2021 Top Management and Performance Challenges Facing HHS 
DRAFT  For Internal OIG Use Only  Not For Distribution 
 
0 
  Introduction 
The 2021 Top Management and Performance Challenges Facing HHS is an annual 
publication of the Department of Health and Human Services (HHS or the Department), 
Office of Inspector General (OIG).  In this edition, OIG has identified six top management and 
performance challenges (TMCs) that the Department faces as it strives to fulfill its mission to enhance 
the health and well-being of all Americans by providing for effective health and human services and by 
fostering sound, sustained advances in the sciences underlying medicine, public health, and social services.  These 
top challenges reflect overarching issues that affect multiple HHS programs and responsibilities.  These are not the 
only challenges that confront HHS.  OIG reports are a key resource that highlight specific opportunities to improve 
HHS programs and operations.  
HHS is responsible for $2.8 trillion in budgetary resources and its programs impact the lives of virtually all Americans.  
To identify the six TMCs, we integrated OIGs oversight, enforcement, data analytics, and risk analysis work.  For 
each TMC, we describe the dimensions of the challenge, highlight the progress the Department has made in 
addressing the challenge, and identify what remains to be done.  
Throughout  this  document,  we  highlight  the  unprecedented  challenges  the  Department  faces  because  of 
coronavirus disease 2019 (COVID-19).  As the lead Federal agency for medical support and coordination during public 
health emergencies, HHS has numerous and significant responsibilities in providing assistance as the United States 
confronts the COVID-19 pandemic.  HHSs responsibilities include working with Federal, State, Tribal, local, and 
international governments to respond effectively to the pandemic; supporting the development and distribution of 
vaccines, treatments, and research on COVID-19; assisting the health care system by providing flexibility, resources, 
and funding; ensuring the safety of the health care workforce; and protecting the health and well-being of the public.  
Challenges related to the Departments COVID-19 response are primarily addressed in TMC 1 on public health.  
However, the COVID-19 response affects nearly every aspect of Department operations, and challenges related to it 
are also addressed in other TMCs.  
Management and performance challenges are inherently crosscutting.  The TMCs reflect how multiple HHS staff 
divisions (StaffDivs) and operating divisions (OpDivs) are addressing these pressing issues.  For example, the 
challenge of financial integrity highlighted in TMC 2 has natural intersections with the challenge of delivering value, 
quality, and improved outcomes in Medicare and Medicaid, which is the subject of TMC 3.  Given that challenges 
cross internal HHS boundaries and externally with Federal and State agencies, coordination among HHS agencies 
and across the government sector is integral to addressing these challenges.     
In  addition  to  this  annual  TMC  publication,  OIG  maintains  a  list  of  significant  and  unimplemented  OIG 
recommendations, including legislative recommendations, that address vulnerabilities.  These recommendations are 
drawn from OIGs audits and evaluations.  OIG identifies the top unimplemented recommendations which if 
implemented would, in OIGs view, most positively affect HHS programs in terms of cost savings, program 
effectiveness and efficiency, and public health and safety.   
More information on OIGs work, including the reports mentioned in this publication, appears on our website at 
https://oig.hhs.gov.  
1 
   
 
 
 
 
 
 
1  4 
Protecting the Health and 
Safeguarding Public Health 
Safety of HHS Beneficiaries 
2  5
Harnessing and Protecting 
Ensuring the Financial 
Data to Improve the Health 
Integrity of HHS Programs   
and Well-Being of Individuals 
3  6
Delivering Value, Quality, 
Improving Collaboration to 
and Improved Outcomes in 
  Better Serve Our Nation 
Medicare and Medicaid 
 
 
2 
  Table of Contents 
Introduction ....................................................................................................................... 1 
TMC 1: Safeguarding Public Health ................................................................................................ 5 
TMC 2: Ensuring the Financial Integrity of HHS Programs ........................................................................ 11 
TMC 3: Delivering Value, Quality, and Improved Outcomes in Medicare and Medicaid ...................................... 21 
TMC 4: Protecting the Health and Safety of HHS Beneficiaries ................................................................................... 26 
TMC 5: Harnessing and Protecting Data to Improve Health and Well-Being of Individuals ........................................ 32 
TMC 6: Improving Collaboration To Better Serve Our Nation ..................................................................................... 39 
Endnotes ...................................................................................................................................................................... 43 
 
 
 
3 
  Acronyms 
ACF  Administration for Children and Families  HHS  US Department 
of Health and Human 
ACO  Accountable Care Organization 
Services 
ADHD  Attention Deficit Hyperactivity Disorder 
IHS  Indian Health Service 
AHRQ  Agency for Healthcare Research and Quality 
IT  Information Technology 
AMP  Average Manufacturer Price 
LCA  Least Costly Alternative 
API  Application Programming Interface 
MA  Medicare Advantage 
APTC  Advance Premium Tax Credit  
MAO  Medicare Advantage Organization 
ASPR  Office of the Assistant Secretary for Preparedness 
MCO  Medicaid Managed Care Organization 
and Response 
NIH  National Institutes of Health 
CARES  Coronavirus Aid, Relief, and Economic Security Act 
OCR  Office for Civil Rights 
CCDF  Child Care and Development Fund 
OGA  Office of Global Affairs 
CDC  Centers for Disease Control and Prevention 
OIG  Office of Inspector General 
CHIP  Childrens Health Insurance Program 
OMB  Office of Management and Budget 
CIO  Chief Information Officer 
ONC  Office of the National Coordinator for Health 
CMS  Centers for Medicare & Medicaid 
Information Technology 
Services 
ORR  Office of Refugee Resettlement 
DHS  Department of Homeland Security 
OTP  Opioid Treatment Program 
DME  Durable Medical Equipment 
OUD  Opioid Use Disorder 
DMI  Data Modernization Initiative 
PCS  Personal Care Services 
DOJ  Department of Justice 
PDMP  Prescription Drug Monitoring Program 
EHR  Electronic Health Record 
PERM  Payment Error Rate Measurement 
EID  Emerging Infectious Diseases 
PPE  Personal Protective Equipment 
EUA  Emergency Use Authorization 
PRF  Provider Relief Fund 
FDA  Food and Drug Administration 
REMS  Risk Evaluation and Mitigation Strategies 
FFS  Fee-For-Service 
SAMHSA  Substance Abuse and Mental Health Services 
FPS  Fraud Prevention System 
Administration 
FSIS  Food Safety Inspection Service 
SNF  Skilled Nursing Facility 
FY  Fiscal Year 
TANF  Temporary Assistance for Needy Families 
GAO  Government Accountability Office 
T-MSIS  Transformed Medicaid Statistical Information 
HC3  Health Sector Cybersecurity Coordination Center  System 
HHS  Department of Health and Human Services  UC  Unaccompanied Children 
HIPAA  Health Insurance Portability and Accountability   
Act of 1996 
HRSA  Health Resources and Services Administration 
4 
   
 
1: Safeguarding  
Public Health 
HHSs core mission is to enhance the health and well-being of all 
Americans.    Pandemic  response  and  recovery  efforts  have  KEY TAKEAWAYS 
exacerbated the Departments challenge to safeguard public health.  
I.  Relevant Agencies: All HHS  
With more than 730,000 deaths attributable to COVID-19 and more 
II.  Elements of the Challenge:  
than 45 million cases of the disease in the United States as of 
  Strengthening emergency 
October 28, 2021,1 HHS must act vigilantly to mitigate the loss of life 
preparedness and response 
and negative short- and long-term health consequences associated 
capabilities 
with COVID-19 while effectively operating a range of programs and 
  Providing adequate oversight 
services  that  are  essential  to  protecting  individuals  and 
of FDA-regulated products 
communities.  This work includes effectively preparing for future 
  Tackling the opioid epidemic 
emergencies while advancing response capabilities, ensuring that 
while ensuring access to 
products regulated by the Food and Drug Administration (FDA) are 
treatment 
safe and effective, and combating the opioid epidemic while helping 
ensure access to treatment.  To operate effective public health 
programs, the Department must ensure that its OpDivs and StaffDivs coordinate efforts internally as well as with 
partners at all levels of government and other stakeholders.  (See TMC 6 for more information on the Departments 
challenge of coordinating with internal and external partners.) 
Strengthening emergency preparedness and response capabilities 
Public health emergencies can severely strain public health and medical infrastructure and lead to serious illness and 
loss of life, often with greater impacts on the most vulnerable populations, such as nursing home residents.  In 2020, 
two in five Medicare beneficiaries in nursing homes were diagnosed either with COVID-19 or likely COVID-19 and 
almost 1,000 more beneficiaries died per day in April 2020 than in April 2019.2   The negative health impacts of 
emergencies can also exacerbate racial and ethnic health disparities.  Black, Hispanic, and Asian Medicare 
beneficiaries in nursing homes were more likely to have had COVID-19 or likely COVID-19 compared to White 
beneficiaries,3  and  HHS  has  identified  pronounced  racial  and  ethnic  disparities  in  COVID-19  infections, 
hospitalizations, death rates, and vaccination rates that extend to the broader population.4  Provisional estimates 
from the Centers for Disease Control and Prevention (CDC) show a decline in U.S. life expectancy in 2020, with 
COVID-19 having had the greatest effect on the decline.  CDC data also show an increase in racial and ethnic 
disparities pertaining to life expectancy in 2020.5  HHS programs must address racial, socioeconomic, geographic, 
and other types of disparities, and the effects that such disparities have on public health.   
HHS has a leading role in preparing for, responding to, and recovering from the adverse health effects of public 
health emergencies including infectious disease outbreaks, natural disasters, and chemical, biological, radiological, 
and nuclear events.  HHS is uniquely positioned to provide guidance, funding, and support to assist States and 
communities throughout the United States so that they can effectively and equitably plan for and respond to 
emergencies, as well as support sustained recovery efforts.  The experience of the past year underscores that HHS 
must be prepared to address multiple public health emergencies occurring simultaneously with different response 
5 
   
needs  and  challenges,  such  as  hurricanes  and  wildfires  that  have 
occurred during the COVID-19 public health emergency.  A key challenge is to 
have  adequate  planning  and  mechanisms  in  place  prior  to  a  public  health 
emergency to efficiently and rapidly deploy assets and provide relief to those in need of 
HHS resources and assistance during the emergency.  This includes planning agency controls 
and strategies to mitigate disaster preparedness and response risk.6  In addition, an effective 
emergency response requires a prepared public health workforce.  The American Rescue Plan Act of 2021 
provided HHS with additional funds, including $7.6 billion to establish, expand, and sustain the public health 
workforce.7  HHS must ensure that the public health workforce is ready to address current and future emergencies. 
For infectious disease emergencies, HHS plays a critical role in identifying, acquiring, developing, distributing, and 
administering medical countermeasures (e.g., vaccines, therapeutics, and diagnostics).  Among HHSs operating 
divisions, the CDC is responsible for responding to health threats and providing critical scientific information to 
protect Americans.  The Biomedical Advanced Research and Development Authority within the Office of the 
Assistant Secretary for Preparedness and Response (ASPR) promotes the development and acquisition of medical 
countermeasures, including supporting the transition of medical countermeasures from research through advanced 
development toward consideration for approval by FDA and inclusion in the Strategic National Stockpile. The 
National  Institutes  of  Health  (NIH)  is  responsible  for  research  related  to  the  development  of  medical 
countermeasures including vaccines.  FDA is responsible for regulating the safety and effectiveness of such medical 
countermeasures and ensuring the safety and availability of the U.S. blood supply and tissue donations.  FDA may 
use its Emergency Use Authorization (EUA) authority to facilitate the availability of medical countermeasures in 
public heath emergencies, as it did for COVID-19 diagnostics, vaccines, and therapeutics.  The Office of Global Affairs 
(OGA) is responsible for leading international engagements to support both preparedness for and responses to 
public health emergencies.   
Existing OIG work on prior outbreaks of communicable disease illustrates the importance of ongoing HHS readiness 
to detect, assess, and respond to new disease outbreaks and other emergencies.  For instance, a 2019 OIG report 
about HHSs response to the 2014 Ebola outbreak recommended that HHS develop department-wide objectives and 
a strategic framework for responding to international public health emergencies.8  HHS concurred with the 
recommendations in the report and indicated that it is continuing to coordinate these efforts and will provide 
additional updates.   
In addition to coordinating emergency planning and response efforts effectively with its program offices, HHS works 
with States and localities to facilitate planning and preparedness to address a wide range of health and human 
service needs including the management and distribution of medical supplies, establishment of alternative care sites, 
and distribution of vaccines and antiviral drugs.  (See TMC 6.)  In an OIG survey of hospitals conducted in March 
2021, hospitals reported that operating in survival mode for an extended period had created challenges with 
health care delivery, staffing, vaccinations, supplies, and finances.  Hospitals found that the emergency exacerbated 
longstanding  challenges  in  health  care  delivery,  access,  and  health  outcomes.9    Prior  OIG  work  identified 
opportunities for health care facilities to improve emergency preparedness and response planning during infectious 
disease outbreaks and disasters.10  HHS should continue to support the development and maturation of health care 
coalitions and other entities in their efforts to plan for and coordinate emergency response among diverse entities 
such as hospitals, public health agencies,11 emergency medical services, and emergency management.12    
As the COVID-19 emergency continues to evolve and new data provide a deeper understanding of topics such as 
transmission, testing, therapeutics, vaccines, vaccination programs, public health communication, and short- and 
long-term health effects, HHS faces the challenge of ensuring that it is a continuously learning organization.  HHS 
6 
   
must rely on up-to-date information to sustain and strengthen its 
emergency response and provide effective public health guidance to the 
American public.     
Ensuring FDA-regulated products are safe and effective 
FDA is charged with ensuring the safety, effectiveness, and security of human and animal drugs, 
biological products, and medical devices; ensuring the safety of the nations food supply, cosmetics, and 
products that emit radiation; and regulating tobacco products.  These functions are critical to ensuring that 
Americans can trust the expansive array of products in FDAs purview.13  FDA has the added challenge of facilitating 
emergency response efforts related to the current COVID-19 emergency, including reviewing scientific evidence and 
issuing emergency use authorizations, and approvals, for COVID-19 vaccines and other medical products, providing 
surveillance of medical product safety and effectiveness, and updating guidance based on emerging science.14  The 
American public relies on FDA to expeditiously assess new medical products or new uses of legally marketed medical 
products (such as drugs or vaccines) that treat or offer protection from negative health effects associated with 
COVID-19 without sacrificing assurances of safety and efficacy.   
Drug, biologic, and medical device safety 
FDAs responsibility to help ensure the safety and effectiveness of medical products begins before approval 
and continues after the product is marketed.  This includes inspections of manufacturing facilities; reviewing 
drugs, devices, and biologics for safety, effectiveness and quality; authorizing the use of investigational 
medical products; and conducting post-market surveillance.  The public relies on FDA to be expeditious in 
evaluating products and thoughtful in its decisions and processes regarding approval for marketing in the 
United States. OIG is currently assessing how FDA implements its accelerated approval pathway.15   
FDAs task of assessing products has become more difficult as manufacturing processes and products have 
evolved.  The drug, biologic, and medical device supply chain is becoming increasingly complex, and many 
of the products used in the United States are manufactured overseas or are dependent on raw materials 
that are produced overseas.  For all FDA-regulated drugs, 74 percent of the manufacturing facilities 
producing active pharmaceutical ingredients and 54 percent of the manufacturing facilities producing 
finished dosage forms of human drugs were located outside of the United States in 202016  In response to 
challenges  with  its  foreign  drug  inspection  process,  FDA  in  May  2017  began  implementing  major 
programmatic changes to enhance its ability to protect public health.  An OIG audit will assess whether 
programmatic changes improved FDAs foreign drug inspection process.17   
Accurate drug tracing information is critical to identifying an illegitimate drug and removing it from the 
supply chain.  If potentially harmful drugs enter the drug supply chain, investigators from FDA, State(s), and 
elsewhere need complete information about the trading partners that bought and sold the drug and about 
the drugs physical movement through the supply chain.  An OIG evaluation found that tracing information 
could not be used to identify the physical movement through the supply chain for about half of selected 
drugs.  FDA agreed with OIGs recommendations to take action to help protect patients from the effects of 
dangerous, ineffective, and illegitimate drugs by, for example, ensuring that trading partners in the drug 
supply chain are aware of Federal requirements and guidance and by seeking legislative authority to require 
information about a drugs complete physical path through the supply chain.18  
The rapid evolution of science and technology presents new concerns for FDA to address via its oversight 
role. Managing cybersecurity risks associated with networked devices is increasingly difficult as more 
7 
   
medical devices use internet connectivity.  Networked medical 
devices approved by FDA can be susceptible to cybersecurity threats 
such as ransomware and unauthorized remote access if the devices lack 
adequate security controls.19  These networked devices include infusion pumps, 
diagnostic imaging, and pacemakers that are commonly used in hospital settings and 
at home.   
In 2021, OIG released a report highlighting the lack of oversight of medical devices by State surveyors 
and accrediting organizations in Medicare-participating hospitals, creating vulnerabilities to cyberattacks 
for patients requiring medical devices.20  Additionally, in 2018 OIG released two reports assessing FDAs 
oversight of premarket and post-market cybersecurity risks to medical devices.21  An underlying issue 
identified in both reports was the opportunity for FDA to take further action in addressing cybersecurity 
threats to reduce risks to patients and the health care industry.  FDA has made administrative changes to 
improve its premarket and post-market processes, but FDA should continue to take steps to enhance its 
ability to receive relevant information as well as securely share it with key stakeholders.  (See TMC 5 on 
data for additional actions FDA has taken related to cybersecurity.) 
Food safety 
Foodborne illnesses are a largely preventable threat to public health.  An estimated 1 in 6 Americans gets 
sick, 128,000 are hospitalized, and 3,000 die from contaminated foods each year.22  FDA has the complex 
responsibility of overseeing facilities that are responsible for producing foods that are safe.  The American 
public relies on FDA, which works in collaboration with other Federal agencies and State, local, and 
territorial partners to help ensure the safety of both human and animal food.23   
FDAs current approach to food safety includes goals to enhance traceability, improve predictive analytics, 
respond more rapidly to outbreaks, address new business models, reduce the contamination of food, and 
foster the development of stronger food safety cultures.24  FDA must continue to modernize the food 
safety system and respond effectively and efficiently when issues are identified.  FDA should conduct risk-
based inspections of domestic and foreign food facilities within the timeframes required by the Food Safety 
Modernization Act, identify instances of failure to comply with good manufacturing practices, and take 
necessary steps when health risks are identified, including administrative and enforcement actions when 
warranted.25  FDA has made organizational changes with the goal of improving incident response through, 
for example, its Coordinated Outbreak Response and Evaluation Network and should continue to improve 
the timeliness and effectiveness of its processes, such as food recalls, to optimize its ability to protect the 
public from outbreaks of foodborne illnesses.   
Tobacco 
Tobacco use is the leading cause of preventable death and disease in the United States.26  FDA regulates 
the manufacturing, marketing, and distribution of tobacco products to protect public health and has made 
a commitment to reduce harm from tobacco products, particularly among youth.  Although FDA and the 
CDCs 2020 National Youth Tobacco Survey showed fewer middle and high school-aged tobacco product 
users in 2020 compared to the previous year, roughly 16 percent of students used a tobacco product, 
including almost 24 percent of high school and 7 percent of middle school students.  In 2020, e-cigarettes 
were the most used tobacco product among both middle and high school students.27   FDA must continue 
efforts to reduce harm amid increasing concerns surrounding the use and detrimental health effects of 
electronic nicotine delivery systems such as e-cigarettes and vape pens.     
8 
   
Working with the CDC, FDA faces the challenge of better 
understanding  the  science  of  tobacco  products  and  the  most 
effective use of its authorities to regulate their manufacturing, marketing, 
and sale, including premarket reviews and health warnings on packaging and 
advertisements.  OIG is assessing FDAs Tobacco Retailer Compliance Check Inspection 
program  under  which  FDA  contractors  (generally  States)  carry  out  undercover-buy 
inspections of tobacco retailers to ensure they are complying with restrictions on sales to minors.28 
Combating the opioid epidemic and helping to ensure access to treatment 
From 2018 to 2019, the number of drug overdose deaths increased by nearly 5 percent, and since 1999 the number 
has quadrupled.  In 2019, opioids were involved in more than 70 percent of the more than 70,500 drug overdose 
deaths.29  The pandemic and related stressors are thought to put people at risk for substance use disorder,30 and 
substance use disorder puts adults at high risk for severe illness from COVID-19.31  Provisional data from the CDC 
show an approximately 30 percent increase in overdose deaths from February 2020 to February 2021, with more 
than 95,000 overdose deaths reported in that period.32   In early FY 2022, HHS released an overdose prevention 
strategy.33 
Current Federal priorities for drug policy include expanding access to evidence-based treatment, advancing racial 
equity in the approach to drug policy, and reducing the supply of illicit substances.34  The Department should 
continue to use the tools available across its operating divisions to address the ongoing opioid epidemic while being 
mindful of patients needs to access appropriate pain management, which may include the use of opioid analgesics.  
FDA has key roles in ensuring the safe use of opioids.  The agency approves new drugs before they are marketed in 
the United States, assesses the benefits and risks of each new drug,35 and monitors the safety of marketed drugs as 
new information becomes available.  FDA supports the treatment of opioid use disorders (OUDs) with FDA-approved 
drugsi.e., buprenorphine, methadone, and naltrexoneas well as the development of additional therapies to 
treat OUDs, and employs tools to mitigate risks associated with approved drugs, including updating product labelling 
and developing  Risk Evaluation and Mitigation Strategies (REMS) as needed.36  An OIG evaluation found that data 
quality issues made it challenging for FDA to determine whether two REMS for opioid analgesics had been effective 
and that REMS may not be well-suited to quickly address the opioid crisis.37  FDA must work to ensure that strategies 
it uses to mitigate the misuse and abuse of opioids achieve their intended impact.  
The opioid crisis is partially fueled by opioids prescribed by licensed medical professionals, dispensed by licensed 
pharmacies, and paid for by Federal funds.  Prescription opioids were involved in more than a quarter of all opioid 
overdose deaths in 2019.38   The COVID-19 pandemic has heightened concern about opioid use and access to 
treatment.  The pandemic has put people with OUD at particular risk, as they are at higher risk of developing COVID-
19 and are more likely to experience hospitalizations or death from the illness.39  More than 43,000 Medicare Part 
D beneficiaries had an opioid overdosefrom prescription opioids, illicit opioids, or bothduring 2020.  Overall, 
nearly 1 in 4 Medicare Part D beneficiaries received opioids during 2020.40  The number of beneficiaries who received 
drugs through Part D to treat OUD increased, but at a slower rate in 2020 than in prior years.  Unlike in other recent 
years, there was no growth in the number of beneficiaries receiving prescriptions through Part D for the opioid 
overdose-reversal drug naloxone.  These slower growth rates add to ongoing concerns about access to medications 
to treat OUD and naloxone.  Ensuring this access is particularly important as we do not yet know the full extent to 
which the stressors of the COVID-19 pandemic may have increased the need for these drugs. 
The Indian Health Service (IHS) also has an important role to play in preventing and detecting opioid misuse and 
abuse.  Data from an OIG evaluation show that some patients received high amounts of opioids from IHS-run 
9 
   
pharmacies, and IHS has taken steps to ensure appropriate opioid use 
among its patients. 41  At the same time, the agency could improve the 
efficiency of its opioid monitoring systems by further automating its system for 
electronic health records (EHRs).  Additionally, IHS officials reported challenges in tracking 
patient care received outside IHS and in using State-run prescription drug monitoring programs 
(PDMPs),  which  are  electronic  databases  that  collect  and  disseminate  controlled  substance 
prescription information.  Both factors can limit the abilities of IHS staff to monitor opioid use.  IHS should 
assess the costs and benefits of updating the IHS EHR system with tools to support more automated monitoring, 
and request support from States and Federal partners to address challenges with State-run PDMPs. 42 
Ensuring access to effective OUD treatment, especially in regions with greater risk for opioid misuse and overdose, 
remains crucial to combating the opioid epidemic. 43  People suffering from an OUD are at risk for withdrawal and 
relapse, and without effective treatment may seek out illicit opioids such as heroin.  However, fewer than 20 percent 
of the 2.1 million people with OUDs received treatment in 2018.44  Measures to address COVID-19 have further 
challenged access to treatment.  In a survey of 143 opioid treatment programs (OTPs), OIG identified various 
challenges OTPs encountered during the COVID-19 pandemic including maintaining pre-pandemic service levels, 
managing impacts on facility operations, and maintaining patient participation in opioid treatment program 
activities, among others.45   
The Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities 
Act requires Medicare to cover certain treatment services provided by opioid treatment programs including 
methadone.  As part of the effort to ensure access to effective treatment, HHS needs data to monitor access and 
unmet needs.  An OIG evaluation identified opportunities to enhance information about access and the need for 
medication to treat OUD through the Buprenorphine Waiver Program, one of the Substance Abuse and Mental 
Health Services Administrations (SAMHSAs) key initiatives for combating the opioid crisis by expanding treatment 
services.46  In spring 2021, HHS released new buprenorphine practice guidelines designed to expand access to 
evidence-based treatment for OUD.47 
In addition, HHS must ensure that funding to address the opioid epidemic is efficiently and effectively spent for its 
intended purpose.  An OIG audit found that 67 of 100 Health Resources and Services Administration (HRSA) health 
centers did not use grant funds that were intended to expand access to mental health and SUD services focusing on 
the treatment, prevention, and awareness of OUD consistent with Federal requirements and grant terms. 48  HHSs 
OpDivs must work with awardees and sub-awardees to ensure behavioral health grant dollars are used in accordance 
with Federal requirements and consistent with the funding opportunity.   
 
