Corrective Action Plans

SIGNIFICANT DEFICIENCIES WIC Special Supplemental Nutrition Program for Women, Infants and Children Federal Assistance Listing Numbers: 10.557 2024.001 Recommendation We recommend that management provide training for those responsible for verifying eligibility to ensure that documentation and internal control over eligibility is maintained. Action Taken The agency Coordinator will have a training session with each clerk in the agency on the importance of documentation and completion of assessing WIC eligibility. This re-training will include step-by-step instructions. Clerks will be instructed to add notes when needed to explain a client's eligibility, (ex. immigrants and eligibility). Demonstration will be required by each clerk to their supervisor. The re-education will be completed by the end of June 2025 and reported on a log with attendees. Ongoing monitoring will be performed by agency supervisors. They will audit five charts twice a month for each clerk/certifier. In the event, there are deficiencies identified, the supervisor will re-train the clerk/certifier at that time. 1. A folder for each clerk will be kept in a locked cabinet by the agency supervisor. It will contain a log that will consist of the clerk's name, household audited and an analysis of the eligibility that was completed at the certification. 2. Ongoing corrections if needed will be addressed by the agency supervisor or coordinator. Retraining may be requested by clerical staff at any time. If the Cognizant or Oversight Agency for Audit has questions regarding this plan, please call: Mr. Tracy Nagel, CFO at (317) 576-1335 or email to tnagel@ihcinc.org.

After FY2024, Almost Home ceased using Temporary Assistance for Needy Families (TANF) to cover the cost of Severe Weather Activation Vouchers (SWAP) for TANF-eligible families. From this point forward, TANF will only be used for clients meeting all TANF eligibility requirements.

All Students who were not reported were entered into the NSLDS website and their records were updated. A process has been established to capture all official and unofficial withdrawal. The Financial Aid and Registrars offices have developed a system to capture all withdrawals in our new FAMS system (Banner from Ellucian). All students who have withdrawn are being updated through National Student Clearinghouse and from there to NSLDS.

Finding: The Community Colleges of Spokane did not have adequate controls over and did not comply with program governance requirements for its Head Start program. Questioned Costs: Assistance Listing # 93.600 Status: Corrective action in progress Corrective Action: The College District will enhance our monthly financial reporting to include a unique identifier for monthly expenditures. Additionally, a report of expenditures procured by credit card will be attached to the regular financial report. The College District acknowledges the importance of clear documentation and tracking of the required training and meeting attendance by all Board of Trustees members and Policy Council members. Beginning in March 2025, the College District started providing additional methods and opportunities for new members to receive fiscal and governance training. To strengthen controls over program governance requirements and to demonstrate the commitment to continuous improvement of existing processes, the College District will further document training completion and the distribution of monthly financial information to all members. Completion Date: Estimated June 2025 Agency Contact: Linda McDermott Chief Financial Officer 501 N Riverpoint Blvd, PO Box 6000 Spokane, WA 99217-6000 (509) 434-5275 Linda.McDermott@ccs.spokane.edu

Finding: Skagit Valley College did not have adequate internal controls over and did not comply with program governance requirements for its Head Start program. Questioned Costs: Assistance Listing # 93.600 Amount $0 Status: Corrective action complete Corrective Action: The College has reviewed and strengthened current internal controls to ensure the Board receives the required financial and credit card statements monthly and that all new Board members receive training within the required 180 days. Financial reporting procedures The Head Start Program Director prepares monthly reporting to be available for inclusion in the monthly board packet, or as requested. In January 2025, the Procedures of Policy Council and Board Reporting were updated to ensure that required monthly reporting is provided to each governing body, regardless of whether there is a scheduled meeting for that month. This procedure became effective for the February 2025 Board of Trustees meeting. All financial reporting that was not previously provided to the Board of Trustees for the period covering July 1, 2023, through December 31, 2024, was transmitted on February 24, 2025. Board member training In January 2025, the Head Start Director provided the Board of Trustees an updated document on the program’s selection criteria and enrollment process. Additionally, the Head Start Board of Trustees Handbook, which has incorporated other training materials, was provided to each board member. The Head Start Director will conduct an annual review of the handbook content and update as appropriate to ensure training materials remain current. Completion Date: March 2025 Agency Contact: Mike Cogan VP of Administrative Services and CFO 2405 East College Way Mount Vernon, WA 98273-5899 (360) 899-2945 mike.cogan@skagit.edu

