remain, 
including with AHRQ communication with stakeholders, such as provider associations, professional societies, and 
risk management organizations.190 
By building and sustaining effective partnerships, HHS can better safeguard and improve the programs so crucial to 
the health and well-being of the Nation.  
 
 
40 
     
 
ENDNOTES 
 
1 OIG, Selected Health Care Coalitions Increased Involvement in Whole Community Preparedness 
But Face Developmental Challenges Following New Requirements in 2017, OEI-04-18-00080, April 2020.  
Available at https://oig.hhs.gov/oei/reports/oei-04-18-00080.pdf.  
 
2 OIG, State and Local Pandemic Influenza Preparedness: Medical Surge, September 2009, OEI-02-08-00210.  
Available at https://oig.hhs.gov/oei/reports/oei-02-08-00210.pdf. 
 
3 OIG, HHS Did Not Always Efficiently Plan and Coordinate Its International Ebola Response Efforts, A-04-16-03567, 
August 2019.  Available at https://oig.hhs.gov/oas/reports/region4/41603567.pdf. 
 
4 OIG, Toolkit: Insights for Health Care Facilities From OIGs Historical Work on Emergency Response, August 2020. 
Available at https://oig.hhs.gov/reports-and-publications/featured-topics/response/toolkit-healthcare.asp. 
 
5 OIG, Gaps Continue to Exist in Nursing Home Emergency Preparedness and Response During Disasters: 2007
2010, April 2012.  Available at https://oig.hhs.gov/oei/reports/oei-06-09-00270.pdf. 
 
6 OIG, Hospitals Reported Improved Preparedness for Emerging Infectious Diseases After the Ebola Crisis, OEI-06-
15-00230, October 2018.  Available at https://oig.hhs.gov/oei/reports/oei-06-15-00230.pdf. 
 
7 OIG, Hospital Experiences Responding to the COVID-19 Pandemic: Results of a National Pulse Survey March 23
27, 2020, OEI-06-20-00300.  Available at: https://oig.hhs.gov/oei/reports/oei-06-20-00300.pdf.  
 
8 FDA, Fact Sheet: FDA at a Glance, October 2019.  Available at https://www.fda.gov/about-fda/fda-basics/fact-
sheet-fda-glance. 
 
9 FDA, Safeguarding Pharmaceutical Supply Chains in a Global Economy, October 2019.  Available at: 
https://www.fda.gov/news-events/congressional-testimony/safeguarding-pharmaceutical-supply-chains-global-
economy-10302019; FDA, Securing the U.S. Drug Supply Chain: Oversight of FDAs Foreign Inspection Program, 
December 2019.  Available at: https://www.fda.gov/news-events/congressional-testimony/securing-us-drug-
supply-chain-oversight-fdas-foreign-inspection-program-12102019.  
 
10 OIG, Drug Supply Chain Security: Wholesalers Exchange Most Tracing Information, OEI-05-14-00640, September 
2017.  Available at https://oig.hhs.gov/oei/reports/oei-05-14-00640.pdf.  OIG, Drug Supply Chain Security: 
Dispensers Received Most Tracing Information, OEI-05-16-00550, March 2018.  Available at 
https://oig.hhs.gov/oei/reports/oei-05-16-00550.pdf.    
 
11 FDA, Cybersecurity, August 2020.  Available at https://www.fda.gov/medical-devices/digital-health-center-
excellence/cybersecurity#guidance.  
 
12 OIG, FDA Should Further Integrate Its Review of Cybersecurity Into the Premarket Review Process for Medical 
Devices, OEI-09-16-00220, September 2018.  Available at: https://oig.hhs.gov/oei/reports/oei-09-16-00220.pdf. 
OIG, The Food and Drug Administrations Policies and Procedures Should Better Address Postmarket Cybersecurity 
Risk to Medical Devices, A-18-16-30530, October 2018. Available at 
https://oig.hhs.gov/oas/reports/region18/181630530.pdf. 
 
13 CDC, CDC and Food Safety, June 2020.  Available at https://www.cdc.gov/foodsafety/cdc-and-food-safety.html/. 
 
41 
     
 
 
 
14 FDA, What does FDA regulate? August 2020.  Available at: https://www.fda.gov/about-fda/fda-basics/what-
does-fda-regulate.  
 
15 OIG, Challenges Remain in FDA's Inspections of Domestic Food Facilities, OEI-02-14-00420, September 2017.  
Available at https://oig.hhs.gov/oei/reports/oei-02-14-00420.pdf.  OIG, The Food and Drug Administration's Food-
Recall Process Did Not Always Ensure the Safety of the Nation's Food Supply, A-01-16-01502, December 2017.  
Available at https://oig.hhs.gov/oas/reports/region1/11601502.pdf.   
 
16 SAMHSA, Key Substance Use and Mental Health Indicators in the United States: 
Results from the 2018 National Survey on Drug Use and Health, August 2019.  Available at 
https://www.samhsa.gov/data/sites/default/files/cbhsq-
reports/NSDUHNationalFindingsReport2018/NSDUHNationalFindingsReport2018.pdf.  
 
17 CDC, Drug Overdose Deaths, March 2020.  Available at 
https://www.cdc.gov/drugoverdose/data/statedeaths.html, citing Hedegaard H, Minino AM, Warner M, Drug 
overdose deaths in the United States, 19992018, NCHS Data Brief, no. 356, National Center for Health Statistics, 
2020.  Available at https://www.cdc.gov/nchs/products/databriefs/db356.htm.   
 
18 Hedegaard H, Minino AM, Warner M, Drug overdose deaths in the United States, 19992018, NCHS Data Brief, 
no. 356, National Center for Health Statistics, 2020.  Available at 
https://www.cdc.gov/nchs/products/databriefs/db356.htm.   
 
19 HHS, Combatting an Epidemic: Legislation to Help Patients with Substance Use Disorder, Testimony before the 
House Subcommittee on Health of the Committee on Energy and Commerce, March 3, 2020.  Available at 
https://energycommerce.house.gov/sites/democrats.energycommerce.house.gov/files/documents/Testimony-
Giroir_Brandt-Opioid%20Legislative%20Hearing_030320.pdf.  
 
20 NIH, COVID-19: Potential Implications for Individuals with Substance Use Disorders, April 2020.  Available at 
https://www.drugabuse.gov/about-nida/noras-blog/2020/04/covid-19-potential-implications-individuals-
substance-use-disorders.   
 
21 Ibid. 
 
22 OIG, Medicare Part D Beneficiaries at Serious Risk of Opioid Misuse or Overdose: A Closer Look, OEI-02-19-00130, 
May 2020.  Available at https://oig.hhs.gov/oei/reports/oei-02-19-00130.pdf. 
 
23 OIG, IHS Needs To Improve Oversight of Its Hospitals Opioid Prescribing and Dispensing Practices and Consider 
Centralizing  Its  Information  Technology  Functions,  A-18-17-11400,  July  2019.    Available  at 
https://oig.hhs.gov/oas/reports/region18/181711400.pdf. 
  
