Reported Medicaid Year 2000 Readiness (05-OCT-99, AIMD-00-22R).  
								 
Pursuant to a congressional request, GAO determined: (1) what the
Health Care Financing Administration (HCFA) is doing to ensure	 
that the year 2000 computing challenge does not adversely affect 
the delivery of Medicaid benefits; and (2) the readiness of	 
states to successfully transition to year 2000 for Medicaid.	 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   AIMD-00-22R					        
    ACCNO:   162839						        
  TITLE:     Reported Medicaid Year 2000 Readiness		      
     DATE:   10/05/1999 
  SUBJECT:   Computer security					 
	     Computer software verification and 		 
	     validation 					 
								 
	     Federal/state relations				 
	     Health care programs				 
	     Internal controls					 
	     Management information systems			 
	     State-administered programs			 
	     Strategic information systems planning		 
	     Y2K						 
	     Medicaid Program					 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Testimony.                                               **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
AIMD-00-22R

United States General Accounting Office Accounting and Information
Washington, DC 20548 Management Division

8- 2838 15 October 5, 1999 The Honorable William V. Roth, Jr. Chairman The
Honorable Daniel Patrick Moynihan Ranking Minority Member Committee on
Finance United States Senate

Subject: Reported Medicaid Year 2000 Readiness At your request, we
determined (1) what the Health Care Financing Administration (HCFA) was
doing to ensure that the Year 2000 computing challenge does not adversely
affect the delivery of Medicaid benefits and (2) the readiness of states? to
successfully transition to year 2000 for Medicaid. On September 30, 1999, we
briefed your offices on the results of our work. This report provides a
high- level summary of information presented at that briefing. Our briefing
slides are enclosed.

Background In fiscal year 1998, Medicaid paid about $169 billion for medical
services to millions of recipients. A joint federal- state program overseen
by HCFA and administered by the states, Medicaid provides health coverage
for about 33 million low- income people, which include children, the
elderly, blind, and disabled individuals.

The federal government has a large vested interest, both programmatically
and monetarily, in automated state systems that support the Medicaid
program. Accordingly, it is essential that states successfully address the
Year 2000 computing problem. Unless they do, beneficiaries could be denied
critical medical services, incorrect eligibility decisions could be made,
and payments could be made for the wrong amounts- or not at all.

HCFA?s Actions Have Reduced the Risk of Year 2000- Induced Failures

HCFA has taken several actions that have significantly reduced the risk that
the Medicaid program will encounter Year 2000 failures. In particular, it
has adopted an approach that

?In the context of this report, the term state includes the District of
Columbia, Puerto Rico, and the Virgin Islands.

GAO/ A& ID- 00- 22R Year 2000 Status of Medicaid

United States General Accounting Office Accounting and Information
Wzhington, DC 20548 Management Division

B- 2838 15 October 5, 1999 The Honorable William V. Roth, Jr. Chairman The
Honorable Daniel Patrick Moynihan Ranking Minority Member Committee on
Finance United States Senate

Subject: Renorted Medicaid Year 2000 Readiness At your request, we
determined (1) what the Health Care Financing Administration (HCFA) was
doing to ensure that the Year 2000 computing challenge does not adversely
affect the delivery of Medicaid benefits and (2) the readiness of states? to
successfully transition to year 2000 for Medicaid. On September 30, 1999, we
briefed your offices on the results of our work. This report provides a
high- level summary of information presented at that briefing. Our briefing
slides are enclosed.

Background In fiscal year 1998, Medicaid paid about $169 billion for medical
services to millions of recipients. A joint federal- state program overseen
by HCFA and administered by the states, Medicaid provides health coverage
for about 33 million low- income people, which include children, the
elderly, blind, and disabled individuals.

The federal government has a large vested interest, both programmatically
and monetarily, in automated state systems that support the Medicaid
program. Accordingly, it is essential that states successfully address the
Year 2000 computing problem. Unless they do, beneficiaries could be denied
critical medical services, incorrect eligibility decisions could be made,
and payments could be made for the wrong amounts- or not at all.

HCFA?s Actions Have Reduced the Risk of Year 2000- Induced Failures

HCFA has taken several actions that have significantly reduced the risk that
the Medicaid program will encounter Year 2ooO failures. In particular, it
has adopted an approach that

?In the context of this report, the term state includes the District of
Columbia, Puerto Rico, and the Virgin Islands.

