Bureaucracy Times

Medicare Froze Lab Cuts for Six Years. Now CMS Says It Can Save $1 Billion a Year.

Congress created a market-based system for Medicare laboratory payments because the government had a fairly familiar problem: it was paying more than private insurers for many of the same tests. CMS’s preliminary 2027 Clinical Laboratory Fee Schedule is now the latest evidence of what happened when Congress spent six years preventing that system from correcting itself.

The solution sounded straightforward enough.

Collect what private insurers actually pay laboratories. Calculate the market rate. Use those numbers to periodically reset what Medicare pays.

Then Washington spent years postponing the resets.

Now, after finally collecting a fresh round of private-payer data, the Centers for Medicare & Medicaid Services says existing Medicare laboratory payment rates are approximately 16 percent higher, on average, than rates calculated from the private market.

CMS estimates correcting that difference will save taxpayers about $1 billion annually.

It is an impressive savings announcement.

It is also the latest chapter in a pricing system that Congress repeatedly prevented from doing precisely the thing it was designed to do.

The Government Builds a Market

The Protecting Access to Medicare Act of 2014, better known as PAMA, fundamentally changed how Medicare establishes prices under the Clinical Laboratory Fee Schedule.

Instead of relying primarily upon an administratively constructed fee schedule with historical roots, Congress directed CMS to collect payment information from laboratories and use the weighted median of private-payer rates to establish Medicare prices.

The logic was difficult to quarrel with.

If private insurers were routinely buying the same laboratory services for less money, Medicare should probably know about it.

There was considerable money at stake.

GAO later reported that Medicare paid approximately $7.1 billion for 433 million laboratory tests in 2017, the year before the first PAMA market-based rates took effect. The watchdog also found that Medicare had generally been paying more than private insurers before the transition.

The first new rates arrived in 2018.

Even that transition was hardly seamless.

GAO subsequently concluded that CMS’s implementation methodology had produced an estimated $733 million in additional Medicare spending between 2018 and 2020 compared with an alternative baseline GAO believed better reflected congressional intent.

Still, the underlying mechanism was now in place.

Private prices would be collected. Medicare prices would be recalculated. The exercise would be repeated periodically so that the government’s laboratory fee schedule would remain connected to the market it was supposed to reflect.

Then the updating largely stopped.

Six Years at Zero

The history is hiding in plain sight on CMS’s own Clinical Laboratory Fee Schedule page.

For 2020, Medicare laboratory payment reductions were limited to 10 percent.

For 2021, the reduction limit was zero.

Then zero again in 2022.

And 2023.

And 2024.

And 2025.

And 2026.

That six-year stretch was not the product of some unnoticed administrative malfunction inside CMS. Congress repeatedly altered the statutory schedule.

Beginning in late 2019 and continuing through pandemic relief legislation and subsequent congressional extensions, lawmakers postponed reporting periods and delayed the application of additional PAMA reductions.

Each intervention had its own legislative context. Taken together, however, they produced a remarkably simple result: for six consecutive calendar years, the ordinary PAMA mechanism could not impose further reductions on the vast majority of laboratory tests that otherwise would have been subject to them.

The market continued moving.

The Medicare schedule largely did not.

And Medicare continued buying laboratory tests by the hundreds of millions.

HHS’s Office of Inspector General reported $7.6 billion in Medicare Part B laboratory spending in 2018 and $7.7 billion in 2019. Spending reached $8 billion in 2020.

MedPAC’s broader Clinical Laboratory Fee Schedule figures show spending climbing to $10.7 billion in 2021 before declining to $9.8 billion in 2022 and $9 billion in 2023.

OIG reported that Part B laboratory spending reached $8.4 billion in 2024, a 5 percent increase from the previous year in its Part B dataset.

Those numbers should not be mistaken for a running ledger of money lost because Congress delayed PAMA reductions. They aren’t.

The laboratory market itself was changing dramatically during the same period.

Genetic testing is the most obvious example. OIG found that Medicare Part B spending on genetic tests exceeded $3.6 billion in 2024 and accounted for approximately 43 percent of total Part B laboratory spending.

Medicare was not simply buying the same basket of tests year after year at frozen prices.

But that changing market is precisely why periodically obtaining current market data was supposed to matter.

Then CMS Checked the Market Again

CMS finally received a substantial new batch of private-payer information this year.

The data underlying its preliminary 2027 Clinical Laboratory Fee Schedule cover private-payer transactions conducted between January 1 and June 30, 2025.

Laboratories reported those transactions to CMS between May and July 2026.

The resulting dataset was not trivial.

CMS says 6,411 laboratories submitted information covering 1,947 billing codes. The agency calculated weighted-median private-payer rates for 1,528 of them.

After years of statutory delays, Medicare once again had a contemporary private-market yardstick against which to measure its laboratory prices.

The yardstick delivered an inconvenient answer.

According to CMS, existing Medicare payment rates are approximately 16 percent higher, on average, than the new rates calculated using private-payer data.

CMS estimates that bringing Medicare’s rates into alignment will save taxpayers approximately $1 billion every year.

There is an almost perfect bureaucratic circle to the story.

Congress created PAMA because Medicare needed laboratory prices that better reflected the private market.

Congress then repeatedly postponed the process intended to keep those prices connected to that market.

CMS eventually obtained fresh market information.

And the government discovered Medicare was once again paying considerably more.

The $1 Billion We Cannot Backdate

The temptation at this point is obvious.

Six years of frozen reductions. One billion dollars in projected annual savings.

Multiplication is easy.

It would also be misleading.

CMS’s $1 billion estimate is based on the newly reported private-payer information and the preliminary payment rates calculated for 2027. It does not tell us what the correct market rate would have been in 2021, 2022 or any other year during the freeze.

We therefore cannot responsibly multiply the current savings estimate by six and declare that the delays cost taxpayers $6 billion.

Determining the actual fiscal effect of the repeated postponements would require reconstructing private-payer prices for those earlier periods and modeling what Medicare payments would have been had the scheduled reporting and reductions occurred.

The available federal records establish something narrower, but hardly insignificant.

Congress repeatedly postponed the system designed to update Medicare laboratory prices.

CMS imposed no PAMA-driven reductions from 2021 through 2026.

Medicare continued spending billions of dollars annually on laboratory services.

And when CMS finally compared its existing rates against a substantial new collection of private-payer data, it found Medicare’s prices approximately 16 percent higher on average.

The agency now expects correcting the discrepancy to save roughly $1 billion annually.

Even the Correction Has a Speed Limit

Medicare will not simply erase the difference on January 1.

Federal law continues to limit how quickly individual laboratory payment rates can fall. For calendar years 2027 through 2029, reductions for individual tests generally cannot exceed 15 percent in a single year.

That means some prices substantially above their newly calculated private-market rates will require multiple years to reach them.

The preliminary 2027 rates are being finalized this fall and are scheduled to take effect January 1.

So, more than a decade after Congress created a market-based laboratory pricing system, the government is preparing to resume the process of bringing Medicare prices closer to the market.

CMS is presenting the result as a significant taxpayer savings initiative, and $1 billion annually certainly qualifies.

But the savings announcement also raises the question sitting quietly beneath it.

If periodically checking Medicare’s prices against the private market can save taxpayers a billion dollars a year, what happens when Washington spends six years postponing the check?

For now, the government has not provided that number.

It has, however, provided a rather compelling reason to ask.
Fediverse reactions
The Furnace Broke. The Recommendations Didn’t.

