Department of Health and Human Services 
OFFICE OF 
INSPECTOR GENERAL 
Y2K READINESS OF MANAGED CARE 
ORGANIZATIONS 
JUNE GIBBS BROWN 
Inspector General 
MAY 1999 
OEI-05-98-00590  OFFICE OF INSPECTOR GENERAL 
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, is to 
protect the integrity of the Department of Health and Human Services programs as well as the 
health and welfare of beneficiaries served by them.  This statutory mission is carried out through a 
nationwide program of audits, investigations, inspections, sanctions, and fraud alerts.  The 
Inspector General informs the Secretary of program and management problems and recommends 
legislative, regulatory, and operational approaches to correct them. 
Office of Evaluation and Inspections 
The Office of Evaluation and Inspections (OEI) is one of several components of the Office of 
Inspector General.  It conducts short-term management and program evaluations (called 
inspections) that focus on issues of concern to the Department, the Congress, and the public.  The 
inspection reports provide findings and recommendations on the efficiency, vulnerability, and 
effectiveness of departmental programs. 
OEI's Chicago office prepared this report under the direction of William C. Moran, Regional 
Inspector General and Natalie Coen, Deputy Regional Inspector General.  Principal OEI staff 
included: 
REGION  HEADQUARTERS 
Thomas F. Komaniecki, Project Leader  Stuart Wright, Program Specialist 
Suzanne Johnson  Barbara Tedesco 
Brian Ritchie 
To obtain copies of this report, please call the Chicago Regional Office at (312)353-4124. 
Reports are also available on the World Wide Web at our home page address: 
http://www.dhhs.gov/progorg/oei  E X E C U T I V E   S U M M A R Y  
PURPOSE 
To examine the Year 2000 readiness of Medicare + Choice managed care organizations 
and provide information for the Health Care Financing Administration. 
BACKGROUND 
The Year 2000 (Y2K) problem stems from the way computers have traditionally stored 
dates through the use of an implied century.  To save memory and storage space, 
programmers have conventionally used only two digits, rather than four, in year date 
fields.  The Health Care Financing Administration (HCFA) has made the Y2K initiative its 
number one priority and is committed to making sure that its date-sensitive systems and 
those of its business partners are ready to verify eligibility, enrollment, coverage and 
payment. 
Some of the key computer systems at risk among healthcare providers that could affect 
the 6.5 million Medicare beneficiaries enrolled in managed care are:  premium billing 
systems, medical information systems, and managed care membership enrollment and 
disenrollment systems.  Failure of these systems to correctly process data could negatively 
impact beneficiary access to care, service delivery, efficient Medicare reimbursement and 
quality of care. 
We sent surveys to 407 Medicare Managed Care Organization (MCO) contracts in 
January and February of 1999.  We received 219 surveys, representing 310 MCO 
contracts, for a response rate of 76 percent. 
FINDINGS 
Managed Care Organizations appear to be moving toward internal Y2K 
compliance 
Currently, 22 percent of MCOs claim being Y2K ready.  Of the 78 percent of MCOs that 
are currently not Y2K ready, nearly two-thirds report that all of their computer systems 
will be Y2K ready by December 31, 1999.  Almost all MCOs have assessed their Y2K 
readiness with over half having tested more than two-thirds of their computer systems, 
although development and testing of contingency plans is lagging. 
Most MCOs are unaware of their business partners Y2K readiness 
The majority of MCO respondents have discussed the possible millennium risks with their 
medical providers and subcontractors.  It appears that these discussions may have been 
largely information sharing since most MCOs report that they are unsure of the Y2K 
Y2K Readiness of MCOs  1  OEI-05-98-00590  readiness of their medical providers and subcontractors.  Less than one-quarter of MCOs 
report testing data exchanges with two-third or more of their medical providers and 
subcontractors. 
Differences in Y2K readiness, assessment and testing exist based on tax status 
and size of MCOs 
Currently, 22 percent of all MCO respondents claim to be Y2K ready.  However, when 
the tax status of the MCO is taken into consideration, 26 percent of for-profit MCOs 
claim to be Y2K compliant compared to 16 percent of not-for-profit.  In addition, more 
large size plans are Y2K compliant compared to small and medium size plans.  Also, more 
large and for-profit MCOs have assessed 100 percent of their systems for Y2K readiness. 
Agency Comments 
We received comments from the Health Care Financing Administration.  Their comments 
are included in Appendix D.  The HCFA is conducting an outreach effort to address the 
preparedness of MCOs and is monitoring the MCOs business continuity and contingency 
planning efforts.  As part of this monitoring, HCFA is directing MCOs to submit their 
contingency plans to HCFA by July 15, 1999.  The HCFA has also awarded a contract to 
an Independent Verification and Validation firm to provide assistance in conducting on-
site visits to numerous MCOs to assess their Y2K readiness. 
Y2K Readiness of MCOs  2  OEI-05-98-00590  T A B L E   O F   C O N T E N T S  
PAGE

EXECUTIVE SUMMARY  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  1

INTRODUCTION  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  4

FINDINGS

MCOs Internal Y2K Readiness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  9

MCOs Unaware of Business Partners Readiness . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  11

Difference Based on Tax Status and Size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  12

APPENDICES 
Non-Response Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  14

