Year 2000 Computing Challenge: HCFA Action Needed to Address Remaining
Medicare Issues (Testimony, 09/27/1999, GAO/T-AIMD-99-299).

Pursuant to a congressional request, GAO discussed the Health Care
Financing Administration's (HCFA) progress in addressing its year 2000
computing challenges.

GAO noted that: (1) HCFA and its contractors have made progress in
addressing Medicare year 2000 issues; (2) however, until HCFA completes
the ongoing recertification tests, the final status of the agency's year
2000 compliance will remain unknown; (3) limited time remains to
completely test all systems that process Medicare claims for year 2000
compliance (internal, fee-for-service contractor, managed care
organization (MCO), and provider); (4) nevertheless, HCFA must sustain
its efforts, because any progress made in testing these many systems
lowers the risk of disruptions to Medicare and the claims payment
process; (5) HCFA must also continue to closely monitor contractor
testing with providers that to date has been limited but has uncovered
year 2000 problems; (6) in addition, HCFA needs to continue its efforts
to ensure that MCOs are adequately addressing their year 2000
challenges; and (7) given the considerable amount of work that remains
in the next few months, it is crucial that the development and testing
of internal, contractor, and MCO business continuity and contingency
plans move forward rapidly to ensure that, no matter what, providers
will be paid and beneficiaries will receive care.

--------------------------- Indexing Terms -----------------------------

 REPORTNUM:  T-AIMD-99-299
     TITLE:  Year 2000 Computing Challenge: HCFA Action Needed to
	     Address Remaining Medicare Issues
      DATE:  09/27/1999
   SUBJECT:  Y2K
	     Claims processing
	     Computer software verification and validation
	     Systems compatibility
	     Data integrity
	     Information resources management
	     Internal controls
	     Strategic information systems planning
	     Systems conversions
IDENTIFIER:  HCFA Common Working File
	     Y2K
	     Medicare Claims Processing System

******************************************************************
** This file contains an ASCII representation of the text of a  **

** GAO report.  Delineations within the text indicating chapter **
** titles, headings, and bullets are preserved.  Major          **
** divisions and subdivisions of the text, such as Chapters,    **
** Sections, and Appendixes, are identified by double and       **
** single lines.  The numbers on the right end of these lines   **
** indicate the position of each of the subsections in the      **
** document outline.  These numbers do NOT correspond with the  **
** page numbers of the printed product.                         **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
** A printed copy of this report may be obtained from the GAO   **
** Document Distribution Center.  For further details, please   **
** send an e-mail message to:                                   **
**                                                              **
**                                            **
**                                                              **
** with the message 'info' in the body.                         **
******************************************************************

Before the Subcommittee on Government Management, Information and
Technology, Committee on Government Reform, and the Subcommittee on
Technology, Committee on Science, House of Representatives

For Release on Delivery
Expected at
2 p.m.
Monday,
September 27, 1999

YEAR 2000 COMPUTING CHALLENGE

HCFA Action Needed to Address Remaining Medicare Issues

Statement of Joel C. Willemssen
Director, Civil Agencies Information Systems
Accounting and Information Management Division
*****************

*****************

GAO/T-AIMD-99-299

Year 2000 Computing Crisis: Readiness of Medicare and the Health Care
Sector 
Mr. Chairman, Ms. Chairwoman, and Members of the Subcommittees:

Thank you for inviting us to participate in today's hearing on Medicare
Y2K (Y2K) issues. Successful Y2K conversion of the automated systems that
are used by the Department of Health and Human Services' (HHS) Health Care
Financing Administration (HCFA) and its contractors to process Medicare
claims is essential to ensuring that the delivery of health care services
to millions of Americans is not negatively affected. 

We initially reported on HCFA's Y2K program in 1997, making
recommendations to improve the agency's program management./Footnote1/ In
our last report in April 1999, we stated that HCFA had been responsive to
our recommendations, but that critical Y2K risks and challenges
remained./Footnote2/ At that time, we also reported that HCFA's final
tests of its mission-critical systems that are expected to be completed by
November 1, 1999, will ultimately determine whether HCFA's systems are Y2K
compliant. Due to the late time frames associated with these final tests
and the many challenges still confronting HCFA, we stressed the importance
of the agency's business continuity and contingency planning efforts. 

As requested, after a brief background discussion, today I will summarize
HCFA's progress in addressing its Y2K challenges to date and describe the
key challenges that confront HCFA in completing the final Y2K tests of its
mission-critical systems by November 1, 1999. I will also discuss that
HCFA must (1) ensure that Medicare contractors are testing with providers, 
(2) monitor managed care organization's (MCO) efforts to address their Y2K
risks, and (3) complete and validate internal, contractor, and MCO
business continuity and contingency plans. 