 
 
 
10 
   
2: Ensuring the Financial 
Integrity of HHS Programs 
HHS is the largest civilian agency in the Federal government, with 
$2.8 trillion in budgetary resources.49  HHSs Medicare program  KEY TAKEAWAYS 
is the Nations largest health insurer by expenditures and handles 
I.  Relevant Agency: All HHS  
more than 1 billion claims per year.  Medicaid is the largest health 
II.  Elements of the Challenge:  
insurer  in  terms  of  lives  covered,  with  81  million  Medicaid 
  Controlling costs by ensuring 
beneficiaries and Childrens Health Insurance Program (CHIP) 
prudent payments for goods 
enrolled  individuals.50    Medicare  and  Medicaid  are  the 
and services 
Departments  largest  programs;  funding  for  these  programs 
  Reducing improper payments  
(including State funding) represents 41 cents of every dollar spent 
  Combating fraud, waste, and 
on health care annually in the United States.51  CMSs Office of 
abuse  
the Actuary estimates that Medicare expenditures totaled $915.4 
  Monitoring and reporting on 
billion  and  Medicaid  expenditures  totaled  $682.7  billion  in 
the integrity of HHS programs 
2020.52,53 Almost 140 million beneficiaries, or more than 40 
percent of Americans, rely on these programs for their health 
insurance including senior citizens, individuals with disabilities, low-income families and individuals, and patients 
with end-stage renal disease.54  CMS bears the responsibility at HHS for administering these programs.  As many 
providers faced fiscal uncertainty due to COVID-19, CMS took steps to provide increased flexibility and advance 
payments to mitigate the financial effects of the pandemic.        
HHS is also the largest grantmaking and second largest contracting agency in the Federal government.  In fiscal year 
(FY) 2020, HHS awarded $244.7 billion in grants (excluding CMS grants) and $160.7 billion in contracts.55,56  
Responsible stewardship that ensures the transparency and accountability of HHS funds is paramount to making 
sure that HHS beneficiaries and the American public get the full benefit of this substantial financial investment.   
The Department must protect the fiscal integrity of HHS funds and ensure that beneficiaries have access to the 
services they need.  This is a growing challenge due to looming financial shortfalls in the Medicare program,57, 58 the 
expansion of eligibility for Medicaid services, and the COVID-19 funds that HHS is responsible for distributing and 
overseeing via grants and other mechanisms.  HHS must manage the efficient and effective use of funds internally 
and oversee the use of Federal funds by thousands of external funding recipients. 
Controlling costs by ensuring prudent payments for goods and services 
Whether HHS is paying for medical services, prescription drugs, or human service programs, managing what the 
Department pays and recognizing and remedying problematic payment policies are critical to controlling costs.  
Medicare 
Medicare should consider whether payment policies, which are generally set by statute by Congress, are 
continuing to deliver the intended value.  For example, some current policies result in Medicare and 
beneficiaries paying more for care provided in certain settings than for the same care provided in other 
settings.  An OIG report found that Medicare  could have potentially saved $4.1 billion over a 6-year period 
if swing-bed services at critical-access hospitals had been paid for at the same rates as at skilled nursing 
11 
   
facilities (SNFs).59  Likewise, in some situations Medicare pays 
hospitals different amounts for the same care depending on whether 
the  hospital  admits  beneficiaries  as  inpatients  or  treats  them  as 
outpatients.   
Additionally, Medicare must take steps to mitigate program integrity risks related to 
payment and coverage policies.  For example, OIG found that hospitals increasingly billed for 
inpatient stays under Medicare severity diagnosis related groups at the highest severity levelthe 
most expensive levelfrom FY 2014 through FY 2019.  These are indications that hospitals may be engaging 
in inappropriate billing practices such as upcoding.60  
Prescription drug programs  
In July 2021, President Biden issued an Executive Order aimed at combatting high prescription drug prices.61  
Increased drug costs may limit patients ability to afford needed prescription drugs, in some cases causing 
patients to skip or split medication doses or forgo purchasing medications altogether.  HHS programs 
accounted for 38 percent ($140 billion) of total U.S. prescription drug expenditures in 2019.62  The Medicare 
Prescription Drug program had net costs of $83.8 billion for FY 2020.63  Vulnerabilities exist in HHSs 
payment strategies for prescription drugs (including biologics).   
The way that Medicare and Medicaid pay and reimburse for drugs can impact prescription drug prices and 
costs for programs and their beneficiaries.  In the Part B program, OIG found that Medicare would have 
saved millions of dollars if dispensing fees for several drugs had been aligned with the rates that Part D and 
State Medicaid programs paid.64  OIG found that CMS included prices for higher cost versions of drugs that 
are not covered under Medicare Part B when setting Part B payment amounts.  Section 405 of the 
Coronavirus Aid, Relief, and Economic Security Act (CARES) required CMS to make the changes to Part B 
payment policy recommended by OIG.  This lowered payment amounts for some Part B drugs as of July 1, 
2021.  OIG also found increases in costs for certain prostate cancer drugs reimbursed under Part B that had 
been subject to the least costly alternative (LCA) policy after that policy was rescinded.  LCA bases the 
payment amount for a group of clinically comparable products on that of the least costly product.  OIG 
found that Medicare expenditures for certain prostate cancer drugs would have been reduced by $33.3 
million over 1 year (from $264.6 million to $231.3 million) under the LCA policy.65  Furthermore, OIG found 
that although there was a 17-percent decrease in Medicare Part D prescriptions for brand-name drugs from 
2011 to 2015, there was a 77-percent increase in total reimbursements for these drugs, leading to greater 
overall Part D spending and higher beneficiary out-of-pocket costs.66   
OIG also found that Medicaid could save hundreds of millions of dollars by excluding authorized generic 
drug transactions to secondary manufacturers from brand-name drugs average manufacturer price (AMP) 
calculations.  Estimated to save $3.2 billion over 10 years, Section 1603 of the Continuing Appropriations 
Act, 2020, and Health Extenders Act of 2019 amended section 1927(k)(1)(C) of the Act to exclude generic 
drug transactions to secondary manufacturers in the brand-name drugs AMP calculations.67  Additionally, 
manufacturers use of reasonable assumptions when calculating AMPs and best pricesa practice OIGs 
work has established as commonrepresents a vulnerability in drug pricing for thousands of drugs used in 
the Medicaid program.68  HHS must endeavor to limit the impact of high prices on programs and 
beneficiaries while protecting access to medically necessary drugs.  Additionally, the Department should be 
prepared to address coverage and reimbursement challenges of emerging technologies.  
12 
   
Preventing and reducing improper payments  
An improper payment is any payment that does not meet statutory, contractual, 
administrative,  or  other  legally  applicable  requirements,  and  that  may  be  an 
overpayment or an underpayment.69  Reducing improper paymentssuch as payments to 
ineligible recipients or duplicate paymentsis critical to safeguarding Federal funds.  Due to their 
size, HHS programs account for some of the largest estimated improper payments in the Federal 
government.  Medicare, Medicaid, and CHIP accounted for 65 percent, or $134.2 billion, of all governmentwide 
estimated improper payments reported in FY 2020.70   Furthermore, insufficient HHS oversight of grant programs 
and contracts poses risks of significant improper payments.     
Medicare 
Original Medicare fee-for-service (FFS), Medicare Part C (also known as Medicare Advantage (MA)), and 
Medicare Part D (also known as Medicare Prescription Drug) accounted for $42.9 billion, or 32 percent, of 
the estimated improper payments that HHS reported in FY 2020.71  Notably, the Medicare FFS improper 
payment rate estimate during the past 3 years has decreased from 8.1 percent ($31.6 billion) in FY 2018 to 
7.3 percent ($28.9 billion) in FY 2019, and to 6.3 percent ($25.7 billion) in FY 2020.72  This represents positive 
momentum upon which the Department and CMS can build.  However, some types of providers and 
suppliers pose heightened risks to the financial security of Medicare.  For instance, OIG and CMS have 
identified especially high rates of improper payments for home health, hospice, and SNF care; durable 
medical equipment, Prosthetics, Orthotics, & Supplies (DMEPOS); chiropractic services; and certain hospital 
services.73  CMS has taken corrective actions for Medicare FFS by focusing on specific service areas with 
high improper payment rates.  The reduction in the improper payment rate was driven primarily by 
reductions in improper payments for home health, Part B, and DME claims.  However, CMS should take 
further action to reduce improper payments among certain provider and supplier types and in geographic 
locations that present a high risk to the financial security of Medicare.  Furthermore, CMS should ensure 
that it is prepared to detect and prevent improper payments in burgeoning areas, such as telemedicine and 
genetic testing. 
Moreover,  improper  payments  to  Medicare  Advantage  Organizations  (MAOs)  pose  a  significant 
vulnerability for CMS and cost taxpayers billions of dollars.  In FY 2020, the improper payment rate for the 
MA program (Part C) was 6.8 percent, for a total of $16.3 billion in improper payments.74  Unlike in FFS, 
through which CMS pays providers directly for each covered service received by a beneficiary, CMS under 
managed care makes a capitated payment to a MAO for each person enrolled in the organization.  In turn, 
the MAO pays providers for services a beneficiary may require that are included in the organizations 
contract with CMS.  CMS adjusts payments to pay MAOs different amounts for beneficiaries with different 
expected health care costs.  This helps improve access to care for beneficiaries with greater health care 
needs and reduces incentives for selecting particular beneficiaries.  However, OIG has found improper 
payments in MA that were driven by diagnoses not supported in the medical records.75, 76  
Medicaid 
Medicaid is a Federal-State financing partnership with the 50 States, 5 territories, and the District of 
Columbia each offering its own program variation reflecting State and local needs and preferences.  CMSs 
Payment Error Rate Measurement (PERM) program measures improper payments in Medicaid and CHIP in 
all 50 States and the District of Columbia, and produces a national improper payment rate for each program.  
The estimated Medicaid improper payment rate increased significantly, from 14.9 percent in FY 2019 to 
13 
   
21.4 percent in FY 2020, while CHIP increased from 15.8 
percent to 27.0 percent.  These increases were largely due to the 
continued  re-introduction  of  beneficiary  eligibility  errors  which  had 
previously been paused while CMS updated the PERM eligibility component.77  
Medicaid accounted for approximately $86.5 billion in estimated improper payments 
in FY 2020.  CMS attributes these increases to high levels of observed eligibility errors, such 
as those occurring when States maintain insufficient documentation to substantiate that income 
and other information were appropriately verified, failures in conducting timely and appropriate annual 
redeterminations, as well as errors when beneficiaries are claimed under incorrect eligibility categories that 
provide a Federal matching rate that was higher than appropriate.78   
OIG work has found that States are not always correctly determining the eligibility of individuals for 
receiving Medicaid benefits, resulting in potential improper payments.  OIG audits have also identified 
substantial improper payments to providers across a variety of Medicaid services including school-based, 
nonemergency medical transportation, targeted case management, and personal care services (PCS).79  In 
addition to other corrective actions, CMS has engaged with State Medicaid and CHIP agencies to develop 
corrective action plans that address State-specific reasons for improper payments identified through the 
PERM program and as part of other Medicaid fiscal oversight efforts.  Given that CMS will apply the updated 
Medicaid eligibility measurements to the last set of States for the first time in FY 2021, the improper 
payment rate is likely to see similar, significant increases in this fiscal year.  As such, it will be imperative 
that CMS focus its efforts to examine the reasons for and implement strategies to reduce Medicaid and 
CHIP improper payment rates. 
Grants and contracts 
Administering grant programs and contracts requires that HHS implement internal controls to ensure that 
program goals are met and funds are used appropriately.  For grant programs, this includes oversight and 
guidance to award recipients.  HHS is responsible for providing up-to-date policies to grant recipients and 
helping States and other grantees address their own financial management and internal control issues.  
Without proper internal controls, funds may be misspent, duplication of services may occur, and sub-
recipients may not be adequately monitored.  OIG has identified grantee-level concerns in several HHS 
programs, including some Office of Refugee Resettlements (ORRs) Unaccompanied Children (UC) Program 
grantees reporting unallowable costs and lacking effective systems for administering program funds.80   OIG 
also found that ORR did not award or effectively manage a sole source contract in accordance with Federal 
regulations and HHS policies and procedures.81  Additionally, OIG found that HHS has taken minimal action 
to improve policies and procedures for ensuring Small Business Innovation Research Program awardee 
eligibility and has taken no action to improve policies and procedures for preventing duplicative funding.82 
To ensure that grant funds are used appropriately, HHS must track and report improper payment rates for 
its risk-susceptible grant programs and thus adhere to the Payment Integrity Information Act of 2019.83  
However, since the inception of these reporting requirements HHS has not reported an improper payment 
estimate for the Temporary Assistance for Needy Families (TANF) program.84  States receive block grants 
($16.2 billion in FY 2020) to design and operate TANF programs.85  HHS has stated that it does not believe 
that it has the statutory authority to collect from States the data necessary for calculating an improper 
payment rate for the TANF program.  The Office of Management and Budget (OMB) has identified TANF as 
a risk-susceptible program that must report estimated rates and amounts of improper payments.  HHS must 
continue to pursue legislative remedies to develop an appropriate methodology for measuring TANF 
payment accuracy and report an improper payment estimate for TANF. 
14 
   
In terms of the Departments oversight of contracts, HHS has 
taken steps to enhance its acquisition systems and better monitor 
contract closeouts and contract payments.  Moreover, CMS has increased 
its efforts in examining workload statistics for benefit integrity contractors and 
improving performance outcomes.  Although CMS has taken steps to improve its 
contract management and closeout processes, the Department needs to take additional 
actions to ensure that it is meeting other Federal requirements.  For example, OIG found that CMS 
did not identify and report potential Antideficiency Act violations for 12 contracts used to establish the 
Federal Health Insurance Marketplace under the Affordable Care Act.86  Additionally, OIG found that CMS 
did not administer and manage strategic communications services contracts in accordance with Federal 
requirements and made recommendations to both HHS and CMS to address the significant deficiencies we 
identified.87  HHS is developing a permanent Procurement Management Oversight Review structure to 
provide further oversight of the HHS acquisition portfolio. 
COVID-19 funding 
Congress appropriated $484 billion to HHS for the COVID-19 response.88  This includes $178 billion for the 
Provider Relief Fund (PRF) to support health care providers affected by the COVID-19 pandemic.  PRF 
dollars are provided to hospitals and other health care providers on the front lines of the COVID-19 
response and allocated to providers as part of general distributions and through targeted allocations to 
high impact areas, safety net hospitals, childrens hospitals, rural providers, Tribal facilities, clinics and 
urban health centers, SNFs, and nursing homes.89  In addition to PRF funds, Congress also appropriated 
additional funds for providers who serve rural Medicaid, CHIP, or Medicare patients.  Furthermore, funds 
were dedicated to reimburse eligible providers and facilities for COVID-19 testing, treatment, and vaccine 
administration for individuals who do not have health coverage, as well as to patients whose health 
insurance does not cover vaccine administration fees or does cover but typically has patient cost-
sharing.90,91  HHS has developed financial assistance policy guidance and tracking mechanisms to support 
the COVID-19 supplemental funding appropriations.92  Efficient and effective management and 
administration will be essential to ensuring that COVID-19 response programs achieve their intended 
purposes and provide relief to intended individuals and entities.  OIG is conducting a series of audits of 
PRF distributions.93 
Combating fraud, waste, and abuse in HHS programs 
Fraud, waste, and abuse divert needed program resources to inappropriate, unauthorized, or illegal purposes.  
Effectively fighting fraud, waste, and abuse requires vigilance and sustained focus on preventing problems from 
occurring in the first place, detecting problems promptly when they occur, and rapidly remediating detected 
problems through investigations, enforcement, and corrective actions.  To accomplish this, HHS must have controls 
to ensure the proper use of resources to detect and prevent fraud.  The Department should also apply a robust 
variety of program integrity strategies to protect HHS programs.  These strategies must include systems and 
processes to detect and prevent fraud, as well as plans for addressing fraud when it occurs.  
COVID-19 funds 
As noted above, HHS received $484 billion in COVID-19 funding.94  Moreover, as of May 2021, CMS had 
made advanced and accelerated payments to Medicare providers totaling more than $107.3 billion and 
paid providers for certain services at enhanced rates applicable during the public health emergency.95  In 
addition, as of September 2020, CMS reported more than $104.3 billion in Other Assets, which are mainly 
15 
   
composed of these advanced and accelerated payments.96  
CMS also suspended or reduced the scope of many program integrity 
safeguards, such as provider enrollment screening.  While these steps may 
be appropriate to ensure access to care, they also raise the risk that fraud will 
be committed by those seeking to exploit the emergency.  Regardless of the source of 
funds, HHS must effectively and efficiently manage the use of funds internally, award and 
manage contracts related to COVID-19 funding in accordance with contracting requirements, and 
appropriately oversee the external use and accounting of Federal funds by thousands of recipients.  HHS 
should ensure that funds are paid only to eligible recipientsin correct amountsand used in accordance 
with program requirements.   
Furthermore,  HHS  must  apply  effective  internal  controls  and  efficiently  manage  the  collection, 
maintenance, and analysis of relevant data that are key to ensuring that COVID-19 funds are used for their 
intended purposes.  OIG has identified serious concerns related to fraud schemes that would divert funds 
intended for COVID-19 response and recovery.  For example, OIG settled a case for civil monetary penalties, 
involving a provider that received PRF funds despite having its Medicare billing privileges revoked and 
attesting in the PRF portal that it was not revoked.97  OIG is currently investigating several other entities 
that allegedly received PRF funds despite being ineligible and providers that falsely attested that they were 
eligible to receive PRF funds.  In May 2021, the Department of Justice (DOJ) and OIG announced criminal 
charges for the misuse of COVID-19 funds.98  Among other charges, funds were allegedly misappropriated 
from PRF based on false applications. 
HHS must also take action to protect individuals from being defrauded under the guise of the public health 
emergency.  In August 2021, OIG alerted the public about COVID-19-related fraud schemes and potential 
harm to beneficiaries.99  OIG noted that fraudsters were offering unapproved and illegitimate COVID-19 
tests, HHS grants, and Medicare prescription cards in exchange for personal details, including Medicare 
information.  Any personal information collected can be used to fraudulently bill Federal health care 
programs and commit medical identity theft.   
Furthermore, as with all HHS grant programs, it will be critical that the Department provide up-to-date 
policies to COVID-19-related grant recipients and help States and other grantees address their own financial 
management and internal control issues.  Without proper internal controls, funds may be misspent, 
duplication of services may occur, and sub-recipients may lack adequate monitoring.   
Medicare and Medicaid 
CMS must be vigilant in identifying and addressing fraud in its programs.  Schemes to steal money from 
Medicare and Medicaid take many forms and vary depending on setting and services provided.  These fraud 
schemes can be as simple as billing for services not provided and identity theft, or as complex as kickbacks, 
improper prescribing, deceptive marketing, and money laundering.  The perpetrators of fraud schemes 
range from highly respected providers to organized criminal enterprises with no legitimate role in health 
care.  OIG has encountered scams in which fraudsters use technology to impersonate official government 
personnel from HHS or OIG.  Scammers target individuals through various methods including phone, email, 
or social media to obtain money or personal, medical, or financial information.  OIG routinely alerts the 
public about emerging fraud scams.  In recent years, OIG has issued fraud alerts involving durable medical 
equipment, genetic testing, and telephone fraud.100  To combat fraud, CMS should continue its important 
coordination with, and support for, law enforcement, including taking parallel administrative actions as 
16 
   
appropriate. 
Managed care   
HHS faces a significant challenge in  conducting oversight of managed  care 
programs and protecting against fraud, waste, and abuse.  Managed care is the primary 
delivery system for Medicaid, covering at least some services for more than 80 percent of all 
enrollees.101  In Medicare, more than one-third of beneficiaries are currently enrolled in MAOs.  OIG 
has found weaknesses in MAOs and Medicaid Managed Care Organizations (MCOs) efforts to identify 
and address fraud and abuse by their providers.102  For example, OIG has found Medicaid MCO capitation 
payments were made in one State on behalf of beneficiaries who were concurrently eligible and residing in 
another State.103  To ensure program integrity requirements are met, CMS requires MAOs and Medicaid 
MCOs, prepaid inpatient health plans, and prepaid ambulatory health plans (referred to as managed care 
plans) to implement compliance programs that are designed to prevent, detect, and correct instances of 
fraud, waste, and abuse.  However, these programs vary widely among the MAOs and Medicaid MCOs, as 
does the detection of suspected fraud.  In Medicaid managed care, program integrity responsibilities are 
even more dispersed as they are shared among CMS, States, and managed care plans.  This makes effective 
program integrity oversight by CMS more complex and challenging.   
Furthermore,  the  MA  program  is  vulnerable  to  fraud, waste,  and  abuse  perpetrated  by  MAOs  to 
inappropriately inflate the payments that they receive from Medicare or to inappropriately deny care that 
they are obligated to provide.  In multiple audits of MAOs, OIG sought to determine whether the MAOs 
submitted diagnosis codes to CMS for use in the risk adjustment program in accordance with Federal 
requirements.  OIG found that risk-adjustment data that MAOs submit to CMS for use in the risk-adjustment 
program was not always supported by medical records.  OIG has recommended that certain MAOs refund 
overpayments and enhance their policies and procedures to prevent, detect, and correct noncompliance 
with Federal requirements.104  OIG also found that billions of dollars in estimated MA risk-adjusted 
payments supported solely through chart reviews or diagnoses reported only on health risk assessments 
raise concerns about the completeness of payment data submitted to CMS, the validity of diagnoses on 
chart reviews and health risk assessments, and the quality of care provided to beneficiaries.105, 106  OIG has 
made recommendations to CMS to improve its oversight of MAOs so that MAOs will ensure practices drive 
better carenot just higher profitsas well as enact policies and procedures to improve the integrity and 
usefulness of payment data.   
Additionally, significant concerns have been raised that the capitated payment model used in MA may 
provide a potential incentive for MAOs to inappropriately deny access to services and payments to increase 
their profits.  An MAO that inappropriately denies authorization of services for beneficiaries or payments 
to health care providers may contribute to physically or financially harming beneficiaries and misuse 
Medicare program dollars that CMS paid for beneficiaries health care.  OIG found that high numbers of 
overturned denials upon appeal and persistent performance problems identified by CMS audits raise 
concerns that some beneficiaries and providers may not be getting services and payment that MAOs are 
required to provide.107   
To strengthen CMSs oversight of the MA program, OIG has recommended that CMS make improvements 
to MA encounter data.108  CMS has taken action to address potential errors in the data and ensure that 
billing provider identifiers are active and valid on all records.  However, CMS must also provide targeted 
oversight of MAOs that have submitted a higher percentage of records with potential errors, track how 
17 
   
