Department of Health and Human Services OFFICE OF INSPECTOR GENERAL CDC'S VACCINES FOR CHILDREN PROGRAM RECIPIENTS DID NOT CONDUCT SITE VISITS AT SOME PROVIDERS AS REQUIRED Inquiries about this report may be addressed to the Office of Public Affairs at Public.Affairs@oig.hhs.gov. Amy J. Frontz Deputy Inspector General for Audit Services September 2023 A-09-22-01000 Office of Inspector General https://oig.hhs.gov The mission of the Office of Inspector General (OIG) is to provide objective oversight to promote the economy, efficiency, effectiveness, and integrity of the Department of Health and Human Services (HHS) programs, as well as the health and welfare of the people they serve. Established by Public Law No. 95-452, as amended, OIG carries out its mission through audits, investigations, and evaluations conducted by the following operating components: Office of Audit Services. OAS provides auditing services for HHS, either by conducting audits with its own audit resources or by overseeing audit work done by others. The audits examine the performance of HHS programs, funding recipients, and contractors in carrying out their respective responsibilities and provide independent assessments of HHS programs and operations to reduce waste, abuse, and mismanagement. Office of Evaluation and Inspections. OEI's national evaluations provide HHS, Congress, and the public with timely, useful, and reliable information on significant issues. To promote impact, OEI reports also provide practical recommendations for improving program operations. Office of Investigations. OI's criminal, civil, and administrative investigations of fraud and misconduct related to HHS programs and operations often lead to criminal convictions, administrative sanctions, and civil monetary penalties. OI's nationwide network of investigators collaborates with the Department of Justice and other Federal, State, and local law enforcement authorities. OI works with public health entities to minimize adverse patient impacts following enforcement operations. OI also provides security and protection for the Secretary and other senior HHS officials. Office of Counsel to the Inspector General. OCIG provides legal advice to OIG on HHS programs and OIG's internal operations. The law office also imposes exclusions and civil monetary penalties, monitors Corporate Integrity Agreements, and represents HHS's interests in False Claims Act cases. In addition, OCIG publishes advisory opinions, compliance program guidance documents, fraud alerts, and other resources regarding compliance considerations, the anti-kickback statute, and other OIG enforcement authorities. Notices THIS REPORT IS AVAILABLE TO THE PUBLIC at https://oig.hhs.gov Section 8M of the Inspector General Act, 5 U.S.C. App., requires that OIG post its publicly available reports on the OIG website. OFFICE OF AUDIT SERVICES FINDINGS AND OPINIONS The designation of financial or management practices as questionable, a recommendation for the disallowance of costs incurred or claimed, and any other conclusions and recommendations in this report represent the findings and opinions of OAS. Authorized officials of the HHS operating divisions will make final determination on these matters. Report in Brief Date: September 2023 Report No. A-09-22-01000 Why OIG Did This Audit CDC's Vaccines for Children Program Recipients The Vaccines for Children (VFC) program provides vaccines at no cost Did Not Conduct Site Visits at Some Providers to children whose parents or as Required guardians may not be able to afford them, which helps ensure that all children have a better chance of What OIG Found CDC's VFC program recipients conducted enrollment site visits for all newly receiving recommended vaccinations enrolled and reenrolling VFC providers as required. However, recipients did on schedule. The Centers for Disease not meet all program requirements for conducting compliance site visits and Control and Prevention (CDC) storage and handling site visits. Specifically, recipients did not: (1) conduct requires that program recipients compliance site visits in a timely manner at 11,499 of 39,120 enrolled and conduct three types of provider site active providers (29 percent), (2) conduct storage and handling site visits at visits (enrollment, compliance, and either of the 2 CDC-approved depot providers, (3) conduct storage and storage and handling), which allow handling site visits for at least 5 percent of their providers, and (4) verify that recipients to determine whether providers completed followup actions by the deadlines for 33,316 of 127,594 vaccines are stored, handled, and issues (26 percent) identified during compliance and storage and handling administered in accordance with the site visits. laws and policies governing the VFC program. However, multiple State CDC officials stated that staffing constraints and the COVID-19 pandemic were auditors' reports identified overdue reasons that program recipients did not conduct site visits at some providers site visits, site visits that were not as required. CDC officials also stated that, during the COVID-19 pandemic, conducted, and overdue followup CDC and recipients were focused on the priority of COVID-19 