Open Recommendations

Identify all CPSC personnel that affect security and privacy (e.g., Executive Risk Council, Freedom of Information Act personnel, etc.) and ensure the training policies are modified to require these individuals to participate in role-based security/privacy training (Data Protection and Privacy iii).

Perform an assessment of the knowledge, skills, and abilities of CPSC personnel with significant security responsibilities (Security Training i).

Document and implement a process for ensuring that all personnel with significant security roles and responsibilities are provided specialized security training to perform assigned duties (Security Training ii/iii) (2021 recommendation).

Develop and tailor security training content for all CPSC personnel with significant security responsibilities and provide this training to the appropriate individuals (Security Training iv/v).

Integrate the established strategy for identifying organizational risk tolerance into the Information Security Continuous Monitoring plan (Information Security Continuous Monitoring i).

Implement Information Security Continuous Monitoring procedures, including those procedures related to the monitoring of performance measures and metrics , that support the Information Security Continuous Monitoring program (Information Security Continuous Monitoring ii) (2021 recommendation).

Develop, document, and distribute all required Contingency Planning documents (e.g.. organization-wide Continuity of Operation Plan and Business Impact Assessment, Disaster Recovery Plan, Business Continuity Plans, and Information System Contingency Plans) in accordance with appropriate federal and best practice guidance (Contingency Planning ii/iv).

Integrate documented contingency plans with the other relevant agency planning areas (Contingency Planning iii).

We recommend that Coventry Health Care of Missouri, Inc. refund to the Federal Government the $548,852 of total net overpayments.

We recommend that Coventry Health Care of Missouri, Inc. identify, for the diagnoses included in this report, instances of noncompliance in the enrollee-years that occurred: (1) during our audit period but were not included in our judgmental sample and (2) before and after our audit period and refund any resulting overpayments to the Federal Government.

We recommend that Coventry Health Care of Missouri, Inc. enhance its compliance procedures to focus on diagnosis codes that are at high risk for being miscoded by 1) educating its providers about the proper use and documentation of these diagnoses and 2) determining whether these diagnosis codes (when submitted to CMS for use in CMS's risk adjustment program) comply with Federal requirements.

This recommendation is Sensitive But Unclassified.

This recommendation is Sensitive But Unclassified.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

USDA OIG has determined that this recommendation contains sensitive information and will not be publicly released due to privacy concerns.

This recommendation is Sensitive But Unclassified.

This recommendation is Sensitive But Unclassified.

This recommendation is Sensitive But Unclassified.

This recommendation is Sensitive But Unclassified.

This recommendation is Sensitive But Unclassified.

The Director evaluates and determines any additional reasons for noncompliance and ensures that staff complete the required prevention and management of disruptive behavior training based on the risk level assigned to their work areas.