Glossary  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  17

Survey Responses  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  18

Agency Comments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  23

Y2K Readiness of MCOs  3  OEI-05-98-00590  I N T R O D U C T I O N  
PURPOSE 
To examine the Year 2000 readiness of Medicare + Choice managed care organizations 
and provide information for the Health Care Financing Administration. 
BACKGROUND 
The healthcare industry is a complex array of public and private enterprises with many 
interdependencies among various Federal, State and local governments and key partners. 
Partners that include, but are not limited to, managed care organizations, physicians, 
healthcare facilities, durable medical equipment suppliers, clinical laboratories, biomedical 
equipment and device manufacturers and sundry other support services. 
The problem stems from the way computers have traditionally stored dates through the 
use of an implied century.  To save memory and storage space, programmers have 
conventionally used only two digits, rather than four, in year date fields.  When the 
calendar flips over to January 1, 2000, many computer systems will recognize the year 
00" as 1900 and applications will either stop running or produce unpredictable results. 
Computer systems that are not Y2K compliant simply will not be able to recognize dates 
occurring after 1999 (e.g., 01" will be recognized as 1901 rather than 2001).  These 
computer systems will not be able to process date and time sensitive data from one 
century into another or between centuries. 
Some of the key computer systems at risk among healthcare providers that could affect 
the 6.5 million Medicare beneficiaries enrolled in managed care are:  premium billing 
systems, medical information systems, and managed care membership enrollment and 
disenrollment systems.  Failure of these systems to correctly process data could negatively 
impact beneficiary access to care, service delivery, efficient Medicare reimbursement and 
quality of care.  Also at risk for failure are medical devices and scientific laboratory 
equipment that have software applications or embedded chips using two-digit fields to 
represent the year.  Equipment failures, especially those that provide misinformation that 
goes undetected, could possibly lead to false diagnoses that harm beneficiaries and delay 
needed care. 
The General Accounting Offices (GAO) Year 2000 Computing Crisis:  An Assessment 
Guide purports that, for Federal agencies to meet the Y2K deadline, assessment should 
have been completed in mid-1997 and renovation work should be done by mid-1998 to 
allow sufficient time for validation and implementation. 
Though perhaps not as complex or problematic as government program systems, managed 
care organizations (MCOs) are considered especially vulnerable to Y2K problems due to 
the myriad business systems they operate.  These are systems that are crucial to the 
ongoing interface necessary to communicate with corporate and government payer 
Y2K Readiness of MCOs  4  OEI-05-98-00590  sources and accounts-payable balances with physicians, hospitals, and other medical and 
non-medical providers and subcontractors. 
Meeting the Y2K Challenge 
The Health Care Financing Administration (HCFA) has made the Y2K initiative its 
number one priority and is committed to making sure that its date-sensitive systems and 
those of its business partners are ready to verify eligibility, enrollment, coverage and 
payment.  The HCFA defines Y2K compliant as: 
...information technology that accurately processes date/time data 
(including, but not limited to, calculating, comparing, and 
sequencing) from, into, and between the nineteenth, twentieth and 
twenty-first centuries, and the years 1999 and 2000 and leap year 
calculations.  Furthermore, Year 2000 compliant information 
technology, when used in combination with other information 
technology, shall accurately process date/time data if the other 
information technology properly exchanges date/time data with it. 
Meeting the Y2K challenge requires identifying, renovating and testing all computer and

information systems to assure the transition from a six-digit date (12/31/99) to an eight-

digit date (12/31/1999) by January 1, 2000.  Some examples of critical dates include:

<  the date a beneficiary became eligible for Medicare, 

<  the date a patient was admitted or discharged from a hospital, 

<  the date a wheelchair rental began, and

<  the date an enrollee entered a Medicare managed care plan. 

A trouble-free transition into the new millennium is key to meeting the needs of Medicare

beneficiaries and providers.  At stake are efficient reimbursement and beneficiaries access

to, and the timeliness and quality of, health care.  The HCFA advises its contracting

MCOs to review the GAO Assessment Guide as an aid to becoming Y2K compliant.  The

HCFA advocates using the following five proactive steps to identify and address potential

impacts presented by the Year 2000 challenge: 