Background

Medicare is the nation's largest health insurer, serving about 39 million
Americans by providing federal health insurance to individuals 65 or older
and to many of the nation's disabled. By 2000, HCFA expects to process
over 1 billion claims and pay $288 billion in fee-for-service and managed
care benefits annually. The consequences, then, of its systems' not being
Y2K compliant could be enormous. 

Medicare Claims Processing Systems Are Numerous and Complex
-----------------------------------------------------------

HCFA operates and maintains 25 internal mission-critical systems; it also
relies on 75 external mission-critical systems operated by contractors
throughout the country to process Medicare claims. These external systems
consist of 68 claims processing contractor systems, 6 standard systems,
and the Common Working File (CWF). Each of the claims processing
contractor systems relies on one of the six standard systems to process
its claims, adding its own front-end and back-end processing systems. The
CWF is a set of databases located at nine sites that works with internal
and external systems to authorize claims payments and determine
beneficiary eligibility. 

In addition to the 25 internal and 75 external contractor systems, the
claims process involves over 1 million health care providers and numerous
banks serving both contractors and providers. HCFA also relies on external
systems located at 383 MCOs. Although HHS has not designated the MCOs as
mission-critical in its Y2K quarterly status reports to the Office of
Management and Budget (OMB), these systems are nevertheless vital since
they are used to serve 6.9 million of the 39 million Medicare
beneficiaries. 

Past Recommendations to Improve HCFA's Management of Its Medicare Y2K
Program
---------------------------------------------------------------------------

We originally highlighted our concerns with HCFA's management of Medicare
Y2K in May 1997./Footnote3/ At that time, we made several recommendations
for improvement, including that HCFA identify responsibilities for
managing Y2K actions and that Medicare contractors submit to HCFA their
Y2K plans and validation strategies. In our report last September, we
warned that although HCFA had made improvements in its Y2K management, the
agency and its contractors were severely behind schedule in making mission-
critical systems that process Medicare claims Y2K compliant./Footnote4/
Our conclusions and recommendations at that time reflected our concern
about the high level of risk and large number of tasks still facing HCFA.
Among our specific recommendations was that the HCFA Administrator

o   rank remaining Y2K work on the basis of an integrated project
  schedule and identify the Y2K project's critical path to ensure that
  all critical tasks were prioritized and completed in time to prevent
  unnecessary delays; 

o develop a risk management process;

o ensure that all external and internal systems' data exchanges had been
  identified and agreements signed among exchange partners;

o define the scope of an end-to-end test of the claims process and
  develop plans and a schedule for conducting such a test; and 

o accelerate the development of business continuity and contingency plans.

This February, we testified that although HCFA had been responsive to our
recommendations and that its top management was actively engaged in its
Y2K program, its reported progress was highly overstated./Footnote5/ We
reported that none of HCFA's 54 external mission-critical systems reported
by HHS as compliant as of December 31, 1998, was Y2K ready because all had
important associated qualifications (exceptions), some of them
significant. Further, we reported that HCFA continued to face serious Y2K
challenges, including a significant amount of testing since changes would
continue to be made to its mission-critical systems to make them compliant. 

In April, we testified that HCFA reported that most of the qualifications
associated with HCFA's mission-critical systems had been
resolved./Footnote6/ Further, we noted that HCFA had continued to be
responsive to our recommendations in critical areas such as managing its
electronic data exchanges and developing business continuity and
contingency plans. Nevertheless, critical Y2K risks and challenges
remained. For example, we reported that the mission-critical systems HCFA
deemed compliant were not the final systems that would be processing
Medicare claims on 
January 1, 2000, because these systems were to undergo a significant
amount of change between then and July 1, 1999, for both Y2K-related and
other reasons. In addition, we reported that HCFA's testing to date of
external systems had not been rigorous. Therefore, we stressed the
importance of HCFA's final recertification tests, planned to occur between
July 1 and November 1, 1999. 

HCFA's Actions to Achieve Compliance and Bolster Outreach Efforts to
Medicare Providers

HCFA continues to be responsive to our recommendations and make progress
in its Y2K efforts. To more effectively identify and manage risks, HCFA is
relying on multiple sources of information, including test reports,
reports from its independent verification and validation (IV&V)
contractors, and weekly status reports from its contractor oversight
teams. In addition, HCFA has stationed staff at critical contractor sites
to assess the data being reported to them and to identify problems. 

HCFA is also more effectively managing its electronic data exchanges. It
issued instructions to its contractors to inform providers and suppliers
that they must submit Medicare claims in an eight-digit format by April 5
of this year. On September 22, HCFA reported that 99 percent of Part A
providers and all Part B providers were using the eight-digit format for
claims submissions./Footnote7/ HCFA also issued new instructions to
contractors for reporting on data exchanges and created a new database to
track status. 