Finding: Edmonds College did not have adequate internal controls over and did not comply with program governance requirements for its Head Start program. Questioned Costs: Assistance Listing # 93.600 Status: Corrective action in progress Corrective Action: In response to the audit finding, the College will explore options for a Governing Body that complies with governance requirements for the Head Start program. By May 2025, the College will consult with its Assistant Attorney General to discuss the composition of a new Governing Body and will take the necessary steps to fully comply with federal regulations. By July 2025, the College will: • Establish a Governing Body that is compliant with requirements outlined in the Head Start Act to perform the required monthly review of financial and credit card statements, major financial expenditures, and any funding applications. • Ensure the Policy Council receives and approves the required financial and credit card statements each month. • Provide training to the new Governing Body and active members of the Policy Council within the required 180 days. Completion Date: Estimated July 2025 Agency Contact: Ginger Williams Head Start Executive Director 20816 44th Ave. W. Lynnwood, WA 98036-7744 (425) 550-3840 ginger.williams@edmonds.edu

Finding: The Health Care Authority did not have adequate internal controls over and did not comply with federal provider eligibility requirements for the Medicaid and Children’s Health Insurance Program. Questioned Costs: Assistance Listing # 93.767 93.767 COVID-19 93.775 93.777 93.777 COVID-19 93.778 93.778 COVID-19 Amount $3,844,961 Status: Corrective action in progress Corrective Action: The Authority partially concurs with the finding. The Authority does not concur with the auditor’s assertion that two providers did not have a valid Core Provider Agreement on file. The Authority also does not concur that two new providers were enrolled without completion of a full enrollment screening. Corrective action has been in process to address revalidation issues from prior audits. As of January 1, 2024, the Authority implemented a system change moving the revalidation date to 90 days before the end of the five-year period. The Authority is revising existing procedures to strengthen internal controls over provider enrollment. Additional procedure implementation is also in progress to ensure high risk providers receive fingerprint-based background checks. Regarding the nursing facility revalidations, the Authority operates cooperatively under a written agreement with the Department of Social and Health Services (Department) who carry out the nursing facility licensing and revalidations. The Department stated: Effective May 2024, the Department updated the nursing facility revalidation process to require the Facilities Contract Specialist review the nursing facility revalidation monitoring spreadsheet monthly and that revalidation paperwork will be sent one year before the due date to ensure revalidation is done ahead of the 5-year period. In addition, the Department will consult with the Authority to determine if it is feasible to automate the revalidation notices. By December 31, 2025, Department contracts staff will verify that the Medicaid Provider Disclosure Statement forms are in the Management Operation Document Imaging System for all nursing facilities and that each form has been completed within the 5-year period. The conditions noted in this finding were previously reported in findings 2023-074, 2022-055, 2021-047, 2020-046, 2019-048, 2018-042, 2017-033, and 2016-035. Completion Date: Estimated December 2025 Agency Contact: William Sogge External Audit Compliance Specialist PO Box 45502 Olympia, WA 98504-5502 (360) 725-5110 william.sogge@hca.wa.gov

Finding: The Department of Children, Youth, and Families did not have adequate internal controls to ensure a child is eligible and group care facility employees and adults residing in prospective caregivers’ households had cleared background checks before having unsupervised access to children. Questioned Costs: Assistance Listing # 93.658 93.658 COVID-19 Status: Corrective action complete Corrective Action: The Department is committed to strengthening internal controls and complying with grant requirements. For the specific exceptions identified in the finding, the Department has taken the following actions: Individuals: • Updated the source of funds in the FamLink application for the child identified in the audit exception to ensure future payments would be made with state funds. • Researched all payments made on behalf of the child and returned the federal portion to the grantor. • Updated the peer review process to ensure that a sample of cases are reviewed quarterly and all documentation is properly retained. Background Checks: • In January 2024, the Department increased its use of National Crime Information Center (NCIC) background checks to ensure all individuals required to complete fingerprint-based checks are compliant prior to a child’s placement. • The Department continues to use the Plan, Do, Check, Act (continuous quality improvement process) to communicate changes and provide additional training to staff as needed to ensure compliance with the background check requirement. The conditions noted in this finding were previously reported in findings 2023-068 and 2022-050. Completion Date: January 2024 Agency Contact: Stefanie Niemela Audit Liaison PO Box 40970 Olympia, WA 98504-0970 (360) 725-4402 stefanie.niemela@dcyf.wa.gov

