US Government Accountability Office GAO

Scale of the problem - Background

"As of September 10, 2020, the U.S. had over 6.3 million cumulative reported cases of COVID-19 and over 177,000 reported deaths, according to federal agencies. The country also continues to experience serious economic repercussions and turmoil."

Roles in supply chain

"It is critically important that HHS and FEMA work with their federal partners to define roles and responsibilities for managing the medical supply chain to sustain supply chain progress. Until HHSand FEMA work with their federal partners to immediately document roles and responsibilitiesfor supply chain management functions transitioning to HHS, they risk losing the momentum and expertise developed up to this point in the response. Additionally, without clearly defined roles and responsibilities, the federal response structure may be unable to respond to new supply chainchallenges that could emerge."

Recommendation 1 The Secretary of Health and Human Services in coordination with the Administrator of the Federal Emergency Management Agency-who head agencies leading the COVID-19 response through the Unified Coordination Group-should immediately document roles and responsibilities for supply chain management functions transitioning to the Department of Health and Human Services, including continued support from other federal partners, to ensure sufficient resources exist to sustain and make the necessary progress in stabilizing the supply chain, and address emergent supply issues for the duration of the COVID-19 pandemic.
Vaccine distribution as a project

"Multiple federal agencies continue to support the development and manufacturing of vaccines and therapeutics to prevent and treat COVID-19. These efforts are aimed at accelerating the traditional timeline to create a vaccine. As these efforts proceed, clarity on the federal government’s plans for distributing and administering vaccine, as well as timely, clear, and consistent communication to stakeholders and the public about those plans, is essential. DOD is supporting HHS in developing plans for nationwide distribution and administration of a vaccine. In September 2020, HHS indicated that it will soon send a report to Congress outlining a distribution plan, but did not provide a specific date for doing so."

Recommendation 2 The Secretary of Health and Human Services in coordination with the Administrator of the Federal Emergency Management Agency—who head agencies leading the COVID-19 response through the Unified Coordination Group—should further develop and communicate to stakeholders plans outlining specific actions the federal government will take to help mitigate remaining medical supply gaps necessary to respond to the remainder of the pandemic, including through the use of Defense Production Act authorities.
More data needed

"Data collected by the Centers for Disease Control and Prevention (CDC) suggest a disproportionate burden of COVID-19 cases, hospitalizations, and deaths exists among racial and ethnic minority groups, but GAO identified gaps in these data. To help address these gaps, on July 22, 2020, CDC released a COVID-19 Response Health Equity Strategy. However, the strategy does not assess whether having the authority to require states and jurisdictions to report race and ethnicity information is necessary to ensure CDC can collect such data. CDC’s strategy also does not specify how it will involve key stakeholders, such as health care providers, laboratories, and state and jurisdictional health departments."

"The Department of Health and Human Services plays a key role in collecting and making data available on indicators of COVID-19 burden, including cases, hospitalizations, and deaths. While race and ethnicity information is incomplete in these reported data, available data demonstrateracial and ethnic disparities in indicators of COVID-19 burden."

Recommendation 5 The Secretary of Health and Human Services, with support from the Secretary of Defense, should establish a time frame for documenting and sharing a national plan for distributing and administering COVID-19 vaccine, and in developing such a plan ensure that it is consistent with best practices for project planning and scheduling and outlines an approach for how efforts will be coordinated across federal agencies and nonfederal entities.
Reports on critically vulnerable locations

"In addition, HHS’s data on COVID-19 in nursing homes do not capture the early months of the pandemic. HHS’s Centers for Medicare & Medicaid Services (CMS) began requiring nursing homes to report COVID-19 data to CDC by May 17, 2020, starting with information as of May 8, 2020, but made reporting prior to May 8, 2020 optional. By not requiring nursing homes to submit data from the first 4 months of 2020, HHS is limiting the usefulness of the data in helping to understand the effects of COVID-19 in nursing homes. "

Recommendation 6 As the Centers for Disease Control and Prevention (CDC) implements its COVID-19 Response Health Equity Strategy, the Director of the Centers for Disease Control and Prevention should determine whether having the authority to require states and jurisdictions to report race and ethnicity information for COVID-19 cases, hospitalizations, and deaths is necessary for ensuring more complete data, and if so, seek such authority from Congress.
Cyber security attacks

"Since March 2020, malicious cyber actors have exploited COVID-19 to target organizations that make up the health care and public health critical infrastructure sector, including government entities, such as HHS. GAO has identified numerous cybersecurity weaknesses at multiple HHS component agencies, including CMS, CDC, and FDA, over the last 6 years, such as weaknesses in key safeguards to limit, prevent, and detect inappropriate access to computer resources. Additionally, GAO’s March 2019 high-risk update identified cybersecurity and safeguarding the systems supporting the nation’s critical infrastructure, such as health care, as high-risk areas. As of July 2020, CMS, FDA, and CDC had made significant progress by implementing 350 (about 81 percent) of the 434 recommendations GAO issued in previous reports to address these weaknesses."

Recommendation 16 Based on the imminent cybersecurity threats, the Secretary of Health and Human Services should expedite implementation of our prior recommendations regarding cybersecurity weaknesses at its component agencies.
The items above were selected and named by the e-Government Subgroup of the EUROSAI IT Working Group on the basis of publicly available report of the author Supreme Audit Institutions (SAI). In the same way, the Subgroup prepared the analytical assumptions and headings. All readers are encouraged to consult the original texts by the author SAIs (linked).