HCFA has also acted to improve its Y2K testing program. For example, it
has more clearly defined its testing procedures for its
contractors/Footnote8/ and is using Y2K analysis tools to measure its
testing thoroughness. In addition, HCFA has improved its test coverage
(e.g., systems functionality, HCFA-mandated dates, interface coverage) of
the external systems. In April 1999, we reported that HCFA's IV&V
contractor had concerns with the documentation of external systems' test
coverage associated with Y2K testing to date./Footnote9/ HCFA issued
instructions on April 9, 1999, that required each contractor to submit a
traceability matrix that listed the business functions covered by the
recertification tests. Some HCFA contractors continue to improve their
test coverage by adding test cases/Footnote10/ to their traceability
matrices. 

In addition, an independent testing contractor is conducting tests on the
six standard systems and the CWF. HCFA also plans to perform end-to-end
testing with its Y2K-compliant test sites. These end-to-end tests are to
include all internal systems and contractor systems; however, they will
not include testing with banks and providers. 

Another area in which HCFA has demonstrated progress is the development of
its overall business continuity and contingency plan, which includes 29
internal plans. The agency established cross-organizational workgroups to
develop contingency plans for the following core business functions:
health plan and provider payment, eligibility and enrollment issues,
program integrity, managed care, quality of care, litigation, and
telecommunications. HCFA's fifth iteration of its overall business
continuity and contingency plan (BCCP) was issued on July 1, 1999; the
internal plans are currently being validated. 

As we have also reported, HCFA has taken comprehensive measures in
conducting its outreach activities./Footnote11/ Outreach activities
include information dissemination as well as presentations and
conferences. For example, the HCFA Administrator sent out individual
letters to over 1.1 million Medicare providers in January and May of this
year, alerting them to take prompt Y2K action on their information and
billing systems. HCFA has also established a toll-free information hotline
and plans to film a four-part series in conjunction with the Health and
Science television network that is to be broadcast to hospitals and
nursing facilities. In addition, as of June 25, 1999, the agency had held
12 Y2K conferences throughout the country, and is planning to hold 10
more. Further, HCFA has a web site dedicated to Y2K issues that contains
information and advice to providers on how to assess readiness, test
systems, and develop contingency plans.

Key Challenges Remain in Testing Mission-Critical Systems

Although HCFA has improved its Y2K testing program, it still faces several
hurdles to completing its recertification tests by November 1, 1999. With
only 5 weeks remaining to complete these critical recertification tests,
HCFA has much work ahead. Unfortunately, this tight schedule is not being
guided by an overall plan because HCFA has not yet completed a detailed
integrated testing plan, including a critical path. In addition to
executing the recertification tests and resolving any errors that are
discovered, HCFA is concurrently addressing other issues uncovered by Y2K
assessment tools. Further, HCFA is in the process of transitioning six
contractors to new data centers. Each of these overlapping efforts
introduces risks that could adversely affect the recertification testing
of HCFA's mission-critical systems. 

HCFA's Recertification Testing Program Is Not Being Guided by an
Integrated Testing Plan That Identifies the Critical Path 
---------------------------------------------------------------------------

In September 1998, we recommended that HCFA rank its remaining Y2K work on
the basis of a schedule that included milestones for renovation and
testing of all systems, and that it include time for end-to-end testing
and identify the critical path./Footnote12/ Such a schedule is extremely
important because of the number of systems, their complexity, and
interdependencies among them. 

The required sequencing of the 75 external and 25 internal systems
associated with the recertification requires an integrated testing
schedule to avoid testing overlap and scheduling constraints. Since each
contractor relies on the CWF and one of the six standard systems to
process its claims, these systems should be completely tested before the
contractors test their front-end and back-end processing systems with
their respective standard systems. 

Given the limited time remaining, it is not possible for HCFA to conduct
the recertification testing in the optimal sequence. Therefore, testing
overlap is planned to occur--the 68 claims processing systems, 6 standard
systems, and the CWF are being concurrently tested. This testing approach
is risky because it results in managing multiple testing baselines and
creates challenges in ensuring that resolving one system's testing errors
do not lead to problems in another system. For example, each of the 68
contractors has tested with multiple versions of the CWF and their
respective standard system that have been changed to address Y2K errors
identified during the recertification testing./Footnote13/ HCFA officials
acknowledge the added risk associated with this testing overlap of the
CWF, standard systems, and contractor systems. 

Given that HCFA does not have enough time to conduct the recertification
tests in the proper sequence, it must now aggressively manage the risks
associated with the testing overlap. HCFA officials believe the risks are
manageable due to their oversight of contractor Y2K efforts. However,
effectively managing these risks calls for a more precise and focused
effort, namely, an integrated testing schedule that defines individual
system schedules and their interdependencies. Unfortunately, HCFA still
does not have such a schedule. Although HCFA has a high-level integrated
project plan that contains activities associated with its Y2K program,
this plan does not identify individual system testing schedules or the
interdependencies among all internal and external systems. In addition, it
does not include the detail necessary to identify the critical path that
would establish the sequence in which tasks must be completed to ensure
that this complex undertaking can be finished on time. Such a critical
path remains an essential tool that HCFA needs to have to manage risks. 