vaccination actions for compliance issues. program development and vaccine distribution, some providers were temporarily closed, and travel was restricted. In addition, we found that CDC Our objective was to determine did not have internal written policies and procedures for CDC's monitoring and whether CDC's VFC program oversight activities, including oversight of recipients' site visits at providers. recipients conducted site visits at Finally, CDC's Provider Education, Assessment, and Reporting online system enrolled and active VFC providers did not have interactive reminders or alerts related to overdue site visits and according to program requirements. followup actions. Because recipients did not conduct site visits as required or verify that providers completed followup actions to address identified How OIG Did This Audit compliance issues, CDC and recipients could not ensure that providers were We identified 39,120 providers and complying with VFC program requirements. 2 CDC-approved depot providers that were enrolled and active at any point from July 1, 2020, through June 30, What OIG Recommends and CDC Comments We recommend that CDC: (1) work with program recipients to implement a 2021. We reviewed 3 years' worth of plan and timeline to conduct the required site visits that are overdue and data for all enrollment, compliance, verify the completion of followup actions that had not been completed by the and storage and handling site visits deadlines and (2) develop an action plan to enforce site visit requirements by and reviewed the data for more than CDC's planned date of July 1, 2023. The report lists two more procedural 127,000 followup actions associated recommendations. CDC concurred with our recommendations and described with these site visits. actions that it had taken or planned to take to address our recommendations, including working with recipients that have overdue site visits to develop an implementation plan and timeline for conducting those site visits and developing an action plan to provide guidance to recipients for site visits. The full report can be found at https://oig.hhs.gov/oas/reports/region9/92201000.asp. TABLE OF CONTENTS INTRODUCTION ............................................................................................................................... 1 Why We Did This Audit ....................................................................................................... 1 Objective ............................................................................................................................. 1 Background ......................................................................................................................... 1 Vaccines for Children Program ............................................................................... 1 VFC Program Management..................................................................................... 2 Program Recipients' Site Visits and Related Followup Actions .............................. 3 CDC's Provider Education, Assessment, and Reporting Online System ................. 4 Impact of COVID-19 Pandemic on the VFC Program .............................................. 5 How We Conducted This Audit ........................................................................................... 6 FINDINGS ......................................................................................................................................... 6 Program Recipients Did Not Conduct Compliance Site Visits in a Timely Manner at Some Providers ............................................................................................................ 7 Program Recipients Did Not Conduct Storage and Handling Site Visits at Either of the CDC-Approved Depot Providers ............................................................. 8 Most Program Recipients Did Not Conduct Storage and Handling Site Visits at a Minimum of 5 Percent of Providers .......................................................................... 8 Program Recipients Did Not Verify That Providers Completed Followup Actions by the Deadline ................................................................................................................ 9 Site Visits Were Not Conducted and Followup Actions Were Not Completed Because of Recipients' Staffing Constraints and CDC's Lack of Written Policies........... 10 CONCLUSION ................................................................................................................................. 11 RECOMMENDATIONS ................................................................................................................... 11 CDC COMMENTS AND OFFICE OF INSPECTOR GENERAL RESPONSE............................................ 11 APPENDICES A: Audit Scope and Methodology ..................................................................................... 13 B: CDC Comments ............................................................................................................. 