prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.



Report 2: Medicare is a federal program that pays for covered health care services of qualified beneficiaries  It was established in 1965 under Title XVIII of the Social Security Act to provide health insurance to individuals 65 and older, and has been expanded over the years to include permanently disabled individuals under 65  The program is administered by the Centers for Medicare & Medicaid Services (CMS), within the U S  Department of Health and Human Services (HHS)  Medicare consists of four distinct parts: Part A (Hospital Insurance, or HI) covers inpatient hospital services, skilled nursing care, hospice care, and some home health services  The HI trust fund is mainly funded by a dedicated payroll tax of 2 9% of earnings, shared equally between employers and workers  Since 2013, workers with income of more than $200,000 per year for single tax filers (or more than $250,000 for joint tax filers) pay an additional 0 9% on income over those amounts  Part B (Supplementary Medical Insurance, or SMI) covers physician services, outpatient services, and some home health and preventive services  The SMI trust fund is funded through beneficiary premiums (set at 25% of estimated program costs for the aged) and general revenues (the remaining amount, approximately 75%)  Part C (Medicare Advantage, or MA) is a private plan option for beneficiaries that covers all Parts A and B services, except hospice  Individuals choosing to enroll in Part C must also enroll in Part B  Part C is funded through the HI and SMI trust funds  Part D covers outpatient prescription drug benefits  Funding is included in the SMI trust fund and is financed through beneficiary premiums, general revenues, and state transfer payments  Medicare serves approximately one in six Americans and virtually all of the population aged 65 and older  In 2019, the program will cover an estimated 61 million persons (52 million aged and 9 million disabled)  The Congressional Budget Office (CBO) estimates that total Medicare spending in 2019 will be about $772 billion; of this amount, approximately $749 billion will be spent on benefits  About 28% of Medicare benefit spending is for hospital inpatient and hospital outpatient services (see Figure 1 )  CBO also estimates that federal Medicare spending (after deduction of beneficiary premiums and other offsetting receipts) will be about $637 billion in 2019, accounting for about 14% of total federal spending and 3% of GDP  Medicare is required to pay for all covered services provided to eligible persons, so long as specific criteria are met  Spending under the program (except for a portion of administrative costs) is considered mandatory spending and is not subject to the appropriations process  Medicare is expected to be a high-priority issue in the current Congress  The program has a significant impact on beneficiaries and other stakeholders as well as on the economy in general through its coverage of important health care benefits for the aged and disabled, the payment of premiums and other cost sharing by those beneficiaries, its payments to providers who supply those health care services, and its interaction with other insurance coverage  Projections of future Medicare expenditures and funding indicate that the program will place increasing financial demands on the federal budget and on beneficiaries  In response to these concerns, Congress may consider a range of Medicare reform options, from making changes within the current structure, including modifying provider payments and revising existing oversight and regulatory mechanisms, to restructuring the entire program  The committees of jurisdiction for the mandatory spending (benefits) portion of Medicare are the Senate Committee on Finance, the House Committee on Ways and Means, and the House Committee on Energy and Commerce  The House and Senate Committees on Appropriations have jurisdiction over the discretionary spending used to administer and oversee the program  Medicare was enacted in 1965 (P L  89-97) in response to the concern that only about half of the nation's seniors had health insurance, and most of those had coverage only for inpatient hospital costs  The new program, which became effective July 1, 1966, included Part A coverage for hospital and posthospital services and Part B coverage for doctors and other medical services  As is the case for the Social Security program, Part A is financed by payroll taxes levied on current workers and their employers; persons must pay into the system for 40 quarters to become entitled to premium-free benefits  Medicare Part B is voluntary, with a monthly premium required of beneficiaries who choose to enroll  Payments to health care providers under both Part A and Part B were originally based on the most common form of payment at the time, namely "reasonable costs" for hospital and other institutional services or "usual, customary and reasonable charges" for physicians and other medical services  Medicare is considered a social insurance program and is the second-largest such federal program, after Social Security  The 1965 law also established Medicaid, the federal/state health insurance program for the poor; this was an expansion of previous welfare-based assistance programs  Some low-income individuals qualify for both Medicare and Medicaid  In the ensuing years, Medicare has undergone considerable change  P L  92-603, enacted in 1972, expanded program coverage to certain individuals under 65 (the disabled and persons with end-stage renal disease (ESRD)), and introduced managed care into Medicare by allowing private insurance entities to provide Medicare benefits in exchange for a monthly capitated payment  This law also began to place limitations on the definitions of reasonable costs and charges in order to gain some control over program spending which, even initially, exceeded original projections  During the 1980s and 1990s, a number of laws were enacted that included provisions designed to