Finding: The Department of Children, Youth, and Families did not have adequate internal controls to ensure monthly foster care maintenance payments to children’s caregivers were adequate and accurate for the Foster Care program. Questioned Costs: Assistance Listing # 93.658 93.658 COVID-19 Status: Corrective action complete Corrective Action: The Department is committed to strengthening internal controls and complying with grant requirements. As stated in the finding’s Cause of Condition, the Department did not fully implement the prior year’s corrective action plan during the audit period and did not have the reporting capabilities to track rate setting reviews for the entire audit period. To strengthen internal controls and documentation, and as part of the implementation of the new rate assessment process, the Department took the following corrective actions: • Published a new report in FamLink to assist rate assessors in identifying: o Six-month reviews that have not been performed timely. o Cases with upcoming rate assessments and due dates for reviews. • Implemented monthly tracking by supervisors to assist with internal controls and compliance. The Department continues to use the Plan, Do, Check, Act (continuous quality improvement process) to improve the accuracy of the new reports and provide additional training to staff as needed to ensure compliance with the requirement of performing six-month reviews of the reimbursement rates. The conditions noted in this finding were previously reported in finding 2023-067. Completion Date: June 2024 Agency Contact: Stefanie Niemela Audit Liaison PO Box 40970 Olympia, WA 98504-0970 (360) 725-4402 stefanie.niemela@dcyf.wa.gov

Finding: The Department of Social and Health Services did not have adequate internal controls over and did not comply with federal requirements to ensure subrecipients of the Refugee and Entrant Assistance programs received required single audits, and that it followed up on findings and issued management decisions. Questioned Costs: Assistance Listing # 93.566 Amount $0 Status: Corrective action in progress Corrective Action: The Department partially concurs with the auditor’s findings. The Department’s Office of Refugee and Immigrant Assistance (ORIA) has taken corrective actions to strengthen controls over subrecipient monitoring. During the fiscal year, the program verified each subrecipient’s total federal financial assistance through online tax forms and determined if a single audit report is required. For subrecipients that met the single audit threshold, ORIA either received the single audit report from the subrecipient or accessed the Federal Audit Clearinghouse database to obtain a copy. However, the Department did not issue management decisions when applicable. By May 2025, the Department will work with the Division of Finance and Financial Resources (DFFR) to review all subrecipients’ single audit reports for state fiscal year 2024. Any audit findings related to activities funded by ORIA awards will be identified for necessary actions. By June 2025, as applicable, the Department will issue management decision letters for the findings outlining the determination of the effectiveness of the subrecipient’s proposed corrective action to address findings. By July 2025, the Department will: • Work with DFFR to implement effective internal controls and develop written procedures to ensure subrecipients receive required single audits; and to issue written management decisions as needed. • Monitor subrecipients’ corrective actions for findings received to ensure they are completed. The conditions noted in this finding were previously reported in finding 2023-053. Completion Date: Estimated July 2025 Agency Contact: Richard Meyer External Audit Compliance Manager PO Box 45804 Olympia, WA 98504-5804 (360) 664-6027 Richard.Meyer@dshs.wa.gov

Finding: The Department of Children, Youth, and Families did not have adequate internal controls over eligibility requirements for child care services paid with the Child Care and Development Fund and Temporary Assistance for Needy Families funds. Questioned Costs: Assistance Listing # 93.558 93.575 93.575 COVID-19 93.596 Amount $0 Status: Corrective action complete Corrective Action: In response to prior audit findings, the Department developed a corrective action plan to address the internal control deficiencies. This finding was issued due to the corrective action plan not being fully implemented during the audit period. To address the prior years’ eligibility audit findings, the Department has taken the following actions: • As of April 2024, conducted a root cause analysis of internal audit findings, particularly for cases with errors due to household composition and approved activities, and updated the desk aid with corrective actions identified. • As of May 2024: o Improved and published the desk aid outlining simplified eligibility determination process that includes procedures for those families who do not have an approved activity. o Developed updated household composition training for all staff as part of core childcare training. The Department will continue to partner with the Administration for Children and Families and follow our program integrity plan. The conditions noted in this finding were previously reported in findings 2023-059, 2022-036, 2021-035, 2020-039, 2019-032, 2018-030, 2017-026, 2016-023, 2015-026, 2014-026, 2013-017, and 12-30. Completion Date: May 2024 Agency Contact: Stefanie Niemela Audit Liaison PO Box 40970 Olympia, WA 98504-0970 (360) 725-4402 stefanie.niemela@dcyf.wa.gov

Finding: The Department of Health did not have adequate internal controls to ensure providers maintained immunization records, control, accountability and safeguarding of vaccines for the Immunization Cooperative Agreements Program. Questioned Costs: Assistance Listing # 93.268 93.268 COVID-19 Amount $0 Status: Corrective action complete Corrective Action: The Department has already taken steps to evaluate current processes to ensure providers maintain immunization records, control, accountability and safeguarding of vaccines for the Immunization Program. As of July 2024, the program implemented a more automated process in the RedCap system to identify the vaccine doses administered outside the age range (DOAR) activities. This process enables adequate reviews and follow up with providers to be performed for the DOAR reports. As of November 2024, the site visit coordinator began the process of closely monitoring site visits due in one month and reaching out to the regional representatives to determine the status of scheduling site visits in order to minimize delays. The Department will continue to conduct monthly site visits and outreach and follow internal policies and procedures to meet DOAR reporting requirements. Completion Date: November 2024 Agency Contact: Jeff Arbuckle External Audit Manager PO Box 47890 Olympia, WA 98504-7890 (360) 701-0798 Jeff.Arbuckle@doh.wa.gov

