Introduction 
 
Top 12 Management and Performance 
The 2018 Top Management and Performance 
Challenges Facing HHS 
Challenges Facing HHS is an annual publication of the 
1.  Preventing and Treating Opioid Misuse 
Department of Health and Human Services (HHS or the 
2.  Ensuring Program Integrity in Medicare 
Department) Office of Inspector General (OIG).  In this 
Fee-for-Service and Effective 
edition, OIG has identified 12 top management and 
Administration of Medicare 
performance challenges (TMCs) facing the Department 
3.  Ensuring Program Integrity and 
as it strives to fulfill its mission to enhance the health 
Effective Administration of Medicaid 
and well-being of all Americans, by providing for 
4.  Ensuring Value and Integrity in 
effective health and human services and by fostering 
Managed Care and Other Innovative 
sound, sustained advances in the sciences underlying 
Healthcare Payment and Service 
medicine, public health, and social services.  These 
Delivery Models 
top challenges arise across HHS programs and cover 
5.  Protecting the Health and Safety of 
critical HHS responsibilities that include delivering 
Vulnerable Populations 
quality services and benefits, exercising sound fiscal 
6.  Improving Financial and Administrative 
management, safeguarding public health and safety, 
Management and Reducing Improper 
and enhancing cybersecurity.  The Department should 
Payments 
be mindful of these challenges and opportunities to 
7.  Protecting the Integrity of HHS Grants 
address them as it undertakes its efforts to ReImagine 
8.  Ensuring the Safety of Food, Drugs, and 
HHS as part of the Federal Governments 
Medical Devices 
comprehensive plan to reform Government. 
9.  Ensuring Quality and Integrity in 
 
Programs Serving American 
HHS is responsible for a portfolio of more than $1 
Indian/Alaska Native Populations 
trillion, and its programs impact the lives of virtually all 
10. Protecting HHS Data, Systems, and 
Americans.  To identify the top 12 challenges, we 
Beneficiaries from Cybersecurity 
synthesized our oversight, risk analysis, data analytics, 
Threats 
and enforcement work.  For each top challenge, we 
11. Ensuring that HHS Prescription Drug 
identify the key components, the Departments 
Programs Work as Intended 
progress in addressing the challenge, and what needs 
12. Ensuring Effective Preparation and 
to be done.  There are many cross-cutting issues that 
Response to Public Health Emergencies 
transcend all the TMCs.  Examples include improper 
 
payments, the quality of services provided and care 
 
received by beneficiaries, promoting effective use of health IT, and combatting fraud.  Each challenge 
 
also lists key OIG resources related to that challenge.  
 
Additionally, OIG maintains a list of significant unimplemented OIG recommendations, including 
legislative recommendations, to address vulnerabilities.  These recommendations are drawn from OIGs 
audits and evaluations.  OIG identifies the top unimplemented recommendations that, in OIGs view, 
would most positively affect HHS programs in terms of cost savings, program effectiveness and 
efficiency, and public health and safety.1  More information on OIGs work, including the reports 
mentioned in this publication, are on our website at https://oig.hhs.gov. 
                                                           
1 OIG, Solutions to Reduce Fraud, Waste, and Abuse in HHS Programs: Top Unimplemented Recommendations, July 2018. 
Available at https://oig.hhs.gov/reports-and-publications/compendium/files/compendium2018.pdf. 
 
   
Table of Contents 
Top Management and Performance Challenges Facing HHS 
1.  Preventing and Treating Opioid Misuse .........................................................................1 
2.  Ensuring Program Integrity in Medicare Fee-for-Service and Effective Administration       
of Medicare ..................................................................................................................7 
3.  Ensuring Program Integrity and Effective Administration of Medicaid ......................... 13 
4.  Ensuring Value and Integrity in Managed Care and Other Innovative Healthcare Payment 
and Service Delivery Models ....................................................................................... 17 
5.  Protecting the Health and Safety of Vulnerable Populations ........................................ 21 
6.  Improving Financial and Administrative Management and Reducing Improper     
Payments  ................................................................................................................... 28 
7.  Protecting the Integrity of HHS Grants ........................................................................ 33 
8.  Ensuring the Safety of Food, Drugs, and Medical Devices ............................................ 37 
9.  Ensuring Quality and Integrity in Programs Serving American Indian/Alaska Native 
Populations ................................................................................................................ 41 
10.  Protecting HHS Data, Systems, and Beneficiaries from Cybersecurity Threats .............. 45 
11.  Ensuring that HHS Prescription Drug Programs Work as Intended................................ 48 
12.  Ensuring Effective Preparation and Response to Public Health Emergencies ................ 53 
 
 
 
   
1.  Preventing and Treating Opioid Misuse 
 
Why This Is a Challenge  
Key Components of the Challenge 
In 2017, the President declared the opioid crisis a nationwide 
 Reducing inappropriate 
public health emergency.  Some analysts estimate that up to 6 
prescribing and misuse of opioids 
million Americans could have opioid use disorder.2  In 2017, it 
 Combating fraud and diversion of 
is estimated that more than 49,000 opioid-related overdose 
prescription opioids and 
deaths occurred in the United States (U.S.), an average of 134 
potentiator drugs 
deaths per day.   
 Ensuring access to appropriate 
 
treatment for opioid use disorder  
Across multiple agencies and programs, HHS has many 
 Ensuring that funding for 
opportunities to help curb the opioid epidemic.  Medicare 
prevention and treatment is used 
provides prescription drug coverage for 45 million Part D 
appropriately 
beneficiaries and Medicaid for 67 million beneficiaries.  The 
 
Indian Health Service (IHS) provides care for 2.2 million 
beneficiaries.  The U.S. Food and Drug Administration (FDA) oversees the approval and safe use of 
prescription drugs.  HHS agencies also conduct research and award grants to support healthcare 
providers, researchers, and States in their efforts to combat the epidemic.  
 
Reducing inappropriate prescribing and misuse of opioids 
 
Key Components of the Challenge 
OIG found that almost 460,000 Medicare Part D beneficiaries received high amounts of opioids in 2017.  
In addition, almost 300 prescribers engaged in questionable opioid prescribing.  These prescribers 
ordered opioids for the highest number of beneficiaries at serious risk of opioid misuse or overdose.  
This does not include prescribing for beneficiaries who have cancer or were in hospice care.  
Beneficiaries at serious risk include those who received extreme amounts of opioids and those who 
appeared to be doctor shopping (i.e., receiving high amounts of opioids from multiple prescribers and 
multiple pharmacies).3  
 
Medicaid beneficiaries may be especially vulnerable to opioid misuse because they are more likely than 
nonbeneficiaries to have chronic conditions and comorbidities that require pain relief, especially those 
who qualify because of a disability.  In 2016, Medicaid covered nearly 4 in 10 nonelderly adults with 
opioid addiction, while only 15 percent of the nonelderly adult population is covered by Medicaid.  OIG 
found that one in six Medicaid beneficiaries in Ohio received an opioid in a 1-year period, and nearly 
5,000 Ohio beneficiaries received high amounts of opioids.  
 
Health disparities and inadequate healthcare services for American Indians and Alaska Natives (AI/AN) 
have been a subject of concern for the Federal Government for almost a century.  AI/AN had the second 
highest rate of opioid overdose deaths in 2015 and 2016.4  IHS is responsible for implementing 
appropriate controls within its pharmacies to reduce and detect diversion of opioids.  OIG has found 
                                                           
2 Modern Healthcare, Opioid Use Disorder Cases Triple Governments Early Estimates, September 14, 2018.  Available at: 
http://www.modernhealthcare.com/article/20180914/NEWS/180919929. 
3 Extreme is defined as an average daily morphine equivalent dose greater than 240 mg for 12 months. 
4 Seth PS, et al., Overdose deaths involving opioids, cocaine, and psychostimulantsUnited States, 2015-2016, MMWR, Vol 67 
(12) March 30, 2018, pp 349-358.) 
1 
   
vulnerabilities at some IHS pharmacies that could put patient safety at risk and allow inappropriate 
prescribing of opioids. 
 
Progress in Addressing the Challenge  
The Department has engaged several Operating Divisions in efforts to address inappropriate prescribing 
and misuse of opioids.  Monitoring of prescription drug claims is one tool to prevent inappropriate 
prescribing and misuse of opioids.  The Centers for Medicare & Medicaid Services (CMS) has taken steps 
to help reduce misuse of opioids, including strengthening drug utilization reviews, a tool that assists 
Medicare Part D sponsors in preventing misuse.  In October 2017, States and CMS convened to discuss 
vulnerabilities, mitigation strategies, challenges, and barriers related to State Medicaid opioid efforts.  In 
June 2018, CMS continued to provide guidance to help States combat the opioid crisis in Medicaid, 
including information on effective practices to identify substance use disorders covered under Medicaid.  
The Centers for Disease Control and Prevention (CDC) has awarded funding to States to improve 
prescription drug monitoring programs (PDMPs), which are statewide databases that track prescriptions.  
In 2016, IHS implemented a policy requiring prescribers to utilize PDMP data to identify at-risk patients.  
PDMPs assist in identifying prescribers at risk of inappropriate prescribing and allow authorized users to 
identify patients who are obtaining opioids from multiple providers.   
 
Education of providers, the industry, and beneficiaries on appropriate prescribing and pain management 
also plays a role in the prevention of opioid abuse.  For example, IHS changed its policy regarding opioid 
prescribing to align with CDC guidelines for prescribing opioids for chronic pain.  Furthermore, FDA is 
encouraging appropriate prescribing of opioid analgesics through the Risk Evaluation and Mitigation 
Strategy (REMS) program for opioid analgesics.  The Opioid Analgesic REMS, approved on September 18, 
2018, includes as the primary component that training be made available to all healthcare providers 
(HCPs) who are involved in the management of patients with pain, including nurses and pharmacists.  To 
meet this requirement, drug manufacturers with approved opioid analgesics will provide unrestricted 
grants to accredited continuing education providers for the development of education courses for HCPs 
based on the FDA Education Blueprint for Health Care Providers Involved in the Management or Support 
of Patients with Pain (Blueprint).  It is expected that continuing education based upon the new Blueprint 
will be available to healthcare providers by March 2019.5  To prevent misuse of opioids, HHS has 
educated providers and the public about alternative options for pain management.  IHS established a 
National Committee on Heroin, Opioids, and Pain Efforts to promote appropriate and effective pain 
management, reduce overdose deaths, and improve access to treatment. 
   
When opioid use becomes addiction, information on treatment is important.  In 2017, HHS launched its 
5-Point Opioid Strategy to improve access to treatment, improve data, promote better pain 
management, increase the availability of overdose-reversing drugs, and increase research on pain and 
addiction.  In April 2018, NIH launched the Helping to End Addiction Long-term (HEAL) initiative to 
improve treatments for opioid misuse and addiction.   
 
What Needs To Be Done 
  HHS agencies should monitor and assess the effectiveness of their ongoing efforts. 
  OIG recommends that CMS continue to develop prescriber educational tools outlining how to 
appropriately prescribe opioids when medically necessary.  As part of this education, CMS should 
                                                           
5 FDA, Opioid Analgesic Risk Evaluation and Mitigation Strategy, September 27, 2018.  Accessed at:  
https://www.fda.gov/Drugs/DrugSafety/InformationbyDrugClass/ucm163647.htm.  
2 
   
engage with those providers who may be prescribing inappropriately, to make sure they have the 
tools to prescribe appropriately.  
  States and IHS should continue efforts to implement and encourage the use of PDMPs.6  Routinely 
checking States PDMPs is an important step toward improving how opioids are prescribed and 
reducing opioid misuse, abuse, and overdose.   
  Medicaid beneficiary data should be shared among States and with HHS so that potential patient 
harm is identified.  Beneficiaries can cross State boundaries to obtain opioids and thereby miss 
being flagged by a States PDMP for potentially excessive opioid use.  
 
Combating fraud and diversion of prescription opioids and potentiator drugs 
 
Key Components of the Challenge 
Several years ago, OIG detectedand began taking action to addressa rise in fraud schemes involving 
opioids, as well as associated potentiator drugs.  Opioid fraud encompasses a broad range of criminal 
activity from prescription drug diversion to addiction treatment schemes. 
 
OIG investigations of opioid drug diversion, which is the redirection of legitimate drugs for illegitimate 
purposes, are on the rise.  Diverted opioid drugs are at high risk to be used inappropriately and create 
significant harm, including increasing the risk of overdose.  Also at risk for diversion are potentiator 
drugs, which are drugs that exaggerate euphoria when combined with opioids and escalate the potential 
for misuse.  Prescription opioids indicated to treat pain and those indicated to treat opioid use disorder 
(particularly, buprenorphine) are also at high risk of diversion.  
 
Progress in Addressing the Challenge  
OIG, along with State and Federal law enforcement partners, participated in an unprecedented fraud 
takedown to combat healthcare fraud and the opioid epidemic in June 2018.  More than 160 defendants 
were charged with participating in Medicare and Medicaid fraud schemes related to opioids or 
treatment for opioid use disorders.  These defendants included 32 doctors who were charged for their 
roles in prescribing and distributing opioids and other dangerous narcotics.   
 
To support public and private sector partners in combatting the opioid crisis, OIG released a toolkit 
providing detailed steps for using prescription drug claims data to analyze patients opioid levels and 
identify certain patients who are at risk of opioid misuse or overdose.  Partners such as Medicare Part D 
plan sponsors, private health plans, and State Medicaid Fraud Control Units (MFCUs) can now analyze 
their own prescription drug claims data using the methodology OIG developed on the basis of its work 
on opioids. 
 
CMS finalized regulations to guide Medicare plans to implement lock-in authority.  Lock-in allows 
Medicare plans to better manage at-risk beneficiaries medication regimens by limiting their access to 
opioids to certain prescribers and pharmacies.  CMS has issued Quarterly Reports of Part D outlier 
prescribers of opioids and other prescription drugs; these prescribers have a high potential for abuse. 
Additionally, IHS implemented system and physical controls at certain IHS hospitals to help ensure 
opioids are secure.  These controls help to ensure prescription drugs and pharmacy information are 
protected, thus lessening the chance that drugs could be illegally diverted.  
 
                                                           
 
3 
   
What Needs To Be Done 
  HHS agencies should improve efforts to identify and investigate potential fraud and abuse.  For 
instance, CMS should collect comprehensive data from Medicare Part D plan sponsors.   
  CMS should ensure that national Medicaid data are sufficient to detect suspected fraud or abuse.   
  CMS and States should follow up on prescribers with questionable prescribing patterns to ensure 
that Medicare Part D and Medicaid are not paying for unnecessary drugs that are being diverted for 
resale or recreational use. 
  IHS should improve controls at entry points to sensitive areas of its hospitals to protect its pharmacy 
inventory from unauthorized access.   
  IHS should continue to strengthen its systems controls to ensure unauthorized individuals cannot 
gain access to sensitive patient information.  
 
Ensuring access to appropriate treatment for opioid use disorder 
 
Key Components of the Challenge 
Given the scope of the epidemic, access to high quality treatment of opioid use disorder is a priority and 
a challenge.  Only 10 percent of people who need treatment for substance use disorder receive that 
treatment.7  Rates of drug overdose deaths are rising in rural areas, surpassing rates in urban areas.  At 
the same time, rural areas are often more limited in their access to treatment.  The Government 
Accountability Office found that the regulatory restrictions placed on providers, such as patient limits, 
and the stigmas related to drug addiction and medication assisted treatment (MAT) are barriers that 
may limit providers participation in treatment. 
 
Increasing access to MAT and programs must be balanced with the increased risk for fraud involving 
addiction treatment schemes.  Fraud committed by providers of treatment for opioid use disorder is a 
concern as it both diverts funds and puts beneficiaries at risk. 
 
Progress in Addressing the Challenge  
HHS has been implementing provisions of the Comprehensive Addiction and Recovery Act of 2016.  This 
includes allowing a temporary expansion of prescribing authority for MAT to other healthcare providers 
beyond physicians, including nurse practitioners and physician assistants.  
 
HHS agencies have taken steps to expand MAT treatment options and access.  The Substance Abuse and 
Mental Health Services Administration (SAMHSA) reviewed the use of three medications (methadone, 
naltrexone, and buprenorphine) to treat opioid use disorders.  In addition, in 2018, the Health Resources 
and Services Administration (HRSA) made $350 million available to expand access to treatment, 
including MAT, at community health centers.  The number of health center clinicians providing MAT 
increased from 1,700 in 2016 to nearly 3,000 in 2017.8  Further, FDA issued scientific recommendations 
                                                           
7 SAMHSA, Receipt of Services for Substance Use and Mental Health Issues among Adults: Results from the 2016 National 
Survey on Drug Use and Health, September 2017.  Accessed at: https://www.samhsa.gov/data/sites/default/files/NSDUH-DR-
FFR2-2016/NSDUH-DR-FFR2-2016.htm.  The 2017 National Survey on Drug Use and Health data is estimated to be released in 
November 2018.  
8 HHS, HHS Makes $350 Million Available to Fight the Opioid Crisis in Community Health Centers Nationwide, June 15, 2018.  
Accessed at: https://www.hhs.gov/about/news/2018/06/15/hhs-makes-350-million-available-to-fight-opioid-crisis-community-
health-centers.html. 
4 
   
to encourage the development of MAT drugs.9  FDA also approved the first generic versions of 
Suboxone, which may increase access to treatment of opioid dependence.10 
 
Additionally, CMS has allowed States to design demonstration projects that increase access to a 
continuum of treatment services for opioid use disorders.  It also allows State Medicaid agencies to 
reimburse for treatment at inpatient facilities with more than 16 beds which are otherwise prohibited 
by current exclusions.  
 
What Needs To Be Done 
  CMS and SAMHSA should monitor the success of their efforts to increase access to MAT.   
  SAMHSA must adequately oversee the waiver process for physicians to prescribe or dispense 
specific narcotic medications in settings other than opioid treatment programs.   
  CMS should continue to develop reimbursement policies that foster the development of services to 
ensure that treatment resources and the number of qualified providers are sufficient to provide 
beneficiaries ready access where and when needed.  
 
Ensuring that funding for prevention and treatment is used appropriately 
 
Key Components of the Challenge 
To build upon the work started under the 21st Century Cures Act (Cures Act), HHS was appropriated  
more than $1 billion in new funding to combat the opioid epidemic and address serious mental illness.   
 
