Medicare: Information Systems Modernization Needs Stronger
Management and Support (20-SEP-01, GAO-01-824).
Congress has questioned whether the Centers for Medicare and
Medicaid Services (CMS), formerly the Health Care Financing
Administration, adequately implemented new payment methods,
effectively safeguarded program payments, and adequately oversaw
the quality of care provided to beneficiaries. CMS depends on
hundreds of information technology (IT) systems to help manage
the Medicare program. With year 2000 systems renovations
successfully completed, CMS has focused on modernizing its IT
systems. The agency's information systems are crucial to carrying
out Medicare's core missions of claims processing and payment,
program oversight, and administration of participating health
plans. However, Medicare's major systems are aged and many are
incompatible with one another. To address these problems, CMS
intends to modify, replace, or redesign systems on which key
Medicare missions depend. CMS plans to make incremental system
improvements while maintaining current functions and
accommodating changes mandated by legislation. The agency's IT
planning and management processes--intended to increase the
likelihood that new systems will be successful and
cost-effective--have shortcomings. The agency's blueprint
documenting its existing and planned IT environments, also known
as its enterprise architecture, is missing essential detail in
critical parts, including well-documented business functions,
information flows, and data models. CMS is trying to strengthen
its planning and has developed guidance for an improved
management process, but will need to make considerable effort to
ensure that modernization stays on track. These weaknesses in IT
planning and management are part of larger agency management
challenges. Resource gaps, both in funding and staff expertise,
threaten the success of planned IT improvements. At the same
time, CMS has made little use of performance measures to ensure
accountability and increase the likelihood of achieving results.
-------------------------Indexing Terms-------------------------
REPORTNUM: GAO-01-824
ACCNO: A01847
TITLE: Medicare: Information Systems Modernization Needs
Stronger Management and Support
DATE: 09/20/2001
SUBJECT: Health care programs
Health insurance
Medical information systems
Performance measures
Information resources management
Agency missions
Strategic information systems planning
HCFA Common Working File
HCFA Provider Enrollment Chain and
Ownership System
Medicare Program
National Medicare Utilization Database
State Children's Health Insurance
Program
Medicare Choice Program
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Testimony. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
GAO-01-824
Report to Ranking Minority Member, Subcommittee on Health, Committee on Ways
and Means, House of Representatives
United States General Accounting Office
GAO
September 2001 MEDICARE Information Systems Modernization Needs Stronger
Management and Support
GAO- 01- 824
Page i GAO- 01- 824 Medicare Information Systems Letter 1
Results in Brief 2 Background 3 Difficulties in Meeting Core Medicare
Functions Prompt Efforts to
Improve Automated Environment 6 IT Planning and Management Weaknesses Could
Delay Systems
Modernization 11 Additional Challenges Put Achieving CMS? IT Goals At Risk
17 Conclusions 23 Matter for Congressional Consideration 25 Recommendations
For Executive Action 25 Agency Comments 26
Appendix I Scope and Methodology 28
Appendix II Consolidation Of Medicare Claims Processing Systems 30
Appendix III Examples Of Missing Elements From CMS? Enterprise Architecture
31
Appendix IV Comments From the Centers for Medicare and Medicaid Services 33
Appendix V GAO Contact and Staff Acknowledgments 35
Related GAO Products 36
Tables
Table 1: Number of Complex and Expensive IT Projects by Level and
Organization 14 Table 2: Examples of Systems Development Delays Because of
Funding Constraints, Identified by CMS Officials 19 Contents
Page ii GAO- 01- 824 Medicare Information Systems
Table 3: Status of Systems Consolidation 30 Table 4: Examples of Missing
Elements From CMS? Enterprise
Architecture 31
Abbreviations
BBA Balanced Budget Act of 1997 CIO Chief Information Officer CMIS
Contractor Management Information System CMS Centers for Medicare and
Medicaid Services CWF Common Working File FMIB Financial Management
Investment Board GPRA Government Performance and Results Act of 1993 HCFA
Health Care Financing Administration HIGLAS HCFA?s Integrated General Ledger
System HIPAA Health Insurance Portability and Accountability Act of 1996
HPMS Health Plan Management System IT Information Technology NCH National
Claims History NMUD National Medicare Utilization Database OIS Office of
Information Services OMB Office of Management and Budget PECOS Provider
Enrollment, Chain and Ownership System SCHIP State Children?s Health
Insurance Program
Page 1 GAO- 01- 824 Medicare Information Systems
September 20, 2001 The Honorable Pete Stark Ranking Minority Member
Subcommittee on Health Committee on Ways and Means House of Representatives
Dear Mr. Stark: Today, as the Congress focuses attention on ways to
modernize the Medicare program, its management by the Centers for Medicare
and Medicaid Services (CMS), formerly called the Health Care Financing
Administration (HCFA), 1 has become a primary concern. The Congress has
raised questions about whether the agency has adequately implemented new
payment methods, worked effectively to safeguard program payments, and
provided adequate oversight of the quality of care provided to
beneficiaries- among other issues. As the nation?s largest health insurer,
Medicare enrolls about 40 million elderly and disabled beneficiaries and
provides more than $200 billion in health care benefits annually. CMS
depends on hundreds of information technology (IT) systems to provide
information to manage this massive program and manages a large repository of
health care data. Information on beneficiary enrollment and use of services,
provider payments, and program expenditures resides in the numerous
databases and processing systems run by CMS and the private companies with
which it contracts. However, some of these systems are old and are difficult
to update, to respond to program changes.
With Year 2000 system renovations successfully completed, CMS has focused
its attention on modernizing its IT systems. These systems are integral not
only to processing and paying claims efficiently, but also to generating
information that can inform policy decisions affecting payments, coverage,
and quality of care. Through modernization, CMS seeks to better manage its
data, be more responsive to legislative initiatives, and support efforts to
improve health care for its beneficiaries.
1 This report will refer to CMS when our findings apply to the present, and
to HCFA when our findings apply to the organizational structure and
operations associated with that name.
United States General Accounting Office Washington, DC 20548
Page 2 GAO- 01- 824 Medicare Information Systems
Because of your interest in examining ways to improve Medicare?s management,
you asked us to evaluate efforts to modernize CMS? IT systems. Accordingly,
this report (1) describes aspects of CMS? current IT environment and
projects CMS has under way to improve its systems, (2) examines the agency?s
IT planning efforts and IT management processes, and (3) discusses the
challenges that need to be addressed to meet the agency?s IT goals. To
address these questions, we reviewed federal requirements and guidance on IT
planning and management processes, CMS? IT planning and procedure documents,
and our prior work and relevant reports issued by the Department of Health
and Human Services? (HHS) Office of Inspector General and CMS. We also
interviewed CMS officials about the agency?s current information systems and
planned IT efforts. (See app. I for a detailed description of our scope and
methodology.) A list of related GAO products is included at the end of this
report. We performed our work from April 2000 through August 2001 in
accordance with generally accepted government auditing standards.
With CMS? ability to administer Medicare under close scrutiny, agency
officials are conducting a concerted effort to modernize CMS? automated
systems. The agency?s information systems are of central importance in
carrying out Medicare?s core missions- namely, claims processing and
payment, program oversight, and administration of participating health
plans. However, Medicare?s major systems are aged and many are incompatible
with one another. Because of their design, the systems do not assemble or
maintain data in a user- friendly format. As a result, analysts querying
Medicare?s systems cannot respond on short notice- without extraordinary
effort- to basic program management questions, such as the effects of
payment policies on beneficiaries? use of services and on the adequacy of
payments to providers, the status of debt owed the program because of
uncollected overpayments, or the status of beneficiary enrollment in managed
care plans. To address these difficulties in fulfilling core Medicare
functions, CMS intends to modify, replace, or redesign systems on which key
Medicare missions depend. CMS? plans are to balance making incremental
system improvements with the need to maintain current functions and the need
to accommodate changes required by legislation.
The agency?s IT planning and management processes- intended to increase the
likelihood that systems development and implementation will be cost-
effective and successful- have certain shortcomings. The agency?s blueprint
documenting its existing and planned IT environments- also known as its
enterprise architecture- has its foundation in place, but is Results in
Brief
Page 3 GAO- 01- 824 Medicare Information Systems
missing essential detail in certain critical parts, including well-
documented business functions, information flows, and data models. Also, the
agency?s process for managing its IT investments omits key review, approval,
and evaluation steps. CMS is making efforts to strengthen its planning and
has developed guidance for an improved management process, but will need to
make considerable progress implementing these changes to ensure that
modernization efforts stay on track.