Finding: The Housing Finance Commission did not have adequate internal controls over earmarking requirements for the Homeowner Assistance Fund program. Questioned Costs: Assistance Listing # 21.026 COVID-19 Amount $0 Status: Corrective action complete Corrective Action: The Commission has taken the following corrective actions to strengthen controls over earmarking requirements for the Homeowner Assistance Fund (HAF) program: • Developed a system to track and monitor expenditures in relation to overall program expenditures to ensure earmarking requirements are within allowable parameters. • Selected an increased percentage of approved, denied, and withdrawn HAF applications that have previously been reviewed by the contractor, as part of the Quality Control process, for a secondary review by program staff. • Reviewed a selection of HAF applications independent of the Quality Control process performed by the contractor. • Reviewed a selection of approved HAF applications prior to disbursing funds to confirm eligibility determinations are proper. The conditions noted in this finding were previously reported in finding 2023-023. Completion Date: October 2024 Agency Contact: Lucas Loranger Senior Finance Director 1000 Second Ave, Suite 2700 Seattle, WA 98104-3601 (206) 464-7139 Lucas.Loranger@wshfc.org

Finding: The Housing Finance Commission did not have adequate internal controls over eligibility requirements for the Homeowner Assistance Fund program. Questioned Costs: Assistance Listing # 21.026 COVID-19 Amount $0 Status: Corrective action complete Corrective Action: The Commission has taken the following corrective actions to strengthen controls over eligibility requirements for the Homeowner Assistance Fund (HAF) program: • Selected an increased percentage of approved, denied, and withdrawn HAF applications that have previously been reviewed by the contractor, as part of the Quality Control process, for a secondary review by program staff. • Reviewed a selection of HAF applications independent of the Quality Control process performed by the contractor. • Reviewed 100% of approved HAF applications prior to disbursing funds to confirm eligibility determinations are proper. The conditions noted in this finding were previously reported in finding 2023-022. Completion Date: June 2024 Agency Contact: Lucas Loranger Senior Finance Director 1000 Second Ave, Suite 2700 Seattle, WA 98104-3601 (206) 464-7139 Lucas.Loranger@wshfc.org

Finding: The Employment Security Department did not have adequate internal controls over and did not comply with requirements to ensure it profiled all claimants under the Unemployment Insurance program to identify people likely to need reemployment services and ensure staff providing those services received required training. Questioned Costs: Assistance Listing # 17.225 17.225 COVID-19 Amount $0 Status: Corrective action in progress Corrective Action: The Department concurs with the audit recommendation to review the Worker Profiling and Reemployment Services calculation of the profile score within the Unemployment Tax and Benefit (UTAB) system. In response to the prior year’s finding, the Department began investigating the process of the score calculation in October 2024. The Department is also examining resource allocation to more effectively validate the profile score and ensure that coefficient values are correctly determined and assigned by the UTAB system. The Department partially concurs with the recommendation to reconcile the UTAB and Reemployment Appointment Scheduler (RAS) interface. There is currently a process in place to notify the RAS team if a record fails at the time of data transmission between UTAB and RAS. The Department will review its processes to verify the complete UTAB exit file was successfully received by RAS. The Department partially concurs with the recommendation to ensure staff have completed the required training before providing services to claimants. The Department currently monitors local offices to ensure staff have taken the required training to be able to provide reemployment screening services to claimants. The exception cited in the finding was due to one staff out of 277 who missed the refresher training during fiscal year 2024. The Department will continue to monitor local staff training to ensure compliance. The conditions noted in this finding were previously reported in finding 2023-010. Completion Date: Estimated May 2025 Agency Contact: Jay Summers  External Audit Manager   PO Box 9046   Olympia, WA 98507-9046  (360) 529-6718  Joshua.Summers@esd.wa.gov

2024-003 – 10.558 – Child and Adult Care Food Program –Eligibility Condition Two providers received an improper amount for their meal reimbursement for the month tested. Recommendation Controls should be reviewed and updated to ensure that complete and accurate meal counts are submitted to the State for reimbursement. Comments on the Finding Given the Organization’s limited size, it is not always feasible to fully segregate the duties surrounding the meal claims processes. However, in order to mitigate errors, steps have been taken to implement checks within those processes. Action Taken Whenever possible, an employee other than the Director will prepare the claims. The Director of the Organization will later review the claims for accuracy and compare the claim numbers in both the excel spreadsheet and the Little Organizer program to ensure their correctness.