While Medicare and Medicaid pay the biggest share of Federal payments for treatment, SAMHSA is 
awarding approximately $930 million in fiscal year (FY) 2018 State Opioid Response grants and awarded 
approximately $484 million in Opioid State Targeted Response grants in FY 2017.  Ensuring these funds 
are used appropriately is a top priority.  As with any Federal program, significant increases in funding 
and subsequent disbursement raises the risk for waste, abuse, and inefficient use (see TMC #7 for more 
information on challenges specific to HHS grants). 
 
Progress in Addressing the Challenge  
In the Agency Priority Goal Action Plan to Reduce Opioid Morbidity and Mortality, the Department 
publishes quarterly updates on its progress on HHS-funded projects to combat the opioid crisis.  For 
example, HRSA reported that it collects quarterly progress-report data from grantees who received 
funding in 2017 to increase access to substance abuse and mental health services, the Rural Health 
Opioid Program, and the Substance Abuse Treatment Telehealth Network Grant Program.    
 
NIH ensures its funded opioid research adheres to NIH Grants Compliance and Oversight policies.  NIH 
uses proactive compliance site visits to assess institutional understanding of Federal policies and 
regulations, minimize or eliminate areas of noncompliance, and nurture partnerships between NIH and 
its recipient institutions.  NIH also uses targeted site visits to focus on recipients compliance with 
Financial Conflict of Interest regulations.   
                                                           
9 FDA, FDA Takes New Steps to Encourage the Development of Novel Medicines for the Treatment of Opioid Use Disorder, 
August 6, 2018.  Accessed at: https://www.fda.gov/NewsEvents/Newsroom/PressAnnouncements/ucm615892.htm. 
10 FDA, FDA approves first generic versions of Suboxone sublingual film, which may increase access to treatment for opioid 
dependence, June 14, 2018.  Accessed at: 
https://www.fda.gov/newsevents/newsroom/pressannouncements/ucm610807.htm. 
5 
   
 
CMS conducts State Program Integrity desk reviews of State Medicaid activities to assist in combatting 
the opioid epidemic.  In FY 2018, CMS began conducting opioid desk reviews to gather information 
related to certain States current programs, delivery systems, policies and/or noteworthy practices in 
response to the opioid crisis.   
 
What Needs To Be Done 
  OIG will monitor and review grantees use of Federal funds for opioid abuse prevention and 
treatment programs, and, as appropriate, use its criminal, civil, and administrative enforcement 
authorities to prevent fraud. 
  SAMHSA and other HHS operating divisions should identify and refer cases to OIG involving grantee 
fraud or misuse of Federal funds for opioid abuse prevention and treatment programs.  
 
Key OIG resources 
  Opioids in Medicare Part D: Concerns about Extreme Use and Questionable Prescribing (OEI-02-
17-00250), July 2017. 
  Two Indian Health Service Hospitals Had System Security and Physical Controls for Prescription 
Drug and Opioid Dispensing but Could Still Improve Controls (A-18-16-30540), November 2017. 
  Toolkit: Using Data Analysis to Calculate Opioid Levels and Identify Patients at Risk of Misuse or 
Overdose (OEI-02-17-00560), June 2018.  
  Opioid Use in Medicare Part D Remains Concerning (OEI-02-18-00220), June 2018.  
  Opioids in Ohio Medicaid: Review of Extreme Use and Prescribing (OEI-05-18-00010), July 2018. 
 
 
 
   
6 
   
2.  Ensuring Program Integrity in Medicare Fee-for-Service 
and Effective Administration of Medicare  
 
Why This Is a Challenge 
Key Components of the Challenge 
In FY 2017, Medicare spent $698.7 billion and provided health 
  Reducing improper payments 
coverage to 58.4 million beneficiaries.  Medicare spending 
  Combating fraud 
represents more than 15 percent of all Federal spending.  
  Fostering prudent payment 
Future spending is expected to increase significantly because 
policies 
of growth in the number of beneficiaries and increases in per 
  Maximizing the promise of health 
capita healthcare costs.  The 2018 Annual Report of the Board 
information technology 
of Trustees of the Federal Hospital Insurance and Federal 
Supplemental Medicare Insurance Trust Funds estimates that 
the Trust Fund for Medicare Part A (Hospital Insurance) will be depleted by 2026.  It also projects that 
spending for Medicare Part B (Medical Insurance) will grow by almost 8.2 percent over the next 5 years, 
outpacing the U.S. economy, which is projected to grow by 4.7 percent during that time.   
 
The Medicare Program continues to be susceptible to risks associated with volume-driven 
reimbursement, such as incentives for inappropriate utilization.  The Department is working to 
transform Medicare into a more value-based system with shared accountability for quality, costs, and 
outcomes.  However, given the millions of beneficiaries and hundreds of billions of dollars still 
associated with traditional Medicare, the Department must continue to ensure the integrity of the 
existing programs even as it develops new ones (see TMC #4 for more information on ensuring value and 
integrity in managed care and other innovative payment and service healthcare delivery models).  
 
Reducing improper payments 
 
Key Components of the Challenge 
FOCUS ON HOSPICE 
Reducing improper payments to providers 
Hospice is an increasingly important benefit for the 
is a critical element in protecting 
Medicare population.  It can provide great comfort to 
Medicares financial integrity.  The 
beneficiaries, their families, and other caregivers at the 
Medicare Fee-For-Service (FFS) improper 
end of a beneficiarys life.  The number of hospice 
payment rate decreased from 11.0 percent, 
beneficiaries has grown every year for the past decade.  
or $41.1 billion, in FY 2016 to 9.51 percent, 
In 2016, Medicare spent about $16.7 billion for hospice 
or $36.2 billion, in FY 2017.  This represents 
care for 1.4 million beneficiaries (compared to $9.2 
positive momentum upon which the 
billion for fewer than 1 million beneficiaries in 2006).  
Department and CMS can build (see TMC #6 
With this growth, OIG has identified significant 
for more information on measuring and 
vulnerabilities and has raised concerns about hospice 
reporting improper payment rates).  Some 
billing, Federal oversight, and quality of care provided to 
types of providers and suppliers pose 
beneficiaries.  OIG investigations have also uncovered 
heightened risk to the financial integrity of 
hospices enrolling beneficiaries without their knowledge 
Medicare.  For instance, OIG and CMS have 
or under false pretenses, enrolling beneficiaries who are 
identified especially high rates of improper 
not terminally ill, billing for services not provided, 
payments for home healthcare, hospice 
paying kickbacks, and falsifying documentation. 
care, durable medical equipment (DME), 
 
7 
   
chiropractic services, care in skilled nursing facilities (SNF), and certain hospital services.   
 
Hospital billing for short inpatient stays also remains a concern.  CMSs enforcement of its 2-midnight 
policy has been limited.  OIG found that hospitals billed for many potentially inappropriate short 
inpatient stays; for these stays, Medicare paid a total of almost $2.9 billion.  OIG also found that 
hospitals may have financial incentives to use short inpatient stays, and that some hospitals increased 
their use of these stays, which is inconsistent with the stated goals of the 2-midnight policy. 
 
Progress in Addressing the Challenge 
HHS and CMS have made several corrective actions for the Medicare FFS program that focus on specific 
service areas with high error rates, such as home health and inpatient rehabilitation facilities claims.  
These actions are designed to reduce fraud, waste, and abuse in the Medicare FFS program while 
ensuring patients receive necessary care. 
 
CMS has put into place new requirements that make identification and recoupment of overpayments 
easier by using tax identification numbers and provider transaction access numbers in addition to 
national provider numbers.  CMS has also improved identification of overpayments by sharing best 
practices across Unified Program Integrity Contractors and addressing challenges that hinder their 
identification of overpayments.  
 
What Needs To Be Done 
  CMS should take more effective actions to reduce improper payments among provider and supplier 
types and in geographic locations that present a high risk to the financial integrity of Medicare.  This 
includes focusing on provider types that OIG and CMS have found to have extremely high rates of 
improper payments, such as chiropractors, home health providers, hospice, SNFs, and high-risk 
hospital services. 
  HHS should continue to address and resolve program integrity weaknesses that OIG has identified.  
For example, CMS should implement the requirement for home health agencies to obtain surety 
bonds to ensure that Medicare can recoup at least some of its overpayments and to potentially 
deter ill-intended providers.   
  CMS needs to strengthen oversight for hospice general inpatient billing and SNF billing.  
 
Combating fraud 
 
Key Components of the Challenge 
Stopping fraud in Medicare is vital to safeguarding healthcare resources and protecting beneficiaries.  
OIG has identified common fraud schemes, such as billing for unnecessary services or services not 
provided; billing for more expensive services than needed or provided; paying kickbacks to recruiters, 
providers, and patients; and medical identity theft.  Program areas susceptible to widespread fraud 
include home health, hospice services, DME, ambulance transportation, and clinical laboratory testing.  
Fraud schemes can become viralspreading and replicating through communitiesand can also 
evolve quickly.  This creates challenges for CMS and law enforcement to detect and quickly respond to 
emerging schemes.  
 
Since June 30, 2011, the Fraud Prevention System (FPS) has continuously run predictive algorithms and 
other sophisticated analytics nationwide against Medicare FFS claims prior to payment to identify, 
prevent, and stop fraudulent claims.  When performing work to certify the actual and projected savings 
8 
   
and the return on investment related to HHSs use of FPS, OIG found that HHS might not have the 
capability to trace the savings from administrative actions back to the originating FPS model or 
formula.  CMS could not track those savings because, according to CMS, that capability was not built 
into FPS.  In addition, CMS did not make use of all pertinent performance results because it did not 
ensure that contractors adjusted savings reported to CMS reflected the amounts certified by OIG, and 
CMS did not evaluate FPS model performance on the basis of the amounts expected to be prevented or 
recovered.  
 
CMS needs accurate information to avoid doing business withand exposing beneficiaries to
untrustworthy actors or ineligible providers.  However, fraudulent providers sometimes provide false or 
incomplete information on ownership and business associations or misrepresent themselves to appear 
legitimate.  Untrustworthy actors may also try to circumvent program safeguards in other ways.  For 
example, an OIG review found that some patient lists supplied by home health agencies were missing 
Medicare beneficiaries, which excluded them from surveyor inspections.  This illustrates a vulnerability 
that home health agencies could exploit to conceal fraudulent activity or health and safety violations. 
 
Progress in Addressing the Challenge 
In February 2016, CMS issued a technical direction letter (TDL) to the Zone Program Integrity 
Contractors (ZPICs or contractors) clarifying how to determine which administrative actions were 
attributable to the FPS.  Additionally, in August 2018, CMS began providing the contractors with an 
annual report listing administrative actions and associated savings that CMS deemed FPS attributable 
and those CMS deemed not FPS attributable.  This allowed CMS to go one step further and ensure that 
contractors adjusted savings reflected the amounts certified by OIG. 
 
In March 2017, CMS launched an updated FPS version (FPS 2.0) that modernizes system and user 
interfaces, improves model development time and performance measurement, and aggressively 
expands CMSs program integrity capabilities.  During FY 2016, the FPS models generated 688 leads that 
were included in the ZPICs workload, resulting in 476 new investigations and augmented information 
for 212 existing investigations.  CMS has also implemented a system to attribute savings from 
administrative actions back to specific models.  CMS is also revising the FPS savings methodology.  
 
HHS partners with OIG and the U.S. Department of Justice (DOJ) on Health Care Strike Force teams and 
other healthcare fraud enforcement activities through the Health Care Fraud and Abuse Control (HCFAC) 
program.  Over its 22-year history, the HCFAC program has recovered billions of dollars and has further 
protected Federal healthcare programs by convicting criminals and excluding providers from 
participation in Medicare and other Federal healthcare programs.  
 
Most recently, HHS, along with State and Federal law enforcement partners, participated in an 
unprecedented nationwide healthcare fraud takedown aimed at combating healthcare fraud and the 
opioid epidemic (see TMC #1 for more information on the opioid epidemic).  More than 600 defendants 
in 58 Federal districts were charged for their alleged participation in schemes involving approximately 
$2 billion in losses to vital healthcare programs, including Medicare.   
 
CMS partners with OIG and DOJ in many ways to fight fraud.  For example, Medicare and Medicaid 
policy experts, OIG and DOJ law enforcement officials, clinicians, and CMS fraud investigators coordinate 
before, during, and after the development of fraud leads to expedite referrals and investigation of 
providers suspected of endangering beneficiaries and/or defrauding Medicare.  OIG, CMS, and DOJ also 
9 
   
coordinate with private sector health insurers through the Healthcare Fraud Prevention Partnership and 
the National Healthcare Anti-Fraud Association.  
 
What Needs To Be Done 
  CMS should fully employ available program integrity tools to prevent payment to fraudulent 
providers.  For example, CMS must continue improving its oversight and the performance of 
contractors implementing Medicare provider enrollment safeguards.   
  CMS should make better use of the performance results within its FPS to refine and enhance its 
predictive analytic models. 
 
Fostering prudent payment policies 
 
Key Components of the Challenge 
Medicare should act as a prudent payer on behalf of taxpayers and beneficiaries by instituting 
economical payment policies.  However, in certain contexts, Medicare payment policies, which are 
generally set by statute, result in Medicare and beneficiaries paying more for care provided in certain 
settings than for the same care provided in other settings.  For example, Medicare could potentially save 
$4.1 billion over a 6-year period if swing-bed services at critical access hospitals were paid for at the 
same rates as at SNFs.  
 
Medicare also pays hospitals different amounts for the same care depending on whether the hospital 
admits beneficiaries as inpatients or treats them as outpatients.  Medicare and beneficiaries coverage 
for SNF services and coinsurance costs following discharge also vary depending on their status as 
hospital inpatients or outpatients, even if they receive the same care during their stay. 
 
Some payment policies create financial incentives that may actually drive up Medicare costs without 
improving care for beneficiaries.  For example, OIG found that Medicare payments to SNFs for therapy 
greatly exceeded SNFs costs for that therapy, creating incentives to bill for unnecessary therapy (see 
TMCs #4 and #11 for more information on challenges of anticipating and addressing financial incentives 
in additional areas, including value-based payments and drug pricing and access). 
 
Progress in Addressing the Challenge 
HHS has been instituting changes to promote more prudent payment policies in some healthcare 
settings.  For example, recent statutory changes require Medicare to stop paying certain new hospital-
owned, off-campus, provider-based departments that charge higher hospital rates than freestanding 
facilities that perform the same services for less.  CMS projects that this will have saved Medicare 
approximately $50 million in 2017.  CMS finalized the Patient Driven Payment Model, a new payment 
system for SNFs to be implemented in FY 2020, which bases Medicare payment on beneficiaries 
conditions and care needed rather than on volume of services provided.   
 
What Needs To Be Done 
  CMS can take actions within existing authorities to mitigate financial risks and quality-of-care risks 
under the current systems.  For example, CMS should reform the payment policy for hospices to 
align payments to costs and address the financial incentives for hospices to target beneficiaries likely 
to have long stays.   
10 
   
  CMS should evaluate the extent to which Medicare payment rates for therapy should be reduced, as 
well as adjust Medicare payments to SNFs to eliminate any increases in payments for therapy that 
are unrelated to changes in beneficiary characteristics.  CMS should also use data analytics to target 
oversight to SNFs that may be inappropriately billing for therapy.   
  CMS can test and rigorously evaluate the effectiveness and efficiency of new payment and delivery 
models.   
  
 
Maximizing the promise of health information technology 
 
Key Components of the Challenge 
Leveraging the benefits of Health Information Technology (Health IT) to ensure the appropriate flow of 
complete, accurate, timely, and secure information and to improve patient care is critical to promoting a 
value-driven healthcare system.  HHS faces challenges in achieving a connected healthcare system in 
which data, including healthcare data and human services data about social determinants of health, flow 
freely, as appropriate.  Challenges for HHS include ensuring that Health IT companies and providers do 
not inappropriately block the flow of information, preventing inappropriate payments to participants 
who do not meet program requirements, ensuring that electronic health records (EHR) are not used as 
tools for fraud, encouraging adoption and use of Health IT by those not eligible for existing incentive 
programs, ensuring that patient safety benefits are realized, and encouraging high-value uses of 
exchanged data.  To avoid potential gaps in policy and oversight that could undermine the promise of 
Health IT, HHS must ensure coordination among internal agencies and other Federal partners that have 
overlapping responsibility for various aspects of Health IT (see TMC #10 for more information on the 
intersection of HHSs data privacy and security). 
 
Progress in Addressing the Challenge 
HHS continues to develop programs and policies that foster the development, adoption, and effective 
use of Health IT to support the appropriate flow of complete, accurate, timely, and secure information 
within Medicare.  As of July 2018, more than 642,500 eligible professionals and hospitalsincluding 
critical access hospitalswere actively registered in the EHR incentive programs.  CMS and the Office of 
the National Coordinator for Health IT (ONC) have also undertaken efforts to educate providers about 
EHR fraud vulnerabilities, including conducting sessions with stakeholders on EHR coding and billing.   
 
HHS also finalized a rule to implement the Medicare Access and CHIP Reauthorization Act of 2015 
(MACRA) provisions that replaced the Medicare EHR Incentive Program for eligible professionals with a 
performance category within Merit Based Incentive Payments System (MIPS).  Additionally, HHS is in the 
process of implementing various provisions of the Cures Act that will facilitate the appropriate flow of 
complete, accurate, timely, and secure data.  OIG will play a role moving forward by using its new civil 
monetary penalty (CMP) authority to enforce information-blocking violations. 
 
What Needs To Be Done 
  CMS must ensure that data collected and relied upon for Medicare program purposes are complete, 
accurate, timely, and secure, and that evolving technologies, such as telemedicine, achieve their 
intended results.   
  HHS must address barriers to the appropriate flow of complete, accurate, timely, and secure data 
among providers, beneficiaries, and other stakeholders.   
11 
   
  ONC and CMS should strengthen their collaborative efforts to develop a comprehensive plan to 
address fraud vulnerabilities in EHRs. 
  To the extent that resources, cost, and quality performance are measured on the basis of Medicare 
Parts A and B claims data, CMS must ensure the soundness and reliability of such data. 
  CMS should adopt sound record-retention and documentation practices for all of Medicare FFS 
while being mindful of minimizing the burdens placed on those implementing the practices.  
Key OIG resources 
  Not All Recommended Safeguards Have Been Implemented in Hospital EHR Technology (OEI-01-
11-00570), December 2013.  
  Medicare Could Have Saved Billions at Critical Access Hospitals if Swing-Bed Services Were 
Reimbursed using the Skilled Nursing Facility Prospective Payment System Rates (A-05-12-
00046), March 2015. 
  The Centers for Medicare and Medicaid Services Could Improve Performance Measures 
Associated with the Fraud Prevention System (A-01-15-00509), September 2017.  
  Medicare Paid Hundreds of Millions in Electronic Health Record Incentive Payments That Did Not 
Comply with Federal Requirements (A-05-14-00047), June 2017.   
 