MAOs respond to edits that reject data, and establish and monitor 
performance thresholds related to MAOs' submissions of records with 
complete  and  valid  data.109    Additionally,  CMS  continues  to  validate  the 
completeness and accuracy of Medicare and Medicaid managed care plan encounter 
data and periodically updates guidance for MAOs in order to improve encounter data 
submission.  OIG has found that identifiers for ordering providers are an essential tool for 
safeguarding program integrity but are largely missing from the encounter data, despite evidence that 
many MAOs can and do already collect this information.110  
CMS should take further actions to ensure the completeness, validity, and timeliness of Medicaid encounter 
data.  OIG found that most States did not provide complete and/or accurate data on Medicaid managed 
care payments to providers in the national data system the Transformed Medicaid Statistical Information 
System (T-MSIS).  CMS and States need complete and accurate payment data to effectively monitor and 
administer Medicaid managed care, the primary delivery system of the Medicaid program.  The need for 
complete and accurate payment data is more important than ever, given the unprecedented stress that the 
COVID-19 pandemic has placed on the Medicaid program.111   
Furthermore, CMS should work with its contractors and with States to improve efforts to identify and 
address fraud and abuse.112  Additionally, the agency should work to ensure that appropriate information 
and referrals are sent to law enforcement.  To improve Medicaid managed care plans identification and 
referrals of cases of suspected fraud or abuse, CMS is working with States to provide technical assistance 
and education on best practices.  (See TMC 5 for more information on expanding HHSs capacity to use and 
share data to support evidence-based policymaking, program management, and program involvement.) 
Marketplace insurance 
The Department must be attuned to ensuring that payments for advance premium tax credits (APTCs) for 
enrollees in marketplace insurance are accurate.  There was an estimated 20 percent increase in people 
eligible for subsidized marketplace coverage after passage of the American Rescue Plan Act of 2021 and an 
estimated $35.5 billion increase in premium tax credits.113  OIG work has found weaknesses in State and 
Federal marketplace systems for ensuring correct eligibility determinations and accurate APTC payments.  
For example, a recent OIG audit determined that APTCs payments were paid on behalf of enrollees who did 
not make required premium payments and recommended improvements to processes and data collection 
and sharing with the Internal Revenue Service.114   
Grants  
Without adequate oversight and internal controls, HHS grants and contracts are vulnerable to fraud 
schemes including embezzlement.115  HHS has worked to strengthen some of its program integrity efforts 
that are focused on grant programs.  For instance, it issued guidance and developed tools to help HHSs 
awarding OpDivs examine prospective grantee risk prior to awarding grants.116  This information enhances 
awarding OpDivs assessment of prospective grant recipients integrity and potential performance.  
Prescription drugs 
OIG has found that opioid-related fraud encompasses a broad range of criminal activity, from prescription 
drug diversion to addiction treatment schemes.  OIG investigations show that opioid drug diversion (the 
redirection of legitimate drugs for illegitimate purposes) is on the rise.  Diverted opioid drugs are at high 
18 
   
risk of inappropriate use and causing significant harm such as 
overdose.  Also, potentiator drugs (drugs that exaggerate euphoria 
and escalate the potential for misuse when combined with opioids) and 
drugs indicated to treat OUDs (particularly buprenorphine) are at high risk for 
diversion.    CMS  and  States  should  follow  up  on  prescribers  with  questionable 
prescribing patterns to ensure that Medicare Part D and Medicaid are not paying for 
unnecessary drugs being diverted for resale or recreational use.  OIG has also recommended that 
IHS improve its internal controls against opioid-related fraud, including controls at entry points to 
sensitive areas of its hospitals to protect its pharmacy inventory from unauthorized access.117  In addition, 
the Department must guard against fraud in OUD treatment programs, including the submission of 
fraudulent insurance claims for purported OUD treatment and testing services.118   
Furthermore, opioid treatment services were not being claimed by selected providers in accordance with 
applicable Federal and State regulations.  Treatment deficiencies included individual counseling sessions 
not supported with adequate documentation, take-home medications not provided in accordance with 
Federal or State regulations, methadone dosing services administered without proper authorization, and 
individual counseling and methadone services provided without a treatment plan in effect.119 
OpDivs should improve efforts to identify and investigate potential fraud and abuse in prescription drug 
programs.  For instance, CMS should collect comprehensive data from Medicare Part D plan sponsors.  CMS 
should also require pharmacies that bill Medicare Part D to enroll in the Medicare program.  Currently, 
CMSs three key tools for safeguarding against fraudenrollment, revocation, and preclusionapply to 
pharmacies only when they bill Medicare Parts B or C, not when they bill Medicare Part D.120  Furthermore, 
CMS should ensure that national Medicaid data are adequate to detect suspected fraud or abuse.  The lack 
of reliable national Medicaid data hampers enforcement efforts.  (See TMC 5.)   
Systems and processes for detecting and preventing fraud 
For detecting and preventing fraud and improper payments, CMSs Fraud Prevention System (FPS) serves 
as an important tool that should be improved to increase its effectiveness.  Since 2011, FPS has continuously 
run predictive algorithms and provided other sophisticated analytics nationwide on Medicare FFS claims 
prior to payments to identify, prevent, and stop fraudulent claims.  However, OIG found that FPS is not as 
effective in preventing fraud, waste, and abuse in Medicare as it could be and recommended that CMS 
make better use of the performance results within its FPS to refine and enhance its predictive analytic 
models.121 
An effective provider enrollment screening process is an important tool for preventing Medicaid and 
Medicare fraud.  It plays a vital role in identifying unscrupulous providers and preventing them from 
enrolling in Medicaid and Medicare.  OIG work has found that Medicaid is vulnerable to being defrauded 
by high-risk providers that were not properly screened.  Specifically, OIG found 13 States had not 
implemented fingerprint-based criminal background checks for their high-risk Medicaid providers as of 
January 2019.  We also found that unscrupulous providers could exploit loopholes in the provider 
enrollment process to enroll in Medicaid without undergoing these checks.122  In addition, OIG found 23 
States had not enrolled all providers serving Medicaid beneficiaries in their respective Medicaid programs, 
exposing them to potentially harmful providers that had not been screened for fraud, waste, and abuse.123  
Furthermore, OIG work found that nearly 1,000 terminated providersor 11 percent of all terminated 
providerswere inappropriately enrolled in State Medicaid programs.124  Despite legislative requirements 
19 
   
in the 21st Century Cures Act designed to strengthen Medicaid 
program integrity, terminated providers continue to serve Medicaid 
beneficiaries.  CMS should: (1) ensure that all States fully implement 
fingerprint-based criminal background checks for high-risk Medicaid providers; 
(2) work with States to ensure that they have the controls required to prevent 
unenrolled providers from participating in Medicaid; and (3) follow up with States to remove 
terminated providers that OIG identified as inappropriately enrolled in Medicaid. 
Monitoring and reporting on the integrity of HHS programs 
HHS must ensure the completeness, accuracy, and timeliness of financial and program information provided to other 
entities both internal and external to the Federal government.  Responsible stewardship of HHS programs is vital to 
operating a financial management and administrative infrastructure that employs appropriate safeguards to 
minimize risk and provide oversight to protect resources.  Although HHS continues to maintain a clean opinion on 
its basic financial statements, addressing weaknesses in financial management systems and resolving issues related 
to reporting requirements of the Digital Accountability and Transparency Act of 2014 remain challenges for HHS. 125   
For FY 2020, OIG recommended that HHS continue to focus efforts on resolving issues related to its information 
technology (IT) system controls and completing data cleanup activities.   
In addition, financial management systems help OpDivs and StaffDivs ensure operational effectiveness and 
efficiency, financial reporting reliability, and compliance with applicable laws and regulations.  OIG continues to find 
deficiencies in internal controls over segregation of duties, configuration management for approved changes to HHS 
financial systems, and access to HHS financial systems.126  These deficiencies collectively constitute a significant 
deficiency in internal controls.  HHS must take additional actions to address and resolve these issues, including 
continuing to work to control user access, ensuring proper approval of and documentation supporting system 
changes, and ensuring appropriate segregation of duties 127   
 
 
 
20 
   
3: Delivering Value, 
Quality, and Improved 
Outcomes in Medicare and 
Medicaid 
HHS continues to reform Medicare and Medicaid to promote quality, 
efficiency, and value of care.  Reforms underway touch virtually every  KEY TAKEAWAYS 
type of health care service and offer opportunities for better care and 
I.  Relevant Agency: CMS 
health outcomes, improved access and health equity, lower costs, 
II.  Elements of the Challenge:  
more  transparency  and  choices  for  consumers,  and  reduced 
  Aligning program incentives 
administrative  burden.128    Reforms  also  come  with  an  array  of 
with quality, equity, and 
operational and program integrity challenges. 
health outcomes 
Medicare and Medicaid are the two largest and most complex health    Strengthening program 
care programs at HHS.  They use multiple delivery models (FFS,  integrity 
managed  care,  and  new  models  such  as  accountable  care    Delivering on the promise of 
organizations (ACOs)); cover a broad array of health conditions,  innovative technology to 
providers, services, and settings; and operate pursuant to intricate  improve health outcomes 
statutory directives and regulatory schemes.  People of all ages and 
backgroundsfrom seniors to children, and from the healthy to the seriously illdepend on these programs.  In fall 
2021, the CMS Innovation Center set a strategic goal for its next 10 years to transform the health system into one 
that achieves equitable outcomes through high quality, affordable, person-centered care.  CMS further committed 
to designing models that include a variety of providers who care for underserved populations.129 130 
Medicare and Medicaid beneficiaries are increasingly choosing managed care options, and more providers are 
participating in value-based models.  Continued growth in value-based care and payment is expected in public and 
private health care programs.  CMSs Innovation Center continues to test new models across the health care 
spectrum.  In a recent report to Congress, CMS estimated that more than 27.8 million Medicare and Medicaid 
beneficiaries and individuals with private insurance in multi-payer model tests had been included in Innovation 
Center models and initiatives as of September 30, 2020.131  Estimated payments for model tests and initiatives 
(excluding reimbursement for covered services) totaled about $13 billion for FYs 2010-20.  Among its permanent 
value-based programs, CMS administers the Quality Payment Program for physician reimbursement and the 
Medicare Shared Savings Program for ACOs.  CMS recently announced plans to expand value-based care in home 
health.  CMS paused timelines and modified some model and program requirements because of the COVID-19 public 
health emergency.    
Both Medicare (FFS, Part C, and Part D) and Medicaid have proven susceptible to fraud, waste, and abuse.  FY 2020 
estimates of improper payments ranged from 6.3 percent (for Medicare FFS) to 21.4 percent (for Medicaid) of total 
expenditures.  Improper payments for Medicare, Medicaid, and CHIP totaled approximately $134.2 billion.132  These 
programs are on the Government Accountability Offices (GAOs) list of high-risk government programs.  OIGs 
enforcement work shows that wrongdoers defraud Medicare and Medicaid through schemes ranging from false 
21 
   
billings to kickbacks.  OIGs oversight work demonstrates a range of 
vulnerabilities including: 
  flawed program design and administration (e.g., improper payments) (see TMC 
2);  
  misaligned program incentives and confusing or insufficient program guidance; 
  deficient delivery of care to beneficiaries such as poor quality and unsafe care (see TMC 4) or 
inappropriate utilization; 
  gaps in provider enrollment systems and available data needed for proper oversight (see TMCs 2 and 5); 
and  
  challenges with adequate access for beneficiaries to covered services in both FFS and managed care. 
 
To reduce disease spread and expedite the delivery of medically needed care during the COVID-19 public health 
emergency, CMS implemented flexibilities addressing coverage and payment for items and services, and OIG 
implemented targeted flexibilities with respect to  application of fraud and abuse authorities to specified types of 
business arrangements.133  These flexibilities introduce additional regulatory risks and compliance challenges for 
stakeholders implementing them and the Department overseeing their effectiveness.  Moreover, the pandemic 
amplified the effects of longstanding, systemic health  care disparities among communities of color and in 
underserved areas. 
To ensure the effectiveness of Medicare and Medicaid in delivering value, the Department should focus on three 
facets of the challenge: (1) aligning program incentives with quality, equity, and health outcomes; (2) strengthening 
program integrity; and (3) delivering on the promise of innovative technology.   
Aligning program incentives with quality, equity, and health outcomes 
Developing effective incentives and policies to drive better health outcomes is difficult given the complexities of 
medicine, the evolving science of quality measurement, and the varying needs of the populations served by these 
programs.  The Department is undertaking initiatives to streamline, improve, and target quality measures more 
precisely and to move from process measures to outcome measures.  In March 2021, CMS launched Meaningful 
Measures 2.0: Moving from Reduction to Modernization to reduce the number of measures in its programs and 
further shape the entire ecosystem of quality measures that drive value-based care.134  CMS reported that since 
the inception of the original initiative in 2017 it has reduced the number of Medicare quality measures by 18 percent, 
saving more than 3 million hours and a projected $128 million.135  With the new iteration, CMS aims to better address 
health care priorities and gaps, emphasize digital quality measurement, and promote patient perspectives.     
Moving forward, HHS should ensure that its programs use effective, evidence-based measures to improve quality of 
care and beneficiary outcomes.  CMS must clearly define actionable and meaningful quality and outcomes measures 
for its programs and ensure their reliability, accuracy, and utility.  CMS should continue, where appropriate, to align 
its  efforts  with  other  OpDivs  using  quality  measurements  to  enhance  efficiency  and  strengthen  quality 
measurement.  Accuracy and completeness of reported quality and performance information is critical for payment 
purposes.  A recent OIG report found that CMSs monitoring was generally effective at ensuring that Medicare 
Shared Savings Program ACOs report complete and accurate data through claims, administrative data, and the CMS 
web portal.  The report identified weaknesses in contractor oversight that could result in incomplete or inaccurate 
data reported through a patient survey.136 
22 
   
Value-based models typically pay, in full or in part, based on health 
outcomes achieved for patients and reductions in health care costs.  Providers 
are reimbursed for a set or bundle of services, often provided across a continuum 
of care settings, with accountability for outcomes and costs over an established period.  
To meet care and cost goals, providers are furnishing a range of services not typically 
reimbursed under volume-based, traditional fee-for-service.  These might include social services, 
care coordination, or health information technology.  Especially when nontraditional services affect the 
amount of payment, HHS should be attentive to ensuring that such services contribute to achieving quality, 
equity, and efficiency outcomes.  Because these interventions are not reflected in normal claims data, CMS should 
ensure it has the available data necessary to understand the services provided and evaluate their effectiveness.  This 
may require that CMS partner with other OpDivs and Federal agencies that support social services.  Operation and 
oversight of models that integrate traditional health and other services may be hampered by data silos both within 
HHS and across the Federal Government.  (See TMC 5 on data sharing.)  There is a heightened program integrity risk 
if add-on, nontraditional services are offered to patients for marketing purposes, rather than to foster improvements 
in patient health outcomes, efficiencies, or equity. 
In November 2020, CMS and OIG issued regulations intended to promote value and quality through better 
coordinated care for patients and broader sharing of patient information for patient care.137  HHS should monitor 
results to ensure that the regulations operate as intended to promote beneficial arrangements and practices, and 
are not subject to abuse. 
Access to care and health equity are longstanding challenges that have been exacerbated by the COVID-19 pandemic.  
OIG work has long identified access issues in Medicare and Medicaid.  For example, a report examining provider 
shortages and limited availability of behavioral health services in New Mexicos Medicaid managed care provides 
insights into challenges likely shared by other States.  Identified challenges included an uneven distribution of 
licensed providers across the state, staff retention, poor care coordination, and a lack of transportation and 
broadband services.  Promising initiatives to increase availability of behavioral health services included open-access 
scheduling, a treat first clinical model, care integration, and telehealth.138  Ensuring that programs have accurate 
demographic and other data is a requisite step in identifying, understanding causes of, and addressing health 
disparities.  A recent OIG analysis of Medicare claims data showed that in nursing homes in 2020 about half of the 
Black, Hispanic, and Asian beneficiariesand 41 percent of the White beneficiarieshad or likely had COVID-19.139   
New payment structures, care delivery methods, business arrangements among providers, and incentives all give 
rise to risk-management challenges in Medicare and Medicaid.  Notwithstanding identified successes, CMS must 
maintain a steady focus on quality of care and health outcomes.  This is particularly true during the COVID-19 public 
health emergency when normal guardrails and conditions have been adjusted to address exigent public health 
circumstances and when providers may temporarily be unable to meet optimal care guidelines.  (See TMC 4 for 
further discussion of quality-of-care challenges.)  
Strengthening program integrity 
HHS must be attentive across FFS and managed care programs to assess, identify, and mitigate program integrity 
risks.  The nature of fraud and abuse risk differs depending on how Medicare and Medicaid pay for services.  
Traditional FFS risks, arising from volume-sensitive payments, include inappropriate increased utilization, increased 
program costs, and improper patient steering.  In managed care, a capitated payment system leads to risks such as: 
stinting on care to reduce costs, discriminating against expensive patients, or manipulating or falsifying data used to 
measure performance, outcomes, acuity, or diagnoses for risk adjustment.  In nontraditional health care models that 
23 
   
marry FFS payments with value-based payments, such as shared savings 
or partial capitation payments, elements of both FFS and managed care risks 
may be present.  In evaluating and managing risks for a specific model, CMS must 
consider the range of incentives in the model.  Managed care is not immune from risks 
created by mixed incentives.  OIGs oversight and enforcement work has revealed opportunities 
for downstream fraud and abuse in managed care by providers paid by plans on an FFS basis. (See 
TMC 2 for further discussion of program integrity in managed care.)    
In  testing  and  implementing  value-based  models,  CMS  must  continue  to  focus  on  program  integrity  risks, 
incorporating safeguards to reduce them and strategies to correct them.  Focusing on program integrity risk is 
especially important for models that introduce new payment incentives, which could lead to new fraud schemes, 
and for models for which customary payment, coverage, or fraud and abuse laws do not apply due to waivers, 
exceptions, or safe harbors.  Additional risks may arise from novel flexibilities granted because of the COVID-19 
public health emergency.  HHS should incorporate guardrails to mitigate risks when designing flexibilities, monitor 
implementation of flexibilities for any abuse, and take prompt action to correct problems and hold wrongdoers 
accountable. 
Many value-based models promote care in home and community settings through in-person home visits, remote 
monitoring, and other technologies.  These services can be less costly and are often preferred by patients.  OIG work 
in areas such as hospice care, home health, and PCS consistently demonstrates that patients and the programs may 
be vulnerable to fraud and abuse in home- and community-based settings.  Moreover, home-based services may 
not meet quality of care requirements.  For example, OIG work showed that hospices lacked oversight of their 
registered nurses, resulting in nurses failing to meet requirements for visiting beneficiaries homes to assess the 
quality of care provided by hospice aides.140   
Additional risks to program integrity across Medicare and Medicaid including improper payments, compliance with 
program requirements, provider eligibility and qualifications, data integrity and availability, transparency and 
accuracy of information available to consumers, patient safety, substandard care, and access to care are covered in 
more detail in TMCs 2, 4, and 5.   
Delivering on the promise of innovative technology to improve health outcomes 
Leveraging digital and health technology to foster efficient, high-quality, safe care is critical to a value-driven health 
care system, as is ensuring the appropriate flow of complete, accurate, timely, and secure information.  For example, 
OIGs work examining how ACOs use health IT showed that, although ACOs have used health IT to aid in care 
coordination, the full potential of health IT has not been realized.141   
HHS faces challenges in achieving a connected health care system to support better coordinated and value-based 
care in which patients dataincluding conventional health care data and newer types of data related to social 
determinants, demographics, and personal trackersflow freely across provider settings, with appropriate privacy 
and security protections.  HHS should also be attentive to the challenges beneficiaries face in choosing reliable apps 
and technologies and assuring themselves that providers with whom they engage via an app or technology are 
trustworthy.  (See TMC 5 for further discussion.)  HHS will need to ensure that rural beneficiaries and underserved 
populations can participate fully in a technology-enriched, value-driven health system. 
The Department also faces challenges in ensuring that evolving technologies are effective, enhance patient access 
to quality care, and support providers ability to furnish such care.  Law enforcement actions have illustrated how 
telephone-based remote physician consultations can turn a familiar fraud schemecharging Medicare for DME or 
24 
   
other services patients do not needinto a larger scale scheme with 
less effort.  HHS must provide appropriate oversight of rapidly evolving 
technologies such as telehealth, networked medical devices, robotics, genomic 
testing, and remote monitoring.142  New technologies and apps are being developed by 
entities and individuals (e.g., engineers or scientists) who may be unfamiliar with the complex 
regulations governing health care and unaware of the range of program integrity risks their 
inventions may face.  These new participants in the health care system will need education, guidance, and 
appropriate oversight.   
During the COVID-19 public health emergency, HHS determined that virtual services could be safer for patients and 
issued broad flexibilities for providers to furnish telehealth and other virtual care in settings and under conditions 
not typically allowed.  HHS should monitor and assess services furnished and billed under these flexibilities for 
compliance with requirements, payment accuracy, and quality of care to ensure the flexibilities work as intended.  
As policymakers consider how and whether to incorporate such services into regular programs after the public health 
emergency abates, it will be important to consider program integrity risks.  These risks could include unknown or 
unqualified providers furnishing virtual services, providers offering and billing for services not suitable for virtual 
care, substandard services, unsecured technology or data transmission, and improper incentives to beneficiaries, 
who receive virtual care or provide Medicare billing numbers to those purporting to furnish virtual services.  
HHS faces a growing challenge in understanding and, as appropriate, overseeing providers use of AI and machine 
learning in the delivery of health care such as in diagnostics, as well as for administrative functions such as coding 
and claims submission.  AI and machine learning are introducing new paradigms that require fresh thinking about 
quality of care, compliance, and fraud prevention.  Relatedly, HHS will need to assess how it can use AI, machine 
learning, and other technologies to foster program integrity, value, and quality of care in Medicare, Medicaid, and 
other HHS programs.  (See TMC 1 for further information about FDAs role in emerging technology.) 
In summary: Realizing the promise of value-based care and payment structures 
To achieve better care at lower cost, HHS must maintain a steady focus on developing and refining effective, 
innovative, and evidence-driven models while being proactive in preventing and detecting fraud, waste, and abuse.  
HHS must pay special attention to effectiveness and program integrity in nascent areas such as the intersection of 
health care and social determinants of health as well as new uses of digital technology.  This is vitally important given 
the current and anticipated growth in the costs of and number of beneficiaries in Medicare and Medicaid.  Meeting 
this challenge will enable the Department to expand the reach of dollars devoted to these programs, thereby abating 
some of the anticipated rise in program costs in the coming decades and improving the lives and health outcomes 
of the beneficiaries they serve. 
 