further stem the rapid increase in program spending through modifications to the way payments to providers were determined, and to postpone the insolvency of the Medicare Part A trust fund  This was typically achieved through tightening rules governing payments to providers of services and limiting the annual updates in such payments  The program moved from payments based on reasonable costs and reasonable charges to payment systems under which a predetermined payment amount was established for a specified unit of service  At the same time, beneficiaries were given expanded options to obtain covered services through private managed care arrangements, typically health maintenance organizations (HMOs)  Most Medicare payment provisions were incorporated into larger budget reconciliation bills designed to control overall federal spending  This effort culminated in the enactment of the Balanced Budget Act of 1997 (BBA 97; P L  105-33 )  This law slowed the rate of growth in payments to providers and established new payment systems for certain categories of providers, including establishing the sustainable growth rate (SGR) methodology for determining the annual update to Medicare physician payments  It also established the Medicare+Choice program, which expanded private plan options for beneficiaries and changed the way most of these plans were paid  BBA 97 further expanded preventive services covered by the program  Subsequently, Congress became concerned that the BBA 97 cuts in payments to providers were somewhat larger than originally anticipated  Therefore, legislation was enacted in both 1999 (Balanced Budget Refinement Act of 1999, or BBRA; P L  106-113 ) and 2000 (Medicare, Medicaid, and SCHIP Benefits Improvement and Protection Act of 2000, or BIPA; P L  106-554 ) to mitigate the impact of BBA 97 on providers  In 2003, Congress enacted the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA; P L  108-173 ), which included a major benefit expansion and placed increasing emphasis on the private sector to deliver and manage benefits  The MMA included provisions that (1) created a new voluntary outpatient prescription drug benefit to be administered by private entities; (2) replaced the Medicare+Choice program with the Medicare Advantage (MA) program and raised payments to plans in order to increase their availability for beneficiaries; (3) introduced the concept of income testing into Medicare, with higher-income persons paying larger Part B premiums beginning in 2007; (4) modified some provider payment rules; (5) expanded covered preventive services; and (6) created a specific process for overall program review if general revenue spending exceeded a specified threshold  During the 109 th Congress, two laws were enacted that incorporated minor modifications to Medicare's payment rules  These were the Deficit Reduction Act of 2005 (DRA; P L  109-171 ) and the Tax Relief and Health Care Act of 2006 (TRHCA; P L  109-432 )  In the 110 th Congress, additional changes were incorporated in the Medicare, Medicaid, and SCHIP Extension Act of 2007 (MMSEA; P L  110-173 ) and the Medicare Improvements for Patients and Providers Act of 2008 (MIPPA; P L  110-275 )  In the 111 th Congress, comprehensive health reform legislation was enacted that, among other things, made statutory changes to the Medicare program  The Patient Protection and Affordable Care Act (ACA; P L  111-148 ), enacted on March 23, 2010, included numerous provisions affecting Medicare payments, payment rules, covered benefits, and the delivery of care  The Health Care and Education Affordability Reconciliation Act of 2010 (the Reconciliation Act, or HCERA; P L  111-152 ), enacted on March 30, 2010, made changes to a number of Medicare-related provisions in the ACA and added several new provisions  Included in the ACA, as amended, are provisions that (1) constrain Medicare's annual payment increases for certain providers; (2) change payment rates in the MA program so that they more closely resemble those in fee-for-service; (3) reduce payments to hospitals that serve a large number of low-income patients; (4) create an Independent Payment Advisory Board (IPAB) to make recommendations to adjust Medicare payment rates; (5) phase out the Part D prescription drug benefit "doughnut hole"; (6) increase resources and enhance activities to prevent fraud and abuse; and (7) provide incentives to increase the quality and efficiency of care, such as creating value-based purchasing programs for certain types of providers, allowing accountable care organizations (ACOs) that meet certain quality and efficiency standards to share in the savings, creating a voluntary pilot program that bundles payments for physician, hospital, and post-acute care services, and adjusting payments to hospitals for readmissions related to certain potentially preventable conditions  In the 112 th and 113 th Congresses, the American Taxpayer Relief Act of 2012 (ATRA; P L  112-240 ), the Continuing Appropriations Resolution of 2014 ( P L  113-67 ), and the Protecting Access to Medicare Act of 2014 (PAMA; P L  113-93 ) primarily made short-term modifications to physician payment updates and payment adjustments for certain types of providers  PAMA also established a new skilled nursing facility (SNF) value-based purchasing program and a new system for determining payments for clinical diagnostic laboratory tests  The Improving Medicare Post-Acute Care Transformation Act of 2014 (IMPACT; P L  113-185 ) required that post-acute care providers—defined in the law as long-term care hospitals (LTCHs), inpatient rehabilitation facilities (IRFs), SNFs, and home health agencies (HHAs)—report standardized patient assessment data and data on quality measures and resource use  IMPACT also modified the annual update to the hospice aggregate payment cap and required that hospices be reviewed every three years to ensure that they are compliant with existing regulations related to patient health and safety and quality of care  In the 114 th Congress, the Medicare Access