GAO/ A& ID- 00- 22R Year 2000 Status of Medicaid

includes three rounds of on- site contractor reviews of states (performed in
conjunction with HCFA regional and headquarters offices) using a standard
methodology. Between November 1998 and April 1999, the contractor completed
the. initial round of on- site reviews in all 50 states and the District of
Columbia. These reviews included assessments of states? integrated
eligibility systems* and Medicaid management information systems (MMIS) 3 in
areas such as project management and planning, remediation progress,
testing, and contingency planning. After completing the on- site state
review, the contractor (1) identified barriers to successful remediation;
(2) made recommendations to address specific areas of concern; and (3)
placed Medicaid integrated eligibility and management information systems
into low, medium, or high risk categories based on the quality and
completeness of project management/ planning, progress in remediation,
quality management, testing, and contingency planning.

Since May 1999, HCFA?s contractor has (again, along with officials from HCFA
regional and headquarters offices) conducted a second round of on- site
reviews in 40 states- primarily those in which at least one system had been
categorized as a high or medium risk during the initial visit. As in the
first round, the state systems were placed in low, medium, or high risk
categories. A system?s risk level was determined based on the resolution of
critical issues previously identified, progress in remediation, testing, and
senior management support. During this round, HCFA?s contractor also
conducted follow- up telephone calls to four states not visited. HCFA?s
third and final round of contractor visits began during the last week of
September. The list of states to undergo third- round visits has not been
finalized, but among the criteria HCFA plans to use is visiting states with
the highest risk systems and business continuity and contingency plans, as
well as states with the largest number of Medicaid recipients. In addition,
agency officials told us that all states will either be visited or undergo
follow- up telephone calls.

To complement its system reviews, HCFA obtained another contractor to review
state business continuity and contingency plans. Such plans are crucial.
Without them, if unpredicted failures occur, an entity will not have well-
defined responses and may not have enough time to develop and test
alternatives. In June 1999, HCFA?s contractor began reviewing the quality of
state plans, based on either a desk audit or on both a desk audit and an on-
site visit. After the contractor?s review, each state?s business continuity
and contingency plan was placed into a high, medium, or low risk category
based on the contractor?s evaluation of the state?s development process and
the quality and completeness of its plan. In September 1999, HCFA
headquarters officials also began reviewing state business continuity and
contingency plans to determine whether any programmatic issues needed to be
addressed.

In addition to evaluating state system remediation activities and business
continuity and contingency plans, HCFA has provided assistance to states
through the issuance of guidance and best practices documents. Moreover, at
the behest of HCFA, its contractors provided three states with technical
assistance on the development of business continuity and

?Integrated eligibility systems determine whether an individual applying for
Medicaid meets the eligibility criteria for participation. These systems are
also often used to determine eligibility for other public assistance
p?ogr~~, such as Food Stamps. Medlcatd management information systems
process claims and deliver payments for services rendered.

Page 2 GAO/ AIMD- 00- 22R Year 2000 Status of Medicaid

contingency plans and intends to continue providing such assistance. States
can also obtain technical assistance on testing and Day One strategies.?

Progress Made But Much Work Remains To Ensure the Continuity of State
Medicaid Operations Into the Next Century

According to the system assessment contractor?s completed round 2 reports of
37 states and the District of Columbia that had been visited during both
rounds, 5 half of the state systems risk ratings improved, 45 percent stayed
the same, and 5 percent declined. In summary, as of October 4, 1999,

l 4 eligibility systems and 5 MMISs were assessed at high risk, l 13
eligibility systems and .8 MMISs were assessed at medium risk, and l 36
eligibility systems and 40 MMISs were assessed at low risk. 6

While state risk ratings have generally improved, many issues continue to be
unresolved. Examples of open issues are testing in a future- date- compliant
environment, which some states have not scheduled until late in the year,
and the lack of top management involvement.

HCFA?s business continuity and contingency plan contractor found problems in
state efforts as well. In particular, of the 33 states and two territories
that have been reviewed, ? 11 were considered high risk, 11 medium risk, and
13 low risk. In addition, many states were reported to have open issues,
such as insufficient plan details, inadequate project documentation, and
incomplete plans.