These weaknesses in IT planning and management are part of larger agency
management challenges. Resource gaps- both in funding and staff expertise-
pose threats to the success of planned IT improvements. At the same time,
the agency has made only limited use of performance measures to ensure
accountability and increase the likelihood of achieving results. Each of
these challenges needs to be addressed, because the consequence of failing
to improve Medicare?s IT environment is significant. At stake is the
continuation of Medicare?s ability to ensure that beneficiaries receive
services to which they are entitled, pay health care providers accurately
and efficiently, and protect taxpayers from unnecessary spending. In light
of these concerns, we are suggesting that the Congress consider enhancing
resources that could be devoted to CMS? IT modernization and be conditioned
upon CMS demonstrating progress in providing appropriate technical
foundations and management capacity. We are also making several
recommendations aimed at strengthening CMS? planning and management of its
IT modernization efforts. In commenting on a draft of this report, CMS
stated that resource limitations have hampered implementation of some
management processes essential to effective IT investment management, as
well as the development of several key system modernization efforts. CMS
agreed to address weaknesses identified in this report, but was not specific
on what actions it would be taking.
The Medicare program?s day- to- day operations rely on numerous largescale
information systems, which house or process information on, among other
things, beneficiaries? enrollment and utilization of services, claims, and
payments to providers. These systems serve Medicare?s traditional feefor-
service component, which enrolls the bulk (about 85 percent) of the
program?s beneficiaries, and the managed care component, which enrolls the
rest.
CMS- along with about 50 insurance companies with which it contracts to
process Medicare claims- operates these systems. Contractors use one of
Medicare?s several standard systems to process fee- for- service claims.
Fiscal intermediaries are contractors that process part A claims (claims
Background
Page 4 GAO- 01- 824 Medicare Information Systems
for hospital services and care provided by other institutional providers,
such as skilled nursing facilities), while carriers are contractors that
process part B claims (claims for physician care and other covered expenses,
such as laboratory services). The fiscal intermediaries use one of two
standard systems to process part A claims; the carriers use one of four
standard systems to process part B claims. These contractor- run standard
systems review claims to ensure that all required fields are complete,
conduct utilization checks to determine whether the services provided
correspond to the beneficiary?s diagnosis, and calculate the payment amount
for the claim. Contractors sometimes modify the standard claims processing
systems they have adopted to address local claims processing needs, such as
determinations as to whether claims are payable given their local medical
coverage policies. Contractor- processed claims are then transmitted to a
CMS- operated prepayment validation and authorization system. 2 This system-
called the Common Working File (CWF)- screens the priced claims for
consistency with rules, eligibility for coverage, and duplication with
previously processed claims and then approves, adjusts, or denies payment
accordingly.
In the early 1990s, HCFA launched a large systems modernization initiative
to replace Medicare?s multiple, contractor- operated claims processing
systems with a single, more technologically advanced one. It was envisioned
that the new, single- system computing environment would result in
simplified program administration and reduced administrative costs, comply
with Year 2000 standards, and improve the agency?s ability to spot improper
billing practices. However, this initiative failed through a series of
planning and development missteps. 3
When the contract for this initiative was terminated in August 1997,
Medicare was left with numerous independent systems that needed Year 2000
modifications. The Year 2000 work delayed other planned IT initiatives,
including the consolidation of Medicare?s standard claims processing
systems- an initiative designed to reduce maintenance costs and some
inconsistencies across the different contractor systems.
2 This system is operated on nine regional databases running in six physical
host sites located across the country. 3 We discussed these problems in
Medicare Transaction System: Success Depends Upon Correcting Critical
Managerial and Technical Weaknesses (GAO/ AIMD- 97- 78, May 16, 1997)
and Medicare Transaction System: Serious Managerial and Technical Weaknesses
Threaten Modernization (GAO/ T- AIMD- 97- 91, May 16, 1997).
Page 5 GAO- 01- 824 Medicare Information Systems
CMS is now refocused on modernizing its IT environment to better implement
congressionally mandated payment policy and other modifications and on
modernizing its information systems. 4 Critical responsibilities for leading
these IT efforts reside with the agency?s Chief Information Officer (CIO),
who heads CMS? Office of Information Services (OIS). Under the CIO?s
direction, OIS is responsible for managing the acquisition and operation of
CMS? information systems that are enterprisewide- those affecting the agency
as a whole. 5 It is also responsible for setting agencywide IT policies with
which the agency?s three major organizational units, or programmatic
?centers?- such as the Center for Medicare Management and the Center for
Beneficiary Choices- and its other administrative offices must comply in
their efforts to develop systems to support statutory and administrative
program requirements. 6
In addition to OIS, other units share responsibility for various aspects of
CMS? IT activities. CMS? programmatic centers and its administrative offices
are generally charged with developing, acquiring, and maintaining systems
that are specific to their individual missions, under the CIO?s guidance and
direction. For example, CMS? Center for Beneficiary Choices is responsible
for systems that contain information on Medicare+ Choice plans; CMS?
administrative Office of Financial Management is responsible for systems
that track agencywide financial transactions for accounting purposes.
4 The Balanced Budget Act of 1997; the Medicare, Medicaid, and SCHIP
Balanced Budget Refinement Act of 1999; and the Medicare, Medicaid, and
SCHIP Benefits Improvement and Protection Act of 2000 made changes to the
Medicare program that required the agency to make numerous changes to its IT
systems.
5 In addition to Medicare, CMS has oversight responsibility for, among other
things, the Medicaid program and the State Children?s Health Insurance
Program, which are jointly financed by the federal government and the states
and are largely state- administered.
6 CMS? Center for Medicare Management, Center for Beneficiary Choices, and
Center for Medicaid and State Operations are focused on the agency?s major
programs. The Center for Medicare Management is responsible for the Medicare
fee- for- service program. The Center for Beneficiary Choices is responsible
for Medicare?s managed care program and also focuses on beneficiary
educational efforts. The Center for Medicaid and State Operations focuses on
programs administered by the states, such as Medicaid. CMS? administrative
offices are responsible for agency operations, such as personnel and
financial management.
Page 6 GAO- 01- 824 Medicare Information Systems
In the last decade, the agency has faced heightened expectations for payment
accuracy, program integrity, and the timely implementation of new and
complex payment methods. Efforts to meet these expectations have brought the
agency?s IT and data quality deficiencies into sharp focus. In response, CMS
has begun several modernization initiatives and has planned others that are
intended to help the agency demonstrably boost the performance of its core
functions.
One of CMS? fundamental responsibilities, to process and pay health care
claims, is a highly automated operation that relies on multiple, large-
scale computer systems run by Medicare contractors. Through the computerized
screening of claims, the contractors seek to ensure that beneficiaries are
properly enrolled in the program and that any changes to their status are
promptly updated. The contractors also seek to ensure that payments are made
only to health care professionals who are authorized to bill Medicare and
that the amount paid for, and the services delivered to, a beneficiary are
consistent with program rules.
In a static environment, efficiently processing almost a billion claims from
almost a million hospitals, and other health care providers each year would
be task enough. However, the Medicare claims processing systems are subject
to frequent modifications to reflect regular annual updates, new policies,
and changes in statutory requirements. In recent years, when major Medicare
legislation added new benefits and created new payment methods to improve
the program?s fiscal health, many system changes had to be implemented.
According to the Blue Cross and Blue Shield Association, which represents
many of Medicare?s contractors, in calendar year 2000 contractors received
719 formal change orders- more than two and a half times the number received
in fiscal year 1998. 7 These orders are instructions sent by CMS for
contractors to modify their claims processing systems.
Implementing changes can be complicated and resource- intensive. Even though
there are six standard systems, contractors have their own systems, in
addition, to perform certain claims administration functions.
7 CMS placed a moratorium on system changes in 1999 to work on Year 2000
system renovations. As a result, the number of system changes in 2000 may
have been higher than normal. Difficulties in Meeting
Core Medicare Functions Prompt Efforts to Improve Automated Environment
Making Changes to Medicare Claims Payment Methods Is Arduous Because of
Multiple Systems
Page 7 GAO- 01- 824 Medicare Information Systems
As a result, for some changes, individual contractor sites require separate
programming solutions. In addition, as systems have been altered over the
decades, the alterations have not always been properly documented. Thus,
implementing new changes, in some instances, takes considerable time and
programming expertise.
The difficulties of implementing changes complicate CMS? efforts to respond
to new legislative requirements. Changes required by the Balanced Budget Act
of 1997 (BBA) provide a recent illustration. In 2000, when the BBA- mandated
prospective payment method for home health services was implemented, 8 the
standard systems had to adopt a complex claims pricing logic, requiring the
retrofitting of systems that were designed to use a much simpler set of
payment rules. For a time, some providers reported that claims that should
have been promptly paid were inappropriately denied or suspended for further
review.