This audit finding refers to retroactive Medicaid billing from BHDDH for dates of service in 2022 and 2023 once the IMD status was removed from ESH. That provider type currently does not require the Medicare information to be submitted to EOHHS for processing. They bill with a type of bill and if there is eligibility on file for Eleanor Slater, the claim is paid. EOHHS will pursue a project to correct this finding. Project PH0630 - OI Edit for ESH was created and is being worked on by Gainwell and the State. The Project Charter states that the state must have controls in place to ensure that claims from the State Hospital, including Eleanor Slater Hospital (ESH) are reimbursed by Medicaid as the payer of last resort. Meetings, requirements gathering, and business designs are ongoing. The Business Design is anticipated to be completed by end of April 2025. Anticipated Completion Date: To Be Determined Contact Person: Hector Rivera, Interdepartmental Project Manager, Executive Office of Health and Human Services hector.l.rivera@ohhs.ri.gov

2024-065a: Rhode Island did not participate in the February 2024 PARIS interstate match due to a file issue that has since been addressed in April 2024. The May and August 2024 PARIS matches were suspended at the Federal level for all States due to an outstanding computer matching agreement between the DoD and HHS/ACF. Enhancements to existing PARIS Interstate match logic are scheduled to run as planned for fall/winter 2025. EOHHS completed implementation of an interface on 3/5/24 between The Work Number (TWN) and RI Bridges. Contract and budget actions for TWN services were not completed until fall 2024. The system requirements that Equifax initially communicated to the State and our Integrated Eligibility System implementation partner were incomplete and the original integration configured in fall 2024 did not successfully pass testing. A system modification to correct the original specifications was originally scheduled for February 2025 but was delayed due to the 12/13/24 RI Bridges cyber event. Target date for TWN implementation is July 2025. The Death Match process resumed in Spring 2025. Long-term modifications are scheduled for December 2025. These modifications include connecting RI Bridges to the SSA Death Master File (DMF) and utilizing the data from DMF as the primary source for monthly death verifications. During SFY 2024, several system fixes were deployed to address the findings noted in 2024-065. Specifically, in September 2024, a system fix was put in place to ensure children with verified SSNs were appropriately evaluated for Medicaid/CHIP coverage and excluded from Cover All Kids. The system automatically identifies individuals aging out of Medicaid Expansion prior to their 65th birth month and redetermines eligibility. EOHHS will improve controls of this process and ensure that if the system is unable to accurately remove the member from the Medicaid expansion category, a manual workaround will be implemented. Anticipated Completion Date: January 1, 2026 Contact Person: Anthony Salvo, Implementation Director of Policy and Programs, Executive Office of Health and Human Services anthony.salvo@ohhs.ri.gov 2024-065b: EOHHS will proactively work with the system vendor and other State agencies to implement controls over eligibility system and process deficiencies. Corrective actions will include, but are not limited to, manual processes, code fixes, and new system enhancements. Anticipated Completion Date: Ongoing Contact Person: Anthony Salvo, Implementation Director of Policy and Programs, Executive Office of Health and Human Services anthony.salvo@ohhs.ri.gov 2024-065c: EOHHS will identify and return any potential ineligible costs by end of the current Federal Fiscal Year (FFY). Anticipated Completion Date: September 30, 2025 Contact Person: Allison Shartrand, Assistant Director, Financial & Contract Management, Executive Office of Health and Human Services allison.shartrand@ohhs.ri.gov

EOHHS currently maintains full staffing within the Medicaid Eligibility Quality Control (MEQC) Unit, consisting of two (2) dedicated analysts and one (1) unit supervisor at EOHHS. Oversight of the unit is provided by a Deputy Medicaid Program Director who operates independently from the Medicaid operations and policy divisions, in accordance with 42 CFR §431.812, ensuring the unit’s objectivity and compliance with federal separation-of-function requirements. All future MEQC reviews will be conducted exclusively by this independent unit. Should any staffing limitations arise that may impact the timely completion of reviews, EOHHS is committed to proactively communicate with both EOHHS Leadership and CMS to request additional time or support, as appropriate. This structure supports consistent quality assurance, audit readiness, and adherence to MEQC program integrity standards. Anticipated Completion Date: Completed Contact Person: Mark Kraics, Deputy Medicaid Director, Executive Office of Health and Human Services mark.kraics@ohhs.ri.gov

Each health plan reports TPL recoveries to EOHHS in its quarterly financial report (FDCR). These recoveries are used as a direct offset to medical expenses. As such, claims paid by the plans on behalf of a member with TPL will remain in the EOHHS encounter data warehouse. Health plans do not void claims that have previously been paid to account for any TPL liability. Rather, they seek to recover from the third party any amount owed and report that amount to the state. In each of the last two fiscal years, this reduced medical expenditures by just under $8 million. 2025 Update: Following the process from 2023 and 2024, we are requesting a new TPL files from Gainwell that will be shared to each MCO. Anticipated Completion Date: Ongoing Contact Person: Jeffrey Schmeltz, Chief, Family Health Systems, Executive Office of Health and Human Services jeffrey.schmeltz@ohhs.ri.gov