 
 
 
12 
   
3.  Ensuring Program Integrity and Effective Administration 
of Medicaid 
 
Why This Is a Challenge 
Key Components of the Challenge 
Medicaid is the largest Federal healthcare program, with 67   Improving the reliability of 
million individuals enrolled, and represents one-sixth of the 
national Medicaid data 
national health economy.  Medicaid is administered by States,   Reducing improper payments 
according to Federal requirements.  The program is funded   Combating fraud 
jointly by the Federal Government and States.  For   Ensuring appropriate Medicaid 
FY 2017, CMS estimated Federal and State Medicaid 
eligibility determinations 
expenditures of $592 billion.  Expenditures are projected to 
 
increase at an average annual rate of 5.7 percent and reach over $1 trillion by 2026.  Effectively 
administering the Medicaid program takes on heightened urgency as it continues to grow in spending 
and the number of beneficiaries served.  The Department provides States with flexibility to administer 
their Medicaid programs, so they can design innovative waivers based on the unique needs of their 
Medicaid enrollees (see TMC #4 for more information on challenges specific to managed care).  
 
Improving the reliability of national Medicaid data  
 
Key Components of the Challenge 
Data is an essential tool for detecting fraud, waste, and abuse and administering the program effectively 
and efficiently.  However, OIGs work has identified numerous issues with the completeness and 
reliability of Medicaid data.  The lack of reliable national Medicaid data hampers States, CMSs, and 
other stakeholders ability to quickly detect potential fraud, waste, or quality concerns at the State, 
multi-State, and national levels.  While all 50 States, the District of Columbia, and Puerto Rico are now 
reporting Transformed Medicaid Statistical Information System (T-MSIS) data, data must be reliable, 
timely, and accurate to be of use to States, CMS, and other stakeholders in making comparisons across 
all States and identifying national trends and vulnerabilities.  
 
Progress in Addressing the Challenge  
CMSs efforts to work with States to report T-MSIS data has led to all 50 States, the District of Columbia, 
and Puerto Rico now reporting T-MSIS data.  CMS also reported efforts underway to improve T-MSIS 
data through various data quality methods.  On August 10, 2018, CMS issued a State Health Official 
letter that provided additional guidance to States on T-MSIS implementation.  The letter stated that 
CMS expects States to resolve data quality for 12 top-priority items no later than 6 months after the 
date of the letter; for any State that cannot meet that timeframe, CMS would request a corrective action 
plan.  CMS also anticipates making T-MSIS research-ready files available in 2019.   
 
What Needs To Be Done 
  CMS and States need to make complete, reliable, accurate, and timely T-MSIS data a management 
priority.  In doing so, CMS should establish and adhere to a deadline for when national T-MSIS data 
will be available for program oversight and management.   
  CMS must ensure that the same data elements are consistently reported and uniformly interpreted 
across States and use its enforcement authorities when States are not submitting timely and 
complete data.  
13 
   
 
Reducing improper payments 
 
Key Components of the Challenge 
Reducing improper payments to providers is a critical element in protecting the financial integrity of the 
Medicaid program.  In FY 2017, HHS reported that it did meet the FY 2016 reduction target of 9.57 
percent and reported an actual 10.10 percent improper payment rate in the Medicaid program.  CMS 
must do more to ensure that Medicaid payments are made to the right providers, for the right amounts, 
for the right services, on behalf of the right beneficiaries.  OIG audits have identified substantial 
improper payments to providers across a variety of Medicaid services, including school-based services, 
nonemergency medical transportation, targeted case management services, and personal care services. 
 
Progress in Addressing the Challenge  
CMS has engaged with State Medicaid agencies to develop corrective action plans that address 
State-specific reasons for improper payments as a part of CMSs Payment Error Rate Measurement 
(PERM) program, which measures Medicaid improper payments.  In 2018, CMS also resumed the 
Medicaid Eligibility Quality Control program requiring States to engage in pilots studying certain 
eligibility determinations for accuracy, a program meant to complement State PERM reviews.  CMS also 
engaged a contractor to design an Express Lane Eligibility error rate measurement methodology for 
States.  CMS also has facilitated national best practices calls to share ideas across States, provided State 
education through the Medicaid Integrity Institute, offered ongoing technical assistance, and provided 
additional guidance as needed to address the root causes of improper payments.  Time will tell whether 
CMSs efforts to measure and provide guidance yield reductions in improper payments. 
 
What Needs To Be Done 
  CMS should continue to engage with State Medicaid agencies to develop corrective action plans and 
provide specific guidance to States regarding services and benefits most vulnerable to improper 
payments.   
 
Combating fraud 
 
Key Components of the Challenge 
A useful strategy to prevent Medicaid provider fraud is to keep bad actors intent on committing fraud 
from enrolling in the program.  However, States are not screening high-risk providers with all the tools 
at their disposal, including site visits and required fingerprint-based criminal background checks during 
enrollment.  In addition, sharing enrollment data across States and with Medicare enrollment data 
systems would streamline the Medicaid enrollment process and reduce the chance for error within any 
one database.  Also, national Medicaid data can be used to identify fraud schemes and other 
vulnerabilities that cross State lines.  Identifying such schemes in one State can alert other States to 
patterns of fraudulent or abusive practices that may be occurring in their jurisdiction.  However, the lack 
of reliable national Medicaid data hampers enforcement efforts.  For example, OIG published a data 
brief identifying concerns about extreme use and questionable prescribing of opioids in Medicare Part 
D.  Unfortunately, OIG currently cannot replicate this type of analysis at a national level in Medicaid 
without national data such as what has been promised through T-MSIS.   
 
   
14 
   
Progress in Addressing the Challenge  
CMS actively works with States on site visits and fingerprint-based criminal background checks to 
identify barriers related to State implementation and compliance with Federal requirements.  This work 
includes issuing guidance, known as the Medicaid Provider Enrollment Compendium, to assist States in 
strengthening their provider screening and enrollment processes. To further streamline Medicaid 
provider enrollment, CMS has employed the use of a data compare tool, which allows States to compare 
their provider population against the data on those providers already screened and enrolled in 
Medicare.  CMS also engages with States at least monthly via technical assistance calls when concerns, 
questions, and best practices are addressed and shared.  
 
What Needs To Be Done 
  CMS should continue to work directly with States to implement tools like site visits or fingerprint-
based criminal background checks for high-risk providers.   
  CMS should develop a central repository or one-stop shop with provider information that all 
States and Medicare can use.  This could reduce data-collection duplication and burdens on States 
and providers and improve the completeness and accuracy of the data available to these programs. 
  CMS should establish a deadline for when national T-MSIS data will be available for multistate 
program integrity efforts.  
 
Ensuring appropriate Medicaid eligibility determinations  
 
Key Components of the Challenge 
CMS faces challenges in ensuring that States appropriately apply criteria for Medicaid eligibility.  The 
Affordable Care Act allowed States to expand Medicaid eligibility for certain low-income adults and 
claim a higher Federal Medical Assistance Percentage for those who are newly eligible under the 
expansion.  OIG reviews in three States estimated that more than $1.2 billion in Federal Medicaid 
payments has been made on behalf of potentially ineligible and ineligible beneficiaries.  Lack of 
beneficiary eligibility systems functionality was a key contributor to these payments.    
 
Progress in Addressing the Challenge  
CMS indicated that it will initiate audits of State beneficiary eligibility determinations in States 
previously reviewed by OIG and will resume measuring eligibility under the PERM program in FY 2019.  
These audits will include an assessment of the impact of changes to State eligibility policies because of 
Medicaid expansion; for example, CMS will review whether beneficiaries were found eligible for the 
correct Medicaid eligibility category.  
 
What Needs To Be Done 
  CMS should closely monitor States to ensure they are correctly determining Medicaid eligibility for 
beneficiaries.   
  CMS should continue to work with States to ensure that eligibility systems are able to verify 
eligibility, develop and implement written policies and procedures to address vulnerabilities, and 
undertake redeterminations as appropriate.  
 
   
15 
   
Key OIG resources 
  Status Update: T-MSIS Data Not Yet Available for Overseeing Medicaid (OEI-05-15-00050), June 
2017. 
  U.S. Department of Health and Human Services Met Many Requirements of the Improper 
Payments Information Act of 2002 but Did Not Fully Comply for Fiscal Year 2017 (A-17-18-
52000), May 2018. 
  Medicaid Fraud and Overpayments: Problems and Solutions (OIG Testimony), June 2018. 
  Improper Payments in State-Administered Programs: Medicaid (OIG Testimony), April 2018. 
  Medicaid Enhanced Provider Enrollment Screenings Have Not Been Fully Implemented (OEI-05-
13-00520), May 2016.  
  New York Did Not Correctly Determine Medicaid Eligibility for Some Newly Enrolled Beneficiaries 
(A-02-15-01015), January 2018. 
  California Made Medicaid Payments on Behalf of Newly Eligible Beneficiaries Who Did Not Meet 
Federal and State Requirements (A-09-16-02023), February 2018. 
  New Jersey Claimed Hundreds of Millions in Unallowable or Unsupported Medicaid School-
Based Reimbursement (A-02-15-01010), November 2017.  
 
 
 
 
 
   
16 
   
4.  Ensuring Value and Integrity in Managed Care and Other 
Innovative Healthcare Payment and Service Delivery 
Models 
 
Why This Is a Challenge  
Key Components of the Challenge 
The HHS Secretary has made the transition to value-based 
 Ensuring effectiveness and 
care a top priority for the Department.  HHS continues to 
integrity in new models 
enact reforms in Medicare and Medicaid that are designed to 
 Combatting provider fraud and 
promote quality and value of care.  Understanding what 
abuse 
constitutes value and whether it is delivered is a challenge in 
 Fostering compliance by managed 
complex healthcare programs and services.  As managed care 
care organizations 
continues to play an increasingly important role in the 
Medicare and Medicaid programs, ensuring that beneficiaries 
get the services they need is essential.  Finally, developing and implementing managed care and other 
innovative models in ways that promote innovation and effectiveness, while also protecting against 
fraud, waste, and abuse, is a significant challenge.   
 
Ensuring effectiveness and integrity in new models 
 
Key Components of the Challenge 
HHS continues to seek innovative ways to move Medicare and Medicaid from volume-based payment to 
value-based payment.  This shift involves the design of new systems, including through experimentation 
and development of new payment and coordinated care approaches.  Developing effective incentives 
and policies can be difficult given complexities of the programs, the populations they serve, and the 
national healthcare system.  HHS faces obstacles in correctly measuring the value of care.  It can be a 
challenge to design measures that effectively incentivize high-quality care without being overly 
prescriptive or burdensome to providers.  The Department is exploringvia a Deputy Secretary led 
Regulatory Sprint to Coordinated Carewhether better care coordination can be fostered through 
changes to existing laws that some view as barriers to coordination, including certain fraud and abuse 
laws administered by CMS and OIG, as well as certain SAMHSA and Office for Civil Rights (OCR) 
regulations.  
 
CMS continues to manage a range of programs and test models through the Center for Medicare and 
Medicaid Innovation that address value-driven system reforms to improve quality of care in Medicare 
and Medicaid and reduce expenditures.  New payment structures, business arrangements among 
providers, and incentives all give rise to risk-management challenges.  In pursuing innovative models to 
improve the healthcare system, CMS must take steps to prevent programs and policies from having 
unintended consequences, such as misaligned incentives or abusive practices. 
 
Progress in Addressing the Challenge 
CMS continues to develop and administer new models and existing models and value-based programs, 
such as the Quality Payment Program and the Medicare Shared Savings Program.  CMS has proposed 
changes to the Medicare Shared Savings Program to increase savings for the Trust Funds and mitigate 
losses, reduce gaming opportunity, and increase program integrity.  CMS continues to coordinate with 
OIG on tailored waivers of fraud and abuse laws, where needed and authorized, to test and carry out 
17 
   
value-based models.  HHS has published Requests for Information to seek stakeholder input on ways to 
revise certain fraud and abuse laws to promote care coordination without undermining their original 
fraud prevention purposes.      
 
In 2017, CMS launched the Meaningful Measures Initiative.  CMS has sought to enhance quality 
measurement by focusing on high-impact areas for quality improvement, identifying outcome-based 
measures that are most useful to patients and clinicians, minimizing the level of provider burden, and 
aligning the measures across programs.  
 
What Needs To Be Done 
  In testing value-based care models, CMS must continue to focus on program integrity risks, 
incorporate safeguards to reduce them, and promptly correct identified issues.  This is especially 
important for models that introduce new payment incentives, which might lead to new fraud 
schemes, and for models for which waivers of payment, coverage, or fraud and abuse laws may 
have been issued.   
  Where applicable, CMS must clearly define actionable and meaningful quality measures, ensuring 
their reliability and accuracy.  CMS and other agencies currently using quality measurements should 
further align these efforts to reduce unnecessary provider burden.   
  Moving forward, HHS will need to ensure that any metrics are effective, evidence-based measures 
for quality improvement.  
 
Combatting provider fraud and abuse  
 
Key Components of the Challenge 
Managed care is the primary delivery system for Medicaid and covers approximately 80 percent of all 
enrollees.  In Medicare, one-third of beneficiaries are enrolled in Medicare Advantage Organizations 
(MAOs).  Fraud, waste, and abuse in Medicaid and Medicare cost taxpayers billions of dollars every year.  
MAOs and Medicaid Managed Care Organizations (MCOs) are essential to safeguarding the Medicare 
and Medicaid programs and taxpayer dollars.  However, weaknesses exist in their efforts to identify and 
address fraud and abuse.  Limitations in Medicare and Medicaid encounter data also hinder efficient and 
effective program oversight and program integrity (see TMC #3 for more information on Medicaid data 
limitations).  In addition, CMS does not require MAOs to include the identifiers for ordering and 
referring providers in their encounter data submissions, which makes it more difficult to detect potential 
fraud, waste, and abuse through data analytics.  
 
Managed care plans often fail to effectively identify and address fraud and abuse by their providers.  
CMS requires MAOs and Medicaid MCOs to implement compliance plans that include measures to 
prevent, detect, and correct instances of fraud, waste, and abuse; however, these vary widely among 
the plans, as does the detection of suspected fraud.  In Medicaid managed care, program integrity 
responsibilities are even more dispersed, as they are shared among CMS, States, and MCOs.  This makes 
effective oversight by CMS more complex and challenging.   
 
Progress in Addressing the Challenge  
CMS is working to validate the completeness and accuracy of MAO and Medicaid MCO encounter data.  
CMS has increased its efforts to enhance data accuracy and recently released best practice guidance for 
MAOs to improve encounter data submission.  CMS is also working with States to provide technical 
18 
   
assistance and education to identify and share best practices for improving Medicaid MCO identification 
and referral of cases of suspected fraud or abuse.  
 
CMS conducts State Program Integrity Reviews, which include State oversight of Medicaid MCOs and 
compliance with applicable Federal regulations.  For those States not compliant, CMS has provided 
technical assistance and requested corrective plans to address any identified concerns. 
 
What Needs To Be Done 
  CMS should take further actions to ensure the completeness, validity, and timeliness of MAO and 
Medicaid encounter data.  This includes requiring MAOs to report identifiers for ordering and 
referring providers.  Having comprehensive data is crucial to safeguard the programs integrity and 
solvency and to ensure that beneficiaries are receiving quality care.   
  CMS should work with its contractors and with States to make improvements in efforts to identify 
and address fraud and abuse.   
  CMS should work to ensure that appropriate information and referrals are sent to law enforcement.   
 
Fostering compliance by managed care organizations  
 
Key Components of the Challenge 
HHS must be vigilant about risks posed to HHS funds and beneficiaries by MAOs and Medicaid MCOs 
contracted to deliver healthcare services.  These entities have incentives to maximize the capitated 
payments received while minimizing their costs in providing healthcare services.  In Medicaid, OIG has 
found significant vulnerabilities in provider availability, which is a key indicator for access to care.  
Without adequate access, enrollees cannot receive the preventive care and treatment necessary to 
achieve positive health outcomes and improved quality of care.  In Medicare, OIG found high rates of 
appealed denials are overturned, and CMS commonly cites MAOs for inappropriate denials in its audits.  
This raises concerns that some beneficiaries and providers may not be getting services and payments 
that MAOs are required to authorize under the Medicare program.  
 
Progress in Addressing the Challenge  
CMS has initiated audits to ensure that Medicaid MCOs are complying with the medical loss ratio 
standard that they spend at least 85 percent of their capitation rate on medical care and activities that 
improve beneficiary quality of care.  CMS is also working to ensure that beneficiaries have adequate 
access to providers.  For example, CMS requires State Medicaid agencies to develop and implement 
provisions that ensure beneficiaries have adequate access to Medicaid covered services.  Furthermore, 
CMS published a toolkit and resource guide to assist States with ensuring adequate provider networks.  
In 2017, CMS issued guidance and best practices regarding increasing the accuracy of provider 
directories and stated that it plans to perform directory monitoring activities that could result in 
enforcement actions for MAOs. 
 
What Needs To Be Done 
  CMS should work with States and MAOs to see that plans networks are substantial enough to 
ensure timely access to care for Medicaid and Medicare managed care beneficiaries.   
  CMS should enhance its oversight of MAO contracts including those with extremely high overturn 
rates and/or low appeal rates and take corrective action as appropriate.  
19 
   
Key OIG resources 
  Medicare Shared Savings Program Accountable Care Organizations Have Shown Potential for 
Reducing Spending and Improving Quality (OEI-02-15-00450), August 2017. 
  CMS Ensured That Medicare Shared Savings Beneficiaries Were Properly Assigned (A-09-17-
03010), October 2017. 
  Early Implementation Review: CMSs Management of the Quality Payment Program (OEI-12-16-
00400), December 2016.  
  Followup Review: CMSs Management of the Quality Payment Program (OEI-12-17-00350), 
December 2017.  
  Weaknesses Exist in Medicaid Managed Care Organizations Efforts to Identify and Address 
Fraud and Abuse (OEI-02-15-00260), July 2018. 
  Medicare Advantage Organizations Identification of Potential Fraud and Abuse (OEI-03-10-
00310), February 2012. 
  Medicare Advantage Encounter Data Show Promise for Program Oversight, But Improvements 
are Needed (OEI-03-15-00060), January 2018. 
  The MEDIC Produced Some Positive Results but More Could be Done to Enhance its Effectiveness 
(OEI-03-17-00310), July 2018. 
  Access to Care: Provider Availability in Medicaid Managed Care (OEI-02-13-00670), December 
2014. 
  Medicare Advantage Appeal Outcomes and Audit Findings Raise Concerns About Service and 
Payment Denials (OEI-09-16-00410), September 2018. 
 