24 FDA, Opioid Analgesic Drugs: Considerations for Benefit-Risk Assessment Framework 
Guidance for Industry, June 2019.  Available at https://www.fda.gov/media/128150/download.  FDAs 2018 
Strategic Policy Roadmap, January 2018.  Available at https://www.fda.gov/media/110587/download.  
 
25 FDA, Opioid Medications, August 2020.  Available at https://www.fda.gov/drugs/information-drug-class/opioid-
medications.  FDA, Information about Medication-Assisted Treatment (MAT), February 2019 .  Available at: 
https://www.fda.gov/drugs/information-drug-class/information-about-medication-assisted-treatment-mat. 
 
 
42 
     
 
 
26 NIH funds $945 million in research to tackle the national opioid crisis through NIH HEAL Initiative.  Available at 
https://www.nih.gov/news-events/news-releases/nih-funds-945-million-research-tackle-national-opioid-crisis-
through-nih-heal-initiative.  
 
27 SAMHSA, Key Substance Use and Mental Health Indicators in the United States: 
Results from the 2018 National Survey on Drug Use and Health, August 2019.  Available at 
https://www.samhsa.gov/data/sites/default/files/cbhsq-
reports/NSDUHNationalFindingsReport2018/NSDUHNationalFindingsReport2018.pdf.  
 
28 OIG, Geographic Disparities Affect Access to Buprenorphine Services for Opioid Use Disorder, OEI-12-17-00240, 
January 2020.  Available at https://oig.hhs.gov/oei/reports/oei-12-17-00240.pdf.  
 
29 OIG, States Use of Grant Funding for a Targeted Response to the Opioid Crisis, OEI-BL-18-00460, March 2020.  
Available at https://oig.hhs.gov/oei/reports/oei-BL-18-00460.pdf. 
 
30 OIG, HRSAs Monitoring Did Not Always Ensure Health Centers Compliance with Federal Requirements for 
HRSAs Access Increases In Mental Health and Substance Abuse Services Supplemental Grant Funding, A-02-18-
02010, July 2020.  Available at https://oig.hhs.gov/oas/reports/region2/21802010.asp. 
 
31 USASpending.gov, Agency Spending Profile.  https://www.usaspending.gov/agency. 
 
32 CMS, CMS Fast Facts, July 2020.   https://www.cms.gov/Research-Statistics-Data-and-Systems/Statistics-Trends-
and-Reports/CMS-Fast-Facts. 
 
33 CMS, Financial Report, FY 2019.  Available at https://www.cms.gov/files/document/cms-financial-report-fiscal-
year-2019. 
 
34 CMS, CMS Fast Facts, July 2020.   https://www.cms.gov/Research-Statistics-Data-and-Systems/Statistics-Trends-
and-Reports/CMS-Fast-Facts. 
 
35 CMS, Trustees Report & Trust Funds, April 2020.  Available at https://www.cms.gov/Research-Statistics-Data-
and-Systems/Statistics-Trends-and-Reports/ReportsTrustFunds. 
 
36HHS, Budget in Brief, FY 2021. Pg. 19.  Available at https://www.hhs.gov/sites/default/files/fy-2021-budget-in-
brief.pdf. 
 
37 HHS Tracking Accountability in Government Grants System (TAGGS), Grants by OPDIV report.  Available at 
https://taggs.hhs.gov/ReportsGrants/GrantsByOPDIV. 
 
38 As of August 31, 2020, HHS awarded $160.7 billion for contractual services and supplies.  USASpending.gov, 
Contractual services and supplies spending.  Available at:  https://www.usaspending.gov/explorer/object_class.  
 
39 According to the 2020 Annual Report of the Board of Trustees of the Federal Hospital Insurance and Federal 
Supplementary Medical Insurance Trust Funds, the Trustees stated that the Federal Hospital Insurance Trust Fund 
is expected to be depleted in 2026.  Available at https://www.cms.gov/files/document/2020-medicare-trustees-
report.pdf. 
 
40 GAO, U.S. Governments 2019 and 2018 Consolidated Financial Statement.  Available at 
https://www.gao.gov/products/GAO-20-315R. 
 
 
43 
     
 
 
41 OIG, Medicare Could Have Saved Billions at Critical Access Hospitals if Swing-Bed Services Were Reimbursed 
Using the Skilled Nursing Facility Prospective Payment System Rates, A-05-12-00046, March 2015.  Available at 
https://oig.hhs.gov/oas/reports/region5/51200046.asp. 
 
42 CMS, National Health Expenditures by type of service and source of funds, CY 1960-2018, December 2019.  
Available at https://www.cms.gov/Research-Statistics-Data-and-Systems/Statistics-Trends-and-
Reports/NationalHealthExpendData/NationalHealthAccountsHistorical. 
 
43 OIG, Increases in Reimbursement for Brand Name Drugs in Part D, OEI-03-15-00080, June 2018.  Available at 
https://oig.hhs.gov/oei/reports/oei-03-15-00080.asp. 
 
44 The specific drugs at issue were inhalation drugs administered through DME and supplying fees for 
immunosuppressive drugs associated with an organ transplant, oral anticancer chemotherapeutic drugs and oral 
antiemetic drugs used as a part of an anticancer chemotherapeutic regimen.  See OIG, Medicare Part B Prescription 
Drug Dispensing and Supplying Fee Payment Rates Are Considerably Higher Than the Rates Paid by Other 
Government Programs, A-06-12-00038, September 2014.  Available at 
https://oig.hhs.gov/oas/reports/region6/61200038.asp. 
 
45 OIG, Issue Brief: Excluding Noncovered Versions When Setting Payment for Two Part B Drugs Would Have 
resulted in Lower Drug Costs for Medicare and its Beneficiaries, OEI-12-17-00260, November 2017.  Available at 
https://oig.hhs.gov/oei/reports/oei-12-17-00260.pdf. 
 
46 31 USC  3351(4) 
 
47GAO, Payment Integrity: Federal Agencies Estimates of FY 2019 Improper Payments.  Available at  
https://www.gao.gov/assets/710/705016.pdf. 
 
48 HHS, 2019 Agency Financial Report.  Available at https://www.hhs.gov/sites/default/files/fy2019-hhs-agency-
financial-report.pdf. 
 
49 CMS, 2019 Medicare Fee-for-Service Supplemental Improper Payment Data.  Available at 
https://www.cms.gov/research-statistics-data-and-systemsmonitoring-programsmedicare-ffs-compliance-
programscertcert/2019-medicare-fee-service-supplemental-improper-payment-data. 
 
