Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster Temporary Assistance for Needy Families (TANF) Social Services Block Grant Opioid STR Block Grants for Community Mental Health Services Block Grants for Substance Abuse, Prevention, Treatment and Recovery Services ALN: 93.044, 93.045, 93.053 93.558 93.667 93.788 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Aging Cluster 2101TXOACM, 2101TXOAHD, 2101TXOANS, 2101TXOASS 2201TXOACM, 2201TXOAHD, 2201TXOANS, 2201TXOASS, 2301TXOACM, 2301TXOAHD, 2301TXOANS, 2301TXOASS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2401TXOASS October 1, 2020 – September 30, 2023, October 1, 2021 – September 30, 2024, October 1, 2022 – September 30, 2024, October 1, 2022 – September 30, 2025 and October 1, 2023 – September 30, 2025 TANF 2301TXTANF, 2301TXTAN3, 2401TXTANF, 2401TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2023 – September 30, 2024 Social Services Block Grant 2201TXSOSR, 2301TXSOSR and 2401TXSOSR October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 and October 1, 2023 – September 30, 2025 Opioid STR 6H79TI083288 and 5H79TI085747 September 30, 2020 – September 29, 2023, September 30, 2022 – September 29, 2024 Block Grants for Community Mental Health Services 6B09SM083999, 1B09SM085994, 6B09SM085994, 1B09SM087322, 1B09SM087345, 6B09SM087345, 1B09SM09610, 1B09SM085385, 6B09SM089380, 1B09SM085913, 1B09SM089984 March 15, 2021 – March 14, 2024, October 1, 2021 – September 30, 2023, October 17, 2022 – October 16, 2024, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, September 1, 2021 – September 30, 2025, September 30, 2023 – September 29, 2025, September 30, 2024 – September 29, 2026 Block Grants for Substance Use Prevention, Treatment and Recovery Services 6B08TI084673, 1B08TI085835, 6B08TI085835, 1B08TI083969, 1B08TI084609, 6B08TI085835, 1B08TI087067, 6B08TI083545 October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, September 1, 2021 – September 30, 2025, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, March 15, 2021 – March 15, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligating action at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: 2023-010, 2022-013, 2021-007 Recommendation: HHSC should implement functionality into CAPPS-FIN to track when obligations of federal awards are made so that the agency is able to retrieve a list of all subawards by obligation date in order to monitor compliance with the Federal Funding Accountability and Transparency Act. Views of responsible officials: HHSC concurs with the finding.
Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster Temporary Assistance for Needy Families (TANF) Social Services Block Grant Opioid STR Block Grants for Community Mental Health Services Block Grants for Substance Abuse, Prevention, Treatment and Recovery Services ALN: 93.044, 93.045, 93.053 93.558 93.667 93.788 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Aging Cluster 2101TXOACM, 2101TXOAHD, 2101TXOANS, 2101TXOASS 2201TXOACM, 2201TXOAHD, 2201TXOANS, 2201TXOASS, 2301TXOACM, 2301TXOAHD, 2301TXOANS, 2301TXOASS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2401TXOASS October 1, 2020 – September 30, 2023, October 1, 2021 – September 30, 2024, October 1, 2022 – September 30, 2024, October 1, 2022 – September 30, 2025 and October 1, 2023 – September 30, 2025 TANF 2301TXTANF, 2301TXTAN3, 2401TXTANF, 2401TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2023 – September 30, 2024 Social Services Block Grant 2201TXSOSR, 2301TXSOSR and 2401TXSOSR October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 and October 1, 2023 – September 30, 2025 Opioid STR 6H79TI083288 and 5H79TI085747 September 30, 2020 – September 29, 2023, September 30, 2022 – September 29, 2024 Block Grants for Community Mental Health Services 6B09SM083999, 1B09SM085994, 6B09SM085994, 1B09SM087322, 1B09SM087345, 6B09SM087345, 1B09SM09610, 1B09SM085385, 6B09SM089380, 1B09SM085913, 1B09SM089984 March 15, 2021 – March 14, 2024, October 1, 2021 – September 30, 2023, October 17, 2022 – October 16, 2024, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, September 1, 2021 – September 30, 2025, September 30, 2023 – September 29, 2025, September 30, 2024 – September 29, 2026 Block Grants for Substance Use Prevention, Treatment and Recovery Services 6B08TI084673, 1B08TI085835, 6B08TI085835, 1B08TI083969, 1B08TI084609, 6B08TI085835, 1B08TI087067, 6B08TI083545 October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, September 1, 2021 – September 30, 2025, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, March 15, 2021 – March 15, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligating action at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: 2023-010, 2022-013, 2021-007 Recommendation: HHSC should implement functionality into CAPPS-FIN to track when obligations of federal awards are made so that the agency is able to retrieve a list of all subawards by obligation date in order to monitor compliance with the Federal Funding Accountability and Transparency Act. Views of responsible officials: HHSC concurs with the finding.
Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster Temporary Assistance for Needy Families (TANF) Social Services Block Grant Opioid STR Block Grants for Community Mental Health Services Block Grants for Substance Abuse, Prevention, Treatment and Recovery Services ALN: 93.044, 93.045, 93.053 93.558 93.667 93.788 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Aging Cluster 2101TXOACM, 2101TXOAHD, 2101TXOANS, 2101TXOASS 2201TXOACM, 2201TXOAHD, 2201TXOANS, 2201TXOASS, 2301TXOACM, 2301TXOAHD, 2301TXOANS, 2301TXOASS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2401TXOASS October 1, 2020 – September 30, 2023, October 1, 2021 – September 30, 2024, October 1, 2022 – September 30, 2024, October 1, 2022 – September 30, 2025 and October 1, 2023 – September 30, 2025 TANF 2301TXTANF, 2301TXTAN3, 2401TXTANF, 2401TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2023 – September 30, 2024 Social Services Block Grant 2201TXSOSR, 2301TXSOSR and 2401TXSOSR October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 and October 1, 2023 – September 30, 2025 Opioid STR 6H79TI083288 and 5H79TI085747 September 30, 2020 – September 29, 2023, September 30, 2022 – September 29, 2024 Block Grants for Community Mental Health Services 6B09SM083999, 1B09SM085994, 6B09SM085994, 1B09SM087322, 1B09SM087345, 6B09SM087345, 1B09SM09610, 1B09SM085385, 6B09SM089380, 1B09SM085913, 1B09SM089984 March 15, 2021 – March 14, 2024, October 1, 2021 – September 30, 2023, October 17, 2022 – October 16, 2024, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, September 1, 2021 – September 30, 2025, September 30, 2023 – September 29, 2025, September 30, 2024 – September 29, 2026 Block Grants for Substance Use Prevention, Treatment and Recovery Services 6B08TI084673, 1B08TI085835, 6B08TI085835, 1B08TI083969, 1B08TI084609, 6B08TI085835, 1B08TI087067, 6B08TI083545 October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, September 1, 2021 – September 30, 2025, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, March 15, 2021 – March 15, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligating action at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: 2023-010, 2022-013, 2021-007 Recommendation: HHSC should implement functionality into CAPPS-FIN to track when obligations of federal awards are made so that the agency is able to retrieve a list of all subawards by obligation date in order to monitor compliance with the Federal Funding Accountability and Transparency Act. Views of responsible officials: HHSC concurs with the finding.
Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster Temporary Assistance for Needy Families (TANF) Social Services Block Grant Opioid STR Block Grants for Community Mental Health Services Block Grants for Substance Abuse, Prevention, Treatment and Recovery Services ALN: 93.044, 93.045, 93.053 93.558 93.667 93.788 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Aging Cluster 2101TXOACM, 2101TXOAHD, 2101TXOANS, 2101TXOASS 2201TXOACM, 2201TXOAHD, 2201TXOANS, 2201TXOASS, 2301TXOACM, 2301TXOAHD, 2301TXOANS, 2301TXOASS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2401TXOASS October 1, 2020 – September 30, 2023, October 1, 2021 – September 30, 2024, October 1, 2022 – September 30, 2024, October 1, 2022 – September 30, 2025 and October 1, 2023 – September 30, 2025 TANF 2301TXTANF, 2301TXTAN3, 2401TXTANF, 2401TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2023 – September 30, 2024 Social Services Block Grant 2201TXSOSR, 2301TXSOSR and 2401TXSOSR October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 and October 1, 2023 – September 30, 2025 Opioid STR 6H79TI083288 and 5H79TI085747 September 30, 2020 – September 29, 2023, September 30, 2022 – September 29, 2024 Block Grants for Community Mental Health Services 6B09SM083999, 1B09SM085994, 6B09SM085994, 1B09SM087322, 1B09SM087345, 6B09SM087345, 1B09SM09610, 1B09SM085385, 6B09SM089380, 1B09SM085913, 1B09SM089984 March 15, 2021 – March 14, 2024, October 1, 2021 – September 30, 2023, October 17, 2022 – October 16, 2024, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, September 1, 2021 – September 30, 2025, September 30, 2023 – September 29, 2025, September 30, 2024 – September 29, 2026 Block Grants for Substance Use Prevention, Treatment and Recovery Services 6B08TI084673, 1B08TI085835, 6B08TI085835, 1B08TI083969, 1B08TI084609, 6B08TI085835, 1B08TI087067, 6B08TI083545 October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, September 1, 2021 – September 30, 2025, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, March 15, 2021 – March 15, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligating action at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: 2023-010, 2022-013, 2021-007 Recommendation: HHSC should implement functionality into CAPPS-FIN to track when obligations of federal awards are made so that the agency is able to retrieve a list of all subawards by obligation date in order to monitor compliance with the Federal Funding Accountability and Transparency Act. Views of responsible officials: HHSC concurs with the finding.
Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster Temporary Assistance for Needy Families (TANF) Social Services Block Grant Opioid STR Block Grants for Community Mental Health Services Block Grants for Substance Abuse, Prevention, Treatment and Recovery Services ALN: 93.044, 93.045, 93.053 93.558 93.667 93.788 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Aging Cluster 2101TXOACM, 2101TXOAHD, 2101TXOANS, 2101TXOASS 2201TXOACM, 2201TXOAHD, 2201TXOANS, 2201TXOASS, 2301TXOACM, 2301TXOAHD, 2301TXOANS, 2301TXOASS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2401TXOASS October 1, 2020 – September 30, 2023, October 1, 2021 – September 30, 2024, October 1, 2022 – September 30, 2024, October 1, 2022 – September 30, 2025 and October 1, 2023 – September 30, 2025 TANF 2301TXTANF, 2301TXTAN3, 2401TXTANF, 2401TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2023 – September 30, 2024 Social Services Block Grant 2201TXSOSR, 2301TXSOSR and 2401TXSOSR October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 and October 1, 2023 – September 30, 2025 Opioid STR 6H79TI083288 and 5H79TI085747 September 30, 2020 – September 29, 2023, September 30, 2022 – September 29, 2024 Block Grants for Community Mental Health Services 6B09SM083999, 1B09SM085994, 6B09SM085994, 1B09SM087322, 1B09SM087345, 6B09SM087345, 1B09SM09610, 1B09SM085385, 6B09SM089380, 1B09SM085913, 1B09SM089984 March 15, 2021 – March 14, 2024, October 1, 2021 – September 30, 2023, October 17, 2022 – October 16, 2024, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, September 1, 2021 – September 30, 2025, September 30, 2023 – September 29, 2025, September 30, 2024 – September 29, 2026 Block Grants for Substance Use Prevention, Treatment and Recovery Services 6B08TI084673, 1B08TI085835, 6B08TI085835, 1B08TI083969, 1B08TI084609, 6B08TI085835, 1B08TI087067, 6B08TI083545 October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, September 1, 2021 – September 30, 2025, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, March 15, 2021 – March 15, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligating action at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: 2023-010, 2022-013, 2021-007 Recommendation: HHSC should implement functionality into CAPPS-FIN to track when obligations of federal awards are made so that the agency is able to retrieve a list of all subawards by obligation date in order to monitor compliance with the Federal Funding Accountability and Transparency Act. Views of responsible officials: HHSC concurs with the finding.
Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster Temporary Assistance for Needy Families (TANF) Social Services Block Grant Opioid STR Block Grants for Community Mental Health Services Block Grants for Substance Abuse, Prevention, Treatment and Recovery Services ALN: 93.044, 93.045, 93.053 93.558 93.667 93.788 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Aging Cluster 2101TXOACM, 2101TXOAHD, 2101TXOANS, 2101TXOASS 2201TXOACM, 2201TXOAHD, 2201TXOANS, 2201TXOASS, 2301TXOACM, 2301TXOAHD, 2301TXOANS, 2301TXOASS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2401TXOASS October 1, 2020 – September 30, 2023, October 1, 2021 – September 30, 2024, October 1, 2022 – September 30, 2024, October 1, 2022 – September 30, 2025 and October 1, 2023 – September 30, 2025 TANF 2301TXTANF, 2301TXTAN3, 2401TXTANF, 2401TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2023 – September 30, 2024 Social Services Block Grant 2201TXSOSR, 2301TXSOSR and 2401TXSOSR October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 and October 1, 2023 – September 30, 2025 Opioid STR 6H79TI083288 and 5H79TI085747 September 30, 2020 – September 29, 2023, September 30, 2022 – September 29, 2024 Block Grants for Community Mental Health Services 6B09SM083999, 1B09SM085994, 6B09SM085994, 1B09SM087322, 1B09SM087345, 6B09SM087345, 1B09SM09610, 1B09SM085385, 6B09SM089380, 1B09SM085913, 1B09SM089984 March 15, 2021 – March 14, 2024, October 1, 2021 – September 30, 2023, October 17, 2022 – October 16, 2024, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, September 1, 2021 – September 30, 2025, September 30, 2023 – September 29, 2025, September 30, 2024 – September 29, 2026 Block Grants for Substance Use Prevention, Treatment and Recovery Services 6B08TI084673, 1B08TI085835, 6B08TI085835, 1B08TI083969, 1B08TI084609, 6B08TI085835, 1B08TI087067, 6B08TI083545 October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, September 1, 2021 – September 30, 2025, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, March 15, 2021 – March 15, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligating action at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: 2023-010, 2022-013, 2021-007 Recommendation: HHSC should implement functionality into CAPPS-FIN to track when obligations of federal awards are made so that the agency is able to retrieve a list of all subawards by obligation date in order to monitor compliance with the Federal Funding Accountability and Transparency Act. Views of responsible officials: HHSC concurs with the finding.
Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster Temporary Assistance for Needy Families (TANF) Social Services Block Grant Opioid STR Block Grants for Community Mental Health Services Block Grants for Substance Abuse, Prevention, Treatment and Recovery Services ALN: 93.044, 93.045, 93.053 93.558 93.667 93.788 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Aging Cluster 2101TXOACM, 2101TXOAHD, 2101TXOANS, 2101TXOASS 2201TXOACM, 2201TXOAHD, 2201TXOANS, 2201TXOASS, 2301TXOACM, 2301TXOAHD, 2301TXOANS, 2301TXOASS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2401TXOASS October 1, 2020 – September 30, 2023, October 1, 2021 – September 30, 2024, October 1, 2022 – September 30, 2024, October 1, 2022 – September 30, 2025 and October 1, 2023 – September 30, 2025 TANF 2301TXTANF, 2301TXTAN3, 2401TXTANF, 2401TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2023 – September 30, 2024 Social Services Block Grant 2201TXSOSR, 2301TXSOSR and 2401TXSOSR October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 and October 1, 2023 – September 30, 2025 Opioid STR 6H79TI083288 and 5H79TI085747 September 30, 2020 – September 29, 2023, September 30, 2022 – September 29, 2024 Block Grants for Community Mental Health Services 6B09SM083999, 1B09SM085994, 6B09SM085994, 1B09SM087322, 1B09SM087345, 6B09SM087345, 1B09SM09610, 1B09SM085385, 6B09SM089380, 1B09SM085913, 1B09SM089984 March 15, 2021 – March 14, 2024, October 1, 2021 – September 30, 2023, October 17, 2022 – October 16, 2024, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, September 1, 2021 – September 30, 2025, September 30, 2023 – September 29, 2025, September 30, 2024 – September 29, 2026 Block Grants for Substance Use Prevention, Treatment and Recovery Services 6B08TI084673, 1B08TI085835, 6B08TI085835, 1B08TI083969, 1B08TI084609, 6B08TI085835, 1B08TI087067, 6B08TI083545 October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, September 1, 2021 – September 30, 2025, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, March 15, 2021 – March 15, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligating action at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: 2023-010, 2022-013, 2021-007 Recommendation: HHSC should implement functionality into CAPPS-FIN to track when obligations of federal awards are made so that the agency is able to retrieve a list of all subawards by obligation date in order to monitor compliance with the Federal Funding Accountability and Transparency Act. Views of responsible officials: HHSC concurs with the finding.
Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster Temporary Assistance for Needy Families (TANF) Social Services Block Grant Opioid STR Block Grants for Community Mental Health Services Block Grants for Substance Abuse, Prevention, Treatment and Recovery Services ALN: 93.044, 93.045, 93.053 93.558 93.667 93.788 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Aging Cluster 2101TXOACM, 2101TXOAHD, 2101TXOANS, 2101TXOASS 2201TXOACM, 2201TXOAHD, 2201TXOANS, 2201TXOASS, 2301TXOACM, 2301TXOAHD, 2301TXOANS, 2301TXOASS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2401TXOASS October 1, 2020 – September 30, 2023, October 1, 2021 – September 30, 2024, October 1, 2022 – September 30, 2024, October 1, 2022 – September 30, 2025 and October 1, 2023 – September 30, 2025 TANF 2301TXTANF, 2301TXTAN3, 2401TXTANF, 2401TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2023 – September 30, 2024 Social Services Block Grant 2201TXSOSR, 2301TXSOSR and 2401TXSOSR October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 and October 1, 2023 – September 30, 2025 Opioid STR 6H79TI083288 and 5H79TI085747 September 30, 2020 – September 29, 2023, September 30, 2022 – September 29, 2024 Block Grants for Community Mental Health Services 6B09SM083999, 1B09SM085994, 6B09SM085994, 1B09SM087322, 1B09SM087345, 6B09SM087345, 1B09SM09610, 1B09SM085385, 6B09SM089380, 1B09SM085913, 1B09SM089984 March 15, 2021 – March 14, 2024, October 1, 2021 – September 30, 2023, October 17, 2022 – October 16, 2024, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, September 1, 2021 – September 30, 2025, September 30, 2023 – September 29, 2025, September 30, 2024 – September 29, 2026 Block Grants for Substance Use Prevention, Treatment and Recovery Services 6B08TI084673, 1B08TI085835, 6B08TI085835, 1B08TI083969, 1B08TI084609, 6B08TI085835, 1B08TI087067, 6B08TI083545 October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, September 1, 2021 – September 30, 2025, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, March 15, 2021 – March 15, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligating action at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: 2023-010, 2022-013, 2021-007 Recommendation: HHSC should implement functionality into CAPPS-FIN to track when obligations of federal awards are made so that the agency is able to retrieve a list of all subawards by obligation date in order to monitor compliance with the Federal Funding Accountability and Transparency Act. Views of responsible officials: HHSC concurs with the finding.
Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster Temporary Assistance for Needy Families (TANF) Social Services Block Grant Opioid STR Block Grants for Community Mental Health Services Block Grants for Substance Abuse, Prevention, Treatment and Recovery Services ALN: 93.044, 93.045, 93.053 93.558 93.667 93.788 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Aging Cluster 2101TXOACM, 2101TXOAHD, 2101TXOANS, 2101TXOASS 2201TXOACM, 2201TXOAHD, 2201TXOANS, 2201TXOASS, 2301TXOACM, 2301TXOAHD, 2301TXOANS, 2301TXOASS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2401TXOASS October 1, 2020 – September 30, 2023, October 1, 2021 – September 30, 2024, October 1, 2022 – September 30, 2024, October 1, 2022 – September 30, 2025 and October 1, 2023 – September 30, 2025 TANF 2301TXTANF, 2301TXTAN3, 2401TXTANF, 2401TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2023 – September 30, 2024 Social Services Block Grant 2201TXSOSR, 2301TXSOSR and 2401TXSOSR October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 and October 1, 2023 – September 30, 2025 Opioid STR 6H79TI083288 and 5H79TI085747 September 30, 2020 – September 29, 2023, September 30, 2022 – September 29, 2024 Block Grants for Community Mental Health Services 6B09SM083999, 1B09SM085994, 6B09SM085994, 1B09SM087322, 1B09SM087345, 6B09SM087345, 1B09SM09610, 1B09SM085385, 6B09SM089380, 1B09SM085913, 1B09SM089984 March 15, 2021 – March 14, 2024, October 1, 2021 – September 30, 2023, October 17, 2022 – October 16, 2024, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, September 1, 2021 – September 30, 2025, September 30, 2023 – September 29, 2025, September 30, 2024 – September 29, 2026 Block Grants for Substance Use Prevention, Treatment and Recovery Services 6B08TI084673, 1B08TI085835, 6B08TI085835, 1B08TI083969, 1B08TI084609, 6B08TI085835, 1B08TI087067, 6B08TI083545 October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, September 1, 2021 – September 30, 2025, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, March 15, 2021 – March 15, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligating action at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: 2023-010, 2022-013, 2021-007 Recommendation: HHSC should implement functionality into CAPPS-FIN to track when obligations of federal awards are made so that the agency is able to retrieve a list of all subawards by obligation date in order to monitor compliance with the Federal Funding Accountability and Transparency Act. Views of responsible officials: HHSC concurs with the finding.
Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster Temporary Assistance for Needy Families (TANF) Social Services Block Grant Opioid STR Block Grants for Community Mental Health Services Block Grants for Substance Abuse, Prevention, Treatment and Recovery Services ALN: 93.044, 93.045, 93.053 93.558 93.667 93.788 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Aging Cluster 2101TXOACM, 2101TXOAHD, 2101TXOANS, 2101TXOASS 2201TXOACM, 2201TXOAHD, 2201TXOANS, 2201TXOASS, 2301TXOACM, 2301TXOAHD, 2301TXOANS, 2301TXOASS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2401TXOASS October 1, 2020 – September 30, 2023, October 1, 2021 – September 30, 2024, October 1, 2022 – September 30, 2024, October 1, 2022 – September 30, 2025 and October 1, 2023 – September 30, 2025 TANF 2301TXTANF, 2301TXTAN3, 2401TXTANF, 2401TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2023 – September 30, 2024 Social Services Block Grant 2201TXSOSR, 2301TXSOSR and 2401TXSOSR October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 and October 1, 2023 – September 30, 2025 Opioid STR 6H79TI083288 and 5H79TI085747 September 30, 2020 – September 29, 2023, September 30, 2022 – September 29, 2024 Block Grants for Community Mental Health Services 6B09SM083999, 1B09SM085994, 6B09SM085994, 1B09SM087322, 1B09SM087345, 6B09SM087345, 1B09SM09610, 1B09SM085385, 6B09SM089380, 1B09SM085913, 1B09SM089984 March 15, 2021 – March 14, 2024, October 1, 2021 – September 30, 2023, October 17, 2022 – October 16, 2024, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, September 1, 2021 – September 30, 2025, September 30, 2023 – September 29, 2025, September 30, 2024 – September 29, 2026 Block Grants for Substance Use Prevention, Treatment and Recovery Services 6B08TI084673, 1B08TI085835, 6B08TI085835, 1B08TI083969, 1B08TI084609, 6B08TI085835, 1B08TI087067, 6B08TI083545 October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, September 1, 2021 – September 30, 2025, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, March 15, 2021 – March 15, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligating action at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: 2023-010, 2022-013, 2021-007 Recommendation: HHSC should implement functionality into CAPPS-FIN to track when obligations of federal awards are made so that the agency is able to retrieve a list of all subawards by obligation date in order to monitor compliance with the Federal Funding Accountability and Transparency Act. Views of responsible officials: HHSC concurs with the finding.
Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster Temporary Assistance for Needy Families (TANF) Social Services Block Grant Opioid STR Block Grants for Community Mental Health Services Block Grants for Substance Abuse, Prevention, Treatment and Recovery Services ALN: 93.044, 93.045, 93.053 93.558 93.667 93.788 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Aging Cluster 2101TXOACM, 2101TXOAHD, 2101TXOANS, 2101TXOASS 2201TXOACM, 2201TXOAHD, 2201TXOANS, 2201TXOASS, 2301TXOACM, 2301TXOAHD, 2301TXOANS, 2301TXOASS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2401TXOASS October 1, 2020 – September 30, 2023, October 1, 2021 – September 30, 2024, October 1, 2022 – September 30, 2024, October 1, 2022 – September 30, 2025 and October 1, 2023 – September 30, 2025 TANF 2301TXTANF, 2301TXTAN3, 2401TXTANF, 2401TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2023 – September 30, 2024 Social Services Block Grant 2201TXSOSR, 2301TXSOSR and 2401TXSOSR October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 and October 1, 2023 – September 30, 2025 Opioid STR 6H79TI083288 and 5H79TI085747 September 30, 2020 – September 29, 2023, September 30, 2022 – September 29, 2024 Block Grants for Community Mental Health Services 6B09SM083999, 1B09SM085994, 6B09SM085994, 1B09SM087322, 1B09SM087345, 6B09SM087345, 1B09SM09610, 1B09SM085385, 6B09SM089380, 1B09SM085913, 1B09SM089984 March 15, 2021 – March 14, 2024, October 1, 2021 – September 30, 2023, October 17, 2022 – October 16, 2024, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, September 1, 2021 – September 30, 2025, September 30, 2023 – September 29, 2025, September 30, 2024 – September 29, 2026 Block Grants for Substance Use Prevention, Treatment and Recovery Services 6B08TI084673, 1B08TI085835, 6B08TI085835, 1B08TI083969, 1B08TI084609, 6B08TI085835, 1B08TI087067, 6B08TI083545 October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, September 1, 2021 – September 30, 2025, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, March 15, 2021 – March 15, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligating action at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: 2023-010, 2022-013, 2021-007 Recommendation: HHSC should implement functionality into CAPPS-FIN to track when obligations of federal awards are made so that the agency is able to retrieve a list of all subawards by obligation date in order to monitor compliance with the Federal Funding Accountability and Transparency Act. Views of responsible officials: HHSC concurs with the finding.
Reporting – FFATA Subawards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Aging Cluster Temporary Assistance for Needy Families (TANF) Social Services Block Grant Opioid STR Block Grants for Community Mental Health Services Block Grants for Substance Abuse, Prevention, Treatment and Recovery Services ALN: 93.044, 93.045, 93.053 93.558 93.667 93.788 93.958 93.959 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Aging Cluster 2101TXOACM, 2101TXOAHD, 2101TXOANS, 2101TXOASS 2201TXOACM, 2201TXOAHD, 2201TXOANS, 2201TXOASS, 2301TXOACM, 2301TXOAHD, 2301TXOANS, 2301TXOASS, 2401TXOACM, 2401TXOAHD, 2401TXOANS, 2401TXOASS October 1, 2020 – September 30, 2023, October 1, 2021 – September 30, 2024, October 1, 2022 – September 30, 2024, October 1, 2022 – September 30, 2025 and October 1, 2023 – September 30, 2025 TANF 2301TXTANF, 2301TXTAN3, 2401TXTANF, 2401TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2023 – September 30, 2024 Social Services Block Grant 2201TXSOSR, 2301TXSOSR and 2401TXSOSR October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024 and October 1, 2023 – September 30, 2025 Opioid STR 6H79TI083288 and 5H79TI085747 September 30, 2020 – September 29, 2023, September 30, 2022 – September 29, 2024 Block Grants for Community Mental Health Services 6B09SM083999, 1B09SM085994, 6B09SM085994, 1B09SM087322, 1B09SM087345, 6B09SM087345, 1B09SM09610, 1B09SM085385, 6B09SM089380, 1B09SM085913, 1B09SM089984 March 15, 2021 – March 14, 2024, October 1, 2021 – September 30, 2023, October 17, 2022 – October 16, 2024, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, September 1, 2021 – September 30, 2025, September 30, 2023 – September 29, 2025, September 30, 2024 – September 29, 2026 Block Grants for Substance Use Prevention, Treatment and Recovery Services 6B08TI084673, 1B08TI085835, 6B08TI085835, 1B08TI083969, 1B08TI084609, 6B08TI085835, 1B08TI087067, 6B08TI083545 October 1, 2021 – September 30, 2023, October 1, 2022 – September 30, 2024, September 1, 2021 – September 30, 2025, October 1, 2022 – September 30, 2024, October 1, 2023 – September 30, 2025, March 15, 2021 – March 15, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Material Weakness in Internal Control over Compliance and Material Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109- 282), as amended by Section 6202 of Public Law 110-252, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) no later than the last day of the month following the month in which the subaward/subaward amendment obligation was made or the subcontract award/subcontract modification was made. Condition: The HHSC Federal Funds Office (FFO) is responsible for submitting all required subawards in the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). A standard FFATA Reporting template has been created by the FFO that includes all required elements to be submitted. Program departments must complete and submit the template to the FFO for all federal subawards with amounts over $30,000 by the 15th of every month to be included in that month’s submission. Currently, it is the responsibility of the individual program departments to ensure that each obligating action at or over $30,000 is reported in the FFATA Reporting Template no later than the end of the next month in which the obligation was made. Due to system limitations, there is no central tracking of award obligations. Thus, HHSC was unable to provide a population of first-tier subawards of $30,000 or more that were obligated during the fiscal year and required to be submitted in FSRS. Accordingly, we were unable to select a sample and test for internal controls over compliance or compliance. Questioned costs: None. Context: See “Condition.” Cause: CAPPS-FIN, HHSC’s system of record, does not have the capability to track the date of obligation of federal awards. Effect: Failure to report all subawards $30,000 or greater in FSRS will result in noncompliance with terms of the federal grant guidelines. Repeat Finding: 2023-010, 2022-013, 2021-007 Recommendation: HHSC should implement functionality into CAPPS-FIN to track when obligations of federal awards are made so that the agency is able to retrieve a list of all subawards by obligation date in order to monitor compliance with the Federal Funding Accountability and Transparency Act. Views of responsible officials: HHSC concurs with the finding.
Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) Social Services Block Grant (SSBG) ALN: 93.558 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2401TXTANF, 2401TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2023 – September 30, 2024 SSBG 2401TXSOSR October 1, 2023 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in the subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes the subrecipient’s unique entity identifier (UEI). Condition: Audit procedures included a review of subaward agreements for required information. We noted the following instances of noncompliance: Temporary Assistance for Needy Families – The UEI was not included in eight of the eight agreements selected for testing. The start and end dates for the agreements were September 1, 2020 – August 31, 2024. Social Services Block Grant –The UEI was not included in one of the 19 agreements selected for testing. The start and end dates for the agreement was January 1, 2021 – August 31, 2024. Questioned costs: None. Context: See “Condition.” Cause: The current contract review process to ensure all required elements are included per 2 CFR 200 §200.332 prior to execution is not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: 2023-011 Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: HHSC concurs with the finding.
Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) Social Services Block Grant (SSBG) ALN: 93.558 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2401TXTANF, 2401TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2023 – September 30, 2024 SSBG 2401TXSOSR October 1, 2023 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in the subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes the subrecipient’s unique entity identifier (UEI). Condition: Audit procedures included a review of subaward agreements for required information. We noted the following instances of noncompliance: Temporary Assistance for Needy Families – The UEI was not included in eight of the eight agreements selected for testing. The start and end dates for the agreements were September 1, 2020 – August 31, 2024. Social Services Block Grant –The UEI was not included in one of the 19 agreements selected for testing. The start and end dates for the agreement was January 1, 2021 – August 31, 2024. Questioned costs: None. Context: See “Condition.” Cause: The current contract review process to ensure all required elements are included per 2 CFR 200 §200.332 prior to execution is not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: 2023-011 Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: HHSC concurs with the finding.
Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Temporary Assistance for Needy Families (TANF) Social Services Block Grant (SSBG) ALN: 93.558 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: TANF 2301TXTANF, 2301TXTAN3, 2401TXTANF, 2401TXTAN3 October 1, 2022 – September 30, 2023 and October 1, 2023 – September 30, 2024 SSBG 2401TXSOSR October 1, 2023 – September 30, 2025 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information at the time of the subaward and if any of these data elements change, include the changes in the subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes the subrecipient’s unique entity identifier (UEI). Condition: Audit procedures included a review of subaward agreements for required information. We noted the following instances of noncompliance: Temporary Assistance for Needy Families – The UEI was not included in eight of the eight agreements selected for testing. The start and end dates for the agreements were September 1, 2020 – August 31, 2024. Social Services Block Grant –The UEI was not included in one of the 19 agreements selected for testing. The start and end dates for the agreement was January 1, 2021 – August 31, 2024. Questioned costs: None. Context: See “Condition.” Cause: The current contract review process to ensure all required elements are included per 2 CFR 200 §200.332 prior to execution is not at the correct precision level. Effect: Providing incomplete information to subrecipients may result in inaccurate reporting by the subrecipients and ultimately by HHSC. Repeat Finding: 2023-011 Recommendation: We recommend management enhance existing controls around the review of all subaward agreements to ensure that all pass-through agreements include each of the required elements by 2 CFR §200.332. Views of responsible officials: HHSC concurs with the finding.
Period of Performance Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Social Services Block Grant 2401TXSOSR October 1, 2023 – September 30, 2025 Block Grants for Community Mental Health Services 1B09SM085994, 6B09SM085994 October 1, 2021 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403(h) cost must be incurred during the approved budget period. The Federal awarding agency is authorized, at its discretion, to waive prior written approvals to carry forward unobligated balances to subsequent budget periods pursuant to § 200.308(e)(3). Condition: For awards with period of performance beginning dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the first month of the award. For awards with period of performance end dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the last month and after the period of performance end date. We noted the following instances of noncompliance: Social Services Block Grant (SSBG) – Audit procedures included testing 40 sampled transactions from projects with period of performance beginning dates during the fiscal year totaling $5,034. Two of the expenditures, totaling $486, were related to costs incurred prior to the period of performance begin date. The Project Period Start Date per the grant award was October 1, 2023, however costs were incurred on September 6, 2023 and September 11, 2023. Block Grants for Community Mental Health Services (MHBG) – Audit procedures included testing 40 sampled transactions, totaling $1,695,512, from projects with period of performance end dates during the fiscal year for which the obligation had not been paid as of the end of the period of performance. Twelve of the expenditures, totaling $312,929, were not paid within 120 days of the period of performance end date, which is the allowed time period to liquidate obligations. The required liquidation date was December 29, 2023; however, these obligations were paid between January 2, 2024 and April 11, 2024. Questioned costs: Social Services Block Grant: $486 Block Grants for Community Mental Health Services: $312,929 Context: See “Condition.” Cause: The two exceptions for SSBG were related to travel costs where the employee’s supervisor approved the transaction, which was coded to the incorrect grant. For the exceptions noted in the liquidation period testing for MHBG, the late payments are due to the HHSC’s reconciliation and closeout process not being performed in a timely manner. Effect: Ineffective internal controls may result in questioned costs and noncompliance with the terms of the grant. In addition, costs paid with non-federal sources remain in the population which is being included on the schedule of federal expenditures (SEFA) for the current fiscal year. Repeat Finding: 2023-016 Recommendation: HHSC should provide additional training over its review process to ensure that reviewers are verifying that transactions are posted to the proper grant. Additionally, HHSC should verify that all obligations incurred are liquidated during the closeout process and adjustments are not made subsequent to closeout. Views of responsible officials: HHSC concurs with the finding.
Period of Performance Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Social Services Block Grant 2401TXSOSR October 1, 2023 – September 30, 2025 Block Grants for Community Mental Health Services 1B09SM085994, 6B09SM085994 October 1, 2021 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403(h) cost must be incurred during the approved budget period. The Federal awarding agency is authorized, at its discretion, to waive prior written approvals to carry forward unobligated balances to subsequent budget periods pursuant to § 200.308(e)(3). Condition: For awards with period of performance beginning dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the first month of the award. For awards with period of performance end dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the last month and after the period of performance end date. We noted the following instances of noncompliance: Social Services Block Grant (SSBG) – Audit procedures included testing 40 sampled transactions from projects with period of performance beginning dates during the fiscal year totaling $5,034. Two of the expenditures, totaling $486, were related to costs incurred prior to the period of performance begin date. The Project Period Start Date per the grant award was October 1, 2023, however costs were incurred on September 6, 2023 and September 11, 2023. Block Grants for Community Mental Health Services (MHBG) – Audit procedures included testing 40 sampled transactions, totaling $1,695,512, from projects with period of performance end dates during the fiscal year for which the obligation had not been paid as of the end of the period of performance. Twelve of the expenditures, totaling $312,929, were not paid within 120 days of the period of performance end date, which is the allowed time period to liquidate obligations. The required liquidation date was December 29, 2023; however, these obligations were paid between January 2, 2024 and April 11, 2024. Questioned costs: Social Services Block Grant: $486 Block Grants for Community Mental Health Services: $312,929 Context: See “Condition.” Cause: The two exceptions for SSBG were related to travel costs where the employee’s supervisor approved the transaction, which was coded to the incorrect grant. For the exceptions noted in the liquidation period testing for MHBG, the late payments are due to the HHSC’s reconciliation and closeout process not being performed in a timely manner. Effect: Ineffective internal controls may result in questioned costs and noncompliance with the terms of the grant. In addition, costs paid with non-federal sources remain in the population which is being included on the schedule of federal expenditures (SEFA) for the current fiscal year. Repeat Finding: 2023-016 Recommendation: HHSC should provide additional training over its review process to ensure that reviewers are verifying that transactions are posted to the proper grant. Additionally, HHSC should verify that all obligations incurred are liquidated during the closeout process and adjustments are not made subsequent to closeout. Views of responsible officials: HHSC concurs with the finding.
Period of Performance Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Social Services Block Grant 2401TXSOSR October 1, 2023 – September 30, 2025 Block Grants for Community Mental Health Services 1B09SM085994, 6B09SM085994 October 1, 2021 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403(h) cost must be incurred during the approved budget period. The Federal awarding agency is authorized, at its discretion, to waive prior written approvals to carry forward unobligated balances to subsequent budget periods pursuant to § 200.308(e)(3). Condition: For awards with period of performance beginning dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the first month of the award. For awards with period of performance end dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the last month and after the period of performance end date. We noted the following instances of noncompliance: Social Services Block Grant (SSBG) – Audit procedures included testing 40 sampled transactions from projects with period of performance beginning dates during the fiscal year totaling $5,034. Two of the expenditures, totaling $486, were related to costs incurred prior to the period of performance begin date. The Project Period Start Date per the grant award was October 1, 2023, however costs were incurred on September 6, 2023 and September 11, 2023. Block Grants for Community Mental Health Services (MHBG) – Audit procedures included testing 40 sampled transactions, totaling $1,695,512, from projects with period of performance end dates during the fiscal year for which the obligation had not been paid as of the end of the period of performance. Twelve of the expenditures, totaling $312,929, were not paid within 120 days of the period of performance end date, which is the allowed time period to liquidate obligations. The required liquidation date was December 29, 2023; however, these obligations were paid between January 2, 2024 and April 11, 2024. Questioned costs: Social Services Block Grant: $486 Block Grants for Community Mental Health Services: $312,929 Context: See “Condition.” Cause: The two exceptions for SSBG were related to travel costs where the employee’s supervisor approved the transaction, which was coded to the incorrect grant. For the exceptions noted in the liquidation period testing for MHBG, the late payments are due to the HHSC’s reconciliation and closeout process not being performed in a timely manner. Effect: Ineffective internal controls may result in questioned costs and noncompliance with the terms of the grant. In addition, costs paid with non-federal sources remain in the population which is being included on the schedule of federal expenditures (SEFA) for the current fiscal year. Repeat Finding: 2023-016 Recommendation: HHSC should provide additional training over its review process to ensure that reviewers are verifying that transactions are posted to the proper grant. Additionally, HHSC should verify that all obligations incurred are liquidated during the closeout process and adjustments are not made subsequent to closeout. Views of responsible officials: HHSC concurs with the finding.
Period of Performance Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant Block Grants for Community Mental Health Services ALN: 93.667 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Social Services Block Grant 2401TXSOSR October 1, 2023 – September 30, 2025 Block Grants for Community Mental Health Services 1B09SM085994, 6B09SM085994 October 1, 2021 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.403(h) cost must be incurred during the approved budget period. The Federal awarding agency is authorized, at its discretion, to waive prior written approvals to carry forward unobligated balances to subsequent budget periods pursuant to § 200.308(e)(3). Condition: For awards with period of performance beginning dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the first month of the award. For awards with period of performance end dates during the fiscal year, audit procedures included testing transactions posted to the general ledger during the last month and after the period of performance end date. We noted the following instances of noncompliance: Social Services Block Grant (SSBG) – Audit procedures included testing 40 sampled transactions from projects with period of performance beginning dates during the fiscal year totaling $5,034. Two of the expenditures, totaling $486, were related to costs incurred prior to the period of performance begin date. The Project Period Start Date per the grant award was October 1, 2023, however costs were incurred on September 6, 2023 and September 11, 2023. Block Grants for Community Mental Health Services (MHBG) – Audit procedures included testing 40 sampled transactions, totaling $1,695,512, from projects with period of performance end dates during the fiscal year for which the obligation had not been paid as of the end of the period of performance. Twelve of the expenditures, totaling $312,929, were not paid within 120 days of the period of performance end date, which is the allowed time period to liquidate obligations. The required liquidation date was December 29, 2023; however, these obligations were paid between January 2, 2024 and April 11, 2024. Questioned costs: Social Services Block Grant: $486 Block Grants for Community Mental Health Services: $312,929 Context: See “Condition.” Cause: The two exceptions for SSBG were related to travel costs where the employee’s supervisor approved the transaction, which was coded to the incorrect grant. For the exceptions noted in the liquidation period testing for MHBG, the late payments are due to the HHSC’s reconciliation and closeout process not being performed in a timely manner. Effect: Ineffective internal controls may result in questioned costs and noncompliance with the terms of the grant. In addition, costs paid with non-federal sources remain in the population which is being included on the schedule of federal expenditures (SEFA) for the current fiscal year. Repeat Finding: 2023-016 Recommendation: HHSC should provide additional training over its review process to ensure that reviewers are verifying that transactions are posted to the proper grant. Additionally, HHSC should verify that all obligations incurred are liquidated during the closeout process and adjustments are not made subsequent to closeout. Views of responsible officials: HHSC concurs with the finding.