1.	 Awareness - inventory all hardware and software systems on the potential Y2K 
impact. 
2.	 Assessment - determine the Y2K readiness of these systems for operation beyond 
12/31/99. 
3.	 Renovation - update or replace systems and software programs as needed to 
ensure operations will be Y2K ready. 
4.	 Testing - test existing and newly purchased systems and software to verify they 
work. 
5.	 Contingency Planning - develop business contingency plans for operations 
beyond 12/31/99, just in case something goes wrong. 
Y2K Readiness of MCOs  5  OEI-05-98-00590  Managed Care Organizations Millennium Compliance Responsibilities 
Effective January 1, 1999, The Balanced Budget Act of 1997 established a new Medicare 
+ Choice program that expands the health insurance options available to Medicare 
beneficiaries.  The options now include an array of health plans and delivery systems 
beyond those that were previously available under the Medicare program.  These new 
choices will offer beneficiaries health plan options similar to those available to the non-
Medicare population. 
The HCFA has requested their Medicare + Choice managed care organizations to make 
Y2K compliance a top priority.  They have advised MCOs to assess the following business 
components: 
<  Applications (including cross-business applications and all external interfaces). 
<  Databases. 
<  Computer Infrastructure (including hardware, system software, 
telecommunications, and date dependent functions such as passwords, accounts 
and software licenses). 
<  Non-Information Technology Systems (including physical plant security, card entry 
systems, elevator systems, environmental control systems). 
In a Managed Care Millennium Compliance Letter dated September 17, 1998, HCFA 
delineates the following Year 2000 compliant responsibilities for their contracting MCOs: 
<	 Complying with the enrollment and payment data exchange processes requirements 
as outlined in HCFAs Operational Policy Letter 98.068.  (In essence, MCOs are 
to update all date/time fields in the record layouts of the Enrollment and 
Disenrollment Transaction and the Transaction Reply/Monthly Activity Report 
Data Format to record a four digit year.) 
<	 Clearly defining all internal and external systems and interfaces requiring 
compliance (membership systems, claims systems, medical record systems, 
pharmacy and lab systems, exchanges between delegated groups, etc.). 
<  Performing a thorough risk assessment. 
<  Identifying all involved parties and entities with whom data is exchanged and 
assuring that the defined requirements are clearly understood by these parties. 
<  Ensuring that providers, suppliers, and beneficiaries are aware of the Y2K 
compliant issues and problems that may arise. 
<	 Ongoing communications with trading partners with whom there is a data 
exchange to assure that they are taking the appropriate measures toward Y2K 
compliance. 
<  Developing implementation plans and testing schedules. 
<  Performing extensive testing. 
<  Developing an extensive contingency plan. 
In addition to the above responsibilities, HCFA will require MCOs to:  (1)  ...certify that 
they understand HCFAs Y2K compliant definition and have tested all of their data 
systems/interfaces to ensure Y2K compliance, and (2) ...have a contingency plan in 
place in the event that internal organization or key external business partner systems fail. 
Y2K Readiness of MCOs  6  OEI-05-98-00590  Other Office of Inspector General Work 
The Office of Inspector General (OIG) has also conducted surveys of hospitals, nursing 
homes, home health agencies, durable medical equipment suppliers and physicians to 
examine the Y2K readiness of these providers.  The results of these surveys can be found 
in an OIG report entitled Y2K Readiness of Medicare Providers, OEI-03-98-00250. 
METHODOLOGY 
The purpose of this inspection was to gather information from Medicare + Choice 
contractors regarding their Y2K preparedness.  We developed the survey instrument in 
cooperation with the Health Care Financing Administration, the Health Insurance 
Association of America and the America Association of Health Plans.  Based on 
discussions with HCFA and with the intent to achieve a higher response rate, the survey 
was anonymous with no tracking of respondents. 
We received from HCFA a list of 412 Medicare + Choice contracts that were in effect 
January 1, 1999.  Some organizations have multiple Medicare + Choice contracts with 
HCFA, we decided to send a survey for each contract.  After reviewing the information 
provided by HCFA, we determined that five contracts did not have complete address 
information.  We did not send a survey to these contracts. 
On December 28, 1998, we sent postcards to the 407 Medicare + Choice contractors 
alerting them that we would shortly be sending a survey on their Y2K preparedness.  On 
January 4, 1999,  we sent a survey along with a cover letter and a self-addressed, stamped 
envelop to 407 contractors.  We sent a follow-up postcard on January 19, 1999.  Another 
survey package was sent on February 8, 1999 to all Medicare + Choice contractors, 
except those contractors where the organization voluntarily identified themselves on a 
returned and completed survey. 
For those organizations that have multiple contracts with HCFA, we allowed them to 
respond once for the organization.  We asked all organizations to inform us about the 
number of contracts for which they were responding.  We received 219 surveys, 
representing 310 contracts, that were used in our analysis for a response rate of 76 
percent. 
In addition to those organizations that completed and returned our survey, five 
organizations responded with form letters regarding the Y2K readiness.  These five 
organizations represent 41 contracts.  We did not include their responses in our survey 
analysis.  We also received two letters back from organizations for other reasons.  Seven 
surveys were returned as having no forwarding address. 
Because of the anonymity of the survey, we were only able to conduct a limited non-
response analysis to determine if the responders were different than the non-responders. 
Through the survey, we identified the tax status of the contractors that responded.  We 
compared the response rate for not-for-profit and for-profit MCOs to the overall 
percentage of not-for-profit and for-profit MCO contracts.  We found no statistical 
evidence of bias based on the tax status of the contract.  For more information on our non-
Y2K Readiness of MCOs  7  OEI-05-98-00590  response analysis, please see Appendix A.  We have included as Appendix B a glossary of 
terms used in the report.  We have also included as Appendix C a copy of the 
questionnaire that we used along with the overall survey results. 
Scope 
We did not assess the data exchange between HCFA and the Medicare + Choice 
organizations.  We also did not examine issues that dealt with the potential impact of 
Y2K-related problems on Medicare beneficiaries access or quality of care.  The data 
analyzed in this report was furnished by MCOs and was not verified for accuracy. 
We conducted our review in accordance with the Quality Standards for Inspections issued 
by the Presidents Council on Integrity and Efficiency. 
Y2K Readiness of MCOs  8  OEI-05-98-00590  F I N D I N G S  
MCOs appear to be moving toward internal Y2K compliance 
Currently, 22 percent of MCOs report being Y2K ready 
Overall, 22 percent of MCOs claim that they are currently Y2K ready.  Yet, less than half 
of these MCOs have tested all of their computer systems to ensure that they accurately 
process time and dates.  In addition, only 72 percent of these MCOs report that they have 
completed assessing all of their computer systems for Y2K readiness.  Of the MCOs that 
report that they are currently Y2K compliant, 56 percent have contracted out for an 
independent verification and validation assessment of their computer systems Y2K 
readiness. 
Most MCOs report that all of their computer systems will be Y2K ready by 
December 31, 1999 
Of the 78 percent of MCOs who report that they are currently not Y2K ready, 65 percent 
claim that 100 percent of their computer systems will be Y2K compliant by December 31, 
1999;  another 34 percent of MCOs report that between 67 to 99 percent of their 
computer systems will be Y2K ready by December 31, 1999. 
Almost half (45%) of all our MCOs report that they have contracted with an outside 
organization to perform an independent verification and validation assessment of their 
Y2K readiness.  The HCFA strongly recommends MCOs follow this course of action to 
ensure Y2K compliance. 
Almost all MCOs have assessed their Y2K readiness 
Almost all (93%) MCO respondents report having taken the first step of identifying Year 
2000 risks and assessing the potential impact of these risks to their organizations. 
Elemental in this assessment is the prioritizing of mission-critical systems for Y2K 
conversion.  Nearly all (95%) of our MCO respondents have assessed more than two-
thirds of their computer systems, with 56 percent claiming to have assessed 100 percent of 
their computer systems for Y2K readiness. 
Managed care organizations may conduct such assessments in house or employ the 
services of an independent, external contractor.  Fifty-five percent of MCOs have engaged 