The VA Office of Inspector General visited the Thomas E. Creek VA Medical Center in Amarillo for four days in February 2026 and found a hospital that had spent the previous three months heating itself with the equipment version of a séance. The resulting Healthcare Facility Inspection report reads like most of its siblings in this OIG series, calm, procedural, and quietly damning. Two recommendations. Zero questioned costs. A director who concurred with everything and asked, politely, for one of them to be closed before the ink dried. It is the kind of report that could put you to sleep if you didn’t notice that the sleeping happened in a hospital where nobody was checking whether the medication was still good.

A Building That Kept Its Own Time

In late November 2025, the heating system at Amarillo’s main hospital stopped working. Not a fuse, not a thermostat, an aged air handling unit whose replacement parts, executive leaders told inspectors, “were not readily available to order.” The outage ran for approximately three months. Engineering staff got by reviving old steam furnaces that had presumably been left in place for exactly this occasion, and when that wasn’t enough, they deployed space heaters and moved veterans out of a medical surgical unit that never did get adequate heat back. The Associate Director said the facility’s infrastructure plan includes replacing other aging systems “to prevent similar disruptions in the future,” which is the sentence every institution says right after the thing it was supposed to prevent has already happened.

This is presented in the report’s Culture section, under the heading “System Shocks,” as a story about resilience. The staff adapted. The mission continued. Nobody froze. All of that is true, and none of it changes the fact that a facility with a $597 million medical care budget kept a wing of veterans warm with the hospital equivalent of camping gear for a full winter because a part could not be sourced. The OIG made no recommendation on this. It did not need to. The next section of the report supplies its own commentary.

The Room Where Nobody Checked the Weather

The Environment of Care section is where the actual grading happens, and Amarillo did not do well. Inspectors touring the medical surgical units, the ICU, the emergency department, and the community living center (VA’s term for its nursing homes) found wall damage in the emergency department and CLC hallways, damaged floors in the CLC, stained ceiling tiles over the emergency waiting area and the CLC dining room, and, in the CLC’s clean utility room, dirty equipment and items simply left on the floor next to whatever was supposed to stay clean. VHA Directive 1608(1) requires facilities to keep those two categories physically separated for the obvious reason that “clean” and “next to a mop bucket” are not the same condition.

Then there’s the medication rooms. Staff in the ICU and the CLC were not monitoring temperature and humidity, a basic requirement under VHA Directive 1108.07(2) that exists because medications stored outside 68 to 77 degrees Fahrenheit and 30 to 60 percent relative humidity can degrade without anyone noticing. The Associate Director told inspectors he had no idea staff weren’t doing this. The facility’s own written policy, in place since 2023, said they were supposed to be. Nobody had checked whether the policy was being followed until the OIG did.

The facility’s fix for this one is worth sitting with. In its written response, Amarillo reported that nursing staff, when interviewed, “were unable to speak to the established process,” which is a generous way of saying the people responsible for the room didn’t know there was a room to be responsible for. The corrective action was staff education and new signage identifying a point of contact. The facility then reviewed a year of monitoring data, found humidity excursions had in fact occurred, decided none of the affected medications needed to be thrown out, and asked the OIG to close the recommendation. The OIG agreed, on September 28, 2026, the same day this report was published. Recommendation open, evaluated, and closed inside the same document. That is not oversight moving quickly. That is oversight arriving exactly in time to watch the facility grade its own test.

A Finding With Its Own Frequent Flyer Program

None of this would be especially newsworthy if it were unique to Amarillo. It isn’t. The VA Indiana Healthcare System’s inspection, completed earlier in this same cycle, cited supplies and debris left on a clean supply room floor and chipped, damaged walls with visible residue in a patient room, language close enough to Amarillo’s that it could be a find and replace job. The VA Western Colorado Healthcare System’s inspection went further, issuing eight recommendations that included the identical clean and dirty item separation failure, plus ceiling vent dust, wall repair, and a call for the regional VISN office itself to start actually overseeing the environment of care program it was supposed to be overseeing all along.

Three different facilities, three different states, three different inspection windows, and the same finding under the same directive with the same prescribed remedy: develop a plan, educate staff, monitor compliance until it holds for six consecutive months. VHA Directive 1608(1) has been in place since 2021. It has been amended once, in 2023, seemingly without anyone updating the muscle memory of the maintenance staff tasked with following it. This is not three unlucky facilities. This is what a compliance program looks like when the response to a finding is standardized but the underlying behavior isn’t.

Closed, In the Sense That the Paperwork Says So

The Amarillo report closes on an uneasy note of institutional self-awareness. In its conclusion, the OIG mentions, almost in passing, that it is tracking VHA’s ongoing restructuring, the collapse of 18 regional networks down to five, completed just months before this inspection was published, and that the agency plans to “monitor VHA’s change management” going forward. It is a tidy sentence to end on, and it says nothing about who, in a newly consolidated five-network structure, will be responsible for making sure the next facility’s clean utility room stays clean.

The honest reading of this report is not that Amarillo is a badly run hospital. Employee survey responses describe leaders who communicate often, veterans who travel from three states away specifically to be treated there, and a 94 percent trust rating that beats the VA average. The honest reading is that a facility can do nearly everything right and still leave a heating system to fail for three months because a part wasn’t in stock, and still let a medication room go unmonitored for however long it takes an inspector with a clipboard to notice. The OIG will be back in roughly three years to check again. Given the pattern at Indiana and Western Colorado, there is no particular reason to expect the sequel to look different, only that it will, once again, be resolved with an action plan, a monitoring period, and a director who concurs.
Fediverse reactions
Federal Register Watch: October 13, 2026
Today’s most consequential entry is a double move by the Environmental Protection Agency, which delayed a hazardous-spill compliance deadline for industrial facilities while stripping references to climate change and environmental justice from the underlying rule, citing a change in Administration policy. Elsewhere, EPA handed Colorado new authority over carbon-injection wells, the Commodity Futures Trading Commission opened the door to a dedicated crypto asset rulebook, and a cluster of ATF paperwork notices used language suggesting that several firearms-related federal approvals had lapsed before being reinstated.
- EPA finalized a rule delaying the compliance deadline for Clean Water Act Facility Response Plans, which onshore facilities that could cause substantial harm from a worst-case hazardous substance spill are required to file and keep current. The same rule strips the plan’s references to climate change and environmental justice, which the agency says is meant to align the requirement with current Administration policy under Executive Order 14148. A compliance-date delay sounds procedural, but it means facilities get more time before they must update their spill-response plans under this newly narrowed version of the rule, so the delay and the content change are really two actions bundled into one, worth watching for what else gets rewritten before the new deadline arrives. Clean Water Act Hazardous Substance Facility Response Plans (EPA, Rule 2026-20849)
- EPA approved Colorado’s request for primacy, meaning primary permitting and enforcement authority, over Class VI wells, the kind used to inject carbon dioxide deep underground for permanent storage, under the Safe Drinking Water Act. Primacy hands day-to-day oversight of these wells to the state’s own Energy and Carbon Management Commission instead of EPA’s regional office, which matters because it changes where the public would go to comment on or challenge a future carbon-sequestration project in Colorado; EPA keeps authority only over wells on tribal land within the state. Colorado Underground Injection Control Program; Class VI Primacy (EPA, Rule 2026-20846)
- ATF (Justice Department) filed at least ten separate Paperwork Reduction Act notices on the same day covering its core firearms paperwork, including the forms used to register machine guns acquired by state and local governments and to document marking variances on serial numbers. Most describe the OMB clearance as being “extended,” the normal language for a renewal filed before the old approval runs out, but at least two, including the government-entity registration form, are instead labeled a “reinstatement” of a previously approved collection, the term used when a clearance has already lapsed and needs to be revived. Why the distinction, and why now: a lapsed information-collection approval doesn’t stop ATF from using a form, but it does mean the paperwork briefly lacked current OMB sign-off, and a batch of ten near-identical notices filed together is also exactly the kind of grouping that can bury one more consequential change in the crowd. Application for Registration of Firearms Acquired by Certain Governmental Entities (ATF Form 10, Notice 2026-20837)
- CFTC issued an advance notice of proposed rulemaking asking the public to weigh in on how it should write dedicated rules for crypto asset transactions and markets. An advance notice is the earliest stage of rulemaking, essentially the agency asking for ideas before it drafts an actual proposed rule, which signals the CFTC wants to build a standing regulatory structure for crypto rather than keep policing the space case by case through enforcement actions. Regulation Crypto Asset Transactions and Regulation Crypto Asset Markets (CFTC, Proposed Rule 2026-20888)
- CBP (Homeland Security) proposed requiring international rail carriers to transmit advance passenger and crew information, plus notice of each train’s arrival and departure, for every cross-border trip, extending to rail the kind of manifest reporting that air and sea travel already require. Because this is only a proposed rule, it is now open for public comment before CBP can finalize it, which is the public’s one formal chance to object to or reshape a new cross-border data-collection regime before it takes effect. Advance Traveler Information for Rail (CBP, Proposed Rule 2026-20884)
- Forest Service (Agriculture Department) finalized changes that consolidate and streamline the process the public uses to formally object to a proposed national forest project, such as a timber sale or grazing plan, before it is approved. Objection periods are typically a community’s last chance to flag problems with a project before it is final, since challenging it afterward usually means going to court, so a “streamlining” rule is worth watching for whether it also narrows who can object or shortens the window to do so; the published abstract doesn’t say either way, which is itself a detail worth asking the agency about. Project-Level Predecisional Administrative Review Process (Forest Service, Rule 2026-20890)
This edition was drawn from the full October 13, 2026 Federal Register docket: 103 documents across 34 agencies. Set aside unless something tripped an anomaly flag: dozens of NOAA fishery-management and marine-mammal permit notices, FAA airworthiness directives and airspace amendments, SEC self-regulatory-organization rule filings from Cboe, Nasdaq, MEMX and CME, FERC hydroelectric and combined filing notices, routine OMB/Paperwork Reduction Act extensions not flagged above, Susquehanna River Basin Commission water-use approvals, Coast Guard safety-zone notices, and two routine FHFA Privacy Act system-of-records updates covering internal transit and parking records.
Fediverse reactions
The VA Hospital That Kept Failing the Same Inspection