 
25 
   
4: Protecting the Health 
and Safety of HHS 
Beneficiaries 
HHS programs provide critical services to diverse populations across 
KEY TAKEAWAYS 
a  broad  range  of  settings  including  hospitals,  clinics,  child  care 
facilities, shelters, and beneficiaries own homes.  Some services are 
I.  Relevant Agencies: ACF, CMS, IHS, 
directly provided by HHS personnel, some delivered via HHS grant 
HRSA, SAMHSA 
programs, some delivered by contractors working for HHS, and others 
II.  Elements of the Challenge:  
rendered by professionals of a beneficiarys choosing who then claim 
  Ensuring safety and quality of 
reimbursements from Federal programs.  Services include health 
care for beneficiaries of 
care, education, child care, and, in limited circumstances, taking legal 
Federal health care programs 
custody for select populations.  Ensuring that intended beneficiaries 
  Protecting the health and 
receive appropriate services that meet standards for quality, are free 
safety of children served by 
from abuse or neglect, and are not exposed to infectious agents 
HHS programs 
represents a major challenge for the Department.  As the Department 
  Preventing abuse and neglect 
supports the Nations efforts to respond to and recover from the 
COVID-19 pandemic, there will be challenges to ensuring safety and 
quality for beneficiaries receiving all varieties of care and services. 
Ensuring safety and quality of care for beneficiaries of Federal health care programs 
HHS operates the Medicare program to serve about 63.3 million elderly or disabled Americans.  In partnership with 
the States, the Medicaid program serves almost 76.5 million beneficiaries, and the CHIP program serves 7.4 million 
beneficiaries.143  IHS provides direct services for about 2.6 million members of 574 Federally recognized Tribes.144  
These programs cover specific health care services that may include hospital care, physician services, prescription 
drugs, immunizations, hospice care, home and community-based care, DME, and skilled nursing care.   
Delivering covered services 
Ensuring access to and use of care that meets quality and safety standards remains a challenge.  Even when 
Federal health care programs cover care, many beneficiaries do not actually receive the care they need.  
For example, OIG found that more than 500,000 children with attention-deficit/hyperactivity disorder 
(ADHD) who were Medicaid-enrolled did not receive timely followup care, and that more than 50,000 such 
children did not receive behavioral therapy as recommended by professional guidelines.145  At the other 
end of the life cycle, OIG found that more than 80 percent of hospice providersa growing health care 
sector serving beneficiaries and their families at extremely vulnerable times near end-of-lifehad quality-
of-care deficiencies.146  Additionally, fixed daily payment structures may incentivize hospices to enroll 
beneficiaries for longer time periods but scrimp on care.  At times, the greatest barrier to care derives from 
the beneficiarys own behaviors and beliefs.  The Department is currently working to overcome substantial 
vaccine hesitancy that has hampered COVID-19 vaccination efforts, despite ample supplies of and an 
adequate ability to distribute and administer three highly safe and effective vaccines.147 
26 
   
Improving quality of care 
Although the Department has made progress, more work remains to 
improve access to and quality of all types of care.  Oversight work revealed 
that patients experience significant rates of adverse events (patient harm as a result 
of medical care) in health care facilities.  Specifically, OIG found that 27 percent of 
Medicare beneficiaries were harmed during their stays in acute-care hospitals, 29 percent in 
rehabilitation hospitals, 33 percent in SNFs, and 46 percent in long-term care hospitals.148  OIG also 
found that hospitals did not identify when harm occurred in their facilities, in part due to confusion over 
HHS and other government guidance regarding how to define and report adverse events.149  OIG is currently 
conducting a study to update the harm rate for Medicare beneficiaries in hospitals.  The review will assess 
progress made in reducing harm in the decade since the prior study was released in 2010.150  Additionally, 
OIG identified a 13 percent rate of adverse events for patients at IHS hospitals with higher rates for older 
patients, labor and delivery patients, and patients treated in smaller hospitals.151  OIG also found that care 
in labor and delivery services at IHS Hospitals frequently deviated from national clinical guidelines or best 
practices, including for crucial services such as inducing labor and treating postpartum hemorrhage.152  (See 
TMC 6 for more information on cross-government efforts to keep patients safe.)   
Nursing Homes.  The Department continues efforts to improve the quality of covered services as 
well the information available to beneficiaries and their families when selecting a care provider.  
One example is CMSs efforts to improve nursing home care.  CMSs Five-Star Quality Rating 
System is intended to facilitate informed comparisons of nursing homes.  As the COVID-19 
pandemic continues, beneficiaries and their families are struggling to find accurate and timely 
information about infection rates in nursing homes or the vaccination status of staff.  Nursing 
home  residents  were  prioritized  for  COVID-19  vaccinations,  but  this  vulnerable  population 
sustained an outsized toll from the disease, especially early in the pandemic.  In 2020, 42 percent 
of Medicare beneficiaries in nursing homes were diagnosed with or likely had COVID-19, with rates 
of disease even higher in Black, Latino, and Asian populations.153  Especially given limited visitation 
and other access to nursing homes during the COVID-19 pandemic, accurate information about 
nursing home quality is critically important to inform patients and families choices.  Given the 
important role friends and families usually play in identifying and reporting quality issuesan 
information source that may be diminished during the pandemicOIG conducted an education 
and outreach campaign to promote nursing homes attention to quality and inform patients, staff, 
and others on how to report quality-of-care concerns.  The Quality Improvement Organizations 
(QIOs) have also conducted education and outreach to nursing homes, including assistance with 
COVID infection control and promoting vaccination for residents and staff. 
As the COVID-19 pandemic has taken a heavy toll on beneficiaries in nursing homes, longstanding 
staffing and quality-of-care concerns remain pressing.  Additionally, nursing homes were charged 
with implementing new infection control imperatives needed to maintain operations during 
natural disasters, utility service disruptions, and other occurrences that complicate continual 
delivery of care.  OIG continues its series of audits to assess nursing homes compliance with health 
and safety regulations.  Such oversight is especially important as the pandemic brought a decrease 
in onsite nursing home surveys conducted on behalf of CMS.154  OIG has recommended that CMS 
safeguard the health and safety of nursing home residents by ensuring facility correction of 
deficiencies.155  Government  enforcement actions have stopped some poorly performing nursing 
homes from rendering deficient services.  One nursing home chain charged with rendering grossly 
27 
   
substandard  care  to  Medicare  and  Medicaid 
beneficiaries agreed to repay $18 million and abide by the 
terms of a Corporate Integrity Agreement to ensure that it 
delivers appropriate care going forward.156     
Hospice care.  OIG has identified as a top priority for HHS improving hospice care, 
including strengthening the survey process and better educating beneficiaries and their 
families and caregivers.157  Furthermore, beneficiaries and families need better information 
about hospice providers.158  CMS has announced plans to revamp its Hospice Quality Star Rating 
System to enable better informed decision making for beneficiaries seeking hospice care.   
Indian Health Service.  After a series of OIG reports about quality-of-care problems in IHS-
operated hospitals,159 IHS created a Quality Framework and Office of Quality to provide better 
guidance and oversight to its facilities and clinical staff.160  IHS is also working to establish a 
nationwide compliance program to address several OIG recommendations and improve care for 
beneficiaries.  However, some longstanding challenges, such as recruiting and retaining qualified 
staff, persist.  As discussed below, there is also a pressing need to protect patientsespecially 
childrenfrom predators within the ranks of health care and service providers.  To continue 
improvements at IHS, OIG has recommended that IHS prioritize developing and implementing a 
staffing program to ensure sufficient qualified staff at facilities; enhance training for staff and 
hospital leaders; intervene quickly and effectively when quality problems are identified; and 
establish better procedures, including improved external communication.161   
Protecting the health and safety of children served by HHS programs  
HHS operates or funds many programs that provide child care, education, and residential care in addition to health 
care for children, including some especially vulnerable children such as children living in foster care and children in 
the UC Program.  The Head Start program promotes school readiness for nearly 900,000 children from low-income 
families,162 and the Child Care and Development Fund (CCDF) provides child care assistance for about 1.4 million 
children from low-income families.163  The importance of properly vetting program staff to ensure childrens safety 
is discussed below.   
Operating the UC Program 
Through the UC Program, ORR assumes custody of children who enter the  United States without 
immigration status and have no parent or guardian in the United States able to provide for their physical 
and mental well-being.  An unaccompanied child may have arrived in the United States alone or may have 
been separated from parents or legal guardians at the border.  The UC Program merits specific discussion 
as it uniquely tasks the Department with assuming custody for children and the ensuing responsibility for 
their welfare.  Through the UC Program, ORR places unaccompanied children in State-licensed shelters and 
other facilities operated by grantees or contractors.  These facilities provide food and shelter as well as 
medical and mental health care and other services.  Children remain in these placements until a sponsor 
(usually a parent or family member) is found to whom the child may be safely released, the childs 
immigration status is resolved, or the child turns 18 years old and ages out of the program.  Since ORR began 
operating the UC Program in 2002, it has served more than 400,000 children.  As of August 31, 2021, more 
than 16,000 UCs were in HHS custody with a length of stay averaging 28 days.164  The number of children 
entering the United States fluctuates and the Department must be prepared to serve additional children at 
28 
   
times of increased need.  In response to the increasing number 
of referrals of unaccompanied children in 2021, ORR opened Influx 
Care Facilities and Emergency Intake Sites to provide additional space 
when the capacity of permanent shelters was exceeded. 
In recent years, ORR has been called upon to care for more children, including children who 
did not come to the United States alone but were separated from parents or guardians at or 
after arrival.  HHS reported to a court as part of a lawsuit that 2,737 children who had been separated 
by the Department of Homeland Security (DHS) had remained in ORR care as of June 2018.  Following OIGs 
January 2019 report finding that significantly more children had been separated from their parents than 
previously reported, the government identified an additional 1,556 children who had been separated.  
Neither ORR nor DHS had kept adequate records about separated families, impeding efforts to identify and 
reunite them.  As of June 30, 2021, a court-appointed steering committee reported that it had been unable 
to locate the parents of 368 children; efforts to locate them were continuing.  OIG also reported, and 
subsequent court filings confirmed, that children for various reasons continued to be separated by DHS 
from their parents, perhaps because of a parents criminal history.  However, ORR did not always receive 
adequate information about the parents of separated children.165  The lack of complete and accurate data 
about separated children complicates HHSs ability to ensure appropriate placement.  These factors may 
cause children to spend more time in HHS custody.  Issues related to identifying and vetting appropriate 
sponsors may also prolong childrens time in HHS care facilities.  OIG also found failures in conducting 
required staff background checks and insufficient clinical staff to serve childrens mental health needs,166 
lack  of  oversight  over  facilities  use  of  inspection  checklists  to  ensure  security  measures,167  and 
shortcomings in incident reporting systems to protect childrens safety.168 
The Department must work to ensure that UC Program-funded facilities meet all safety requirements, 
including new infection control priorities related to COVID-19, and provide adequate medical and mental 
health care.  As discussed further below, HHS must also enhance efforts to ensure that all staff with access 
to children have passed required background checks.   
Preventing abuse and neglect 
HHS funds and oversees many types of services for a broad range of beneficiaries.  Thousands of HHS-funded 
providers hold positions of trust that bring them into close contact with beneficiaries, often behind closed doors and 
at especially vulnerable times in the beneficiaries lives.  The vast majority of providers seek to serve beneficiaries 
best interests.  However, some providers may cause beneficiaries harm, and HHS must protect its beneficiaries from 
abuse and neglect.  For example, a former IHS pediatrician is currently serving a prison sentence for sexually 
assaulting boys he treated as patients.  This disturbing case commanded extensive attention, and the Department 
committed to collaborating with a Presidential Task Force on Protecting Native American Children in the IHS system 
established in March 2019.169  The task force released a report in July 2020 detailing its investigation of institutional 
and systemic breakdowns that failed to protect children from abuse.170  (See TMC 6 regarding protecting IHS 
patients.)  Better attention to protecting vulnerable beneficiaries of all ages in all HHS care settings is also needed.  
Vetting providers and staff 
Although even the most thorough vetting cannot completely prevent all potential predators from abusing 
Federal programs to gain access to victims, background checks are a useful tool.  OIG identified failure to 
conduct required background checks for UC facility staff whose jobs entail access to children.171  OIG is 
currently reviewing whether the UC Programs Influx Care Facilities and Emergency Intake Sites, which are 
29 
   
not  State-licensed,  conduct  required  background  checks 
before employees are hired and implement mitigation strategies to 
ensure the safety and well-being of children if ORR permitted employees 
to have direct access to children before background checks were completed.172  
Failure to conduct adequate background checks has been a problem in other HHS-
funded child care programs as well.  In several audits, OIG found that some States have not 
fully implemented CCDF requirements to conduct comprehensive criminal background checks on 
current and prospective staff.173  Additionally, some IHS-funded, Tribe-run health centers failed to 
conduct  required  background  checks  on  employees  working  with  American  Indian  children.174  
Implementation of background checks for long-term care providers remains a challenge as well.175  Along 
with demonstrating job-specific competency and qualifications, ensuring that staff pass all required 
background checks is an important safety measure. 
The Department should improve efforts to ensure staff pass required background checks before they have 
access to patients in various health care settings and to children in the UC Program, Head Start, and CCDF-
funded programs.  The Department is also working to support States implementation of the CCDF 
background check requirements.  The Department should continue to work with States to ensure that 
implementation  of  the  Child  Care  and  Development  Block  Grant  Act  of  2014  background  check 
requirements align with the statutorily required effective dates and the allowable timelines described in 
the CCDF Final Rule. 
Identifying and reporting abuse and neglect 
Beneficiaries in all care settings are at risk of abuse and neglect.  Home and community-based services allow 
many Medicaid beneficiaries the opportunity to avoid undesired facility care.  However, some beneficiaries 
have been abused or neglected by individuals such as family members who were paid by Federal health 
care programs to care for the beneficiary at home.  Group homes provide care to many especially vulnerable 
people, including adults with developmental disabilities.  OIGs work found extensive failures in the proper 
handling of critical incidents, including the suspected abuse and neglect of group home residents.176  About 
1.8 million Medicare beneficiaries receive care in SNFs each year.177  OIG has identified substantial failures 
to report incidents of potential abuse or neglect of Medicare beneficiaries living in SNFs who require 
treatment in hospital emergency departments.178  In addition, OIG work identified cases of potential abuse 
of Medicare beneficiaries in hospice care and that hospices failed to act in some instances.179  These cases 
reveal vulnerabilities in beneficiary protections that CMS must address to better ensure that beneficiary 
harm is identified, reported, addressed, and ultimately prevented.  All States have enacted mandatory 
reporting laws that require certain individuals such as school teachers or nursing home staff to report 
suspected abuse or neglect targeting vulnerable individuals.  However, many instances of abuse and neglect 
go unreported, making it harder to help victims and hold wrongdoers accountable.180  During the ongoing 
COVID-19 pandemic, as many students did not attend school in person and many patients were unable to 
receive visitors, ensuring well-functioning processes that identify and report abuse is particularly important.  
Continued oversight and contact with family and friends can be particularly important to ensure quality 
care in nursing homes.  OIG is reviewing continuity of on-site oversight by CMS and State Survey Agencies 
during the pandemic.  Also, CMS has issued guidance to help nursing homes resume in-person visitation 
while minimizing the risk of COVID-19 transmission.   
The Department has created several resources to better address the abuse and neglect of residents in group 
homes.  These resources include model practices for: (1) State incident management and investigation; (2) 
30 
   
State incident management audits; (3) State mortality reviews; 
and (4) State quality assurance.181  OIG is committed to promoting the 
continued adoption of model practices to improve critical incident reporting 
systems. 
It is important to prevent harm by identifying providers and facilities that are subjecting 
beneficiaries to abuse or neglect.  States and other partners should use claims data to better 
identify unreported abuse and neglect.  OIG created a resource guide to help accomplish this goal.182  
OIG has also explored Medicaid claims data as an additional way to identity potential child abuse and 
neglect.183  Additional efforts would help to improve reporting.  For example, CMS should compile a list of 
diagnosis codes that indicate potential abuse or neglect, conduct periodic data extracts, and encourage 
States to better use data to facilitate compliance with mandatory reporting laws.   
CMS should also work to ensure that Federal mandatory reporting laws sufficiently protect beneficiaries in 
all care settings and are adequately enforced.  Protecting beneficiaries from abuse and neglect is a critical 
responsibility requiring attention and cooperation from all stakeholders.  
   
31 
   
5: Harnessing and 
Protecting Data to Improve 
the Health and Well-Being of 
Individuals 
The Department continues to improve how it collects, manages, 
KEY TAKEAWAYS  
shares, and secures its data.  Yet, HHS faces significant challenges to 
both protect data from persistent cybersecurity threats and improve 
I.  Relevant Agency: All HHS  
how the Department and related entities share an increasingly large 
II.  Elements of the Challenge:  
amount of critical data, including public health data.  The demands of 
  Expanding HHS's capacity to use and 
these dual challenges have been made readily apparent during the 
share data to support evidence-based 
pandemic.  Responding to COVID-19 has required HHS to collect and 
policymaking, program management 
report a wide range of data on an unprecedented scale.  At the same 
and program improvement    
time, large-scale cybersecurity attacks such as the SolarWinds hack 
  Providing data to HHS partners and 
demonstrated the need to improve cybersecurity governmentwide.  
promoting public data access and 
HHS will need to apply lessons learned during its pandemic response 
sharing  
in  order  to  sustain  and  accelerate  its  efforts  to  get  the  right 
  Protecting data from misuse or 
information to the right people at the right time.    
unlawful disclosure  
HHSs capabilities to operationalize and change how it uses, shares, 
and protects data for the COVID-19 response was in part aligned with the focus HHS had placed on modernizing its 
data practices across the Department.184  The pandemic accelerated that need, and the Department built new 
systems intended to improve and centralize some data functions to support the COVID-19 response including HHS 
Protecta platform for the authentication, amalgamation, and sharing of health care information.185  Standing up 
and collecting data via HHS Protect presented initial difficulties related to the scalability, veracity, and security of the 
data critical for COVID-19 response and recovery.  According to hospitals, changing reporting requirements and 
systems added to the frustration and burden of health care providers in the midst of the pandemic.186  Continued 
modernization of HHS data practices is needed for HHS and its OpDivs to fulfill their missions, especially to prepare 
for future public health threats.  All of this must happen as the Department continues to respond to COVID-19 and 
while the quantity, frequency, and sophistication of cybersecurity risks to HHS increases rapidly.   
HHSs authorities shape how an individuals data are used and protected by other private and public entities.  These 
authorities are increasingly important in a technology-enriched health and human services delivery system.  HHS 
made progress, but COVID-19 has presented a new challenge by amplifying demand for easier access to data.  While 
many health care providers, State and local governments, and others switched to remote and virtual interactions to 
slow the spread of COVID-19, the need to continue to improve data interoperability and security was evident.  At 
the same time, the health care industry and related private sector entities have faced persistent and systemic 
cybersecurity challenges, particularly ransomware attacks.   
The response to COVID-19 also highlighted HHSs need to focus on racial and geographical disparities within 
programs.  These disparities warrant further scrutiny of how data is collected and used in health care settings under 
32 
   