the services of an external contractor to assist them in their efforts to solve Y2K-related 
computer problems. 
An organizations awareness of Year 2000 issues is a contributing factor to the successful 
implementation of a Y2K compliant program.  Ninety-seven percent of our MCO 
respondents believe that their staff are aware of potential Y2K problems.  About half of 
the MCOs have trained staff, organization wide, to handle any problems associated with 
millennium issues. 
Y2K Readiness of MCOs  9  OEI-05-98-00590  Over half of MCOs have tested more than two-thirds of their computer systems 
To date, over 50 percent of MCO respondents have tested two-thirds or more of their 
computer systems to ensure that dates and time are accurately processed in the Year 2000. 
See Table 1 for MCO survey responses on their computer systems Y2K readiness. 
Table 1 
MCO INTERNAL COMPUTER SYSTEMS TESTING 
Survey Question  Response  Percent of Systems Tested 
0% 1-33%  34-66% 67-99% 100% Unsure 
Q 30. How many of your computer systems, including 
hardware and software, have you tested to ensure that 
N = 310  2%  14%  20%  49%  13%  2% 
they accurately process date and time data (e.g. 
calculating, comparing and sequencing) for the years 
1999 & 2000, and the leap year calculations? 
Q 31. How many of your computer systems, including 
hardware and software, have you tested to ensure that 
N = 310  11% 17%  17%  47%  5%  3% 
they accurately process date and time data (e.g. 
calculating, comparing and sequencing) from, into 
and between the nineteenth, twentieth and twenty-
first centuries? 
Q 32. How many of your computer systems, including 
hardware and software, have you tested for possible 
N = 308  5%  12%  16%  53%  6%  8% 
date discontinuity failures? 
Q 33. How many of your computer systems, including 
hardware and software, have you tested to ensure that 
N = 308  5%  12%  17%  44%  14%  8% 
end of file codes are not misinterpreted as dates (e.g. 
9999 as September 9, 1999 and 999,999,999 as 
September 8, 2001)? 
Source: OEI Survey 1999 
May not add to 100 percent due to rounding 
The GAO advises that system renovation efforts should be validated and tested to: 
(1) uncover errors introduced during renovation, (2) validate Y2K compliance, and 
(3) verify operational readiness.  Testing should account for application, database 
interdependencies and interfaces.  Without going through this verification process, 
assurances of Y2K compliancy are a coin toss. 
Contingency plans are lagging 
Contingency planning is an important aspect of a Year 2000 conversion program and one 
that HCFA and the GAO advise for mission-critical systems.  The GAO further advises 
that such plans should begin development in the assessment stage of a Y2K program, prior 
to the renovation and testing of computer systems.  On average, 64 percent of MCOs have 
thus far developed contingency plans related to potential Y2K problems.  See Table 2 for 
MCO survey responses on their Y2K contingency planning. 
Table 2 
Y2K Readiness of MCOs  10  OEI-05-98-00590  MCO INTERNAL SYSTEMS CONTINGENCY PLANS 
Survey Question  Number of  Response 
Respondents 
Yes  No  N/A  Unsure 
Have you developed a contingency strategy for 
dealing with potential Y2K-related problems 
associated with your: 
premium billing systems?  N = 298  71%  15%  5%  9% 
biomedical equipment or devices?  N = 303  41%  9%  41%  10% 
medical information systems?  N = 302  68%  13%  9%  10% 
membership enrollment & disenrollment systems?  N = 303  73%  14%  4%  10% 
member appeal & grievance systems?  N = 297  67%  16%  5%  12% 
telephone systems?  N = 284  67%  19%  3%  11% 
Source: OEI Survey 1999 
May not add to 100 percent due to rounding 
Forty-one percent of our respondents believed the development of contingency plans for 
biomedical equipment did not apply to them.  Another 41 percent believed the opposite 
and had developed contingency plans for Y2K problems that might occur involving 
biomedical equipment used by their medical providers or subcontractors. 
Testing contingency plans is vital to achieving a smooth transition into the new 
millennium.  As of January/February 1999, only 8 percent of MCOs had tested their 
contingency plans to verify they worked. 
Most MCOs are unaware of their business partners Y2K 
readiness 
Y2K discussions with medical providers and subcontractors appear to be limited 
to MCO information sharing 
In general, MCOs knowledge of the Y2K readiness of their medical providers and 
subcontractors is largely unknown.  We found that 81 percent of MCOs have discussed 
possible millennium risks with their medical providers and 89 percent have discussed these 
issues with their subcontractors. 
However, it appears that these discussions may have been largely information sharing by 
the managed care organizations, since 68 percent of MCOs report they are unsure of the 
current Y2K readiness of their medical providers computer systems.  Fifty-nine percent of 
MCOs report that they are unsure if their subcontractors computer systems are Y2K 
compliant. 
Y2K Readiness of MCOs  11  OEI-05-98-00590  In addition, 68 percent of MCOs are unsure if their medical providers have tested their 
biomedical equipment.  Seventy-five percent of MCOs are unsure whether their 
subcontractors have tested their biomedical equipment. 
Over half of MCOs have developed contingency plans to deal with potential Y2K 
failures associated with their medical providers and subcontractors 
Sixty-one percent of MCOs have developed contingency plans for dealing with Y2K-
related problems associated with their medical providers, while 65 percent developed 
contingency plans for subcontractor Y2K-related problems.  Managed care organizations 
have received limited assurances from their medical providers and subcontractors that they 
will be Y2K compliant by December 31, 1999.  Only 24 percent of MCOs had received 
such assurances from two-thirds or more of their medical providers that their systems 
would be Y2K ready.  Twenty-one percent of MCOs had received such assurances from 
two-thirds or more of their subcontractors. 
Less than one-quarter of MCOs have tested data exchanges with two-thirds or 
more of their medical providers and subcontractors 
Twenty-two percent of MCOs have tested data exchanges with two-thirds or more of 
their medical providers.  A similar percentage reports having tested data exchanges with 
two-thirds or more of their subcontractors. 
About three-fourths (73%) of MCOs will require their subcontractors to demonstrate that 
their systems are Y2K compliant.  On the other hand, only 30 percent of MCOs will 
require their medical providers to do so. 
Differences in Y2K readiness, assessment and testing exist 
based on tax status and size of MCOs 
More for-profit and large MCOs claim to be Y2K ready 
Overall, 22 percent of MCOs claimed that they were currently Y2K ready.  When we 
examined MCO responses based on their tax status, we found that 26 percent of for-profit 
MCOs claim that they are currently Y2K ready, while 16 percent of not-for-profits claim 
that they are Y2K ready. 
In addition, more large size plans (47%) are currently Y2K ready compared to small 
(20%) and medium (15%) size plans.  We considered large plans to be those with more 
than 50,000 Medicare enrollees, medium size plans to have Medicare enrollments between 
2,000 and 50,000, and small plans to have less than 2,000 Medicare enrollees. 
Y2K Readiness of MCOs  12  OEI-05-98-00590  More large and for-profit MCOs have assessed 100 percent of their computer 
systems 
Seventy-one percent of large MCOs have assessed 100 percent of their computer systems 
for Y2K readiness compared to 50 percent of medium MCOs and 64 percent of small 
MCOs.  In addition, 68 percent of for-profit MCOs have assessed all of their computer 
systems compared to 39 percent of not-for-profit MCOs. 
Fewer medium size MCOs have developed contingency plans for Y2K-related 
problems related to medical providers 
Overall, 61 percent of MCOs have developed contingency plans for dealing with Y2K-
related problems associated with their medical providers.  When we analyzed the MCOs 
response by the size of the MCOs, we found that 56 percent of medium size plans 
developed contingency plans for problems associated their medical providers compared to 
71 percent and 72 percent for large and small MCOs respectively. 
A similar situation exists as it relates to contingency plans developed for subcontractor 
Y2K-related problem.  Overall, 65 percent developed contingency plans for subcontractor 
Y2K-related problems compared to 59 percent of medium size plans. 
Agency Comments 
We received comments from the Health Care Financing Administration.  Their comments 
are included in Appendix D.  The HCFA is conducting an outreach effort to address the 
preparedness of MCOs and is monitoring the MCOs business continuity and contingency 
planning efforts.  As part of this monitoring, HCFA is directing MCOs to submit their 
contingency plans to HCFA by July 15, 1999.  The HCFA has also awarded a contract to 
an Independent Verification and Validation firm to provide assistance in conducting on-
site visits to numerous MCOs to assess their Y2K readiness. 
Y2K Readiness of MCOs  13  OEI-05-98-00590  APPENDIX A 
Non-Response Analysis