The VA Office of Inspector General spent four days in August 2025 walking the halls of the VA New Jersey Healthcare System, and what it found reads less like a discovery than a rerun. Untested fire doors. Exposed wiring. Expired hand sanitizer. Missing sprinkler head plates. Every one of these had already been flagged, by two other auditors, in two prior years. The OIG simply confirmed that nobody had done anything about it (VA OIG, Report 25-00242-195, Sept. 25, 2026).

A Facility With Three Report Cards and One Grade

The Joint Commission inspected East Orange and Lyons in the spring of 2024 and found damaged ceiling tiles, emergency pull cords wrapped uselessly around handrails, and a hand sanitizer dispenser bolted directly above an electrical outlet, an arrangement that National Fire Protection Association code exists specifically to prevent. Weeks later, the Veterans Integrated Service Network’s own annual safety evaluation found the same wiring problems, the same missing sprinkler plates, the same neglected eye wash stations. Then in August 2025, sixteen months and one more VISN evaluation later, OIG inspectors arrived and cataloged the identical list. Bugs in light fixtures. An eye wash station blocked by trash cans. Another behind a locked door. A blanket warmer with a broken thermometer, so nobody could confirm it wasn’t running hot enough to injure a patient.

The most damning line in the entire report is not a violation; it’s an explanation. Facility leaders told the OIG that when a Joint Commission finding came in, they assigned a “champion” to fix that specific item, track it for a few months, and close it out. Nobody then checked whether the same defect existed two floors up, or in the other building, or in the room next door. The system was built to close tickets, not to fix conditions. That is not an oversight. That is a workflow, and it is the reason three separate inspections over two years kept finding the same broken country.

The Clock That Stopped in 2018

Buried in the fire safety section is a detail that deserves more alarm than it got. Components of East Orange’s sprinkler system were last fully tested in 2018. Federal fire code requires that testing every three years. Nobody inside the facility caught the seven year lapse. It took an outside inspector, flipping through maintenance logs during a routine three year cycle visit, to notice that the system meant to put out fires in a building full of bedridden patients hadn’t been checked since the first Trump administration.

The facility’s written response is a masterclass in bureaucratic redemption arc, promising a “comprehensive action plan,” an assessment of all six hundred fire doors, “interim life safety measures,” and monthly reporting up a new committee chain. All of this is true and all of it is also what gets written every time an inspector shows up with a clipboard. The test is not the pledge; it’s whether the OIG’s next visit, on its own three year cycle, finds anything different.

Nobody Told the Family

The report’s second major thread involves adverse events, VHA’s term for incidents that harm or nearly harm a patient. In the twelve months before the inspection, the facility recorded a delayed diagnosis, a serious injury, and a death, each the kind of event that VHA policy requires be formally disclosed to the patient or their family. The facility disclosed none of them. Risk managers told OIG inspectors they had “varying interpretations” of which adverse events actually triggered the disclosure requirement, an admission that a policy meant to protect patients had quietly become optional at the point of use.

Separately, patient safety staff had let twenty nine corrective actions from prior root cause analyses go overdue, and executive leadership said they had no idea. The chief of quality had been on the job for fourteen days when the OIG walked in and told her about a backlog that had been accumulating on someone else’s watch for months.

The Corrective Action Plan Is Also a Genre

None of this is new to VA, and none of it is unique to New Jersey. The pattern here, an inspection generates a promise, the promise generates a committee, the committee generates a monthly report, and the underlying condition waits patiently to be rediscovered by the next auditor, is close to the operating system of federal accountability itself. VA New Jersey’s leadership turned over almost entirely in the year before the inspection, a new director, a new chief of engineering, a new quality chief, each inheriting a facility mid collapse and each producing, on cue, a fresh action plan with a fresh target date of March or December 2027.

Reading eleven recommendations and eleven corresponding concurrences, each attached to a specific committee that will “monitor” compliance until some threshold of ninety percent is reached for six consecutive months, one starts to suspect that the compliance theater has become more sophisticated than the compliance itself. The VISN director concurred in one paragraph. The facility director concurred in one paragraph. Both thanked the OIG for the opportunity.

The veterans using that emergency department, the ones navigating a locked interior route or an outdoor ramp to reach it, are unlikely to be reassured by a committee’s monitoring cadence. They would probably just like the doors to close.
Fediverse reactions
CMS Found Possible Errors in Medicaid Financial Data. Then It Didn’t Follow Up.

The Centers for Medicare & Medicaid Services had a system for checking whether states submitted complete Medicaid managed-care financial reports.

It also had a system for checking whether some of the numbers in those reports might be wrong.

What it apparently did not have was a procedure for what to do when the second system found something.

A new Department of Health and Human Services Office of Inspector General report found limitations in CMS’s process for verifying state-submitted medical loss ratio data, including dozens of reports containing potential inaccuracies that CMS identified but did not pursue with the states involved.