Program monitoring and oversight is another critical agency function that is
fundamental to ensuring that Medicare beneficiaries have access to quality
health care services and that the program is paying claims properly. This
function is particularly important to guard against unintended effects as
payment methods undergo change. BBA and subsequent legislation gave CMS
significant tools to adjust its payment methods, but inadequacies in CMS?
information systems have made it difficult to implement these measures and
to track the effect of program changes.
For instance, monitoring the effectiveness of program policies requires
obtaining timely and accurate information about the services beneficiaries
receive and the payments made to their providers. However, CMS? IT systems
have often been of little help. The reason is that several of CMS? key
databases- such as its National Claims History (NCH) database, which
maintains the electronic files of Medicare?s paid claims- are structured in
a way that makes the quick retrieval of beneficiary utilization and provider
payment information difficult. Retrieving data from hundreds of millions of
claims and generating statistics to answer policy questions requires special
programming for each query and may take months.
8 Previously, payments to home health agencies were made on the basis of
their costs. The prospective payment method pays providers rates fixed in
advance for an episode of home health care rather than for the cost of each
service. Systems Hinder Providing
Timely, Relevant Data for Program Management
Page 8 GAO- 01- 824 Medicare Information Systems
Similarly, the design and stand- alone nature of the various systems that
maintain Medicare?s financial information limit CMS? ability to respond
promptly to financial status questions, such as how much money in
overpayments is owed to Medicare. To answer such questions, CMS must rely
largely on its claims administration contractors? systems, which produce a
fragmented, rather than coherent, picture of the financial matter at hand.
These problems have been exacerbated by lapses in ensuring data quality. At
times, CMS has used data from separate systems that were neither updated on
the same schedule nor subsequently reconciled. As a result, CMS lacks key
financial information needed to properly manage the program. For example,
the Medicare fee- for- service accounts receivable net balance was more than
$3.7 billion at the end of fiscal year 2000. However, CMS could not generate
a complete and up- to- date list of delinquent debts that it could use to
monitor the efforts of its contractors to refer such debts for collection.
A third critical management function involves the oversight of Medicare+
Choice- Medicare?s managed care component. 9 In Medicare+ Choice, health
plans compete for Medicare beneficiary enrollees by offering additional
benefits- such as coverage for outpatient prescription drugs- at low or no
premiums. 10 To give beneficiaries managed care choices, CMS has to collect
and disseminate information about plans to inform beneficiaries and then be
able to record and maintain information on the beneficiaries? enrollment
choices, once they have enrolled in plans. CMS also collects and analyzes
information to ensure that payments to managed care organizations are
appropriate.
The agency?s managed care functions are currently supported by a ?family?
of systems, and these systems, in turn, interface with other application
systems and databases. Some of the systems were developed a decade ago and
have been modified many times to meet increasingly complex requirements and
growing capacity demands. The current systems are labor- intensive to modify
and validate and do not respond promptly to beneficiary enrollment and
health plan inquiries. According to CMS
9 Beneficiaries? participation in managed care is small (under 6 million
enrollees, as compared to the 34- plus- million beneficiaries in traditional
Medicare), and the number of health plans participating- 178 contracts as of
March 2001- has declined in recent years.
10 Beneficiaries enrolled in Medicare+ Choice plans must continue to pay the
Medicare part B premium. CMS? IT Systems Fall Short
of Meeting Information Needs of Medicare Managed Care
Page 9 GAO- 01- 824 Medicare Information Systems
officials, the underlying structure of these systems limits the extent to
which additional modifications are possible.
Properly adjusting plan payments is another area in which CMS? current
systems do not provide adequate support to the agency. BBA required the
agency to refine its managed care rate adjuster to better reflect patients?
health status. The adjustment is designed to pay health plans appropriately
when they enroll a disproportionate number of healthier or sicker than
average beneficiaries. Calculating this adjustment requires data on
enrollees? use of medical services, known as encounter data. However, CMS?
existing systems are not organized to maintain service utilization data at
the individual enrollee level, thus impeding efforts to modify the rate
adjuster as required.
In 1998, HCFA developed a strategic vision for agencywide IT modernization
in which modular units that perform different functions would be
interconnected with central databases. 11 The central databases- such as
those for maintaining beneficiary data and claims history data- are being
designed to serve as the source from which agency systems obtain
information. This structure is designed to reduce redundancy in data
maintenance and modification efforts and improve data consistency and
quality. CMS? current plans for implementing modernization improvements
include making incremental changes to some systems while replacing others
with more advanced technology.
Already under way are CMS efforts to consolidate its standard claims
processing systems to ease the burden of modifying multiple systems. CMS is
reducing the number of standard processing systems from six to three- one
for fiscal intermediaries, one for other carriers, and one for Durable
Medical Equipment Regional Carriers (DMERC). (See app. II for more detail on
this consolidation.) According to CMS officials, reducing the number of
standard systems will reduce maintenance costs and inconsistencies across
the different contractor systems and simplify making program changes.
CMS is also planning to redesign the CWF, the critical prepayment system in
the overall claims process. Prior to paying a claim, the contractors
11 As of September 7, 2001, the agency?s Web site has the strategic vision
posted at http:// www. hcfa. gov/ standards/ ita/ it_ arch/ volumes/
v1atcha. pdf. CMS Has Begun to
Redesign Some Current Systems and Develop New Ones
Page 10 GAO- 01- 824 Medicare Information Systems
submit their claims to the CWF to check whether the claim is for a valid
beneficiary and whether the beneficiary is entitled to the service, in order
to authorize the claim for payment. Several key activities are fully
dependent on the effectiveness and operational quality of the CWF, including
program safeguard checking, query resolution, and compiling information on
approved claims for parts A and B services.
In other modernization efforts, CMS intends to substantially improve its
ability to monitor the care provided to beneficiaries and payment integrity
in Medicare?s fee- for- service component. One project is to replace
Medicare claims history files with a modern database that can be readily
queried and can generate up- to- date information quickly. The new system-
the National Medicare Utilization Database (NMUD)- will use advanced
database management software to enhance and speed data access. CMS tested
the ability of an NMUD prototype to answer complex questions about
beneficiaries? use of services and provider payments and found that it could
respond- in a matter of hours- to queries that had taken weeks to answer
using CMS? previous technology.
With regard to fiscal management, CMS has a system development initiative
under way to improve its underlying financial reporting systems. Called
HCFA?s Integrated General Ledger Accounting System (HIGLAS), the system will
be designed to interconnect with the agency?s other financial and claims
processing systems, including a new system intended to improve contractors?
efforts to recover Medicare payments that should have been made by another
insurer. The Medicare payment recovery system is expected to, among other
things, establish and maintain accounts receivables associated with
contractors? recovery activities.
To improve the use of its systems containing managed care data, CMS has
several initiatives under way designed to perform functions required by BBA,
such as conducting an information campaign to educate beneficiaries about
competing health plans and refining payment adjustments. Among other things,
the agency is doing the following work.
CMS is building a new data repository within its Health Plan Management
System (HPMS) that will collect and maintain data about plan benefit
packages, premiums, and service areas. HPMS is expected to enable CMS to
conduct an improved information campaign to educate Medicare beneficiaries
about plan options and conduct better oversight of health plans? offerings
and the quality of care provided to enrollees.
Page 11 GAO- 01- 824 Medicare Information Systems
CMS is obtaining medical encounter data from the new NMUD claims history
database so that it can develop health plan payment adjusters based on
patient health status.
With such a large array of routine operations, systems maintenance, and
critical system improvement activities under way, CMS needs welldeveloped IT
planning and implementation oversight processes. Although CMS has a
strategic vision and has made progress in developing key IT planning
documents, certain gaps remain in the documentation of the agency?s current
and planned IT environments and in its process to manage IT investments. If
not addressed, CMS? IT planning and investment management weaknesses could
put critical modernization efforts at risk.
Although CMS has made notable progress in developing the foundation for its
blueprint of its current and planned systems environment- its enterprise
architecture- critical elements are not in place or have not been developed
in sufficient detail. CMS? enterprise architecture is contained in a
multivolume document presented in a framework consistent with Office of
Management and Budget (OMB) and other federal guidance. The agency?s
enterprise architecture includes, among other things, a broad description of
core program and operational activities, their purpose, and the centers or
administrative offices responsible for their performance; a discussion of
how technology is and will be used to support these activities; a general
explanation of the policies, standards, and tools needed to develop IT
applications and ensure system security; a broad description of CMS?
hardware, software, and network technologies; and an explanation of the IT
decision- making hierarchy and process for resolving disputes. 12
Key pieces of the architecture document, however, are either incomplete or
have not been developed at all. To develop some of these, CMS? programmatic
staff play a significant role. For example,
Major ?business? functions, such as claims processing, are not well
documented in terms of the key steps in how the activities are conducted,
what agency units are involved, and what might cause the function to
12 As of September 7, 2001, the architecture volumes are posted on the
agency?s Web site at http:// www. hcfa. gov/ standards/ ita/ itarch. asp. IT
Planning and
Management Weaknesses Could Delay Systems Modernization
Blueprint of CMS? IT Environment Is Incomplete and Does Not Outline Next
Steps
Page 12 GAO- 01- 824 Medicare Information Systems
change. Without this documentation, CMS cannot easily reengineer its
operations in line with the agency?s system modernization efforts.