A consideration in survey analysis is that the results may be biased if non-respondents are 
significantly different from respondents.  To determine whether a difference exists in this 
survey, we compared the two groups, respondents and non-respondents by the tax status 
of their contracts.  Since tax status is a categorical variable (either for-profit or not-for-
profit), we tested for statistical significance using a chi-square with the appropriate 
degrees of freedom. 
Analysis by tax status 
We found that not-for-profit MCOs had a lower response rate (68%) compared to for-
profit MCOs (82%).  The computed chi-square test statistic (11.757) is statistically 
significant at the 99 percent confidence level.  This indicates a potential for bias in the 
results.  See Table 3 for response rate and test statistics. 
Table 3 
Comparison of Respondents By Tax Status 
Respondents  Non-respondents  Total  Percent 
Responding 
Number  Percent  Number  Percent  Number  Percent 
For-
Profit  188  61%  40  41%  228  56%  82% 
Not-For-
Profit  120  39%  57  59%  177  44%  68% 
Total  308  100%  97  100%  405  100%  76% 
Chi-square = 11.757  DF = 1 
To determine the effect of the relationship between response rate and tax status, we 
undertook an analysis of the non-respondents.  Assuming that non-respondents would 
have answered the same as respondents answered, we calculated a hypothetical global 
response to Questions 15, 25a, 28 and 35.  These questions ask about overall assessment, 
current Y2K readiness, computer systems assessment and anticipated Y2K readiness.  We 
found that the responses were within the confidence intervals for the original estimates. 
Therefore, no statistical evidence of bias based on tax status was shown. 
Y2K Readiness of MCOs  14  OEI-05-98-00590  APPENDIX A 
Non-Response Analysis