The findings concern Medicaid managed-care medical loss ratios, or MLRs. An MLR measures the percentage of a plan’s revenue spent on covered health care services and quality-improvement activities. The federal standard is 85 percent, meaning a plan reaching that figure spent 85 percent on those purposes and the remaining 15 percent on administration and profit.

The numbers aren’t merely informational. States use past MLRs when developing future capitation rates, the fixed monthly amounts paid to managed-care plans for each enrolled beneficiary. States are required to develop those rates so plans can reasonably achieve an MLR of at least 85 percent.

That makes the accuracy of the underlying data rather important.

CMS Couldn’t Check More Than Half the Reports

OIG examined CMS’s oversight of 595 final MLR summary reports submitted by 44 states for the 2019 reporting year.

CMS used five accuracy checks covering four required MLR data elements. According to OIG, those checks identified 57 reports submitted by 16 states containing at least one potential inaccuracy.

There was another problem.

For three of the four required data elements, CMS needed additional information to perform its accuracy checks. But those underlying data elements were optional for states to submit.

The predictable happened.

CMS could not conduct each of four accuracy checks on more than half of the 595 reports. Depending on the check, CMS could test only 43 to 46 percent of them.

Where CMS did have enough information to perform the checks, it found potential problems.

Among the reports CMS could test, it identified 23 potentially inaccurate MLR numerators, 15 potentially inaccurate denominators using one check, 18 using another denominator check, and one potentially inaccurate adjusted MLR. OIG noted that additional optional data might have allowed CMS to identify additional potential inaccuracies.

CMS performed another check by comparing reported “member months” against enrollment information. It could perform that comparison for 448 of the 595 reports and identified 25 with potentially inaccurate member-month figures.

These were potential inaccuracies, not OIG findings that the figures were definitively wrong.

Determining that would have required another step.

And Then, Nothing

CMS itself told OIG that potential inaccuracies require further evaluation and possibly follow-up with states to determine whether the numbers are actually incorrect.

CMS did not follow up with the 16 states.

OIG found that the agency therefore missed an opportunity both to obtain corrected information where errors actually existed and to alert states so they could investigate the questionable data themselves.

Curiously, CMS did have procedures for chasing down missing information.

For the same 2019 reporting year, CMS followed up with states over missing MLR data and successfully obtained 192 initial or resubmitted reports from 19 states.

Its written procedures simply did not specify what employees should do about potential inaccuracies detected by CMS’s own accuracy checks.

Completeness, apparently, had a workflow. Accuracy was still waiting for one.

The Findings Stayed in Their Lane

OIG found another disconnect inside CMS.

As of October 2025, the CMS staff reviewing state-submitted MLR data did not share the results of their accuracy checks with the CMS employees responsible for reviewing states’ future capitation rates.

Those rates are precisely where historical MLR information can matter.

CMS reviews the prospective rates and approves managed-care contracts containing the final rates. OIG concluded that by not communicating the accuracy-check results internally, CMS missed an opportunity for those findings to inform its rate reviews.

OIG recommended that CMS establish procedures for handling potentially inaccurate data, share accuracy-review information with employees reviewing capitation rates, and improve the effectiveness of its MLR oversight, potentially by adding automated accuracy checks to its reporting portal.

CMS concurred with all three recommendations.

An Important Date on the Report Card

There is a significant caveat to the findings.

Although OIG issued the report in September 2026, the data it analyzed came from the 2019 reporting year.

CMS emphasized that point in its response, calling 2019 one of the earlier reporting periods for state MLR submissions and saying it has made substantial improvements since then. Those changes include an MLR toolkit, an optional standardized reporting template, a web-based submission portal and public release of plan-specific MLR data.

The agency also said it has already added automated checks preventing states from submitting reports with blank required fields and will consider expanding the system to perform automated accuracy checks. CMS has encouraged states to submit the optional data needed for additional verification and says it intends to continue doing so.

That means the OIG report does not establish that the same deficiencies persist today.

It does establish something narrower, and peculiar enough on its own.

CMS had financial reports that mattered to Medicaid managed-care oversight. It built checks designed to identify questionable numbers in those reports. Those checks found potential inaccuracies in reports from 16 states.

And when the warning lights came on, there was no procedure telling the agency what to do next.
Fediverse reactions
DOD Cut Its Civilian Workforce. GAO Says It Hasn’t Assessed What Happened at Remote Bases

The Pentagon spent much of 2025 reducing its civilian workforce. At some of the military’s hardest places to staff, the consequences included closed youth programs, reduced services, depleted housing offices and positions that could already take more than a year to fill.

There is just one problem.

According to a new Government Accountability Office report, the Department of Defense has not specifically assessed what those workforce reductions did to critical services at remote and isolated military installations.

GAO examined civilian staffing and services including health care, housing, child care, education, morale and recreation, and military-spouse employment at nine installations. The audit found that remote installations already faced substantial recruiting and retention problems before the latest workforce reductions.

Then came 2025.

GAO identified three major federal workforce actions affecting the installations it examined: the federal and DOD hiring freezes, the Deferred Resignation Program and DOD-directed staffing reductions. Installation officials told auditors those actions affected their ability to hire and retain workers needed to provide critical services.

The numbers suggest DOD was hardly beginning with an abundance of spare personnel.

Across the nine installations examined, GAO counted 624 vacant critical-support positions during fiscal years 2023 through 2025. Eielson Air Force Base in Alaska accounted for 428 of them. Naval Air Station Key West had 95 vacancies, while the Marine Corps Air Ground Combat Center at Twentynine Palms had 83.

Filling those jobs could take considerably longer than ordering the furniture for their offices.

DOD had established a baseline of 98 days for hiring civilian personnel. GAO found that Eielson averaged 407 days. White Sands Missile Range averaged 212 days, Cannon Air Force Base 199, Fort Wainwright 194 and Holloman Air Force Base 158.

All but one of the installations for which GAO could calculate hiring times exceeded DOD’s 98-day baseline.

The reasons are not particularly mysterious.

Officials told GAO that remote installations compete against private employers offering better wages and must convince prospective employees to move somewhere with fewer services and amenities. Alaska installations reported losing prospective engineers and cooks to higher-paying oil and gold-mining jobs. At NAS Key West, officials said child-care job announcements remain continuously open because workers are constantly needed.

DOD installations have tried bonuses and other incentives to compensate. That produces its own peculiar arithmetic.

At some installations, recruitment and retention incentives come from the same account used for civilian salaries. Cannon officials told GAO that an installation with enough funding to hire 10 workers might be able to hire only six or seven after paying the incentives necessary to attract them.

Then the workforce reductions arrived.

GAO found tangible consequences across the installations it visited. Staffing shortages contributed to reduced morale, welfare and recreation programs, shortened operating hours and facility closures. At Fort Greely, officials planned to close the dining facility for certain meals because there weren’t enough employees to operate it full time. GAO noted that alternatives both on and off the installation were extremely limited.

Child care took a hit as well.

Officials at Holloman, Fort Wainwright, NAS Key West and Twentynine Palms told GAO that staffing shortages resulted in closures or reduced hours for child-care or youth programs. The DOD Inspector General had already identified the department’s difficulty providing quality child care as one of its top management and performance challenges for fiscal 2026.

Housing and medical services present another problem because there may be no practical alternative outside the gate.

At NAS Key West, anything beyond basic medical care can require a trip to Miami, more than 150 miles away and more than three hours by car. Officials told GAO that staffing at the installation clinic is thin enough that when personnel are sick or on leave, services can shut down.

At Fort Greely, insufficient primary care means referrals to Bassett Army Hospital, requiring a one-way trip exceeding 100 miles, including during an Alaska winter that officials noted lasts more than six months.