The agency?s information flows- indicating how information is shared
across the agency- have not been developed in detail.
The data model that is intended to chart the location of, and
relationships between, common data elements in CMS? various IT systems is
also incomplete. As of July 2001, the model included data on use of services
by Medicare beneficiaries and on enrollment and managed care, as well as
Medicaid data. CMS officials told us that they intended to model financial
data as part of HIGLAS, but had not begun to do so. There are no plans in
the near future to include quality of care data. The officials attributed
the data model completion problems to insufficient staff to conduct this
effort and budgetary constraints.
For a description of additional elements that are weak or missing from the
architecture document, see appendix III.
With key descriptions of the agency?s IT environment missing from the
enterprise architecture, CMS lacks sufficient detail to formally map the
implementation steps to move from its existing IT environment to the one
outlined in the agency?s enterprise architecture and then take those steps.
This map is known as a ?migration plan.? It is typically developed from a
?gap analysis,? or study of the differences between the agency?s current and
desired IT environments and includes required hardware and software changes.
A migration plan can suggest the priorities for, and sequencing of, future
IT development- with scheduled milestones for system upgrades,
modifications, and development consistent with the agency?s capacity to
handle these changes. CMS? 5- year information resources management plan
discusses in a broad way certain projects that it considers key to its
modernization effort, but it does not indicate how these projects will be
ranked in order of priority. CMS is beginning to develop a strategy for
moving toward its desired IT environment but has not completed a detailed
migration plan. The absence of such a migration plan can create difficulties
when CMS is determining its project priorities.
In addition to having a blueprint, having a process to manage IT investments
can help mitigate modernization risks. CMS? IT workload includes major
systems developments, systems operation maintenance, and systems
modifications, such as those designed to implement program changes. An
effective IT investment management process is critical to ensure that
resources are used as effectively as possible. Federal requirements and
guidance direct agencies to manage their IT projects as a CMS? IT Investment
Management Process Requires Further Development
Page 13 GAO- 01- 824 Medicare Information Systems
portfolio of investments. 13 This involves developing a process that (1)
establishes project selection criteria and quantifies the benefits and risks
of each project, (2) ensures that projects continue to meet mission needs
and provides senior management with progress reports that detail each
project?s cost, quality, and timeliness, and (3) includes a project
evaluation phase that can inform future project selection and management. An
IT investment management process following this guidance is intended to
provide agencies with the information needed to better control their IT
budgets; reduce the risks associated with building, acquiring, and
maintaining systems; and increase the likelihood of improving program
operations.
The number and complexity of CMS? IT projects require a strong agencywide IT
investment management process. As of January 2001, 102 of the 183 IT
projects under way were classified by CMS as complex and expensive (levels C
and D). (See table 1.) Because they take longer to implement and are more
costly, they pose a greater risk to the agency. The rest were classified as
lower cost or short- term projects- such as systems maintenance and 1- year
purchases and leases (levels A and B). A little over 40 percent of level C
and D projects are managed directly by OIS. The rest are managed primarily
by the center or administrative office responsible for the program activity
to which the project is linked, while OIS maintains an oversight and
technical assistance role. For example, the Office of Financial Management
has primary responsibility for nearly half of nonOIS level C and D projects
because they generally relate to maintaining or improving systems that
provide financial management or program integrity information.
13 The IT investment management guidance is included in the Clinger- Cohen
Act of 1996 (P. L. 104- 106); Funding Information Investments (OMB
Memorandum M- 97- 02, Oct. 25, 1996); Capital Programming Guide (OMB, July
22, 1997); Management of Federal Information Resources (OMB Circular A- 130,
Nov. 30, 2000); and Executive Guide: Improving Mission Performance Through
Strategic Information Management and Technology (GAO/ AIMD- 94- 115, May
1994).
Page 14 GAO- 01- 824 Medicare Information Systems
Table 1: Number of Complex and Expensive IT Projects by Level and
Organization Managing organization Level C a Level D b Total
Center for Beneficiary Services 9 2 11 Center for Health Plans and Providers
3 1 4 Center for Medicaid and State Operations 8 1 9 Office of Clinical
Standards and Quality 4 0 4 Office of Communications and Operations Support
1 0 1 Office of Financial Management 23 3 26 Office of Information Services
34 10 44 Office of Internal Customer Support 1 0 1 Office of Strategic
Planning 2 0 2
Total 85 17 102
Note: All information is as of January 19, 2001, and reflects HCFA?s
organizational structure at that time. a Level C projects are multiyear
software development projects, complex or large purchases, and large
hardware or network integration activities that can be broken down into
discrete phases. b Level D projects are major investments that exceed $2. 5
million in 1 year or $10 million over 5 years, are highly visible, or
expected to improve a mission- critical activity and warrant a focused
review and detailed analysis and documentation.
Source: GAO summary of data from CMS? IT Investment Database.
CMS? process for selecting and managing these substantial projects falls
short of recognized commercial and public sector best practices and guidance
14 in the following ways.
Despite the importance of involving senior- level management in reviews of
project cost, quality, and timeliness, executive- level monitoring of
critical IT projects at CMS is uneven. CMS? Executive Council, in
conjunction with its Financial Management Investment Board (FMIB), serve as
its IT
14 As outlined in the Clinger- Cohen Act, OMB memorandum, and our executive
guide, which includes a discussion of IT management practices of leading
public and private organizations.
Page 15 GAO- 01- 824 Medicare Information Systems
investment review board as required by federal law. 15 The FMIB reviews
project funding requests annually when it defines funding priorities and
makes its annual funding recommendations to the Executive Council, and the
Executive Council is briefed on the progress of some of the projects. The
CIO receives monthly status reports on about a third of the major projects
OIS manages. However, neither the FMIB nor the CIO routinely receives status
reports on projects managed by the agency?s program units, particularly such
critical projects as the development of the system needed to maintain
information on Medicare+ Choice plans. Without their systematic involvement,
senior managers will not be able to make timely and appropriate decisions if
cost, schedule, and performance outcomes are not achieved.
CMS has not formally defined criteria for project funding. The agency?s
FMIB bases its decisions on high- level criteria that are used for selecting
IT investments. 16 These criteria are focused on meeting mission needs, but
do not include explicit cost, schedule, benefit, or risk criteria-
considerations that would be helpful in making trade- offs among investments
competing for limited resources. In addition, CMS has not developed written
selection criteria.
Some projects were approved for funding before the benefits and risks,
including technical considerations, had been analyzed and reported.
HCFA implemented a database for tracking IT projects in mid- 1999.
However, at the time of our review, the database was not useful for
monitoring projects. Our review of records and discussions with project
managers indicated that cost, schedule, and milestone information in the
database was missing, incomplete, or outdated.
CMS does not conduct project evaluations, making efforts to examine a
project?s performance relative to expectations and efforts to identify
15 An IT investment review board is a decision- making body made up of
senior program, financial, and information managers that is responsible for
setting agency priorities and making decisions about IT projects and
systems. Such a board helps federal agencies fulfill Clinger- Cohen Act
requirements for establishing an investment management process. CMS?
Executive Council is comprised of its CIO, its Chief Financial Officer, who
is also Director of the Office of Financial Management, the CMS
Administrator and Deputy Administrator, and other senior executive managers.
The Executive Council is supported by the FMIB, which is comprised of senior
level managers (generally deputy Center or Office directors) that report
directly to members of the Executive Council. The FMIB/ Executive Council
are responsible for developing CMS? fiscal operating plan each year, based
on the overall budget allocated by the Congress. The FMIB makes
recommendations to the Executive Council regarding IT and non- IT
investments and funding.
16 Our interviews with CMS officials indicate that the unwritten criteria
include whether a project is critical to keeping CMS? programs operating, is
congressionally mandated, or meets another priority.
Page 16 GAO- 01- 824 Medicare Information Systems
lessons learned largely haphazard. Although officials told us that they
intend to add a postimplementation review process, details and milestones to
put this step in place have not been developed.