HHSs jurisdiction to ensure equitable access and care for beneficiaries.  
Improved and appropriate data collection and access can provide key support 
for efforts addressing systemic disparities.  HHS will need to sustain efforts to ensure 
that early progress turns into lasting structural improvement across the health and human 
service systems.  (See TMC 6 for more information on reducing health disparities.)    
Expanding HHSs capacity to use and share data to support evidence-based policy 
making, management, and program improvement    
Data are central role to every HHS program.187  HHS operations depend on the effective collection, use, and exchange 
of a large amount of sensitive and important data about individuals, health care providers, key public health assets, 
regulated industry, and other entities and actors.  The Department and its programs are increasingly able to collect, 
store, and analyze data from disparate sources and provide new pathways within HHS to improve access to data.  
However, having large amounts of data does not mean that the data can be used efficiently and effectively.  HHS 
faces challenges in how it manages and leverages data across its programs.  Although most OpDivs primarily collect 
data to administer their own programs, the use of data across programs and OpDivs remains a challenge.  Data are 
often housed within a single OpDivs data silo and not easily shared with other parts of HHS, even though OpDiv 
missions often overlap.188  Data silos also impede data sharing within OpDivs. 
The effect of these data silos was seen during the response to the pandemic, limiting how HHS and its partners 
gained insight about COVID-19.189  In January 2021, President Biden issued an Executive Order on Ensuring a Data-
Driven Response to COVID-19 and Future High-Consequence Public Health Threats.190  The Executive Order 
highlighted the need to advance innovation in public health data and analytics, enhance data collection and 
collaboration capabilities for high-consequence, public health threats, and build a better public health infrastructure.  
Achieving a mature public health reporting system that can respond to future public health threats requires 
extensive collaboration among Federal, State, local, and Tribal entities.  It requires interoperability and security 
across a range of systems to allow for the exchange of data in a timely fashion and data collection that is accurate, 
timely, and efficient in order to track and thwart emerging health threats.  Similarly, through OGA the Department 
must continue to engage with international stakeholders to ensure that the public health reporting system can 
support international response and coordination.   
Data silos may also impede deployment of emerging technologies, such as machine learning, that have enormous 
potential to improve the efficiency and effectiveness of the Department.  These technologies often depend on large, 
standardized data sets and will require collaboration across the Department.  Eliminating or reducing data silos 
within the Department and increasing appropriate access across programs will be an essential step for improving 
program management and evidence-based decisionmaking, as well as laying the groundwork for HHS to benefit from 
emerging technologies.  For example, the CDC Data Modernization Initiative (DMI) includes plans to deploy next-
generation tools to improve public health surveillance.191  To effectively develop, deploy, and use those tools, HHS 
will have to rely on representative data from across its programs, which will require complex technical coordination 
among diverse types of data, some of which have technical limitations.   
Improving data governance to enhance program management  
One critical step for improving HHSs capacity to utilize its data is the adoption of a better data governance 
approach.  Effective data governance can improve communication and transparency by making data more 
available and useable.  However, data governance practices are not consistent across HHS.  The need to 
improve data governance is not unique to the Department and is a priority and a requirement for all Federal 
33 
   
agencies.192    Although  progress  has  been  promising,  the 
Departments  challenge  will  be  to  operationalize  its  plans 
notwithstanding the continued effect of data silos, restrictions related to 
the privacy and use of certain data, and legacy technology and data systems that 
do not easily support data sharing.  HHS must ensure any progress it makes on 
improving governance of its internally generated data must also apply to data that are 
generated by external entities but that are received and managed by the Department.  This 
challenge will play a significant role as CDC moves forward with its DMI and especially its newly launched 
initiativethe Pandemic Ready Interoperability Modernization Effort.193  This new, multiyear collaboration 
with the U.S. Digital Service is designed to automate data, improve public health reporting, and develop a 
flexible, cloud-based infrastructure that will improve public health data quality and IT systems.  As this and 
other efforts move forward, HHS should learn from previous projects that encountered complex data 
collection and reporting issues in other HHS programs.   
For example, OIG has raised concerns about the completeness and quality of data submissions by States for 
the national Medicaid data set, T-MSIS.194  CMSs recent progress related to T-MSIS may be helpful in 
providing lessons learned.  Nearly all State Medicaid programs now report data directly to T-MSIS, and CMS 
has worked with States to improve the quality of data submissions and release T-MSIS data to researchers.  
Based on this progress, CMS is able to use T-MSIS to provide programmatic insights, including insight about 
COVID-19  treatment  and  testing  and  how  the  public  health  emergency  affected  Medicaid  service 
utilization.195  CMS also publishes data quality information related to several data categories in T-MSIS 
through its DQ Atlas web application.196  The DQ Atlas and other reviews indicate that there are still issues 
with the completeness and reliability of some T-MSIS data.  CMS has issued guidance to States to improve 
T-MSIS reporting of certain variables including the collection of race, ethnicity, and social determinants of 
health data.  But additional guidance and testing is needed.197  (See also TMC 3 regarding data for new care 
models.)  And OIGs recent analysis of Medicaid managed care payments illustrates that most States did 
not provide complete or accurate data in T-MSIS about managed care plan payments to providers.198  It will 
be important for HHS to proactively address similar data quality and governance challenges as HHS 
modernizes how it collects and uses external data from grantees or other organizations.199     
Although much of HHSs data are publicly available, some may not be easy to use.  Or there may be other 
barriers such as a lack of standardization that limit stakeholders and the publics access or use of the 
data.200  Those barriers present a challenge to providing increased access to HHS data that are vital for 
public health and welfare and that could lead to innovation and improvement in health and human service 
systems.  Many HHS external stakeholders rely on effective dissemination of data collected by departmental 
programs.  Much of HHSs data are publicly available but may not be well understood or in easily accessed 
formats.  For example, currently, most public access to HHS data does not use contemporary approaches, 
such as the use of application programming interfaces (APIs).  OpDivs are planning and have made some 
progress to expand access to these important assets.  In May 2020, NIH made beta access available to its 
All of Us Researcher Workbench.201  In its first year of allowing beta access to its workbench for more than 
800 researchers and more than 570 research projects, NIH has added new types of data including wearables 
and results from the COVID-19 Participant Experience Survey.  NIH has also brought together 16 types of 
EHRs from more than 50 data providers and has continued to improve the research tools that can be used 
by researchers in the All of Us workbench.202  In September 2019, FDA released a Technology Modernization 
Action Plan.203  Among other goals, FDA aims to improve how it uses data and technology to carry out its 
mission and improve communication and collaboration with other government and external stakeholders.  
34 
   
FDA has also made progress related to its New Era for Smarter 
Food  Safety  by,  for  example,  prioritizing  technology-enabled 
traceability.204 These approaches and plans must be replicated across HHS 
to remove barriers to other HHS program data and allow HHS partners to more 
effectively use that data.    
Making data sharing between health care providers, patients, and payers commonplace   
Several OpDivs have authority or influence to shape how data are shared within the industries they 
regulate, among HHS partners, and with individuals and patients.  Most notable is HHSs potential to 
improve the availability and interoperability of electronic health information.  Yet the health care system 
and patients in general have not fully realized and benefited from modern approaches to improve the 
appropriate flow of electronic health information.  As part of HHSs Information Technology Strategic Plan, 
two key goals are aimed at improving health information exchange: enhance data and interoperability, and 
improve IT management and governance.205  Although work continues to improve upon the capabilities 
that enable this effort and there are signs of recent progress, routine and robust health information 
exchange  between  providers  remains  a  challenge.206    In  2019,  55  percent  of  acute-care  hospitals 
electronically performed all four interoperability functions, which are to find patient health information and 
send, receive, and integrate patient summary-of-care records from sources outside health systems.207  This 
is up from 23 percent of hospitals in 2014.  Among the interoperability functions, the largest increase was 
in hospitals that can integrate data, rising from 40 percent to 71 percent over the same timeframe.208   
Interoperability of EHRs also plays a crucial role in providing data for the response to COVID-19 and could 
be key to public health modernization efforts.  HHS and other entities are exploring how best to use 
electronic case reporting (eCR), which is the automated generation and transmission of case reports from 
health care providers EHRs to public health agencies.  CDC is leading the project called eCR Now, which is 
designed to rapidly deploy eCR operations through the use Fast Healthcare Interoperability Resources APIs 
to meet the demands of public health reporting.  As of July 2021, more than 9,200 facilities were actively 
sending COVID-19 case reports at multiple jurisdictions at the same time.209      
Improvement in the way patients and providers can access, use, and exchange electronic health information 
continues largely in response to HHS regulatory action taken in 2020.  Office of the National Coordinator 
for Health Information Technology (ONC) and CMS regulations related to interoperability, data standards, 
and data exchange mechanisms continue to shape industry progress as health care providers, health IT 
developers, and others operationalize the requirements, such as use of standard, open APIs.210  Still, the 
health care industry faces some fundamental issues that hinder widespread interoperability.  For example, 
ONC continues its efforts to improve the ability to match patient data across health IT, and in late 2020 
began a new initiative to standardize how patient addresses are included in their electronic health 
records.211  The challenge for HHS will be translating these authorities and other initiatives into more 
widespread improvements across the health care industry.  This will require further engagement to ensure 
progress is not limited to those health care entities with resources to implement modern technologies and 
data practices.   
Combating persistent, emerging cyberthreats and protecting data 
The risk of cybersecurity attacks that threaten the confidentiality, integrity, and availability of government-held data 
are persistent and growing.  For example, the recent rise in ransomware attacks is a major challenge.  Overall 
ransomware is up more than 150 percent in North America as a result of a confluence of factors including an increase 
35 
   
in the use of hard-to-trace cryptocurrencies, ransomware-as-a-service, 
and successful ransomware operations through which cybercriminals are 
paid.212  Although ransomware risks are not unique to HHS, overall the Department 
and the Federal Government have been targeted by increasingly complex cybersecurity 
attacks that seek to exploit a range of vulnerabilities that exist across Government agencies.   
In response to growing cybersecurity threats to Government operations, the Administration has made 
improving the cybersecurity of the Federal Government a top priority.  In the May 2021 Executive Order 
Improving the Nations Cybersecurity, the President directed Federal agencies to fundamentally and systemically 
change the approach to cybersecurity that crosses Departments and industries and that will require significant 
investments of resources and cultural and organizational change.213  The Executive Order will likely require HHS to 
reorient how its OpDivs and StaffDivs carry out the increasingly complex task of managing and implementing 
cybersecurity safeguards across a range of entities.  In response, the Department will likely need to undertake a 
multiyear effort in coordination with other Federal agencies to assess and change its approach to cybersecurity, such 
as continuing efforts to reduce the several aspects of cybersecurity that remain siloed within OpDivs and StaffDivs.  
This effort will need to begin even as cyberthreats to HHS remain elevated, as adversaries attempt to take advantage 
of the public health emergency to infiltrate HHS systems or impede their performance.   
Many HHS partners and granteesand the health care system at largeare similarly subject to increases in 
cyberattacks.  Consistent with cybersecurity advisory warnings, the potential for an increased and imminent threat 
of cybercrime in the form of ransomware to hospitals and other health care providers was realized as an increasing 
number of hospitals and other providers were victims of ransomware, with nearly 34 percent of health care 
organizations reported being hit by ransomware.214  Public confidence in the health care sectors and HHSs ability 
to protect crucial public health data or sensitive, personal health data is important for the success of Federal 
initiatives that seek to leverage technology to create future medical treatments.  OIG is continuing to conduct work 
addressing cybersecurity in HHS programs. 
Cybersecurity challenges in a federated environment  
Although the Department continues to improve its overall cybersecurity posture, OIG and GAO audits 
have identified challenges and systemic weaknesses.215  One persistent challenge that underpins a 
number of cybersecurity issues is the federated nature of IT and cybersecurity environments across HHS.  
For example, 24 of NIHs 28 entities receive individual funding from Congress and administer their own 
budgets.  Each NIH entity designates its own chief information officer (CIO) who coordinates with the NIH 
CIO.  This type of environment poses challenges in managing and responding to cybersecurity threats 
across distinct entities.  Most OpDivs are stewards of sensitive personal information and are required to 
protect such information from improper disclosure, including by external entities.  Given the size, 
complexity, and constant use of this data, OpDivs face challenges in ensuring that third parties access this 
information for legitimate purposes.  For example, OIG investigations of health care fraud often involve 
criminals that use valid credentials to access systems with program beneficiary information for illicit 
purposes, such as identify theft.  
To ensure cybersecurity governance is effective across HHS, the Department has instituted policies and 
procedures; however, it has limited capabilities to assess compliance with, implementation of, and 
effectiveness of its policies and procedures within OpDivs and StaffDivs.  Progress is being made to 
improve HHS-wide insights into cybersecurity.  For example, the HHS Computer Security Incident 
Response Center and the Health Sector Cybersecurity Coordination Center (HC3) serve as central points of 
contact for incident reporting, information sharing, and cyber-data repositories.216  As HHS implements 
36 
   
the cybersecurity Executive Order and enhances the 
governance, capabilities, and awareness of both of these entities, 
HHSs overall cyber hygiene should continue to improve.        
 
In addition to cybersecurity, other threats to HHS programs and grantees put the 
integrity of information and data at risk.  HHS is responsible for scientific development, 
integrity, and security at NIH.  Foreign entities seek to gain medical research and intellectual 
property developed by the Federal government to further their economic and research goals or 
disrupt the normal functioning of the Department.  Taxpayer-funded medical research is being targeted 
by foreign adversaries.  While these risks are complex and affect many aspects of U.S. national interests, 
HHS- and NIH-funded research and grantees continue to be targeted.  OIG work has identified several 
issues that NIH can address to improve its safeguards, and NIH is making progress by, for example, 
working with the HHS Office of National Security.217  However, NIH must continue to strengthen its 
safeguards against foreign influence by updating its policies and procedures while advancing its 
technological capabilities to assess, identify, and respond to foreign threats. 
Promoting the security and privacy of the health care system 
HHSs responsibilities for ensuring cybersecurity also extend to the health care system.  The strength of the 
health care systems cybersecurity defenses continues to be tested as cyberthreats increase during the 
COVID-19 pandemic.  Additionally, many health care providers rapidly shifted care to telehealth and other 
remote technology and thus provided additional openings for possible attacks.  Sustained utilization of 
telehealth may pose new cybersecurity challenges because health care entities remain primary targets, and 
health care data are reportedly among the most valuable data for cybercriminals.  In addition to data and 
identity theft, cyberthreats can also pose safety risks by causing outages of systems needed for patient care 
or exploiting vulnerabilities in the growing number of connected medical devices and other medical 
equipment involved in direct patient care.  To ensure these areas of focus are not vulnerable and remain 
effective, HHS will need to work with the health care industry to improve cybersecurity by, for example, 
ensuring contingency plans are updated and tested to cover telehealth.  
The Department has made some progress to bolster cybersecurity in the health care industry.  Since 2019, 
HC3 has issued many products aimed at educating the health care industry on specific threats, mitigation 
efforts, and other educational materials.  The products describe trends and new cybersecurity threats 
designed to take advantage of the COVID-19 pandemic.218  The Department also plays a significant role in 
ensuring the privacy of sensitive individual data, such as personal health information, genetic information, 
and more.  Most notably, OCR established and enforces the Health Insurance Portability and Accountability 
Act of 1996 (HIPAA) Privacy Rules requirements.  However, the bulk of the Privacy Rules requirements 
were established nearly 20 years ago and may not adequately address modern issues related to privacy 
concerns about the use and disclosure of protected health information.  Some of the limitations associated 
with HIPAA were highlighted as the health care industry responded to COVID-19.  In response, OCR took 
several actions including exercising its enforcement discretion to support greater flexibilities for the types 
of technology used for telehealth and issuing guidance about sharing patient health information on COVID-
19 to emergency first responders.219  OCRs response to COVID-19 foreshadows the need for potential 
future actions to address privacy issues as the health care industry continues to modernize.  As health care 
providers and patients shift to using more telehealth, remote-based care, and emerging technologies, new 
challenges related to the privacy and security of patient health information will arise.  The Departments 
challenge is to keep up with changes in the health care industry and with nontraditional health care entities 
that may impact patient privacy.   
37 
   
   
 
6: Improving Collaboration to 
Better Serve Our Nation  
HHS faces some of the largest and most complex issues confronting 
our  Government  and  the  Nation.    These  problems  commonly  KEY TAKEAWAYS 
transcend a single HHS program.  Often HHS's mission is only one 
I.  Relevant Agency: All HHS  
piece  in  a  larger  puzzle  of  overlapping  and  coordinating 
II.  Elements of the Challenge:  
responsibilities.  To achieve its mission, HHS needs to collaborate 
  Combating COVID-19  
effectively across HHS programs and with other Federal agencies as 
  Reducing health disparities 
well as outside the Federal government including with Tribal, State 
and local governments, international entities, industry, and other    Turning the tide on the opioid 
stakeholders.     crisis 
  Protecting children 
Improving HHSs collaboration can help Americans receive more    Keeping patients safe 
efficient, higher-quality health and human services and benefit from 
greater advances in the sciences underlying them.  Cross-agency efforts led by the Department such as the 
Secretarys Intradepartmental Council on Native American Affairs and the Behavioral Health Coordinating Council, 
along with those related to Department management and data, provide opportunities for HHS programs to work 
more efficiently and in greater alignment.  Effective partnerships with other Federal agencies help ensure that critical 
initiatives  and  resources,  such  as  those  for  emergency  preparedness  and  response  and  law  enforcement 
investigations, are working in concert.  Established networks of information exchange, such as through the 
Secretarys Tribal Advisory Committee, can better allow HHS programs to reflect community needs.  Effective 
collaboration with HHSs vast array of nongovernmental stakeholdersfrom health care practitioners to food and 
drug manufacturers, health systems, nursing homes, hospices, professional associations, scientists, consumers, and 
community nonprofits, just to name a fewis essential to delivering the best services and care to the American 
people and supporting HHS programs in achieving their intended outcomes.   
The need for collaboration crosses many of the programs and challenges discussed in other TMCs, highlighting the 
broad and complex nature of HHSs work.  To run effective and efficient programs, HHS must consider issues and 
impacts outside a single program or mission for any one of its agencies.  For example, the importance of data access 
and sharing across stakeholders is discussed in TMC 5. 
Barriers to HHS collaboration include navigating a wide breadth of stakeholders with different goals and authorities, 
the scope and complexity of the problems for which HHS needs partnerships to resolve, and the ever-changing 
landscape of the health and human services sectors.  Overcoming these barriers requires HHS to engage in 
intentional and sustained efforts toward building effective partnerships both domestically and internationally, 
communicating effectively, managing collaborative work, and maintaining accountability.  Recent OIG work reveals 
the importance of effective and collaborative management within HHS and with HHSs partners, and areas for 
improvement.     
38 
   
Combating COVID-19  
The unprecedented nature of the COVID-19 pandemic underscores the critical 
importance of effective coordination in emergency preparedness and response.  From 
the onset of the pandemic, various stakeholders were quickly called upon to collaborate on a 
myriad of efforts including those related to temporary emergency expansions, distributing Federal 
funds, managing health care programs, nursing home safety, vaccine development and distribution, 
testing, personal protective equipment (PPE) and respirator availability from the national stockpile, and public 
health guidance.   
An OIG survey of hospitals responding to COVID-19 that was conducted in late March 2020 found that changing and 
sometimes inconsistent guidance from Federal, State, and local authorities on issues such as testing, use of PPE, and 
obtaining supplies from the national stockpile posed challenges for hospitals and the public.220  In a follow-up survey 
conducted in March 2021, hospitals reported receiving varying information from different levels of government 
about who was eligible to receive the COVID-19 vaccine and when they were eligible.221  Federal, State, and local 
governments had prioritized different population groups to receive vaccines and hospitals reported that these 
differences in priorities complicated eligibility determinations, which meant the process could be time-consuming 
and resource-intensive.  Reports from OIG related to coordination in past emergencies found Federal agencies can 
reduce burdens on States and other stakeholders by consolidating outgoing communication and requests for data 
or information, and that clearly defined roles can ensure that staff are not working at cross-purposes.222,223   
The Department has taken steps to address challenges to emergency coordination efforts.  Related to cross-agency 
coordination, ASPR, CDC, and CMS implemented a joint OIG recommendation in 2020 to continue to help hospitals 
sustain preparedness for emerging infectious diseases (EID) by coordinating guidance and providing practical advice 
for all hospitals.224  These agencies have taken actions to update EID preparedness guidance to ensure that it is clear 
and concise, develop strategies for updating information about EID threats, and provide practical advice that 
hospitals can easily employ.  These efforts continued during the COVID-19 response. 
Reducing health disparities 
The disparate impacts of the COVID-19 pandemic on various racial and ethnic groups have brought health equity 
concerns to the forefront.  Health disparities are differences in health that adversely affect certain groups.  People 
of color have been found to experience disparities in areas such as access to care and quality of care.225  Such 
disparities have profound implications for the health and well-being of these individuals.   
The COVID-19 Health Equity Task Force was established by Executive Order 13995, Ensuring an Equitable Pandemic 
Response and Recovery, which was issued on January 21, 2021.226  The task force is part of a government-wide effort 
to identify and eliminate health and social disparities that result in disproportionately higher rates of exposure, 
illness, hospitalization and death related to COVID-19.  In addition to HHS, five additional Federal agencies are 
represented  on  the  task  force  including  the  Departments  of  Agriculture,  Education,  Housing  and  Urban 
Development, Justice, and Labor.  The task force's mission is to provide specific recommendations to the President 
for mitigating inequities caused or exacerbated by the COVID-19 pandemic and for preventing such inequities in the 
future.   
One of the COVID-19 Health Equity Task Forces interim recommendations is to create data transparency related to 
the demographics of those receiving therapeutics and providing public health intervention funding to address 
barriers to care.  OIG has work assessing HHS efforts to collect and analyze data on disparities to address the COVID-
19 pandemic as well as, more broadly, to identify and mitigate health disparities.  In an evaluation of Medicare claims 
39 
   
data that analyzed differences by beneficiary characteristics including 
race and ethnicity, OIG found that Black, Hispanic, and Asian Medicare 
residents of nursing facilities had higher rates of COVID-19 diagnoses than White 
Medicare residents.227  Ensuring that Medicare is able to assess disparities is key to 
improving overall health, advancing health equity, and reducing overall health care costs.  The 
ability to assess disparities hinges on the quality of the underlying race and ethnicity data.  (See TMC 
5 for more information on improving data related to health disparities.) 
Addressing the opioid crisis 
The COVID-19 pandemic has further challenged HHS efforts to achieve its goal of reducing opioid morbidity and 
mortality.  The pandemic may be exacerbating the Nations opioid epidemic and individuals with an OUD may be at 
greater risk for COVID-19.228  (See TMC 1).  A number of OpDivs within HHS and other Federal agencies play a role in 
addressing opioid abuse and misuse, and coordination among them and other partners is vital to turn the tide on 
this crisis.  State sharing of PDMP data, for example, may help to improve safe prescribing practices and prevent 
prescription drug abuse and misuse.229  Better collaboration is a key step in helping reduce geographic disparities in 
access to medication to treat OUD.  Improved stakeholder communication may also help make medication to treat 
OUD more available through better data collection and expand the use of data to measure performance.230   
Protecting children 
HHS faces substantial continued challenges in coordinating with respect to the Unaccompanied Children Program.  
(See TMC 4 for program background.)  In a review of challenges that HHS faced in responding to the zero-tolerance 
policy  and  reunifying  separated  children  with  their  parents,231  OIG  identified  shortfalls  in  internal  HHS 
communication, collaboration across Federal agencies, and outreach to critical stakeholders.  These challenges 
impeded HHS in protecting children in its custody.  In the Department, key senior HHS officials did not act on the 
OpDiv staff's repeated warnings that family separations were occurring and might increase, which impeded the 
Departments ability to provide prompt and appropriate care for separated children when the zero-tolerance policy 
was implemented.  For example, HHS could not always place separated children in HHS-funded care provider 
facilities in a timely manner due to the lack of sufficient bed capacity.   
Problems with interagency coordination also limited the Departments ability to plan for the care of children in its 
custody.  For instance, information was not effectively shared in advance of the zero-tolerance policy, despite 
existing channels to facilitate high-level interagency coordination and engagement on important immigration 
issues.232  Furthermore, HHS and DHS did not collaborate on systems for tracking separated families across agencies 
for later reunification, leaving HHS to struggle to identify separated children and reunite them with their parents.  
Additionally, poorly communicated guidance from HHS complicated care provider facilities ability to care for 
children separated from their parents.   
HHS oversees numerous other programs that provide direct services to children.  Program funding may pass from 
the Federal government to States and then to local implementing entities that provide services such as foster care 
and child care.  OIG audits of State compliance with employee background checks and other health and safety 
requirements in HHS programs found lapses that can put children at risk,233, 234 supporting the need for better 
coordination between HHS and States to keep children safe.  (See TMC 4 for more information on keeping children 
safe.)   
40 
   
Keeping patients safe 
Health care and mental health care providers, as well as providers furnishing OUD 
treatment, hospice, and nursing home services are among those on the frontline of 
ensuring safety for beneficiaries receiving care through HHS programs and at HHS facilities.  
OIG reports have identified issues with HHS oversight of, coordination with, and outreach to 
external partners that may leave patients at risk of harm.  These include a series of reports finding 
deficiencies  in  State  agency  oversight  of  nursing  homes  compliance  with  life  safety  and  emergency 
preparedness requirements.235 (See TMC 4 regarding patient safety.) 
Recent cases of patient abuse by IHS employees have raised concerns about protecting the American Indian/Alaska 
Native population.  The convictions of a former IHS pediatrician in September 2018 and 2019 brought attention to 
the issue and shed light on areas requiring improvement within IHS.236, 237  An OIG memorandum to IHS on past and 
ongoing OIG audits reported that Tribal health programs that received Indian Self-Determination and Education 
Assistance Act funds from the IHS were not conducting required Federal Bureau of Investigation fingerprint 
background checks for all employees, contractors, and volunteers who have regular contact with Indian children.238  
This increases the risk that an individual in one State with a disqualifying criminal history in a different State could 
be hired into a position that involves regular contact with Indian children. 
In response to OIGs memorandum, IHS issued a letter to Tribal leaders identifying the need for immediate action 
and steps toward a collaborative response to address this vulnerability, which may compromise the safety and well-
being of Indian children who receive treatment at IHS-funded Tribal health programs.239  It is imperative that HHS 
ensure that both IHS and Tribe-operated health facilities meet Federal requirements for background verifications of 
employees, contractors, and volunteers in contact with children served by the facilities, and that health care 
providers treating these children are appropriately licensed. 
By building and sustaining effective partnerships, HHS can better safeguard and improve the programs so crucial to 
the health and well-being of the Nation.  
 