50 OIG, Online Portfolio: Home Health, February 2016.  Available at https://oig.hhs.gov/reports-and-
publications/portfolio/home-health/.  OIG, Vulnerabilities in the Medicare Hospice Program Affect Quality Care 
and Program Integrity: An OIG Portfolio, OEI-02-16-00570, July 2018.  Available at 
https://oig.hhs.gov/oei/reports/oei-02-16-00570.asp.  OIG, CMS Improperly Paid Millions of Dollars for Skilled 
Nursing Facility Services When the Medicare 3-Day Inpatient Hospital Stay Requirement Was Not Met, A-05-16-
00043, February 2019.  Available at https://oig.hhs.gov/oas/reports/region5/51600043.pdf.  OIG, Medicare 
Improperly Paid Suppliers for Durable Medical Equipment, Prosthetics, Orthotics, and Supplies Provided to 
Beneficiaries During Inpatient Stays, A-09-17-03035, November 2018.  Available at 
https://oig.hhs.gov/oas/reports/region9/91703035.pdf.  OIG, Medicare Improperly Paid Providers for Items and 
Services Ordered by Chiropractors, A-07-17-03002, July 2018.  Available at 
https://oig.hhs.gov/oas/reports/region9/91602033.pdf.  OIG, Medicare Improperly Paid Hospitals Millions of 
Dollars for Intensity-Modulated Radiation Therapy Planning Services, A-09-16-02033, August 2018.  Available at 
https://oig.hhs.gov/oas/reports/region9/91602033.pdf. 
 
51 OIG, Billions in Estimated Medicare Advantage Payments From Chart Reviews Raise Concerns, OEI-03-17-00470, 
December 2019.  Available at https://oig.hhs.gov/oei/reports/oei-03-17-00470.asp. 
 
44 
     
 
 
 
52 OIG, Medicare Advantage Appeal Outcomes and Audit Findings Raise Concerns About Service and Payment 
Denials, OEI-09-16-00410, September 2018.  Available at https://oig.hhs.gov/oei/reports/oei-09-16-00410.asp. 
 
53 CMS, 2019 PERM Medicaid Improper Payment Rates.  Available at https://www.cms.gov/Research-Statistics-
Data-and-Systems/Monitoring-Programs/Medicaid-and-CHIP-
Compliance/PERM/PERMErrorRateFindingsandReport. 
 
54 CMS, Fiscal Year (FY) 2019 Medicare Fee-For-Service Improper Payment Rate is Lowest Since 2010 while data 
points to concerns with Medicaid eligibility.  Available at https://www.cms.gov/newsroom/press-releases/fiscal-
year-fy-2019-medicare-fee-service-improper-payment-rate-lowest-2010-while-data-points. 
 
55 OIG, Vulnerabilities Exist in State Agencies' Use of Random Moment Sampling To Allocate Costs for Medicaid 
School-Based Administrative and Health Services Expenditures, December 2018.  Available at 
https://oig.hhs.gov/oas/reports/region7/71804107.asp.  OIG, Michigan Did Not Always Comply With Federal and 
State Requirements for Claims Submitted for the Nonemergency Medical Transportation Brokerage Program, A-5-
16-00021, June 2018.  Available at https://oig.hhs.gov/oas/reports/region5/51600021.asp.  OIG, Minnesota Did 
Not Always Comply With Federal and State Requirements for Claims Submitted for the Nonemergency Medical 
Transportation Brokerage Program, A-05-15-00026, September 2017.  Available at 
https://oig.hhs.gov/oas/reports/region5/51500026.asp.  OIG, Oklahoma Did Not Adequately Oversee Its Medicaid 
Nonemergency Medical Transportation Program, A-06-16-00007, August, 2017.  Available at 
https://oig.hhs.gov/oas/reports/region6/61600007.asp.  OIG, Work Plan: Medicaid Targeted Case Management, 
2020.  Available at https://oig.hhs.gov/reports-and-publications/workplan/summary/wp-summary-0000235.asp. 
OIG, Personal Care Services Portfolio.  Available at https://oig.hhs.gov/newsroom/media-materials/2016/mpcs.asp. 
 
56 OIG, Featured Topic: Unaccompanied Children, August 2020.  Available at https://oig.hhs.gov/reports-and-
publications/featured-topics/uac/. 
 
57 OIG, Recommendation Followup: Vulnerabilities Continue To Exist in the HHS Small Business Innovation Research 
Program, OEI-04-18-00230, March 2019.  Available at https://oig.hhs.gov/oei/reports/oei-04-18-00230.asp. 
 
58 31 USC  3351-3358. 
 
59 OIG, U.S. Department of Health and Human Services Met Many Requirements of the Improper Payments 
Information Act of 2002 but Did Not Fully Comply for Fiscal Year 2019, A-17-20-52000, May 2020.  Available at 
https://oig.hhs.gov/oas/reports/region17/172052000.asp. 
 
60 Congressional Research Service, The Temporary Assistance for Needy Families (TANF) Block Grant: Responses to 
Frequently Asked Questions, July 2020.  Available at:  https://fas.org/sgp/crs/misc/RL32760.pdf. 
 
61 OIG, The Centers for Medicare & Medicaid Services Did Not Identify and Report Potential Antideficiency Act 
Violations for 12 Contracts Used To Establish the Federal Marketplace Under the Affordable Care Act, A-03-16-
03001, February 2020.  Available at https://oig.hhs.gov/oas/reports/region3/31603001.asp. 
 
62 OIG, CMS Did Not Administer and Manage Strategic Communications Services Contracts in Accordance With 
Federal Requirements, A-12-19-20003, July 2020.  Available at 
https://oig.hhs.gov/oas/reports/region12/121920003.asp. 
 
63 HHS, CARES Act Provider Relief Fund:  General Information.  Available at 
https://www.hhs.gov/coronavirus/cares-act-provider-relief-fund/general-information/index.html#timeline. 
 
45 
     
 
 
 
64 HHS, Coronavirus (COVID-19) Grant Opportunities and Guidance.  Available at 
https://www.hhs.gov/coronavirus/grants/index.html#covid19. 
 
65 CMS, Medicaid Managed Care Enrollment and Program Statistics, 2017.  Available at 
https://www.medicaid.gov/medicaid/managed-care/downloads/enrollment/2017-medicaid-managed-care-
enrollment-report.pdf. 
 
66 OIG, Weaknesses Exist in Medicaid Managed Care Organizations' Efforts To Identify and Address Fraud and 
Abuse, OEI-02-15-00260, July 2018.  Available at https://oig.hhs.gov/oei/reports/oei-02-15-00260.asp. 
 
67 OIG, Billions in Estimated Medicare Advantage Payments From Chart Reviews Raise Concerns, OEI-03-17-00470, 
December 2019.  Available at https://oig.hhs.gov/oei/reports/oei-03-17-00470.asp. 
 
68 OIG, Billions in Estimated Medicare Advantage Payments From Diagnoses Reported Only on Health Risk 
Assessments Raise Concerns, OEI-03-17-00471, September 2020.  Available at https://oig.hhs.gov/oei/reports/oei-
03-17-00471.asp. 
 
69 OIG, Medicare Advantage Appeal Outcomes and Audit Findings Raise Concerns About Service and Payment 
Denials, OEI-09-16-00410, September 2018.  Available at https://oig.hhs.gov/oei/reports/oei-09-16-00410.asp. 
 