15 CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits at Some Providers as Required (A-09-22-01000) INTRODUCTION WHY WE DID THIS AUDIT The Vaccines for Children (VFC) program provides vaccines at no cost to children whose parents or guardians may not be able to afford them, which helps ensure that all children have a better chance of receiving recommended vaccinations on schedule. The Centers for Disease Control and Prevention (CDC) provides funding for the VFC program through a cooperative agreement with program recipients-i.e., State health departments and certain local and territorial public health agencies. One of CDC's requirements is that program recipients conduct site visits at VFC providers. Site visits allow recipients to determine whether vaccines are stored, handled, and administered in accordance with the laws and policies governing the VFC program. COVID-19 vaccines were not administered as part of the VFC program but were administered as part of a separate COVID-19 vaccine program. Multiple State auditors' reports identified overdue site visits, site visits that were not conducted, and overdue followup actions for compliance issues discovered during site visits of VFC providers. 1 Therefore, we conducted this audit to determine whether program recipients nationwide complied with VFC program requirements for site visits at enrolled and active providers. 2 OBJECTIVE Our objective was to determine whether CDC's VFC program recipients conducted site visits at enrolled and active VFC providers according to program requirements. BACKGROUND Vaccines for Children Program Authorized by section 1928 of the Social Security Act, the VFC program is an entitlement program (a right granted by law) for eligible children. A child is eligible for the VFC program if the child is younger than 19 years of age and is one of the following: eligible for the Medicaid 1 The State auditors' reports were for the States of California, Connecticut, and Illinois for fiscal year ended June 30, 2019. In addition, a prior Office of Inspector General report Vaccines for Children Program: Vulnerabilities in Vaccine Management (OEI-04-10-00430), issued June 5, 2012, examined the extent to which selected VFC providers and program recipients adhered to CDC's requirements for vaccine management. 2 To enroll in the VFC program, a provider must have an enrollment site visit, and to remain active in the program, the provider must order vaccines every 12 months. CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits at Some Providers as Required (A-09-22-01000) 1 program, uninsured, underinsured, or an American Indian or Alaska Native (Social Security Act § 1928(b)(2)(A)). 3 The VFC program provides vaccines at no cost to children who might not otherwise be vaccinated because of inability to pay. This program helps ensure that all children have a better chance of getting their recommended vaccines on schedule and has helped prevent disease and save lives. The vaccines provided protect children against chickenpox, diphtheria, measles, rubella, tetanus, pertussis, and other diseases. In fiscal years 2020 and 2021, CDC's funding for the VFC program totaled more than $4.5 billion and $3.8 billion, respectively, for vaccine direct assistance (purchase of vaccines) and for program operations and infrastructure (program oversight, quality improvement, and vaccine management). CDC awards funding to program recipients for VFC program operations and infrastructure through cooperative agreements. CDC also refers to program recipients as "awardees," "grantees," and "immunization programs." (In this report, we use "program recipients" or "recipients.") Cooperative agreement funding is awarded by budget periods, which run from July 1 through June 30. VFC Program Management CDC is responsible for policy development and implementation of the VFC program. CDC administers the VFC program at the national level through its National Center for Immunization and Respiratory Diseases (NCIRD). Within NCIRD, the Immunization Services Division's Program Operations Branch provides policy guidance and oversight for the VFC program, provides technical assistance to program recipients on all program components, and monitors program recipients' performance. CDC buys vaccines at a discount and distributes them to VFC providers at the direction of program recipients. To manage the VFC program, recipients perform many tasks, including recruiting and enrolling providers in the program, evaluating performance, providing quality assurance, completing surveys, and conducting site visits at providers. A VFC provider is any health care provider location that is licensed or otherwise authorized by a State to administer pediatric vaccines and is enrolled in the VFC program. CDC-approved depots are considered VFC providers; however, they only store vaccines and do not administer them. 3 "Underinsured" means the child has health insurance but that insurance does not cover vaccines or does not cover certain vaccines or covers vaccines but has a fixed dollar limit or cap for vaccines. Once that fixed dollar amount is reached, a child is then eligible for the VFC program. Underinsured children are eligible to receive vaccines only at Federally Qualified Health Centers or Rural Health Clinics. CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits at Some Providers as Required (A-09-22-01000) 2 There are 61 program recipients for the 50 States, the District of Columbia, 5 territories, and 5 cities.4 We identified 39,122 VFC providers that participated in the VFC program during our audit period. Program Recipients' Site Visits and Related Followup Actions CDC's Immunization Program Operations Manual requires that: (1) recipients and providers adhere to VFC requirements and guidance for all areas as outlined in CDC's VFC Operations Guide (Operations Guide) and (2) recipients conduct site visits at VFC providers (Unit II, chapter C). To ensure the quality of VFC vaccines and the integrity of the VFC program, the Operations Guide requires recipients to conduct: Enrollment site visits educate • an enrollment site visit for all new and reenrolling providers on implementing VFC VFC providers before they receive VFC vaccines, program requirements and assess providers' storage and handling • compliance site visits for all enrolled and active equipment. Compliance site visits VFC providers within 12 months of enrollment evaluate whether providers are and every 24 months thereafter, 5 complying with and understand program requirements. Storage and • scheduled storage and handling site visits at handling site visits assess providers' CDC-approved depot providers every 12 months, compliance with and knowledge of requirements for storing and handling and vaccines. • unannounced storage and handling site visits at a minimum of 5 percent of VFC providers during each cooperative agreement budget period. Site visits allow recipients to determine provider compliance with VFC program requirements, including requirements for vaccine eligibility screening and documentation, accountability, and management. Site visits also evaluate whether vaccines are stored, handled, and administered properly. 6 The goal is to ensure that VFC-eligible children are receiving properly managed and viable vaccines. Recipients also use site visits to identify areas in which providers are doing well and areas needing additional followup, and to provide training for providers on program requirements. 4 The five territories are the Commonwealth of Puerto Rico, U.S. Virgin Islands, American Samoa, Guam, and the Northern Mariana Islands. The five cities are Chicago, Houston, New York City, Philadelphia, and San Antonio. 5 Recipients are not required to conduct compliance site visits at CDC-approved depots. 6 Proper storage and handling of vaccines ensures that they are kept at the correct temperatures. Vaccines exposed to too much heat, cold, or light may lose their potency, which can render them less effective or even useless, and unable to provide immunity for vaccinated individuals. CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits at Some Providers as Required (A-09-22-01000) 3 After a compliance or storage and handling site visit has been conducted, the recipient must discuss the outcome with the provider and agree on a plan with followup actions and deadlines for addressing identified compliance issues or opportunities for improvement. Followup actions are mandatory corrective actions that providers must implement within a given timeframe. Examples of followup actions include but are not limited to documenting screening of patient eligibility for vaccines, documenting the temperature of vaccine storage units, removing expired vaccines from storage units, and placing appropriate thermometers in storage units. CDC's Provider Education, Assessment, and Reporting Online System The Operations Guide requires that program recipients use CDC's Provider Education, Assessment, and Reporting (PEAR) online system to document provider site visits and any compliance issues identified during those visits. PEAR contains reviewer guides that recipients must use to conduct site visits, with a series of questions that recipients must address during each visit. For each question, onsite or followup actions are specified to address identified compliance issues. Each followup action includes a due date for completion, ranging from immediate (onsite actions) to 6 months after the site visit. Followup actions may require action by either the provider or the recipient, or both. An example of a required recipient action would be conducting a followup site visit to verify completion of a followup action by the provider. PEAR serves as an oversight management tool for both CDC and program recipients, as discussed in the following sections. CDC's Management of the VFC Program Using the PEAR Online System PEAR serves as an oversight management tool for CDC. According to CDC officials, as part of its oversight of the VFC program, CDC performed annual testing of PEAR to ensure data validity and system integrity, performed an annual review of PEAR dashboards (which are graphical, real-time representations of data in PEAR) and reports, and routinely analyzed PEAR data. Additionally, before the COVID-19 pandemic, as part of its oversight, CDC conducted regular technical assistance site visits at all 61 recipients annually to review each recipient's data, dashboards, and reports, and addressed overdue site visits and followup actions. Program Recipients' Management