and CHIP Reauthorization Act of 2015 (MACRA; P L  114-10 ) repealed the SGR formula for calculating updates to Medicare payment rates to physicians and other practitioners and established an alternative set of methods for determining the annual updates   MACRA also introduced alternatives to the current fee-for-service (FFS) based physician payments by creating a new merit-based incentive payment system (MIPS) and put in place processes for developing, evaluating, and adopting alternative payment models (APMs)  Additionally, MACRA reduced updates to hospital and post-acute care provider payments, extended several expiring provider payment adjustments, made adjustments to income-related premiums in Parts B and D, and prohibited using Social Security numbers on beneficiaries' Medicare cards  Among other changes, the Increasing Choice, Access, and Quality in Health Care for Americans Act (Division C of the 21 st Century Cures Act; P L  114-255 ) made adjustments to LTCH reimbursement and modified the average length of stay criteria, which determines whether a hospital qualifies as an LTCH  It also delayed payment reductions and required the Secretary of Health and Human Services (the Secretary) to make changes to how payments are determined for certain durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS)  Lastly, it allowed beneficiaries with ESRD to enroll in MA beginning January 1, 2021  In the 115 th Congress, the Bipartisan Budget Act of 2018 (BBA 18; P L  115-123 ) made a number of changes to federal health care programs, including Medicare  For example, BBA 18 included provisions designed to expand care for beneficiaries with chronic health conditions, such as promoting team-based care by providers, increasing the use of telehealth services, and expanding certain MA supplemental benefits  In addition, BBA 18 extended for five years a number of existing Medicare provisions that were set to expire (or that had temporarily expired), including the Medicare dependent hospital program and add-on payments for low-volume hospitals, rural home health services, and certain ambulance services  BBA 18 also specified payment updates for the Medicare physician fee schedule, SNFs, and home health services; reduced payments for non-emergency ambulance transports; and required modification of the home health prospective payment system starting in 2020  In addition, the act provided for indefinite authority for MA special needs plans, repealed limits on outpatient therapy services, and eliminated the IPAB  Starting in 2019, the act will require that pharmaceutical manufacturers participating in Medicare Part D provide a larger discount on brand-name drugs purchased by enrollees in the coverage gap and will create a new high-income premium category under Parts B and D  Most persons aged 65 or older are automatically entitled to premium-free Part A because they or their spouse paid Medicare payroll taxes for at least 40 quarters (about 10 years) on earnings covered by either the Social Security or the Railroad Retirement systems  Persons under the age of 65 who receive cash disability benefits from Social Security or the Railroad Retirement systems for at least 24 months are also entitled to Part A  (Since there is a five-month waiting period for cash payments, the Medicare waiting period is effectively 29 months ) The 24-month waiting period is waived for persons with amyotrophic lateral sclerosis (ALS, "Lou Gehrig's disease")  Individuals of any age with ESRD who receive dialysis on a regular basis or a kidney transplant are generally eligible for Medicare  Medicare coverage for individuals with ESRD usually starts the first day of the fourth month of dialysis treatments  In addition, individuals with one or more specified lung diseases or types of cancer who lived for six months during a certain period prior to diagnosis in an area subject to a public health emergency declaration by the Environmental Protection Agency (EPA) as of June 17, 2009, are also deemed entitled to benefits under Part A and eligible to enroll in Part B  Persons over the age of 65 who are not entitled to premium-free Part A may obtain coverage by paying a monthly premium ($437 in 2019) or, for persons with at least 30 quarters of covered employment, a reduced monthly premium ($240 in 2019)  In addition, disabled persons who lose their cash benefits solely because of higher earnings, and subsequently lose their extended Medicare coverage, may continue their Medicare enrollment by paying a premium, subject to limitations  Generally, enrollment in Medicare Part B is voluntary  All persons entitled to Part A (and persons over the age of 65 who are not entitled to premium-free Part A) may enroll in Part B by paying a monthly premium  In 2019, the monthly premium is $135 50; however, about 3 5% of Part B enrollees pay less, due to a "hold-harmless" provision in the Social Security Act  Since 2007, higher-income Part B enrollees pay higher premiums  (See " Part B Financing  ") Although enrollment in Part B is voluntary for most individuals, in most cases, those who enroll in Part A by paying a premium also must enroll in Part B  Additionally, ESRD beneficiaries and Medicare Advantage enrollees (discussed below) also must enroll in Part B  Together, Parts A and B of Medicare comprise "original Medicare," which covers benefits on a fee-for-service basis  Beneficiaries have another option for coverage through private plans, called the Medicare Advantage (MA or Part C) program  When beneficiaries first become eligible for Medicare, they may choose either original Medicare or they may enroll in a private MA plan  Each fall, there is an annual open enrollment period during which time Medicare beneficiaries may choose a different MA plan, or leave or join the MA program  Beneficiaries are to receive information about their options to help them make informed decisions  In 2019, the annual open enrollment period runs from October 15 to December 7 for plan choices starting the following January  Since 2012, MA plans