HCFA Needs to Monitor Recertification Test Execution by Contractors and
Address Y2K Errors Expeditiously
---------------------------------------------------------------------------

In addition to the challenge posed by the many system interdependencies,
HCFA is making progress in the individual recertification testing of each
of the six standard systems and the CWF; however, this progress is uneven.
For example, the MCS standard system contractor has executed 6,509 of its
planned 6,734 recertification test scripts (97 percent), while the CWF
contractor has only executed 55,606 of its 112,418 planned test scripts 
(49 percent). Figure 1 shows the number of test scripts for each of the
six standard systems planned to be completed by October 8, and those
actually completed as of August 31, 1999./Footnote14/ 

Figure****Helvetica:x11****1:    Recertification Test Scripts Planned and
                                 Reported Executed for the Six Standard
                                 Systems as of August 31, 1999

*****************

*****************

Note: The six standard systems consists of two Part A systems--Arkansas
Part A Standard System (APASS) and Fiscal Intermediaries Standard System
(FISS)--and four Part B systems--GTE Medicare System (GTEMS), Medicare
Claims System (MCS), United Healthcare (UHC), and VIPS Medicare System
(VMS).

Source: HCFA.

The executed test scripts as of August 31, 1999, for the six standard
systems and the CWF have uncovered Y2K errors, as shown in table 1. 

Table****Helvetica:x11****1:    Reported Failed Test Scripts for the Six
                                Standard Systems and the CWF as of August
                                31, 1999

----------------------------------------------------------------------------
|             :   APASS :  FISS :   GTEMS :   MCS :   UHC :   VMS :   CWF  |
|--------------------------------------------------------------------------|
| Priority 1,2:       3 :     0 :       0 :     0 :    12 :     4 :     0  |
|--------------------------------------------------------------------------|
| Priority    :       3 :     3 :       1 :    28 :   127 :     1 : 3,236  |
| 3,4,5       :         :       :         :       :       :       :        |
----------------------------------------------------------------------------

Source: HCFA.

As defined by HCFA, the priority 1 and 2 failures represent errors that
would result in Y2K failures of the system. The priority 3, 4, and 5
errors represent lesser impacts, such as those for which there are either
alternative workarounds, those that do not affect a required mission
capability, or those that were reported as operator errors that need to be
retested. Because of the significance of the priority 1 and 2 failures,
these not only require correction, but the systems changes to address them
need to be retested to ensure that these changes do not introduce
additional errors. Since the final recertification tests will ultimately
determine whether HCFA's mission-critical systems are Y2K compliant, it is
essential that HCFA and its IV&V contractor closely monitor test execution
and the resolution of these errors. 

HCFA Needs to Assess Y2K Renovation Quality and Test Coverage Using
Automated Tools
---------------------------------------------------------------------------

As an additional mechanism to ensure that mission-critical systems are
free of Y2K errors and that ongoing recertification testing is adequate,
HCFA is using Y2K analysis tools on each of the six standard systems and
the CWF. These tools are to determine (1) the Y2K readiness of the
software code (i.e., Y2K renovation quality) and (2) the adequacy of test
coverage. 

Preliminary results of the Y2K renovation quality tool reveal Y2K errors
in the code. This tool identifies potential Y2K errors in three categories--
(1) Y2K noncompliant errors, (2) suspect errors that may have a Y2K
impact, and (3) warnings that have the potential for Y2K problems--that
must be further analyzed to determine if indeed they are Y2K problems. For
example, the FISS standard system had 775 noncompliant findings and 100
warnings identified by the renovation quality tool; but, according to HCFA
officials, an analysis of the 875 potential problems found 49 actual Y2K
problems, 2 of which required renovation. In addition, HCFA officials told
us on September 24, 1999, that seven updates to the VMS standard system
have already occurred to address Y2K problems uncovered by the renovation
quality tool. Figure 2 presents the preliminary results of executing the
renovation quality tool for the six standard systems and the CWF. 

Figure****Helvetica:x11****2:    Preliminary Results of the Renovation
                                 Quality Tool for the Six Standard Systems
                                 and the CWF

*****************

*****************

Source: HCFA.

Until this analysis is complete, the extent of programming errors that
must be renovated and retested is unknown. Additionally, the utility of
this tool is minimized if the analysis of the results is not completed
quickly and any necessary changes are not incorporated into the
recertification testing program. On September 24, 1999, HCFA officials
told us that they have established an October 1, 1999, deadline for
completing this analysis. 