Reporting Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Social Services Block Grant ALN: 93.667 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2201TXSOSR October 1, 2021 – September 30, 2023 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The 42 USC 1397e requires states and territories to submit to the federal administering agency, the Office of Community Services, an annual Post Expenditure Report no later than six months following the close of the fiscal year. The report includes certain critical key line information including: TANF Funds Transferred into SSBG –Amount reported on this line item should be consistent with the TANF federal financial report (ACF-196R). The Federal Funds Office (FFO) is responsible for the completeness, accuracy, and timely submission of the Post Expenditure Report. Federal Reporting Fiscal Management personnel are responsible for proper reporting and submission of the ACF-196R. Condition: During testing of key line items for the FY2023 Annual Post Expenditure Report submitted in March 2024, we noted that TANF Funds Transferred into SSBG, as reported on the ACF-196R report was $45,104,976, however, the amount reported on the FY2023 Post Expenditure Report was $40,351,905, resulting in a variance of $4,753,071. Questioned costs: None Context: See “Condition.” Cause: FFO did not properly coordinate efforts with the Federal Reporting personnel to ensure the amounts noted on the ACF-196R were consistent with the amount on the Post Expenditure Report. Effect: Improperly designed internal controls over reporting may result in a misstatement of amounts reported on federal reports. Repeat Finding: 2023-013 Recommendation: We recommend the FFO coordinate with the appropriate Federal Reporting Team personnel regarding amounts noted for the TANF Funds Transferred into SSBG to ensure the amount in the Post Expenditure Report matches with the amount in the ACF-196R. Views of responsible officials: HHSC concurs with the finding.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Block Grants for Community Mental Health Services ALN: 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: B09SM087345 October 1, 2022 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Audit procedures included a sample of 40 general disbursements, totaling $440,324, incurred during the fiscal year. For one general disbursement selected, totaling $7,185, there was no evidence of review and approval of the disbursement prior to payment. Total general disbursements, which excludes salaries and benefits and indirect costs, incurred for the program during the fiscal year was $796,639. Questioned costs: None. Context: See “Condition.” Cause: Management did not retain evidence of the approval for this transaction. Effect: Failure to review expenditure transactions pertinent to a federal award and maintain adequate documentation evidencing review may result in noncompliance with grant terms and conditions as well as payment of unallowed costs. Repeat Finding: No Recommendation: HHSC should enforce policies and procedures to ensure all disbursements are reviewed and approved prior to payment. Views of responsible officials: HHSC concurs with the finding.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Block Grants for Community Mental Health Services ALN: 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: B09SM087345 October 1, 2022 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Audit procedures included a sample of 40 general disbursements, totaling $440,324, incurred during the fiscal year. For one general disbursement selected, totaling $7,185, there was no evidence of review and approval of the disbursement prior to payment. Total general disbursements, which excludes salaries and benefits and indirect costs, incurred for the program during the fiscal year was $796,639. Questioned costs: None. Context: See “Condition.” Cause: Management did not retain evidence of the approval for this transaction. Effect: Failure to review expenditure transactions pertinent to a federal award and maintain adequate documentation evidencing review may result in noncompliance with grant terms and conditions as well as payment of unallowed costs. Repeat Finding: No Recommendation: HHSC should enforce policies and procedures to ensure all disbursements are reviewed and approved prior to payment. Views of responsible officials: HHSC concurs with the finding.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Block Grants for Community Mental Health Services ALN: 93.958 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: B09SM087345 October 1, 2022 – September 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Audit procedures included a sample of 40 general disbursements, totaling $440,324, incurred during the fiscal year. For one general disbursement selected, totaling $7,185, there was no evidence of review and approval of the disbursement prior to payment. Total general disbursements, which excludes salaries and benefits and indirect costs, incurred for the program during the fiscal year was $796,639. Questioned costs: None. Context: See “Condition.” Cause: Management did not retain evidence of the approval for this transaction. Effect: Failure to review expenditure transactions pertinent to a federal award and maintain adequate documentation evidencing review may result in noncompliance with grant terms and conditions as well as payment of unallowed costs. Repeat Finding: No Recommendation: HHSC should enforce policies and procedures to ensure all disbursements are reviewed and approved prior to payment. Views of responsible officials: HHSC concurs with the finding.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility, Reporting, Special Tests and Provisions – Provider Eligibility – Information Technology – Vendor Management Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2405TXIMPL, 2405TX5000, 2405TX5MAP, October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: HHSC contracted with Conduent State Healthcare, LLC (Conduent Pharmacy) to administer the Vendor Drug Program for the Medicaid Cluster through March 2024. Conduent Pharmacy performs services related to processing pharmacy claims and managing the rebate administration function for the HHSC Vendor Drug Program. HHSC utilizes the Conduent Drug Rebate Administration Management (DRAMS) application to validate and bill drug manufacturers for rebates and the Open Systems Plus (OS+) application to construct drug coverage rules related to payment for pharmacy services. A Service Organization Controls 1 (SOC 1) Type 2 report validates the suitability of design and operating effectiveness of the controls to meet the designed control objectives of internal controls over financial reporting. This report is critical to ensure that the service organization has the required controls infrastructure in place to process HHSC’s data. Testing of controls infrastructure includes, but is not limited to, physical security, logical controls, and change management. We noted that the SOC 1 Type 2 report for the third-party administrator for DRAMS and OS+ was not completed for the seven month period during which the applications were being utilized. As such, HHSC was unable to evaluate whether reasonable controls were in place over this third-party service to determine if they are secure, accurate and available, and support processing integrity during the period in which the applications were being used. Questioned costs: None Context: See “Condition.” Cause: DRAMS and OS+ were used to manage the Vendor Drug Program through March 2024, after which HHSC moved to a different third-party administrator. Despite HHSC’s request, Conduent did not engage an auditor to complete the SOC 1 Type 2 report for the period September 1, 2023 – March 30, 2024. Effect: Failure to obtain and review findings and complementary user entity controls within a third-party vendor’s SOC 1 Type 2 report may result in inappropriate reliance on the third-party vendor’s internal controls, which could result in noncompliance. Repeat finding: No Recommendation: HHSC should strengthen its vendor management policies to ensure SOC 1 Type 2 reports are completed and received in a timeframe that allows management to determine if the third-party services are secure, accurate and available, and support processing integrity for the fiscal year. This may be accomplished by including clauses into vendor contracts to require SOC 1 Type 2 reports or allow HHSC rights to audit if alternative procedures are necessary. Views of responsible officials: HHSC concurs with the finding.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility, Reporting, Special Tests and Provisions – Provider Eligibility – Information Technology – Vendor Management Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2405TXIMPL, 2405TX5000, 2405TX5MAP, October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: HHSC contracted with Conduent State Healthcare, LLC (Conduent Pharmacy) to administer the Vendor Drug Program for the Medicaid Cluster through March 2024. Conduent Pharmacy performs services related to processing pharmacy claims and managing the rebate administration function for the HHSC Vendor Drug Program. HHSC utilizes the Conduent Drug Rebate Administration Management (DRAMS) application to validate and bill drug manufacturers for rebates and the Open Systems Plus (OS+) application to construct drug coverage rules related to payment for pharmacy services. A Service Organization Controls 1 (SOC 1) Type 2 report validates the suitability of design and operating effectiveness of the controls to meet the designed control objectives of internal controls over financial reporting. This report is critical to ensure that the service organization has the required controls infrastructure in place to process HHSC’s data. Testing of controls infrastructure includes, but is not limited to, physical security, logical controls, and change management. We noted that the SOC 1 Type 2 report for the third-party administrator for DRAMS and OS+ was not completed for the seven month period during which the applications were being utilized. As such, HHSC was unable to evaluate whether reasonable controls were in place over this third-party service to determine if they are secure, accurate and available, and support processing integrity during the period in which the applications were being used. Questioned costs: None Context: See “Condition.” Cause: DRAMS and OS+ were used to manage the Vendor Drug Program through March 2024, after which HHSC moved to a different third-party administrator. Despite HHSC’s request, Conduent did not engage an auditor to complete the SOC 1 Type 2 report for the period September 1, 2023 – March 30, 2024. Effect: Failure to obtain and review findings and complementary user entity controls within a third-party vendor’s SOC 1 Type 2 report may result in inappropriate reliance on the third-party vendor’s internal controls, which could result in noncompliance. Repeat finding: No Recommendation: HHSC should strengthen its vendor management policies to ensure SOC 1 Type 2 reports are completed and received in a timeframe that allows management to determine if the third-party services are secure, accurate and available, and support processing integrity for the fiscal year. This may be accomplished by including clauses into vendor contracts to require SOC 1 Type 2 reports or allow HHSC rights to audit if alternative procedures are necessary. Views of responsible officials: HHSC concurs with the finding.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility, Reporting, Special Tests and Provisions – Provider Eligibility – Information Technology – Vendor Management Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2405TXIMPL, 2405TX5000, 2405TX5MAP, October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: HHSC contracted with Conduent State Healthcare, LLC (Conduent Pharmacy) to administer the Vendor Drug Program for the Medicaid Cluster through March 2024. Conduent Pharmacy performs services related to processing pharmacy claims and managing the rebate administration function for the HHSC Vendor Drug Program. HHSC utilizes the Conduent Drug Rebate Administration Management (DRAMS) application to validate and bill drug manufacturers for rebates and the Open Systems Plus (OS+) application to construct drug coverage rules related to payment for pharmacy services. A Service Organization Controls 1 (SOC 1) Type 2 report validates the suitability of design and operating effectiveness of the controls to meet the designed control objectives of internal controls over financial reporting. This report is critical to ensure that the service organization has the required controls infrastructure in place to process HHSC’s data. Testing of controls infrastructure includes, but is not limited to, physical security, logical controls, and change management. We noted that the SOC 1 Type 2 report for the third-party administrator for DRAMS and OS+ was not completed for the seven month period during which the applications were being utilized. As such, HHSC was unable to evaluate whether reasonable controls were in place over this third-party service to determine if they are secure, accurate and available, and support processing integrity during the period in which the applications were being used. Questioned costs: None Context: See “Condition.” Cause: DRAMS and OS+ were used to manage the Vendor Drug Program through March 2024, after which HHSC moved to a different third-party administrator. Despite HHSC’s request, Conduent did not engage an auditor to complete the SOC 1 Type 2 report for the period September 1, 2023 – March 30, 2024. Effect: Failure to obtain and review findings and complementary user entity controls within a third-party vendor’s SOC 1 Type 2 report may result in inappropriate reliance on the third-party vendor’s internal controls, which could result in noncompliance. Repeat finding: No Recommendation: HHSC should strengthen its vendor management policies to ensure SOC 1 Type 2 reports are completed and received in a timeframe that allows management to determine if the third-party services are secure, accurate and available, and support processing integrity for the fiscal year. This may be accomplished by including clauses into vendor contracts to require SOC 1 Type 2 reports or allow HHSC rights to audit if alternative procedures are necessary. Views of responsible officials: HHSC concurs with the finding.