States that are in a particularly difficult position are those that have a
high- risk system as well as a high risk business continuity and contingency
pl, an. Currently, two states fall into this situation. Also in a difficult
position are the six states with at least one medium- risk Medicaid system
and a high- risk business continuity and contingency plan.

ScoDe and Methodology To determine what HCFA was doing to ensure that the
Year 2000 challenge does not adversely affect the delivery of Medicaid
benefits, we reviewed key documents such as the agency?s Year 2000 guidance
and best practices. We also assessed HCFA contractors? system readiness and
business continuity and contingency planning methodologies, and interviewed
HCFA and contractor officials about these methodologies.

To ascertain the readiness of states to successfully transition to year 2000
for Medicaid, we analyzed the assessment and business continuity and
contingency planning contractors? final

?A Day One strategy (also known as a day zero strategy) comprises a
comprehensive set of actions to be executed by a entity during the last days
of 1999 and the first days of 2OOO. ?As of October 4, 1999, 23 final and 17
draft reports for second- round visits were completed. Two of the draft
reports were for Puerto Rico and the Virgin Islands, which were not visited
in the first round. 6Thirteen state ratings in the low- risk category are
based on the results of first- round visits because they were not visited
during the second round. ?As of October I, 1999, 15 state and the District
of Columbia?s business continuity and contingency plans had not been
reviewed, and 2 states had not provided their plans to HCFA.

Page 3 GAO/ AIMD- 00- 22R Year 2000 Status of Medicaid

and draft reports. In addition, we accompanied the system assessment
contractor on its second round of on- site visits to Delaware, New
Hampshire, New York, North Dakota, Ohio, South Carolina, Tennessee, and
Vermont. We also interviewed state officials on their Year 2000 status.
Further, we reviewed business continuity and contingency plans for five
states considered to be models by HCFA.

Prior to briefing your offices, we supplied copies of our briefing materials
to HCFA officials for comment, who agreed with the information provided. In
addition, we subsequently updated the information on our briefing slides to
reflect the most current state data. We conducted our review from June
through October 4, 1999, in accordance with generally accepted government
auditing standards. Our work was done at HCFA?s headquarters in Baltimore,
MD, the assessment contractor?s headquarters in Columbia, MD, and in the
eight states we visited.

As agreed with your offices, unless you publicly announce the contents of
this correspondence earlier, we will not distribute it until 5 days from the
date of this letter. At that time, we will provide copies to Senators Robert
F. Bennett, Chairman, and Christopher J. Dodd, Vice- Chairman, Senate
Special Committee on the Year 2000 Technology Problem; Representatives
Stephen Horn, Chairman, and Jim Turner, Ranking Minority Member,
Subcommittee on Government Management, Information, and Technology, House
Committee on Government Reform; Representatives Constance A. Morella,
Chairwoman, and James A. Barcia, Ranking Minority Member, Subcommittee on
Technology, House Committee on Science; and Representatives Bill Archer,
Chairman, and Charles B. Rangel, Ranking Minority Member, House Committee on
Ways and Means. We are also sending copies to the Honorable Donna Shalala,
the Secretary of Health and Human Services; Mr. Michael Hash, Deputy
Administrator, Health Care Financing Administration; the Honorable Jacob
Lew, Director, Office of Management and Budget; and other interested
parties. Copies will also be made available to others upon request.

If you have any questions on matters discussed in this letter, please
contact me at (202) 5 12- 6253 or by email me at willemsseni. aimd@ gao. gov
or Linda Lambert, Assistant Director, at (202) 5 12- 9556 or by email at
lambertl. aimd@ gao. gov. Key contributors to this assignment were Norman
Heyl, John Mollet, and John Snavely.

Director, Civil Agencies Information Systems Enclosure

(511801) Page 4 GAO/ AIMD- 00- 22R Year 2000 Status of Medicaid

GAO Year 2000 (Y2K) Computing Challenge

Y2K Readiness of State Medicaid Systems

Briefing for the Committee on Finance, United States Senate

September 30, 1999* *Information in the slides was updated as of October 4,
1999.

GAO Overview l Objectives l Scope and Methodology l Health Care Financing
Administration (HCFA)

Monitoring and Oversight l Reported Status of States? Systems Readiness? l
Reported Status of States? Business Continuity and

Contingency Plans l Overall Observations

2 ?In the context of this briefing, states can include the District of?
Columbia, Puerto Rico, and the Virgin Islands.