MCO letter responses to Y2K survey 
In addition to our non-response analysis, we received letters detailing Y2K efforts from 5 
managed care organizations, representing 41 plans.  The following is a summary of their 
reported Year 2000 readiness. 
MCO A:  This MCO began its Y2K assessment in 1998.  It anticipates that its internal 
systems will be Year 2000 compliant or contingency plans will be in place before 
December 1999.  The  MCO has sent a Y2K readiness questionnaire to its vendors and 
plans to track vendor responses. 
MCO B: This MCO began its Y2K assessment in 1995.  As of February 1999, the MCO 
reports that its internal inventory and assessment, including its biomedical equipment, is 
largely complete.  Remediation efforts are currently underway and hardware and 
operating system software is currently being tested.  The MCO is also investigating the 
Y2K readiness of its business partners and is seeking assurances of those partners Year 
2000 readiness. 
MCO C: This MCO plans to have all major information services and facility equipment 
and services Year 2000 compliant by August 1999.  The initial inventory of its information 
services and infrastructure is complete.  Project test plans are currently, as of January 
1999, being developed for its high risk enterprise-wide and department specific 
equipment and systems.  In addition, the MCO is currently in the process of contacting its 
business partners (e.g. vendors, suppliers, contractors, external agents) to determine their 
Y2K readiness. 
MCO D: This MCO reports that 98 percent of its internal systems remediation efforts 
were completed by December 31, 1998.  The MCO reports that most of its external file 
formats and underlying system logic has be modified to process 4 digit years and all of its 
systems meet HCFAs eight digit requirement.  As of January 1999, the MCO systems 
currently Y2K ready and processing proven are:  (1) automated eligibility systems, (2) 
medical and dental claims systems, (3) provider referral and pre-authorization systems, and 
(4) other critical managed care billing and payment systems.  The MCO also reports that 
its reimbursement accounts, pharmacy administration, managed dental care systems, and 
managed behavioral care systems are also Year 2000 compliant. 
The MCO plans to focus on integrated testing and external readiness issues in 1999.  It 
has completed internal unit, system and acceptance testing on all of its systems and is now 
in the process of conducting end-to-end testing of all systems.  Contingency and business 
resumption plans are currently being developed for key processes.  In addition, the MCO 
has retained the services of biomedical engineering firms to verify Y2K claims made by 
manufacturers of the biomedical equipment directly owned by the MCO.  Presently, the 
MCO is also conducting assessments of the potential Y2K problem impact from third-
Y2K Readiness of MCOs  15  OEI-05-98-00590  APPENDIX A 
Non-Response Analysis