 
41 
   
ENDNOTES 
 
1 CDC, COVID Data Tracker.  Available at https://covid.cdc.gov/covid-data-tracker/#cases_totalcases.   
 
2 OIG, COVID-19 Had a Devastating Impact on Medicare Beneficiaries in Nursing Homes During 2020, OEI-02-20-00490, 
June 2021.  Available at https://oig.hhs.gov/oei/reports/OEI-02-20-00490.asp. 
 
3 Ibid. 
 
4 Office of the Assistant Secretary for Planning and Evaluation, Health Disparities by Race and Ethnicity during the COVID-19 
Pandemic: Current Evidence and Policy Approaches.  Available at https://aspe.hhs.gov/reports/health-disparities-race-ethnicity-
during-covid-19-pandemic-current-evidence-policy-approaches.  
 
5 CDC National Center for Health Statistics (NCHS), Vital Statistics Rapid Release: Provisional Life Expectancy Estimates for 2020.  
Available at https://www.cdc.gov/nchs/data/vsrr/vsrr015-508.pdf.  
 
6 OIG, The Substance Abuse and Mental Health Services Administration Generally Had Controls and Strategies for Mitigating 
Disaster Preparedness and Response Risks, A-04-20-02026, May 2021.  Available at 
https://oig.hhs.gov/oas/reports/region4/42002026.asp.  
 
7 117th Congress (2021-22), H.R.1319 - American Rescue Plan Act of 2021.  Available at https://www.congress.gov/bill/117th-
congress/house-bill/1319/text.  
 
8 OIG, HHS Did Not Always Efficiently Plan and Coordinate Its International Ebola Response Efforts, A-04-16-03567, August 2019.  
Available at https://oig.hhs.gov/oas/reports/region4/41603567.asp.  
 
9 OIG, Hospitals Reported That the COVID-19 Pandemic Has Significantly Strained Health Care Delivery, OEI-09-21-00140, March 
2021.  Available at https://oig.hhs.gov/oei/reports/OEI-09-21-00140.asp.  
 
10 OIG, Toolkit: Insights for Health Care Facilities From OIGs Historical Work on Emergency Response, August 2020.  Available at 
https://oig.hhs.gov/reports-and-publications/featured-topics/response/toolkit-healthcare.asp . 
 
11 OIG, The Puerto Rico Department of Healths Implementation of Its Emergency Preparedness and Response Activities Before 
and After Hurricane Maria Was Not Effective, A-02-18-02002, July 2021.  Available at 
https://oig.hhs.gov/oas/reports/region2/21802002.asp.  
 
12 OIG, Selected Health Care Coalitions Increased Involvement in Whole Community Preparedness But Face Developmental 
Challenges Following New Requirements in 2017, OEI-04-18-00080, April 2020.  Available at 
https://oig.hhs.gov/oei/reports/oei-04-18-00080.asp.  
 
13 FDA, Fact Sheet: FDA at a Glance.  Available at https://www.fda.gov/about-fda/fda-basics/fact-sheet-fda-glance. 
 
14 FDA, COVID-19 Vaccines: Emergency Use AuthorizationVaccines.  Available at https://www.fda.gov/emergency-
preparedness-and-response/coronavirus-disease-2019-covid-19/covid-19-vaccines#eua-vaccines.  
 
15 OIG, Review of the FDAs Accelerated Approval Pathway.  Available at https://oig.hhs.gov/reports-and-
publications/workplan/summary/wp-summary-0000608.asp.  
 
16 FDA, COVID-19 and Beyond: Oversight of the FDAs Foreign Drug Manufacturing Inspection Process.  Available at 
https://www.fda.gov/news-events/congressional-testimony/covid-19-and-beyond-oversight-fdas-foreign-drug-manufacturing-
inspection-process-06022020.  
 
 
42 
   
 
17 OIG, report in progress Review of the Food and Drug Administration's Foreign Drug Inspection Process, W-00-19-50000.  
Estimated completion date in 2022.  Work Plan item available at https://oig.hhs.gov/reports-and-
publications/workplan/summary/wp-summary-0000380.asp. 
 
18 OIG, OwnershipBut Not Physical Movementof Selected Drugs Can Be Traced Through the Supply Chain, OEI-05-17-00460, 
February 2020.  Available at https://www.oig.hhs.gov/oei/reports/oei-05-17-00460.asp.  
 
19 FDA, Cybersecurity Guidances, August 2020.  Available at https://www.fda.gov/medical-devices/digital-health-center-
excellence/cybersecurity#guidance.  
 
20 OIG, Medicare Lacks Consistent Oversight of Cybersecurity for Networked Medical Devices in Hospitals, OEI-01-20-00220, June 
2021.  Available at  https://oig.hhs.gov/oei/reports/OEI-01-20-00220.asp. 
 
21 OIG, FDA Should Further Integrate Its Review of Cybersecurity Into the Premarket Review Process for Medical Devices, 
OEI-09-16-00220, September 2018.  Available at https://oig.hhs.gov/oei/reports/oei-09-16-00220.asp.  See also OIG, The Food 
and Drug Administrations Policies and Procedures Should Better Address Postmarket Cybersecurity Risk to Medical Devices, A-
18-16-30530, October 2018.  Available at https://oig.hhs.gov/oas/reports/region18/181630530.asp.  
 
22 FDA, What You Need to Know about Foodborne Illnesses.  Available at https://www.fda.gov/food/consumers/what-you-need-
know-about-foodborne-illnesses.  
 
23 FDA, What does FDA regulate?  Available at: https://www.fda.gov/about-fda/fda-basics/what-does-fda-regulate.  
 
24 FDA, New Era of Smarter Food Safety Frequently Asked Questions.  Available at https://www.fda.gov/food/new-era-smarter-
food-safety/new-era-smarter-food-safety-frequently-asked-questions.  
 
25 OIG, Challenges Remain in FDA's Inspections of Domestic Food Facilities, OEI-02-14-00420, September 2017.  Available at 
https://www.oig.hhs.gov/oei/reports/oei-02-14-00420.asp.  See also  OIG, The Food and Drug Administration's Food-Recall 
Process Did Not Always Ensure the Safety of the Nation's Food Supply, A-01-16-01502, December 2017.  Available at 
https://oig.hhs.gov/oas/reports/region1/11601502.asp. 
 
26 FDA, Center for Tobacco Products Overview.  Available at https://www.fda.gov/tobacco-products/about-center-tobacco-
products-ctp/center-tobacco-products-overview.  
 
27 CDC, Tobacco Product Use Among Middle and High School Students  United States, 2020.  Available at 
https://www.cdc.gov/mmwr/volumes/69/wr/mm6950a1.htm  
 
28 OIG, FDAs Tobacco Retailer Compliance Check Inspection Program.  Available at https://oig.hhs.gov/reports-and-
publications/workplan/summary/wp-summary-0000441.asp.   
 
29 CDC, Opioids: Understanding the Epidemic.  Available at https://www.cdc.gov/opioids/basics/epidemic.html. 
  
30 CDC, Mental Health, Substance Use, and Suicidal Ideation During the COVID-19 Pandemic  United States, June 2430, 2020.  
Available at https://www.cdc.gov/mmwr/volumes/69/wr/mm6932a1.htm.  
 
31 CDC, Science Brief: Evidence used to update the list of underlying medical conditions that increase a persons risk of severe 
illness from COVID-19.  Available at https://www.cdc.gov/coronavirus/2019-ncov/science/science-briefs/underlying-evidence-
table.html?CDC_AA_refVal=https%3A%2F%2Fwww.cdc.gov%2Fcoronavirus%2F2019-ncov%2Fhcp%2Fclinical-
care%2Funderlying-evidence-table.html.  
 
32 CDC NCHS, Provisional Drug Overdose Death Counts.  Available at https://www.cdc.gov/nchs/nvss/vsrr/drug-overdose-
data.htm.  
 
33 HHS, Overdose Prevention Strategy.  Available at https://www.hhs.gov/overdose-prevention/. 
 
43 
   
 
34 Executive Office of the President Office of National Drug Control Policy, The Biden-Harris Administrations Statement of Drug 
Policy Priorities for Year One.  Available at https://www.whitehouse.gov/wp-content/uploads/2021/03/BidenHarris-Statement-
of-Drug-Policy-Priorities-April-1.pdf. 
 
35 FDA, Opioid Analgesic Drugs: Considerations for Benefit-Risk Assessment Framework, Guidance for Industry.  Available at 
https://www.fda.gov/media/128150/download.  See also FDA, FDAs 2018 Strategic Policy Roadmap.  Available at 
https://www.fda.gov/media/110587/download.  
 
36 FDA, Opioid Medications.  Available at https://www.fda.gov/drugs/information-drug-class/opioid-medications.  FDA, 
Information about Medication-Assisted Treatment (MAT).  Available at: https://www.fda.gov/drugs/information-drug-
class/information-about-medication-assisted-treatment-mat. 
 
37 OIG, FDAs Risk Evaluation and Mitigation Strategies: Uncertain Effectiveness in Addressing the Opioid Crisis, 
OEI-01-17-00510, September 2020.  Available at https://oig.hhs.gov/oei/reports/OEI-01-17-00510.asp.  
 
38 CDC, Prescription Opioid Overdose Death Maps.  Available at 
https://www.cdc.gov/drugoverdose/deaths/prescription/maps.html.  
 
39 Q.Q. Wang, D.C. Kaelber, R. Xu, et al. COVID-19 risk and outcomes in patients with substance use disorders: analyses from 
electronic health records in the United States. Molecular Psychiatry 26, 3039 (2021). Available at 
https://doi.org/10.1038/s41380-020-00880-7. 
 
40 OIG, Concerns Persist About Opioid Overdoses and Medicare Beneficiaries Access to Treatment and Overdose-Reversal Drugs, 
OEI-02-20-00401, August 2021.  Available at https://oig.hhs.gov/oei/reports/OEI-02-20-00401.pdf. 
 
41 OIG, Few Patients Received High Amounts of Opioids from IHS-Run Pharmacies, OEI-05-18-0-470, December 2020.  Available 
at https://oig.hhs.gov/oei/reports/OEI-05-18-00470.asp.  
 
42 OIG, IHS Needs To Improve Oversight of Its Hospitals' Opioid Prescribing and Dispensing Practices and Consider Centralizing Its 
Information Technology Functions, A-18-17-11400, July 2017.  Available at 
https://oig.hhs.gov/oas/reports/region18/181711400.asp.  
 
43 OIG, Opioids in Medicaid: Concerns About Opioid Use Among Beneficiaries in Six Appalachian States, OEI-05-19-00410, 
December 2020.  Available at https://oig.hhs.gov/oei/reports/OEI-05-19-00410.asp.  
 
44 SAMHSA, Key Substance Use and Mental Health Indicators in the United States: Results from the 2018 National Survey on 
Drug Use and Health, August 2019.  Available at https://www.samhsa.gov/data/sites/default/files/cbhsq-
reports/NSDUHNationalFindingsReport2018/NSDUHNationalFindingsReport2018.pdf.  
 
45 OIG, Opioid Treatment Programs Reported Challenges Encountered During the COVID-19 Pandemic and Actions Taken to 
Address Them, A-09-20-01001, November 2020.  Available at https://www.oig.hhs.gov/oas/reports/region9/92001001.asp.  
 
46 OIG, SAMHSA Is Missing Opportunities To Better Monitor Access to Medication Assisted Treatment Through the Buprenorphine 
Waiver Program, OEI-BL-20-00260, June 2021.  Available at https://oig.hhs.gov/oei/reports/OEI-BL-20-00260.asp.  
47 HHS, HHS Releases New Buprenorphine Practice Guidelines, Expanding Access to Treatment for Opioid Use Disorder. April 
2021. Available at https://www.hhs.gov/about/news/2021/04/27/hhs-releases-new-buprenorphine-practice-guidelines-
expanding-access-to-treatment-for-opioid-use-disorder.html 
 
48 OIG, In Selected States, 67 of 100 Health Centers Did Not Use Their HRSA Access Increases in Mental Health and Substance 
Abuse Services Grant Funding in Accordance With Federal Requirements, A-02-19-02001, November 2020.  Available at 
https://oig.hhs.gov/oas/reports/region2/21902001.asp.  
 
 
44 
   
 
49 USAspending.gov, Agency Profile: Department of Health and Human Services.  Available at 
https://www.usaspending.gov/agency/806.  
 
50 CMS, March 2021 Medicaid & CHIP Enrollment Data Highlights.  Available at https://www.medicaid.gov/medicaid/program-
information/medicaid-and-chip-enrollment-data/report-highlights/index.html.  
 
51 CMS, Fiscal Year 2020 Financial Report.  Available at https://www.cms.gov/files/document/cms-financial-report-fiscal-year-
2020.pdf.  
 
52 CMS, Trustees Report & Trust Funds, August 2021.  Available at https://www.cms.gov/Research-Statistics-Data-and-
Systems/Statistics-Trends-and-Reports/ReportsTrustFunds.  The Medicaid estimate is based on the CMS-64 Financial 
Management Report and reflects net services.  Available at https://www.medicaid.gov/medicaid/financial-management/state-
expenditure-reporting-for-medicaid-chip/expenditure-reports-mbescbes/index.html.  
 
53 CMS, Expenditure Reports From MBES/CBES, Financial Management Report for FY 2020. Available at 
https://www.medicaid.gov/medicaid/financial-management/state-expenditure-reporting-for-medicaid-chip/expenditure-
reports-mbescbes/index.html. 
 
54 CMS, CMS Fast Facts.  Available at https://www.cms.gov/Research-Statistics-Data-and-Systems/Statistics-Trends-and-
Reports/CMS-Fast-Facts. 
 
55 HHS Tracking Accountability in Government Grants System (TAGGS), Grants by OPDIV.  Available at 
https://taggs.hhs.gov/ReportsGrants/GrantsByOPDIV.  
 
56 As of June 14, 2021, HHS awarded $74.6 billion for contractual services and supplies.  See USAspending.gov, Spending 
Explorer: Contractual services and supplies spending.  Available at: https://www.usaspending.gov/explorer/object_class.  
 
57 According to the 2020 Annual Report of the Board of Trustees of the Federal Hospital Insurance and Federal Supplementary 
Medical Insurance Trust Funds, the Trustees stated that the Federal Hospital Insurance Trust Fund is expected to be depleted in 
2026.  See CMS, 2020 Annual Report of the Boards of Trustees of the Federal Hospital Insurance and Federal Supplementary 
Medical Insurance Trust Funds.  Available at https://www.cms.gov/files/document/2020-medicare-trustees-report.pdf. 
 
58 GAO, FY 2019 and FY 2018 Consolidated Financial Statements of the U.S. Government.  Available at 
https://www.gao.gov/products/GAO-20-315R. 
 
59 OIG, Medicare Could Have Saved Billions at Critical Access Hospitals If Swing-Bed Services Were Reimbursed Using the Skilled 
Nursing Facility Prospective Payment System Rates, A-05-12-00046, March 2015.  Available at 
https://oig.hhs.gov/oas/reports/region5/51200046.asp.  
 
60 OIG, Trend Toward More Expensive Inpatient Hospital Stays in Medicare Emerged Before COVID-19 and Warrants Further 
Scrutiny, OEI-02-18-00380, February 2021.  Available at https://oig.hhs.gov/oei/reports/OEI-02-18-00380.asp.  
 
61 The White House, Executive Order on Promoting Competition in the American Economy.  Available at 
https://www.whitehouse.gov/briefing-room/presidential-actions/2021/07/09/executive-order-on-promoting-competition-in-
the-american-economy/.  
 
62 CMS, Data on national health expenditures by type of service and source of funds for CY 1960-2019.  Available at 
https://www.cms.gov/Research-Statistics-Data-and-Systems/Statistics-Trends-and-
Reports/NationalHealthExpendData/NationalHealthAccountsHistorical. 
 
63 CMS, Fiscal Year 2020 Financial Report.  Available at https://www.cms.gov/files/document/cms-financial-report-fiscal-year-
2020.pdf. 
 
64 At issue were specifically inhalation drugs administered through DME and supplying fees for immunosuppressive drugs 
associated with organ transplant, oral anticancer chemotherapeutic drugs, and oral antiemetic drugs used as a part of an 
 
45 
   
 
anticancer chemotherapeutic regimen.  See OIG, Medicare Part B Prescription Drug Dispensing and Supplying Fee Payment 
Rates Are Considerably Higher Than the Rates Paid by Other Government Programs, A-06-12-00038, September 2014.  Available 
at https://oig.hhs.gov/oas/reports/region6/61200038.asp. 
 
65 OIG, Least Costly Alternative Policies: Impact on Prostate Cancer Drugs Covered Under Medicare Part B, OEI-12-12-00210, 
November 2012.  Available at https://oig.hhs.gov/oei/reports/oei-12-12-00210.asp. 
 
66 OIG, Increases in Reimbursement for Brand-Name Drugs in Part D, OEI-03-15-00080, June 2018.  Available at 
https://oig.hhs.gov/oei/reports/oei-03-15-00080.asp.  
 
67 OIG, Medicaid Could Save Hundreds of Millions by Excluding Authorized Generic Drug Transactions to Secondary 
Manufacturers from Brand Name Drugs Average Manufacturer Price Calculations, A-06-18-04002, April 2019.  Available at 
https://oig.hhs.gov/oas/reports/region6/61804002.asp. 
 
68 OIG, Reasonable Assumptions in Manufacturer Reporting of AMPs and Best Prices OEI-12-17-00130, September 2019.  
Available at https://oig.hhs.gov/oei/reports/oei-12-17-00130.asp.  
 
69 31 USC  3351(4). 
 
70According to PaymentAccuracy.gov, the total estimated government improper payment rate for 2020 was $206.4 billion.  
Available at https://www.paymentaccuracy.gov/payment-accuracy-the-numbers/.  For Medicare and Medicaid estimated 
improper payment rates, see also CMS, 2020 Estimated Improper Payment Rates for Centers for Medicare & Medicaid Services 
(CMS) Programs.  Available at https://www.cms.gov/newsroom/fact-sheets/2020-estimated-improper-payment-rates-centers-
medicare-medicaid-services-cms-programs.   
 
71 HHS, Agency Financial Report, Fiscal Year 2020.  Available https://www.hhs.gov/sites/default/files/fy-2020-hhs-agency-
financial-report.pdf.  
 
72 CMS, 2019 Medicare Fee-for-Service Supplemental Improper Payment Data.  Available at 
https://www.cms.gov/newsroom/fact-sheets/2020-estimated-improper-payment-rates-centers-medicare-medicaid-services-
cms-programs.  
 
73 OIG, OIG Online Portfolio: Home Health, February 2016.  Available at https://oig.hhs.gov/reports-and-
publications/portfolio/home-health/.  See also: 
 
OIG, Vulnerabilities in the Medicare Hospice Program Affect Quality Care and Program Integrity: An OIG Portfolio, OEI-02-
16-00570, July 2018.  Available at https://oig.hhs.gov/oei/reports/oei-02-16-00570.asp.   
 
OIG, CMS Improperly Paid Millions of Dollars for Skilled Nursing Facility Services When the Medicare 3-Day Inpatient 
Hospital Stay Requirement Was Not Met, A-05-16-00043, February 2019.  Available at 
https://oig.hhs.gov/oas/reports/region5/51600043.asp.   
 
OIG, Medicare Improperly Paid Suppliers for Durable Medical Equipment, Prosthetics, Orthotics, and Supplies Provided to 
Beneficiaries During Inpatient Stays, A-09-17-03035, November 2018.  Available at 
https://oig.hhs.gov/oas/reports/region9/91703035.asp.   
 
OIG, Medicare Improperly Paid Providers for Items and Services Ordered by Chiropractors, A-07-17-03002, July 2018.  
Available at https://www.oig.hhs.gov/oas/reports/region9/91703002.asp.   
 
OIG, Medicare Improperly Paid Hospitals Millions of Dollars for Intensity-Modulated Radiation Therapy Planning Services, 
A-09-16-02033, August 2018.  Available at https://oig.hhs.gov/oas/reports/region9/91602033.asp.  
 
74 CMS, 2020 Estimated Improper Payment Rates for Centers for Medicare & Medicaid Services (CMS) Programs.  Available at 
https://www.cms.gov/newsroom/fact-sheets/2020-estimated-improper-payment-rates-centers-medicare-medicaid-services-
cms-programs.  
 
46 
   
 
75 OIG, Medicare Advantage Compliance Audit of Specific Diagnosis Codes That Anthem Community Insurance Company, Inc. 
(Contract H3655) Submitted to CMS, A-07-19-01187, May 2021.  Available at 
https://oig.hhs.gov/oas/reports/region7/71901187.asp. 
 
76 OIG, Medicare Advantage Compliance Audit of Specific Diagnosis Codes That Blue Cross Blue Shield of Michigan (Contract 
H9572) Submitted to CMS, A-02-18-01028, February 2021.  Available at https://oig.hhs.gov/oas/reports/region2/21801028.asp. 
77 CMS, 2020 Estimated Improper Payment Rates for Centers for Medicare & Medicaid Services (CMS) Programs.  Available at 
https://www.cms.gov/newsroom/fact-sheets/2020-estimated-improper-payment-rates-centers-medicare-medicaid-services-
cms-programs.  
 
78 CMS, Fiscal Year (FY) 2019 Medicare Fee-For-Service Improper Payment Rate is Lowest Since 2010 while data points to 
concerns with Medicaid eligibility.  Available at https://www.cms.gov/newsroom/press-releases/fiscal-year-fy-2019-medicare-
fee-service-improper-payment-rate-lowest-2010-while-data-points. 
 
79 OIG, Indiana Received Over $22 Million in Excess Federal Funds Related to Unsupported Community Integration and 
Habilitation Waiver Services at 12 Selected Service Providers, A-05-19-00022, June 2020.  Available at 
https://oig.hhs.gov/oas/reports/region5/51900022.asp.  See also: 
 
OIG, New York's Claims for Federal Reimbursement for Payments to Health Home Providers on Behalf of Beneficiaries 
Diagnosed With Serious Mental Illness or Substance Use Disorder Generally Met Medicaid Requirements But It Still Made 
$6 Million in Improper Payments to Some Providers, A-02-19-01007, July 2021.  Available at 
https://oig.hhs.gov/oas/reports/region2/21901007.asp.  
 
OIG, New York Improved Its Monitoring of Its Personal Care Services Program But Still Made Improper Medicaid Payments 
of More Than $54 Million, A-02-19-01016, December 2020.  Available at 
https://www.oig.hhs.gov/oas/reports/region2/21901016.asp.  
 
OIG, Massachusetts Made at Least $14 Million in Improper Medicaid Payments for the Nonemergency Medical 
Transportation Program, A-01-19-00004, January 2021.  Available at 
https://oig.hhs.gov/oas/reports/region1/11900004.asp.  
 
OIG, Kentucky Claimed Millions in Unallowable School-Based Medicaid Administrative Costs, A-04-17-00113, June 2021.  
Available at https://oig.hhs.gov/oas/reports/region4/41700113.asp. 
 
OIG, Florida Received Unallowable Medicaid Reimbursement for School-Based Services, A-04-18-07075, November 2020.  
Available at https://oig.hhs.gov/oas/reports/region4/41807075.asp.  
 