GAO Objectives l Determine what HCFA is doing to ensure that the

Year 2000 challenge does not adversely affect the delivery of Medicaid
benefits

l Determine the readiness of states to successfully transition to year 2000
for Medicaid

3

GAO Scope and Methodology l Assessed HCFA contractors? system readiness and

business continuity and contingency planning methodologies

l Accompanied HCFA and its contractors on eight site visits

l Reviewed and analyzed key documents and available site visit reports

l Reviewed business continuity and contingency plans for five states
considered to be models by HCFA

4

GAO Scope and Methodology (cont?d) l Interviewed agency, contractor, and
selected state

officials on assessment and business continuity and contingency plan
methodologies and states? Y2K status.

l Our work was performed from June through October 4, 1999, in accordance
with generally accepted government auditing standards.

GAO HCFA Monitoring and Oversight l HCFA has:

0 0

0 0

Obtained a contractor to perform comprehensive Y2K readiness assessments of
states? Medicaid systems. Obtained another contractor to perform
comprehensive reviews of states? business continuity and contingency plans.
Provided states with Y2K guidance and best practices examples. Provided
three states with technical ?assistance on the? development of business
continuity and contingency plans. Technical assistance is also available in
other areas, such as testing. - 6

GAO Reported Status of State Readiness: Systems Risk Assessments

l HCFA intends that its assessment contractor will conduct three rounds of
site visits. During these site visits, the contractor assesses states?
Eligibility and Medicaid Management Information Systems (MMIS). a

l HCFA round 1 (November 1998 through April 1999) l During round 1, HCFA?s
assessment contractor

(accompanied by HCFA personnel) conducted comprehensive onsite assessments
of all 50 states and the District of Columbia.

7 ?Some state integrated eligibility systems determine eligibility for the
Medicaid program as well as other state- administered public assistance
programs, such as Food Stamps. MMIS process Medicaid claims and include
beneficiary and provider information. Each state?s eligibility and MMIS
systems are unique due to the differences in state Medicaid programs.

G- 0 Reported Status of State Readiness: Systems Risk Assessments (cont?d)

l HCFA round 1 (cont?d) l Each state system was placed into a low, medium,

or high risk category based on the quality and completeness of project
management/ planning, remediation process, quality management, test. ing,
and contingency planning. l Reports to the states included issues (items
that

were considered to be ?show stoppers?) and recommendations (items that, if
completed, would improve the quality of the state?s Year 2000 program).

8

GAO Reported Status of State Readiness: Systems Risk Assessments (cont?d)

l During round 1 site visits, some states requested additional HCFA actions.
In response, HCFA

l issued guidance on interface agreements with Medicaid data exchange
partners, l issued a Business Continuity Handbook, l issued seven issue
papers on Y2K best practices, l is developing other Y2K issue papers on
topics

such as validating business continuity and contingency plans and emergency
procedures, and l delayed changes to Medicaid dual eligibility

reporting requirements until spring 2000. 9

GAO Reported Status of State Readiness: Systems Risk Assessments (cont?d)

l HCFA round 2 (May through September 1999) l HCFA?s assessment contractor
(accompanied by

HCFA personnel) conducted comprehensive onsite assessments of 37 states and
the District of Columbia, each of which had at least one high or medium risk
system, to follow up on critical Y2K issues and barriers. Onsite assessments
of Puerto Rico and the Virgin Islands, which were not covered in round 1,
we. re also conducted. l HCFA? s contractor conducted follow- up telephone

calls to four states not visited. 10

GAO Reported Status of State Readiness: Systems Risk Assessments (cont?d)

0 Round 2 (cont?d) l Each state system assessed was placed into low,

medium, or high risk category, based on l resolution of critical issues
previously noted l remediation progress, testing, and senior

management support l Reports to the states included whether prior issues

and recommendations were addressed by the states as well as any new issues
or recommendations.