 
 
 
20 
   
5.  Protecting the Health and Safety of Vulnerable 
Populations 
 
Why This Is a Challenge  
Key Components of the Challenge 
HHS programs provide critical health and human services to 
 Ensuring the safety and security of 
many vulnerable populations in many different settings.  
unaccompanied children in HHS 
Therefore, HHS must ensure that the individuals in HHS 
care 
programs have access to and receive high-quality care and 
 Addressing substandard nursing 
services and are protected from abuse or neglect.   
home care 
 
 Reducing problems in hospice care 
HHS, through the Administration for Children and Families 
 Mitigating risks to individuals 
(ACFs) Office of Refugee Resettlement (ORR), is responsible 
receiving home- and community-
for the ensuring the shelter and care of thousands of 
based services 
unaccompanied alien children (UAC) who enter the U.S. 
 Ensuring access to safe and 
without legal status.  ACF also administers the Child Care and 
appropriate services for children 
Development Fund (CCDF) program and provides funding to 
 Addressing serious mental illness 
State foster care programs.  Ensuring that these children have 
 
access to safe, high-quality care remains a longstanding 
challenge for HHS. 
  
Additionally, healthcare providers such as nursing homes, group homes, and hospices have continued to 
experience issues with ensuring quality of care and safety for vulnerable individuals.  HHS has not always 
acted to correct deficiencies in these facilities.  
 
Ensuring the safety and security of unaccompanied children in HHS care 
 
Key Components of the Challenge  
Most UAC are initially taken into custody by the Department of Homeland Security (DHS) at the U.S. 
border and transferred into ORRs custody.  ORR provides temporary shelter, care, and other related 
services to UAC, often in facilities operated by grantees that receive funding from ORR.  HHS has 
encountered challenges caring for UAC in ORR grantee facilities, especially when the UAC program 
experiences a sudden surge in the number and/or needs of children.  In FY 2017 alone, more than 
40,000 UAC were referred to ORR custody, a dramatic increase from the 13,625 UAC referred in FY 
2012.11  Challenges also exist to ensuring the safety and well-being of UACs after being released to 
sponsors. 
 
OIG reviews of ORR grantees determined that some grantees may not have complied with certain 
program requirements, including releasing children to sponsors without conducting all required 
background checks and documentating that public record checks were conducted on sponsors.  As a 
result, ORR does not have assurance that all grantees properly released children to sponsors. 
     
                                                           
11 ORR, Facts and Data, June 25, 2018.  Accessed at: https://www.acf.hhs.gov/orr/about/ucs/facts-and-data. 
21 
   
Progress in Addressing the Challenge 
HHS has increased its efforts to promote the safety and well-being of UAC after their release from HHS 
care.  ORR continues to provide case management services to the most vulnerable children; additionally, 
ORR now attempts to contact children and sponsors 30 days after release and operates helplines 
available to all children and sponsors.   
 
HHS has also improved its coordination with DHS related to UAC.  In February 2016, HHS and DHS signed 
a formal agreement to outline each Departments roles and responsibilities related to UAC.  In 2017, OIG 
also reported that HHS had improved its coordination with DHS and increased its efforts to promote the 
safety and well-being of UAC after their release from HHS custody. 
 
What Needs To Be Done 
  ACF should continue to ensure the health and safety of children in ORR care, especially when the 
program experiences a sudden change in the number and/or needs of children.   
  OIG will continue to provide oversight of the UAC program.  For instance, OIG is conducting ongoing 
audits of ORR facilities compliance with health and safety requirements as well as internal financial 
controls.  OIG is also conducting a review focusing on the care and well-being of children residing in 
ORR-funded facilities.   
  OIG will continue to examine instances of potential criminal misconduct to determine whether an 
investigation or referral is needed.  
 
Addressing substandard nursing home care  
 
Key Components of the Challenge  
Many nursing home residents are at risk of abuse and neglect.  OIG identified instances of nursing 
facilities failing to identify and report abuse and neglect as required, as well as deficiencies in 
procedures for enforcing requirements.  For example, OIG identified 134 Medicare beneficiaries whose 
injuries may have been the result of potential abuse or neglect that occurred from January 1, 2015, 
through December 31, 2016.  OIG also identified instances where States fell short in conducting 
investigations of serious nursing home complaints within required timeframes.  
 
Progress in Addressing the Challenge 
HHS has taken steps to promote quality and prevent abuse and neglect.  This includes making progress 
in developing the SNF Value-Based Purchasing Program, planned for launch in FY 2019.  HHS has 
improved reporting of accurate nursing home quality information through the Nursing Home Compare 
Program and Five-Star Quality Rating System.  HHS also works closely with law enforcement partners at 
DOJ and the Elder Justice Interagency Working Group to promote better care for older adults and to 
prosecute providers that subject them to abuse or neglect. 
 
CMS has revised its requirements and guidelines for nursing home surveyors to focus on assessing 
adverse event identification and reductions.  To help raise awareness of adverse events in post-acute 
care, CMS collaborated with the Agency for Healthcare Research and Quality to promote and create a 
final list of potential nursing home events.  Additionally, OIG has entered quality-of-care corporate 
integrity agreements with more than 40 nursing home companies covering more than 1,000 facilities.  
These agreements require providers to retain an independent monitor to perform clinical and quality 
reviews and assessments of the delivery of quality healthcare.  
 
22 
   
What Needs To Be Done 
  HHS should implement strategies to strengthen oversight of nursing homes and improve nursing 
care.  For example, HHS should monitor how often nursing home residents are hospitalized and 
develop additional resources to help providers avoid adverse events.   
  HHS must improve internal controls, as well as surveyor guidance and training, to ensure that 
nursing homes correct deficiencies and prevent recurrence of safety and quality issues. 
  CMS should improve identification and reporting of nursing home resident abuse and neglect.  For 
instance, CMS should take immediate action to ensure that incidents of potential abuse or neglect 
of Medicare beneficiaries residing in SNFs are identified and reported.   
  To reduce incidence of adverse events, CMS should instruct nursing home surveyors to review 
facility practices for identifying and reducing adverse events, as well as assist States that are failing 
to meet timeframes for investigating nursing home complaints.  
 
Reducing problems in hospice care  
 
Key Components of the Challenge 
OIGs body of work on the Medicare hospice benefit has identified numerous quality of care problems 
for Medicare beneficiaries in the hospice general inpatient care setting.  For example, OIG found that 
most beneficiaries, including beneficiaries with complex needs, do not see a hospice physician, and key 
services to control pain and manage symptoms are sometimes lacking.  OIG also raised concerns about 
hospice beneficiaries and their caregivers not receiving the information they need to make informed 
decisions.   
 
Additionally, investigations have uncovered hospices enrolling patients without the beneficiarys 
knowledge or under false pretenses, enrolling beneficiaries who are not terminally ill, billing for services 
not provided, paying kickbacks, and falsifying documentation.  
 
Progress in Addressing the Challenge 
HHS launched the Hospice Compare web site to facilitate public access to hospice quality data.  
Medicare Administrative Contractors have targeted their monitoring toward hospices that rely heavily 
on nursing facility residents.  By seeking out these residents, hospices may be looking to increase their 
profits by only serving beneficiaries associated with longer but less complex care.  Additionally, HHS is 
also taking enforcement actions against hospices fraudulently enrolling beneficiaries.   
 
What Needs To Be Done 
  CMS should improve quality of care and consumer protections by strengthening the survey process.  
This will better ensure that hospices provide beneficiaries with needed services and quality care.   
  CMS should promote physician involvement and accountability to guarantee that beneficiaries 
receive appropriate care, as well as take steps to tie payments to beneficiary care needs and quality 
of care to confirm that services rendered adequately serve beneficiaries needs.   
  CMS can take steps to make available consumer-friendly information that explains the hospice 
benefit to families and caregivers.  
 
 
23 
   
Mitigating risks to individuals receiving home- and community-based services 
 
Key Components of the Challenge 
In recent decades, healthcare has shifted from institutional care settings to more community-based 
services and support, such as group homes.  These settings provide beneficiaries greater independence, 
increased flexibility for providers, and access to more opportunities than in an institutional setting.  
However, OIG has found that group home health and safety policies and procedures are not always 
followed, leaving beneficiaries at risk of serious harm.  This is a systemic problem; in recent years, 49 
States had media reports of health and safety problems in group homes.12   
 
Payment and quality vulnerabilities also exist in home settings.  Reported fraud and abuse incidents in 
personal care services (PCS) are a substantial and growing percentage of MFCU cases and outcomes.    
OIG work has demonstrated that existing program safeguards intended to ensure medical necessity, 
patient safety, and quality and prevent improper payments were often ineffective.  In addition, OIG 
interviews with Medicaid beneficiaries revealed quality-of-care concerns including serious allegations 
including physical abuse or threats of abuse, property theft, and patient abandonment.  Without proper 
control and oversight mechanisms, unscrupulous attendants could expose beneficiaries to substandard 
quality of care and injury. 
 
Progress in Addressing the Challenge 
In an HHS joint report, the Administration for Community Living (ACL), the HHS OCR, and OIG developed 
Model Practices that provide States with a roadmap for how to implement better health and safety 
practices.  The report provides States with models for incident management and investigation, incident 
management audits, mortality reviews, and quality assurance.15  In response to the Joint Reports 
suggestions, CMS issued an Informational Bulletin in June 2018 to encourage States to implement 
compliance oversight programs for group homes, such as the Model Practices.13 
 
HHS is working with MFCUs to prevent, detect, and take enforcement action against PCS providers 
suspected of fraud or abuse.  The Cures Act mandated that CMS implement the electronic visit 
verification (EVV) system for all Medicaid PCS and home health services that require an in-home visit by 
a provider.14  CMS reported that it currently has reviewed 30 advance planning documents (APDs) from 
31 States (including the Arizona and Hawaii joint APD), and 11 States have implemented EVV. 
 
What Needs To Be Done 
  CMS should continue to implement the Model Practices outlined in the HHS joint report.  CMS needs 
to take immediate action in response to serious health and safety findings in home- and community-
based services providers.   
  CMS must also help ensure successful State implementation of EVV for all Medicaid PCS by January 
1, 2020, and for home health services by January 1, 2023.   
  CMS should issue policies and procedures to ensure effective reporting of critical incidents.  
 
                                                           
12 OIG, ACL, OCR, Ensuring Beneficiary Health and Safety in Group Homes Through State Implementation of Comprehensive 
Compliance Oversight, January 2018.  Accessed at: https://www.hhs.gov/sites/default/files/report_joint_report_hcbs.pdf. 
13 CMS, CMCS Informational Bulletin, June 2018.  Accessed at: https://www.medicaid.gov/federal-policy-
guidance/downloads/cib062818.pdf. 
14 CMS, Electronic Site Visit Verification.  Accessed at: https://www.medicaid.gov/medicaid/hcbs/guidance/electronic-visit-
verification/index.html. 
24 
   
 
Ensuring access to safe and appropriate services for children  
 
Key Components of the Challenge 
OIG has identified vulnerabilities related to CCDF childcare providers who received neither a verified 
background check nor the necessary training, based on State requirements in place prior to changes in 
Federal requirements.  In addition, OIG audits conducted in 10 States found that 96 percent of CCDF 
childcare providers visited had at least one health and safety violation.  OIG also found that more ACF 
oversight of States CCDF programs is needed.  For instance, some States monitoring requirements for 
CCDF childcare providers did not always meet recommendations issued by ACF prior to changes in 
Federal requirements.  States also reported limitations in technology, resources, and coordination as 
challenges to program integrity.  Taken together, these findings highlight the need for stronger ACF and 
State oversight to ensure that safe, high-quality care is provided to children. 
 
In State foster care programs, OIG found that nearly one-third of children in foster care enrolled in 
Medicaid did not receive required health screenings.  Additionally, some States protocols for the use 
and monitoring of psychotropic medications for children in foster care were lacking treatment planning 
and medication monitoring.  OIG has also identified instances in which States did not always ensure that 
documentation existed that Title IV-E eligible children received required healthcare and case 
management services.  
 
Progress in Addressing the Challenge 
HHS is working with States to implement expanded background checks for childcare providers mandated 
by the reauthorization of the Child Care and Development Block Grant Act of 2014.  States are in the 
process of designing and implementing health and safety training for all providers before care begins 
and ongoing as professional development.  HHS is also implementing a new on-site monitoring process 
to ensure that States are meeting Federal childcare requirements. 
 
ACF continues to provide oversight of State compliance with Federal healthcare oversight requirements 
for children in foster care through ongoing program administration, and on-site monitoring through 
Child and Family Services Reviews, and technical assistance to State child welfare agencies to promote 
best practices.  Additionally, ACF plans to engage State foster care managers to discuss how to improve 
oversight of psychotropic medications for children in foster care.  CMS is also working with States to 
reduce inappropriate prescribing of antipsychotic drugs for children in foster care and to improve access 
to dental care for children in Medicaid.   
 
What Needs To Be Done 
  ACF needs to ensure that States are complying with required health and safety standards for 
childcare providers and examine the effectiveness of program integrity and fraud-fighting activities. 
  ACF needs to improve its oversight of State foster care programs to ensure that children are 
receiving required health screenings in a timely manner, as well as treatment planning and 
medication monitoring.  Specifically, ACF should improve compliance and strengthen State 
requirements to protect children at risk for inappropriate psychotropic medication treatment and 
prescribing.   
 
   
25 
   
Addressing serious mental illness 
 
Key Components of the Challenge  
In 2016, nearly one in five adults aged 18 or older in the U.S. (about 44.7 million) lived with a mental 
illness, and only 43 percent (about 19.2 million) of these adults received mental health treatment in the 
prior year.  Additionally, in 2016, roughly 1 in 25 adults (about 9.8 million) in the U.S., age 18 and older, 
battled a serious mental illness, such as a psychotic or major depressive disorder.   
 
Medicare and Medicaid both serve significant patient populations in need of mental health services. 
However, beneficiaries may experience barriers to accessing care, including being limited both 
geographically and by type of service.  The Interdepartmental Serious Mental Ilness Coordinating 
Committee has found that relatively few adults with serious mental illness receive effective treatments, 
effective treatment models that exist are not widely available, most counties in the U.S. face shortages 
of mental health professionals, and most States report insufficient psychiatric crisis response capacity as 
well as insufficient numbers of psychiatric hospital beds.15  OIG has ongoing work examining reported 
access issues in certain State Medicaid managed care programs.   
 
Progress in Addressing the Challenge 
As required under the Cures Act, HHS released the Action Plan for Enhanced Enforcement of Mental 
Health and Substance Use Disorder Coverage in April 2018, which focuses on improvement of Federal 
and State coordination related to the enforcement of certain mental health and substance use disorder 
parity provisions.  The Cures Act also authorized a new Assertive Community Treatment grant program 
for individuals with a serious mental illness, which helps communities improve behavioral health 
outcomes by reducing hospitalization rates of patients with serious mental illness.16 
In addition, mental healthcare has been included in Essential Health Benefits since January 1, 2014.  The 
Mental Health Parity and Addiction Equity Act (P.L. 110-343) requires Medicaid and CHIP programs to 
comply with mental health and substance use disorder parity requirements.  On March 29, 2016, CMS 
published a final rule applying these requirements to certain Medicaid plans and all CHIP programs, 
resulting in the expansion of parity protections to about 23 million more individuals.17  In 2016, HHS 
participated in the White House Mental Health and Substance Abuse Disorder Parity Task Force, which 
issued recommendations to Federal agencies on supporting consumers, improving parity 
implementation, and enhancing parity compliance and enforcement.18  In response to the Parity Task 
Forces findings, HHS created a Mental Health and Substance Abuse Disorder Parity website, which 
provides parity-specific resources to consumers and providers, as well as updates on new ways Federal 
agencies enforce and clarify parity regulations.19 
 
                                                           
15 Interdepartmental Serious Mental Illness Coordinating Committee, The Way Forward: Federal Action for a System That Works 
for All People Living With SMI and SED and Their Families and Caregivers, December 2017.  Accessible at 
https://www.samhsa.gov/sites/default/files/programs_campaigns/ismicc_2017_report_to_congress.pdf  
16 HHS, FY2019 Budget in Brief, February 19, 2018.  Accessed at: https://www.hhs.gov/sites/default/files/fy-2019-budget-in-
brief.pdf. 
17 Federal Register, March 29, 2016.  Accessed at: https://www.federalregister.gov/documents/2016/03/30/2016-
06876/medicaid-andchildrens-health-insurance-programs-mental-health-parity-and-addiction-equity-act-of 
18 White House Mental Health and Substance Use Disorder Parity Task Force, Final Report, October 2016.  Accessed at: 
https://www.hhs.gov/sites/default/files/mental-health-substance-use-disorder-parity-task-force-final-report.PDF. 
19 HHS, Mental Health and Substance Use Disorder Parity.  Accessed at: https://www.hhs.gov/programs/topic-sites/mental-
health-parity/index.html. 
26 
   
HHS is increasing grant funding to develop strategies to expand access to mental health services and for 
mental health awareness training.  New methods, including telemedicine, are also increasingly used to 
provide increased mental health access, particularly in rural areas.  The Bipartisan Budget Act of 2018 
expanded telehealth services for Medicare Advantage plans and Accountable Care Organizations. 
 
What Needs To Be Done 
  While HHS agencies have taken steps to increase mental health parity and funding for mental health 
services, they can take additional steps to increase the access and quality of mental health services, 
particularly for serious mental illness.   
  CMS should improve efforts to ensure beneficiaries have appropriate access to mental health 
services and to reduce barriers to care.   
  HHS can take steps to implement the Mental Health and Substance Abuse Disorder Parity Task 
Forces recommendations.  
  