The consequences can reach beyond inconvenience.

GAO found that inadequate medical services can cost military personnel duty time and therefore affect operational readiness. At Cannon Air Force Base, officials reported approximately 12,400 referrals outside the military health system in fiscal 2025 alone and about $587,000 in reimbursable patient travel expenses. The Defense Health Agency spent $28 million for medical care outside Cannon during fiscal years 2024 and 2025.

Against that backdrop, GAO found DOD has not collected specific lessons learned about how its recent civilian workforce reductions affected remote and isolated installations.

That matters because DOD doesn’t even have a settled enterprise-wide picture of which installations belong in that category. The Army and Navy completed new remote-and-isolated designation lists in May 2026. The Air Force did not, arguing that designation without additional resources or authorities would provide little benefit and that critical-service shortages were systemic throughout the service.

GAO made two recommendations. One calls for DOD to establish a clear definition of a remote and isolated installation. The other calls for the department to specifically examine lessons learned from civilian workforce reductions at those locations.

DOD concurred with both.

The larger problem documented by GAO is therefore fairly simple.

Remote installations were already difficult to staff. Some civilian positions already took months, or more than a year, to fill. Medical care could require hundreds of miles of travel. Child-care programs were vulnerable to shortages. And some bases had few alternatives when an on-base service disappeared.

DOD then reduced the civilian workforce.

Now GAO is asking the department to determine what happened next.
Fediverse reactions
America Runs on Stolen Cooking Oil. The Government Tracks the Fuel — But Who Tracks the Grease?

Behind countless American restaurants sits a container filled with something most customers would reasonably consider garbage.

It is the exhausted remnant of the fryer: old cooking oil that has already performed its useful service producing french fries, chicken wings and whatever else emerged from the kitchen before being poured, pumped or otherwise banished into a collection tank out back. To the casual observer, its commercial life would appear to be over.

The federal government, the renewable-fuels industry and a surprisingly industrious collection of thieves would disagree.

Used cooking oil has become a valuable commodity in the American renewable-fuels economy. It can be collected from restaurants, aggregated at warehouses, sold through brokers, transported across state lines and ultimately refined into biodiesel or renewable diesel. Once incorporated into that system, the humble vat of restaurant grease enters a regulatory and financial world involving federal renewable-fuel mandates, tradable compliance credits, detailed recordkeeping requirements and, under the right circumstances, federal tax incentives.

This is how we arrived at the peculiar modern circumstance in which people are stealing used cooking oil by the truckload.

Federal prosecutors have spent the past several years pursuing cases involving organized thefts of restaurant grease across multiple states. Those prosecutions initially look like colorful additions to the endlessly inventive catalog of things Americans will steal when sufficient money is attached to them. Look more closely, however, and they present a more interesting question.

The government has developed elaborate systems for determining what qualifies as renewable fuel, what feedstocks can be used to make it, how environmental attributes are calculated and how the resulting compliance credits move through the market.

What is considerably less clear is who, somewhere along this highly regulated journey from deep fryer to diesel tank, is responsible for establishing that nobody stole the grease.

That question is now the subject of a Bureaucracy Times investigation.

The $60,000 Grease Run

One of the clearest examples comes from western New York, where federal prosecutors have been unraveling an interstate used-cooking-oil theft operation.

In September, Guodeng Chen and Didi Huang pleaded guilty to transporting stolen goods in interstate commerce. According to the U.S. Attorney’s Office for the Western District of New York, the two men caused approximately 45,000 pounds of stolen used cooking oil to be transported from western New York to a refinery in Erie, Pennsylvania, on April 8, 2022.

The shipment brought in $29,433.60.

Twenty days later, another approximately 45,000 pounds traveled to the same destination. That load brought $30,618.

In less than three weeks, the two shipments represented roughly 90,000 pounds of stolen fryer oil worth more than $60,000.

Earlier filings in the prosecution help explain how something extracted from restaurant grease tanks managed to arrive at a refinery hundreds of miles away. Prosecutors described an operation in which participants drove trucks to restaurants, pumped used cooking oil from privately owned collection tanks and transported the material to a warehouse. From there, the oil could be sold through a broker and shipped across state lines to a refinery.

When authorities announced arrests in the broader case in 2023, prosecutors noted that used cooking oil could be refined into biodiesel and resold for approximately $4 to $5 per gallon.

Suddenly, stealing grease from behind a restaurant begins to look somewhat less eccentric.

The important feature of the New York case, however, is not simply that the oil was stolen. Theft requires little regulatory analysis. The interesting part is what happened afterward.

The stolen commodity moved from restaurant tanks into a warehouse, through a commercial intermediary and eventually to a refinery.

Somewhere along that journey, stolen property entered an otherwise legitimate industrial supply chain.

Iowa, and the Industrialization of Grease Theft

The New York prosecution might be dismissed as an unusually ambitious local theft operation were it not for what federal authorities have been prosecuting elsewhere.

In Iowa, the Justice Department has brought a sprawling case involving what prosecutors allege was an organized enterprise devoted to stealing and reselling used cooking oil. The prosecution eventually grew to include 19 defendants.

According to the government, members of the alleged operation stole or attempted to steal used cooking oil from restaurants across Iowa, Tennessee, Minnesota, Indiana, Ohio, Alabama, Illinois, Nebraska, Missouri and Kentucky. The material was allegedly transported to warehouses in several states, consolidated and resold.

Two defendants, Tianzhu Chen and Yong Chen, pleaded guilty in September to racketeering conspiracy charges. Tianzhu Chen also pleaded guilty to money laundering. Other defendants remain scheduled for trial in April 2027, and the allegations against those who have not pleaded guilty remain precisely that: allegations.

What the Iowa case adds is scale.

This was not a matter of somebody occasionally discovering that a restaurant had neglected to lock the grease tank. Prosecutors describe an alleged network involving vehicles, warehouses, interstate transportation and resale operations spread across a substantial portion of the country.

The existence of such infrastructure tells us something about the underlying commodity.

Nobody builds an interstate logistics network around something that has no value.

Used cooking oil has value because the substance restaurants are finished with is something the renewable-fuels industry still wants.

And that is where a curious theft story becomes a regulatory story.

Washington Discovers the Fryer

Used cooking oil is among the feedstocks that can be converted into renewable transportation fuels. Once that happens, it enters one of the more intricate corners of federal energy policy.

Under the Environmental Protection Agency’s Renewable Fuel Standard, qualifying renewable fuels can generate Renewable Identification Numbers, commonly known as RINs. EPA itself describes RINs as the “currency” of the Renewable Fuel Standard program.

The system exists because certain refiners and importers have renewable-volume obligations. RINs are generated in connection with qualifying renewable fuel, transferred through the market and ultimately retired by regulated parties to demonstrate compliance.

Naturally, there is a federal electronic system for this.

The EPA Moderated Transaction System, or EMTS, records transactions involving RINs. Renewable-fuel producers operate under registration, reporting and recordkeeping requirements, and federal regulations specify which feedstocks and production pathways qualify for the program.

Used cooking oil therefore does not wander casually into the federal renewable-fuels regime. There are rules.

Those rules include documentation concerning the feedstock itself. A renewable-fuel producer using used cooking oil or certain other waste materials must maintain records from suppliers certifying information relevant to whether the material qualifies as renewable biomass, including descriptions of the material and the process that generated it.

The federal government, in other words, has developed mechanisms for establishing that the grease really is the correct kind of grease.

Our investigation has encountered a more elementary problem.

