US Government Accountability Office GAO

As of September 10, 2020, the U.S. had over 6.3 million cumulative reported cases of COVID-19 and over 177,000 reported deaths, according to federal agencies. The country also continues to experience serious economic repercussions and turmoil.

It is critically important that HHS and FEMA work with their federal partners to define roles and responsibilities for managing the medical supply chain to sustain supply chain progress. Until HHSand FEMA work with their federal partners to immediately document roles and responsibilitiesfor supply chain management functions transitioning to HHS, they risk losing the momentum and expertise developed up to this point in the response. Additionally, without clearly defined roles and responsibilities, the federal response structure may be unable to respond to new supply chainchallenges that could emerge.

Multiple federal agencies continue to support the development and manufacturing of vaccines and therapeutics to prevent and treat COVID-19. These efforts are aimed at accelerating the traditional timeline to create a vaccine. As these efforts proceed, clarity on the federal government’s plans for distributing and administering vaccine, as well as timely, clear, and consistent communication to stakeholders and the public about those plans, is essential. DOD is supporting HHS in developing plans for nationwide distribution and administration of a vaccine. In September 2020, HHS indicated that it will soon send a report to Congress outlining a distribution plan, but did not provide a specific date for doing so.

Data collected by the Centers for Disease Control and Prevention (CDC) suggest a disproportionate burden of COVID-19 cases, hospitalizations, and deaths exists among racial and ethnic minority groups, but GAO identified gaps in these data. To help address these gaps, on July 22, 2020, CDC released a COVID-19 Response Health Equity Strategy. However, the strategy does not assess whether having the authority to require states and jurisdictions to report race and ethnicity information is necessary to ensure CDC can collect such data. CDC’s strategy also does not specify how it will involve key stakeholders, such as health care providers, laboratories, and state and jurisdictional health departments.

The Department of Health and Human Services plays a key role in collecting and making data available on indicators of COVID-19 burden, including cases, hospitalizations, and deaths. While race and ethnicity information is incomplete in these reported data, available data demonstrateracial and ethnic disparities in indicators of COVID-19 burden.

In addition, HHS’s data on COVID-19 in nursing homes do not capture the early months of the pandemic. HHS’s Centers for Medicare & Medicaid Services (CMS) began requiring nursing homes to report COVID-19 data to CDC by May 17, 2020, starting with information as of May 8, 2020, but made reporting prior to May 8, 2020 optional. By not requiring nursing homes to submit data from the first 4 months of 2020, HHS is limiting the usefulness of the data in helping to understand the effects of COVID-19 in nursing homes.

Since March 2020, malicious cyber actors have exploited COVID-19 to target organizations that make up the health care and public health critical infrastructure sector, including government entities, such as HHS. GAO has identified numerous cybersecurity weaknesses at multiple HHS component agencies, including CMS, CDC, and FDA, over the last 6 years, such as weaknesses in key safeguards to limit, prevent, and detect inappropriate access to computer resources. Additionally, GAO’s March 2019 high-risk update identified cybersecurity and safeguarding the systems supporting the nation’s critical infrastructure, such as health care, as high-risk areas. As of July 2020, CMS, FDA, and CDC had made significant progress by implementing 350 (about 81 percent) of the 434 recommendations GAO issued in previous reports to address these weaknesses.