Update the EBLL tracker to show whether one or multiple children have an EBLL and whether the unit, building, or development previously had an EBLL reported.

Update the EBLL tracker by including which data fields are required, establishing what type of information can be entered into each data field, and disallowing case closure if required information is missing.

PIH in coordination with other HUD offices as necessary, research and address potential causes of the variance in the number of EBLL cases among States on the EBLL tracker and identify solutions that are within HUD's control.

Status

On May 7, 2024, the Office of Field Operations (OFO) stated that it met with the Real Estate Assessment Center (REAC) and Office of Lead Hazard Control and Healthy Homes (OLHCHH) on March 4 and April 23 and agreed that OFO and OLHCHH will review CDC data on counties with the highest prevalence of EBLLs in children for counties whose states that have reported their BLL data to CDC. OFO will review its EBLL tracker to determine reporting rates by the largest public housing authorities in those counties. OLHCHH will assign an analyst to summarize the most recently available prevalence rates based on selected states. Subsequently, OFO will scrutinize public housing authorities within those states to ascertain the reported cases.

The revised estimated completion date is February 28, 2025.

Analysis

To fully address this recommendation, OFO must provide evidence of meetings held and summaries of the research conducted. For example, what was the exchange with OLHCHH, did OFO coordinate with any other offices, and what research was conducted? OFO needs to research potential causes for the variances and determine what HUD could do to address them.

Alternatively, OFO must establish that there are no solutions within HUD’s control to address any identified causes.

Implementation of this recommendation will help ensure that EBLL cases are reported and recorded appropriately in the EBLL tracker.

Create a plan and timeline that outlines OFO’s proposal to move the LBPR tracker to a different platform.

Develop a timeliness standard in the LBPR tracker to establish expectations for how often field office staff must reach out to PHAs on the LBPR tracker to discuss measures that will resolve cases in a timely manner.

Update HUD regulations, policies, and procedures following the regulatory process required by the amended Lead Safe Housing Rule, in consideration of CDC’s lowered BLRV of 3.5 ug/dL.

Status

On June 12, 2024, the Office of Lead Hazard Control and Healthy Homes informed HUD OIG that the draft Federal Register notice of its request for information from Lead Safe Housing Rule stakeholders and the general public on its proposal to adopt CDC's BLRV of 3.5 µg/dL as its EBLL under the rule has been circulated for OGC and preclearance review, which will be followed by Departmental clearance. OLHCHH plans on publishing the Federal Register notice by June 30, 2024, with a 60-day comment period. OLHCHH will provide the link and the link and the notice once it is published. OLHCHH will then review public comments in preparing to decide whether to change the rule's current level, and if so, to what level.

The Office of Lead Hazard Control and Healthy Homes estimated this will be completed by June 30, 2024.

Analysis

To fully address this recommendation, OLHCHH must provide evidence that it has updated its regulations, policies, and procedures so that they are consistent with CDC’s lowered BLRV of 3.5 ug/dL.

Alternatively, OLHCHH must establish that its research led it to determine that environmental interventions in cases of children with EBLLs between 3.5 and 4.9 µg/dL were ineffective in reducing the children’s blood lead levels and that lowering HUD’s EBLL regulation to 3.5 µg/dL is unnecessary.

Implementation of this recommendation will help ensure children living in public housing with EBLLs receive effective environmental interventions.

Identify short- and long-term plans for the RPA program that align its capabilities, staffing needs, funding projections, and mission needs.

Implement procedures to capture and monitor centralized logs to maintain appropriate visibility into bot activities and provide for auditability of bot actions.

Implement procedures to periodically review RPA system access and remove access for users that are not authorized or no longer have a need to use the system.

Implement procedures to ensure that attended bots use the security rights and credentials of the attending user.

Provide more detailed guidance to HUD reviewers on benchmarks for each performance standard.

Update the PAR template to ensure that HUD reviewers include required information.

Assess HUD reviewers’ skills and readiness to determine the appropriate frequency of training.

Provide more detailed guidance to HUD reviewers and FHEO regional directors on when and under what circumstances to recommend or issue a PIP.

HUD OCIO should implement procedures to ensure that information in cybersecurity risk registers is obtained accurately, consistently, and in a reproducible format and is used to a. quantify and aggregate security risks, b. normalize cybersecurity risk information across organizational units, and c. prioritize operational risk response (derived from metric 5).

HUD OCIO and the HUD Chief Risk Officer should coordinate to implement procedures to monitor the effectiveness of cybersecurity risk responses to ensure that risk tolerances are maintained at an appropriate level (derived from metric 5).

HUD OCIO and the Office of Administration should implement procedures to ensure proper validation of media sanitization in accordance with HUD Media Protection Procedures 2.0 (February 2022) and form HUD 1067A, Certification of Sanitization (derived from metric 36).

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

HUD OCIO should ensure that system owners and information system security officers consistently test their ISCPs and upload the test results to CSAM in accordance with HUD’s defined ISCP testing policy (derived from metric 63).

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.