Key OIG resources 
  Florence Crittenton Services of Orange County, Inc., Did Not Always Meet Applicable Safety 
Standards Related to Unaccompanied Alien Children (A-09-16-01005), June 2018.  
  HHSs Office of Refugee Resettlement Improved Coordination and Outreach to Promote the 
Safety and Well-Being of Unaccompanied Alien Children (OEI-09-16-00260), July 2017.  
  Early Alert: CMS Has Inadequate Procedures to Ensure That Incidents of Potential Abuse or 
Neglect at Skilled Nursing Facilities Are Identified and Reported in Accordance With Applicable 
Requirements (A-01-17-00504), August 2017.  
  Vulnerabilities in the Medicare Hospice Program Affect Quality Care and Program integrity: An 
OIG Portfolio (OEI-02-16-00570), July 2018.  
  Some WA State Group-Care Facilities for Children in Foster Care Did Not Always Comply with 
State Health and Safety Requirements (A-09-16-01006), March 2018.  
  Series of OIG reports on childcare providers compliance with State health and safety 
requirements (http://oig.hhs.gov/oas/child-care/). 
  Child Care and Development Fund: Monitoring of Licensed Child Care Providers (OEI-07-10-
00230), November 2013.  
  More Effort Is Needed to Protect the Integrity of Child Care and Development Fund (OEI-03-16-
00150), July 2016.  
  Treatment Planning and Medication Monitoring Were Lacking for Children in Foster Care 
Receiving Psychotropic Medication (OEI-07-15-00380), September 2018. 
  Ohio Did Not Always Comply with Requirements Related to the Case Management of Children in 
Foster Care (A-05-16-00022), May 2018.  
  Oklahoma Did Not Always Comply with Requirements for Providing Health Care Services to 
Children in Foster Care (A-06-16-07006), February 2018.  
 
 
 
   
27 
   
6.  Improving Financial and Administrative Management and 
Reducing Improper Payments  
 
Why This Is a Challenge 
Key Components of the Challenge 
HHS is the largest civilian agency in the Federal Government.  
 Addressing weaknesses in 
In FY 2017, HHS reported total budgetary resources of 
financial management systems 
approximately $1.1 trillion.  Responsible stewardship of HHS 
 Addressing Medicare trust fund 
programs is vital, and operating a financial management and 
issues/social insurance 
administrative infrastructure that employs appropriate 
 Reducing improper payments 
safeguards to minimize risk and provide oversight for the 
 Improving contract management 
protection of resources remains a challenge for HHS.  Due to 
 Implementing the DATA Act 
their size, HHS programs account for some of the largest 
 
estimated improper payment amounts.  HHS must also ensure 
 
the completeness, accuracy, and timeliness of any financial and program information provided to other 
entities, both internal and external to the Federal Government.  
 
Addressing weaknesses in financial management systems 
 
Key Components of the Challenge 
OIG continues to report a material weakness in HHSs financial management systems related to 
inadequate internal controls over segregation of duties, configuration management for approved 
changes to HHS financial systems, and access to HHS financial systems.  OIG continues to report that 
HHS does not substantially comply with requirements for financial system management because of 
these issues.  Under the Federal Financial Management Improvement Act of 1996, Federal agencies 
must establish and maintain financial management systems and OIGs must report on compliance by 
their respective agency.  These systems help agencies ensure operational effectiveness and efficiency, 
financial reporting reliability, and compliance with applicable laws and regulations. 
 
Progress in Addressing the Challenge 
HHS has continued to take corrective actions to resolve the IT-related deficiencies reported in the 
Agency Financial Report (AFR).  In FY 2017, the Information Technology Material Weakness Working 
Group continued its HHS-wide focus on corrective actions.  As a result, many prior-year control 
deficiencies related to user access, configuration management, and segregation of duties have 
improved.  OIG noted investments and other actions that led to the remediation of these findings and 
which should improve internal controls over key financial management systems.   
 
What Needs To Be Done 
  HHS still needs to take additional actions to address and resolve the material weakness in its 
financial management systems.   
  HHS should continue to work to control user access.   
  HHS should ensure proper approval of system changes and maintain appropriate documentation 
that supports the approval of these changes.   
  HHS should ensure appropriate segregation of duties so that no one employee can both enter and 
approve information entered into HHS financial management systems.   
 
28 
   
Addressing Medicare trust fund issues/social insurance 
 
Key Components of the Challenge 
The Statement of Social Insurance (SOSI) presents the actuarial present value of (1) contributions and 
tax income (excluding interest income); (2) scheduled expenditures; and (3) the difference between the 
two for all current and future participants (open group) of the Medicare program for the projection 
period, which covers 75 years.  The Statement of Changes in Social Insurance Amounts (SCSIA) 
reconciles the beginning and ending open group measures and presents the components of the changes 
for 2 years.  These statements cover the Medicare FFS, Medicare Advantage, and Medicare Prescription 
Drug Benefit programs, and the amounts they disclose are based on current law.  According to the 2018 
Annual Report of the Boards of Trustees of the Federal Hospital Insurance and Federal Supplementary 
Medical Insurance Trust Funds, the Trustees assume that the various cost-reduction measures included 
in the Affordable Care Act will occur as current law requires.  The Trustees stated that to achieve this 
outcome, healthcare providers would have to realize productivity adjustments at a faster rate than 
experienced historically.  The Trustees also stated that should healthcare providers be unable to 
transition to more efficient models of care delivery and achieve productivity increases commensurate 
with economy-wide productivity and if the provider reimbursement rates paid by commercial insurers 
continue to be based on the same negotiated process in use, the availability and quality of healthcare 
received by Medicare beneficiaries under current law would fall short when compared to private health 
insurance.  The Trustees also stated in the 2018 report that the Federal Hospital Insurance Trust Fund 
now is expected to be depleted by 2026 and that spending for Federal Supplementary Medical 
Insurance is expected to exceed inflation in the next 5 years.  
 
The Medicare Board of Trustees included in the Annual Trustees Report an alternative scenario to 
illustrate, where possible, the potential understatement of Medicare costs and projection results.  Since 
2010, OIG has noted the inherent difficulties in projecting growth in healthcare costs over time and 
issued a disclaimer of opinion on the SOSI and SCSIA based on these uncertainties.   
 
Progress in Addressing the Challenge 
In FY 2017, HHS continued to present an illustrative alternative scenario to the current legal projections 
for Medicare to show the potential magnitude on Medicare outlays if certain components of current law 
are not sustainable.  According to the CMS Chief Actuary, the techniques and methodology used to 
evaluate the financial status of the Federal Hospital Insurance Trust Fund and the Federal 
Supplementary Medical Insurance Trust Fund are based on sound principles of actuarial practice.  With 
certain caveats, the principal assumptions used and the resulting actuarial estimates are individually, 
and in the aggregate, reasonable for evaluating the financial status of the trust funds.  The Federal 
Accounting Standards Advisory Board (FASAB) does not have any active or planned projects that would 
revise existing guidance related to SOSI.  OIG continues to expect to issue a disclaimer of opinion on the 
SOSI and SCSIA until the variances between income and expenditures between current law and the 
illustrative alternative scenario become much less significant.   
 
What Needs To Be Done 
  HHS should continue to work with the CMS Chief Actuary to analyze the Patient Protection and 
Affordable Care Act and its impact on providers ability to sustain the productivity adjustments.  The 
ability to sustain these productivity adjustments would greatly narrow the large variance between 
current law and the illustrative scenario.   
29 
   
  HHS should continue to support actions needed to ensure the long-term viability of the Federal 
Hospital Insurance Trust Fund. 
  HHS should continue to work with FASAB to revise the accounting standards for SOSI and SCSIA.  
 
Reducing improper payments 
 
Key Components of the Challenge 
Reducing improper payments is a critical element in protecting the financial integrity of HHS programs.  
Although not all improper payments constitute fraud, all improper payments pose a risk to the financial 
security of Federal programs.  Pursuant to the Improper Payments Information Act of 2002 (IPIA), as 
amended, Federal agencies are required to provide uniform, annual estimates on improper payments 
and their efforts to reduce them for high risk programs.  In the FY 2017 AFR, HHS reported improper 
payments of more than $90 billion for seven of the eight programs designated high risk and susceptible 
to improper payments.  In the audit report of the HHSs FY 2017 AFR, published in May 2018, OIG found 
that while HHS met many requirements, HHS did not meet all IPIA requirements.  Specifically, HHS did 
not report an improper payment estimate for the Temporary Assistance for Needy Families (TANF) 
program, as HHS does not believe it has the statutory authority to collect from States the data necessary 
for calculating such a rate.  
 
In FY 2017, HHS reported that the improper payment rate exceeded 10 percent for the Medicaid 
program.  In addition, two other programs that the Office of Management and Budget (OMB) has 
deemed susceptible to risk of improper payments (CHIP and Foster Care programs) did not meet their FY 
2017 improper payment reduction target error rates (see TMC #3 for more information on reducing 
Medicaid improper payments). 
 
Progress in Addressing the Challenge 
In FY 2017, HHS awarded a 5-year contract for promoting and supporting innovation in TANF data, and 
one component of this contract is to help HHS and stakeholders better understand how States assess 
improper payments and ensure program integrity.  This assessment will help HHS understand existing 
State and alternative approaches to estimating improper payments for TANF.  CMSs various corrective 
action efforts brought the Medicare FFS program into compliance with IPIA, resulting in reporting an 
improper payment estimate of less than 10 percent for the first time in several years.  In the case of 
Medicaid, CMS continues working with the States to develop State-specific corrective action plans.  CMS 
also shared Medicare data to assist States with meeting Medicaid screening and enrollment 
requirements and provided ongoing guidance, education, and outreach.  CMS also offered training, 
technical assistance, and additional support to improve States Medicaid program integrity (see TMC #3 
for more information on reducing Medicaid improper payments). 
 
What Needs To Be Done 
  HHS must continue to pursue needed legislative remedies to develop an appropriate methodology 
for measuring TANF payment accuracy and report an improper payment estimate for TANF.  
  HHS should address and reduce improper payments in the Medicaid program. 
  HHS must continue to establish and meet improper payments reduction targets, and report 
improper payments of less than 10 percent for all programs.   
 
30 
   
Improving contract management   
 
Key Components of the Challenge 
HHS is the fourth largest contracting agency in the Federal Government.  In FY 2017, HHS awarded more 
than $24 billion in contracts across all program areas.  These contracts can often have complex 
strategies involving multiple contractors, making them difficult to manage.  Given the high dollar 
amounts and complexity of its contracts, it is paramount that HHS have strong monitoring and oversight.   
 
However, challenges to the contract systems remain.  OIG has identified vulnerabilities in acquisition 
planning and procurement and contract monitoring.  For instance, key HHS contracts may not always 
undergo Contract Review Board oversight before being awarded, and when awarding contracts, CMS 
has not always performed thorough reviews of contractors past performance.   
 
OIG has also raised issues regarding payments to contractors and contract closeouts.  In the past, CMS 
and other agencies have frequently chosen contract types that place the risk of cost increases solely on 
the Government.  Large backlogs of unclosed contracts can pose a significant financial risk to HHS.  
Finally, HHS has faced obstacles in the oversight and performance measurement of its benefit integrity 
contractors, which sometimes have substantial differences in the number of investigations initiated and 
cases referred to law enforcement.  
 
Progress in Addressing the Challenge 
HHS has taken steps to enhance its acquisition systems and better monitor contract closeouts and 
contract payments.  CMSs Office of Acquisition and Grants Management (OAGM) has increased 
productivity on its current backlog and implemented a quarterly closeout report that collects and 
monitors closeout data from each division.  Additionally, CMS has improved the functionality of its 
Comprehensive Acquisition Management System to better track vendor invoicing.  
 
CMS has also increased its efforts in examining workload statistics for benefit integrity contractors and 
improving performance outcomes.  New investigations in program integrity priority areas (including 
home health, hospice, and laboratory services) increased from 18 to 25 percent from 2015 to 2016.  The 
percentage of payment suspensions associated with the priority areas increased from 48 to 58 percent 
during that same time.   
 
What Needs To Be Done 
  To reduce vulnerabilities in acquisition planning and procurement, HHS should take steps to ensure 
that acquisition strategies are completed as required.  
  Awarding agencies should assign systems integrators to complex contracts whenever appropriate, 
and CMS should ensure that its contracts undergo Contract Review Board oversight prior to being 
awarded.   
  HHS must continue to strengthen its contracts oversight to assist in contract closeout and funds 
management.   
  HHS can take further steps to improve coordination and collaboration across departmental staff 
with contract closeout responsibilities by, for example, establishing and maintaining guidelines for 
the division of work.  
 
31 
   
Implementing the DATA Act 
 
Key Components of the Challenge 
The Digital Accountability and Transparency Act of 2014 (DATA Act) required OMB and the Department 
of the Treasury to establish government-wide data standards for reporting financial and payment 
information by May 2015.  Broadly, the DATA Act required that HHS begin using the government-wide 
data standards to enter information into USASpending.gov by May 2017 to ultimately increase 
transparency and accountability.  The DATA Act also required the Inspector General of each agency to 
determine the accuracy, completeness, timeliness, and quality of this data.  For FY 2017, OIGs audit of 
compliance with the DATA Act found that HHS complied with data standards established by OMB and 
the Department of the Treasury and entered the required information into USASpending.gov within the 
established timeframe.  However, OIG found HHS relied on a manual and excessively labor-intensive 
process to comply with the government-wide data standards and continues to experience issues, as 
described above, with the information systems that support this data. 
 
Progress in Addressing the Challenge 
For FY 2017, HHS met the requirements for data accuracy, completeness, timeliness, and quality as well 
as complied with the reporting timeline established in the DATA Act. 
 
What Needs To Be Done 
  HHS must continue to address the weaknesses in its key financial management systems as described 
above and limit the need to rely on manual processes to submit the required data.  
 
Key OIG resources 
  U.S. Department of Health and Human Services Met Many Requirements of the Improper 
Payments Information Act of 2002 but Did Not Fully Comply for Fiscal Year 2017 (A-17-18-
52000), May 2018.  
  OIG Report on Financial Statement Audit of Health and Human Services for Fiscal Year 2017 (FY 
2017 HHS Agency Financial Report), November 2017. 
  CMS Has Not Performed Required Closeouts of Contracts Worth Billions (OEI-03-12-00680), 
December 2015.  
  CMS Did Not Identify All Federal Marketplace Contract Costs and Did Not Properly Validate the 
Amount to Withhold for Defect Resolution on the Principal Federal Marketplace Contract (A-03-
14-03002), September 2015.  
  U.S. Department of Health and Human Services Met the Requirements of the Digital 
Accountability and Transparency Act of 2014, but Key Areas Require Improvement (A-17-17-
02018), November 2017. 
 
32 
   
7.  Protecting the Integrity of HHS Grants  
 
Why This Is a Challenge 
Key Components of the Challenge 
In FY 2017, HHS awarded $101 billion in grants (excluding 
 Ensuring appropriate and effective 
CMS).  HHS has increasingly used grant programs to address a 
use of grant funds 
variety of public health needs and crises, including the opioid 
 Ensuring effective grant 
epidemic, emergency preparedness, and natural disaster 
management at the department 
relief efforts (see TMCs #1 and #12 for more information on 
level 
these grants).  This expansion comes with an increased need 
 Ensuring program integrity and 
to effectively manage grant funding.  The growth of Federal 
financial capability at the grantee 
funding to State and local governments also requires 
level 
additional verification of existing controls and reporting 
 Combating fraud, waste, and 
requirements. 
abuse 
 
 
Ensuring appropriate and effective use of grant funds 
 
Key Components of the Challenge 
Administering grant programs requires implementing internal controls to help ensure that program 
goals are met and funds are used appropriately.  This includes oversight of both recipients and sub-
recipients.  Otherwise, funds can be misspent, duplication of services can occur, and sub-recipients may 
not be adequately monitored.  Grant files must also be kept in an organized, accessible manner, which 
allows auditors and third-party reviewers to assess program appropriateness and effectiveness in a 
comprehensive, streamlined manner.  OIG consistently identifies fraud and improper payments in the 
CCDF program. 
 
Progress in Addressing the Challenge 
HHS has begun its ReInvent Grants Management initiative as part of ReImagine HHS, a department-wide 
effort to evaluate how to best perform its mission.  This initiatives goal is to re-engineer the entire grant 
lifecycle to eliminate duplication and waste, and to reduce grantee burden.  As part of this initiative, 
HHS has promoted enhancing performance measurements during application, award, and management 
processes.  The Department is planning to develop analytical methods to allow better assessments of 
impact and value-based grant funding.  HHS has also worked to provide quality assurance guidance to 
grantees.  HRSA, for example, provided more specific guidance to grantees regarding the focus of their 
quality assurance programs and how they should conduct periodic assessments.   
 
What Needs To Be Done 
  HHS must maintain transparency and accountability for Federal funds.  This includes ensuring that 
all HHS agencies maintain official files in accordance with HHS policy.   
  Grant programs will need to effectively set baseline expectations and incentivize improvement. 
  HHS should also issue an updated Grants Policy Statement that references the Part 75 grant rules 
and reflects the changes made by that rule.  
  HHS must examine States methods for ensuring that sub-recipients of CCDF funds are adequately 
performing program integrity activities.   
  When necessary, HHS should expand the scope of its State reviews to ensure that compliance with 
States CCDF plans are sufficiently assessed.  
33 
   
 
Ensuring effective grant management at the departmental level 
 
Key Components of the Challenge 
HHS is responsible for providing infrastructure for overseeing grants across the Department.  
Information must be effectively shared across grant programs to both correct for grant-awarding 
systems that do not interface and prevent the potential duplication of grant missions and funding.  To 
fulfill this responsibility, HHS must collect and maintain timely, accurate, and complete data on grants 
programs.  HHS should also implement OIG recommendations in a timely manner, which will ensure that 
Federal funds are effectively and efficiently used to carry out only the activities for which they are 
authorized.  
 
Progress in Addressing the Challenge 
In implementing its ReInvent Grants Management initiative, HHS has indicated a move towards 
outcome-based performance management in its grant process.   
 
HHS is taking steps toward improving the interoperability of its IT systems.  The HHS Office of the 
Assistant Secretary for Financial Resources (ASFR) has conducted an analysis to plan the implementation 
and usage of integrated databases that contain grantees past performance data, which will help 
promote transparency and accountability.  In its ReInvent Grants Management initiative, HHS has begun 
implementing plans to develop a single platform that would streamline data entry and management and 
align shared services grant systems. 
 
ASFR has taken steps to increase department-wide coordination.  For instance, it has taken steps to 
facilitate department-wide information-sharing regarding grantees with past performance issues, which 
could help identify and prevent duplicative payments in the future.  Additionally, on October 1, 2018, 
the Department launched the HHS Audit Tracking and Analysis System (ATAS).  The system was primarily 
designed to systematically automate the assignment of Single Audit findings.  The implementation of 
ATAS supports the Department and operating divisions in the timely resolution of Single Audit findings, 
intra-Department visibility of these findings, and identification of potential grantee risks across 
operating divisions. 
 