OIG, Colorado Improperly Claimed Millions in Enhanced Federal Medicaid Reimbursement for New Adult Group 
Beneficiaries Because of a Data Processing Error, A-07-17-02807, October 2020.  Available at 
https://oig.hhs.gov/oas/reports/region7/71702807.asp.  
 
OIG, Ohio Did Not Correctly Determine Medicaid Eligibility for Some Newly Enrolled Beneficiaries, A-05-18-00027, 
November 2020.  Available at https://oig.hhs.gov/oas/reports/region5/51800027.asp.  
 
OIG, Vulnerabilities Exist in State Agencies' Use of Random Moment Sampling To Allocate Costs for Medicaid School-Based 
Administrative and Health Services Expenditures, A-07-18-04107, December 2018.  Available at 
https://oig.hhs.gov/oas/reports/region7/71804107.asp.   
 
OIG, Michigan Did Not Always Comply With Federal and State Requirements for Claims Submitted for the Nonemergency 
Medical Transportation Brokerage Program, A-5-16-00021, June 2018.  Available at 
https://oig.hhs.gov/oas/reports/region5/51600021.asp.   
 
OIG, Minnesota Did Not Always Comply With Federal and State Requirements for Claims Submitted for the Nonemergency 
Medical Transportation Brokerage Program, A-05-15-00026, September 2017.  Available at 
https://oig.hhs.gov/oas/reports/region5/51500026.asp.   
 
47 
   
 
OIG, Oklahoma Did Not Adequately Oversee Its Medicaid Nonemergency Medical Transportation Program, A-06-16-00007, 
August, 2017.  Available at https://oig.hhs.gov/oas/reports/region6/61600007.asp.   
 
OIG, Medicaid Personal Care Services.  Available at https://oig.hhs.gov/newsroom/media-materials/2016/mpcs.asp. 
 
OIG, report in progress Medicaid Targeted Case Management.  Estimated completion date in 2022.  Work Plan item 
available at https://oig.hhs.gov/reports-and-publications/workplan/summary/wp-summary-0000235.asp.  
 
80 OIG, Unaccompanied Children, August 2020.  Available at https://oig.hhs.gov/reports-and-publications/featured-topics/uac/. 
 
81 OIG, The Office of Refugee Resettlement Did Not Award and Manage the Homestead Influx Care Facility Contracts in 
Accordance With Federal Requirements, A-12-20-20001, December 2020.  Available at  
https://oig.hhs.gov/oas/reports/region12/122020001.asp.  
 
82 OIG, Recommendation Followup: Vulnerabilities Continue To Exist in the HHS Small Business Innovation Research Program, 
OEI-04-18-00230, March 2019.  Available at https://oig.hhs.gov/oei/reports/oei-04-18-00230.asp. 
 
83 31 USC  3351-3358. 
 
84 OIG, U.S. Department of Health and Human Services Met Many Requirements of the Improper Payments Information Act of 
2002 but Did Not Fully Comply for Fiscal Year 2019, A-17-20-52000, May 2020.  Available at 
https://oig.hhs.gov/oas/reports/region17/172052000.asp. 
 
85 Congressional Research Service, The Temporary Assistance for Needy Families (TANF) Block Grant: Responses to Frequently 
Asked Questions.  Available at https://fas.org/sgp/crs/misc/RL32760.pdf. 
 
86 OIG, The Centers for Medicare & Medicaid Services Did Not Identify and Report Potential Antideficiency Act Violations for 12 
Contracts Used To Establish the Federal Marketplace Under the Affordable Care Act, A-03-16-03001, February 2020.  Available 
at https://oig.hhs.gov/oas/reports/region3/31603001.asp. 
 
87 OIG, CMS Did Not Administer and Manage Strategic Communications Services Contracts in Accordance With Federal 
Requirements, A-12-19-20003, July 2020.  Available at https://oig.hhs.gov/oas/reports/region12/121920003.asp. 
 
88 USASpending.gov, The Federal Response to COVID-19.  Available at https://www.usaspending.gov/disaster/covid-
19?publicLaw=all. 
 
89 HRSA, Provider Relief Fund Past Payments.  Available at https://www.hrsa.gov/provider-relief/past-payments. 
 
90 HRSA, COVID-19 Claims Reimbursement to Health Care Providers and Facilities for Testing, Treatment, and Vaccine 
Administration for the Uninsured.  Available at https://www.hrsa.gov/coviduninsuredclaim. 
 
91 HRSA, COVID-19 Coverage Assistance Fund.  Available at https://www.hrsa.gov/covid19-coverage-assistance. 
 
92 HHS, Coronavirus (COVID-19) Grant Opportunities and Guidance.  Available at 
https://www.hhs.gov/coronavirus/grants/index.html#covid19. 
 
93 See ongoing PRF-related reviews in OIG Work Plan at https://oig.hhs.gov/reports-and-publications/workplan/active-item-
table.asp?search.search=PRF. 
 
94 USASpending.gov, The Federal Response to COVID-19.  Available at https://www.usaspending.gov/disaster/covid-
19?publicLaw=all. 
 
 
48 
   
 
95 CMS, Medicare COVID-19 Public Health Emergency Accelerated and Advance Payments Program Repayment Data.  Available 
at https://www.cms.gov/files/document/covid-medicare-accelerated-and-advance-payments-program-covid-19-public-health-
emergency-repayment.pdf. 
 
96 CMS, Financial Report Fiscal Year 2020.  Available at https://www.cms.gov/files/document/cms-financial-report-fiscal-year-
2020.pdf.  
 
97 OIG, 441 Urgent Care Center Agreed to Pay $165,000 for Allegedly Violating the Civil Monetary Penalties Law by Falsely 
Certifying to Its Eligibility to Receive CARES Act Provider Relief Funds.  Available at https://oig.hhs.gov/fraud/enforcement/441-
urgent-care-center-agreed-to-pay-165000-for-allegedly-violating-the-civil-monetary-penalties-law-by-falsely-certifying-to-its-
eligibility-to-receive-cares-act-provider-relief-funds/. 
 
98 DOJ, DOJ Announces Coordinated Law Enforcement Action to Combat Health Care Fraud Related to COVID-19.  Available at 
https://www.justice.gov/opa/pr/doj-announces-coordinated-law-enforcement-action-combat-health-care-fraud-related-covid-
19. 
 
99 OIG, Fraud Alert: COVID-19 Scams.  Available at https://oig.hhs.gov/fraud/consumer-alerts/fraud-alert-covid-19-scams/. 
 
100 OIG, Consumer Alerts.  Available at https://oig.hhs.gov/fraud/consumer-alerts/. 
 
101 CMS, Medicaid Managed Care Enrollment and Program Characteristics, 2017.  Available at 
https://www.medicaid.gov/medicaid/managed-care/downloads/enrollment/2017-medicaid-managed-care-enrollment-
report.pdf. 
 
102 OIG, Weaknesses Exist in Medicaid Managed Care Organizations' Efforts To Identify and Address Fraud and Abuse, 
OEI-02-15-00260, July 2018.  Available at https://oig.hhs.gov/oei/reports/oei-02-15-00260.asp. 
 
104 OIG, Medicare Advantage Compliance Audit of Diagnosis Codes That Humana, Inc., (Contract H1036) Submitted to CMS, 
A-07-16-01165, April 2021.  Available at https://oig.hhs.gov/oas/reports/region7/71601165.asp.  See also: 
 
OIG, Medicare Advantage Compliance Audit of Specific Diagnosis Codes That Anthem Community Insurance Company, Inc. 
(Contract H3655) Submitted to CMS, A-07-19-01187, May 2021.  Available at 
https://oig.hhs.gov/oas/reports/region7/71901187.asp. 
 
OIG, Medicare Advantage Compliance Audit of Specific Diagnosis Codes That Blue Cross Blue Shield of Michigan (Contract 
H9572) Submitted to CMS, A-02-18-01028, February 2021.  Available at 
https://oig.hhs.gov/oas/reports/region2/21801028.asp. 
 
105 OIG, Billions in Estimated Medicare Advantage Payments From Chart Reviews Raise Concerns, OEI-03-17-00470, December 
2019.  Available at https://oig.hhs.gov/oei/reports/oei-03-17-00470.asp. 
 
106 OIG, Billions in Estimated Medicare Advantage Payments From Diagnoses Reported Only on Health Risk Assessments Raise 
Concerns, OEI-03-17-00471, September 2020.  Available at https://oig.hhs.gov/oei/reports/oei-03-17-00471.asp. 
 
107 OIG, Medicare Advantage Appeal Outcomes and Audit Findings Raise Concerns About Service and Payment Denials, 
OEI-09-1600410, September 2018.  Available at https://oig.hhs.gov/oei/reports/oei-09-16-00410.asp. 
 
108 OIG, CMS's Encounter Data Lack Essential Information That Medicare Advantage Organizations Have the Ability to Collect, 
OEI-03-19-00430, August 2020.  Available at https://oig.hhs.gov/oei/reports/OEI-03-19-00430.asp. 
 
109 OIG, Medicare Advantage Encounter Data Show Promise for Program Oversight, But Improvements Are Needed, 
OEI-03-15-00060, January 2018.  Available at https://www.oig.hhs.gov/oei/reports/oei-03-15-00060.asp. 
 
110 OIG, Medicare Advantage Organizations Are Missing Opportunities To Use Ordering Provider Identifiers To Protect Program 
Integrity, OEI-03-19-00432, April 2021.  Available at https://oig.hhs.gov/oei/reports/OEI-03-19-00432.asp. 
 
49 
   
 
111 OIG, Data on Medicaid Managed Care Payments to Providers Are Incomplete and Inaccurate, OEI-02-19-00180, March 2021.  
Available at https://oig.hhs.gov/oei/reports/OEI-02-19-00180.asp.  
 
112 OIG, Weaknesses Exist in Medicaid Managed Care Organizations' Efforts To Identify and Address Fraud and Abuse, 
OEI-02-15-00260, July 2018.  Available at https://oig.hhs.gov/oei/reports/oei-02-15-00260.asp. 
 
113 Matthew Rae, et al. (Kaiser Family Foundation), How the American Rescue Plan Act Affects Subsidies for Marketplace 
Shoppers and People Who Are Uninsured.  Available at https://www.kff.org/health-reform/issue-brief/how-the-american-
rescue-plan-act-affects-subsidies-for-marketplace-shoppers-and-people-who-are-uninsured.  See also Congressional Budget 
Office , Reconciliation Recommendations of the House Committee on Ways and Means.  Available at 
https://www.cbo.gov/system/files/2021-02/hwaysandmeansreconciliation.pdf.  
 
114 OIG, CMS Authorized Hundreds of Millions of Dollars in Advanced Premium Tax Credits on Behalf of Enrollees Who Did Not 
Make Their Required Premium Payments, A-02-19-02005, March 2021.  Available at  
https://oig.hhs.gov/oas/reports/region2/21902005.asp.  
 
115 OIG has found that some Tribes and Tribal organizations have not adequately protected funds under the Indian Self-
Determination and Education Assistance Act and other programs, resulting in embezzlement and theft of Federal funds. 
 
116 HHS codified the Uniform Guidance at 45 CFR part 75, which prescribes instructions and other pre-award matters for the 
granting agency to use in the announcement and application process for awards made on or after December 26, 2014.  The 
Uniform Guidance stipulates that the use of certain sections is required only for competitive Federal awards but may also be 
used by the HHS awarding agency for noncompetitive awards where appropriate or required by Federal statute.   
 
117 OIG, Two Indian Health Service Hospitals Had System Security and Physical Controls for Prescription Drug and Opioid 
Dispensing but Could Still Improve Controls, A-18-1630540, November 2017.  Available at 
https://oig.hhs.gov/oas/reports/region18/181630540.asp.  
 
118 See e.g., Testimony of Maureen Dixon, Examining Efforts to Prevent Opioid Overutilization and Misuse in Medicare and 
Medicaid, pp. 45.  Available at https://oig.hhs.gov/testimony/docs/2018/dixon-testimony052918.pdf. 
 
119 OIG, California Claimed at Least $2 Million in Unallowable Medicaid Reimbursement for a Selected Provider's Opioid 
Treatment Program Services, A-09-20-02001, January 2021.  Available at 
https://oig.hhs.gov/oas/reports/region9/92002001.asp.  
 
120 OIG, Key Medicare Tools To Safeguard Against Pharmacy Fraud and Inappropriate Billing Do Not Apply to Part D, 
OEI-02-15-00440, March 2020.  Available at https://oig.hhs.gov/oei/reports/oei-02-15-00440.asp. 
 
121 OIG, The Centers for Medicare & Medicaid Services Could Improve Performance Measures Associated With the Fraud 
Prevention System, A-01-15-00509, September 2017.  Available at https://oig.hhs.gov/oas/reports/region1/11500509.asp.  
 
122 OIG, Problems Remain for Ensuring That All High Risk Medicaid Providers Undergo Criminal Background Checks, 
OEI-05-00070, July 2019.  Available at https://oig.hhs.gov/oei/reports/oei-05-18-00070.asp. 
 
123 OIG, Twenty-Three States Reported Allowing Unenrolled Providers To Serve Medicaid Beneficiaries, OEI-05-19-00060, March 
2020.  Available at https://oig.hhs.gov/oei/reports/oei-05-19-00060.asp. 
 
124 OIG, States Could Do More To Prevent Terminated Providers From Serving Medicaid Beneficiaries, OEI-03-19-00070, March 
2020.  Available at https://oig.hhs.gov/oei/reports/oei-03-19-00070.asp. 
 
125 OIG, U.S. Department of Health and Human Services Met the Requirements of the Digital Accountability and Transparency 
Act of 2014, With Areas That Require Improvement, A-17-19-54000, October 2019.  Available at 
https://oig.hhs.gov/oas/reports/region17/171954000.asp. 
 
 
50 
   
 
126 HHS, FY 2019 Agency Financial Report.  Available at https://www.hhs.gov/sites/default/files/fy2019-hhs-agency-financial-
report.pdf. 
 
127 Ibid. 
 
128 This TMC focuses on Medicare and Medicaid, the Departments two largest health care programs.  The Department funds 
other vital health services including those through IHS, HRSA, and SAMHSA that are addressed in other TMCs.   
 
129 CMS, Innovation Models.  Available at:  https://innovation.cms.gov/innovation-models#views=models. 
 
130 Chiquita Brooks-LaSure, et al., Innovation At The Centers For Medicare And Medicaid Services: A Vision For The Next 10 
Years, Health Affairs Blog, August 12, 2021.  Available at 
https://www.healthaffairs.org/do/10.1377/hblog20210812.211558/full/. 
 
131 CMS, 2020 Report to Congress, Center for Medicare and Medicaid Innovation.  Available at https://innovation.cms.gov/data-
and-reports/2021/rtc-2020.  
 
132 CMS, 2020 Estimated Improper Payment Rates for Centers for Medicare & Medicaid Services (CMS) Programs.  Available at 
https://www.cms.gov/newsroom/fact-sheets/2020-estimated-improper-payment-rates-centers-medicare-medicaid-services-
cms-programs.   
 
133 CMS, CMS Innovation Center COVID-19 Flexibilities, June 2020.  Available at https://innovation.cms.gov/innovation-
models/covid-19-flexibilities.  OIG, COVID-19 Policy Statements and Guidance, April 15, 2021. Available at 
https://oig.hhs.gov/coronavirus/policy.asp?utm_source=oig-web&utm_medium=oig-covid-portal&utm_campaign=cv-
response-policies-faq. 
 
134 CMS, Meaningful Measures 2.0: Moving from Measure Reduction to Modernization.  Available at 
https://www.cms.gov/meaningful-measures-20-moving-measure-reduction-modernization. 
 
135 Ibid.  
 
136 OIG, CMSs Monitoring Activities for Ensuring That Medicare Accountable Care Organizations Report Complete and Accurate 
Data on Quality Measures Were Generally Effective, but There Were Weaknesses That Could Be Improved, A-09-18-03033, 
September 2020.  Available at https://oig.hhs.gov/oas/reports/region9/91803033.asp. 
 
137 OIG Final Rule, 85 Fed. Reg. 77684 (December 2, 2020); CMS Final Rule, 85 Fed. Reg. 77492 (December 2, 2020).  SAMHSA 
also issued a final rule and OCR a proposed rule to improve care coordination and sharing of information.  SAMHSA Final Rule, 
85 Fed. Reg. 42986 (July 15, 2020).   
 
138 OIG, Provider Shortages and Limited Availability of Behavioral Health Services in New Mexicos Medicaid Managed Care, 
OEI-02-17-00490, September 2019.  Available at https://oig.hhs.gov/oei/reports/oei-02-17-00490.asp. 
 
139 OIG, COVID-19 Had a Devastating Impact on Medicare Beneficiaries in Nursing Homes During 2020, OEI-02-20-00490, June 
2021.  Available at https://oig.hhs.gov/oei/reports/OEI-02-20-00490.asp. 
 
140  OIG, Registered Nurses Did Not Always Visit Medicare Beneficiaries Homes at Least Once Every 14 Days to Assess Quality of 
Care and Services Provided by Hospice Aides, A-09-18-03022, November 2019.  Available at 
https://oig.hhs.gov/oas/reports/region9/91803022.asp.  
 
141 OIG, Using Health IT for Care Coordination: Insights From Six Medicare Accountable Care Organizations, OEI-01-16-00180, 
May 2019.  Available at https://oig.hhs.gov/oei/reports/oei-01-16-00180.asp.  
 
142 OIG, Opportunities Exist To Strengthen Evaluation and Oversight of Telehealth for Behavioral Health in Medicaid, 
OEI-02-19-00401.  Available at https://oig.hhs.gov/oei/reports/OEI-02-19-00401.asp. 
 
 
51 
   
 
143 CMS, CMS Fast Facts Mobile Site.  Available at https://www.cms.gov/research-statistics-data-systems/cms-fast-facts/cms-
fast-facts-mobile-site. 
 
144 IHS, IHS Profile.  Available at  https://www.ihs.gov/newsroom/factsheets/ihsprofile/. 
 
145 OIG, Many Medicaid-Enrolled Children Treated for ADHD Did Not Receive Recommended Followup Care, OEI-07-17-00170, 
August 2019.  Available at https://oig.hhs.gov/oei/reports/oei-07-17-00170.pdf. 
 
146 OIG, 2019: Vulnerabilities in Hospice Care.  Available at https://oig.hhs.gov/newsroom/media-materials/2019/hospice/.   
 
147 HHS, Featured Priority: Vaccine Confidence.  Available at https://www.hhs.gov/vaccines/featured-priorities/vaccine-
confidence/index.html 
 
148 OIG, Adverse Events in Hospitals: National Incidence Among Medicare Beneficiaries, OEI-06-09-00090, November 2010.  
Available at https://oig.hhs.gov/oei/reports/oei-06-09-00090.pdf.  See also: 
 
OIG, Adverse Events in Skilled Nursing Facilities: National Incidence Among Medicare Beneficiaries, OEI-06-11-00370, 
February 2014.  Available at https://oig.hhs.gov/oei/reports/oei-06-11-00370.asp.  
 
OIG, Adverse Events in Rehabilitation Facilities: National Incidence Among Medicare Beneficiaries, OEI-06-14-00110, July 
2016.  Available at https://oig.hhs.gov/oei/reports/oei-06-14-00110.asp.  
 
OIG, Adverse Events in Long-Term-Care Hospitals: National Incidence Among Medicare Beneficiaries, OEI-06-14-00530, 
November 2018.  Available at https://www.oig.hhs.gov/oei/reports/oei-06-14-00530.asp. 
 
149 OIG, Hospital Incident Reporting Systems Do Not Capture Most Patient Harm, OEI-06-09-00091, January 2012.  Available at 
https://oig.hhs.gov/oei/reports/oei-06-09-00091.asp. 
 
150 OIG, report in progress Adverse Events In Hospitals: National Incidence Among Medicare Beneficiaries10-Year Update, 
OEI-06-18-00400.  Estimated completion date in 2022.  Work Plan item available at https://oig.hhs.gov/reports-and-
publications/workplan/summary/wp-summary-0000328.asp. 
 
151 OIG, Incidence of Adverse Events in Indian Health Service Hospitals, OEI-06-17-00530, December 2020.  Available at 
https://oig.hhs.gov/oei/reports/oei-06-17-00530.asp. 
152 OIG, Instances of His Labor and Delivery Care Not Following National Clinical Guidelines or Best Practices, OEI-06-19-00190, 
December 2020.  Available at https://oig.hhs.gov/oei/reports/OEI-06-19-00190.asp.  
 
153 OIG, COVID-19 Had a Devastating Impact on Medicare Beneficiaries in Nursing Homes During 2020, OEI-02-20-00490, June 
2021.  Available at https://www.oig.hhs.gov/oei/reports/OEI-02-20-00490.asp.  
 
154 OIG, Onsite Surveys of Nursing Homes During the COVID-19 Pandemic: March 23-May 30, 2020, OEI-01-20-00430, December 
2020.  Available at https://oig.hhs.gov/oei/reports/OEI-01-20-00430.asp.  
 
155 OIG, CMS Guidance to State Survey Agencies on Verifying Correction of Deficiencies Needs To Be Improved To Help Ensure the 
Health and Safety of Nursing Home Residents, A-09-18-02000, February 2019.  Available at 
https://oig.hhs.gov/oas/reports/region9/91802000.asp.  
 
156 OIG, Corporate Integrity Agreement.  Available at 
https://oig.hhs.gov/fraud/cia/agreements/Vanguard_Healthcare_LLC_Vanguard_Healthcare_Services_LLC_Boulevard_Terrace_
LLC_Glen_Oaks_LLC_Imperial_Gardens_Health_and_Rehabilitation_Vanguard_of_Manchester_%20LLC_Vanguard_Financial_Sv
cs_LLC_etal_01092019.pdf. 
 
157 OIG, Vulnerabilities in the Medicare Hospice Program Affect Quality Care and Program Integrity: An OIG Portfolio, 
OEI-02-16-00570, July 2018.  Available at https://oig.hhs.gov/oei/reports/oei-02-16-00570.asp.  
 
 
52 
   
 
158 OIG, Hospice Deficiencies Pose Risks to Medicare Beneficiaries, OEI- 02-17-00020, July 2019.  Available at 
https://www.oig.hhs.gov/oei/reports/oei-02-17-00020.asp.  
 
159 OIG, Indian Health Service Hospitals: More Monitoring Needed to Ensure Quality Care, OEI-06-14-00010, October 2016.  
Available at https://oig.hhs.gov/oei/reports/oei-06-14-00010.asp.  See also OIG, Indian Health Service Hospitals: Longstanding 
Challenges Warrant Focused Attention to Support Quality Care, OEI-06-14-00011, October 2016.  Available at 
https://oig.hhs.gov/oei/reports/oei-06-14-00011.asp. 
 
160 IHS, Quality at IHS.  Available at https://www.ihs.gov/quality/. 
 
161 OIG, Indian Health Service Hospitals: More Monitoring Needed to Ensure Quality Care, OEI-06-14-00010, October 2016.  
Available at https://oig.hhs.gov/oei/reports/oei-06-14-00010.asp.  See also: 
 
OIG, Longstanding Challenges Warrant Focused Attention to Support Quality Care, OEI-06-14-00011, October 2016.  
Available at https://oig.hhs.gov/oei/reports/oei-06-14-00011.asp.  
 