Suppose the material unquestionably originated in a restaurant fryer. Suppose it satisfies the relevant federal definition. Suppose its chemical and environmental characteristics make it perfectly acceptable as renewable-fuel feedstock.

Suppose, however, that somebody stole it.

The oil has not undergone a molecular transformation during the theft. It remains exactly the same renewable biomass it was before somebody arrived behind the restaurant with a pump.

Its legal provenance is another matter entirely.

So far, Bureaucracy Times has not identified a nationwide federal Renewable Fuel Standard requirement specifically requiring a renewable-fuel producer to establish that used cooking oil was lawfully acquired from the restaurant or other original generator.

That finding requires an important qualification.

It does not mean no safeguards exist.

Companies may impose contractual requirements on suppliers. Brokers may conduct due diligence. State property laws still apply. Industry auditing programs, fraud controls, supplier certifications and private compliance systems may provide additional layers of protection. A refinery receiving stolen material unknowingly is in an entirely different position from somebody knowingly trafficking stolen goods.

Our question is narrower.

Within the federal renewable-fuels system itself, where is lawful ownership established?

So far, that answer has proved surprisingly difficult to locate.

Then There Is the Tax Code

As often happens when Washington creates a sufficiently complicated regulatory system, eventually the Internal Revenue Code arrives.

Section 45Z created the Clean Fuel Production Credit for qualifying transportation fuels produced in the United States beginning in 2025. The credit covers qualifying sustainable aviation fuel and other clean transportation fuels, with its value tied in part to emissions characteristics and other statutory requirements.

Producers seeking the credit must satisfy federal eligibility and registration requirements.

Here, too, provenance matters.

Treasury and IRS have grappled explicitly with the origin of used cooking oil in the context of imported feedstocks and concerns about distinguishing UCO from substances such as palm oil. Beginning with fuel produced after Dec. 31, 2025, qualifying fuel generally must be derived exclusively from feedstocks produced or grown in the United States, Mexico or Canada.

The government therefore cares where the feedstock came from.

It cares what the feedstock is.

It cares how the resulting fuel was produced.

It cares about emissions calculations, producer registration and eligibility for federal tax benefits.

This represents a considerable amount of institutional curiosity about a substance that began its life bubbling beneath a basket of potatoes.

Which brings us back to the comparatively unsophisticated question at the center of this investigation:

Does anybody have to prove that it wasn’t stolen?

We Asked the Government

On Sept. 23, Bureaucracy Times sent the Environmental Protection Agency seven questions about the provenance of used cooking oil entering the Renewable Fuel Standard system. EPA acknowledged the inquiry the following day, later requested additional time, and supplied substantive written answers on Oct. 7.

The response clarified what the federal program follows, and what EPA did not establish that it follows. EPA described existing RFS records addressing feedstock identity, renewable-biomass eligibility and point of origin. But in its answers, the agency did not identify a specific nationwide requirement to document that the restaurant or other original generator authorized the removal of the oil.

That distinction matters. A record showing where grease originated is not necessarily a record establishing that its owner agreed to surrender it. The two questions can be related without being interchangeable.

We also asked what would happen if stolen cooking oil made its way into renewable fuel and associated RINs. EPA did not provide a categorical ruling that such fuel would qualify or be disqualified. Its answer depended on the particular facts and records. Nor did the agency suggest that theft is outside the government’s reach: it said unlawful acquisition of UCO may be investigated by EPA’s Criminal Investigation Division, while declining to comment on enforcement matters involving the Iowa prosecution.

There is a revealing regulatory footnote. In a June 17, 2025 proposal published at 90 FR 25784, EPA contemplated expanded point-of-origin documentation. The agency told Bureaucracy Times that the additional documentation was not finalized in the Set 2 final rule. Even such documentation would not, by itself, necessarily amount to proof of authorization by the original owner. But the proposal shows that EPA has considered how much more of the feedstock’s journey should be documented.

Asked about a national chain-of-custody system comparable to California’s controls for inedible kitchen grease, EPA offered a general statement about program integrity without confirming an equivalent nationwide requirement.

None of this establishes that a particular producer violated RFS rules, that stolen oil generated RINs, or that EPA lacks enforcement authority. It establishes a narrower and more consequential reporting point: when asked directly about proof of lawful acquisition from the original generator, EPA’s response did not identify that safeguard as an explicit federal RFS documentation requirement.

Bureaucracy Times also sent questions to Treasury and IRS concerning Section 45Z, including whether substantiation for the Clean Fuel Production Credit establishes lawful acquisition of used cooking oil. We have not received a substantive answer to that inquiry as of this article’s preparation.

The U.S. Attorney’s Office for the Southern District of Iowa declined to provide additional responses beyond the public record. Open-records requests and other follow-up inquiries may yet clarify how regulators and investigators approach the movement of stolen feedstocks into otherwise lawful markets.

But the existing public record already demonstrates the problem: organized theft occurs, interstate resale networks exist, and in the New York prosecution stolen cooking oil passed through commercial intermediaries to a refinery.

Following the Grease

There is a temptation in stories involving federal subsidies, environmental regulations and criminal enterprises to leap directly from correlation to scandal. That would be premature here.

We have found no evidence that the Pennsylvania refinery identified in the New York prosecution knew the oil was stolen.

We have found no evidence establishing that the stolen shipments generated RINs.

We have found no evidence that those shipments resulted in Section 45Z tax credits or any other federal financial benefit.

Nor does the existence of federal incentives for renewable fuels somehow explain the criminal conduct of people stealing restaurant grease.

Those are distinctions worth maintaining, particularly because the question we can document is interesting enough without embellishment.

Federal prosecutors have demonstrated that stolen used cooking oil can leave a restaurant, pass through warehouses and brokers, cross state lines and reach the renewable-fuels industry.

At the same time, the federal government operates an elaborate regulatory structure concerned with the identity, origin, environmental characteristics and ultimate disposition of renewable-fuel feedstocks.

Somewhere between those two realities lies the provenance problem.

EPA has now described the feedstock records the RFS requires, without identifying a specific requirement to prove that the original generator authorized removal. Treasury or IRS may yet identify additional substantiation relevant to clean-fuel tax credits. Records obtained through FOIA may reveal enforcement practices not readily apparent from the regulations themselves.

We will report those findings as they emerge. For now, the EPA response leaves open whether the United States has constructed a regulatory system capable of following the environmental attributes of a gallon of renewable fuel with considerable precision while remaining remarkably incurious about who owned the raw material before it entered the system.

Either answer is worth knowing.

For now, the trail begins where the thieves apparently discovered it long ago:

behind the restaurant, next to the dumpster, in a tank full of something that turns out not to be garbage at all.
Fediverse reactions
The Label Only Needed One Signature. That Was the Problem.

Every kidney that leaves an organ procurement organization is supposed to travel with two things attached to it: a label confirming which kidney it is, and the signatures of two separate human beings swearing that label is correct. The federal government built that redundancy on purpose, because the alternative to redundancy is a courier showing up at a transplant hospital with the left kidney labeled as the right one. According to a new HHS Office of Inspector General audit, that alternative has already happened. More than once. The report just wasn’t supposed to be the one that found it.

An Audit About Money That Found a Body Problem

OIG set out to check whether independent organ procurement organizations, the not-for-profit entities that recover and ship organs for transplant, were reporting their kidney transportation costs correctly on their Medicare cost reports. That is, on its face, an accounting story. Auditors sampled 213 high-dollar kidney transportation costs across 43 of these OPOs and found that 32 of them had reported a combined $428,325 in unallowable expenses, either by dumping the cost of flying a multi-organ recovery team onto the kidney line item, or by billing Medicare for driving a donor’s body to a funeral home, which is not, whatever an OPO’s accounting department may have believed, a step in organ acquisition.