70 OIG, CMS's Encounter Data Lack Essential Information That Medicare Advantage Organizations Have the Ability 
to Collect, OEI-03-19-00430, August 2020.  Available at https://oig.hhs.gov/oei/reports/OEI-03-19-00430.asp. 
 
71 OIG, Medicare Advantage Encounter Data Show Promise for Program Oversight, But Improvements Are Needed, 
OEI-03-15-00060, January 2018.  Available at https://www.oig.hhs.gov/oei/reports/oei-03-15-00060.asp. 
 
72 OIG has found that some Tribes and Tribal organizations have not adequately protected funds under the Indian 
Self-Determination and Education Assistance Act and other programs, resulting in embezzlement and theft of 
Federal funds. 
 
73 HHS codified the Uniform Guidance at 45 CFR part 75, which prescribes instructions and other pre-award 
matters for the granting agency to use in the announcement and application process for awards made on or after 
December 26, 2014.  The Uniform Guidance stipulates that the use of certain sections is required only for 
competitive Federal awards but may also be used by the HHS awarding agency for non-competitive awards where 
appropriate or required by Federal statute.   
 
74 OIG, Key Medicare Tools To Safeguard Against Pharmacy Fraud and Inappropriate Billing Do Not Apply to Part D, 
OEI-02-15-00440, March 2020.  Available at https://oig.hhs.gov/oei/reports/oei-02-15-00440.asp. 
 
75 OIG, Two Indian Health Service Hospitals Had System Security and Physical Controls for Prescription Drug and 
Opioid Dispensing but Could Still Improve Controls, A-18-1630540, November 2017.  Available at 
https://oig.hhs.gov/oas/reports/region18/181630540.pdf. 
 
76 See, e.g., Examining Efforts to Prevent Opioid Overutilization and Misuse in Medicare and Medicaid, Testimony 
of Maureen Dixon, pp. 45, May 2019.  Available at https://oig.hhs.gov/testimony/docs/2018/dixon-
testimony052918.pdf. 
 
 
46 
     
 
 
77 OIG, The Centers for Medicare & Medicaid Services Could Improve Performance Measures Associated With the 
Fraud Prevention System, A-01-15-00509, September 2017.  Available at 
https://oig.hhs.gov/oas/reports/region1/11500509.pdf. 
 
78 OIG, Problems Remain for Ensuring That All High Risk Medicaid Providers Undergo Criminal Background Checks, 
July 2019.  Available at https://oig.hhs.gov/oei/reports/oei-05-18-00070.asp. 
 
79 OIG, Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries, OEI-05-19-
00060, March 2020.  Available at https://oig.hhs.gov/oei/reports/oei-05-19-00060.asp. 
 
80 OIG, States Could Do More To Prevent Terminated Providers From Serving Medicaid Beneficiaries, OEI-03-19-
00070, March 2020.  Available at https://oig.hhs.gov/oei/reports/oei-03-19-00070.asp. 
 
81 OIG, U.S. Department of Health and Human Services Met the Requirements of the Digital Accountability and 
Transparency Act of 2014, With Areas That Require Improvement, A-17-19-54000, October 2019.  Available at 
https://oig.hhs.gov/oas/reports/region17/171954000.asp. 
 
82 HHS, 2019 Agency Financial Report.  Available at https://www.hhs.gov/sites/default/files/fy2019-hhs-agency-
financial-report.pdf. 
 
83 Ibid. 
 
84 This TMC focuses on Medicare and Medicaid.  The Department funds other vital health services, such as IHS, 
substance abuse treatment facilities, and Federally Qualified Health Centers, which are addressed in other TMCs.   
 
85 CMS, CMS Innovation Center COVID-19 Flexibilities, June 2020.  Available at 
https://innovation.cms.gov/innovation-models/covid-19-flexibilities.  
 
86 The Healthcare Payment Learning & Action Network, APM Measurement: Progress of Alternate Payment Models 
Methodology and Results Report, 2019,  http://hcp-lan.org/workproducts/apm-methodology-2019.pdf,Pursuant to 
the LAN framework, the higher figure represents categories 2, 3, and 4 models and the lower figure represents 
only categories 3 and 4.  The report also includes data for Medicare Advantage and commercial insurance.   
 
87 HHS, 2019 Agency Financial Report.  Available at https://www.hhs.gov/sites/default/files/fy2019-hhs-agency-
financial-report.pdf. 
 
88 CMS, 2019 PERM Medicaid Improper Payment Rates.  Available at https://www.cms.gov/Research-Statistics-
Data-and-Systems/Monitoring-Programs/Medicaid-and-CHIP-
Compliance/PERM/PERMErrorRateFindingsandReport.  
 
89 Speech: Remarks by Administrator Seema Verma at the 2019 CMS Quality Conference, January 29, 2019.  
Available at https://www.cms.gov/newsroom/press-releases/speech-remarks-administrator-seema-verma-2019-
cms-quality-conference. 
 
90  HHS, National Health Quality Roadmap, May 2020.  Available at https://www.hhs.gov/about/leadership/eric-d-
hargan/quality-roadmap/index.html.  The authors note that some project timelines in the Roadmap will be pushed 
back due to the COVID-19 pandemic. 
 
91 OIG, ACOs' Strategies for Transitioning to Value-Based Care: Lessons From the Medicare Shared Savings Program, 
OEI-02-15-00451, July 2019.  Available at https://oig.hhs.gov/oei/reports/oei-02-15-00451.pdf.  
 
47 
     
 
 
 
92 84 Fed. Reg. 55766 (Oct. 17, 2019); 84 Fed. Reg. 55694 (Oct. 17, 2019); 85 Fed. Reg. 42986 (July 15, 2020); 83 
Fed. Reg. 64302 (Dec. 14, 2018).    
 
93  OIG, Registered Nurses Did Not Always Visit Medicare Beneficiaries Homes at Least Once Every 14 Days to 
Assess Quality of Care and Services Provided by Hospice Aides, A-09-18-03022, November 2019.  Available at 
https://oig.hhs.gov/oas/reports/region9/91803022RIB.pdf. 
 
94 OIG, Using Health IT for Care Coordination: Insights From Six Medicare Accountable Care Organizations, OEI-01-
16-00180, May 2019.  Available at https://oig.hhs.gov/oei/reports/oei-01-16-00180.pdf.  
 
95 OIG, Many Medicaid-Enrolled Children Treated for ADHD Did Not Receive Recommended Followup Care, OEI-07-
17-00170, August 2019.  Available at https://oig.hhs.gov/oei/reports/oei-07-17-00170.pdf.     
 
96 OIG, 2019: Vulnerabilities in Hospice Care.  Available at https://oig.hhs.gov/newsroom/media-
materials/2019/hospice/.   
 