with a 5-star quality rating have been allowed to enroll Medicare beneficiaries who are either in traditional Medicare or in an MA plan with a lower quality rating at any time  Finally, each individual enrolled in either Part A or Part B is also entitled to obtain qualified prescription drug coverage through enrollment in a Part D prescription drug plan  Similar to Part B, enrollment in Part D is voluntary and the beneficiary pays a monthly premium  Since 2011, some higher-income enrollees pay higher premiums, similar to enrollees in Part B  Generally, beneficiaries enrolled in an MA plan providing qualified prescription drug coverage (MA-PD plan) must obtain their prescription drug coverage through that plan  In general, individuals who do not enroll in Part B or Part D during an initial enrollment period (when they first become eligible for Medicare) must pay a permanent penalty of increased monthly premiums if they choose to enroll at a later date  Individuals who do not enroll in Part B during their initial enrollment period may enroll only during the annual general enrollment period, which occurs from January 1 to March 31 each year  Coverage begins the following July 1  However, the law waives the Part B late enrollment penalty for current workers who have primary coverage through their own or a spouse's employer-sponsored plan  These individuals have a special enrollment period once their employment ends; as long as they enroll in Part B during this time, they will not be subject to penalty  Individuals who do not enroll in Part D during their initial enrollment period may enroll during the annual open enrollment period, which corresponds with the Part C annual enrollment period—from October 15 to December 7, with coverage effective the following January  Individuals are not subject to the Part D penalty if they have maintained "creditable" drug coverage through another source, such as retiree health coverage offered by a former employer or union  However, once employees retire or have no access to "creditable" Part D coverage, a penalty will apply unless they sign up for coverage during a special enrollment period  Finally, for persons who qualify for the low-income subsidy for Part D, the delayed-enrollment penalty does not apply  Medicare Parts A, B, and D each cover different services, with Part C providing a private plan alternative for all Medicare services covered under Parts A and B, except hospice  The Parts A-D covered services are described below, along with a description of Medicare's payments  Part A provides coverage for inpatient hospital services, posthospital skilled nursing facility (SNF) services, hospice care, and some home health services, subject to certain conditions and limitations  Approximately 20% of fee-for-service enrollees use Part A services during a year  Medicare inpatient hospital services include (1) bed and board; (2) nursing services; (3) use of hospital facilities; (4) drugs, biologics, supplies, appliances, and equipment; and (5) diagnostic and therapeutic items and services  (Physicians' services provided during an inpatient stay are paid under the physician fee schedule and discussed below in the " Physicians and Nonphysician Practitioner Services " section ) Coverage for inpatient services is linked to an individual's benefit period or "spell of illness" (defined as beginning on the day a patient enters a hospital and ending when he or she has not been in a hospital or skilled nursing facility for 60 days)  An individual admitted to a hospital more than 60 days after the last discharge from a hospital or SNF begins a new benefit period  Coverage in each benefit period is subject to the following conditions: Days 1-60  Beneficiary pays a deductible ($1,364 in 2019)  Days 61-90  Beneficiary pays a daily co-payment charge ($341 in 2019)  Days 91-150  After 90 days, the beneficiary may draw on one or more of 60 lifetime reserve days, provided they have not been previously used  (Each of the 60 lifetime reserve days can be used only once during an individual's lifetime ) For lifetime reserve days, the beneficiary pays a daily co-payment charge ($682 in 2019); otherwise the beneficiary pays all costs  Days 151 and over  Beneficiary pays for all costs for these days  Inpatient mental health care in a psychiatric facility is limited to 190 days during a patient's lifetime  Cost sharing is structured similarly to that for stays in a general hospital (above)  Medicare makes payments to most acute care hospitals under the inpatient prospective payment system (IPPS), using a prospectively determined amount for each discharge  Medicare's payments to hospitals is the product of two components: (1) a discharge payment amount adjusted by a wage index for the area where the hospital is located or where it has been reclassified, and (2) the weight associated with the Medicare severity-diagnosis related group (MS-DRG) to which the patient is assigned  This weight reflects the relative costliness of the average patient in that MS-DRG, which is revised annually, generally effective October 1 st of each year  Additional payments are made to hospitals for cases with extraordinary costs (outliers), for indirect costs incurred by teaching hospitals for graduate medical education, and to disproportionate share hospitals (DSH) which provide a certain volume of care to low-income patients  Additional payments may also be made for qualified new technologies that have been approved for special add-on payments  Medicare also makes payments outside the IPPS system for direct costs associated with graduate medical education (GME) for hospital residents, subject to certain limits  In addition, Medicare pays hospitals for 65% of the allowable costs associated with beneficiaries' unpaid deductible and co-payment amounts as well as for the costs for certain other services  IPPS payments may be reduced by certain quality-related programs based on a hospital's quality performance  These quality-related programs include the Hospital Readmissions Reduction