What Needs To Be Done 
  In implementing its new initiative, the Department will need to set appropriate measurement 
standards, monitor outcomes, and oversee program integrity.   
  HHS must use ASFRs ongoing analysis to guide the full implementation of interoperable grant 
management systems.   
  HHS agencies should continue to use data and technology to improve grant system management.   
  HRSA can develop additional data processes that work across the grant management lifecycle to 
reduce the elevated financial risks of health centers.  
 
   
34 
   
Ensuring program integrity and financial capability at the grantee level 
  
Key Components of the Challenge 
In managing its many grant programs, HHS is responsible for providing up-to-date policies to grantees, 
along with addressing States and other grantees inadequate financial management and internal 
controls.  OIG has identified grantee-level concerns in many HHS programs, including some UAC 
program grantees reporting unallowable costs and lacking effective systems for administering program 
funds; States not sufficiently overseeing their CCDF program payments; and Head Start grantees not 
properly addressing audit findings.  HHS also must hold States accountable to complying with the 
activities they outline in their specific State plans.  
Progress in Addressing the Challenge 
HHS has taken steps to improve its outreach and training on financial risk assessments for grant 
programs.  The Department is providing information to HHS operating divisions on risk assessments, 
which they have used to update their policies.  HRSA, for example, has updated its risk management 
process incorporating OIG input.  Recently, NIH announced an increased effort to protect the integrity of 
U.S. biomedical research by partnering with NIH-funded academic institutions, relevant Government 
agencies, and other stakeholders.  The initiative focuses on improving accurate reporting, mitigating risk 
to intellectual property security, and protecting the integrity of peer review.  Furthermore, HHS also 
continues to conduct provider record reviews and onsite visits.  For the CCDF program, States 
participating in site visits complete a self-assessment on fiscal responsibilities that identifies risks and 
issues related to program payments, as well as mitigation steps to improve practices.  ACF has also 
implemented a new monitoring process for CCDF to help assess compliance with activities reported in 
State CCDF plans. 
 
What Needs To Be Done 
  HHS awarding agencies should work with States and other grantees to assess and strengthen their 
program integrity and program evaluation tools.  For example, ACF should provide training for Head 
Start grantees on how to implement corrective action plans and take steps to resolve recurring Head 
Start Single Audit findings.   
  HHS should help increase States and other grantees fraud-fighting efforts.  HRSA, for example, 
should continue to explore additional steps that it could take to help health centers reduce their 
elevated financial risk.   
 
Combatting fraud, waste, and abuse 
 
Key Components of the Challenge 
HHS faces persistent and heightened challenges in preventing fraud in its grant programs.  Without 
sufficient grantee oversight and internal controls, grants are vulnerable to fraud schemes, including 
embezzlement.   
 
Progress in Addressing the Challenge 
HHS has worked to increase its employees knowledge of and effectiveness in combatting fraud.  For 
instance, it has collaborated with OIG on training opportunities, including the OIG 2018 Grants Forum, 
that have focused on topics related to fraud, including suspension and disbarment and how to report 
potential fraud, waste, and abuse. 
 
35 
   
HHS has also worked to strengthen some program integrity efforts.  For instance, it issued guidance to 
HHS awarding agencies about facilitating a review of prospective grantees prior to awarding grants.  This 
information enhances awarding agencies assessment of prospective grant recipients integrity and 
potential performance.  In addition, the Federal Awardee Performance and Integrity Information System 
database includes informationsuch as contractor criminal, civil, and administrative proceedings 
related to Federal awards, and suspensions and debarmentsthat will improve HHSs access to 
information pertaining to contractor misconduct and performance.  
 
Further, HHS awarding agencies have begun reaching out to OIG regarding allegations of fraud.  For 
example, HRSA officials referred allegations to OIG that resulted in significant criminal convictions and 
recoveries on behalf of HRSAs grant program and shut down a fraud scheme in which Federal funds 
were being stolen and diverted for personal use.   
 
What Needs To Be Done 
  HHS grant programs, grantees, and sub-recipients, in collaboration with OIG, must work to recognize 
the prevalent fraud schemes and regularly engage in antifraud activities, including reviewing 
provider records for potential fraud, identifying duplicate payments, performing verification checks, 
and conducting onsite visits.   
  Once identified, HHS, grantees, and grant sub-recipients must continue to refer suspected fraud to 
OIG.   
  All HHS agencies with grant programs should work to increase their number of referrals each year.  
This collaboration and referrals will allow for the full use of all available enforcement remedies
criminal, civil, and administrativewhen fraud, waste, or abuse is identified. 
 
Key OIG resources 
  Not All of Missouris Child Care Subsidy Program Payments Complied with Federal and State 
Requirements (A-07-1504226), November 2017.   
  Texas Did Not Appropriately Spend Some State Balancing Incentive Payments Program Funds (A-
06-15-00041), December 2017. 
  The National Institutes of Health Did Not Always Administer Superfund Appropriations During 
Fiscal Year 2015 In Accordance With Federal Requirements (A-04-16-04046), February 2018.   
  The Administration for Children and Families Region II Did Not Always Resolve Head Start 
Grantees Single Audit Findings in Accordance With Federal Requirements (A-02-16-02009), 
February 2018.  
  HRSA Helped Health Centers with Elevated Risks and Can Continue to Take Additional Steps 
(OEI-05-14-00470), May 2018.   
  The Administration for Children and Families Did Not Always Resolve Audit Recommendations In 
Accordance With Federal Requirements (A-07-1703225), July 2018. 
  More Effort Is Needed to Protect the Integrity of the Child Care and Development Fund Block 
Grant Program (OEI-03-16-00150), July 2016. 
 
   
36 
   
8.  Ensuring the Safety of Food, Drugs, and Medical Devices  
 
Why This Is a Challenge 
FDA has the continuing challenge of ensuring the safety and 
Key Components of the Challenge 
security of the Nations food and medical products (including 
 Ensuring food safety 
drugs, biological products, and medical devices), which 
 Ensuring the safety, effectiveness, 
directly affect the health of every American.  With an annual 
and quality of drugs and medical 
budget of more than $5 billion, FDA oversees products that 
devices 
represent about 20 percent of all U.S. consumer spending.  
 Ensuring the security of drug 
FDA has a broad statutory mandate that has continued to 
supply chains 
expand through recent legislation.  The Cures Act, for 
instance, provided new authorities to help spur medical 
 
innovation and modernize medical product regulation throughout a products lifecycle.   
   
Ensuring food safety 
 
Key Components of the Challenge 
Each year roughly 48 million people get sick from a foodborne illness, 128,000 are hospitalized, and 
3,000 die.20  FDA inspects food facilities to ensure food safety and compliance with regulations.  Various 
administrative tools and enforcement authorities can be used to protect the public from unsafe food.  
However, FDA faces challenges in ensuring that inspections of domestic food facilities are conducted in a 
timely manner and that significant inspection violations are corrected.  FDA has not always used its full 
enforcement authorities and faces obstacles in maintaining an efficient and effective food recall process.  
 
Progress in Addressing the Challenge 
FDA is currently on track to meet the domestic food facility inspection timeframes for the initial cycles 
mandated by the Food Safety Modernization Act.  It has also initiated a new food recall quality system 
audit process and has developed a plan to provide early notice to the public.  FDA also established the 
Strategic Coordinated Oversight of Recall Execution (SCORE) initiative, a team of FDA senior leaders that 
examines cases that present significant hazards to human health and makes decisions pertaining to 
challenging high-risk food-recall cases. 
 
What Needs To Be Done 
  FDA should work to keep the food supply safe by creating a process for timely, effective corrections 
of problems identified during domestic food facility inspections.   
  FDA should take appropriate actions against all food facilities with significant inspection violations. 
  Procedures should also be in place to guarantee that food recalls are initiated promptly.  For 
example, FDA should use its SCORE initiative to establish set timeframes, expedite decision making 
and move recall cases forward, and improve electronic recall data.  
 
   
                                                           
20 CDC, Food Safety, Foodborne Illnesses and Germs, February 16, 2018.  Available at: 
https://www.cdc.gov/foodsafety/foodborne-germs.html. 
37 
   
Ensuring the safety, effectiveness, and quality of drugs and medical devices 
 
Key Components of the Challenge 
FDAs responsibility to ensure safe and effective medical devices begins before a device is brought to 
market and continues after FDA approval.  This includes overseeing facilities; reviewing drugs, devices, 
and biologics for safety and efficacy; authorizing the use of investigational medical products; and 
conducting postmarket surveillance.  FDA oversees more than 8,500 drug facilities and 21,000 medical 
device facilities, and in 2017, FDA approved 56 novel drugs and biologics, 80 first-time generic drugs, 5 
biosimilars, and 95 novel medical devices.  FDA, in partnership with State authorities, also oversees 
compounded drugs, which are not subject to FDAs premarket process.  It continues to identify issues 
with the development of compounded drugs.  
 
FDA must make sure that medical devices remain safe and retain an acceptable quality after they have 
entered the market.  This involves adapting to changing technology and reviewing many factors both 
pre- and post-market release, including any potential cybersecurity threats to medical devices.   
 
Cybersecurity of medical devices is increasingly important for patients safety and health.  With devices 
increasingly dependent on software and Internet access, procedures to address cybersecurity risks 
before and after a device is cleared or approved are essential.   
 
Progress in Addressing the Challenge 
FDA has worked to implement the tools provided by Congress in the Cures Act to help promote the 
development of safe and effective medical devices.  For example, in December 2016 FDA established the 
Regenerative Medicine Advanced Therapy designation program as authorized in the Cures Act.  Since 
the RMAT program inception, 24 RMAT Designations have been granted as of June 30, 2018.  This 
program is intended to facilitate efficient development, and expedite review, of certain regenerative 
medicine therapies for serious conditions through, among other things, early and frequent interactions 
between FDA and product sponsors.  
 
FDA has improved how it conducts its inspections and reviews.  For example, it has increased capacity 
for inspecting generic drug manufacturers by finalizing its policies and procedures for requesting records 
in lieu of or in advance of an inspection.  Additionally, FDA has increased its efforts to address 
cybersecurity as part of the pre-market review process.  For example, FDA issued guidance on device 
submissions and cybersecurity in October 2014, which it uses to assist its cybersecurity review.  On 
October 17, 2018, FDA updated its guidance to better help ensure device manufacturers are adequately 
addressing evolving cybersecurity threats.21 
 
FDA has also taken steps to hold drug manufacturers accountable for satisfying regulatory requirements.  
For instance, it has improved its ability to hold drug manufacturers accountable for fulfilling REMS 
requirements by identifying and following up on incomplete assessments.  For devices, FDA has 
prioritized development of active surveillance through continuing to build out the National Evaluation 
System for Health Technology (NEST) which uses real-world evidence to evaluate premarket and 
postmarket safety, reducing the time and cost of innovative device development, fostering 
reimbursement, and providing greater patient safeguards at a lower cost.  
                                                           
21 FDA, FDA In Brief, October 17, 2018.  Accessed at: 
https://www.fda.gov/NewsEvents/Newsroom/FDAInBrief/ucm623624.htm. 
38 
   
 
What Needs To Be Done 
  FDA must continue to ensure timely implementation of the statutory authority granted in the Cures 
Act.  FDA must also continue to take additional steps to improve both the premarket review process 
and its procedures for responding to postmarket cybersecurity incidents.  This should include 
further integration of cybersecurity assessments into FDAs processes. 
  FDA is encouraging device manufacturers to consider cybersecurity risks and implement controls as 
they create and develop each device to help mitigate potential cybersecurity threats.  In addition, 
FDA should promote the use of early meetings between FDA and device manufacturers to discuss 
specific cybersecurity questions that manufacturers need to address prior to submitting a device 
application to FDA.   
  FDA should include cybersecurity documentation (such as a threat modeling and cybersecurity risk 
assessment) as part of the hazard analysis describing a devices cybersecurity risks and controls that 
a manufacturer has considered, in information that manufacturers are required to submit to FDA for 
its premarket review. 
 
Ensuring the security of the drug supply chain 
 
Key Components of the Challenge 
Drug supply chains continue to grow increasingly complex in both domestic and global markets.  As a 
result, intricate supply chains present FDA with many challenges as drugs face risks of diversion, theft, 
counterfeiting, and adulteration.  This makes open communication and exchange of necessary 
information even more important.  To enhance drug supply chain security, the Drug Supply Chain 
Security Act (DSCSA) requires trading partners in the drug supply chain to exchange certain information 
in each drug product transaction and to identify and investigate suspect and illegitimate products.22  It is 
therefore expected that the exchange of complete information among trading partners in the drug 
supply chain will facilitate FDAs investigations, identify harmful medical products, prevent further 
distribution of adulterated products, and facilitate efficient recalls.  
 
Progress in Addressing the Challenge 
Trading partners in the drug supply chain have been exchanging drug product tracing information in 
each transaction since the requirements to do so took effect in 2015.  OIG has found that roughly one-
half of wholesalers, including those representing the vast majority of transactions, exchange everything 
required by FDA.  These companies have also developed a variety of methods for exchanging the 
necessary information.  OIG has also found that dispensers are moving toward full implementation of 
the DSCSA requirements, but that some dispensers may still be unaware of the DSCSA or lack an 
understanding of their drug product tracing responsibilities. 
 
What Needs To Be Done 
  FDA needs to offer more educational and technical assistance to drug wholesale distributors and 
dispensers on how to best implement the drug product tracing provision of the DSCSA. 
 
                                                           
22 Drug Quality and Security Act, P.L. No.113-54, Title II. 
39 
   
Key OIG resources 
  The Food and Drug Administration Food-Recall Process Did Not Always Ensure the Safety of the 
Nations Food Supply (A-01-11-601502), December 2017.  
  Drug Supply Chain Security: Wholesalers Exchange Most Tracing Information (OEI-05-14-00640), 
September 2017. 
  Drug Supply Chain Security: Dispensers Received Most Tracing Information (OEI-05-16-00550), 
March 2018. 
  The Food and Drug Administration Computed Prescription Drug User Fee Rates Accurately (A-
05-17-00040), June 2018.  
  FDA Should Further Integrate Its Review of Cybersecurity Into the Premarket Review Process for 
Medical Devices (OEI-09-16-00220), September 2018.  
 
 
   
40 
   
9.  Ensuring Quality and Integrity in Programs Serving 
American Indian/Alaska Native Populations 
 
Why This Is a Challenge 
Key Components of the Challenge 
Many HHS programs provide health and human services to 
 Addressing deficiencies in IHS 
AI/ANs throughout the U.S., with IHS directing the largest 
management, infrastructure, and 
amount of targeted funding to AI/AN communities.  With a 
quality of care 
budget of $5.5 billion in FY 2018, IHS is responsible for 
 Preventing fraud and misuse of 
providing primary and preventive health services to 2.3 
HHS funds serving AI/AN 
million AI/ANs in partnership with the 573 federally 
populations 
recognized Tribes.  Other HHS agencies provide grants to 
 
Tribes for human services programs, including Head Start and 
the Low-Income Home Energy Assistance Program (LIHEAP).  
 
HHS faces significant challenges to ensuring effective delivery of crucial services to AI/AN communities 
and protecting funds from fraud, waste, and abuse.  The AI/AN population historically has had disparate 
health outcomes compared to the rest of the U.S. population.  There have been some important health 
improvements among the AI/AN population over the past two decades, such as reduced mortality rates 
from tuberculosis and heart disease, among others.  Even with these improvements, AI/ANs continue to 
face numerous health disparities in comparison to the national population.  For instance, the infant 
mortality rate for AI/ANs is about 25 percent higher than the national rate, and AI/ANs are almost twice 
as likely as the overall population to have diabetes.  AI/AN populations also have disproportionately high 
rates of suicide, unintentional injuries resulting in death, and drug overdose deaths (see TMC #1 for 
more information on IHS challenges and progress specific to opioid misuse).  Many AI/AN communities 
are in geographically remote locations, adding to the operational and management challenges of the 
HHS programs that serve them. 
 
Addressing deficiencies in IHS management, infrastructure, and quality of 
care 
 
Key Components of the Challenge 
During the past 3 years, Medicare compliance deficiencies affected patient care at 3 of the 25 IHS-
operated hospitals.  Two hospitals lost their Medicare certification and a third closed its emergency 
departments for 7 months in 2016.  These deficiencies have a direct and detrimental effect on patient 
care and relate to several longstanding challenges.  IHS faces difficulties in recruiting and retaining 
essential staff and in maintaining its staffs clinical competency in low-volume hospitals.  Healthcare 
services are provided in remote locations, often in outdated buildings and using old equipment.  
Compounding these problems, the Purchased and Referred Care program, intended to supplement IHS 
services by purchasing select services from non-IHS providers, faces financial shortfalls in at least some 
Areas every year.  When this happens, IHS prioritizes the most acutely urgent requests and some AI/ANs 
go without preventive services, primary and secondary care, and other services.  Additionally, OIG found 
that some IHS hospitals have deficiencies in their continuity of operations programs and disaster 
recovery plans and were unable to retrieve patients records in the event of physical damage.  While 
most of OIGs work has focused on IHS-run facilities, OIG also found that one tribally run health center in 
Maine did not always have a physician who provided medical direction, clear lines of authority and 
41 
   
responsibility between medical and administrative decisionmaking, and medical policies and 
procedures. 
   
OIG found that IHS headquarters and Area offices do not provide sufficient oversight of the quality of 
care provided in IHS facilities.  Area offices have a complaints and patient harm reports  problem.  
Additionally, most area offices depend on infrequent Governing Board meetings to review quality 
metrics. 
 
Progress in Addressing the Challenge  
IHS is working to implement a broad quality framework with several initiatives to improve the care 
provided in its hospitals and clinics.  These initiatives include developing a quality dashboard to track 
compliance and quality efforts, adopting new standards for hospital governing boards, and acquiring a 
new credentialing software system to ensure that providers have necessary qualifications.  IHS is also 
pursuing expanded access for AI/AN services through new telehealth contracts and heightened 
standards for patient appointment-setting and wait times.  IHS also awarded a contract to the Joint 
Commission for accreditation, training, and education to strengthen quality and patient safety.  
Supporting these efforts for IHS hospitals that participate in Medicare, CMS committed to conducting 
more frequent surveys of non-accredited IHS hospitals and is assisting with quality improvement efforts 
in IHS facilities through its Quality Improvement Network, Quality Improvement Organization (QIO), and 
Hospital Engagement Network programs.   
 
