EIN: 660500678
UEI: ZKUEYJL8KZ15
Data as of August 20, 2026
Management decision deadline — for entities that funded this organization
The FAC accepted this audit on October 11, 2024. Under 2 CFR 200.521(d), a pass-through entity that provided federal funds to this organization for this audit period must issue a management decision on these findings by April 11, 2025, which was (497 days ago).
What is a management decision? →Criteria SMAs must establish and maintain a program for conducting periodic risk analyses to ensure appropriate and cost effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. SMAs shall review ADP system security installations involved in the administration of HHS programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Condition The security plan for ADP (Automatic Data Processing) system, including policies and procedures to address contingency plans in the event of unforeseen interruptions has not been implemented and tested. Cause This situation was primarily caused by the lack of effective internal control over ADP Risk Analysis and System Security Review. Effect Critical business functions may not be resumed on time in case an emergency or disaster causes the ADP system resources to become unable to meet critical processing needs in the event of a short or long-term interruption of service. Questioned Costs None Perspective information N/A Prior Year Audit Finding 2022-001 Recommendation The Administration should establish and maintain a program for conducting periodic risk analysis to ensure appropriate, cost-effective safeguards are incorporated into new and existing systems. Management’s Response: Refer to Grantee’s Corrective Action Plan
ASES contracted a Cybersecurity expert to review the Disaster Recovery Plan (DRP) and a Business Impact Analysis was completed to acquire space within the AZURE cloud with the approval of the Puerto Rico Innovation and Technology Service (PRITS). The strategy of protection and alternate space was designed to work on ASES applications and documents in case of a disaster. ASES already has a virtual RED environment where the resources are being replicated for users and area documentation and eventually the servers will be replicated in the AZURE space. Additionally, an internal Risk Assessment was performed that helped identify and remedy the vulnerabilities in the agency. It was prepared by the Information Systems Security Administrator, evaluated by the personnel hired at the executive level and signed in acceptance of the exercise carried out. As a result, the DRP was updated based on departmental needs and the current capabilities of the agency's information systems. ASES also implemented the use of OneDrive tools for users to save their documents in this application and SharePoint for departmental files and documents.
2022-001
Criteria Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal, Part 200.512, Report Submission, (a) General, (1) states that the audit must be completed, and the data collection form and reporting package must be submitted within the earlier of 30 calendar days after receipt of the auditor's report(s), or nine months after the end of the audit period. Condition The Data Collection Form and Single Audit reporting package were not submitted within nine (9) months after the end of the audit period. Cause The Administration experienced the aftermath of the Coronavirus Pandemic as it relates to maintaining up to date its accounting records. Effect Data collection form and single audit reports were not submitted in a timely manner as required by the Uniform Guidance. Prior Year Audit Finding 2022-002 Recommendation Data collection form and single audit package shall be submitted within the required due dates. Questioned Costs None Management’s Response Refer to Grantee’s Corrective Action Plan
The PRHIA was proactive to ensure compliance in submitting the 2023 Single Audit Report by due date, maximizing the human resources available, in collaboration with auditors. The PRHIA expects to ensure compliance by submitting the 2023 Single Audit Report by its due date.
2022-002
Management decision deadline — for entities that funded this organization
The FAC accepted this audit on October 11, 2024. Under 2 CFR 200.521(d), a pass-through entity that provided federal funds to this organization for this audit period must issue a management decision on these findings by April 11, 2025, which was (497 days ago).