Program, the Hospital-Acquired Condition Reduction Program, and the Hospital Value-Based Purchasing Program  Further, hospitals may receive Medicare payment reductions for failing to demonstrate meaningful use of certified electronic health record (EHR) technology  Additional payment adjustments or special treatment under the IPPS may apply for hospitals meeting one of the following designations: (1) sole community hospitals (SCHs), (2) Medicare dependent hospitals, (3) rural referral centers, and (4) low-volume hospitals  Certain hospitals or distinct hospital units are exempt from IPPS and paid on an alternative basis, including (1) inpatient rehabilitation facilities, (2) long-term care hospitals, (3) psychiatric facilities including hospitals and distinct part units, (4) children's hospitals, (5) cancer hospitals, and (6) critical access hospitals  Medicare covers up to 100 days of posthospital care for persons needing skilled nursing or rehabilitation services on a daily basis  The SNF stay must be preceded by an inpatient hospital stay of at least 3 consecutive calendar days, and the transfer to the SNF typically must occur within 30 days of the hospital discharge  Medicare requires SNFs to provide services for a condition the beneficiary was receiving treatment for during his or her qualifying hospital stay (or for an additional condition that arose while in the SNF)  There is no beneficiary cost sharing for the first 20 days of a Medicare-covered SNF stay  For days 21 to 100, beneficiaries are subject to daily co-payment charges ($170 50 in 2019)  The 100-day limit begins again with a new spell of illness  SNF services are paid under a prospective payment system (PPS), which is based on a per diem urban or rural base payment rate, adjusted for case mix (average severity of illness) and area wages  The per diem rate generally covers all services, including room and board, provided to the patient that day  The case-mix adjustment is made using the resource utilization groups (RUGs) classification system, which uses patient assessments to assign a beneficiary to one of 66 groups that reflect the beneficiary's expected use of services  Patient assessments are done at various times during a patient's stay and a beneficiary's designated RUG category can change with changes in the beneficiary's condition  Extra payments are not made for extraordinarily costly cases ("outliers")  The Medicare hospice benefit covers services designed to provide palliative care and management of a terminal illness; the benefit includes drugs and medical and support services  These services are provided to Medicare beneficiaries with a life expectancy of six months or less for two 90-day periods, followed by an unlimited number of 60-day periods  The individual's attending physician and the hospice physician must certify the need for the first benefit period, but only the hospice physician needs to recertify for subsequent periods  Since January 1, 2011, a hospice physician or nurse practitioner must have a face-to-face encounter with the individual to determine continued eligibility prior to the 180 th day recertification, and for each subsequent recertification  Hospice care is provided in lieu of most other Medicare services related to the curative treatment of the terminal illness  Beneficiaries electing hospice care from a hospice program may receive curative services for illnesses or injuries unrelated to their terminal illness, and they may disenroll from the hospice at any time  Nominal cost sharing is required for drugs and respite care  Payment for hospice care is based on one of four prospectively determined rates (which correspond to four different levels of care) for each day a beneficiary is under the care of the hospice  The four rate categories are routine home care, continuous home care, inpatient respite care, and general inpatient care  Payment rates are adjusted to reflect differences in area wage levels, using the hospital wage index  Payments to a hospice are limited by two caps; the first limits the number of days of inpatient care to 20% or less of total patient care days, and the second limits the average annual payment per beneficiary  Home health services and services for individuals with end-stage renal disease are covered under both Parts A and B of Medicare  Medicare covers visits by participating home health agencies for beneficiaries who (1) are confined to home and (2) need either skilled nursing care on an intermittent basis or physical or speech language therapy  After establishing such eligibility, the continuing need for occupational therapy services may extend the eligibility period  Covered services include part-time or intermittent nursing care, physical or occupational therapy or speech language pathology services, medical social services, home health aide services, and medical supplies and durable medical equipment  The services must be provided under a plan of care established by a physician, and the plan must be reviewed by the physician at least every 60 days  There is no beneficiary cost sharing for home health services (though some other Part B services provided in connection with the visit, such as durable medical equipment, may be subject to cost-sharing charges)  Home health services are covered under both Medicare Parts A and B  There are special eligibility requirements and benefit limits for home health services furnished under Part A to beneficiaries who are enrolled in both Parts A and B  For such a beneficiary, Part A pays for only postinstitutional home health services furnished for up to 100 visits during a spell of illness, while Part B covers any medically necessary home health services that exceed the 100-visit limit, as well as medically necessary home health services that do not qualify as "postinstitutional " For beneficiaries enrolled in only Part A or only Part B, the requirements described above do not apply  Part A or Part B, as applicable, covers all medically necessary episodes of home health care, without a visit