Turning to the test coverage tools, results reveal some systems with low
test coverage. HCFA uses two Y2K tools that assess test coverage by
identifying the total number of date references tested./Footnote15/ The
results of these tools are analyzed, and inadequate test coverage results
are remedied by

adding test cases. Figure 3 shows the percentage of the date references
tested for each of the standard systems and the CWF./Footnote16/ 

Figure****Helvetica:x11****3:    Date References Tested for the Six
                                 Standard Systems and the CWF

*****************

*****************

Source: HCFA.

Of particular concern are the lower percentages for the GTEMS and, most
important, the CWF, which is the heart of the Medicare Claims Processing
System. To its credit, HCFA is asking these standard system contractors to
improve their test coverage by adding test cases to the ongoing
recertification tests. However, HCFA has limited time to plan, execute,
and analyze the results of additional test cases. Therefore, it should
establish a deadline to accomplish each of these activities. 

HCFA Needs to Expedite Contractor Transitions to New Data Centers 
------------------------------------------------------------------

The recertification testing for 6 of the 68 contractors has recently been
delayed due to the recent departure of a data center/Footnote17/ that had
been providing service to these 6 contractors. These six contractors now
have to be transferred to other data centers. Because these six
transitions are scheduled to occur from mid-September through early
November, these contractors will not be able to complete their
recertification testing by November 1. The six contractors intend to
complete the recertification testing by December 1, covering the two most
immediate planned HCFA testing dates rather than all of the required four
future date recertification tests./Footnote18/ HCFA needs to expedite the
transitions to these new data centers and recertification testing
associated with these six contractors because of the limited time
available to address any schedule delays or problems identified in the
recertification testing.

HCFA Needs to Minimize System Changes Through March 31, 2000
------------------------------------------------------------

As noted in our January 1999 testimony, changes made to systems after they
have been certified as Y2K compliant can introduce new Y2K
problems./Footnote19/ To address this risk, we suggested that OMB consider
directing agencies to adopt a strong change management policy-one that
limits new software and systems changes. 

In response to our suggestion, in May, OMB issued a memorandum to federal
department heads stating the importance of considering the potential
effect of changes to information technology systems on Y2K readiness, and
urging agency heads to adopt a policy that only allows system changes
where absolutely necessary. OMB also requested that agency heads summarize
in their quarterly Y2K progress reports how they would implement such
guidance. 

HCFA has acted to implement OMB's request. Specifically, HCFA reported on
June 3, 1999, that it implemented controls to minimize system changes
after July 1. In addition, HHS reported in its August 1999 quarterly
report to OMB that HCFA's formal moratorium that halts systems changes to
Y2K-certified systems is October 1, 1999, through March 31, 2000. HHS'
quarterly report also states that exceptions to the moratorium may be
allowed through a strict approval process. Such an exception is HCFA's
planned October 1999 and January 2000 provider payment updates. In April,
we reported that these updates contribute to HCFA's already monumental
testing challenge. However, HCFA officials told us that these updates are
minor and that they do not expect them to impede the recertification
testing program. 

Other Critical Risks and Challenges Remain

In addition to the challenges associated with its recertification testing,
HCFA must also address three other critical areas. First, contractor
progress in testing with providers has been limited. Second, many MCOs
have outstanding issues to address in order to become Y2K compliant.
Finally, HCFA needs to complete and validate internal, contractor, and MCO
business continuity and contingency plans. 

HCFA Needs to Monitor Provider Testing With Contractors
-------------------------------------------------------

In addition to individual systems testing, HCFA must also test its systems
end-to-end to verify that defined sets of interrelated systems, which
collectively support an organizational core business function, will work
as intended. Since providers submit Medicare claims through claims
processing contractors, HCFA has tasked these contractors to future date
test with their respective providers and encouraged providers to take
advantage of the opportunity to future date test with contractors. In
March 1999, HCFA required all Medicare contractors to establish test
environments that would allow Medicare claims from providers and
submitters/Footnote20/ to be validated in a future date environment. In
May 1999, HCFA further defined this requirement by establishing a goal for
contractors to future date test with providers that represent at least 
50 percent of the annual claims volume. 

In July, we reported that contractor testing with providers/submitters had
been limited and testing that had occurred had identified
problems./Footnote21/ Specifically, as of June 21, 1999, 38 of 68
contractors had not initiated any testing with their respective providers.
Of the remaining 30, only 1 had tested with more than 1 percent of its
respective providers. We also reported that according to HCFA's web site,
the one Medicare contractor that completed substantial testing of 434
providers encountered initial problems with 123 (28 percent); 9 of these
were critical failures that produced dates of 1900 and 1901 during the
testing process. We also reported that contractor/provider testing only
identifies problems with data exchanges. Accordingly, it does not address
whether providers' systems that process Medicare claims are Y2K compliant.

HCFA's latest information on contractor/provider testing continues to be
discouraging. As of September 21, 1999, HCFA's data showed that of 75
contractors, 69 have initiated testing with their respective
providers./Footnote22/ However, HCFA reports that 40 of the 69 contractors
have tested with less than 1 percent of their providers. Table 2 shows the
percentage of providers that have future date tested with each of the 69
contractors.