In response to these acknowledged weaknesses, CMS officials told us of
several improvements planned or under way. During our review, CMS issued a
guide to implementing more structured controls in its investment management
process. 17 As part of its improvements, the agency has begun to implement a
more effective project selection process. For example,
?seed money? funding to develop a business case analysis for a project-
which includes a study of the project?s estimated costs, benefits, and
risks- before proceeding with further development was provided for some CMS?
newest major projects, including the CWF redesign project. 18 The business
case analysis is intended to provide the FMIB with more information on the
project?s needs, scope, and cost when making funding decisions.
CMS also expects to implement more structured management controls, including
ongoing CIO monitoring for cost, performance, and scheduling of level C and
D projects, with technical reviews performed at critical project milestones.
For example, CMS plans to have the CIO Technical Advisory Board 19 perform
technical reviews of projects at the end of the design phase and before
testing is performed, but the details of this process have not been
finalized. In addition, CMS implemented a new version of its IT investment
database in November 2000 with enhancements intended to improve its
usefulness in tracking project spending and performance. Despite the actions
taken and planned, however, achievement of the agency?s IT goals remains at
risk until these and other key improvements are fully implemented in its IT
planning and management efforts.
17 Office of Information Services, Investment Planning and Management Group,
IT Investment Management Process Guide, May 4, 2001. 18 A business case
analysis includes an assessment of the current state of CMS? system( s) and
future requirements, a gap analysis, alternative analysis, and conceptual-
level systems design.
19 The board is composed of members of technical staff from throughout CMS
and is charged with providing the CIO advice when requested.
Page 17 GAO- 01- 824 Medicare Information Systems
The weaknesses identified in CMS? IT planning efforts and project management
procedures are part of a larger set of interrelated problems involving the
agency?s budget, workforce, and strategic management approach. CMS? budget
and workforce are not commensurate with the agency?s congressionally
mandated workload. At the same time, however, CMS has made limited use of
performance measures to achieve accountability and results.
Developing major projects while maintaining current IT systems and
infrastructure and other programmatic operations is an expensive undertaking
that involves difficult budgetary trade- offs. As the agency?s mission has
grown over the years, its discretionary dollars that fund IT and other
operations to adminster its programs have been stretched thinner. 20 Budget
pressures have forced the Congress to make difficult decisions to limit
agencies? discretionary spending. Like many other federal agencies, CMS has
been operating with a discretionary budget to administer its programs that
has only slightly increased over the past 10 years. Yet, during the last
decade, mandatory spending on Medicare benefit payments has doubled, and
CMS? overall and IT workload increased appreciably. This is due mainly to
the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and
BBA requirements and new non- Medicare programmatic responsibilities, such
as the State Children?s Health Insurance Program (SCHIP). BBA alone had 335
provisions requiring CMS to make substantial changes to the Medicare
program. In 1998- a key BBA implementation year- the agency was doing this
work with about 1,000 fewer employees than it had in 1980. 21 In fiscal year
2000, Medicare?s operating costs represented less than 2 percent of the
program?s benefit
20 CMS predominantly funds IT projects out of its program management
account. Within program management, CMS has four separate categories or
program activities that relate to specific business functions-( 1) Medicare
contractors, (2) research, (3) state survey and certification, and (4)
federal administration. In addition, CMS funds some IT activities through
two other accounts. These accounts fund the Medicare Integrity Program,
which receives an appropriation as specified in the Health Insurance
Portability and Accountability Act of 1996, and Peer Review Organizations,
which receive an apportionment from the Medicare trust funds. IT projects
are funded out of the program activities they will serve, may be funded out
of multiple activities or accounts, and compete directly with other ongoing
activities and planned investments. Most system development projects are
funded out of the Medicare contractors program activity within the program
management account.
21 In 1998, HCFA published 92 regulations and Federal Register notices
implementing aspects of the BBA, including congressional directives,
beneficiary protections, the Medicare+ Choice program, and program savings.
Additional Challenges
Put Achieving CMS? IT Goals At Risk
Funding Constraints Pose Barriers to IT Modernization Efforts
Page 18 GAO- 01- 824 Medicare Information Systems
outlays, far below the percentage for private or nonprofit insurers, even
after accounting for differences in the functions each performs.
CMS? IT projects compete for resources with other agency responsibilities of
national importance, some of which are also lacking in funds and staff. For
example, in the area of nursing home quality, CMS has made negligible use of
its most effective oversight technique- a federally conducted nursing home
inspection to assess how well state inspectors have identified serious
deficiencies in nursing facilities. Conducting these independent
inspections, known as comparative surveys, is important to check the quality
of state inspections because some state inspectors have missed significant
problems. However, CMS has lacked sufficient staff to perform an adequate
number of these checks. 22 CMS? ability to oversee the performance of its
Medicare claims administration contractors is similarly constrained. After
weaknesses in contractors? performance of critical activities to assure
accurate payment were detected, in fiscal year 2001, the agency requested
funding for 100 additional positions to focus on key contractor oversight
activities, such as monitoring claims processing and reviewing payments made
to providers.
With the many program priorities in CMS- including maintaining current
systems- allocating funds for IT improvements is a difficult juggling act.
Currently, HIGLAS, which is CMS? planned financial management system now
under development, is one of the agency?s top IT priorities. It is expected
to have the capacity to aggregate financial information that now resides in
the stand- alone claims processing systems of the contractors. The agency
allotted an additional $10 million to HIGLAS for its development in fiscal
year 2001 to purchase and customize needed software. At the same time,
funding had to be decreased or eliminated entirely for other systems,
including the Provider Enrollment, Chain and Ownership System (PECOS), a
centralized national provider enrollment database; NMUD; and the Contractor
Management Information System (CMIS), a contractor monitoring database. (See
table 2 for discussion of the role these systems are designed to play in
modernizing Medicare.) Delays in developing these systems have considerably
slowed efforts by CMS and its contractors to conduct Medicare program
monitoring and policy development activities more competently and
efficiently.
22 Nursing Home Care: Enhanced HCFA Oversight of State Programs Would Better
Ensure Quality (GAO/ HEHS- 00- 6, Nov. 4, 1999).
Page 19 GAO- 01- 824 Medicare Information Systems
Table 2: Examples of Systems Development Delays Because of Funding
Constraints, Identified by CMS Officials
System Role in Medicare modernization Funding constraints
PECOS is designed to be a national Medicare provider database to ensure that
Medicare enrolls only the physicians, hospitals, suppliers, and other
providers who are professionally qualified and meet the program?s billing
requirements.
PECOS would replace the multiple existing contractor systems that separately
house provider enrollment data. This simplification would facilitate the
nationwide screening of providers billing Medicare.
In fiscal year 2000, due to competing priorities, CMS had to allot this
project $1 million less than project managers requested, which limited the
system?s implementation to contractors that process providers? part A
claims. In fiscal year 2001, funding for further development was cut
entirely, precluding system development for contractors that process
providers? part B claims. NMUD is a database using modern technology for
storing information on beneficiaries? use of part A and part B services.
NMUD is intended to replace an existing database whose outmoded software
does not generate reports in a user- friendly format. The existing service
utilization database cannot be queried on a range of questions about
beneficiaries? use of health care services. Such information is basic to the
agency?s ability to monitor health care quality and the appropriateness of
provider payments.
The level of funding CMS allocated in fiscal year 2001 for NMUD?s
development was not sufficient to enable users to generate data reports.
CMIS is intended to replace an existing system that contains data on
contractor claims administration activities and produces quarterly reports.
CMIS is expected to have next- day data and to be easy to query. The ability
to obtain management information promptly can facilitate CMS? oversight of
its claims administration contractors, which are responsible for the
efficiency of Medicare?s dayto- day operations.
CMIS was to get no funding in fiscal year 2001. However, CMS reprogrammed
some funding to enable this project to be continued.
Source: GAO, based on information provided by CMS.
Because CMS must make trade- offs that affect its ability to manage the
Medicare program, having a process to manage its IT and other
Page 20 GAO- 01- 824 Medicare Information Systems
programmatic investments can help ensure that the most critical activities
are funded. The development of CMS? database for beneficiaries? use of
services- NMUD- is a case in point. CMS originally allotted $600, 000 to the
NMUD project for fiscal year 2001. However, this amount did not reflect the
funds needed to build in the capacity to assemble and maintain beneficiary
encounter data used in Medicare+ Choice to fulfill the BBA requirement for a
health- based risk adjuster. Once staff recognized the necessity of storing
encounter data, CMS redistributed IT funds to support developing a component
in NMUD that had the capacity to assemble and maintain those data in a user-
friendly format.