EOHHS has met expectations on aligning the FSR and FDCR reports, has updated files to Milliman, and continues to monitor compliance. EOHHS is currently in a maintenance phase and will continue monthly oversight going forward. Anticipated Completion Date: Current and Ongoing Contact Person: Steven Corvese, Plan Analyst, Executive Office of Health and Human Services steven.corvese@ohhs.ri.gov

The findings can be grouped into several areas as shown below. The responses are included below each grouping. Each response is included in each category. 1. Licensing a. “Licensing for providers of behavioral healthcare services and home and community-based services to members with developmental disabilities are, by statute, the responsibility of the Department of Behavioral Healthcare, Developmental Disabilities, and Hospitals (BHDDH). BHDDH, in conjunction with evaluations of provider health and safety standards, relicenses providers biennially. Inconsistent with most Medicaid providers, EOHHS, as the Medicaid agency, does not receive annual licensing data from BHDDH resulting in a weakness in control for this segment of providers.” b. “Licensing for providers of residential services (inclusive of psychiatric services) to children in the State’s custody is, by statute, the responsibility of the Department of Children, Youth, and Families (DCYF). DCYF, in conjunction with evaluations of provider health and safety standards, relicenses providers annually. Inconsistent with most Medicaid providers, EOHHS, as the Medicaid agency, does not receive annual licensing data from DCYF resulting in a weakness in control for this segment of providers. c. 4 out of 60 providers sampled noted instances where providers remained active during fiscal 2024 after provider licenses had expired, evidencing a deficiency in internal control relating to timely provider deactivation if provider licensure is not evidenced. No claims were paid to these providers thus noncompliance was not noted.” EOHHS’ Division of Medicaid Compliance is actively working with BHDDH, DCYF, and RIDOH to address the licensing concerns by strengthening the communication of end dates between each agency’s licensing division and Medicaid’s Division of Medicaid Compliance. Anticipated Completion Date: Ongoing. Anticipated June 2025. Contact Persons: Emily Tumber, Implementation Director of Policy and Programs, Executive Office of Health and Human Services emily.tumber@ohhs.ri.gov Nicholas James, Implementation Director of Policy and Programs, Executive Office of Health and Human Services nicholas.james@ohhs.ri.gov 2. Systems a. “Encounter data submitted by managed care organizations is not currently validated for provider enrollment upon acceptance. This deficiency in internal controls over provider eligibility prevents the detection of claiming submitted by unenrolled providers. Our testing noted 4 managed care providers that were not enrolled in the Medicaid Program as required by federal regulations resulting in noncompliance with provider eligibility requirements (questioned costs - $3,371). All 4 providers were out-of-state providers required to be enrolled under federal regulations based on the volume of services billed to RI Medicaid. Implementing this additional edit when processing encounter data would improve controls over compliance. b. For claims representing care furnished to a beneficiary by an out-of-state furnishing provider, the SMA may pay a claim, in limited circumstances, to a furnishing provider that is not enrolled in the reimbursing state’s Medicaid plan. In these circumstances, the State is required to meet several requirements including verification that the provider is enrolled in good standing in Medicare or another state’s Medicaid program. The State is not currently performing such validation for out-of-state providers with limited claiming. c. The State did not have documentation supporting review of the SSA Death Master file for 19 out of the 60 providers we tested. a. EOHHS conducted research on these cases and completed a system upgrade to remedy the issue on 5/1/2024. b. EOHHS conducted research on these cases and completed a system upgrade to remedy the issue on 5/1/2024. c. EOHHS implemented new Provider Screening Tool in February 2025 which will provide dated documentation following the automated search for various screening requirements, including Death Master File. This documentation will be uploaded to the provider file. This will eliminate the manual process of searching for providers individually through the Death Master File and relying on an individual recording the date. Anticipated Completion Date: Ongoing Contact Person: Kimberly Tebow, Senior Medical Care Specialist, Executive Office of Health and Human Services kimberly.tebow@ohhs.ri.gov 3. Provider Surveys a. Federal regulations require the Medicaid agency to execute provider agreements with nursing facility providers and intermediate care facilities for individuals with intellectual disabilities (ICF/IID) upon receiving notification from the State survey and certification unit that the provider has been certified in substantial compliance with federal health and safety regulations. The State Medicaid agency lacked documentation of a finalized provider agreements and approval letters to providers in 6 out of 18 providers reviewed. In respect to the State’s only ICF/IID facility, the State Medicaid agency was not monitoring the RI Department of Health’s (RIDOH) certification process and had no documentation from RIDOH regarding the facility’s health and safety certification. All providers were recertified by RIDOH and compliant with program health and safety requirements. EOHHS/Medicaid implemented tracking protocol for all surveys received by the RIDOH to ensure completeness and timely response. Revisions to the internal standard operating procedure for the review and approval of these surveys are under review. This was completed on February 1, 2024. Regarding the monitoring of RIDOH’s certification process, EOHHS will collaboratively work with RIDOH to implement a monitoring program. Anticipated Completion Date: June 2026 for the monitoring program. Contact Person: Patricia Arruda, Chief of Strategic Planning, Monitoring & Evaluation, Executive Office of Health and Human Services patricia.arruda@ohhs.ri.gov