What is a management decision? →Criteria SMAs must establish and maintain a program for conducting periodic risk analyses to ensure appropriate and cost effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. SMAs shall review ADP system security installations involved in the administration of HHS programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Condition The security plan for ADP (Automatic Data Processing) system, including policies and procedures to address contingency plans in the event of unforeseen interruptions has not been implemented and tested. Cause This situation was primarily caused by the lack of effective internal control over ADP Risk Analysis and System Security Review. Effect Critical business functions may not be resumed on time in case an emergency or disaster causes the ADP system resources to become unable to meet critical processing needs in the event of a short or long-term interruption of service. Questioned Costs NonePerspective information N/A Prior Year Audit Finding 2021-001 Recommendation The Data Collection Form and Single Audit package shall be submitted within the required due dates Management’s Response: Refer to Grantee’s Corrective Action Plan
ASES contracted a Cybersecurity expert to review the Disaster Recovery Plan draft, including the security policies and standards of information systems. The work plan includes the following: 1. Preparation of the Business Impact Analysis: a) Separate meetings with all managers to identify departments' data retention, RTO, BAT and RPO needs. b) This document will provide a better guide for the IT department of the needs of the departments and thus implement or acquire the necessary solutions for the protection, and DRP of the departments and the agency. 2. Perform an internal Risk Assessment which will help identify and remedy the vulnerabilities in the agency. 3. Establish responsibility to the directors of the agency's departments for their processes and the data they handle.4. Update the DRP based on departmental needs and the current capabilities of the agency's information systems. The IT department is in advanced discussions with PRITS for the purchase of the licensing of Azure Site Recovery and Azure Backup to meet the needs of the agency and mitigate the possible loss of data and applications in case of an incident such as ransomware attacks and events such as hurricanes or events related to hardware failures (servers, computers, etc.). This is a high priority for the Executive Director. In the coming months ASES will start the use of OneDrive tools for users to save their documents in this application and SharePoint for departmental files and documents. This implementation will help mitigate the risk that users lose their information due to security incidents or hardware failures. The Backup, Disaster Recovery and Security posture is expected to improve in the next 6 months if the above solutions are implemented.
2021-001
Criteria Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal, Part 200.512, Report Submission, (a) General, (1) states that the audit must be completed, and the data collection form and reporting package must be submitted within the earlier of 30 calendar days after receipt of the auditor's report(s), or nine months after the end of the audit period. Condition The Data Collection Form and Single Audit reporting package were not submitted within nine (9) months after the end of the audit period. Cause The Administration experienced the aftermath of the Coronavirus Pandemic as it relates to maintaining up to date its accounting records. Effect Data collection form and single audit reports were not submitted in a timely manner as required by the Uniform Guidance. Prior Year Audit Finding N/A Recommendation Data collection form and single audit package shall be submitted within the required due dates. Questioned Costs None Management’s Response Refer to Grantee’s Corrective Action Plan
The PRHIA was proactive to ensure compliance in submitting the 2022 Single Audit Report by due date, maximizing the human resources available, in collaboration with auditors. However, we were unable to comply with the due date, mainly, because of the employees turnover as part of the aftermath of the Coronavirus Pandemic as it relates to maintaining up to date its accounting records.
Management decision deadline — for entities that funded this organization
The FAC accepted this audit on October 30, 2022. Under 2 CFR 200.521(d), a pass-through entity that provided federal funds to this organization for this audit period must issue a management decision on these findings by April 30, 2023, which was (1209 days ago).
What is a management decision? →Finding Number: 2021-001Federal Program: Medical Assistance ProgramAssistance Listing: 93.778Federal Grantor: U.S. Department of Health and Human ServicesCompliance Requirement: Special Test and Provisions-ADP Risk Analysis andSystem Security ReviewCategory: Material Weakness and NoncomplianceCriteriaSMAs must establish and maintain a program for conducting periodic risk analyses to ensure appropriate and cost effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. SMAs shall review ADP system security installations involved in the administration of HHS programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621).ConditionThe security plan for ADP (Automatic Data Processing) system, including policies and procedures to address contingency plans in the event of unforeseen interruptions has not been implemented and tested.CauseThis situation was a primarily caused by the lack of effective internal control over ADP Risk Analysis and System Security Review.EffectCritical business functions may not be resumed on time in case an emergency or disaster causes the ADP system resources to become unable to meet critical processing needs in the event of a short or long-term interruption of service.Questioned CostsNonePerspective informationN/APrior Year Audit Finding2020-001RecommendationThe Administration should establish and maintain a program for conducting periodic risk analysis to ensure appropriate, cost-effective safeguards are incorporated into new and existing systems.Management?s Response:Refer to Grantee?s Corrective Action Plan
After favorable results of the Proof of Concept (POC) for a Disaster Recovery Site (DRS) we have established an onsite replication environment for our system operation. ASES is currently engaged in requesting and evaluating processes with several vendors, based on ASES requirements and the Puerto Rico Innovation and Technology Service (PRITS) recommendations for a DRS base environment.