That’s a real finding, and a real number, though a modest one against the $53.6 million in kidney transportation costs the audit actually covered. It is also, and this matters, not the finding buried five pages later. Four of the 43 OPOs failed to meet Medicare’s separate requirement that two people, one of them an OPO employee, physically verify the label on an organ before it ships. Three of those four submitted verification forms signed by exactly one person. The fourth never sent the required donor documentation to three transplant hospitals at all. OIG did not find a mislabeled organ in its own sample. But it did note, almost in passing, that “some OPOs mentioned incidents in which labeling errors had resulted in the wrong organs being sent for transplant,” including one case in which a label for a left kidney ended up on the container for the right one. That sentence is doing more work than the entire cost-allocation section, and it arrives as a footnote to a footnote.

“Clerical Error,” Four Times in a Row

Ask an OPO why it filed for reimbursement of a lung recovery team’s flight as a kidney expense, and the answer, nearly every time, is clerical error or a misunderstanding of Medicare’s rules. Ask an OPO why it billed the transportation of a dead body to a funeral home as an organ acquisition cost, same answer. Ask an OPO why only one person signed a label verification form that federal regulation requires two people to sign, same answer again. Four separate OPOs gave OIG the identical explanation for the identical failure; staff made a mistake, nobody caught it.

There is a point at which “clerical error” stops describing an incident and starts describing a system. Three OPOs out of four, independently, produced a verification form with one signature where the rule requires two. That is not a typo. That is a control that exists on paper and does not exist in practice, at three different organizations that likely never spoke to each other about it. The audit’s own explanation for why this keeps happening is almost sympathetic (Palmetto GBA, the Medicare administrative contractor responsible for reviewing these cost reports, has never provided direct training to OPOs on how to report transportation costs). It has, per its own account to auditors, discussed the subject “frequently.” Frequent conversation is not instruction, and OIG’s two recommendations to CMS, recover the money and “provide additional education,” read less like accountability and more like a request that someone finally hold the seminar that should have happened years ago.

The Kidney Gets Reviewed. Everything Else Doesn’t.

Here is the structural reason 32 of 43 OPOs found it so easy to misfile these costs; Palmetto reviews and caps an OPO’s standard acquisition charge for kidneys, and only kidneys. Nonkidney organs, livers, hearts, lungs, get no such review, and Medicare settles up retroactively with OPOs for kidneys but never for anything else. That asymmetry creates an obvious, if unglamorous, incentive; a cost that gets scrutinized as a kidney expense and a cost that gets waved through as a liver expense are not treated the same way on the back end, and an OPO’s accounting staff does not need to be dishonest to notice which line item is safer to pad.

CMS has actually acknowledged this is a problem, just not urgently. Its FY 2027 Inpatient Prospective Payment System final rule, issued July 31, 2026, extends MAC review to standard acquisition charges for all organ types, and requires retroactive settlement adjustments for nonkidney organs too. The effective date is October 1, 2028. That is two full budget cycles from now, during which the exact incentive structure that produced $428,325 in documented misallocation over an 18-month audit window remains fully intact, uncorrected, and unreviewed for anything that isn’t a kidney.

CMS Concurred, Which Is Not the Same as CMS Acting

CMS’s written response to the draft report is exactly what a government agency’s written response to a draft OIG report usually is; concurrence with both recommendations, a promise to instruct Palmetto to recover the identified reimbursements “consistent with relevant law and the agency’s policies and procedures,” and a commitment to “explore the most effective and efficient way” to get education to OPOs about costs they’ve apparently been miscoding since at least the start of this audit period. Nothing in CMS’s comments, at least in the portion of the letter accompanying the report’s narrative summary, addresses the labeling failures directly, and nothing in either OIG’s recommendations or CMS’s response proposes anything beyond training for the four OPOs that shipped organs without proper verification. Federal rule gives CMS the authority to decertify an OPO that is out of compliance with a process performance measure, making it ineligible for Medicare reimbursement entirely. That authority goes unmentioned. What gets recommended instead, for a failure OIG itself says “may increase risks to patient safety and may lead to compromised transplant outcomes,” is the same fix proposed for OPOs that miscoded a funeral home bill, education.

The 43 OPOs in this audit are never named. OIG’s own account of the industry describes each one only as “one OPO” or “another OPO,” a convention that protects individual organizations from scrutiny while the aggregate failure gets a press release. Whether that anonymity survives a records request is a question for another piece. Whether a two-year runway before nonkidney costs get reviewed at all survives without another mislabeled kidney reaching a transplant hospital is a question nobody in this report seems in a hurry to answer.
Fediverse reactions
DOT Systems Missed Required Privacy Reviews as Staffing and Funding Gaps Undercut Compliance

Three years after a data breach exposed personal information belonging to roughly 237,000 current and former federal employees, the Department of Transportation was still failing to consistently perform required annual privacy assessments on information systems containing personally identifiable information, according to a new inspector general audit.

The explanations were considerably less sophisticated than the technology involved.

At one DOT agency, officials could not fully explain why required privacy work had not been completed because the employees previously responsible for the program had left. At another, privacy responsibilities were divided among offices and officials acknowledged that completing the work had not been made a funded priority.

The findings come from a Department of Transportation Office of Inspector General audit examining whether DOT had established an effective privacy program and implemented required controls for protecting personally identifiable information, or PII.

OIG identified 247 DOT systems containing PII and selected a statistical sample of 55 for review. Nine of those 55 systems — roughly 16 percent of the sample — did not receive required annual privacy risk assessments.

The audit does not establish that those systems were breached or that information contained within them was improperly accessed. Rather, the missing assessments meant DOT could not demonstrate that it was consistently performing one of the controls intended to identify and address changing privacy risks.

That distinction matters. So does the history.

In May 2023, DOT disclosed a breach involving its Federal Transit Benefit Program that exposed PII belonging to approximately 237,000 current and former federal employees. OIG had also previously identified weaknesses in DOT’s implementation of privacy policies in audits issued in 2018 and 2019.

The latest audit suggests that some of the basic compliance problems persisted.

At the Federal Motor Carrier Safety Administration, OIG found that three systems did not receive required annual privacy assessments during fiscal years 2022 through 2024: SAFETYNET, the Enforcement Management Information System, and the National Consumer Complaint Database.

The National Consumer Complaint Database also lacked required Privacy Threshold Analyses during the period reviewed.

When auditors sought an explanation, FMCSA officials could not provide documentation or direct knowledge explaining why the assessments had not been completed.

There was a bureaucratic complication: according to OIG, the personnel responsible for managing FMCSA’s privacy program from fiscal years 2019 through 2024 had left the agency.

In other words, the institutional knowledge apparently departed with the employees.

The Federal Aviation Administration had its own version of the problem.

OIG found six FAA systems that had not received required annual privacy assessments during fiscal years 2022 through 2024. Another system received an assessment in fiscal 2023 but not in fiscal 2024.

The affected systems identified by OIG included the National Flight Data Center, National Airspace System Resource System, Flight Activity and Crew Tracking System, Weather Systems Processor and Weather Camera System.

FAA officials attributed the deficiencies partly to how privacy responsibilities were distributed between privacy personnel and individual system owners.

But OIG also reported a more straightforward explanation.

According to FAA’s chief privacy officer, Air Traffic Organization leadership had not made the required privacy work a funded priority, limiting the organization’s ability to complete necessary privacy documentation.