of the VFC Program Using the PEAR Online System PEAR also serves as an oversight management tool for recipients. PEAR collects relevant VFC data to support overall program activities and is used to document recipients' quality assurance activities, capture recipients' compliance with various policies and reporting requirements, and note provider noncompliance when applicable. CDC requires recipients to use PEAR to: (1) document followup actions for compliance issues identified during site visits and (2) monitor and evaluate program performance. PEAR enables recipients to track providers' progress on followup actions and to maintain information on other contacts (e.g., by email or phone) with CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits at Some Providers as Required (A-09-22-01000) 4 VFC providers unrelated to site visits. Recipients can use the PEAR dashboards and reports to monitor provider and program level issues and trends. Impact of the COVID-19 Pandemic on the VFC Program CDC officials described to us the impact Figure 1: The Number of Site Visits That Program of the COVID-19 pandemic on the VFC Recipients Conducted Significantly Decreased program, especially with respect to Starting in March 2020 and Gradually Increased recipients' ability to conduct site visits. Over the Remainder of 2020 and in 2021 Staffing constraints, travel restrictions, re-prioritizing of resources, and temporary provider closures were all reasons that CDC offered to explain why recipients delayed site visits. According to CDC officials, because of CDC's own staffing constraints, CDC delayed its work on developing internal written policies and procedures for program oversight. Key staff were deployed for multiple extended periods to support COVID-19-related activities, which required delaying or suspending routine calls with recipients and annual site visits to provide technical assistance to recipients. CDC suspended all provider site visits by recipients in mid-March 2020 but required recipients to submit plans for ensuring providers' proper storage and handling of vaccines. In mid-May 2020, CDC allowed recipients to resume in-person site visits at their discretion. In addition, CDC authorized hybrid site visits in July 2020 and virtual site visits in August 2020. 7 Figure 1 shows the number of site visits of each type conducted from July 1, 2018, through June 30, 2021, by quarter. The variations in the number of site visits conducted reflected the changes in CDC's guidance. 7 A hybrid visit is a compliance site visit that is conducted partly in-person (onsite) and partly remotely. A virtual visit is an enrollment, compliance, or storage and handling site visit conducted entirely remotely. CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits at Some Providers as Required (A-09-22-01000) 5 HOW WE CONDUCTED THIS AUDIT We reviewed CDC's operations manuals and guidance related to VFC program requirements for site visits at providers. We identified 39,122 providers, consisting of 39,120 providers that administered VFC vaccines and 2 CDC-approved depot providers, that were enrolled and active at any point from July 1, 2020, through June 30, 2021 (audit period). 8 To determine whether the 61 program recipients conducted the required site visits at providers, we reviewed 3 years' worth of PEAR data (July 1, 2018, through June 30, 2021) for all enrollment, compliance, and storage and handling site visits conducted at the identified providers. We determined the "due date" of a provider's next required site visit and calculated the number of days of delay for an overdue site visit. To determine whether providers completed followup actions by the PEAR system-assigned deadlines, we reviewed the PEAR data for 127,594 followup actions associated with these site visits. We analyzed the status of these followup actions and identified the number of days between the assigned deadlines and the actual completion dates. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix A contains the details of our audit scope and methodology. FINDINGS CDC's VFC program recipients conducted enrollment site visits for all newly enrolled and reenrolling VFC providers as required. However, recipients did not meet all program requirements for conducting compliance site visits and storage and handling site visits. Specifically: • Recipients did not conduct compliance site visits in a timely manner at 11,499 of 39,120 enrolled and active providers (29 percent). • Recipients did not conduct storage and handling site visits at either of the two CDC-approved depot providers. • Most recipients (43 of 61 recipients) did not conduct storage and handling site visits for at least 5 percent of their providers. 