limit, regardless of whether the episode follows a hospitalization  Regardless of whether the beneficiary is enrolled in Part A only, in Part B only, or in both parts, the scope of the Medicare home health benefit is the same, Medicare's payments to HHAs are calculated using the same methods, and beneficiaries have no cost-sharing  Home health services are paid under a home health PPS, based on 60-day episodes of care; a patient may have an unlimited number of episodes  The physician's certification of an initial 60-day episode of home health must be supported by a face-to-face encounter with the patient related to the primary reason that the patient needs home health services  Under the PPS, for episodes with five or greater visits, a nationwide base payment amount is adjusted by differences in wages (using the hospital wage index)  This amount is then adjusted for case mix using the applicable Home Health Resource Group (HHRG) to which the beneficiary has been assigned  The HHRG applicable to a beneficiary is determined following an assessment of the patient's condition and care needs using the Outcome and Assessment Information Set (OASIS); there are 153 HHRGs  For episodes with four or fewer visits, the PPS reimburses the provider for each visit performed  Further payment adjustments may be made for services provided in rural areas, outlier visits (for extremely costly patients), a partial episode for beneficiaries that have an intervening event during their episode, or an agency's failure to submit quality data to CMS  Since January 1, 2016, home health agencies in nine states are being reimbursed under a home health value-based purchasing (HHVBP) model  These home health agencies can receive increased or decreased home health reimbursements depending on their performance across certain quality measures  Individuals with end-stage renal disease (ESRD) are eligible for all services covered under Parts A and B  Kidney transplantation services, to the extent they are inpatient hospital services, are subject to the inpatient hospital PPS and are reimbursed by both Parts A and B  However, kidney acquisition costs are paid on a reasonable cost basis under Part A  Dialysis treatments, when an individual is admitted to a hospital, are covered under Part A  Part B covers their dialysis services, drugs, biologicals (including erythropoiesis stimulating agents used in treating anemia as a result of ESRD), diagnostic laboratory tests, and other items and services furnished to individuals for the treatment of ESRD  In effect since January 1, 2011, the ESRD prospective payment system (PPS) makes no payment distinction as to the site where renal dialysis services are provided  With the implementation of the ESRD PPS, Medicare dialysis payments provide a single "bundled" payment for Medicare renal dialysis services that includes (1) items and services included in the former payment system's base rate as of December 31, 2010; (2) erythropoiesis stimulating agents (ESAs) for the treatment of ESRD; (3) other drugs and biologicals for which payment was made separately (before bundling); and (4) diagnostic laboratory tests and other items and services furnished to individuals for the treatment of ESRD  The system is case-mix adjusted based on factors such as patient weight, body mass index, comorbidities, length of time on dialysis, age, race, ethnicity, and other appropriate factors as determined by the Secretary  Under the ESRD Quality Incentive Program, dialysis facilities that fail to meet certain performance standards receive reduced payments  Medicare Part B covers physicians' services, outpatient hospital services, durable medical equipment, and other medical services  Initially, over 98% of the eligible population voluntarily enrolled in Part B, but in recent years the percentage has fallen to about 91%  About 89% of enrollees in original (FFS) Medicare use Part B services during a year  The program generally pays 80% of the approved amount (most commonly, a fee schedule or other predetermined amount) for covered services in excess of the annual deductible ($185 in 2019)  The beneficiary is liable for the remaining 20%  Most providers and practitioners are subject to limits on amounts they can bill beneficiaries for covered services  For example, physicians and some other practitioners may choose whether or not to accept "assignment" on a claim  When a physician signs a binding agreement to accept assignment for all Medicare patients, the physician accepts the Medicare payment amount as payment in full and can bill the beneficiary only the 20% coinsurance plus any unmet deductible  The physician agrees to accept assignment on all Medicare claims in a given year and is referred to as a "participating physician " There are several advantages to being a participating provider, including higher payment under the Medicare fee schedule, a lower beneficiary co-payment, and automatic forwarding of Medigap claims  Physicians who do not agree to accept assignment on all Medicare claims in a given year are referred to as nonparticipating physicians  Nonparticipating physicians may or may not accept assignment for a given service  If they do not, they may charge beneficiaries more than the fee schedule amount on nonassigned claims; however, these "balance billing" charges are subject to certain limits  Alternatively, physicians may choose not to accept any Medicare payment and enter into private contracts with their patients where no Medicare restrictions on payment or balance billing apply; however, this requires that physicians "opt out" of Medicare for two years  For some providers, such as nurse practitioners and physician assistants, assignment is mandatory; these providers can only bill the beneficiary the 20% coinsurance and any unmet deductible  For other Part B services, such as durable medical equipment, assignment is optional; for these services, applicable providers may bill beneficiaries for amounts above Medicare's recognized payment level and may do so without limit  