2024-056a: During SFY 2024, several system fixes were deployed to address the findings noted in 2024-056. Specifically, in September 2024, a system fix was put in place to ensure children with verified SSNs were appropriately evaluated for Medicaid/CHIP coverage and excluded from Cover All Kids. RI Bridges appropriately determines eligibility for CHIP when TPL data is not present. Once TPL information is known to the system, existing eligibility rules will only evaluate for Medicaid, not CHIP. The TPL exceptions noted by the OAG show a discrepancy between TPL data in the MMIS and the information sent to RI Bridges via the TPL loopback file. EOHHS will work with their vendor to determine the root cause of the discrepancy and establish a corrective action plan if appropriate. Rhode Island did not participate in the February 2024 PARIS interstate match due to a file issue that has since been addressed in April 2024. The May and August 2024 PARIS matches were suspended at the Federal level for all States due to an outstanding computer matching agreement between the DoD and HHS/ACF. Enhancements to existing PARIS Interstate match logic are scheduled to run as planned for fall/winter 2025. Income/Wage Validation: EOHHS completed implementation of an interface on 3/5/24 between The Work Number (TWN) and RI Bridges. Contract and budget actions for TWN services were not completed until fall 2024. The system requirements that Equifax initially communicated to the State and our Integrated Eligibility System implementation partner were incomplete and the original integration configured in fall 2024 did not successfully pass testing. A system modification to correct the original specifications was originally scheduled for February 2025 but was delayed due to the 12/13/24 RI Bridges cyber event. Target date for TWN implementation is July 2025. Anticipated Completion Date: July 1, 2025 for income/wage validation. Contact Person: Anthony Salvo, Implementation Director of Policy and Programs, Executive Office of Health and Human Services anthony.salvo@ohhs.ri.gov 2024-056b: The Center for Staff Development and Learning (CSDL) the lead for training at the Rhode Island Department of Human Services (RIDHS) will work towards correction by using a blended approach to learning using formal (classroom or virtual learning sessions) and on the job learning activities. will conduct the following: a. The CSDL Team will continue to include in its Ex Parte Learning Series review of where the system performs an Ex Parte review to determine Medicaid eligibility for age outs ages 19, 26, and 65. In addition, included in the Medicaid Refresher, currently in development, a review will be done of updating income and verification procedures that includes end date and employment segments when household members lost employment. b. The Operations staff supervisors will schedule processing labs that will require the participants to process live cases with guidance from a supervisor. Anticipated Completion Date: The trainings and refresher learnings are ongoing. Processing labs are scheduled as need for this specific topic, we anticipate that processing labs will be scheduled and completed between July – September of 2025. The Medicaid Refresher Learning Series will be released in July. This training will also be ongoing. Contact Person: Zulma Valenzuela, Assistant Director of Administrative Services, Center for Staff Development and Learning, Department of Human Services zulma.valenzuela@dhs.ri.gov 2024-056c: As noted in prior year responses, CMS will not pursue recoveries associated with questioned costs given that recoveries based on eligibility errors can only be pursued when identified by programs operating under CMS’ Payment Error Rate Measurement program per section 1903(u) of the Social Security Act and regulations at 42 CFR Part 431, Subpart Q. This limits CMS’s ability to recover on most of the SSA eligibility findings. While CMS will pursue the internal control deficiencies noted by the SSA, CMS will not pursue recoveries associated with the questioned costs. Anticipated Completion Date: Not Applicable Contact Person: Anthony Salvo, Implementation Director of Policy and Programs, Executive Office of Health and Human Services anthony.salvo@ohhs.ri.gov