8 CDC indicated that there were three CDC-approved depot providers. However, we determined that one of the CDC-approved depot providers that was enrolled and active during our audit period was not included in the PEAR data because the program recipient did not accurately enroll the provider. CDC officials stated that the recipient was working to correct the enrollment error. CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits at Some Providers as Required (A-09-22-01000) 6 • Recipients did not verify that providers completed followup actions by the deadlines for 33,316 of 127,594 issues (26 percent) identified during compliance and storage and handling site visits. CDC officials stated that staffing constraints and the COVID-19 pandemic were reasons that recipients did not conduct site visits at some providers as required. CDC officials also stated that, during the COVID-19 pandemic, CDC and recipients were focused on the priority of COVID-19 vaccination program development and vaccine distribution, some providers were temporarily closed, and travel was restricted. In addition, we found that CDC did not have internal written policies and procedures for CDC's monitoring and oversight activities, including oversight of recipients' site visits at providers. Finally, CDC's PEAR online system did not have interactive reminders or alerts related to overdue site visits and followup actions. Because recipients did not conduct site visits as required or verify that providers completed followup actions to address identified compliance issues, CDC and recipients could not ensure that providers were complying with VFC program requirements. PROGRAM RECIPIENTS DID NOT CONDUCT COMPLIANCE SITE VISITS IN A TIMELY MANNER AT SOME PROVIDERS According to the Operations Guide, recipients must conduct compliance site visits that cover different compliance areas at each VFC provider at least every 24 months. These areas include provider information (e.g., the names of key staff and the number of VFC-eligible children served by the provider), patient eligibility, documentation (e.g., screening and eligibility, billing records, temperature logs, and vaccine-ordering records), storage and handling of vaccines, and inventory management. The first compliance site visit for newly enrolled or reenrolled providers must be completed within 12 months of enrollment. Recipients did not conduct the required compliance site visits in a timely manner at 11,499 of the 39,120 providers (29 percent) that were enrolled and active during our audit period. Specifically, recipients did not conduct the required compliance site visits at 10,365 providers within the 24-month timeframe and did not conduct the first compliance visit at 1,134 providers within 12 months of the provider's enrollment. 9 9 Of the 10,365 providers, 455 should have had a compliance site visit before CDC allowed suspension of site visits (in March 2020) in response to the COVID-19 pandemic. Of the 1,134 providers, 263 should have had their first compliance site visit before CDC allowed suspension of site visits. CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits at Some Providers as Required (A-09-22-01000) 7 Figure 2 shows the number of overdue compliance site visits by the number of days the site visits were late. 10 Figure 2: The Number of Overdue Compliance Site Visits Conducted by Program Recipients 2,500 2,213 1,960 Number of Overdue Visits 2,000 1,555 1,560 1,500 1,168 1,096 1,025 922 1,000 500 - 1-50 51-100 101-150 151-200 201-250 251-300 301-365 >365 Number of Days Late PROGRAM RECIPIENTS DID NOT CONDUCT STORAGE AND HANDLING SITE VISITS AT EITHER OF THE CDC-APPROVED DEPOT PROVIDERS According to the Operations Guide, recipients are required to perform a scheduled storage and handling site visit at each CDC-approved depot provider every 12 months to ensure compliance with storage and handling requirements. For each of the two CDC-approved depot providers that were enrolled and active during our audit period, recipients did not conduct the required storage and handling site visits within the 12-month timeframe. Specifically, neither of these depot providers had any storage and handling site visits in the 3-year period from July 1, 2018, through June 30, 2021. MOST PROGRAM RECIPIENTS DID NOT CONDUCT STORAGE AND HANDLING SITE VISITS AT A MINIMUM OF 5 PERCENT OF PROVIDERS According to the Operations Guide, recipients are required to conduct unannounced storage and handling site visits at a minimum of 5 percent of VFC providers during each cooperative 10 To determine the "due date" of a provider's next required compliance site visit, we used: (1) the provider's enrollment date and added 12 months for a newly enrolled or reenrolled provider or (2) the date of the provider's prior compliance site visit and added 24 months. We then determined the number of days of delay for an overdue site visit by counting the number of days that had elapsed between the due date and the actual date of the first compliance site visit if one had been conducted or the provider's unenrollment date if applicable or June 30, 2021 (the last date of site visits in the 3-year period), whichever was earlier. CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits at Some Providers as Required (A-09-22-01000) 8 agreement budget period. Because of the COVID-19 pandemic, CDC allowed recipients to conduct scheduled storage and handling site visits in lieu of unannounced visits, effective August 28, 2020. Of the 61 recipients, 43 did not conduct storage and handling site visits at a minimum of 5 percent of their providers. To meet the requirement, these 43 recipients should have conducted storage and handling