One of the difficulties of trying to conduct long- term improvement projects
is that unexpected new priorities requiring immediate attention, such as new
program requirements with short implementation time frames, can push longer
term projects to the end of the funding queue. For example, due to an
unexpected spike in claims processing and appeals workloads, CMS staff told
us that claims administration contractors would either need to be allocated
more funding than anticipated in fiscal year 2001 or the contractors would
have to shift funds from other functions, such as their provider and
beneficiary education efforts, to address added claims processing and
appeals workload. Statutory mandates often have hidden systems costs that
can become ongoing expenses for which the agency does not get additional
funding. For example, while adding an improved risk adjuster for Medicare+
Choice appeared to be a small legislative provision, maintaining information
for the risk adjuster will end up costing the agency about $20 million to
$30 million per year as a new, ongoing cost.
The success of CMS? efforts to modernize its systems and implement effective
planning and management processes hinges on its ability to build, prepare,
and manage its IT workforce. However, CMS already has a shortage of skilled
IT staff and, like other agencies, faces challenges to fill its gaps.
Staff shortages- in terms of skills and numbers- have seriously undercut
CMS? efforts to carry out IT best practices. The CIO told us that OIS
staffing levels and expertise are not adequate to simultaneously conduct the
system maintenance, contract monitoring, and system development work that is
being demanded of the staff. Specifically, CMS officials pointed to data
security and project management as areas where expertise needs
strengthening. According to the CIO, some IT security projects have Human
Capital Challenges
Could Slow Modernization Efforts
Page 21 GAO- 01- 824 Medicare Information Systems
been delayed for at least a year because OIS lacked employees with requisite
skills.
CMS also faces the possibility of losing its current employees who have
technical and managerial expertise. An estimated 36 percent of the agency?s
computer and telecommunications specialists are eligible to retire by the
end of fiscal year 2005. In efforts to recruit new employees, CMS- like
other federal agencies- must cope with the demand for, and at times short
supply of, qualified IT workers. Despite the recent economic slowdown,
employers from every sector, including the federal government, are still
finding it difficult to meet their needs for highly skilled IT workers. In
the long term, demand for skilled IT personnel is likely to increase.
In order to address its skill needs, CMS has begun an agencywide workforce
planning effort, which includes assessing employees? IT skills through a
survey. 23 However, as noted, CMS lacks a complete architecture and
migration plan to detail its current capacity and proposed IT needs. Without
such information about its needs, CMS will have difficulty determining the
skills needed to accomplish its IT modernization. In addition, the agency
has not developed a comprehensive plan for using training, hiring,
outsourcing, and retention strategies to fill skill gaps and staffing needs.
Part of CMS? challenge for planning its future workforce is to determine the
right balance between work performed by CMS employees and by contractors.
Despite CMS? many resource- related challenges- including rehabilitating its
information systems- the agency has not documented its resource needs well.
In January 1998, we reported that the agency lacked an approach- consistent
with the Government Performance and Results Act of 1993 (GPRA)- to develop a
strategic plan for its full range of program objectives. 24 Since then, the
agency has developed a plan, but it has not tied global objectives to day-
to- day program operations.
23 This is a step that we have recommended- see Human Capital: Building the
Information Technology Workforce to Achieve Results (GAO- 01- 1007T, July
31, 2001 ). Also, see Human Capital: A Self- Assessment Checklist for Agency
Leaders (GAO/ OCG- 00- 14G, Sept. 2000). 24 Medicare: HCFA Faces Multiple
Challenges to Prepare for the 21st Century (GAO/ T- HEHS- 98- 85, Jan. 29,
1998). Management Approach
Lacks Strong Performance Focus
Page 22 GAO- 01- 824 Medicare Information Systems
To encourage a greater focus on results and improve federal management, the
Congress enacted GPRA- a results- oriented framework that encourages
improved decision- making, maximum performance, and strengthened
accountability. Managing for results is fundamental to an agency?s ability
to set meaningful goals for performance, measure performance against those
goals, and hold managers accountable for their results. 25
In May 2001, we reported on the results of our survey of federal managers at
28 departments and agencies on strategic management issues. 26 The
proportion of CMS managers who reported having output, efficiency, customer
service, quality, and outcome measures was significantly below that of other
government managers for each of the performance measures. CMS was the
lowest- ranking agency for each measure- except for customer service, where
it ranked second lowest. Moreover, CMS managers? responses concerning
whether they were held accountable for results to a great or very great
extent- 42 percent- was significantly lower than the 63 percent reported by
the rest of the government.
Apart from any other challenge, no agency can function effectively without
adequate resources coupled with appropriate accountability mechanisms.
Adequate resources are vital to support the kind of oversight and
stewardship activities that Americans have come to count on from the
Medicare program- inspection of nursing homes and laboratories,
certification of Medicare providers, and collection and analysis of critical
health care data, to name a few.
In the case of other agencies or programs with serious resource challenges,
the Congress has helped jump- start improvements by providing agencies with
additional funds tied to improvements in
25 As we noted in our assessment of HHS? fiscal year 2000 performance
reports and fiscal year 2002 performance plans, HCFA?s progress in meeting
the key outcome of reducing fraud, waste, and error in Medicare and Medicaid
has been difficult to determine because goal changes make its progress hard
to track. In addition, two general weaknesses have hindered HCFA?s efforts
to ensure proper payment of claims- outmoded information systems and weak
financial management, due in part to lack of a fully integrated financial
management IT system. See Health and Human Services: Status of Achieving Key
Outcomes and Addressing Major Management Challenges (GAO- 01- 748, June 15,
2001).
26 Managing for Results: Federal Managers? Views on Key Management Issues
Vary Widely Across Agencies (GAO- 01- 592, May 25, 2001). CMS IT Challenges
Warrant Congressional Attention
Page 23 GAO- 01- 824 Medicare Information Systems
management capability. In conjunction with such an increase in resources,
CMS needs to have its IT funded at adequate levels to ensure both that the
existing systems can be maintained and replaced by more functional,
modernized systems and that its IT can provide more effective and efficient
mission support.
Providing IT funding that can be obligated over a multiyear period provides
added flexibility when developing long- term projects, such as new systems.
In the case of CMS, such additional multiyear funding would provide the
stability and flexibility the agency needs to maintain and modify some
systems while gradually replacing or redesigning others. As it has done in
other cases, the Congress could provide CMS the funding in a separate
account or line item appropriation, if that were deemed necessary to ensure
that the money would be used for IT purposes.
CMS? IT funding levels should support and be commensurate with demonstrated
improvements in key IT management capabilities. This includes the further
development of its enterprise architecture and migration plan and enhanced
IT investment management processes to strengthen its decision- making.
Further development of its enterprise architecture and investment management
processes will help ensure the most effective use of funds.
However, CMS will need support while further developing its enterprise
architecture and management process because it cannot abandon its current
efforts. These include maintaining current systems and ongoing improvement
efforts as well as responding to needed programmatic changes that require IT
solutions. Without such concurrent efforts, the performance of key Medicare
operations could be jeopardized, a situation that would be unacceptable to
beneficiaries and providers and inconsistent with congressional expectations
for implementing legislative mandates effectively within reasonable time
frames. Providing additional funds could be made contingent on the agency
making sufficient progress in developing its enterprise architecture,
investment practices, and human capital capabilities, and on providing the
Congress with a detailed annual plan for its IT modernization efforts.
With Medicare reform at the forefront of the nation?s domestic agenda, the
IT environment in which the program operates day- to- day must be capable of
supporting effective program management and adaptable to change and
innovation. In our view, the successful modernization of CMS? systems is
fundamental to a health financing program that can serve its major
Conclusions
Page 24 GAO- 01- 824 Medicare Information Systems
stakeholders- beneficiaries, health care providers, and taxpayers- with the
efficiency and effectiveness that will be demanded of such a program in the
future.
The role of CMS in strengthening its IT modernization efforts is clear. To
ensure greater rigor in the execution of its systems renovation and
development, the agency must develop key IT planning documents and requisite
processes that are currently lacking. This includes further developing the
enterprise architecture documentation, particularly the agency?s information
flows and data elements. However, this cannot be accomplished by OIS alone.
The agency?s top leadership must engage the efforts not only of the
technical staff in OIS but also of staff members in program and
administrative units to complete its enterprise architecture plans. The
participation of key program and administrative staff members is
particularly important to establish the processes needed to ensure data
reliability and relevance. In conjunction with CMS? other units, the CIO
needs to develop a migration plan that will prioritize and sequence IT
projects so that officials throughout the agency understand the roadmap they
are following to move toward a modernized IT environment.