That left a federal privacy requirement competing for attention and resources inside an agency responsible for some of the country’s most consequential transportation systems.

OIG identified a broader management problem as well.

During the audit period, DOT lacked a formally approved department-wide privacy program plan meeting federal requirements. Department officials provided auditors with various policies, procedures, strategic documents and other materials that they maintained collectively constituted such a program.

OIG disagreed.

Auditors found DOT could not demonstrate that its senior agency official for privacy had formally approved or designated those materials as the Department’s privacy program plan. Some strategic documents were unsigned and lacked required goals and objectives.

DOT has since corrected that deficiency.

In January 2025 — after the fiscal 2024 period examined by auditors — the Department completed and formalized its privacy program plan. That makes the audit less a story about DOT currently operating without a privacy plan than one about how inconsistently required privacy controls were implemented before and during the period under review.

OIG ultimately issued just two recommendations.

The inspector general recommended that DOT maintain its newly established enterprise privacy plan and ensure that annual privacy risk assessments are performed for Department information systems.

DOT concurred with both recommendations. OIG considers them resolved but open until the Department completes the promised corrective actions.

The audit therefore stops short of uncovering another major DOT data breach.

Instead, it documents something less dramatic but arguably more familiar: federal agencies had established privacy requirements, officials knew assessments were supposed to be performed, and some of those assessments nevertheless went undone because personnel changed, responsibilities were fragmented and resources were directed elsewhere.

For a Department still operating in the shadow of a breach affecting 237,000 people, those are precisely the mundane administrative failures privacy controls are supposed to prevent from becoming something considerably less mundane.
Fediverse reactions
The Hospital Built on a Document That Never Existed

In September 2026, the Department of Veterans Affairs Office of Inspector General published a review of the new VA medical center in Louisville, Kentucky, a hospital that Congress authorized in 2010 and that, as of this writing, still is not open. The current completion estimate is November 2027. That puts the project at thirteen years behind its original schedule, sixteen years past its congressional authorization, and about $700 million over its 2007 cost estimate of $418.8 million. The bill now stands at more than $1.1 billion.

None of that is the interesting part. Federal construction runs late; everyone involved has made peace with it. The interesting part is what the OIG found when it went looking for the document that was supposed to justify all of it, the “business case” that federal budget rules require agencies to submit to the Office of Management and Budget before spending real money on a capital project. VA never submitted one. Not a bad one, not an outdated one. None. The OIG’s entire review of thirteen extra years and $700 million in overruns had to be built on a draft business case from 2007 that VA itself says was abandoned when the project got left out of the fiscal year 2009 budget request. The department spent nineteen years building a hospital against a plan that was never finished and never approved, and then acted surprised when the OIG asked to see the paperwork.

A Billion Dollars, Zero Documentation

Under OMB Circular A-11, a business case is not a formality. It is the instrument that establishes a project’s cost, schedule, and performance goals, the baseline against which everyone (Congress, OMB, and eventually inspectors general) is supposed to measure whether the government got what it paid for. VA’s executive director of the Office of Asset Enterprise Management confirmed to the OIG, on the record, that no business case for Louisville was ever submitted to OMB. Because VA could not produce one, the OIG did the only thing it could do under the Inspector General Act, classifying the entire $1.17 billion in project obligations as a questioned cost, meaning money spent without adequate supporting documentation to justify it.

VA’s defense, offered in its official response, is that the business case “was not required” because Louisville funding did not make it into the fiscal year 2009 budget request. This is the bureaucratic equivalent of explaining that you never filed a permit application because the building got built before you got around to filling out the form. The OIG did not buy it, noting plainly that being left out of one year’s budget cycle does not relieve a department of its ongoing obligation to maintain a supportable basis for a billion-dollar decision. VA also leaned on the fact that the Army Corps of Engineers has managed construction execution since 2015, arguing that anything that went wrong afterward was the Corps’ problem, not VA’s. The OIG’s response to that one is worth quoting for the sheer bluntness of it; the mandated construction services provided by the Corps do not absolve VA of its own responsibility to approve and report changes and account for costs. In plain terms, VA does not get to outsource the paperwork along with the construction.

The Books Do Not Add Up, and Nobody Told Congress

The missing business case would be a bureaucratic embarrassment on its own. What makes it worse is that VA also cannot accurately tell Congress what the project has actually cost. The congressionally approved cost ceiling, set in fiscal year 2023, is just over $1.013 billion. The OIG’s own reconciliation of VA’s accounting systems found $1.17 billion in actual obligations and pending user costs, once you add in $43.4 million in advance planning charges, $76.6 million in Army Corps management fees, and $40 million in unreported “user-requested changes” (design fixes for sterile processing, mental health space, and interventional radiology that must happen before the hospital can even open) that never made it into the reported total. That is a discrepancy of nearly $160 million, comfortably past the 10 percent threshold that federal rules say requires notifying Congress that a project has blown through its authorized ceiling. VA did not send that notice. It also missed two consecutive quarterly cost reports to Congress that are legally required under 38 U.S.C. § 8120 for any project over $100 million, a category Louisville has occupied for well over a decade.

Layered on top of the money problem is a change-control problem. VA’s internal process requires anything altering a project’s scope, schedule, or cost by more than 10 percent to be signed off by the Secretary and a body called the Construction Review Council. The OIG found five major change requests on this project. Two of the three that should have gone to the Secretary or the Council never got that approval. Four of the five were missing at least one required signature. In one memorable stretch documented in the report, a design contractor was told in May 2013 to build the new hospital as a shared structure with a Veterans Benefits Administration office, then in August was ordered to stop and redesign around an entirely new atrium concept, then was formally suspended in October and not cleared to resume until the following February. That is 288 days of paid design work thrown out for a change nobody ran through the approval process, on a project that did not have years to spare.

Sixteen Years of Warnings the Department Had Already Heard

If any of this sounds familiar, that is because GAO told VA the same story more than a decade ago. In an April 2013 report examining VA’s largest medical-facility projects at the time (Denver, Las Vegas, Orlando, and New Orleans), GAO found cost increases ranging from 59 to 144 percent and schedule delays averaging nearly three years, driven by the same failures the Louisville OIG report identifies now (inadequate planning, unmanaged scope changes, and a construction management structure that could not keep pace with its own decisions). Congress held hearings. GAO made recommendations. VA implemented some of them. And Louisville, which had already been under construction for years by the time that 2013 report came out, went on to rack up cost increases north of 170 percent anyway.

The environmental review process alone cost the project years it did not have to lose. VA had planning funds available to start environmental assessments before its 2010 budget authorization and used them for a feasibility study, but let initial design work sit idle for lack of funding and did not award its first environmental assessment contract until ten months after authorization. The agency then spent a year deciding whether to pursue a lighter environmental assessment or a full environmental impact statement, chose the lighter path, and got burned for it: in 2015, the assessment’s own contractor concluded a “finding of no significant impact” was not supportable and warned that proceeding anyway would leave VA exposed to litigation. VA pivoted to the full impact statement, which was not finalized until 2017, by which point a nearby community had already sued to block the project outright, adding roughly three more years of delay before a federal court ruled in VA’s favor.

Seven recommendations came out of this review, and VA concurred with all of them, which is what agencies do when there is no plausible way to disagree. Target completion dates stretch out to May 2027, conveniently just before the hospital itself is supposed to open. The OIG says it will keep the recommendations open until VA proves it actually fixed things. Given that this department was already living through nearly identical GAO findings when ground had barely broken on this project, there is no particular reason to expect the sixth recommendation letter to land any differently than the first.
Fediverse reactions