site visits at 1,268 providers. However, the recipients conducted storage and handling site visits at 277 providers. Of those 43 recipients, 23 did not conduct any storage and handling site visits during our audit period, which was the same as the cooperative agreement budget period. (See Figure 3.) Figure 3: Most Program Recipients Did Not Meet the 5-Percent Requirement PROGRAM RECIPIENTS DID NOT VERIFY THAT PROVIDERS COMPLETED FOLLOWUP ACTIONS BY THE DEADLINE According to the Operations Guide, recipients are required to use PEAR to document recipient or provider followup actions for compliance issues identified during a site visit. Recipients should also review planned and required provider followup actions in PEAR that are overdue or have not been implemented. Recipients did not verify that providers completed by the deadline 33,316 of the 127,594 followup actions required for issues identified during compliance and storage and handling site visits. As shown in Figure 4 on the next page, of overdue followup actions, approximately 43 percent were completed within 1 week after the deadline. However, more than 8,000 followup actions were not completed in the first 5 weeks after the deadline, and more than 200 followup actions were not completed until 1 or 2 years after the deadline. 11 11 In Figure 4, the 1,075 followup actions that were not completed by the deadline had not been completed as of January 28, 2022, which was the date that CDC retrieved the data. CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits at Some Providers as Required (A-09-22-01000) 9 Figure 4: The Number of Overdue Followup Actions Completed by Providers 16,000 14,284 14,000 12,000 10,000 8,197 8,000 6,000 3,770 4,000 2,306 1,874 1,567 2,000 1,075 227 16 0 SITE VISITS WERE NOT CONDUCTED AND FOLLOWUP ACTIONS WERE NOT COMPLETED BECAUSE OF RECIPIENTS' STAFFING CONSTRAINTS AND CDC's LACK OF WRITTEN POLICIES CDC officials stated that recipients' staffing constraints (e.g., a hiring freeze, high rate of staff turnover within immunization programs, and reassigning staff to work on COVID-19-related areas) were significant reasons that recipients did not conduct compliance site visits and storage and handling site visits, both before and during the COVID-19 pandemic. CDC officials also stated that, during the COVID-19 pandemic, CDC and recipients were focused on the priority of COVID-19 vaccination program development and vaccine distribution, some providers were temporarily closed, and travel was restricted. For 3 years since the pandemic started in March 2020, CDC has not enforced site visit requirements, even though these requirements have been in effect and CDC authorized alternatives to conducting site visits in- person (e.g., allowing recipients to make hybrid and virtual site visits and allowing recipients to schedule storage and handling visits in lieu of unannounced visits). 12 In addition, CDC did not have internal written policies and procedures for CDC's monitoring and oversight activities related to the VFC program, including oversight of recipient site visits at providers to ensure that requirements are met. CDC started developing these internal policies before the COVID-19 pandemic, but as of April 2023, these internal policies had not been issued. According to CDC officials, this work was delayed because of competing priorities of the pandemic. Furthermore, although PEAR could generate dashboards and reports that provided information on site visits and followup actions, there were no interactive reminders or alerts to inform and remind CDC and recipients about: (1) overdue site visits and recipients' progress 12 On January 11, 2023, CDC officials stated that they planned to start enforcing the site visit requirements on July 1, 2023. CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits at Some Providers as Required (A-09-22-01000) 10 toward meeting the 5-percent requirement and (2) followup actions that had not been completed by the deadlines. CONCLUSION Program recipients' site visits evaluate whether providers are complying with and understand overall VFC program requirements. Site visits are intended to ensure the quality of VFC vaccines and the integrity of the VFC program. Proper storage and handling of vaccines is important in preventing the loss of vaccines due to exposure to temperatures outside of allowable limits and ensuring their effectiveness. Because recipients did not conduct compliance and storage and handling site visits as required or verify that providers had completed followup actions to address identified compliance issues, CDC and recipients could not ensure that providers were complying with VFC program requirements. RECOMMENDATIONS We recommend that the Centers for Disease Control and Prevention: • work with program recipients to implement a plan and timeline to: (1) conduct the required site visits that are overdue and (2) verify the completion of followup actions that had not been completed by the deadlines; • develop an action plan to enforce site visit requirements by CDC's planned date of July 1, 2023; • complete the development and implementation of internal written policies and procedures for VFC program oversight