CMS must also tighten project review, approval, and evaluation procedures,
ensuring that the selection and management of IT projects receive adequate
attention from senior officials agencywide. Selection and management would
be strengthened when CMS develops and uses written criteria to prioritize
project selection, requires technical reviews, and has an adequate
agencywide process for monitoring the status of projects. In addition, CMS
is not currently realizing the full value of lessons learned from its
modernization efforts because it does not have a systematic process to
evaluate them. Such an evaluative process could help the agency capitalize
on successes and avoid obstacles in developing its next generation of
projects. Furthermore, while CMS has been taking steps to assess its
workforce skills, it still needs to complete its assessment of IT staffing
needs and identify and fill skill gaps. Given the importance of human
capital to achieving mission results, such a deficit leaves the agency more
vulnerable to IT development mishaps.
The combination of stronger IT management plans and processes, coupled with
adequate resources, would improve the chances that CMS? IT challenges will
be met. We believe that the Congress can address both the agency?s resource
needs as well as its tactical management shortcomings. The Congress could
provide CMS with additional funding- with authority to obligate the funds
over several years- but could tie the agency?s authority to obligate funds
to a requirement that it invest, and demonstrate
Page 25 GAO- 01- 824 Medicare Information Systems
improvements, in its IT planning and investment management, as well as its
human capital management. With the certainty of longer term project funding
tied to an increased expectation for performance and accountability, the
likelihood of achieving success in modernizing Medicare?s information
systems could be greatly improved.
To help CMS successfully modernize its IT environment, the Congress may wish
to provide additional, multiyear funding for CMS? IT projects, under certain
conditions that link funding increases to efforts to improve and
demonstrated progress in technical, program, and human capital management.
Because the absence of an effective enterprise architecture and IT
investment management process hinders CMS? ability to manage its IT
environment, the Congress may wish to consider making the authority to
obligate funds contingent upon the agency using the funds initially to
support only
ongoing program operations, maintenance of existing systems, and IT
projects currently under way;
efforts to develop an effective enterprise architecture and IT investment
management process, as well as to obtain the human capital needed to
modernize IT practices and operations; and
statutorily required activities. The Congress may wish to make subsequent
funding available for new IT development projects contingent on the agency?s
(1) providing a satisfactory plan specifying the use of funds for the
upcoming fiscal years and (2) demonstrating sufficient progress in
implementing the following recommendations for improving critical IT
capabilities necessary to successfully manage large and more complex
projects.
We recommend that, to ensure the success of the agency?s IT modernization,
the Administrator of CMS and its senior management become more involved in
IT planning and management efforts, and thus elevate the priority given to
these efforts throughout the agency. To improve development and
implementation of the agency?s enterprise architecture, the Administrator
should
direct center and administrative unit officials to complete, in
conjunction with OIS, the enterprise architecture documentation,
particularly of the business functions, information flows, and data elements
for the systems for which their respective units are responsible, and Matter
for
Congressional Consideration
Recommendations For Executive Action
Page 26 GAO- 01- 824 Medicare Information Systems
direct the CIO to specify in a migration plan the priorities for, and
sequencing of, IT projects.
To improve the investment management process, the Administrator should
establish sufficient and written criteria to ensure a consistent process
for funding IT projects agencywide;
require that major IT projects undergo a technical review before the
agency approves them for further development;
direct the CIO and FMIB to develop sufficient information to monitor the
status of IT projects;
establish a systematic process for evaluating completed IT projects that
includes cost, milestone, and performance data; and
direct the CIO to develop an IT workforce strategy that outlines a plan to
assess staffing needs, identify skill gaps, and fill the gaps.
In written comments on a draft of this report, CMS officials said that they
had undertaken a series of steps to make the agency more responsive to
beneficiaries and to changes in the health care industry, and that
strengthening management of its IT was essential to the success of these
efforts. They stated that resource limitations have hampered their
implementation of some IT management processes as well as the development of
several key systems modernization efforts. Notwithstanding these resource
limitations, agency officials agreed that they would take steps to address
the weaknesses identified in this report, but were not specific about the
actions that they would take. In addition, CMS provided technical comments,
which we incorporated where appropriate. CMS? written comments are reprinted
in appendix IV.
As agreed with your office, unless you publicly announce its contents
earlier, we plan no further distribution of this report until 30 days after
the date on this letter. At that time, we will send copies to the Secretary
of the Department of Health and Human Services, the CMS Administrator,
Agency Comments
Page 27 GAO- 01- 824 Medicare Information Systems
interested congressional committees, and others. We will also make copies
available upon request. If you or your staff have any questions about this
report, please contact me at (312) 220- 7600. Another contact and GAO staff
acknowledgments are listed in appendix V.
Sincerely yours, Leslie G. Aronovitz Director, Health Care- Program
Administration and Integrity Issues
Appendix I: Scope and Methodology Page 28 GAO- 01- 824 Medicare Information
Systems
Our review of CMS? IT modernization efforts described aspects of CMS?
current IT environment and projects CMS has under way to improve its
systems, examined the agency?s IT planning efforts and IT management
process, and discussed the challenges that need to be addressed to meet the
agency?s IT goals. We focused specifically on CMS? ability to support
Medicare?s claims processing, financial management, and managed care
activities. To these ends, we did the following.
We interviewed the agency?s program managers and staff responsible for
contractor oversight, financial management, and managed care activities and
discussed the information systems that support these functions as well as
the development and management of projects to consolidate, replace, or
redesign these systems. In addition, we discussed the architectural plan and
investment management processes with the CIO, the Chief Architect, and the
Executive Secretary of FMIB as well as other CMS IT officials.
We assessed the agency?s compliance with applicable sections of the
Clinger- Cohen Act of 1996, OMB?s guidance related to IT architectural plan
development and the acquisition and management of information resources, and
our architectural plan and IT investment management guidance. 1
We analyzed the agency?s enterprise architecture, IT Investment Management
Process Guide, and related documentation.
We reviewed internal documents, such as IT Council meeting minutes,
funding and spending plans, and the charters for various entities involved
in the IT architectural plan and IT investment management processes.
We examined the agency?s IT investment database, which is used to track
agency IT projects.
We examined documents and interviewed officials regarding the agency?s
budget formulation and IT funding. This included reviewing documents on
Medicare?s administrative budget, such as the agency?s operating plan for
fiscal year 2001, and its budget justification and supporting documentation
for fiscal years 2000 and 2001. It also included conducting interviews with
agency officials in the Office of Financial Management, including the Chief
Financial Officer, the Director of Budget Formulation, and the Executive
Secretary of the FMIB, and IT project managers. We did not validate the
accuracy of the data in the agency?s budget documents.
1 Executive Guide: Improving Mission Performance Through Strategic
Information Management and Technology (GAO/ AIMD- 94- 115, May 1994).
Appendix I: Scope and Methodology
Appendix I: Scope and Methodology Page 29 GAO- 01- 824 Medicare Information
Systems
We identified certain system changes mandated by HIPAA; BBA; the Medicare,
Medicaid, and SCHIP Balanced Budget Refinement Act of 1999; and the
Medicare, Medicaid, and SCHIP Benefits Improvement and Protection Act of
2000.
We identified IT workforce challenges by reviewing agency policies,
practices, plans, and current data on IT job series, retirement, hiring,
training, and retention; interviewed relevant agency officials; and examined
the consistency of the agency?s workforce planning efforts with Clinger-
Cohen Act requirements and our human capital self- assessment checklist. 2
To gain more insight into how CMS selects and manages IT projects, we
reviewed eight IT projects, selected because they were (1) either level C or
D, 3 (2) in different life cycle stages (e. g., requirements definition,
design, or operations and maintenance), and (3) managed by different CMS
centers and offices. The following projects were selected:
Medicare Managed Care System Redesign,
Common Working File Redesign,
Medicare Beneficiary Database,
National Medicare Utilization Database,
Health Plan Management System,
Contractor Management Information System,
Provider Enrollment Chain and Ownership System, and
Medical Review for Skilled Nursing Facility Prospective Payment System.
Our work was conducted from April 2000 through August 2001 in accordance
with generally accepted government auditing standards.
2 Human Capital: A Self- Assessment Checklist for Agency Leaders (GAO/ OCG-
00- 14G, Sept. 2000). 3 Level C projects are multiyear software development
projects, complex or large purchases, and large hardware or network
integration activities that can be broken down into discrete phases. Level D
projects are major investments that exceed $2.5 million in 1 year or $10
million over 5 years, are highly visible, or expected to improve a mission-
critical activity and warrant a focused review and detailed analysis and
documentation.
Appendix II: Consolidation Of Medicare Claims Processing Systems
Page 30 GAO- 01- 824 Medicare Information Systems
To reduce variation in claims processing and lower its systems maintenance
costs, CMS is consolidating the number of IT systems used by its claims
administration contractors to process Medicare fee- forservice claims. At
present, the Medicare claims contractors use one of six systems. Two systems
are used by fiscal intermediaries and four are used by carriers. All of the
DMERCs use a single system. CMS plans to consolidate its claims processing
into three selected systems: one for fiscal intermediaries, one for
carriers, and one for DMERCs. Table 3 summarizes the planned consolidation
for each type of contractor, the current systems used, and the anticipated
completion date of these consolidation efforts.