party entities critical to its operations.  Critical vendor assessments and site visits, 
including alternative sourcing strategies are now being done.  The MCO is also in the 
process of testing key vendor computer systems interface. 
MCO E:  This MCO began its Year 2000 compliance efforts in 1996.  As of December 
1998, the MCO reports that 75 to 80 percent of its systems are currently Y2K ready.  The 
MCO expects to be 100 percent Y2K compliant by December 1999.  The MCO also 
expects to have completed its internal assessment by January 31, 1999 and its remediation 
efforts by March 31, 1999.  Contingency plans for critical business processes are expected 
to be completed by June 1999 and testing for Year 2000 compliancy has already begun. 
An inventory and assessment of the Y2K readiness of its vendor and counter party support 
(e.g. insurance, payroll, outside data processing) is also being conducted by the MCO. 
Letters of compliancy expectation have been sent to its business partners and the MCO 
plans to assess suppliers and vendors for their Y2K readiness. 
Y2K Readiness of MCOs  16  OEI-05-98-00590  APPENDIX B 
GLOSSARY

Y2K Ready:  MCOs, contracted medical providers and subcontractors computer 
systems that can compute and process dates after December 31, 1999. 
Medical Provider:	 Any individual or entity engaging in the delivery of health care services in a 
State who is licensed, certified or required by the State to engage in that 
activity in that State. 
Subcontractor:  A secondary contractor undertaking some or all of the obligations of 
(Vendor)	 another contract.  These obligations include, but are not limited to, tangible 
goods, professional services, technical support and functions delegated to 
other entities.  For example, DME vendors, home health agencies, 
hospitals, audit firms, billing companies, etc. 
Computer Systems:  Systems that relate to the following functions or areas: 
1.	 Continued access to quality medical care (including things like 
DME, appointment scheduling, pharmacy, etc.); 
2.  Financial stability; 
3.  Continued provider payments (contracted and non-contracted); 
4.	 Enrollment/eligibility administrative functions (e.g. appeals, 
grievances and encounter data collection); 
5.  Communications capabilities (e.g. telephone systems); 
6.  Quality assurance; and, 
7.	 Any other delegated or subcontracted good, services or 
relationship, that could cause a potential adverse impact to an 
enrollee. 
Date Discontinuity:	 Date discontinuity can occur when a computer systems internal time clock 
does not move forward in line with true time.  For example, such systems 
are equipped with a clock that calculates time from a fixed point by 
counting the number of clock ticks.  This fixed point is usually an arbitrary 
date set by the equipment manufacturer.  When enough clock ticks 
accumulate and register as full, the internal clock is reset, like a car 
odometer, to show zero.  This will be interpreted by the computer as the 
arbitrary date previously set by the manufacturer. 
End of File Codes:	 Software programers commonly designate certain numbers to indicate the 
end of a computer program file.  For example, 9999" and 00" are often 
used.  The computer will malfunction if it misinterprets these end of file 
codes to represent actual dates; in this case, September 9, 1999 and the 
year 2000. 
Y2K Readiness of MCOs  17  OEI-05-98-00590  APPENDIX C 
Medicare Managed Care Organization Year 2000 Survey 
Demographic/Background Information (Please circle the correct response or fill in the blank) 
1. 	 How would you describe your plan type?  (a) HMO,  (b) CMP,  (c) Other 
N= 307  83%  12%  5% 
2. 	 How would you describe your contract type?  (a) Cost,  (b) Risk,  (c) HCPP,  (d) Demonstration 
N= 307  11%  78%  2%  8% 
3. 	 How would you describe your organizational model? 
(a) Staff,  (b) IPA,  (c) Group,  (d) Mixed, (e) Other (please list): 
N= 306  3%  38%  12%  44%  2% 
4. 	 What is the tax status of your plan?  (a) Non-profit,  (b) For-profit 
N= 308  39%  61% 
5. 	 What types of enrollees do you serve? Circle all that apply 
(a) Commercial,  (b) Medicare,  (c) Medicaid,  (d) Other (please list): 
6. 	 What is the size of your enrollment for each population you serve? 
Medicare___________,  Medicaid____________,  Commercial___________,  Other_____________ 
7.  What is the total number of members you serve? _____________________ 
8.  Where are the majority of your members located? (a) urban areas,  (b) rural areas,  (c) suburban areas,  (d) Mix of 
areas 
N= 303  20%  2%  3%  76% 
9. 	 Do you contract with Medicare on a national scale? _____ Yes  No _____ 
N= 310  34%  66% 
10. What geographic HCFA region, or regions, does your plan service? 
11. 	Does your organization delegate claims or any other functions to providers or third-party administrators? 
____Yes No____ 
N= 310  61%  39% 
12. Have you engaged the services of an outside/external contractor to assist in your efforts to solve Y2K-related 
computer problems?  _____Yes  No _____ 
N= 310  55%  45% 
13. 	If you answered Yes to either Q11 or Q12, have you obtained assistance from that entity in completing this survey? 
_____Yes  No _____ 
N= 252  10%  90% 
14. Concerning this survey, for how many H#s are you responding? ________________________ 
Y2K Readiness of MCOs  18  OEI-05-98-00590  APPENDIX C 
Medicare Managed Care Organization Year 2000 Survey 
Awareness/Contingency Planning  Yes  No  N/A Unsure 
15. 	Have you identified the Y2K risks facing your business operations and assessed the potential impact 
and probability of occurrence of each of these risks?  I I   O 
N= 303  93%  2%  0%  4% 
16. 	Are your staff, organization wide, aware of potential Y2K problems?  I I   O 
N= 305  97%  1%  1%  2% 
17. 	Have your staff, organization wide, been trained to handle potential Y2K problems?  I I   O 
N= 302  51%  41%  2%  6% 
18. 	Have you discussed Y2K issues with your medical providers?  I I   O 
N= 309  81%  14%  1%  4% 
19. 	Have you discussed Y2K issues with your subcontractors?  I I   O 
N= 309  89%  5%  4%  2% 
20. Are you facing the following constraints or obstacles in identifying or fixing potential Y2K problems: 
a: lack of financial resources?	 I I   O 
N= 308  3%  96%  0%  0% 
b: lack of skilled personnel?	 I I   O 
N= 309  7%  93% 0%  0% 
c: lack of subcontractor cooperation?	 I I   O 
N= 308  3%  85% 3%  9% 
d: lack of medical provider cooperation?	 I I   O 
N= 309  3%  77% 3%  17% 
21. 	Are your medical providers and subcontractors (e.g. hospitals, physicians, chemistry and 
imaging service providers) hesitant to share their Y2K test information due to: 
a. 	 fear of legal liability and litigation from patients, vendors and others?  I I   O 
N= 280  19% 34% 4%  43% 
b. 	 concerns over patient loss of confidence?  I I   O 
N= 279  3%  35% 4%  58% 