2020-001
Finding Number: 2021-002Federal Program: Medical Assistance Program, Children?s Health Insurance Program (CHIP)Assistance Listing: 93.778, 93.767Federal Grantor: U.S. Department of Health and Human ServicesCompliance Requirement: Special Test and Provisions- Manage Care Financial AuditCategory: Significant Deficiency and NoncomplianceCriteriaTwo types of audits are required for managed care:? Audited Financial Reports ? The contract with each MCO, PIHP, and PAHP must require them to submit to the state an audited financial report specific to the Medicaid contract on an annual basis. These audits must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards (42 CFR section 438.3(m)).? Periodic Audits ? Effective no later than for rating periods for contracts starting on or after July 1, 2017, the state must periodically, but no less frequently than once every three years, conduct, or contract for an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of each MCO, PIHP, and PAHP and post the results of these audits on its website (42 CFR section 438.602(e) and (g); May 6, 2016, Federal Register (81 FR 27497); OMB No. 0938-0920).ConditionState Medicaid Agency (SMA) not provide us with an independent audit carried out to each MCO to validate that information provided is accurate, truthfulness, and completeness and post the results of these audit on its websites.CauseThis situation was a primarily caused because State Medicaid Agency (SMA) no conduct or contract to perform and independent audit to validate the accuracy, truthfulness, and completeness of the financial information submitted by each MCO.EffectState Medicaid Agency (SMA) not ensure that each managed care organization provide correct, accuracy, truthfulness, and completeness financial information required by the Medicaid Assistance Program.Questioned CostsNonePerspective informationN/APrior Year Audit FindingN/ARecommendationThe State Medical Agency (SMA) should carryout or contract to perform independent audit no less than once every three years to each MCO to validate the accuracy, truthfulness, and completeness of the financial information submitted and post the results of these audit on its websites.Management?s Response:Refer to Grantee?s Corrective Action Plan
The PRHIA?s Compliance Office will develop and implement an audit workplan to periodically, but no less frequently than once every 3 years, conduct, or contract for the conduct of, an independent audit of the accuracy, truthfulness, and completeness of the encounter and financial data submitted by, or on behalf of, each MCO, PIHP or PAHP. Once completed, the results of these audits will be posted on the Administration?s website.It is important to note that the Administration contracted to conduct a review of encounter data management by each MCO. The purpose of the review was to assess the capture of claims data, submitting encounters, monitoring and correcting rejections and denials, and reporting quality, and to identify best practices or opportunities for improvement. Such reports were issued on October 29, 2021.
Management decision deadline — for entities that funded this organization
The FAC accepted this audit on March 31, 2022. Under 2 CFR 200.521(d), a pass-through entity that provided federal funds to this organization for this audit period must issue a management decision on these findings by October 1, 2022, which was (1420 days ago).
What is a management decision? →Finding Number: 2020-001Federal Program: Medical Assistance ProgramCFDA: 93.778Federal Grantor: U.S. Department of Health and Human ServicesCompliance Requirement: Special Test and Provisions-ADP Risk Analysis andSystem Security ReviewCategory: Significant deficiency and NoncomplianceCriteriaStates are required to establish a security plan for ADP systems that include policies and procedures to address: (1) physical security of ADP resources; (2) equipment security to protect equipment from theft and unauthorized use; (3) software and data security; (4) telecommunications security; (5) personnel security; (6) contingency plans to meet critical processing needs in the event of short- or long-term interruption of service; (7) emergency preparedness; and (8) designation of an agency ADP security manager.State agencies must establish and maintain a program for conducting periodic risk analyses to ensure appropriate, cost effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. On a biennial basis, State agencies shall review the ADP system security of installations involved in the administration of HHS programs. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices.At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621).ConditionThe security plan for ADP (Automatic Data Processing) system, including policies and procedures to address contingency plans in the event of unforeseen interruptions has not been implemented and tested.EffectCritical business functions may not be resumed on time in case an emergency or disaster causes the ADP system resources to become unable to meet critical processing needs in the event of a short or long-term interruption of service.CauseThis situation was a primarily caused by the lack of effective internal control over ADP Risk Analysis and System Security ReviewPrior Year Audit Finding2019-001RecommendationThe Administration should establish and maintain a program for conducting periodic risk analysis to ensure appropriate, cost effective safeguards are incorporated into new and existing systems.Questioned CostsNoneManagement?s Response:Refer to Grantee?s Corrective Action Plan
ASES is running a Proof of Concept (POC) with Truenorth Corporation for the Disaster Recovery Site (DRS). We are replicating the production environment to this system. After the completion of the POC, ASES will ask several vendors for a complete solution that Meets ASES requirements for a DRS base on the recommendation of the Puerto Rico Innovation and Technology Service.