97 OIG, Adverse Events in Hospitals: National Incidence Among Medicare Beneficiaries, OEI-06-09-00090, November 
2010.  Available at https://oig.hhs.gov/oei/reports/oei-06-09-00090.pdf.   
OIG, Adverse Events in Skilled Nursing Facilities: National Incidence Among Medicare Beneficiaries, OEI-06-11-00370, 
February 2014.  Available at https://oig.hhs.gov/oei/reports/oei-06-11-00370.pdf.   
OIG, Adverse Events in Inpatient Rehabilitation Facilities (IRF): National Incidence Among Medicare Beneficiaries, 
OEI-06-14-00110, July 2016.  Available at https://oig.hhs.gov/oei/reports/oei-06-14-00110.pdf.   
OIG, Adverse Events in Long-term Care Hospitals: National Incidence Among Medicare Beneficiaries, OEI-06-14-
00530, November 2018.  Available at https://oig.hhs.gov/oei/reports/oei-06-14-00530.pdf.  
 
98 OIG, Hospital Incident Reporting Systems Do Not Capture Most Patient Harm, OEI-06-09-00091, January 2012.  
Available at https://oig.hhs.gov/oei/reports/oei-06-09-00091.asp. 
 
99 OIG, Adverse Events In Hospitals: National Incidence Among Medicare Beneficiaries10-Year Update, OEI-06-18-
00400, estimated November 2020.   
 
100 OIG, Hospice Deficiencies Pose Risks to Medicare Beneficiaries, OEI- 02-17-00020, July 2019.  Available at 
https://oig.hhs.gov/oei/reports/oei-02-17-
00020.asp?utm_source=mmpage&utm_medium=web&utm_campaign=OEI-02-17-00020. 
 
101 OIG, Corporate Integrity Agreement.  Available at  
https://oig.hhs.gov/fraud/cia/agreements/Vanguard_Healthcare_LLC_Vanguard_Healthcare_Services_LLC_Boulev
ard_Terrace_LLC_Glen_Oaks_LLC_Imperial_Gardens_Health_and_Rehabilitation_Vanguard_of_Manchester_%20L
LC_Vanguard_Financial_Svcs_LLC_etal_01092019.pdf. 
 
102 OIG, Indian Health Service Hospitals: More Monitoring Needed to Ensure Quality Care, OEI-06-14-00010, 
October 2016.  Available at https://oig.hhs.gov/oei/reports/oei-06-14-00010.pdf.  OIG, Longstanding Challenges 
Warrant Focused Attention To Support Quality Care, OEI-06-14-00011, October 2016.  Available at 
https://oig.hhs.gov/oei/reports/oei-06-14-00011.pdf.  
 
103 IHS, Quality at IHS.  Available at https://www.ihs.gov/quality/. 
 
104 OIG, Vulnerabilities in the Medicare Hospice Program Affect Quality Care and Program Integrity: An OIG 
Portfolio, OEI-02-16-00570, July 2018.  Available at https://www.oig.hhs.gov/oei/reports/oei-02-16-00570.pdf.  
 
48 
     
 
 
 
105 OIG, CMS Guidance to State Survey Agencies on Verifying Correction of Deficiencies Needs To Be Improved To 
Help Ensure the Health and Safety of Nursing Home Residents, A-09-18-02000, February 2019.  Available at 
https://oig.hhs.gov/oas/reports/region9/91802000.pdf.  
 
106 OIG, Indian Health Service Hospitals: More Monitoring Needed to Ensure Quality Care, OEI-06-14-00010, 
October 2016.  Available at https://oig.hhs.gov/oei/reports/oei-06-14-00010.pdf.   
OIG, Longstanding Challenges Warrant Focused Attention To Support Quality Care, OEI-06-14-00011, October 
2016.  Available at https://oig.hhs.gov/oei/reports/oei-06-14-00011.pdf.   
OIG, Rosebud Hospital, Indian Health Service Management of Emergency Department Closure and Reopening, A 
Case Study, OEI-06-17-00270, July 2019.  Available at https://oig.hhs.gov/oei/reports/oei-06-17-00270.pdf. 
 
107 OIG, Separated Children Placed in Office of Refugee Resettlement Care, OEI-BL-18-00511, January 2019.  
Available at https://www.oig.hhs.gov/oei/reports/oei-BL-18-00511.pdf.   
 
108 OIG, The Tornillo Influx Care Facility: Concerns About Staff Background Checks and Number of Clinicians on Staff, 
A-12-19-20000, November 27, 2018.  Available at https://oig.hhs.gov/oas/reports/region12/121920000.pdf. 
 
109 OIG, Unaccompanied Alien Children Program Care Provider Facilities Do Not Include All Required Security 
Measures in Their Checklists, OEI-05-19-00210, June 2020.  Available at  https://oig.hhs.gov/oei/reports/oei-05-19-
00210.pdf.  
 
110 OIG, The Office of Refugee Resettlements Incident Reporting System Is Not Effectively Capturing Data to Assist 
Its Efforts to Ensure the Safety of Minors in HHS Custody, OEI-09-19-00430, June 2020.  Available at 
https://oig.hhs.gov/oei/reports/oei-09-18-00430.pdf.  
 
111 DOJ, U.S. Attorneys Office, District of Montana, White House Announces Presidential Task Force on Protecting 
Native American Children in the Indian Health Service System, March 26, 2019.  Available at 
https://www.justice.gov/usao-mt/pr/white-house-announces-presidential-task-force-protecting-native-american-
children-indian. 
 
112 Presidential Task Force on Protecting Native American Children in the Indian Health Service System.  Report, 
July 23, 2020.  Available at https://www.whitehouse.gov/wp-content/uploads/2020/07/Task-Force-Report-
Protecting-Native-American-Children-in-the-Indian-Health-Service-System-April-2020.pdf.  
 
113 OIG, Indian Health Service Has Strengthened Patient Protection Policies but Must Fully Integrate Them Into 
Practice and Organizational Culture, OEI-06-19-00330, December 2019.  Available at 
https://oig.hhs.gov/oei/reports/oei-06-19-00330.pdf. 
 
114 OIG, The Tornillo Influx Care Facility: Concerns About Staff Background Checks and Number of Clinicians on Staff, 
A-12-19-20000, November 27, 2018.  Available at https://oig.hhs.gov/oas/reports/region12/121920000.pdf.   
 
115 OIG, All Six States Reviewed Had Partially Implemented New Criminal Background Check Requirements for 
Childcare Providers, and Five of the States Anticipate Full Implementation by Fiscal Year 2020, A-05-19-00015, 
August 2019.  Available at https://oig.hhs.gov/oas/reports/region5/51900015.asp. 
 
116 OIG, Tribal Health Programs: Concerns About Background Verifications for Staff Working With Indian Children, 
A-01-20-01500, August 2020.  Available at:  https://oig.hhs.gov/oas/reports/region1/12001500.asp. 
 
 
49 
     
 
 
117 OIG, National Background Check Program for Long-Term-Care Providers: Assessment of State Programs 
Concluded in 2017 and 2018, OEI-07-18-00290, August 2019.  Available at https://oig.hhs.gov/oei/reports/oei-07-
18-00290.asp.  See also: OIG, National Background Check Program for Long-Term-Care Providers: Assessment of 
State Programs Concluded Between 2013 and 2016, OEI-07-16-00160, April 2019.  Available at 
https://oig.hhs.gov/oei/reports/oei-07-16-00160.asp.   
 