Medicare Part B covers medically necessary physician services and medical services provided by some nonphysician practitioners  Covered nonphysician practitioner services include, but are not limited to, those provided by physician assistants, nurse practitioners, certified registered nurse anesthetists, and clinical social workers  Certain limitations apply for services provided by chiropractors and podiatrists  Beneficiary cost sharing is typically 20% of the approved amount, although most preventive services require no coinsurance from the beneficiary  A number of Part B services are paid under the Medicare physician fee schedule (MPFS), including services of physicians, nonphysician practitioners, and therapists  There are over 7,000 service codes under the MPFS  The fee schedule assigns relative values to each service code  These relative values reflect physician work (based on time, skill, and intensity involved), practice expenses (e g , overhead and nonphysician labor), and malpractice expenses  The relative values are adjusted for geographic variations in the costs of practicing medicine  These geographically adjusted relative values are converted into a dollar payment amount by a national conversion factor  Annual updates to payments are determined through changes in the conversion factor  MACRA made several fundamental changes to how Medicare pays for physician and practitioner services by (1) changing the methodology for determining the annual updates to the conversion factor, (2) establishing a merit-based incentive payment system (MIPS) to consolidate and replace several existing incentive programs and to apply value and quality adjustments to the MPFS, and (3) establishing the development of, and participation in, alternative payment models (APMs)  Prior to MACRA, the SGR system, which had been in place since BBA 97, tied annual updates to the Medicare fee schedule to cumulative Part B expenditure targets  MACRA repealed the SGR methodology, established annual fee schedule updates in the short term, and put in place a new method for determining updates thereafter  As a result of the MACRA changes, the update to physician payments under the MPFS was 0% from January 2015 through June 2015; for the remainder of that year—July 2015 through December 2015—the payments were increased by 0 5%  In each of the next four years, 2016 through 2019, the payments were to increase by 0 5% each year; however, the BBA 18 reduced the 2019 update to 0 25%  For the next six years, from 2020 through 2025, the payment update will be 0%  In addition to changes to the annual update, MACRA established two pathways for payment reform, collectively referred to as the Quality Payment Program (QPP)  Medicare payment to all physicians and other practitioners will be determined by which conditions of the QPP, either MIPS or APM, the participant satisfies  The MIPS is a new program that remains based on FFS rates but combines four categories of performance measures (quality of care, cost/resource use, clinical practice improvement activities, and promoting interoperability) into a single adjustment to the base MPFS payment  Following several years of data collection and feedback on measures, the MIPS adjustments will affect actual payments for the first time in 2019  In contrast, qualified advanced APMs are intended to be alternatives to FFS, incorporating new approaches to paying for medical care that reward quality and efficiency while de-emphasizing the number of services billed (volume of care)  Proposed advanced APMs are evaluated by an ad hoc committee (the Physician-Focused Payment Models Technical Advisory Committee), which provides comments and recommendations to the Secretary as to whether new payment models meet the criteria of APMs  For 2019, there are 13 advanced APMs under the QPP, though not all are available to all physicians and practitioners, as some are restricted to certain special services (e g , oncology care, joint replacement) or geographic locations (e g , Vermont's Medicare ACO Initiative, Maryland's Total Cost of Care Model)  MACRA established incentives to make APMs more attractive than MIPS  First, qualifying participants in advanced APMs are eligible for an annual prepaid bonus (paid 2019-2024)  Second, beginning in 2026, there will be two update factors, one for items and services furnished by a participant in an advanced APM and another for those electing to remain in the modified FFS payment system (MIPS) that do not participate in an advanced APM  The update factor for the advanced APM participants will be 0 75%, and the update factor for MIPS will be 0 25%, causing a difference between the payment levels that will grow over time  Medicare covers medically necessary outpatient physical and occupational therapy and speech-language pathology services  Beginning in 1997 and for many years subsequently but intermittently, beneficiaries faced limits ( therapy caps ) on how much Medicare would pay for outpatient therapy services in a calendar year  BBA 18 permanently repealed the outpatient therapy caps beginning January 1, 2018, and established a requirement that therapy services exceeding $3,000 would trigger a manual medical review (MMR) of the medical necessity of these services, in years 2018-2028  Beginning with 2029, the annual MMR threshold limit is to be increased by the percentage increase in the MEI, and it is to be applied separately for (1) physical therapy services and speech-language pathology services combined and (2) occupational therapy services  Medicare statute prohibits payments for covered items and services that are "not reasonable and necessary for the diagnosis or treatment of illness or injury or to improve the functioning of a malformed body member," which would effectively exclude the coverage of preventive and screening services  However, Congress has explicitly added and expanded Medicare coverage for a number of such services through legislation, including through MMA, MIPPA, and ACA  Under current law, if a preventive service