2019-001
Finding Number: 2020-002Federal Program: Medical Assistance ProgramCFDA: 93.778Federal Grantor: U.S. Department of Health and Human ServicesCompliance Requirement: Special Test and ProvisionsCategory: Significant Deficiency and NoncomplianceCriteriaThe State Plan must provide methods and procedures to safeguard against unnecessary utilization of care and services. In addition, the State must have (1) methods of determining criteria for identifying suspected fraud cases; (2) methods for investigating these cases; and (3) procedures, developed in cooperation with legal authorities, for referring suspected fraud cases to law enforcement officials (42 CFR Parts 455, 456, and 1002).The SMA must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. The agency must have procedures for the ongoing post payment review, on a sample basis, of the need for and the quality and timeliness of Medicaid services. The SMA may conduct this review directly or may contract with an independent entity (42 CFR sections 456.5, 456.22, and 456.23).The SMA must ensure that each managed care organization with which it contracts is evaluated annually on quality, timeliness, and access to the health care services by an external quality review organization (EQRO). The state must ensure that the EQRO conduction such reviews is competent and independent (42 CFR 438, Subpart E).ConditionThere are no insurer reviews by external quality review organization (EQRO) for the fiscal year ended June 30, 2020.EffectState Medicaid Agency (SMA) not ensure that each managed care organization with which it contracts is evaluate on quality, timeliness, and access to the health care services.CauseThis situation was a primarily caused because external quality review organization (EQRO) have not been hired to carry out the review by the State Medicaid Agency (SMA).Prior Year Audit FindingN/ARecommendationThe State Medical Agency (SMA) should contract external quality review organization (EQRO) and assure that carry out annually review on quality, timeliness and access to the health care service of each manage care organization with which it contracts.Questioned CostsNoneManagement?s Response:Refer to Grantee?s Corrective Action Plan
On December 16, 2021 the State Medical Agency (SMA) issued the Request for Proposals (RFP) 2021-PRMP-RFP-002 to contract external quality review organization (EQRO). The contract signature is expected to be made on 5/13/2022.
Finding Number: 2020-003Agency: All Federal Agencies in the SEFAFederal Program: All Federal Agencies in the SEFACFDA: All Federal Agencies in the SEFAFederal Grantor: U.S. Department of Health and Human ServicesCompliance Requirement: ReportingCategory: Significant Deficiency and NoncomplianceCriteriaUniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal, Part 200.512, Report Submission, (a) General, (1) states that the audit must be completed and the data collection form and reporting package must be submitted within the earlier of 30 calendar days after receipt of the auditor's report(s), or nine months after the end of the audit period.ConditionPuerto Rico Health Insurance Administration did not comply with the required due date for the submission of the Single Audit Report.EffectPuerto Rico Health Insurance Administration (PRHIA) could be sanctioned by the Federal Government for the noncompliance of this requirement.CauseDuring March 2020, due the Coronavirus pandemic the government declared a lock down. This event caused the interruption of services and business activities which resulted in economic hardship. This event affected the operations of the Administration and the services provided.Prior Year Audit FindingN/ARecommendationThe PRHIA should designate work teams among all departments which serve as liaisons with the auditors and be responsible for the delivery of information and documentation to ensure compliance with due dates. In addition, shall establish controls and procedures to enable compliance with completion and submitting of the Single Audit Report of PRHIA to the Federal Clearinghouse before the 9 months deadline.Questioned CostsNoneManagement?s ResponseRefer to Grantee?s Corrective Action Plan
The delay in the issuance of the Single Audit Report package was because the financial information related to the pension and OPEB liabilities were not available in a timely manner. Such information is provided by another State Agency of the Government of Puerto Rico. The Central Government of the Commonwealth of Puerto Rico requested to hold the financial statements until such audited financial information was available. Additionally, the COVID-19 pandemic delayed the completion of the audit and the preparation of the financial statements.To correct this condition, PRHIA decided that for the next financial statements (and the Single Audit Report package) PRHIA will issued the reports even if the pension financial information is not delivered on time to be included in our financial statements.