118CMS, CMS Fast Facts, July 2019.  Available at https://www.cms.gov/research-statistics-data-and-
systems/statistics-trends-and-reports/cms-fast-facts/index.html.  
 
119 OIG, Joint Report: Ensuring Beneficiary Health and Safety in Group Homes Through State Implementation of 
Comprehensive Compliance Oversight, January 2018  Available at https://oig.hhs.gov/reports-and-
publications/featured-topics/group-homes/group-homes-joint-report.pdf.   
 
120 OIG, Incidents of Potential Abuse and Neglect at Skilled Nursing Facilities Were Not Always Reported and 
Investigated, A-01-16-00509, June 2019.  Available at https://oig.hhs.gov/oas/reports/region1/11600509.pdf. 
 
121 OIG, CMS Could Use Medicare Data To Identify Instances of Potential Abuse or Neglect, A-01-17-00513, June 
2019.  Available at https://oig.hhs.gov/oas/reports/region1/11700513.pdf.  
 
122CMCS Informational Bulletin: Health and Welfare of Home and Community Based Services (HCBS) Waiver 
Recipients, June 2018.  Available at https://www.medicaid.gov/federal-policy-guidance/downloads/cib062818.pdf. 
 
123 OIG, A Resource Guide for Using Diagnosis Codes in Health Insurance Claims to Help Identify Unreported Abuse 
or Neglect, A-01-19-00502, July 2019.  Available at 
https://oig.hhs.gov/oas/reports/region1/11900502.asp?utm_source=website&utm_medium=asp&utm_campaign
=abuse-neglect-guide.  
 
124 OIG, Medicaid Data Can Be Used To Identify Instances of Potential Child Abuse Or Neglect, A-01-19-00001, July 
2020.  Available at https://oig.hhs.gov/oas/reports/region1/11900001.pdf.  
 
125 The Foundation for Evidence Based Policymaking Act of 2018, P.L. 111-435 (Jan. 14, 2019); Federal Data Strategy 
2020 Action Plan.  Available at https://strategy.data.gov/assets/docs/2020-federal-data-strategy-action-plan.pdf. 
 
126 ReImagine HHS is a transformation effort to improve the Departments ability to enhance the health and 
wellbeing of all Americans.  In spring 2017, OMB released Memorandum M-17-22, requiring all Cabinet-level 
agencies to develop a plan to become more effective, efficient, and accountable.  In response, HHS formed 
ReImagine HHS.  
 
127 Office of the Chief Technology Officers, Leveraging Data for the Nations Health: A vision for inter-agency data 
sharing for the U.S. Department of Health and Human Services, December 2019.  Available at 
https://www.hhs.gov/sites/default/files/master-future-state-508.pdf.  Federal Data Strategy: Principles and 
Practices.  Available at https://strategy.data.gov/.  
 
128 HHS Protect: Frequently Asked Questions, July 2020.  Available at 
https://www.hhs.gov/about/news/2020/07/20/hhs-protect-frequently-asked-questions.html. 
  
129 CMS IFC Rule release on August 25, 2020 (https://www.cms.gov/files/document/covid-ifc-3-8-25-20.pdf).  Will 
update once rule is in Federal Register and cite to hospital reporting requirements.  
 
 
50 
     
 
 
130 The COVID-19 Tracking Project, August 2020.  Available at https://covidtracking.com/blog/hospitalization-data-
reported-by-the-hhs-vs-the-states-jumps-drops-and-other.  
 
131 Office of the Assistant Secretary for Planning and Evaluation, Improving Data for Decision Making: HHS Data 
Collection Strategies for a Transformed Health System, December 2011.  Available at https://aspe.hhs.gov/basic-
report/improving-data-decision-making-hhs-data-collection-strategies-transformed-health-system. 
 
132 Office of the Chief Technology Officer, The State of Data Sharing at the U.S. Department of Health and Human 
Services (Sept. 2018).  Available at https://www.hhs.gov/sites/default/files/HHS_StateofDataSharing_0915.pdf. 
 
133 HHS Protect: Frequently Asked Questions, July 2020.  Available at 
https://www.hhs.gov/about/news/2020/07/20/hhs-protect-frequently-asked-questions.html. 
 
134 Remarks by CDC Director Robert Redfield and HHS Chief Information Officer Jose Arrieta on COVID-19 Data 
Collection, July 2020.  Available at https://www.hhs.gov/about/news/2020/07/15/prepared-remarks-from-hhs-
media-call-cdc-director-redfield-cio-arrieta-covid-19-data-collection.html.  
 
135 HHS, COVID-19 Guidance for Hospital Reporting and FAQs For Hospitals, Hospital Laboratory, and Acute Care 
Facility Data Reporting, July 2020.  Available at https://www.hhs.gov/sites/default/files/covid-19-faqs-hospitals-
hospital-laboratory-acute-care-facility-data-reporting.pdf. 
 
136 Foundations for Evidence-Based Policymaking Act of 2018, P.L. 111-435 (Jan. 14, 2019).  Enterprise data 
governance is one of the four areas that is part of the Federal Data Strategy.  Available at 
https://strategy.data.gov/.  The Federal Data Strategy Action Plan requires all Federal agencies to make several 
data governance improvements, including establishing a data governance body.  Action 12: Constitute a Diverse 
Data Governance Body.  Available at https://strategy.data.gov/action-plan/#action-12-constitute-a-diverse-data-
governance-body. 
 
137 HHS Strategic Plan FY 20182022, Strategic Goal 5: Promote Effective and Efficient Management and 
Stewardship.  Available at https://www.hhs.gov/about/strategic-plan/strategic-goal-5/index.html#obj_5_3.  Digital 
Strategy at HHS.  Available at https://www.hhs.gov/web/governance/digital-strategy/index.html.  
 
138 Office of the Chief Technology Officer, Leveraging Data for the Nations Health: A vision for inter-agency data 
sharing for the U.S. Department of Health and Human Services, December 2019.  Available at 
https://www.hhs.gov/sites/default/files/master-future-state-508.pdf.  
 
139 The CARES Act appropriated $500 million to the CDC for public health data surveillance and analytics 
infrastructure modernization.   
 
140 T-MSIS is a joint effort by the States and CMS to build a national Medicaid data set that addresses identified 
problems with prior Medicaid data sets.  CMS intends for T-MSIS to provide States and the Federal Government 
with a national Medicaid data repository that would, among other functions, support program management, 
financial management, and program integrity.  CMS, State Health Official Letter, SHO #18-008, August 10, 2018.  
Available at https://www.medicaid.gov/federal-policy-guidance/downloads/sho18008.pdf. 
 
141 OIG, National Review of Opioid Prescribing in Medicaid is Not Yet Possible, OEI-05-18-00480, August 2019.  
Available at https://oig.hhs.gov/oei/reports/oei-05-18-00480.pdf.  
 
 
51 
     
 
 
142 OIG work has shown that databases such as ACFs Program Information Report, FDA's Food Facility Registry and 
its National Drug Code Directory, HRSAs 340B covered-entity database, and IHS's Health Service Directory contain 
incomplete and inaccurate data. 
 