Table****Helvetica:x11****2:    Contractor/Provider Testing Status as of
                                September 21, 1999

-----------------------------------------------------------------------
| Number of contractors              : Providers that have tested     |
|                                    : with contractors               |
|---------------------------------------------------------------------|
| 40                                 : Less than 1 %                  |
|---------------------------------------------------------------------|
| 22                                 : 1 to 4 %                       |
|---------------------------------------------------------------------|
| 6                                  : 6 to 12 %                      |
|---------------------------------------------------------------------|
| 1                                  : 100 %                          |
|---------------------------------------------------------------------|
| Total  69                          :                                |
-----------------------------------------------------------------------

Source: HCFA.

HCFA also continues to report that Y2K failures are occurring during
provider/contractor testing. On September 22, HCFA's chief information
officer reported that 10 to 20 percent of the providers/submitters who
have tested with contractors have experienced failures due to incorrect
claim dates. These failures were attributed to provider hardware and
software problems. Concerning HCFA's goal to test with
providers/submitters who represent 50 percent of their total claims
volume, HCFA reports that only nine contractors have met this goal as of
September 20, 1999. 

HCFA and the President's Council on Year 2000 Conversion also have
concerns about providers' Y2K readiness. HCFA officials told us that
despite their outreach efforts to the provider community, providers are
reluctant to test with Medicare contractors. The President's Council on
Year 2000 Conversion, established in February 1998 to, among other things,
increase awareness of and gain cooperation in addressing the Y2K problem
in various economic sectors, also recently highlighted concerns about the
compliance status of health care provider recordkeeping and billing
systems. Last month, the Council reported that Y2K failures in these
billing and recordkeeping systems, if not promptly addressed, could
interfere with normal payment processes and force smaller, cash-strapped
providers to suspend operations./Footnote23/

Until these data exchanges between providers and contractors are future
date tested, the ability of these entities to process Medicare claims in a
future date environment is unknown. Therefore, it is essential that HCFA
continue to monitor and publicize provider testing with contractors and
establish milestones for contractors to test with providers. 

HCFA Needs to Ensure That Managed Care Organizations Are Y2K Compliant
----------------------------------------------------------------------

In addition to fee-for-service contractors, 6.9 million of Medicare's 
39 million beneficiaries are currently enrolled in 383 MCOs. In January
1999, HCFA required that by April 15, 1999, the MCOs certify their systems
as Y2K compliant. In April, we testified that HCFA had received
certifications from 315 MCOs and that, similar to the claims processing
contractors, 271 of the 315 contained qualifications
(exceptions)./Footnote24/

HCFA's most recent data on these certifications continue to be of concern.
HCFA had received certifications from 425 MCOs,/Footnote25/ and reported
that as of June 1999, 365 of the 425 certification statements contained
qualifications (86 percent) and that only 4 were Y2K compliant. The
President's Council on Year 2000 Conversion also recently highlighted
concerns about the Y2K readiness of MCOs. The Council reported in August
that serious concerns exist with MCOs that either started late in
addressing the problem or have yet to take significant steps toward
achieving full Y2K readiness./Footnote26/

To focus the limited remaining time on the higher risk MCOs, HCFA, with
assistance from a contractor, performed a risk assessment of each of the
425 MCOs using the certification statements and the associated
qualifications, along with other criteria./Footnote27/ HCFA's June 1999
risk assessment concluded that 

o 94 MCOs are high risk (22 percent),

o   314 MCOs are medium risk (74 percent), and

o   17 MCOs are low risk (4 percent).

To ensure that reported qualifications are being addressed and that these
MCOs are adequately addressing their Y2K challenges, HCFA is conducting
site visits covering 184 MCOs, which include the 94 high-risk MCOs.
According to HCFA, the 184 serve about 90 percent of the 6.9 million MCO
Medicare beneficiary population. HCFA officials told us that they are
using the self-reported results of a Medicare Y2K survey by the HHS Office
of the Inspector General to follow up on the status of the MCOs not
covered in the site visits. The Inspector General survey results are
expected to be released by the end of this month.

Although HCFA's "risk-approach" to determining the Y2K status of MCOs has
been useful, it is essential that HCFA now focus on the resolution of
reported qualifications and whether each of the MCOs is Y2K compliant. On
January 25, 1999, HCFA instructed MCOs that a formal recertification would
be required later in 1999; however, HCFA officials now tell us they have
decided that a formal recertification will not be required. Without such a
recertification, risks are enhanced that MCOs will experience Y2K-related
disruptions. Accordingly, we believe that HCFA should reconsider this
decision. As part of our ongoing work for the Senate Special Committee on
Aging, we plan to review the resolution of the qualifications associated
with MCO certifications and HCFA's follow-up actions to determine whether
each MCO is Y2K compliant.