What Needs To Be Done 
  To improve quality of care and patient safety, HHS should reconvene a multi-agency council focused 
on overcoming the longstanding challenges to providing high quality care to AI/AN populations.   
  IHS should develop and implement a comprehensive quality-focused compliance program for IHS 
hospitals. 
  IHS should implement an agency-wide strategic plan with actionable initiatives and target dates.   
  CMS should continue to communicate with IHS leadership about deficiencies in IHS facilities 
citations and continue to provide technical assistance and training to IHS hospitals in the QIO 11th 
Scope of Work.   
  IHS should offer technical assistance to Tribes that operate their own clinics pursuant to the Indian 
Self-Determination and Education Assistance Act.  This should include assistance to Tribes that 
operate health centers enrolled as Medicare Federally Qualified Health Centers to help Tribes 
ensure that their health centers are under the medical direction of a physician; establish clear lines 
of authority and responsibility between medical and administrative decisionmaking; and develop 
and implement medical policies and procedures to comply with health and safety requirements. 
  To better protect patient information and continuity of operations for IHS hospitals, IHS should test 
mechanisms at all IHS hospitals to ensure patient information is fully recoverable and implement an 
effective continuity of operations program and disaster recovery plan and procedures in accordance 
with Federal requirements.  
 
   
42 
   
Preventing fraud and misuse of HHS funds serving AI/AN populations 
 
Key Components of the Challenge 
OIG has found fraud and misuse of HHS funds in serving AI/AN populations and has performed audits 
and taken legal action.  OIG has found that some Tribes and Tribal organizations have not adequately 
protected funds under the Indian Self-Determination and Education Assistance Act and other programs, 
resulting in embezzlement and theft of Federal funds.  OIG has also enforced Civil Monetary Penalty 
(CMP) Law to reclaim funds from organizations in violation.  OIG has also identified improper 
administration of funds by Tribes in the Indian Self-Determination and Education Assistance Act program 
and LIHEAP.  Errors included, among others, failure to adequately track and support payments and 
failure to refund unobligated funds as required because the Tribes we audited did not have policies and 
procedures or internal controls to prevent these issues. 
 
Progress in Addressing the Challenge  
In May 2018, OIG led 2 days of compliance training for 250 IHS and Tribal employees and other 
stakeholders on internal controls, compliance programs, and ensuring quality care.  OIG staff also made 
presentations to AI/AN audiences about compliance at four additional conferences led by HHS agencies 
and Tribal members. 
 
OIG has taken multiple actions to prevent the misuse of Federal funding serving AI/AN populations.  For 
example, OIG has enforced CMPs against Tribes and entered into settlement agreements for improperly 
billing Federal healthcare programs.  OIG has identified improper payments at a tribal health clinic 
funded by IHS and in two Tribal LIHEAP programs.  Additionally, OIG entered into a False Claims Act 
voluntary compliance agreement with a Tribe that improperly billed Medicaid, and has assisted DOJ in 
prosecuting Tribal employees who embezzled HHS funds.  
 
What Needs To Be Done 
  HHS agencies should continue to collaborate on strengthening program integrity and safeguarding 
HHS funds intended to serve AI/AN populations.   
  OIG will continue to promote coordination and will expand oversight of HHS programs serving 
AI/ANs by conducting audits alongside OIGs from other departments serving these communities.  
Tribes and Tribal organizations can contribute to these goals by implementing strong internal 
control mechanisms and training staff on compliance and proper procedures, such as adherence to 
OMB cost principles when using Indian Self-Determination and Education Assistance Act funds.  
 
43 
   
Key OIG resources 
  Protecting Indian Health and Human Services Programs and Their Beneficiaries: The Basics of 
Health Care and Grants Management Compliance (OIG 2018 Conference), May 2018. 
  The Indian Health Service Did Not Always Resolve Audit Recommendations in Accordance With 
Federal Requirements (A-07-17-03227), September 2018. 
  The Passamaquoddy Tribes Pleasant Point Health Center Did Not Always Meet Federal and 
Tribal Health and Safety Requirements (A-01-11-701500), July 2018. 
  Two Indian Health Service Hospitals Had System Security and Physical Controls for Prescription 
Drug and Opioid Dispensing but Could Still Improve Controls (A-18-16-30540), November 2017.  
  The Turtle Mountain Band of Chippewa Indians Improperly Administered Some Low-Income 
Home Energy Assistance Program Funds for Fiscal Years 2010 Through 2013 (A-07-16-04233), 
September 2017.  
  The Three Affiliated Tribes Improperly Administered Low-Income Home Energy Assistance 
Program Funds for Fiscal Years 2010 Through 2014 (A-07-16-04230), July 2017.  
  Expenses Incurred by the Rocky Boy Health Board Were Not Always Allowable or Adequately 
Supported (A-07-15-04221), March 2016. 
  Indian Health Service Hospitals: More Monitoring Needed to Ensure Quality Care (OEI-06-14-
00010) and Indian Health Service Hospitals: Longstanding Challenges Warrant Focused 
Attention to Support Quality Care (OEI-06-14-00011), October 2016. 
 
   
44 
   
10.  Protecting HHS Data, Systems, and Beneficiaries from 
Cybersecurity Threats 
 
Why This Is a Challenge  
Data management, use, and security are essential to the 
Key Components of the Challenge 
effective and efficient operation across HHSs agencies and   Securing HHSs data and systems   
programs.  Each agency has its own mission, budget,   Advancing cybersecurity within 
leadership, and IT systems.  HHS spends more than $5 billion 
the healthcare ecosystem 
every year on IT (not including grants-related IT 
 
expenditures).  The environment in which HHS must protect its systems is complex, with ever-increasing 
volumes of data residing in many places and with many entities and individuals, and with continued 
expansion of the Internet of Things, including networked medical devices.  Those possessing health and 
human services dataincluding public stakeholdershave cybersecurity responsibilities, which include 
ensuring effective people, processes, and technologies are in place to protect HHS data.  The 
Departments challenges are, thus, multifaceted and include protecting data on internal systems, 
overseeing the cybersecurity of data in cloud environments, and ensuring that providers, grantees, and 
contractors are adhering to sound cybersecurity principles.  
  
Among HHS operating divisions, CMS is the single largest payer for healthcare in the U.S.  The integrity 
of IT systems used to operate the $900+ billion in programs administered by CMS is thus critically 
important to the health and well-being of the American people.  Oversight of the integrity of State 
Medicaid and MCO IT systems is also under HHSs jurisdiction.  Moreover, the IT systems at FDA, IHS, 
and other HHS agencies present qualitatively different types of cybersecurity challenges.  FDA, for 
example, is charged with regulating the safety, effectiveness, and security of food, cosmetics, drugs, 
biological products, and medical devices (see TMC #8 for more information on challenges specific to 
safety of food, drugs, and medical products).  By contrast, IHS is responsible for providing Federal health 
services to AI/ANs.  FDAs IT systems process and maintain data that looks very different from that of IHS 
and other agencies.  The cybersecurity of IHS systems will continue to remain a focus for OIG, as 
confidentiality, integrity, and availability of IHS healthcare systems is linked to improving care and 
patient safety.  
 
The cybersecurity threats facing HHS are real and pressing.  Healthcare data is a prime target for 
cybercriminals, and the value of a compromised EHR has been reported to be as much as 10 times that 
of a credit card number.  In addition to identity threats, compromising the integrity and availability of 
HHS systems can adversely affect patient care.  The WannaCry ransomware vulnerability, for example, 
affected an estimated 300,000 computers world-wide and resulted in thousands of operations and 
appointments being canceled unless ransoms of $300 to $600 were paid per malware instance.  The 
Department has employed measures to notify hospitals about how to mitigate the impact of this 
vulnerability to the U.S. healthcare system.  
 
Securing HHSs data and systems 
 
Key Components of the Challenge 
The infinite number of threats in cyberspace makes it nearly impossible to prevent every attack that 
looms on the horizon.  As more healthcare functions come online (e.g., the healthcare Internet of 
Things, telemedicine, etc.), HHS will have to address new types of cybersecurity challenges.  Any doubts 
45 
   
that the public may have about HHSs ability to protect confidential, personal health data may hinder 
the full potential of Federal initiatives (e.g., NIHs All of Us Research Program) that seek to leverage 
technology to create medical treatments of the future.  HHS lacks robust resources to comprehensively 
prepare cybersecurity personnel (i.e., to test the different types of incident responses and recovery 
procedures that may reveal gaps) to respond efficiently and effectively when an actual attack occurs.   
 
Progress in Addressing the Challenge  
The 2017 HHS budget allocated $50 million to meet HHSs cybersecurity needs and to ensure that HHS 
could protect sensitive and critical information.  HHS has implemented continuous monitoring tools to 
facilitate security compliance and has partnered with a commercial vendor to deploy threat hunting 
technologies at some HHS agencies.  Security awareness and phishing prevention campaigns are 
instituted throughout the year.  Continuous dialogue takes place across HHS agencies, focusing on 
cybersecurity and operational challenges.  Select HHS agencies also coordinate with DHS to conduct 
cybersecurity testing.  HHS is using a standardized log-analysis platform that will enable HHS and its 
operating divisions to better perform deep analysis of events and facilitate automation and integration 
with internal and external data sources and security tools.  In addition, DHS conducts security scans of 
external-facing HHS systems.  To help ensure the resilience of HHS systems, the Secretary signed a 
memorandum on April 5, 2018, informing all HHS agency leadership that entities within HHS would be 
responsible for planning and establishing necessary capabilities and being prepared to perform their 
respective Mission Essential Functions, with little or no warning and under any operating conditions.  
OIG continues to assess HHS cybersecurity vulnerabilities.   
 
What Needs To Be Done 
  A well-designed contingency program should be in place not only to respond to natural or man-
made disasters but also as a key feature of cyber-defenses.   
  Similarly, HHS must be proactive in identifying vulnerabilities and developing mitigation protocols in 
a timely manner to combat current and future cybersecurity threats.  HHS should therefore focus on 
its capabilities to respond efficiently and effectively to a wide range of threats to healthcare and the 
resilience of its information systems, including its incident response coordination channels and 
contingency planning.  
  To protect its data and systems, the Department must continue to take steps to address 
vulnerabilities previously identified by OIG and others.  
 
Advancing cybersecurity within the healthcare ecosystem  
 
Key Components of the Challenge 
Information sharing is one of the most effective tools in the cybersecurity defense toolbox.  The U.S.  
mitigated the effects of the WannaCry vulnerability largely because public and private sector entities 
shared information with stakeholders in real time.  Within hours of the attack spreading through 
Europe, HHS notified its agencies and private sector entities about the attack.  So, while cyber-attacks 
are nearly impossible to predict, once they occur, it is possible to obtain and share needed information 
with public and private partners, including how and where the exploit occurred, what types of systems 
are under attack, and, most important, what steps may be taken to mitigate the threat.  HHS must 
continue to be at the forefront in encouraging cybersecurity information sharing and coordination 
among the healthcare public and private sectors.  Because Government, academia, and private industry 
often employ similar technologies in providing healthcare and conducting medical research, there is 
great value in sharing cybersecurity vulnerabilities within commonly used systems.      
46 
   
 
Progress in Addressing the Challenge  
The Department and its public and private partners and stakeholders have taken some steps to address 
coordination and information sharing concerning cybersecurity threats, but they must continue to work 
to enhance capabilities.  Health-care-specific cybersecurity information sharing and analysis reports are 
available through numerous sources, including FireEye iSight reports, National Health Information 
Sharing and Analysis Center, Health Sector Cybersecurity Coordination Center, and the Computer 
Security Information Response Center.  Some HHS agencies have created memoranda of understanding 
with outside information sharing organizations to better coordinate cybersecurity efforts.  The FDA 
Commissioner announced a CyberMed Safety Analysis Board, a public-private entity composed of 
representatives from Government, academia, and industry to fully assess and validate high-risk medical 
device vulnerabilities and incidents. 
 
What Needs To Be Done 
  HHS agencies should continually seek opportunities to partner with other Government agencies, 
private industry, academia, and State Governments to share information on cybersecurity, emerging 
threats, risks, and best practices.  
  HHS must continue to engage the healthcare and public health sectors to ensure that cybersecurity 
threats are properly communicated and that appropriate guidance on foundational cyber hygiene 
best practices is available.  Both help protect the sector and, in turn, the HHS environment.  
 
Key OIG resources 
  Maryland Did Not Adequately Secure Its Medicaid Data and Information Systems (A-18-
1630520), August 2018.  
  Summary Report for Fiscal Year 2016 OIG Penetration Testing of Four HHS Operating Division 
Networks (A-18-1708500), December 2017.  
  Two Indian Health Service Hospitals Had System Security and Physical Controls for Prescription 
Drug and Opioid Dispensing but Could Still Improve Controls (A-18-1630540), November 2017.  
  HealthCare.gov: Case Study of CMS Management of the Federal Marketplace (OEI-06-14-
00350), February 2016. 
  Hospitals Largely Reported Addressing Requirements for EHR Contingency Plans (OEI-01-14-
00570), July 2016.  
  Wireless Penetration Test of Centers for Medicare & Medicaid Services Data Centers (A-18-
1530400), August 2016.  
  The Food and Drug Administrations Policies and Procedures Should Better Address Postmarket 
Cybersecurity Risk to Medical Devices (A-18-16-30530), October 2018. 
  FDA Should Further Integrate Its Review of Cybersecurity Into the Premarket Review Process for 
Medical Devices (OEI-09-16-00220), September 2018. 
 
 
47 
   
11.  Ensuring that HHS Prescription Drug Programs Work as 
Intended  
 
Why This Is a Challenge  
Key Components of the Challenge 
HHS programs accounted for almost 40 percent ($130 billion) 
  Protecting the integrity of 
of the total U.S. prescription drug expenditures in 2016.23  
prescription drug programs 
HHS oversees coverage of prescription drugs under various 
  Fostering prudent payments for 
programs operated by the Department, such as Medicare, 
prescription drugs 
Medicaid, and IHS.  In addition to providing drug coverage 
  Ensuring appropriate access to 
benefits through CMS and IHS, the Department also impacts 
prescription drugs 
prescription drug availability and pricing through agencies 
 
such as FDA and HRSAs 340B Drug Pricing Program.   
 
Increases in drug prices have contributed to the growth in total prescription drug spending.  Patients 
and Government programs may be overpaying for prescription drugs.  Increases in drug prices may limit 
patients access to needed prescription drugs if the out-of-pocket costs become unaffordable.  The 
Administration recognized this with its release of American Patients First, the Presidents blueprint to 
lowering drug prices and reducing out-of-pocket costs.  HHS is committed to increasing transparency to 
improve oversight of prescription drug payments and reimbursements.  
 
Protecting the integrity of prescription drug programs 
 
Key Components of the Challenge  
To limit Medicaid expenditures for prescription drugs, Congress created the Medicaid Drug Rebate 
Program in 1990; CMS and States implemented the Program in 1991.  However, it is a longstanding 
challenge to ensure that drug manufacturers and State Medicaid agencies are complying with 
requirements.  OIG recently found that potential misclassifications reported by drug manufacturers may 
have led to $1 billion in lost Medicaid rebates.   
 
HHS faces challenges in ensuring the integrity of the Medicare prescription drug programs.  For instance, 
OIG has continued to raise concern about payments for expired drugs.  In addition, OIG found that Part 
D spending for compounded topical drugs was 24 times higher in 2016 than in 2010, raising concerns 
about fraud and abuse.   
 
OIG has identified two longstanding fundamental vulnerabilities in the 340B program: (1) a lack of 
transparency that prevents ensuring that 340B providers are not overpaying pharmaceutical 
manufacturers and that State Medicaid programs are not overpaying 340B providers, and (2) a lack of 
clarity regarding program rules that creates inconsistencies in how contract pharmacies implement the 
program.   
 
   
                                                           
23 CMS, National Health Expenditure Data.  Accessed at: https://www.cms.gov/Research-Statistics-Data-and-Systems/Statistics-
Trends-and-Reports/NationalHealthExpendData/Downloads/NHE2016.zip. 
48 
   
Progress in Addressing the Challenge  
States are now appropriately reporting offset rebate amounts on their Medicaid expenditure reports.  
CMS is monitoring this as part of the certification review at the close of each reporting period.  CMS 
reports that the amount of offset rebates collected increased by $400 million because of these efforts.   
 
Additionally, in August 2018, the Administration released guidance clarifying how drug rebates are 
computed for a line extension of an existing pharmaceutical manufacturers drug.  The change intends 
to prevent manufacturers from treating new formulations of existing drugs as new medications to lower 
Medicaid rebate amounts owed to States.  The Congressional Budget Office estimates that this change 
could save $6.5 billion over 10 years.24 
 
CMS has taken a number of compliance and enforcement actions against Medicare Part D plan sponsors.  
CMS has also continued to expand use of its Overutilization Monitoring System and released guidance 
for Part D plan sponsors to implement lock-in programs to prevent abuse of Part D drugs.  
 
HRSA has taken steps to improve oversight of the 340B program and was granted additional oversight 
authorities.  HRSA received authority to share 340B ceiling prices with 340B providers and was given 
new enforcement tools, including authority to impose CMPs for manufacturers that knowingly and 
intentionally overcharge 340B providers.  
 