143 The Foundation for Evidence Based Policymaking Act of 2018 mandates HHS improve its capacity for using data 
for evidence building purposes; Federal Data Strategies, Promoting Efficient and Appropriate Data Use: Practices 
27-40.  Available at https://strategy.data.gov/practices/. U.S. Department of Health and Human Services, 2018 HHS 
Data Strategy: Enhancing the HHS Evidence-Based Portfolio. 
 
144 CDC, Data Modernization Initiative, A Roadmap of Activities and Expected Outcomes.  Available at 
https://www.cdc.gov/surveillance/pdfs/318212-A_DMI_LogicModel_July23b-508.pdf.  
 
145 Most HHS data that can be shared are in machine-readable formats, but some data are not.  Without structured 
data that can be automatically read and formatted, sharing and use of data may require resource intensive 
preparation work.  Office of the Chief Technology Officer, The State of Data Sharing at the U.S. Department of 
Health and Human Services, page 12, September 2018.  Available at 
https://www.hhs.gov/sites/default/files/HHS_StateofDataSharing_0915.pdf#:~:text=The%20State%20of%20Data%
20Sharing%20at%20the%20U.S.,gives%20us%20their%20data%2C%20they%20lose%20all%20control. 
 
146 The Clinical Response through Emerging Technology.  Available at https://www.hhs.gov/sites/default/files/cret-
document.pdf.  Available at https://www.hhs.gov/cto/blog/2019/1/17/top-health-tech-sprint-unleashes-the-
power-of-open-data-and-ai.html.  HHS Reimagine Acquisitions, BuySmarter.  Available at 
https://www.hhs.gov/sites/default/files/hhs-buysmarter-journey.pdf.   
 
147 Examples of HHS stakeholders include Medicare providers, State Medicaid agencies, public health entities, 
researchers, universities, and other entities that may have similar missions or interests to that of the Department 
and its programs.  
 
148 The Foundations for Evidence-Based Policymaking Act of 2018 created a default presumption that Government 
data assets be available to the public in a machine-readable, open format, and under open licenses, and 
encouraging public use. P.L. 111-435  202 (Jan. 2019).  The third Federal Data Strategy Principle is promoting 
transparency: articulate the purposes and uses of federal data to engender public trust.  Comprehensively 
document processes and products to inform data providers and users.  Available at 
https://strategy.data.gov/principles/.  The 2018 HHS Data strategy Priority 1 is improving access to HHS data.  
Available at https://aspe.hhs.gov/system/files/pdf/261591/2018HHSDataStrategy.pdf.  
 
149 Office of the Chief Technology Officer, The State of Data Sharing at the U.S. Department of Health and Human 
Services, September 2018.  Available at 
https://www.hhs.gov/sites/default/files/HHS_StateofDataSharing_0915.pdf.  
 
150 HHS, COVID-19 Guidance for Hospital Reporting and FAQs For Hospitals, Hospital Laboratory, and Acute Care 
Facility Data Reporting, July 2020.  Available at https://www.hhs.gov/sites/default/files/covid-19-faqs-hospitals-
hospital-laboratory-acute-care-facility-data-reporting.pdf.  
 
151 CMS, COVID-19 Nursing Home Data.  Available at https://data.cms.gov/stories/s/COVID-19-Nursing-Home-
Data/bkwz-xpvg/.  
 
152 NIH, All of Research Hub  Workbench.  Available at https://www.researchallofus.org/workbench/.  
 
 
52 
     
 
 
153 FDA, FDAs Technology Modernization Action Plan, September 2019.  Available at https://www.fda.gov/about-
fda/reports/fdas-technology-modernization-action-plan. 
 
154 HHS Secretary Priorities, Value-Based Care.  Available at 
https://www.hhs.gov/about/leadership/secretary/priorities/index.html#value-based-healthcare. 
 
155 ONC, State of Interoperability among U.S. Non-federal Acute Care Hospitals in 
2018 , March 2020.  Available at  https://www.healthit.gov/sites/default/files/page/2020-03/State-of-
Interoperability-among-US-Non-federal-Acute-Care-Hospitals-in-2018.pdf. 
 
156 Ibid. 
 
157 ONC, Interoperability for COVID-19 Novel Coronavirus Pandemic.  Available at 
https://www.healthit.gov/isa/covid-19. 
 
158 85 Fed. Reg. 25642 (May 1, 2020).  Available at https://www.federalregister.gov/documents/2020/05/01/2020-
07419/21st-century-cures-act-interoperability-information-blocking-and-the-onc-health-it-certification.  
 
159 85 Fed. Reg. 25510, May 1, 2020.  Available at https://www.federalregister.gov/documents/2020/05/01/2020-
05050/medicare-and-medicaid-programs-patient-protection-and-affordable-care-act-interoperability-and.  
 
160 CMS, Fact Sheet onMyHealthEData, March 2020.  Available at https://www.cms.gov/About-CMS/Story-
Page/MyHealthEData-fact-sheet.pdf.  
 
161 ONC, A Look Ahead: Year Two for ONC and the Recognized Coordinating Entity for TEFCA, May 2020.  Available 
at: https://www.healthit.gov/buzz-blog/health-it/a-look-ahead-year-two-for-onc-and-the-recognized-
coordinating-entity-for-tefca.  
 
162 HHS, Voice of HHS Podcast, Eric Hargan: De-regulation, Taiwan, and the Return to Washington, August 2020.  
Available at https://www.hhs.gov/podcasts/voices-of-hhs/learning-curve-12-eric-hargan-de-regulation-taiwan-
and-the-return-to-washington.html.  
 
163 CISA, HHS, and FBI, Ransomware Activity Targeting the Healthcare and Public Health Sector, October 2020.  
Available at https://us-cert.cisa.gov/ncas/alerts/aa20-302a. 
 
164 OIG, Review of the Department of Health and Human Services Compliance with Federal Information Security 
Modernization Act of 2014 for Fiscal Year 2019, A-18-19-11200, April 2020.  Available at 
https://oig.hhs.gov/oas/reports/region18/181911200.asp.  
 
165 OIG, Summary Report for Office of Inspector General Penetration Testing of Eight HHS Operating Division 
Networks, A-18-18-08500, March 2019.  Available at https://oig.hhs.gov/oas/reports/region18/181808500.asp. 
 
166 NIH, ACD Working Group for Foreign Influences on Research Integrity, December 2018.  Available at 
https://acd.od.nih.gov/documents/presentations/12132018ForeignInfluences_report.pdf. 
 
167 OIG, Opportunities Exist for the National Institutes of Health to Strengthen Controls in Place to Permit and 
Monitor Access to Its Sensitive Data, A-18-18-09350, February 2019.  Available at 
https://oig.hhs.gov/oas/reports/region18/181809350.pdf.   
 