HCFA Needs to Complete and Validate Internal, Contractor, and MCO Business
Continuity and Contingency Plans
---------------------------------------------------------------------------

Given the magnitude of the many challenges that HCFA continues to face,
the development of BCCPs to ensure continuity of critical operations and
business processes is essential. HCFA continues to make steady progress on
its agencywide and 29 internal BCCPs; however, the status of contractor
plans is unknown, and the results of HCFA's initial review of MCO plans
are not promising. 

HCFA has completed its agencywide BCCP that includes 29 internal plans;
however, essential validation activities remain. As of September 2, 1999,
HCFA reported that it had procedurally validated 25 of these 29
plans./Footnote28/ Of the remaining four plans, it plans to procedurally
validate three of them. The remaining BCCP-Medicare contractor management-
does not require validation because it is currently being used to guide
contractor transitions, according to agency officials. In addition to the
procedural validations, HCFA reports that 11 of the internal plans require
additional validation through extensive simulation and/or operational
reviews./Footnote29/ It is unclear when these more detailed validations
will be completed since HCFA has missed its latest milestone of August 30,
1999, to validate BCCPs and has not yet established a new deadline. Such
validation activities are essential to ensuring that BCCPs can be executed
in the event of Y2K-induced failures.

The status of Medicare contractor BCCPs is unknown. In May 1999, HCFA
reviewed 77/Footnote30/ contractor plans and concluded that 17 of these
required major improvement. However, HCFA's BCCP technical support
contractor stated that not all Medicare contractors have specified
detailed procedures that are required for executing and testing BCCPs. Our
assessment of these plans is consistent with the technical support
contractor-HCFA does not yet have the detailed plans from most contractors. 

To address this situation, HCFA issued a memorandum on August 6, 1999,
instructing Medicare contractors to have detailed BCCPs available for
HCFA's review by September 30. HCFA plans to review these at each of the
contractor's site using agency Y2K contractor oversight teams. To prepare
these teams for this review, HCFA's technical assistance contractor
recently provided training to them, along with checklists, that will be
used to assess the adequacy of Medicare contractor BCCPs. On September 24,
1999, HCFA officials told us that these assessments are to be completed by
October 30, 1999. We remain concerned about the late completion dates
associated with these plans and whether there will be sufficient time
remaining to test them. 

The status of MCO BCCPs is likewise not encouraging. HCFA required MCOs
participating in the Medicare program to submit their plans to HCFA by
July 15, 1999. As of September 2, 1999, HCFA had received BCCPs covering
310 of the 383 MCOs. HCFA's review of these 310 concluded that 69 percent
of them need major improvement, 18 percent need minor improvement, and 13
percent were reasonable. 

HCFA has been active in following up on the MCO BCCPs. For example, it
mailed letters to each of the 73 that have not yet submitted plans. In
addition, it sent letters to those MCOs with plan deficiencies and has
requested that those plans in the "needs major improvement" category be
resubmitted by September 28. In addition, HCFA has held three workshops-in
Los Angeles, Denver, and Atlanta-to assist MCOs in developing BCCPs. HCFA
officials told us they have requested that the MCOs validate their plans
by the end of November, but they could not provide documentation to us to
substantiate this request. 

Limited time remains to complete and validate all BCCPs. Therefore, it is
essential that HCFA sustain its efforts to validate all internal plans and
closely monitor the completion and validation of contractor and MCO plans.

In summary, HCFA and its contractors have made progress in addressing
Medicare Y2K issues. However, until HCFA completes the ongoing
recertification tests, the final status of the agency's Y2K compliance
will remain unknown. Limited time remains to completely test all systems
that process Medicare claims for Y2K compliance (internal, fee-for-service
contractor, MCO, and provider). Nevertheless, HCFA must sustain its
efforts, because any progress made in testing these many systems lowers
the risk of disruptions to Medicare and the claims payment process. HCFA
must also continue to closely monitor contractor testing with providers
that to date has been limited but has uncovered Y2K problems. In addition,
HCFA needs to continue its efforts to ensure that MCOs are adequately
addressing their Y2K challenges. Given the considerable amount of work
that remains in the next few months, it is crucial that the development
and testing of internal, contractor, and MCO BCCPs move forward rapidly to
ensure that no matter what, providers will be paid and beneficiaries will
receive care. This concludes my statement, and I would be pleased to
respond to any questions at this time.

Contact and Acknowledgments

For information about this testimony, please contact Joel Willemssen at
(202) 512-6253 or by e-mail at [email protected]. Individuals
making key contributions to this testimony included Dr. Nabajyoti
Barkakati, Christina Bower, Mary Dorsey, Dr. Robert Norris, and Dave
Powner. 