Management decision deadline — for entities that funded this organization
The FAC accepted this audit on November 3, 2020. Under 2 CFR 200.521(d), a pass-through entity that provided federal funds to this organization for this audit period must issue a management decision on these findings by May 3, 2021, which was (1936 days ago).
What is a management decision? →Finding Number: 2019-001 Federal Program: Medical Assistance Program CFDA: 93.778 Federal Grantor: U.S. Department of Health and Human Services Compliance Requirement: Special Test and Provisions-ADP Risk Analysis and System Security Review Category: Significant deficiency and Noncompliance Criteria States are required to establish a security plan for ADP systems that include policies and procedures to address: (1) physical security of ADP resources; (2) equipment security to protect equipment from theft and unauthorized use; (3) software and data security; (4) telecommunications security; (5) personnel security; (6) contingency plans to meet critical processing needs in the event of short- or long-term interruption of service; (7) emergency preparedness; and (8) designation of an agency ADP security manager. State agencies must establish and maintain a program for conducting periodic risk analyses to ensure appropriate, cost effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. On a biennial basis, State agencies shall review the ADP system security of installations involved in the administration of HHS programs. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Condition The security plan for ADP (Automatic Data Processing) system, including policies and procedures to address contingency plans in the event of unforeseen interruptions has not been implemented and tested. Effect Critical business functions may not be resumed on time in case an emergency or disaster causes the ADP system resources to become unable to meet critical processing needs in the event of a short or long-term interruption of service. Cause This situation was a primarily caused by the lack of effective internal control over ADP Risk Analysis and System Security Review Prior Year Audit Finding 2018-001 Recommendation The Administration should establish and maintain a program for conducting periodic risk analysis to ensure appropriate, cost effective safeguards are incorporated into new and existing systems. Questioned Costs None Management?s Response: The Administration is in the process of obtaining qualified bidders from a request for proposal (RFP) process for testing its Business Continuity Plan (Plan) with the purpose to establish the ADP Risk Analysis and System Security Review.
The Administration is in the process of obtaining qualified bidders from a request for proposal (RFP) process for testing its Business Continuity Plan (Plan) with the purpose to establish the ADP Risk Analysis and System Security Review.
2018-001
Management decision deadline — for entities that funded this organization
The FAC accepted this audit on February 14, 2019. Under 2 CFR 200.521(d), a pass-through entity that provided federal funds to this organization for this audit period must issue a management decision on these findings by August 14, 2019, which was (2564 days ago).
What is a management decision? →GSA_MIGRATION
GSA_MIGRATION
2017-001
Management decision deadline — for entities that funded this organization
The FAC accepted this audit on January 29, 2017. Under 2 CFR 200.521(d), a pass-through entity that provided federal funds to this organization for this audit period must issue a management decision on these findings by July 29, 2017, which was (3310 days ago).
What is a management decision? →GSA_MIGRATION
GSA_MIGRATION
2015-002
Data source: This information comes from the Federal Audit Clearinghouse, the official repository of Single Audit data. All data is public domain. Verify this organization's audit history at fac.gov.
Track your findings and corrective action plans across audit cycles.
Start tracking findings →Monitor subrecipient audit findings and compliance status.
Start monitoring →Single Audit Intelligence is an independent tool powered by Federal Audit Clearinghouse data. Not affiliated with GSA, OMB, or any federal agency.