What Needs To Be Done 
  CMS should pursue a means to compel manufacturers to correct inaccurate classification data 
reported to the Medicaid Drug Rebate Program.  The methods could include, for example, seeking 
legislative authority to compel manufacturers to submit accurate data and/or enhance its 
enforcement authority.   
  Although States are now appropriately reporting rebates to CMS, CMS did not always provide 
accurate Medicaid quarterly unit rebate offset amounts to State Medicaid agencies.  The State 
agencies would have used incorrect unit rebate offset amounts to calculate rebates that were 
reported to CMS, which would have resulted in incorrect rebate amounts being claimed.  CMS 
should conduct periodic matches that would compare unit rebate offset amount information sent to 
State agencies with the Medicaid drug rebate system.  
  For a covered outpatient drug to be eligible for Federal reimbursement under Medicaids drug 
rebate requirements, manufacturers must participate in the Medicaid Drug Rebate program and pay 
rebates to the States for the drugs.  State Agencies need to strengthen internal controls to ensure 
that all physician-administered drugs eligible for rebates are invoiced.   
  OIG has recommended that Part D prescribers be required to enroll in Medicare for program 
integrity purposes.  CMS recently established a preclusion list for problematic Part D prescribers that 
would prohibit Medicare payment for drugs prescribed by providers on this list.  The list includes 
certain individuals and entities revoked from Medicare or those who have engaged in behavior for 
which CMS could have revoked the individual or entity if they had been enrolled in Medicare.  OIG 
believes that requiring enrollment in Medicare would help ensure that only reputable and qualified 
individuals and entities are providing services to Medicare beneficiaries.  
  CMS should require the use of claim-level methods to help States more accurately identify 340B 
drug claims, and thus reduce the risk of duplicate discounts and forgone rebates associated with 
                                                           
24 CMS, Medicaid Drug Rebate Program Notice No. 109 For Participating Drug Manufacturers, August 9, 2018.  Available at: 
https://www.medicaid.gov/medicaid-chip-program-information/by-topics/prescription-drugs/downloads/rx-releases/mfr-
releases/mfr-rel-109.pdf. 
49 
   
provider-level methods.  CMS may need legislative authority to require States to use claim-level 
methods.  
  HRSA should increase transparency by sharing 340B ceiling prices with 340B providers and States. 
HRSA may need new legislative authority to share 340B ceiling prices with States.  HRSA should also 
clarify its guidance on preventing duplicate discounts for drugs paid through Medicaid MCOs.  
  CMS should clarify Part D policies for coverage of compounded topical drugs and the use of 
utilization management tools.  In addition, CMS should conduct training for Part D sponsors on fraud 
schemes and safety concerns related to compounded topical drugs.  
 
Fostering prudent payments for prescription drugs 
 
Key Components of the Challenge  
How CMS sets the amount reimbursed for a drug can result in additional costs for programs and their 
beneficiaries.  For example, Medicare Part B would have saved millions of dollars if dispensing fees for 
inhalation drugs administered through DME and supplying fees for immunosuppressive drugs associated 
with an organ transplant, oral anticancer chemotherapeutic drugs, and oral antiemetic drugs used as 
part of an anticancer chemotherapeutic regimen had been aligned with the rates that Part D and State 
Medicaid programs paid.  Additionally, CMS includes noncovered versions of drugs when calculating 
payment amounts for two Part B drugs, Orencia and Cimizia.  The inclusion of these drugs caused 
Medicare and its beneficiaries to pay an extra $366 million from 2014 through 2016.  
 
Progress in Addressing the Challenge  
The Bipartisan Budget Act of 2015 established a requirement that manufacturers pay an additional 
rebate when the average manufacturer price (AMP) for a generic-name drug increases by more than a 
specified inflation factor.  The additional rebate for generic drugs applies to rebate periods beginning 
with the first quarter of 2017.  Additionally, legislative change requiring DME infusion drugs to be paid 
using the average sales price (ASP) methodology will save $660 million over 10 years.  Lastly, CMS 
altered its payment methodology for 340B drugs in the Hospital Outpatient Prospective Payment System 
(OPPS) to save beneficiaries an estimated $320 million on copayments in 2018.  Starting in 2019, CMS 
will allow Medicare Advantage plans to use new cost-saving and negotiation tools for Part B drugs.  
These tools are already successfully used in the Part D program.  
 
What Needs To Be Done 
  CMS should seek a legislative change that would provide the agency flexibility to determine when 
noncovered versions of a drug should be included in Medicare Part B payment amount calculations. 
  CMS should amend current regulations to decrease the Medicare Part B payment rates for 
dispensing and supplying Part B drugs to rates similar to those of other payers, such as Medicare 
Part D or Medicaid.  
 
   
50 
   
Ensuring appropriate access to prescription drugs  
 
Key Components of the Challenge 
High drug prices can limit access to needed prescription drugs.  For instance, OIG found that increasing 
prices for brand-name drugs may result in increasing costs for Medicare and its beneficiaries, especially 
those beneficiaries who need access to expensive drugs.  Increases in drug prices may limit patients 
access to needed prescription drugs if the out-of-pocket costs become unaffordable. 
 
Generic and biosimilar prescription drugs are important because they are often sold at lower prices and 
with lower patient payment obligations.  Availability of generics and biosimilars can be an important 
mechanism for ensuring appropriate access to prescription drugs. 
 
Progress in Addressing the Challenge  
FDA announced a Drug Competition Action Plan to lower drug prices and increase access for patients by 
removing barriers to generic drug development and market entry.25  The agencys actions include 
publishing a list of off-patent, off-exclusivity drugs without approved generics and implementing a 
revised prioritization policy to expedite the review of generic drug applications until there are three 
approved generics for a given drug product.  In 2017, FDA approved 1,027 new generic drugs, the 
highest number of generic drug applications in its history.26  
 
To complement the Drug Competition Action Plan, FDA subsequently released a Biosimilars Action Plan 
to facilitate the efficient development and approval of biosimilars to increase competition in the 
biologics marketplace and thereby reduce costs.  As of October 2018, FDA has approved 13 biosimilars, 
including biosimilars for the treatment of cancer.  Under the 2019 Part C and Part D regulation issued by 
CMS, Medicare beneficiaries receiving low-income subsidies can access biosimilars with lower out-of-
pocket costs.   
 
CMS has acknowledged that action is necessary to address rising drug costs and asked the industry to 
partner with the agency to find solutions that allow for both innovation and affordability.  CMS has 
taken regulatory steps to increase access for Medicare beneficiaries, including allowing for certain low-
cost generic drugs to be substituted onto plan formularies at any point during the year so beneficiaries 
immediately benefit by lower cost-sharing for these drugs.27  
 
What Needs To Be Done 
  When determining prudent payment policies and ensuring program integrity in HHS prescription 
drug programs, HHS should ensure appropriate access for beneficiaries.  For instance, plans need to 
meet minimum access requirements when implementing their utilization management tools.  
 
                                                           
25 FDA, Statement from FDA Commissioner Scott Gottlieb, M.D., on the Trump Administrations plan to Lower Drug Prices, 
May 2018.  Available at: https://www.fda.gov/NewsEvents/Newsroom/PressAnnouncements/ucm607495.htm 
26 FDA, 2017 Was Another Record-Setting Year for Generic Drugs, February 2018.  Available at:  
https://blogs.fda.gov/fdavoice/index.php/2018/02/2017-was-another-record-setting-year-for-generic-drugs/ 
27CMS, CMS Lowers the Cost of Prescription Drugs for Medicare Beneficiaries, April 2018.  Available at: 
https://www.cms.gov/newsroom/press-releases/cms-lowers-cost-prescription-drugs-medicare-beneficiaries. 
51 
   
Key OIG resources 
  States' Collection of Medicaid Rebates from Drug Manufacturers (OIG series of reports), 
February 2018. 
  Part D Plans Generally Include Drugs Commonly Used by Dual Eligibles: 2018 (OEI-05-18-00240), 
June 2018. 
  Potential Misclassifications Reported by Drug Manufacturers May Have Led to $1 Billion in Lost 
Medicaid Rebates (OEI-03-17-00100), December 2017.  
  Questionable Billing for Compounded Topical Drugs in Medicare Part D (OEI-02-16-00440), 
August 2018.   
  Examining Oversight Reports on the 340B Drug Pricing Program (OIG Testimony), May 2018.   
  CMS Did Not Always Provide Accurate Medicaid Unit Rebate Offset Amounts to State Medicaid 
Agencies (A-07-17-06074), May 2018.   
  Medicare Part B Prescription Drug Dispensing and Supplying Fee Payment Rates Are 
Considerably Higher Than the Rates Paid by Other Government Programs (A-06-12-00038), 
September 2014. 
  Excluding Noncovered Versions When Setting Payment for Two Part B Drugs Would Have 
Resulted in Lower Drug Costs for Medicare and its Beneficiaries (OEI-12-17-00260), November 
2017. 
  Medicare Part B Prescription Drug Dispensing and Supplying Fee Payment Rates Are 
Considerably Higher Than the Rates Paid by Other Government Programs (A-06-12-00038), 
September 2014. 
  Increases in Reimbursement for Brand-Name Drugs in Part D (OEI-03-15-00080), June 2018. 
  The MEDIC Produced Some Positive Results but More Could be Done to Enhance its Effectiveness 
(OEI-03-17-00310), July 2018. 
 
   
52 
   
12.  Ensuring Effective Preparation and Response to Public 
Health Emergencies 
 
Why This Is a Challenge  
Key Components of the Challenge 
Public health emergencies, such as emerging infectious 
 Ensuring access to health and 
diseases and natural disasters, can severely strain public 
human services during and after 
health and medical infrastructure and lead to serious illness 
emergencies 
and loss of life.  As the lead agency for the Federal response 
 Ensuring effective use and 
to public health emergencies, HHS is responsible for ensuring 
oversight of funding 
both it and its State and local partners are prepared to 
 Ensuring effective and timely 
respond to, and recover from, public health emergencies 
responses to infectious disease 
efficiently and effectively.  
threats 
 
During a disaster response, Federal, State, and local entities 
must collaborate to provide response and recovery services.  However, this often leads to challenges 
with coordination and information sharing within and across these entities.   
 
Ensuring access to health and human services during and after emergencies 
 
Key Components of the Challenge  
During and after a public health emergency, State and local governments must ensure they have 
adequate plans (such as preparing for a medical surge) and mechanisms in place to efficiently and 
rapidly deploy assets and provide relief to those in need.  For example, the destruction from the 2017 
hurricane season left many individuals without medical care, including in facilities without electricity, 
and other needed health and human services resources in the immediate aftermath and for subsequent 
months.  State and local governments must also coordinate with healthcare facilities and other entities 
to leverage resources during a response.   
 
Prior OIG work has identified gaps in emergency preparedness and response planning and community 
preparedness for healthcare facilities during disasters and pandemics.  For example, OIG found that 
many hospitals and other entities in disaster areas affected by Superstorm Sandy encountered problems 
with distributing shared resources, such as hospital beds and access to fuel and transportation, which 
decreased hospitals capability to care for patients.  OIG has also historically identified gaps in nursing 
home emergency planning, disaster response, and coordination with State and local entities.  Nursing 
homes often struggle to execute emergency plans and protect residents after disasters hit, despite 
receiving enhanced guidance from CMS.  For example, during the 2017 hurricane season, reports of 
nursing homes performance found failures to evacuate residents or provide safe sheltering in place, 
which raises questions about the adequacy and execution of healthcare facilities emergency plans.  
 
Progress in Addressing the Challenge  
CMS developed guidance to help healthcare facilities improve planning and preparing for disasters, 
improve access to medical care, and meet medical surge needs during disasters.  In 2016, CMS finalized 
a rule to establish new national emergency preparedness requirements that apply to all facilities 
receiving Medicare or Medicaid reimbursement.  In 2017, CMS issued guidelines for providers and 
surveyors when assessing compliance with Federal regulations for long-term-care facility emergency 
53 
   
planning and training.  As of September 2018, CMS has reported surveying about 75 percent of facilities, 
and anticipates survey completion by February 2019. 
 
The Office of the Assistant Secretary for Preparedness and Response (ASPR) continues to provide 
technical assistance and guidance to healthcare providers, emergency managers, and other public 
health emergency preparedness stakeholders on topics including medical surge and improving 
collaboration during and after disasters.  Additionally, ASPR has developed data tools to assist entities 
with rapidly identifying resource availability (e.g., electricity and beds) and at-risk populations that need 
assistance during an emergency.  ASPR is also integrating Federal, State, local public health, and medical 
assets on the ground and building regional capability to fight highly infectious and other disease threats 
through regular training, exercises, and ensuring that equipment and organization of medical 
components are updated. 
 
What Needs To Be Done 
  HHS should take steps to improve coordination within the public health and human services 
infrastructure.  For example, CMS needs to ensure that all applicable providers are effectively 
implementing the emergency preparedness requirements.   
  CMS needs to ensure that all surveyors are effectively assessing providers compliance with these 
requirements.  OIG will continue to monitor these requirements.  
  ASPR should continue to improve the use and collection of data to access real-time information 
about emerging threats and to rapidly respond to emergencies to ensure they meet the health and 
human service needs of individuals. 
  ASPR should continue to build regional surge capacity through formula-based cooperative 
agreements, Regional Disaster Health Response System pilots, and support programs related to 
healthcare preparedness, response, and recovery.   
 
Ensuring effective use and oversight of funding  
 
Key Components of the Challenge 
HHS awards grant funds across Federal, State and local entities to strengthen emergency preparedness.  
HHS, States, and other grantees also receive supplemental appropriations to respond to emergencies.  
In 2017, HHS received almost $6 billion in supplemental funding for preparedness and response efforts 
for the hurricanes impacting Puerto Rico, the Virgin Islands, and the southern U.S.  Funds awarded 
during emergencies are often susceptible to fraud and misuse by grantees.   
 
HHS must also see that proper grant mechanisms are in place to ensure effective response coordination 
with domestic and international partners.  For example, OIG found deficiencies in CDCs grant award 
process to award funds for international Ebola preparedness and response activities.  States also 
reported wanting more direction from ACF on allowable activities and reporting requirements for 
Superstorm Sandy block grants.  Uncertainty about allowable expenses may have hindered some States 
use of funds for relief efforts.  Additionally, OIG also found internal control weaknesses in audits of 
foreign grantees receiving Presidents Emergency Plan for AIDS Relief funds (see TMC #7 for more 
information on challenges specific to HHS grants). 
 
Progress in Addressing the Challenge 
HHS has made efforts to assess grant program performance and improve grant oversight by identifying 
potential fraud, waste, and abuse.  For instance, OIG found that HRSA complied with Federal and HHS 
54 
   
grant policies when awarding funding to health centers and other entities to expand access and delivery 
of healthcare services to respond to the spread of the Zika Virus in Puerto Rico and other U.S. territories 
from October 1, 2016, through March 15, 2017.  Additionally, ACF is developing administrative guidance 
on lessons learned to use if additional supplemental disaster funds are appropriated to the agency 
under the Social Services Block Grant authority. 
 
What Needs To Be Done 
  HHS needs to improve its oversight of funds awarded to grantees for emergency response and 
recovery activities to ensure that grant funds are being used efficiently, effectively, and for their 
intended purposes.   
  HHS agencies must provide appropriate guidance to its grantees about when the use and expiration 
of supplemental disaster relief funds and what documentation is needed to ensure program 
integrity.   
 
Ensuring effective and timely responses to infectious disease threats 
 
Key Components of the Challenge 
The spread of infectious diseases, like Ebola and Zika, is an ongoing challenge and demonstrates the 
need for the Department to rapidly detect and diagnose infectious diseases and assess threats.  HHS 
needs to ensure its ability to readily develop, distribute, and administer medical countermeasures 
(MCMs) (i.e., vaccines, therapeutics, and diagnostics) to effectively prevent and treat infectious 
diseases.  OIG identified systemic issues that may prevent CDC from ensuring inventory in the Strategic 
National Stockpile (SNS)a repository of MCMs. 
 
Additionally, HHS needs to enhance State and local preparedness for influenza pandemics.  OIG found 
that States and localities need to improve planning and preparedness in areas including medical surge 
and vaccine and antiviral drug distribution and dispensing.  For example, during the Ebola crisis, many 
hospitals reported that they were unprepared to receive cases and experienced challenges, such as 
difficulty using Federal guidance, to sustain preparedness.  
 
Progress in Addressing the Challenge 
HHS continues to make significant investments to develop MCMs to protect against emerging infectious 
diseases and other threats.  For example, ASPR is sustaining efforts to build domestic manufacturing 
infrastructure and a robust vaccine stockpile for pandemic influenza.  As of September 2018, ASPRs 
Biomedical Advanced Research and Development Authority (BARDA) supported an MCM enterprise that 
included 42 FDA approvals of 38 medical products and technologies.  BARDAs Division of Research, 
Innovation, and Ventures (DRIVe) program also supports transformational technologies to identify 
diseases earlier and address cross cutting health security threats. 
 
HHS is also enhancing preparedness for future infectious disease threats.  In April 2018, HHS executed 
its largest patient movement exercise, with more than 50 organizations (including Federal, State, and 
local agencies) participating, to test the nation-wide ability to move patients with highly infectious 
diseases safely and securely to regional treatment centers.  OIGs ongoing work has also identified 
improvements in hospital preparedness for responding to emerging infectious diseases.  For instance, 
following the Ebola crisis, hospitals reported taking actions such as revising infectious disease and 
emergency plans, conducting additional staff training and exercises, and participating in healthcare 
coalitions.  In response to OIGs work, CMS is updating its State Operations Manual to include emerging 
55 
   
infectious diseases in hospital emergency planning.  Additionally, ASPR is building on its successes using 
a regional response model during the Ebola response by developing a Regional Disaster Health Response 
System to surge medical response during disasters and emergencies.  
 
What Needs To Be Done  
  HHS agencies should take steps to improve collaboration and coordination of guidance to help 
healthcare facilities sustain preparedness for emerging infectious disease threats.   
  CMS should monitor enforcement of its emergency preparedness requirements to ensure that 
emerging infectious diseases are included in hospital preparation.   
  ASPR should continue efforts to expand the portfolio of emerging infectious disease MCMs under 
development. 
  HHS should improve SNS coordination and readiness to ensure that inventory is readily deployable 
in a public health emergency.  To that end, plans are underway for ASPR to assume operational 
control of the SNS to streamline MCM development and procurement and improve the speed and 
effectiveness of emergency response capabilities.  
Key OIG resources 
  Examining Federal Efforts to Ensure Quality of Care and Resident Safety in Nursing Homes (OIG 
Testimony), September 2018. 
  Hospital Emergency Preparedness and Response During Superstorm Sandy (OEI-06-13-00260), 
September 2014.  
  Gaps Continue to Exist in Nursing Home Emergency Preparedness and Response During 
Disasters: 2007-2010 (OEI-06-09-00270), April 2012.  
  Superstorm Sandy Block Grants: Funds Benefited States Reconstruction and Social Service 
Efforts, Though ACFs Guidance Could be Improved (OEI-09-15-00200), September 2016.  
  CDC Awarded Selected Ebola Funds for International Response Activities in Accordance with 
Applicable Laws, Regulations, and Departmental Guidance (A-04-16-03568), January 2017.   
  HRSA Complied with Federal and HHS Grant Policies When Awarding Zika Response and 
Preparedness Appropriations Act Funds During FY 2017 (A-04-17-02003), October 2017.  
  Readiness of CDCs SNS Could be at Risk in Case of a Public Health Emergency (A-04-16-03554), 
June 2017.  
  Hospitals Reported Improved Preparedness for Emerging Infectious Diseases After the Ebola 
Crisis (OEI-06-15-00230), October 2018. 
 
 
 
 
56 
   
 
57