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility, Reporting, Special Tests and Provisions – Provider Eligibility – Information Technology – Vendor Management Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2405TXIMPL, 2405TX5000, 2405TX5MAP, October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: HHSC contracted with Conduent State Healthcare, LLC (Conduent Pharmacy) to administer the Vendor Drug Program for the Medicaid Cluster through March 2024. Conduent Pharmacy performs services related to processing pharmacy claims and managing the rebate administration function for the HHSC Vendor Drug Program. HHSC utilizes the Conduent Drug Rebate Administration Management (DRAMS) application to validate and bill drug manufacturers for rebates and the Open Systems Plus (OS+) application to construct drug coverage rules related to payment for pharmacy services. A Service Organization Controls 1 (SOC 1) Type 2 report validates the suitability of design and operating effectiveness of the controls to meet the designed control objectives of internal controls over financial reporting. This report is critical to ensure that the service organization has the required controls infrastructure in place to process HHSC’s data. Testing of controls infrastructure includes, but is not limited to, physical security, logical controls, and change management. We noted that the SOC 1 Type 2 report for the third-party administrator for DRAMS and OS+ was not completed for the seven month period during which the applications were being utilized. As such, HHSC was unable to evaluate whether reasonable controls were in place over this third-party service to determine if they are secure, accurate and available, and support processing integrity during the period in which the applications were being used. Questioned costs: None Context: See “Condition.” Cause: DRAMS and OS+ were used to manage the Vendor Drug Program through March 2024, after which HHSC moved to a different third-party administrator. Despite HHSC’s request, Conduent did not engage an auditor to complete the SOC 1 Type 2 report for the period September 1, 2023 – March 30, 2024. Effect: Failure to obtain and review findings and complementary user entity controls within a third-party vendor’s SOC 1 Type 2 report may result in inappropriate reliance on the third-party vendor’s internal controls, which could result in noncompliance. Repeat finding: No Recommendation: HHSC should strengthen its vendor management policies to ensure SOC 1 Type 2 reports are completed and received in a timeframe that allows management to determine if the third-party services are secure, accurate and available, and support processing integrity for the fiscal year. This may be accomplished by including clauses into vendor contracts to require SOC 1 Type 2 reports or allow HHSC rights to audit if alternative procedures are necessary. Views of responsible officials: HHSC concurs with the finding.
Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility, Reporting, Special Tests and Provisions – Provider Eligibility – Information Technology – Vendor Management Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2405TXIMPL, 2405TX5000, 2405TX5MAP, October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: HHSC contracted with Conduent State Healthcare, LLC (Conduent Pharmacy) to administer the Vendor Drug Program for the Medicaid Cluster through March 2024. Conduent Pharmacy performs services related to processing pharmacy claims and managing the rebate administration function for the HHSC Vendor Drug Program. HHSC utilizes the Conduent Drug Rebate Administration Management (DRAMS) application to validate and bill drug manufacturers for rebates and the Open Systems Plus (OS+) application to construct drug coverage rules related to payment for pharmacy services. A Service Organization Controls 1 (SOC 1) Type 2 report validates the suitability of design and operating effectiveness of the controls to meet the designed control objectives of internal controls over financial reporting. This report is critical to ensure that the service organization has the required controls infrastructure in place to process HHSC’s data. Testing of controls infrastructure includes, but is not limited to, physical security, logical controls, and change management. We noted that the SOC 1 Type 2 report for the third-party administrator for DRAMS and OS+ was not completed for the seven month period during which the applications were being utilized. As such, HHSC was unable to evaluate whether reasonable controls were in place over this third-party service to determine if they are secure, accurate and available, and support processing integrity during the period in which the applications were being used. Questioned costs: None Context: See “Condition.” Cause: DRAMS and OS+ were used to manage the Vendor Drug Program through March 2024, after which HHSC moved to a different third-party administrator. Despite HHSC’s request, Conduent did not engage an auditor to complete the SOC 1 Type 2 report for the period September 1, 2023 – March 30, 2024. Effect: Failure to obtain and review findings and complementary user entity controls within a third-party vendor’s SOC 1 Type 2 report may result in inappropriate reliance on the third-party vendor’s internal controls, which could result in noncompliance. Repeat finding: No Recommendation: HHSC should strengthen its vendor management policies to ensure SOC 1 Type 2 reports are completed and received in a timeframe that allows management to determine if the third-party services are secure, accurate and available, and support processing integrity for the fiscal year. This may be accomplished by including clauses into vendor contracts to require SOC 1 Type 2 reports or allow HHSC rights to audit if alternative procedures are necessary. Views of responsible officials: HHSC concurs with the finding.
Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP; 2405TXIMPL, 2405TX5000, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample. Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR 435.912(c)(3), the determination of eligibility for any applicant may not exceed (except in unusual circumstances such as an administrative or other emergency beyond the agency’s control): Ninety days for applicants who apply for Medicaid on the basis of disability; and Forty-five days for all other applicants. Condition: Audit procedures included a review of 60 applications for Medicaid associated with current benefit recipients. Of the 60 applications, we identified three non-disability applications for which the eligibility determination was not made within 45 days. Eligibility determinations were made 62, 93, and 124 days from the date of the respective application. Questioned costs: None. Context: See “Condition.” Cause: The exceptions noted were due to the statewide timeliness issues. All three tasks were received into the system but were not claimed or worked until after the 45 days. Once the tasks were claimed, however, the Qualified Medicare Beneficiary (QMB) benefits were certified the same day. There were no case actions in between that caused a delay in processing. Effect: Failure to process applications in a timely manner may lead to recipients not receiving benefits timely and noncompliance with grant award terms and conditions. Repeat Finding: No Recommendation: HHSC should enhance existing application processing procedures to ensure all applications are reviewed and an eligibility determination is made within the required timelines. Views of responsible officials: HHSC concurs with this recommendation.
Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP; 2405TXIMPL, 2405TX5000, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample. Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR 435.912(c)(3), the determination of eligibility for any applicant may not exceed (except in unusual circumstances such as an administrative or other emergency beyond the agency’s control): Ninety days for applicants who apply for Medicaid on the basis of disability; and Forty-five days for all other applicants. Condition: Audit procedures included a review of 60 applications for Medicaid associated with current benefit recipients. Of the 60 applications, we identified three non-disability applications for which the eligibility determination was not made within 45 days. Eligibility determinations were made 62, 93, and 124 days from the date of the respective application. Questioned costs: None. Context: See “Condition.” Cause: The exceptions noted were due to the statewide timeliness issues. All three tasks were received into the system but were not claimed or worked until after the 45 days. Once the tasks were claimed, however, the Qualified Medicare Beneficiary (QMB) benefits were certified the same day. There were no case actions in between that caused a delay in processing. Effect: Failure to process applications in a timely manner may lead to recipients not receiving benefits timely and noncompliance with grant award terms and conditions. Repeat Finding: No Recommendation: HHSC should enhance existing application processing procedures to ensure all applications are reviewed and an eligibility determination is made within the required timelines. Views of responsible officials: HHSC concurs with this recommendation.
Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP; 2405TXIMPL, 2405TX5000, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample. Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR 435.912(c)(3), the determination of eligibility for any applicant may not exceed (except in unusual circumstances such as an administrative or other emergency beyond the agency’s control): Ninety days for applicants who apply for Medicaid on the basis of disability; and Forty-five days for all other applicants. Condition: Audit procedures included a review of 60 applications for Medicaid associated with current benefit recipients. Of the 60 applications, we identified three non-disability applications for which the eligibility determination was not made within 45 days. Eligibility determinations were made 62, 93, and 124 days from the date of the respective application. Questioned costs: None. Context: See “Condition.” Cause: The exceptions noted were due to the statewide timeliness issues. All three tasks were received into the system but were not claimed or worked until after the 45 days. Once the tasks were claimed, however, the Qualified Medicare Beneficiary (QMB) benefits were certified the same day. There were no case actions in between that caused a delay in processing. Effect: Failure to process applications in a timely manner may lead to recipients not receiving benefits timely and noncompliance with grant award terms and conditions. Repeat Finding: No Recommendation: HHSC should enhance existing application processing procedures to ensure all applications are reviewed and an eligibility determination is made within the required timelines. Views of responsible officials: HHSC concurs with this recommendation.
Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP; 2405TXIMPL, 2405TX5000, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample. Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR 435.912(c)(3), the determination of eligibility for any applicant may not exceed (except in unusual circumstances such as an administrative or other emergency beyond the agency’s control): Ninety days for applicants who apply for Medicaid on the basis of disability; and Forty-five days for all other applicants. Condition: Audit procedures included a review of 60 applications for Medicaid associated with current benefit recipients. Of the 60 applications, we identified three non-disability applications for which the eligibility determination was not made within 45 days. Eligibility determinations were made 62, 93, and 124 days from the date of the respective application. Questioned costs: None. Context: See “Condition.” Cause: The exceptions noted were due to the statewide timeliness issues. All three tasks were received into the system but were not claimed or worked until after the 45 days. Once the tasks were claimed, however, the Qualified Medicare Beneficiary (QMB) benefits were certified the same day. There were no case actions in between that caused a delay in processing. Effect: Failure to process applications in a timely manner may lead to recipients not receiving benefits timely and noncompliance with grant award terms and conditions. Repeat Finding: No Recommendation: HHSC should enhance existing application processing procedures to ensure all applications are reviewed and an eligibility determination is made within the required timelines. Views of responsible officials: HHSC concurs with this recommendation.
Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP; 2405TXIMPL, 2405TX5000, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample. Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR 435.912(c)(3), the determination of eligibility for any applicant may not exceed (except in unusual circumstances such as an administrative or other emergency beyond the agency’s control): Ninety days for applicants who apply for Medicaid on the basis of disability; and Forty-five days for all other applicants. Condition: Audit procedures included a review of 60 applications for Medicaid associated with current benefit recipients. Of the 60 applications, we identified three non-disability applications for which the eligibility determination was not made within 45 days. Eligibility determinations were made 62, 93, and 124 days from the date of the respective application. Questioned costs: None. Context: See “Condition.” Cause: The exceptions noted were due to the statewide timeliness issues. All three tasks were received into the system but were not claimed or worked until after the 45 days. Once the tasks were claimed, however, the Qualified Medicare Beneficiary (QMB) benefits were certified the same day. There were no case actions in between that caused a delay in processing. Effect: Failure to process applications in a timely manner may lead to recipients not receiving benefits timely and noncompliance with grant award terms and conditions. Repeat Finding: No Recommendation: HHSC should enhance existing application processing procedures to ensure all applications are reviewed and an eligibility determination is made within the required timelines. Views of responsible officials: HHSC concurs with this recommendation.
Special Tests and Provisions – ADP Risk Analysis and System Security Review – Information Technology – Lack of Risk Assessments Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Condition: HHSC has a total of 62 in-house and third-party systems that are used in the administration of Medicaid which are required to be reviewed each biennial period. During the fiscal year 2022-2023 biennial, only five risk assessments were executed based on internal methodology or third-party assessments. Noncompliance is due to HHSC not performing risk assessments over the remaining 57 systems during the two-year period. During fiscal year 2024, no further assessments were performed and the scheduled corrective action implementation date was extended to August 31, 2025. Questioned costs: None Context: See “Condition.” Cause: HHSC is not adhering to its current policies and procedures regarding completion of the biennial ADP system security reviews. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: 2023-017 Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – ADP Risk Analysis and System Security Review – Information Technology – Lack of Risk Assessments Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Condition: HHSC has a total of 62 in-house and third-party systems that are used in the administration of Medicaid which are required to be reviewed each biennial period. During the fiscal year 2022-2023 biennial, only five risk assessments were executed based on internal methodology or third-party assessments. Noncompliance is due to HHSC not performing risk assessments over the remaining 57 systems during the two-year period. During fiscal year 2024, no further assessments were performed and the scheduled corrective action implementation date was extended to August 31, 2025. Questioned costs: None Context: See “Condition.” Cause: HHSC is not adhering to its current policies and procedures regarding completion of the biennial ADP system security reviews. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: 2023-017 Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – ADP Risk Analysis and System Security Review – Information Technology – Lack of Risk Assessments Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Condition: HHSC has a total of 62 in-house and third-party systems that are used in the administration of Medicaid which are required to be reviewed each biennial period. During the fiscal year 2022-2023 biennial, only five risk assessments were executed based on internal methodology or third-party assessments. Noncompliance is due to HHSC not performing risk assessments over the remaining 57 systems during the two-year period. During fiscal year 2024, no further assessments were performed and the scheduled corrective action implementation date was extended to August 31, 2025. Questioned costs: None Context: See “Condition.” Cause: HHSC is not adhering to its current policies and procedures regarding completion of the biennial ADP system security reviews. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: 2023-017 Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – ADP Risk Analysis and System Security Review – Information Technology – Lack of Risk Assessments Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Condition: HHSC has a total of 62 in-house and third-party systems that are used in the administration of Medicaid which are required to be reviewed each biennial period. During the fiscal year 2022-2023 biennial, only five risk assessments were executed based on internal methodology or third-party assessments. Noncompliance is due to HHSC not performing risk assessments over the remaining 57 systems during the two-year period. During fiscal year 2024, no further assessments were performed and the scheduled corrective action implementation date was extended to August 31, 2025. Questioned costs: None Context: See “Condition.” Cause: HHSC is not adhering to its current policies and procedures regarding completion of the biennial ADP system security reviews. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: 2023-017 Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – ADP Risk Analysis and System Security Review – Information Technology – Lack of Risk Assessments Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN Number: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost-effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Condition: HHSC has a total of 62 in-house and third-party systems that are used in the administration of Medicaid which are required to be reviewed each biennial period. During the fiscal year 2022-2023 biennial, only five risk assessments were executed based on internal methodology or third-party assessments. Noncompliance is due to HHSC not performing risk assessments over the remaining 57 systems during the two-year period. During fiscal year 2024, no further assessments were performed and the scheduled corrective action implementation date was extended to August 31, 2025. Questioned costs: None Context: See “Condition.” Cause: HHSC is not adhering to its current policies and procedures regarding completion of the biennial ADP system security reviews. Effect: Failure to perform risk analyses increases the risk that safeguards will not be in place over physical and data security. Repeat finding: 2023-017 Recommendation: HHSC should ensure all systems are reviewed in a two-year period. HHSC should also implement oversight controls to ensure progress toward the plan is executed during the two-year period, including resolution of remediation items. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Provider Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR § 455.414 states that HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 55 Managed Care Organization (MCO) and five Long-Term Care (LTC) providers. For two of the five LTC providers, revalidation of enrollment was not completed within the last five years. The most recent validation of enrollment for the two LTC providers was completed on September 16, 2018, and January 21, 2019. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all providers are revalidated within the last five years. Effect: Failure to revalidate provider enrollments timely may result in otherwise ineligible providers receiving Medicaid funds. Repeat Finding: 2023-018, 2022-014, 2021-008 Recommendation: HHSC should enhance existing controls to ensure all providers are re-enrolled at least once every five years. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Provider Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR § 455.414 states that HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 55 Managed Care Organization (MCO) and five Long-Term Care (LTC) providers. For two of the five LTC providers, revalidation of enrollment was not completed within the last five years. The most recent validation of enrollment for the two LTC providers was completed on September 16, 2018, and January 21, 2019. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all providers are revalidated within the last five years. Effect: Failure to revalidate provider enrollments timely may result in otherwise ineligible providers receiving Medicaid funds. Repeat Finding: 2023-018, 2022-014, 2021-008 Recommendation: HHSC should enhance existing controls to ensure all providers are re-enrolled at least once every five years. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Provider Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR § 455.414 states that HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 55 Managed Care Organization (MCO) and five Long-Term Care (LTC) providers. For two of the five LTC providers, revalidation of enrollment was not completed within the last five years. The most recent validation of enrollment for the two LTC providers was completed on September 16, 2018, and January 21, 2019. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all providers are revalidated within the last five years. Effect: Failure to revalidate provider enrollments timely may result in otherwise ineligible providers receiving Medicaid funds. Repeat Finding: 2023-018, 2022-014, 2021-008 Recommendation: HHSC should enhance existing controls to ensure all providers are re-enrolled at least once every five years. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Provider Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR § 455.414 states that HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 55 Managed Care Organization (MCO) and five Long-Term Care (LTC) providers. For two of the five LTC providers, revalidation of enrollment was not completed within the last five years. The most recent validation of enrollment for the two LTC providers was completed on September 16, 2018, and January 21, 2019. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all providers are revalidated within the last five years. Effect: Failure to revalidate provider enrollments timely may result in otherwise ineligible providers receiving Medicaid funds. Repeat Finding: 2023-018, 2022-014, 2021-008 Recommendation: HHSC should enhance existing controls to ensure all providers are re-enrolled at least once every five years. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Provider Eligibility Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: Medicaid Cluster 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 42 CFR § 455.414 states that HHSC must revalidate the enrollment of all providers regardless of provider type at least every five years. Condition: Various departments within and contractors of HHSC are responsible for ensuring medical providers are properly licensed, screened, and enrolled in the Medicaid Program including Contract Administration and Provider Monitoring (CAPM), Access and Eligibility Services (AES), Procurement and Contracting Services, and the Texas Medicaid and Healthcare Partnership. Audit procedures included a review of 55 Managed Care Organization (MCO) and five Long-Term Care (LTC) providers. For two of the five LTC providers, revalidation of enrollment was not completed within the last five years. The most recent validation of enrollment for the two LTC providers was completed on September 16, 2018, and January 21, 2019. Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all providers are revalidated within the last five years. Effect: Failure to revalidate provider enrollments timely may result in otherwise ineligible providers receiving Medicaid funds. Repeat Finding: 2023-018, 2022-014, 2021-008 Recommendation: HHSC should enhance existing controls to ensure all providers are re-enrolled at least once every five years. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Provider Health and Safety Standards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR Part 442, providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID. The standards may be modified in the state plan. Condition: HHSC outsources the verification of health and safety standards for out-of-state providers (OoS) to the Texas Medicaid Healthcare Partnership (TMHP). TMHP has a process in place to check if a OoS provider has not been disbarred or has not voluntarily withdrawn from the Medicare/Medicaid programs and as such, is still meeting the required health and safety standards. An automated monthly check is used to determine if there were any revocation or voluntarily withdrawals from the Medicaid program. The process uses TMHP's Master Provider File and the Adverse Action File. The Master Provider File is a listing of all in-state and out of state providers that TMHP is responsible for monitoring that are active in Texas programs. The Adverse Action File is a downloaded report from the CMS database that displays providers that have adverse actions against them that could potentially lead to disenrollment within programs. The automated program compares these two files, and outputs a file titled Post Enrollment DEX Report, which displays any provider matches from the two input reports. This is a monthly report that is uploaded to a shared location with HHSC Office of Inspector General (OIG). OIG then conducts manual reviews of these matches and determines if there is any action necessary to take against a provider, such as disenrollment. Audit procedures included a review of five monthly DEX reports. For one of the months selected, there was no evidence of OIG’s review of the DEX report. Questioned costs: None. Context: See “Condition.” Cause: OIG experienced staffing challenges due to retirements during the fiscal year. The review of the report was missed as responsibilities of retired employees were still in transition. Effect: Failure to perform a timely review of the monthly DEX reports could lead to payment of federal funds to ineligible OoS providers. Repeat Finding: No Recommendation: HHSC’s OIG should enhance current policies and procedures around the review of the monthly DEX reports to ensure the reviews are performed timely each month, including when there is turnover of key personnel. Views of responsible officials: HHSC's OIG concurs with the finding.