activities, including oversight of program recipients' site visits to ensure that requirements are met; and • update its Provider Education, Assessment, and Reporting online system to include interactive reminders or alerts related to overdue site visits and followup actions. CDC COMMENTS AND OFFICE OF INSPECTOR GENERAL RESPONSE In written comments on our draft report, CDC concurred with our recommendations and described actions that it had taken or planned to take to address our recommendations. CDC stated that it will: (1) work with recipients that have overdue site visits to develop an implementation plan and timeline for conducting those site visits; (2) develop an action plan to provide guidance to recipients for site visits and followup actions; (3) complete and implement internal written policies and procedures for VFC program oversight activities; and (4) make enhancements to its PEAR online system, including sending automatic email alerts to recipients and CDC staff regarding site visits and followup actions. In addition, CDC provided detailed information to emphasize the impact of the COVID-19 pandemic on the VFC program. CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits at Some Providers as Required (A-09-22-01000) 11 After reviewing the information provided by CDC, we updated our description of the impact of the COVID-19 pandemic on the VFC program on page 5 of the report. CDC also provided technical comments on our draft report, which we addressed as appropriate. CDC's comments, excluding the technical comments, are included in their entirety as Appendix B. CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits at Some Providers as Required (A-09-22-01000) 12 APPENDIX A: AUDIT SCOPE AND METHODOLOGY SCOPE We reviewed CDC's operations manuals and guidance related to VFC program requirements for site visits at providers. We identified 39,122 providers, consisting of 39,120 providers that administered VFC vaccines and 2 CDC-approved depot providers, that were enrolled and active at any point from July 1, 2020, through June 30, 2021. To determine whether the 61 program recipients conducted the required site visits at providers, we reviewed 3 years' worth of data (July 1, 2018, through June 30, 2021) for all enrollment, compliance, and storage and handling site visits conducted at the identified providers. We determined the "due date" of a provider's next required site visit and calculated the number of days of delay for an overdue site visit. To determine whether providers completed followup actions by the deadlines, we also reviewed the data for 127,594 followup actions associated with these site visits. We analyzed the status of these followup actions and identified the number of days between the assigned deadlines and the actual completion dates. We did not assess the overall internal control structure of CDC. Rather, we limited our review to CDC's internal controls related to its oversight activities for ensuring that recipients conducted required site visits. To determine the effectiveness of the design and implementation of these internal controls, we interviewed CDC officials, reviewed CDC's operating manuals related to program requirements and the PEAR online system, and reviewed provider and site visit data from PEAR. Our review of PEAR data allowed us to evaluate the operating effectiveness of internal controls. We conducted our audit from January 2022 to April 2023. METHODOLOGY To accomplish our objective, we: • reviewed applicable Federal regulations and guidance; • reviewed CDC's operations manuals to identify VFC program requirements; • reviewed CDC guidance issued in response to the COVID-19 pandemic; • interviewed CDC officials to identify CDC's oversight activities related to recipients' conducting of provider site visits; • obtained data from CDC's PEAR online system for: (1) VFC providers who were enrolled and active during our audit period, (2) site visits conducted at these providers, and (3) providers' followup actions related to these site visits; CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits at Some Providers as Required (A-09-22-01000) 13 • identified 39,122 providers, consisting of 39,120 providers that administered VFC vaccines and 2 CDC-approved depot providers, that were enrolled and active at any point during our audit period; • reviewed 3 years' worth of data for all enrollment, compliance, and storage and handling site visits conducted at these identified providers; • reviewed data for 127,594 followup actions associated with the site visits and providers being reviewed; and • discussed our findings with CDC officials. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits at Some Providers as Required (A-09-22-01000) 14 APPENDIX B: CDC COMMENTS CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits at Some Providers as Required (A-09-22-01000) 15 CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits at Some Providers as Required (A-09-22-01000) 16 CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits at Some Providers as Required (A-09-22-01000) 17 CDC's Vaccines for Children Program Recipients Did Not Conduct Site Visits at Some Providers as Required (A-09-22-01000) 18