Management agrees with the finding regarding inaccurate calculations. Management disagrees with the finding regarding information about DCYF children in the system. The Office of Child Care (OCC) is continually reviewing available training materials related to CCAP eligibility and case processing and has identified certain gaps where additional training/clarification, and more frequent communication to processing staff is needed – specifically in income calculation/input of paystubs, confirming asset declarations, and confirming need hours. OCC is working with the DHS training department to create a CCAP-specific training to provide in-depth coverage of program requirements. OCC continues to present at quarterly meetings to highlight error findings and the critical importance of accurate documentation. In addition, the CCAP administrator works continuously with field staff and Deloitte through weekly theme meetings to identify areas where system changes can improve accuracy of eligibility determinations. OCC is currently reviewing the grace period/short-term approval policy, how it is applied to specific cases, and how it is implemented in RIBridges. The finding has been escalated from the CCAP administrator to the assistant director of the Office of Child Care to ensure continued collaboration from all facets of the eligibility work to continue to improve errors in determination. Anticipated Completion Date: Ongoing – will continue to see a decline in errors in eligibility approval. Contact Person: Nicole Chiello, Assistant Director, Office of Child Care, Department of Human Services nicole.chiello@dhs.ri.gov

2024-053a: The State (EOHHS) receives quarterly user access reports from the MMIS fiscal agent. Anyone identified on the reports that have not logged in for a period of 60 days will have their access terminated. Terminating the users access locks them out and prevents access the system without first requesting a password reset, which is reviewed and approved/denied by EOHHS systems group. In addition, when a user leaves state service or moves to another agency, their access is terminated immediately. An SOP will be implemented with offboarding procedures to assist in timely removal of access. Access is maintained and controlled within the GainwellNow system. Email notifications of pending requests for access are sent to Hector Rivera and Kim Tebow (both EOHHS), who must then review the request and attached form and either grant or deny access. An FTE will be added to the EOHHS/Medicaid Systems team to standardize all user access policies and procedures. Oversight of all IT security activities performed by the MMIS contractor is the responsibility of the EOHHS/Medicaid Project/Contract Manager assigned to the vendor. This individual is supported by the ETSS AIM assigned to support EOHHS/Medicaid. A SOC audit is completed yearly and provides documentation for penetration and vulnerability testing. Anticipated Completion Date: Current and Ongoing Contact Persons: Brian Tichenor, Medicaid Systems Manager, Executive Office of Health and Human Services brian.tichenor@ohhs.ri.gov Hector Rivera, Interdepartmental Project Manager, Executive Office of Health and Human Services hector.l.rivera@ohhs.ri.gov Kimberly Tebow, Senior Medical Care Specialist, Executive Office of Health and Human Services kimberly.tebow@ohhs.ri.gov 2024-053b: The 2025 MARS-E Assessment is underway and will be completed by 4/30/2025. The results will be reviewed to assure the items in the previous MARS-E assessment have been addressed as expected by the state. Documentation lacking to evaluate security controls; Complete pending MARS-E Assessment Continued use of unsupported applications in need of update or patching; major upgrade of the end of life frameworks is planned for SFY2026 start. This expensive upgrade structurally supports most of the modernization platforms that the state is considering. Start SFY 2026; Completion SFY 2027 Lack of contractor tracking of exceptions and risk assessments; Exceptions for vulnerabilities are tracked in JIRA. Risk assessments are performed in all security tests and periodically on security controls. CISO approves all vulnerability exceptions. Complete pending MARS-E Assessment Contractor only sharing partial vulnerability scanning results; Raw report results are provided in Sharepoint in support of the risk assessment process. Complete pending MARS-E Assessment Lack of a robust triage process for security vulnerabilities; Complete pending MARS-E Assessment Inadequate consideration of IT security vulnerabilities with industry best practices. Security vulnerability assessments are performed using the CMS method of impact X probability. The method has been reviewed by state and MARS-E assessor. Complete pending MARS-E Assessment Anticipated Completion Dates: See above Contact Person: Deb Merrill, Security Officer, Enterprise Technology System Services, Department of Administration deb.merrill@doit.ri.gov 2024-053c: The State (EOHHS) collaborates with system vendors (MMIS/Gainwell and Deloitte/RI Bridges) Maintenance & Operations (M&O) and Security teams to ensure annual risk assessment/vulnerability best practices and lessons learned are integrated into annual planning and scope of work for future FYs. Anticipated Completion Date: Current and Ongoing Contact Persons: Brian Tichenor, Medicaid Systems Manager, Executive Office of Health and Human Services brian.tichenor@ohhs.ri.gov Hector Rivera, Interdepartmental Project Manager, Executive Office of Health and Human Services hector.l.rivera@ohhs.ri.gov 2024-053d: Our controls for User Access are in place. Depending on the access requested by the type of user and the program being administered, access are provided accordingly. Anticipated Completion Date: Current and Ongoing Contact Persons: Saurabh Gosai, Director – Technology, Strategy and Innovation, Department Human Services saurabh.u.gosai@dhs.ri.gov Sherri Kennedy, Chief - Human Services Policy and Systems Specialist, Department of Human Services sherri.kennedy@dhs.ri.gov