OIG, Case Study: Indian Health Service Management of Rosebud Hospital Emergency Department Closure and Reopening, 
OEI-06-17-00270, July 2019.  Available at https://oig.hhs.gov/oei/reports/oei-06-17-00270.asp.  
 
162ACF, Office of Head Start, Head Start Programs.  Available at:  https://www.acf.hhs.gov/ohs/about/head-start. 
 
163 ACF, Office of Child Care, Characteristics of Families Served by the Child Care and Development Fund (CCDF) Based on 
Preliminary FY2019 Data.  Available at https://www.acf.hhs.gov/occ/fact-sheet/characteristics-families-served-child-care-and-
development-fund-ccdf-based. 
 
164 HHS, Latest UC Data  FY 2021.  Available at https://www.hhs.gov/programs/social-services/unaccompanied-children/latest-
uc-data-fy2021/index.html.  
 
165 OIG, Separated Children Placed in Office of Refugee Resettlement Care, OEI-BL-18-00511, January 2019.  Available at 
https://www.oig.hhs.gov/oei/reports/oei-BL-18-00511.asp. 
 
166 OIG, The Tornillo Influx Care Facility: Concerns About Staff Background Checks and Number of Clinicians on Staff, 
A-12-19-20000, November 2018.  Available at https://oig.hhs.gov/oas/reports/region12/121920000.asp.  
 
167 OIG, Unaccompanied Alien Children Program Care Provider Facilities Do Not Include All Required Security Measures in Their 
Checklists, OEI-05-19-00210, June 2020.  Available at  https://oig.hhs.gov/oei/reports/oei-05-19-00210.asp.  
 
168 OIG, The Office of Refugee Resettlements Incident Reporting System Is Not Effectively Capturing Data To Assist Its Efforts To 
Ensure the Safety of Minors in HHS Custody, OEI-09-19-00430, June 2020.  Available at https://oig.hhs.gov/oei/reports/oei-09-
18-00430.asp. 
 
169 The United States Attorneys Office, District of Montana, White House announces Presidential Task Force on Protecting 
Native American Children in the Indian Health Service System, March 26, 2019.  Available at https://www.justice.gov/usao-
mt/pr/white-house-announces-presidential-task-force-protecting-native-american-children-indian. 
 
170 Presidential Task Force on Protecting Native American Children in the Indian Health Service System report, July 23, 2020.  
Available at https://www.whitehouse.gov/wp-content/uploads/2020/07/Task-Force-Report-Protecting-Native-American-
Children-in-the-Indian-Health-Service-System-April-2020.pdf.  
 
171 OIG, The Tornillo Influx Care Facility: Concerns About Staff Background Checks and Number of Clinicians on Staff, 
A-12-19-20000, November 27, 2018.  Available at https://oig.hhs.gov/oas/reports/region12/121920000.asp.  
172 OIG, report in progress Office of Refugee Resettlement Influx Care Facilities and Emergency Intake Sites: Employee/Staff 
Background Screening, W-00-21-59459.  Estimated completion date in 2022.  Work Plan item available at 
https://oig.hhs.gov/reports-and-publications/workplan/summary/wp-summary-0000590.asp. 
 
 
53 
   
 
173 OIG, All Six States Reviewed Had Partially Implemented New Criminal Background Check Requirements for Childcare 
Providers, and Five of the States Anticipate Full Implementation by Fiscal Year 2020, A-05-19-00015, August 2019.  Available at 
https://oig.hhs.gov/oas/reports/region5/51900015.asp.  See also: 
 
OIG, Colorado's Monitoring Did Not Ensure Child Care Provider Compliance With State Criminal Background Check 
Requirements at 18 of 30 Providers Reviewed, A-07-19-06084, April 2021.  Available at 
https://oig.hhs.gov/oas/reports/region7/71906084.asp. 
 
OIG, Virginia's Monitoring Did Not Ensure Child Care Provider Compliance With State Criminal Background Check 
Requirements at 8 of 30 Providers Reviewed, A-03-19-00253, February 2021.  Available at 
https://oig.hhs.gov/oas/reports/region3/31900253.asp. 
 
OIG, Indiana's Monitoring Did Not Ensure Child Care Provider Compliance With State Criminal Background Check 
Requirements at 17 of 30 Providers Reviewed, A-05-19-00012, August 2020.  Available at 
https://oig.hhs.gov/oas/reports/region5/51900012.asp. 
 
OIG, Rhode Island's Monitoring Did Not Ensure Child Care Provider Compliance With State Criminal Background Check 
Requirements at 18 of 30 Providers Reviewed, A-01-18-02505, August 2020.  Available at 
https://oig.hhs.gov/oas/reports/region1/11802505.asp. 
 
OIG, New Jersey's Monitoring Did Not Ensure Child Care Provider Compliance With State Criminal Background Check 
Requirements at 9 of 30 Providers Reviewed, A-02-19-02004, July 2020.  Available at 
https://oig.hhs.gov/oas/reports/region2/21902004.asp. 
 
OIG, Illinois' Monitoring Did Not Ensure Childcare Provider Compliance With State Criminal Background Check 
Requirements at 12 of 30 Providers Reviewed, A-05-19-00016, April 2020.  Available at 
https://oig.hhs.gov/oas/reports/region5/51900016.asp. 
 
OIG, New Hampshire's Monitoring Did Not Ensure Childcare Provider Compliance With State Criminal Background Check 
Requirements at 21 of 30 Providers Reviewed, A-01-18-02504, April 2020.  Available at 
https://oig.hhs.gov/oas/reports/region1/11802504.asp. 
 
174 OIG, Tribal Health Programs: Concerns About Background Verifications for Staff Working With Indian Children, 
A-01-20-01500, August 2020.  Available at https://oig.hhs.gov/oas/reports/region1/12001500.asp. 
 
175 OIG, National Background Check Program for Long Term-Care Providers: Assessment of State Programs Concluded in 2017 
and 2018, OEI-07-18-00290, August 2019.  Available at https://oig.hhs.gov/oei/reports/oei-07-18-00290.asp.  See also OIG, 
National Background Check Program for Long Term-Care Providers: Assessment of State Programs Concluded Between 2013 and 
2016, OEI-07-16-00160, April 2019.  Available at https://oig.hhs.gov/oei/reports/oei-07-16-00160.asp.   
 
176 OIG et. al., Ensuring Beneficiary Health and Safety in Group Homes Through State Implementation of Comprehensive 
Compliance Oversight, January 2018.  Available at https://oig.hhs.gov/reports-and-publications/featured-topics/group-
homes/group-homes-joint-report.pdf.   
 
177 CMS, CMS Fast Facts.  Available at https://www.cms.gov/research-statistics-data-and-systems/statistics-trends-and-
reports/cms-fast-facts/index.html.  
 
178 OIG, Incidents of Potential Abuse and Neglect at Skilled Nursing Facilities Were Not Always Reported and Investigated, 
A-01-16-00509, June 2019.  Available at https://oig.hhs.gov/oas/reports/region1/11600509.asp.  
 
179 OIG, Safeguards Must Be Strengthened To Protect Medicare Hospice Beneficiaries From Harm, OEI-02-17-00021, July 2019.  
Available at https://oig.hhs.gov/oei/reports/oei-02-17-00021.asp. 
 
180 OIG, CMS Could Use Medicare Data To Identify Instances of Potential Abuse or Neglect, A-01-17-00513, June 2019.  Available 
at https://oig.hhs.gov/oas/reports/region1/11700513.asp.  
 
54 
   
 
181CMS, CMCS Informational Bulletin: Health and Welfare of Home and Community Based Services (HCBS) Waiver Recipients.  
Available at https://www.medicaid.gov/federal-policy-guidance/downloads/cib062818.pdf.  
 
182 OIG, A Resource Guide for Using Diagnosis Codes in Health Insurance Claims To Help Identify Unreported Abuse or Neglect, 
A-01-19-00502, July 2019.  Available at 
https://oig.hhs.gov/oas/reports/region1/11900502.asp?utm_source=website&utm_medium=asp&utm_campaign=abuse-
neglect-guide.  
 
183 OIG, Medicaid Data Can Be Used To Identify Instances of Potential Child Abuse or Neglect, A-01-19-00001, July 2020.  
Available at https://oig.hhs.gov/oas/reports/region1/11900001.asp.  
 
184 ReImagine HHS was a transformation effort to improve the Departments ability to enhance the health and well-being of all 
Americans.  In spring 2017, OMB released Memorandum M-17-22 which required all Cabinet-level agencies to develop a plan to 
become more effective, efficient, and accountable.  In response, HHS formed ReImagine HHS.  
 
185 HHS, HHS Protect: Frequently Asked Questions.  Available at https://www.hhs.gov/about/news/2020/07/20/hhs-protect-
frequently-asked-questions.html. 
  
186 OIG, Hospitals Reported That the COVID-19 Pandemic Has Significantly Strained Health Care Delivery, OEI-09-21-00140, 
March 2021.  Available at https://oig.hhs.gov/oei/reports/OEI-09-21-00140.asp.  
 
187 Office of the Assistant Secretary for Planning and Evaluation, Improving Data for Decision Making: HHS Data Collection 
Strategies for a Transformed Health System.  Available at https://aspe.hhs.gov/basic-report/improving-data-decision-making-
hhs-data-collection-strategies-transformed-health-system. 
 
188 Office of the Chief Technology Officer, The State of Data Sharing at the U.S. Department of Health and Human Services.  
Available at https://www.hhs.gov/sites/default/files/HHS_StateofDataSharing_0915.pdf. 
 
189 HHS, HHS Protect: Frequently Asked Questions.  Available at https://www.hhs.gov/about/news/2020/07/20/hhs-protect-
frequently-asked-questions.html. 
 
190 The White House, Executive Order Ensuring a Data-Driven Response to COVID-19 and Future High-Consequence Public Health 
Threats.  Available at https://www.whitehouse.gov/briefing-room/presidential-actions/2021/01/21/executive-order-ensuring-
a-data-driven-response-to-covid-19-and-future-high-consequence-public-health-threats/.  
 
191 CDC, Data Modernization Initiative.  Available at https://www.cdc.gov/surveillance/surveillance-data-strategies/data-IT-
transformation.html. 
 
192 Foundations for Evidence-Based Policymaking Act of 2018, P.L. 111-435 (January 14, 2019).  Enterprise data governance is 
one of the four areas that is part of the Federal Data Strategy.  Available at https://strategy.data.gov/.  The Federal Data 
Strategy Action Plan requires all Federal agencies to make several data governance improvements including establishing a data 
governance body.  The plans action number 12 is Constitute a Diverse Data Governance Body.  Available at 
https://strategy.data.gov/action-plan/#action-12-constitute-a-diverse-data-governance-body.  The HHS Data Governance Board 
serve as the principal data governance forum and decision-making body for managing HHS data as a strategic asset and to 
support HHS in meeting its mission and agency priorities, including implementation of the Evidence Act.  See 
https://beta.healthdata.gov/dataset/HHS-Data-Governance-Board-Membership/w3i2-jayx/data. 
 
193 CDC, Its time to build pandemic-ready IT systems.  Available at https://www.cdc.gov/surveillance/pdfs/PRIME_1-
sheet_single-page.pdf. 
194 T-MSIS is a joint effort by the States and CMS to build a national Medicaid data set that addresses identified problems with 
prior Medicaid data sets.  CMS intends for T-MSIS to provide States and the Federal Government with a national Medicaid data 
repository that would, among other functions, support program management, financial management, and program integrity.  
See CMS, State Health Official Letter, SHO #18-008, August 10, 2018.  Available at https://www.medicaid.gov/federal-policy-
guidance/downloads/sho18008.pdf. 
 
 
55 
   
 
195 CMS, Fact Sheet: Medicaid & CHIP and the COVID-19 Public Health Emergency, May 2021.  Available at: 
https://www.cms.gov/newsroom/fact-sheets/fact-sheet-medicaid-chip-and-covid-19-public-health-emergency. 
 
196 CMS, DQ (Data Quality) Atlas.  Available at https://www.medicaid.gov/dq-atlas/welcome.  
 
197 CMS, CMS MACBIS T-MSIS Reporting Reminder: Reporting ICD-10-CM Diagnosis Codes with clarification on Z Codes for 
Social Determinants of Health (SDOH).  Available at https://www.medicaid.gov/medicaid/data-and-
systems/macbis/tmsis/tmsis-blog/105716, https://www.medicaid.gov/medicaid/data-and-systems/macbis/tmsis/tmsis-
blog/109701.  See also OIG, National Review of Opioid Prescribing in Medicaid Is Not Yet Possible, OEI-05-18-00480, August 
2019.  Available at https://oig.hhs.gov/oei/reports/oei-05-18-00480.asp.  
 
198 OIG, Data on Medicaid Managed Care Payments to Providers Are Incomplete and Inaccurate, OEI-02-19-00180, March 2021.  
Available at https://oig.hhs.gov/oei/reports/OEI-02-19-00180.asp.  
 
199 OIG work has shown that databases such as ACFs Program Information Report, FDA's Food Facility Registry and its National 
Drug Code Directory, HRSAs 340B covered-entity database, and IHS's Health Service Directory contain incomplete and 
inaccurate data. 
 
200 Office of the Chief Technology Officer, The State of Data Sharing at the U.S. Department of Health and Human Services.  
Available at https://www.hhs.gov/sites/default/files/HHS_StateofDataSharing_0915.pdf.  
 
201 NIH, All of Us Research Hub  Researcher Workbench.  Available at https://www.researchallofus.org/workbench/.  
 
202 NIH, Researchers Guide and Drive the Workbench's First Year.  Available at https://allofus.nih.gov/news-events-and-
media/announcements/researchers-guide-and-drive-workbenchs-first-year. 
 
203 FDA, FDAs Technology Modernization Action Plan, September 2019.  Available at https://www.fda.gov/about-
fda/reports/fdas-technology-modernization-action-plan. 
204 FDA, New Era of Smarter Food Safety, August 2021.  Available at https://www.fda.gov/food/new-era-smarter-food-safety. 
 
205 HHS, HHS Information Technology Strategic Plan.  Available at https://www.hhs.gov/sites/default/files/hhs-it-strategic-plan-
final-fy2021-2023.pdf.  
 
206 OIG, Using Health IT for Care Coordination: Insights from Six Medicare Accountable Care Organizations, OEI-01-16-00180, 
May 2019. Available at https://oig.hhs.gov/oei/reports/oei-01-16-00180.asp 
 
207 ONC, Use of Certified Health IT and Methods to Enable Interoperability by U.S. Non-Federal Acute Care Hospitals, 2019.  
Available at  https://www.healthit.gov/sites/default/files/page/2021-
03/Hospital%20Use%20of%20Certified%20HIT_Interop%20v10_1.pdf. 
 
208 Ibid. 
 
209 CDC, Healthcare Facilities in Production for COVID-19 Electronic Case Reporting.  Available at 
https://www.cdc.gov/coronavirus/2019-ncov/hcp/electronic-case-reporting/hcfacilities-map.html. 
 
210 85 Fed. Reg. 25510, May 1, 2020.  Available at https://www.federalregister.gov/documents/2020/05/01/2020-
05050/medicare-and-medicaid-programs-patient-protection-and-affordable-care-act-interoperability-and.  
 
211 ONC, Say Hey! to Project US@  a Unified Specification for Address in Health Care.  Available at 
https://www.healthit.gov/buzz-blog/health-it/say-hey-to-project-us-a-unified-specification-for-address-in-health-care. 
 
212 Sonic Wall, 2021 Cyber Threat Report.  Available at https://www.sonicwall.com/2021-cyber-threat-report/. 
 
 
56 
   
 
213 The White House, Executive Order on Improving the Nations Cybersecurity.  Available at 
https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-
cybersecurity/. 
 
214 Cybersecurity and Infrastructure Security Agency, Ransomware Activity Targeting the Healthcare and Public Health Sector.  
Available at https://us-cert.cisa.gov/ncas/alerts/aa20-302a.  See also HHS, Ransomware Trends 2021.  Available at 
https://www.hhs.gov/sites/default/files/ransomware-trends-2021.pdf.  
 
215 HHS, Cybersecurity.  Available at https://oig.hhs.gov/reports-and-publications/featured-topics/cybersecurity/.  See also GAO, 
Cybersecurity.  Available at https://www.gao.gov/cybersecurity. 
 
216 HHS, Office of the Chief Information Officer, Incident Reporting, Policy and Incident Management Reference.  Available at 
https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/incident-reporting-policy-incident-management-
reference/index.html.  See also HHS, Office of the Chief Information Officer, Health Sector Cybersecurity Coordination Center 
(HC3).  Available at https://www.hhs.gov/about/agencies/asa/ocio/hc3/index.html.  
 
217 OIG, Opportunities Exist for the National Institutes of Health To Strengthen Controls in Place To Permit and Monitor Access to 
Its Sensitive Data, A-18-18-09350, February 2019. Available at https://oig.hhs.gov/oas/reports/region18/181809350.asp 
 
218 HHS press release, HHS Announces the Official Opening of the Health Sector Cybersecurity Coordination Center.  Available at 
https://www.hhs.gov/about/news/2018/10/30/hhs-announces-official-opening-health-sector-cybersecurity-coordination-
center.html.  
 
219 HHS, HIPAA and COVID-19.  Available at https://www.hhs.gov/hipaa/for-professionals/special-topics/hipaa-
covid19/index.html.  
 
220 OIG, Hospital Experiences Responding to the COVID-19 Pandemic: Results of a National Pulse Survey March 2327, 2020, 
OEI-06-20-00300, April 2020.  Available at https://oig.hhs.gov/oei/reports/oei-06-20-00300.asp.  
 
221 OIG, Hospitals Reported That the COVID-19 Pandemic Has Significantly Strained Health Care Delivery, OEI-06-20-00300, 
March 2021.  Available at https://oig.hhs.gov/oei/reports/OEI-09-21-00140.asp.  
 
222 OIG, Hospitals Reported Improved Preparedness for Emerging Infectious Diseases After the Ebola Outbreak, OEI-06-15-
00230, October 2018.  Available at https://www.oig.hhs.gov/oei/reports/oei-06-15-00230.asp. 
 
223 OIG, HHS Did Not Always Efficiently Plan and Coordinate Its International Ebola Response Efforts, A-04-16-03567, August 
2019.  Available at https://oig.hhs.gov/oas/reports/region4/41603567.asp. 
 
224 OIG, Hospitals Reported Improved Preparedness for Emerging Infectious Diseases After the Ebola Outbreak, 
OEI-06-15-00230, October 2018.  Available at https://www.oig.hhs.gov/oei/reports/oei-06-15-00230.asp.  
 
225 CDC, Health Equity Considerations and Racial and Ethnic Minority Groups, July 24, 2020.  Available at 
https://www.cdc.gov/coronavirus/2019-ncov/community/health-equity/race-ethnicity.html. 
 
226 HHS, Office of Minority Health, About COVID-19 Health Equity Task Force.  Available at 
https://www.minorityhealth.hhs.gov/omh/browse.aspx?lvl=2&lvlid=100. 
 
227 OIG, COVID-19 Had a Devastating Impact on Medicare Beneficiaries in Nursing Homes During 2020, OEI-02-20-00490, June 
2021.  Available at https://www.oig.hhs.gov/oei/reports/OEI-02-20-00490.asp. 
 
228 NIH, COVID-19: Potential Implications for Individuals with Substance Abuse Disorders.  Available at 
https://www.drugabuse.gov/about-nida/noras-blog/2020/04/covid-19-potential-implications-individuals-substance-use-
disorders. 
 
 
57 
   
 
229 OIG, States Oversight of Opioid Prescribing and Monitoring of Opioid Use.  Available at https://oig.hhs.gov/oas/opioid-
oversight-map/oversight.asp. 
 
230 OIG, SAMHSA Is Missing Opportunities To Better Monitor Access to Medication Assisted Treatment Through the 
Buprenorphine Waiver Program, OEI-BL-20-00260, June 2021.  Available at https://oig.hhs.gov/oei/reports/OEI-BL-20-
00260.asp. 
   
231 OIG, Communication and Management Challenges Impeded HHS's Response to the Zero-Tolerance Policy, OEI-BL-18-00510, 
March 2020.  Available at https://oig.hhs.gov/oei/reports/oei-BL-18-00510.asp. 
 
232 Ibid. 
 
233 OIG, Ohio Did Not Ensure the Accuracy and Completeness of Psychotropic and Opioid Medication Information Recorded in Its 
Child Welfare Information System for Children in Foster Care, A-05-18-00007, July 2020.  Available at 
https://oig.hhs.gov/oas/reports/region5/51800007.asp.  
 
234 OIG, Kansas Did Not Ensure That Group Homes for Children in Foster Care Complied With All State Health and Safety 
Requirements, A-07-19-06087, July 2020.  Available at https://oig.hhs.gov/oas/reports/region7/71906087.asp.  
 
235 OIG, Missouri Should Improve Its Oversight of Selected Nursing Homes Compliance With Federal Requirements for Life Safety 
and Emergency Preparedness, A-07-18-03230, March 2020.  Available at 
https://oig.hhs.gov/oas/reports/region7/71803230.asp.  See also: 
 
OIG, Florida Should Improve Its Oversight of Selected Nursing Homes Compliance With Federal Requirements for Life Safety 
and Emergency Preparedness, A-04-18-08065, March 2020.  Available at 
https://www.oig.hhs.gov/oas/reports/region4/41808065.asp.  
 
OIG, Life Safety and Emergency Preparedness Deficiencies Found at 18 of 20 Texas Nursing Homes, A-06-19-08001, 
February 2020.  Available at https://oig.hhs.gov/oas/reports/region6/61908001.asp.  
 
OIG, California Should Improve Its Oversight of Selected Nursing Homes Compliance With Federal Requirements for Life 
Safety and Emergency Preparedness, A-09-18-02009, November 2019.  Available at 
https://oig.hhs.gov/oas/reports/region9/91802009.asp.  
 
OIG, New York Should Improve Its Oversight of Selected Nursing Homes Compliance With Federal Requirements for Life 
Safety and Emergency Preparedness, A-02-17-01027, August 2019.  Available at 
https://oig.hhs.gov/oas/reports/region2/21701027.asp. 
 
236 Christopher Weaver and Dan Frosch, PBS Frontline, A Pedophile Doctor Drew Suspicions for 21 Years. No One Stopped 
Him.  Available at https://www.pbs.org/wgbh/frontline/article/patrick-stanley-weber-sexual-abuse-pine-ridge-blackfeet-
reservation. 
 
237 Christopher Weaver, The Wall Street Journal, Former U.S. Indian Health Service Doctor Is Found Guilty of Abusing Boys.  
Available at https://www.wsj.com/articles/former-u-s-indian-health-service-doctor-is-found-guilty-of-abusing-boys-
11569624911.  
 
238 OIG, Tribal Health Programs: Concerns About Background Verifications for Staff Working With Indian Children, 
A-01-20-01500, August 2020.  Available at https://oig.hhs.gov/oas/reports/region1/12001500.asp. 
 
239 IHS letter addressed to Tribal Leader with attachment OIG Memorandum Report  Early Alert: Tribal Health Programs: 
Concerns About Background Verifications for Staff Working With Indian Children, A-01-20-01500.  Available at 
https://www.ihs.gov/sites/newsroom/themes/responsive2017/display_objects/documents/2020_Letters/DTLL_09252020.pdf. 
 
58