Table 3: Status of Systems Consolidation Contractors Planned
Consolidation Current Systems Anticipated
Completion Date for Transition
Fiscal Intermediary Standard System (FISS)
Currently using system Fiscal Intermediaries
Fiscal Intermediary Standard System (FISS)
Arkansas Part A Standard System (APASS)
Transition on hold a GTE Medicare System (GTEMS) February 2002 HCFA Part B
Standard System (HPBSS)
March 2004 Multi- Carrier System (MCS) Currently using
system b Carriers
(other than DMERCs)
Multi- Carrier System (MCS)
Variable Information Processing Systems Medicare System (VMS)
September 2003 DMERCs
Variable Information Processing Systems Medicare System (VMS)
Variable Information Processing Systems Medicare System (VMS)
Currently using system
a CMS has not set a time frame for when it will have all of its fiscal
intermediaries using a single system. Major changes were made to fiscal
intermediary systems to implement the outpatient and home health prospective
payment systems, and agency officials told us that they wanted to allow
claims payment processes to stabilize under the new payment methods before
any further transitions begin. In addition, agency officials indicated that
they are currently recompeting the contract for maintaining FISS. The
contractor chosen to maintain FISS would also manage fiscal intermediaries?
transitions. CMS anticipates that it will award the new contract in February
2002. b About 60 percent of carrier claims are currently being processed on
MCS.
Appendix II: Consolidation Of Medicare Claims Processing Systems
Background
Appendix III: Examples Of Missing Elements From CMS? Enterprise Architecture
Page 31 GAO- 01- 824 Medicare Information Systems
CMS? enterprise architecture- a blueprint of the agency?s current and
planned IT environment- is documented in a set of volumes, each detailing a
different component of CMS? IT environment. Described below are examples of
missing elements from the business, information, application,
infrastructure, and security volumes of CMS? enterprise architecture and the
potential impact on IT modernization efforts.
Table 4: Examples of Missing Elements From CMS? Enterprise Architecture
Missing elements Potential impact
Business volume Except for the managed care and peer review organization
functions, this volume does not sufficiently detail the Medicare program?s
key functional areas, such as claims processing. Missing are adequate
accounts of processes and activities, the units involved, and factors that
could cause the function to change.
CMS will not be able to rely on its architecture documents to effectively
support the agency?s mission, vision, and goals through a complete
description of its major functions. For example, with regard to the Medicare
claims processing function, it cannot be assured that the agency has the
proper information to identify needed applications and technology.
Information volume This volume does not fully describe how information flows
internally. In addition, the description of external information flows is at
too general a level to be useful for planning purposes. The volume also does
not fully define the data maintained or describe relationships among data
elements, such as how data elements are maintained and accessed.
CMS lacks critical information about the agency?s existing data elements to
ensure an effective transition to a new database management system. This
will hamper efforts to develop and maintain systems and make them
interoperable. In turn, these difficulties will affect the efficient
operation of program functions and activities. Applications volume During
our review, the agency developed an inventory of existing and planned
software applications that it published on its internal network to provide
guidance for agency staff. This inventory is not yet included in the
architecture volume.
CMS will need to monitor project selection to ensure that software choices
made are compatible with the architecture.
Infrastructure volume The volume does not identify all standards pertaining
to information transfer, information processing, data management, key
software needed for information transfer, applications, systems management,
and external environment. CMS officials stated that standards in these areas
were developed but not yet approved. However, they were unable to provide us
with a list.
CMS risks that developers would use standards that would result in systems
that were not compatible with one another. For example, without approved
standards related to interfaces, CMS could develop systems that are
incompatible with external systems that could make system
Appendix III: Examples Of Missing Elements From CMS? Enterprise Architecture
Appendix III: Examples Of Missing Elements From CMS? Enterprise Architecture
Page 32 GAO- 01- 824 Medicare Information Systems
Missing elements Potential impact
integration much more difficult and costly. Security volume Standards for
some basic security services are pending (e. g., database access controls)
or have not been identified (e. g., intrusion detection).
CMS lacks a set of rules to govern how it will develop, implement, and
operate systems with respect to security, which can lead to deficiencies in
security of systems and data.
Source: GAO.
Appendix IV: Comments From the Centers for Medicare and Medicaid Services
Page 33 GAO- 01- 824 Medicare Information Systems
Appendix IV: Comments From the Centers for Medicare and Medicaid Services
Appendix IV: Comments From the Centers for Medicare and Medicaid Services
Page 34 GAO- 01- 824 Medicare Information Systems
Appendix V: GAO Contact and Staff Acknowledgments
Page 35 GAO- 01- 824 Medicare Information Systems
Sheila K. Avruch, (202) 512- 7277 In addition to the person named above,
Margaret Davis, Hannah Fein, Sandra Gove, Norm Heyl, Erin Kuhls, Linda
Lambert, Anh Le, Henry Sutanto, and Marcia Washington made key contributions
to this report. Appendix V: GAO Contact and Staff
Acknowledgments GAO Contact Staff Acknowledgments
Related GAO Products Page 36 GAO- 01- 824 Medicare Information Systems
Human Capital: Building the Information Technology Workforce to Achieve
Results (GAO- 01- 1007T, July 31, 2001).
Medicare Management: CMS Faces Challenges to Sustain Progress and Address
Weaknesses (GAO- 01- 817, July 31, 2001).
Medicare Management: Current and Future Challenges (GAO- 01- 878T, June 19,
2001).
Health and Human Services: Status of Achieving Key Outcomes and Addressing
Major Management Challenges (GAO- 01- 748, June 15, 2001).
Managing For Results: Federal Managers? Views on Key Management Issues Vary
Widely Across Agencies (GAO- 01- 592, May 25, 2001).
Major Management Challenges and Program Risks: Department of Health and
Human Services (GAO- 01- 247, Jan. 2001).
High- Risk Series: An Update (GAO- 01- 263, Jan. 2001). Human Capital: A
Self- Assessment Checklist for Agency Leaders (GAO/ OCG- 00- 14G, Sept.
2000).
Federal Health Care: Comments on H. R. 4401, the Health Care Infrastructure
Investment Act of 2000 (GAO/ AIMD- 00- 240, July 11, 2000).
Medicare: HCFA Faces Challenges to Control Improper Payments (GAO/ THEHS-
00- 74, Mar. 9, 2000).
Medicare Post- Acute Care: Better Information Needed Before Modifying BBA
Reforms (GAO/ T- HEHS- 99- 192, Sept. 15, 1999).
HCFA Management: Agency Faces Multiple Challenges in Managing Its Transition
to the 21st Century (GAO/ T- HEHS- 99- 58, Feb. 11, 1999).
Medicare Transaction System: Serious Managerial and Technical Weaknesses
Threaten Modernization (GAO/ T- AIMD- 97- 91, May 16, 1997).
Medicare Transaction System: Success Depends Upon Correcting Critical
Managerial and Technical Weaknesses (GAO/ AIMD- 97- 78, May 16, 1997).
Executive Guide: Improving Mission Performance Through Strategic Information
Management and Technology (GAO/ AIMD- 94- 115, May 1994). Related GAO
Products
(201046)
The first copy of each GAO report is free. Additional copies of reports are
$2 each. A check or money order should be made out to the Superintendent of
Documents. VISA and MasterCard credit cards are also accepted.
Orders for 100 or more copies to be mailed to a single address are
discounted 25 percent.
Orders by mail:
U. S. General Accounting Office P. O. Box 37050 Washington, DC 20013
Orders by visiting:
Room 1100 700 4 th St., NW (corner of 4 th and G Sts. NW) Washington, DC
20013
Orders by phone:
(202) 512- 6000 fax: (202) 512- 6061 TDD (202) 512- 2537
Each day, GAO issues a list of newly available reports and testimony. To
receive facsimile copies of the daily list or any list from the past 30
days, please call (202) 512- 6000 using a touchtone phone. A recorded menu
will provide information on how to obtain these lists.
Orders by Internet
For information on how to access GAO reports on the Internet, send an email
message with ?info? in the body to:
Info@ www. gao. gov or visit GAO?s World Wide Web home page at: http:// www.
gao. gov
Contact one:
Web site: http:// www. gao. gov/ fraudnet/ fraudnet. htm
E- mail: fraudnet@ gao. gov
1- 800- 424- 5454 (automated answering system) Ordering Information
To Report Fraud, Waste, and Abuse in Federal Programs
*** End of document. ***