(511797)

--------------------------------------
/Footnote1/-^Medicare Transaction System: Success Depends Upon Correcting
  Critical Managerial and Technical Weaknesses (GAO/AIMD-97-78, May 16,
  1997).
/Footnote2/-^(GAO/T-AIMD-99-160, April 27, 1999).
/Footnote3/-^GAO/AIMD-97-78, May 16, 1997.
/Footnote4/-^Medicare Computer Systems: Year 2000 Challenges Put Benefits
  and Services in Jeopardy (GAO/AIMD-98-284, September 28, 1998).
/Footnote5/-^Year 2000 Computing Crisis: Readiness Status of the
  Department of Health and Human Services (GAO/T-AIMD-99-92, February 26,
  1999). 
/Footnote6/-^GAO/T-AIMD-99-160, April 27, 1999.
/Footnote7/-^Part A claims are those submitted by hospitals, skilled
  nursing facilities, hospices, home health agencies, and rehabilitation
  agencies. Part B claims are those submitted by physicians, laboratories,
  durable medical equipment suppliers, outpatient providers, and other
  practitioners.
/Footnote8/-^From February 2, 1999, through September 22, 1999, HCFA
  issued 19 updates to its recertification instructions to more clearly
  define its testing procedures.
/Footnote9/-^GAO/T-AIMD-99-160, April 27, 1999.
/Footnote10/-^A test case is a series of test scripts that identifies each
  testable condition of a system (including valid and invalid conditions),
  the associated inputs, and the expected results. 
/Footnote11/-^Year 2000 Computing Crisis: Status of Medicare Providers
  Unknown (GAO/AIMD-99-243, July 28, 1999).
/Footnote12/-^GAO/AIMD-98-284, September 28, 1998.
/Footnote13/-^On September 24, 1999, HCFA officials told us that since the
  recertification testing began, the CWF has been changed three times and
  that each of the standard systems has also been changed.
/Footnote14/-^In obtaining comments on a draft of this testimony, HCFA
  officials told us that they provided us with incorrect information on
  the number of CWF planned recertification test scripts as of August 31,
  1999. They added that the correct number is 15,002 and that as of
  September 24, 1999, 14,877 of these had been executed. They also
  provided updated information on planned and executed test scripts for
  the six standard systems. We did not present this updated information
  since HCFA officials were unable to provide supporting documentation and
  were unable to provide the number of failures associated with these
  executed test scripts. 
/Footnote15/-^Date references are the actual dates in the computer system.
/Footnote16/-^Due to time constraints, HCFA is not running the test
  coverage tool on all code associated with the six standard systems and
  the CWF. Rather, according to HCFA officials, it has decided to run the
  tool on just the eligibility and claims processing portions of these
  systems, since these are the critical software components for processing
  Medicare claims.
/Footnote17/-^HCFA has 23 data centers-large claims processing operations
  that operate one or more of the standard systems for one or more of the
  68 contractors. A data center may also be a host site for the CWF.
/Footnote18/-^HCFA's recertification is to test four future dates-
  12/31/1999 rollover to 1/4/2000, 2/27/2000 rollover to 3/2/2000,
  9/30/2000, and 12/30/2000 rollover to 1/2/2001. 
/Footnote19/-^Year 2000 Computing Crisis: Readiness Improving, But Much
  Work Remains to Avoid Major Disruptions (GAO/T-AIMD-99-50, January 20,
  1999).
/Footnote20/-^Submitters are third-party billers or clearinghouses that
  bill for providers.
/Footnote21/-^GAO/AIMD-99-243, July 28, 1999.
/Footnote22/-^HCFA's most recent data on contractor/provider testing lists
  75 instead of 68 claims processing contractors, because HCFA tracks this
  testing by identification number and some contractors have been assigned
  more than one identification number.
/Footnote23/-^The President's Council on Year 2000 Conversion: Third
  Summary of Assessment Information, August 5, 1999.
/Footnote24/-^GAO/T-AIMD-99-160, April 27, 1999.
/Footnote25/-^Since July 1999, the number of MCOs decreased from 425 to
  383 because 52 left the Medicare program while 10 new MCOs joined.
/Footnote26/-^The President's Council on Year 2000 Conversion: Third
  Summary of Assessment Information, August 5, 1999.
/Footnote27/-^The other criteria were size, tax status, corporate
  experience, sole MCO in region, data exchanges, Y2K risk assessment,
  contingency planning, independent verification and validation,
  monitoring of results, centralized management, delegation, stability,
  and system compliance. 
/Footnote28/-^According to HCFA, procedural validation consists of
  emergency response team members reviewing the BCCP to confirm basic
  procedures and discussing responsibilities for different failure
  scenarios to ensure adequate staffing. 
/Footnote29/-^According to HCFA, simulation consists of emergency response
  team role-playing from alternate facilities with minimal test scripts,
  while operational validation is used to evaluate the most complex and
  critical BCCPs under full or partial operating conditions using detailed
  scripts. 
/Footnote30/-^Some contractors submitted more than one BCCP. 

*** End of document. ***