11

G- 0 Reported Status of State Readiness: Systems Risk Assessments (cont?d)

l HCFA round 3 (September through December 1999) l began in the last week of
September l the list of states to undergo visits has not been

finalized but among the criteria HCFA plans to use are to visit states with
the highest risk systems and business continuity and contingency plans as
well as states with the greatest number of Medicaid recipients l followup
phone calls are to be made to other states l additional emphasis will be
placed on areas such

as day one planning, managed care organizations, and county eligibility
determination 12

GAO Reported Status of State Readiness: Changes to System Risk Assessments

Round One Round Two? l Eligibility systems Eligibility systems*

l 8 high( 16%) 4 high (10%) l 20 medium (39%) 13 medium (33%) l 23 low (45%)
23 low (58%)

l MMIS MMIS* l 11 high (22%) l 15 medium (29%) . 25 low (49%)

5 high (13%) 8 medium (20%) 27 low (68%) *Percentages do

not add to 100% due to rounding

13 ?Based on HCFA?s 23 final and 17 draft reports for second round site
visits, conducted May- September 1999 and does not include 13 states that
were not visited in the second round.

GAO Reported Status of State Readiness: Eligibility Systems as of October 4,
1999

t 1 c)

Rating improved from round 1 Rating declined from round I Rating same as
round I PR No symbol indicates that risk ratings were (No1 visited is based
on first round visitsb

Rousd I) ) I

VI (high TILL) Low Risk Medium Risk m High Risk (NOI visited ill

Round I) Source: 14. HCFAkontmctor sile visirs. Because some of these the
state visits look place months ago, their SIIIUS may have chqed. *HCFA
assessed California?s Meclicaid eligibility database. but nol its many
county systems that perform eligibility determinalion. ?Except for Pucr~ o
Rico and the Virgm Islands which were not visited in the first round.
Thirteen slates were not visited during the rscond rounJ.

GAO Reported Status of State Readiness: MMIS Systems as of October 4, 1999

TX ,NH n

t Rating improved from round I * Rating declined from round I # Rating same
as round I Wg

PR No symbol indicates that risk ratings were (Not visited it1 I

based on first round visits? Rowrd I) VI (high risk) El Low Risk Medium Risk
High Risk (NOI visited ill

Round I) 1 5 Source: HCFA/ contractor site visits. Because some of these the
state visits took place months ago, their status may have changed.

?Except for Puerto Rico and the Virgin Islands which were not visited in the
first round. Thirteen states w& e not visited during the second round.

GAO Barriers to Successful Remediation: Resolution of Round 1 Eligibility
Issues

Resolution of round 1 eligibility issues for 40 states and the District of
Columbia (a state may have more than one issue)?

ckd IviJder l4Lliorl PattialAction NoI_ ronga Issues ofIssues Taken Taken
Applicable Unresolved

Testing 49 30 2 1 16 Project Mjg- rLManning 31 22 0 1 8 ckx& in~ yPlarming
231 111 31 I 1. , 8

Atrhiving 11 8 2 0 1 11 6 1 2 2

16 ?Based on the completed round 2 visits for 37 states and the District of
Columbia and completed telephone updates for 3 states. This information was
not yet available for 10 states as of October 4, 1999 and Puerto Rico and
the Virgin Islands were not visited in the first round.

G- 0 Barriers to Successful Remediation: R& solution of Round 1 MMIS Issues

Resolution of round 1 eligibility issues for 40 states and the District of
Columbia (a state may have more than one issue)?

Issues Testing

Project MgndPlanning aairIgency Planning Atchiving 8

ofrssm 38 44

18 6

ckxed Action partial Action Taken Taken

20 7 35 1 12 0

6 1 3 0

No Ianger Applicable

1 0 0 0

1 unresolved

10 8 6

1 2

17 ?Based on the completed round 2 visits for 37 states and the District of
Columbia and completed telephone updates for 3 states. s This information
was not yet available for IO states as of October 4, 1999 and Puerto Rico
and the Virgin Islands were not visited

in the first round.

GAO Barriers to Successful Remediation: Round 2 Eligibility Issues

Open issues for 40 states, the District of Columbia, Puerto Rico and the
Virgin Islands at the end of round 2 (a state may have more than one issue)?

1 8 ?Based on the completed round 2 visits for 37 states, the District of
Columbia, Puerto Rico and the Virgin Islands and completed telephone updates
for 3 states. This information was not yet available for 10 states as of
October 4, 1999. Also, some round 2 issues iriclude unresolved round I
issues.

GAO Barriers to Successful Remediation: Round 2 MMIS Issues

Open issues for 40 states, the District of Columbia, Puerto \ Rico and the
Virgin Islands at the end of round 2 (a state may hav ?e more t :han one
issue)?