 
53 
     
 
 
168 HHS Press Release, HHS Announces the Official Opening of the Health Sector Cybersecurity Coordination Center, 
October 2018.  Available at https://www.hhs.gov/about/news/2018/10/30/hhs-announces-official-opening-
health-sector-cybersecurity-coordination-center.html.  
 
169 FDA, Cybersecurity Safety Communications.  Available at https://www.fda.gov/medical-devices/digital-
health/cybersecurity.  
 
170 84 Fed. Reg. 55766 and 55694 (October 17, 2019). Available at 
https://www.federalregister.gov/documents/2019/10/17/2019-22027/medicare-and-state-healthcare-programs-
fraud-and-abuse-revisions-to-safe-harbors-under-the and 
https://www.federalregister.gov/documents/2019/10/17/2019-22028/medicare-program-modernizing-and-
clarifying-the-physician-self-referral-regulations.  
 
171 OCR, HIPAA and COVID-19.  Available at https://www.hhs.gov/hipaa/for-professionals/special-topics/hipaa-
covid19/index.html.  
 
172 OCR, Resources for Mobile Health Apps Developers, September 2020.  Available at 
https://www.hhs.gov/hipaa/for-professionals/special-topics/health-apps/index.html.  
 
173 OIG, Hospital Experiences Responding to the COVID-19 Pandemic: Results of a National Pulse Survey March 23
27, 2020, OEI-06-20-00300, April 2020  Available at https://oig.hhs.gov/oei/reports/oei-06-20-00300.pdf.  
 
174 OIG, Hospitals Reported Improved Preparedness for Emerging Infectious Diseases After the Ebola Outbreak, OEI-
06-15-00230, October 2018.  Available at https://www.oig.hhs.gov/oei/reports/oei-06-15-00230.pdf. 
 
175 Dr. Nora Volkow, Director, National Institute on Drug Abuse, National Institutes of Health, COVID-19: Potential 
Implications for Individuals with Substance Abuse Disorders, April 6, 2020.  Accessed at 
https://www.drugabuse.gov/about-nida/noras-blog/2020/04/covid-19-potential-implications-individuals-
substance-use-disorders on April 9, 2020.  
 
176 OIG, States Oversight of Opioid Prescribing and Monitoring of Opioid Use.  July 20, 2020.  Available at 
https://oig.hhs.gov/oas/opioid-oversight-map/oversight.asp. 
 
177 HHS, Strategy to Combat Opioid Abuse, Misuse, and Overdose: A Framework Based on the Five Point Strategy. 
Available at https://www.hhs.gov/opioids/sites/default/files/2018-09/opioid-fivepoint-strategy-20180917-
508compliant.pdf 
 
178 OIG, Geographic Disparities Affect Access to Buprenorphine Services for Opioid Use Disorder, OEI-12-17-00240, 
January 2020.  Available at: https://oig.hhs.gov/oei/reports/oei-12-17-00240.asp. 
 
179 OIG, Medicare Part D Beneficiaries at Serious Risk of Opioid Misuse or Overdose: A Closer Look, OEI-02-19-
00130, May 2020.  Available at https://oig.hhs.gov/oei/reports/oei-02-19-00130.pdf. 
 
180 OIG, Communication and Management Challenges Impeded HHS's Response to Zero-Tolerance Policy, OEI-BL-
18-00510, March 2020.  Available at  https://oig.hhs.gov/oei/reports/oei-BL-18-00510.pdf. 
 
181 OIG, Unaccompanied Alien Children Care Provider Facilities Generally Conducted Required Background Checks 
but Faced Challenges in Hiring, Screening, and Retaining Employees, A-12-19-20001, September 2019.  Available at 
https://oig.hhs.gov/oas/reports/region12/121920001.pdf.  
 
 
54 
     
 
 
182 OIG, Ohio Did Not Ensure the Accuracy and Completeness of Psychotropic and Opioid Medication Information 
Recorded in Its Child Welfare Information System for Children in Foster Care, A-05-18-00007, July 2020.  Available 
athttps://oig.hhs.gov/oas/reports/region5/51800007.asp.  
 
183 OIG, Kansas Did Not Ensure That Group Homes for Children in Foster Care Complied With All State Health and 
Safety Requirements, A-07-19-06087, July 2020.  Available at 
https://oig.hhs.gov/oas/reports/region7/71906087.asp.  
 
184 OIG, Missouri Should Improve Its Oversight of Selected Nursing Homes Compliance With Federal Requirements 
for Life Safety and Emergency Preparedness, A-07-18-03230, March 2020.  Available at 
https://oig.hhs.gov/oas/reports/region7/71803230.pdf. OIG, Florida Should Improve Its Oversight of Selected 
Nursing Homes Compliance With Federal Requirements for Life Safety and Emergency Preparedness, A-04-18-
08065, March 2020. Available at https://oig.hhs.gov/oas/reports/region4/41808065.pdf. OIG, Life Safety and 
Emergency Preparedness Deficiencies Found at 18 of 20 Texas Nursing Homes, A-06-19-08001, February 2020. 
Available at https://oig.hhs.gov/oas/reports/region6/61908001.pdf. OIG, California Should Improve Its Oversight of 
Selected Nursing Homes Compliance With Federal Requirements for Life Safety and Emergency Preparedness, A-
09-18-02009, November 2019. Available at https://oig.hhs.gov/oas/reports/region9/91802009.pdf. OIG, New York 
Should Improve Its Oversight of Selected Nursing Homes Compliance With Federal Requirements for Life Safety and 
Emergency Preparedness, A-02-17-01027, August 2019. Available at 
https://oig.hhs.gov/oas/reports/region2/21701027.pdf. 
 
185 Christopher Weaver and Dan Frosch, A Pedophile Doctor Drew Suspicions for 21 Years. No One Stopped Him, 
PBS Frontline in partnership with The Wall Street Journal, February 9, 2019. Accessed at 
https://www.pbs.org/wgbh/frontline/article/patrick-stanley-weber-sexual-abuse-pine-ridge-blackfeet-reservation/ 
on September 19, 2019. 
 
186 Christopher Weaver, Former U.S. Indian Health Service Doctor Is Found Guilty of Abusing Boys, The Wall 
Street Journal, September 27, 2019. Accessed at https://www.wsj.com/articles/former-u-s-indian-health-service-
doctor-is-found-guilty-of-abusing-boys-11569624911 on October 1, 2019.   
 
187 OIG, Report: Indian Health Service Has Strengthened Patient Protection Policies but Must Fully Integrate Them 
Into Practice and Organizational Culture, OEI-06-19-00330, December 2019.  Available at 
https://oig.hhs.gov/oei/reports/oei-06-19-00330.pdf. 
 
188 https://oig.hhs.gov/oas/reports/region1/12001500.pdf. 
 
189https://www.ihs.gov/sites/newsroom/themes/responsive2017/display_objects/documents/2020_Letters/DTLL_
09252020.pdf. 
 
190 OIG, Patient Safety Organizations: Hospital Participation, Value, and Challenges, OEI-01-00420, September 
2019.  Available at https://oig.hhs.gov/oei/reports/oei-01-17-00420.pdf.  
 
55