Special Tests and Provisions – Provider Health and Safety Standards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR Part 442, providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID. The standards may be modified in the state plan. Condition: HHSC outsources the verification of health and safety standards for out-of-state providers (OoS) to the Texas Medicaid Healthcare Partnership (TMHP). TMHP has a process in place to check if a OoS provider has not been disbarred or has not voluntarily withdrawn from the Medicare/Medicaid programs and as such, is still meeting the required health and safety standards. An automated monthly check is used to determine if there were any revocation or voluntarily withdrawals from the Medicaid program. The process uses TMHP's Master Provider File and the Adverse Action File. The Master Provider File is a listing of all in-state and out of state providers that TMHP is responsible for monitoring that are active in Texas programs. The Adverse Action File is a downloaded report from the CMS database that displays providers that have adverse actions against them that could potentially lead to disenrollment within programs. The automated program compares these two files, and outputs a file titled Post Enrollment DEX Report, which displays any provider matches from the two input reports. This is a monthly report that is uploaded to a shared location with HHSC Office of Inspector General (OIG). OIG then conducts manual reviews of these matches and determines if there is any action necessary to take against a provider, such as disenrollment. Audit procedures included a review of five monthly DEX reports. For one of the months selected, there was no evidence of OIG’s review of the DEX report. Questioned costs: None. Context: See “Condition.” Cause: OIG experienced staffing challenges due to retirements during the fiscal year. The review of the report was missed as responsibilities of retired employees were still in transition. Effect: Failure to perform a timely review of the monthly DEX reports could lead to payment of federal funds to ineligible OoS providers. Repeat Finding: No Recommendation: HHSC’s OIG should enhance current policies and procedures around the review of the monthly DEX reports to ensure the reviews are performed timely each month, including when there is turnover of key personnel. Views of responsible officials: HHSC's OIG concurs with the finding.
Special Tests and Provisions – Provider Health and Safety Standards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR Part 442, providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID. The standards may be modified in the state plan. Condition: HHSC outsources the verification of health and safety standards for out-of-state providers (OoS) to the Texas Medicaid Healthcare Partnership (TMHP). TMHP has a process in place to check if a OoS provider has not been disbarred or has not voluntarily withdrawn from the Medicare/Medicaid programs and as such, is still meeting the required health and safety standards. An automated monthly check is used to determine if there were any revocation or voluntarily withdrawals from the Medicaid program. The process uses TMHP's Master Provider File and the Adverse Action File. The Master Provider File is a listing of all in-state and out of state providers that TMHP is responsible for monitoring that are active in Texas programs. The Adverse Action File is a downloaded report from the CMS database that displays providers that have adverse actions against them that could potentially lead to disenrollment within programs. The automated program compares these two files, and outputs a file titled Post Enrollment DEX Report, which displays any provider matches from the two input reports. This is a monthly report that is uploaded to a shared location with HHSC Office of Inspector General (OIG). OIG then conducts manual reviews of these matches and determines if there is any action necessary to take against a provider, such as disenrollment. Audit procedures included a review of five monthly DEX reports. For one of the months selected, there was no evidence of OIG’s review of the DEX report. Questioned costs: None. Context: See “Condition.” Cause: OIG experienced staffing challenges due to retirements during the fiscal year. The review of the report was missed as responsibilities of retired employees were still in transition. Effect: Failure to perform a timely review of the monthly DEX reports could lead to payment of federal funds to ineligible OoS providers. Repeat Finding: No Recommendation: HHSC’s OIG should enhance current policies and procedures around the review of the monthly DEX reports to ensure the reviews are performed timely each month, including when there is turnover of key personnel. Views of responsible officials: HHSC's OIG concurs with the finding.
Special Tests and Provisions – Provider Health and Safety Standards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR Part 442, providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID. The standards may be modified in the state plan. Condition: HHSC outsources the verification of health and safety standards for out-of-state providers (OoS) to the Texas Medicaid Healthcare Partnership (TMHP). TMHP has a process in place to check if a OoS provider has not been disbarred or has not voluntarily withdrawn from the Medicare/Medicaid programs and as such, is still meeting the required health and safety standards. An automated monthly check is used to determine if there were any revocation or voluntarily withdrawals from the Medicaid program. The process uses TMHP's Master Provider File and the Adverse Action File. The Master Provider File is a listing of all in-state and out of state providers that TMHP is responsible for monitoring that are active in Texas programs. The Adverse Action File is a downloaded report from the CMS database that displays providers that have adverse actions against them that could potentially lead to disenrollment within programs. The automated program compares these two files, and outputs a file titled Post Enrollment DEX Report, which displays any provider matches from the two input reports. This is a monthly report that is uploaded to a shared location with HHSC Office of Inspector General (OIG). OIG then conducts manual reviews of these matches and determines if there is any action necessary to take against a provider, such as disenrollment. Audit procedures included a review of five monthly DEX reports. For one of the months selected, there was no evidence of OIG’s review of the DEX report. Questioned costs: None. Context: See “Condition.” Cause: OIG experienced staffing challenges due to retirements during the fiscal year. The review of the report was missed as responsibilities of retired employees were still in transition. Effect: Failure to perform a timely review of the monthly DEX reports could lead to payment of federal funds to ineligible OoS providers. Repeat Finding: No Recommendation: HHSC’s OIG should enhance current policies and procedures around the review of the monthly DEX reports to ensure the reviews are performed timely each month, including when there is turnover of key personnel. Views of responsible officials: HHSC's OIG concurs with the finding.
Special Tests and Provisions – Provider Health and Safety Standards Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5MAP, 2405TX5ADM October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a Statistically Valid Sample Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR Part 442, providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID. The standards may be modified in the state plan. Condition: HHSC outsources the verification of health and safety standards for out-of-state providers (OoS) to the Texas Medicaid Healthcare Partnership (TMHP). TMHP has a process in place to check if a OoS provider has not been disbarred or has not voluntarily withdrawn from the Medicare/Medicaid programs and as such, is still meeting the required health and safety standards. An automated monthly check is used to determine if there were any revocation or voluntarily withdrawals from the Medicaid program. The process uses TMHP's Master Provider File and the Adverse Action File. The Master Provider File is a listing of all in-state and out of state providers that TMHP is responsible for monitoring that are active in Texas programs. The Adverse Action File is a downloaded report from the CMS database that displays providers that have adverse actions against them that could potentially lead to disenrollment within programs. The automated program compares these two files, and outputs a file titled Post Enrollment DEX Report, which displays any provider matches from the two input reports. This is a monthly report that is uploaded to a shared location with HHSC Office of Inspector General (OIG). OIG then conducts manual reviews of these matches and determines if there is any action necessary to take against a provider, such as disenrollment. Audit procedures included a review of five monthly DEX reports. For one of the months selected, there was no evidence of OIG’s review of the DEX report. Questioned costs: None. Context: See “Condition.” Cause: OIG experienced staffing challenges due to retirements during the fiscal year. The review of the report was missed as responsibilities of retired employees were still in transition. Effect: Failure to perform a timely review of the monthly DEX reports could lead to payment of federal funds to ineligible OoS providers. Repeat Finding: No Recommendation: HHSC’s OIG should enhance current policies and procedures around the review of the monthly DEX reports to ensure the reviews are performed timely each month, including when there is turnover of key personnel. Views of responsible officials: HHSC's OIG concurs with the finding.
Special Tests and Provisions – Medical Loss Ratio (MLR) Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR section 438.8(k) - The State, through its contracts, must require each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), or Prepaid Ambulatory Health Plan (PAHP) to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC reviews MLR reports received from MCOs to verify the reports contain the required data elements. Audit procedures included a review of six MLR reports from MCOs submitted to the FRAC during the fiscal year. One of six reports did not contain two of the thirteen required elements as follows: Methodology(ies) for allocation of expenditures A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all required data elements are included in the MLR reports. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: The FRAC should enhance existing controls around the review of MLR report submissions to ensure they are complete and accurate. Views of responsible officials: HHSC concurs with the finding.
Special Tests and Provisions – Medical Loss Ratio (MLR) Federal Agency: U.S. Department of Health and Human Services Federal Program Title: Medicaid Cluster ALN: 93.775, 93.777, 93.778 Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Number and Period: 2305TXIMPL, 2305TX5MAP, 2305TX5ADM, 2405TXIMPL, 2405TX5000, 2405TX5ADM, 2405TX5MAP October 1, 2022 – September 30, 2023, July 1, 2023 – September 30, 2023, October 1, 2023 – September 30, 2024, October 1, 2023 – June 30, 2024 Statistically Valid Sample: No, and not intended to be a statistically valid sample Type of Finding: Significant Deficiency in Internal Control over Compliance and Noncompliance Criteria or specific requirement: Per 2 CFR 200.303(a), Health and Human Services Commission (HHSC) must establish and maintain effective internal control over the Federal award that provides reasonable assurance that it is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in the “Internal Control Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 42 CFR section 438.8(k) - The State, through its contracts, must require each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), or Prepaid Ambulatory Health Plan (PAHP) to submit a report to the State that includes at least the following information for each Medical Loss Ratio (MLR) reporting year: (i) Total incurred claims. (ii) Expenditures on quality improving activities. (iii) Fraud prevention activities as defined in paragraph (e)(4) of this section. (iv) Non-claims costs. (v) Premium revenue. (vi) Taxes, licensing and regulatory fees. (vii) Methodology(ies) for allocation of expenditures. (viii) Any credibility adjustment applied. (ix) The calculated MLR. (x) Any remittance owed to the State, if applicable. (xi) A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). (xii) A description of the aggregation method used under paragraph (i) of this section. (xiii) The number of member months. Condition: The Financial Reporting and Audit Coordination (FRAC) group at HHSC reviews MLR reports received from MCOs to verify the reports contain the required data elements. Audit procedures included a review of six MLR reports from MCOs submitted to the FRAC during the fiscal year. One of six reports did not contain two of the thirteen required elements as follows: Methodology(ies) for allocation of expenditures A comparison of the information reported in this paragraph with the audited financial report required under § 438.3(m). Questioned costs: None. Context: See “Condition.” Cause: Current internal controls are not at the correct precision level to ensure all required data elements are included in the MLR reports. Effect: Failure to obtain required information from MCOs pertinent to a federal award may result in noncompliance with grant terms and conditions. Repeat Finding: No Recommendation: The FRAC should enhance existing controls around the review of MLR report submissions to ensure they are complete and accurate. Views of responsible officials: HHSC concurs with the finding.