25 Number of

Issues 20

15 10

5 n

&I u 19 ;? Based on the completed round 2 visits for 37 states, the District
of Columbia, Puerto Rico and the Virgin Islands and completed

telephone updates for 3 states. This information was not yet available for
10 states as of October 4, 1999. Also, some round 2 issues include
unresolved round I issues.

GAO Barriers to Successful Remediation: Examples of Open Issues

l Testing l Future- date- compliant environment not planned or

scheduled late in year l End- to- end testing not planned or scheduled late
in

year l Proiect Management/ Planning

l No overall project plan l Lack of top management involvement

20

G- 0 Remaining Barriers to Successful Remediation: HCFA Reported Examples

l Contingency Planning; l Contingency? plan not completed l No hot site for
disaster recovery

l Archiving of Y2K Program Data l No l No

l Other archiving policies

archiving procedures l Risk of county office failures l Insufficient
outreach to providers or beneficiaries

21

GAO Reported Status of States? Business Continuity and Contingency Plans

HCFA? s business continuity and contingency planning contractor began
reviewing the quality of state plans in June 1999.

Some of these plans were reviewed through both a desk audit and an onsite
visit while other plans underwent just a desk audit.

22

G. 0 Reported Status of States? Business Continuity and Contingency Plans

l After the contractor?s review, each state?s business continuity and
contingency plan was placed into a low, medium, or high risk category, based
on the evaluation of its

l development process-- including management oversight, risk analysis,
assessment of alternative strategies, and testing of plans, and l quality
and completeness-- including having a well-

documented mission statement and the identification of critical business
processes, minimum levels of service, triggers, and recovery mechanisms. 23

GAO Reported Status of States? Business Continuity and Contingency Plans

PR 0 VI (med. risk)

I Low Risk Medium Risk High Risk m Risk rating not yet completed m State did
not provide plan to HCFA 24 Source: HCFA, based on contractor reviews
conducted between June and October 1, 1999.

GAO Business Continuity and Contingency Planning Issues

Business continuity and contingency plan issues for 31 states and 2
territories (a state may have more than one issue)?

14 12 10 Number of States 6

6 4 2 0

The ?other? category includes areas such as the lack of a training program
or standard methodology

25 ?Based on 16 final reports and 17 draft reports of HCFA?s business
continuity and contingency plan contractor. Reports were not available as of
October 1, 1999 for the other 2 state business continuity and contingency
plans reviewed.

GAO Business Continuity and Contingency Planning: HCFA Reviews

l In September 1999, HCFA headquarter personnel began reviewing state
business continuity and contingency plans to determine whether any
programmatic issues needed to be addressed.

26

GAO Business Continuity and Contingency Planning: HCFA Reviews

l HCFA is considering policies that could affect state business continuity
and contingency planning.

l States sending interim payments to providers. HCFA has drafted a policy
paper on this issue which is undergoing internal review. l States approving
presumptive eligibility

(approving applicants without completing the normal eligibility
determination, process). HCFA is considering this issue and plans to issue a
policy paper.

27

GAO Overall Observations l HCFA's efforts in monitoring states? Medicaid Y2K

actions have identified critical issues and have significantly reduced the
risk of Y2K disruptions

l Half of the states? systems reported risk ratings improved after second
round visits but reported risk ratings worsened in the following cases

l Alaska (MMIS) l Massachusetts (MMIS) l North Carolina (Eligibility) l New
Mexico (Eligibility)

28

GAO Overall Observations l Much work remains on business continuity and

contingency planning l 2 states have not provided HCFA their plans l 11
states were reported to have high risk ratings l HCFA?s contractor has not
reviewed the plans of

15 states and the District of Columbia l States at the highest risk are
those which have a

reported high risk system and a reported high, risk business continuity and
contingency plan

l New Hampshire (Eligibility) l New Mexico (Eligibility) 29

GAO Overall Observations l States at significant risk are those with a
reported

medium risk system( s) and a reported high risk business continuity and
contingency plans

l Delaware (Eligibility) l New Mexico (MMIS) l Ohio (MMIS) l Oklahoma
(Eligibility and MMIS) l Tennessee (MMIS) l Vermont (Eligibility) .
*** End of document ***