c. 	 concerns over investor loss of confidence?  I I   O 
N= 279  3%  35% 4%  58% 
d. 	 fear of interference and oversight from regulatory agencies?  I I   O 
N= 278  4%  35% 4%  57% 
Y2K Readiness of MCOs  19  OEI-05-98-00590  APPENDIX C 
Medicare Managed Care Organization Year 2000 Survey 
Yes  No  N/A Unsure 
22. 	Have you developed a contingency strategy for dealing with potential Y2K-related problems 
associated with your: 
a: premium billing systems?  I I   O 
N= 298  70%  15%  5%  9% 
b: biomedical equipment or devices?	 I I   O 
N= 303  41%  9%  41%  10% 
c: medical information systems (e.g. patient files, utilization)?	 I I   O 
N= 302  68% 13%  9%  10% 
d: membership enrollment/disenrollment systems?	 I I   O 
N= 303  73% 14%  4%  10% 
e: member appeal/grievance systems?	 I I   O 
N= 297  67% 16%  5%  12% 
f: 	medical providers?  I I   O 
N= 298  61%  19%  5%  15% 
g: subcontractors?	 I I   O 
N= 299  65%  14%  9%  12% 
h: telephone systems?	 I I   O 
N= 300  67%  19%  3%  11% 
23a.Have you tested your contingency plans?  I I   O 
N= 300  8%  77%  2%  12% 
23b. If you have not tested your contingency plans, when will they be tested? ____________________ 
24. Have you contracted with an outside organization for an independent verification and validation 
assessment of your organizations Y2K readiness?  I I   O 
N= 309  45%  48%  0%  6% 
25a.Are your computer systems, including hardware and software, currently Y2K ready?  I I   O 
N= 310  22%  76%  0%  2% 
25b. If your computer systems, including hardware and software, are not currently Y2K ready, 
when will they be ready? __________________________________________________________ 
26. Are you going to require that your medical providers demonstrate that their systems 
are Y2K ready?  I I   O 
N= 306  30%  46% 11%  13% 
27. Are you going to require that your subcontractors demonstrate that their systems 
are Y2K ready?  I I   O 
N= 309  73%  13%  4%  11% 
Y2K Readiness of MCOs  20  OEI-05-98-00590  APPENDIX C 
Medicare Managed Care Organization Year 2000 Survey 
Computer Systems  0% 1-33%  34-66% 67-99% 100%  Unsure 
28. 	How many of your computer systems, including hardware and software, have you 
assessed for Y2K readiness?  I I    N  O  O 
N= 310  0%  0%  3%  39%  56%  1% 
29. How many of your computer systems, including hardware and software, have you 
renovated or replaced?	 I I    N  O  O 
N= 305  1%  17%  28%  50%  2%  3% 
30. 	How many of your computer systems, including hardware and software, have you 
tested to ensure that they accurately process date and time data (e.g. calculating, 
comparing and sequencing) for the years 1999 & 2000, and 
the leap year calculations?  I I    N O  O 
N= 310  2%  14%  20%  49%  13%  2% 
31. 	How many of your computer systems, including hardware and software, have you 
tested to ensure that they accurately process date and time data (e.g. calculating, 
comparing and sequencing) from, into and between the nineteenth, twentieth and 
twenty-first centuries?  I I    N O  O 
N= 310  11%  16%  17%  47%  5%  3% 
32. How many of your computer systems, including hardware and software, have you 
tested for possible date discontinuity failures?	 I I    N O  O 
N= 308  5%  12%  16%  53%  6%  8% 
33. 	How many of your computer systems, including hardware and software, have you 
tested to ensure that end of file codes are not misinterpreted as dates (e.g. 9999 as 
September 9, 1999 and 999,999,999 as September 8, 2001?  I I    N O  O 
N= 308  5%  12%  17%  44%  14%  8% 
34. 	If you have not tested your computer systems for the conditions described in Q28-Q33, 
when will they be tested? _________________________________________________ 
35. How many of your computer systems, including hardware and software, will be Y2K 
ready by December 31, 1999?	 I I    N O  O 
N= 310  0%  0%  0%  28%  71%  1% 
36. How many of your computer systems, including hardware and software, will be Y2K 
ready for the turn of the Century leap year (February 29, 2000)?	 I I    N O  O 
N= 310  0%  0%  0%  27%  71%  1% 
37. How many of your medical providers have given you assurances that their systems 
will be Y2K ready?	 I I    N O  O 
N= 306  9%  16%  17%  14%  10%  34% 
38. How many of your subcontractors have given you assurances that their systems 
will be Y2K ready?	 I I    N O  O 
N= 305  3%  13%  40%  12%  9%  22% 
Y2K Readiness of MCOs  21  OEI-05-98-00590  APPENDIX C 
Medicare Managed Care Organization Year 2000 Survey 
Computer Systems  0% 1-33%  34-66% 67-99% 100%  Unsure 
39. How many of your medical providers have tested their medical devices 
(e.g. chemistry, imaging) for Y2K readiness?  I I    N O  O 
N= 305  1%  8%  3%  12%  8%  68% 
40. How many of your subcontractors have tested their medical devices 
(e.g. chemistry, imaging) for Y2K readiness?	 I I    N O  O 
N= 298  2%  6%  4%  12%  1%  75% 
41a.How many of your medical providers have tested data exchange between their 
systems and your systems?  I I    N O  O 
N= 274  13%  26%  15%  19%  3%  24% 
41b. If you have not tested data exchange between your systems and your 
____________________ 
medical providers systems, when will you test?
42a.How many of your subcontractors have tested data exchange between their systems 
and your systems?  I I    N O  O 
N= 298  11%  23%  24%  19%  3%  20% 
42b. If your have not tested data exchange between your systems and your 
______________________ 
subcontractors systems, when will you test?
43a.How many of your medical providers systems, including hardware and software, 
are currently Y2K ready?  I I    N O  O 
N= 270  3%  10%  6%  4%  9%  68% 
43b. If your medical providers systems, including hardware and software, are not 
currently Y2K ready, when will they be ready? ______________________________ 
44a.How many of your subcontractors systems, including hardware and software, are 
currently Y2K ready?  I I    N O  O 
N= 265  2%  12%  11%  15%  3%  57% 
44b. If your subcontractors systems, including hardware and software, are not currently 
Y2K ready, when will they be ready? ______________________________________ 
Please answer the following question: 
45. Could your plan continue to provide services to patients if Medicare payments were delayed? 
_____ Yes (If yes, for how long?): __________________  No _____ 
N=310  74%  Mode=1 to 2 months  19%	 7% answered other or 
did not answer 
Y2K Readiness of MCOs  22  OEI-05-98-00590  APPENDIX D 
Agency Comments

Y2K Readiness of MCOs  23  OEI-05-98-00590  APPENDIX D 
Agency Comments

Y2K Readiness of MCOs  24  OEI-05-98-00590  APPENDIX D 
Agency Comments

Y2K Readiness of MCOs  25  OEI-05-98-00590  APPENDIX D 
Agency Comments

Y2K Readiness of MCOs  26  OEI-05-98-00590  APPENDIX D 
Agency Comments

Y2K Readiness of MCOs  27  OEI-05-98-00590  APPENDIX D 
Agency Comments

Y2K Readiness of MCOs  28  OEI-05-98-00590