is recommended for use by the U S  Preventive Services Task Force (USPSTF, an independent evidence-review panel) and Medicare covers the service, all cost sharing must be waived  Also, the Secretary may add coverage of a USPSTF-recommended service that is not already covered  Coverage for preventive and screening services currently includes, among other services, (1) a "welcome to Medicare" physical exam during the first year of enrollment in Part B and an annual visit and prevention plan thereafter; (2) flu vaccine (annual), pneumococcal vaccine, and hepatitis B vaccine (for persons at high risk); (3) screening tests for breast, cervical, prostate, and colorectal cancers; (4) screening for other conditions such as depression, alcohol misuse, heart disease, glaucoma, and osteoporosis; and (5) intensive behavioral therapy for heart disease and for obesity  Payments for these services are provided under the physician fee schedule and/or the clinical laboratory fee schedule  Part B covers outpatient clinical laboratory tests, such as certain blood tests, urinalysis, and some screening tests, provided by Medicare-participating laboratories  These services may be furnished by labs located in hospitals and physician offices, as well as by independent labs  Beneficiaries have no co-payments or deductibles for covered clinical lab services  From 1984 until recently, payments for outpatient clinical laboratory services were made on the basis of the Medicare clinical laboratory fee schedule (CLFS), which set payment amounts as the lesser of the amount billed, the local fee for a geographic area, or a national limit amount  Most clinical lab services were paid at the national limit amount
Report 2: 1 prototypes for evaluation  BAE's contract was for $103 8 million and SAIC's for $121 5 million, and each company is to build 16 prototypes  The Marines expect to down select to a single vendor in 2018  Initial operational capability (IOC) was expected by the end of 2020, and all ACV 1 1 vehicles are planned to be fielded by summer 2023  Plans are to equip six battalions with ACV 1 1s and 392 existing upgraded AAVs  Both BAE and SAIC reportedly have a long history related to amphibious vehicles, as BAE built the Marines' original AAV and SAIC has built hundreds of Terrex 1 vehicles used by Singapore, and both companies had Marine Corps contracts to modernize AAVs  ACV 1 1 is intended to have some amphibious capability but would rely on ship-to-shore connectors  ACV 1 2 is intended to have greater amphibious capability, including greater water speed and the ability to self-deploy from amphibious ships  BAE planned to team with Italian manufacturer Iveco (which owns Chrysler and Ferrari)  BAE's prototype would accommodate 13 Marines and travel 11 5 miles at about 7 miles per hour (mph) in surf and 65 mph on land  BAE's version would incorporate a V hull design intended to protect passengers from underside blasts and have external fuel tanks for increased safety  BAE intends to produce its prototypes at its York, PA, facility  SAIC planned to team with Singapore Technology Kinetics to develop its prototype based on an existing design called Terrex  SAIC's version is said to travel 7 mph in water and incorporates a V hull design as well as blast-mitigating seats  It would carry a crew of 3 and can accommodate 11 Marines  SAIC's version plans for a Common Remote Weapons System (CROWS) ( 50 calibre machine gun and a 30 mm cannon), which could be operated from inside the vehicle while buttoned up, therefore not exposing crewmen to hostile fire  On December 7, 2015, it was reported that GDLS would protest the award of the ACV 1 1 contract to BAE and SAIC, claiming the Marines asked for particular capabilities and then evaluated vendors by a different set of standards  On March 15, 2016, GAO denied GDLS's protest, noting that "the Marine Corps' evaluation was reasonable and consistent with the evaluation scheme identified in the solicitation " The Marines reportedly stated that the protest put the ACV 1 1 program about 45 days behind schedule but anticipated the ACV 1 1 would still be fielded on time  BAE and SAIC reportedly delivered their ACV 1 1 prototypes, with BAE delivering its first prototype in December 2016 and SAIC delivering its prototype in February 2017  This early delivery could potentially result in an unspecified incentive fee award for both companies  EMD testing began the week of March 13 and was scheduled to last eight months  In early December 2017, the Marines reportedly sent the ACV 1 1 down select request for proposals to BAE and SAIC  Plans called for operational testing to start in January 2018, with the Marines anticipating announcing a contract winner in June 2018 for the delivery of 204 ACV 1 1s over a four-year period  In accordance with the provisions of the FY2014 National Defence Authorization Act ( P L  113-66 ) Section 251, GAO submitted its annual report to Congress on the ACV program in April 2018  GAO reviewed program cost estimates, updated schedules, and program assessments of test results and production readiness, and compared ACV acquisition efforts to DOD guidance and GAO-identified best practices  GAO found the following: The first version of the Amphibious Combat Vehicle (ACV 1 1) is on track to meet development cost goals with no additional anticipated delays for major acquisition milestones  With regard to costs, the development phase of ACV 1 1 is on pace to not exceed cost goals that were established at the start of development, based on a recent Navy estimate, the ACV program office, and reporting from the contractors  GAO recommended that the Marine Corps (1) not enter the second year of low rate production for ACV 1 1 until after the contractor has achieved an overall Manufacturing Readiness Level (MRL) of 8 and (2) not enter full-rate production until achieving an overall MRL of 9  DOD partially concurred with this recommendation but noted that it was "reasonable to proceed at lower MRL levels if steps are taken to mitigate risks " On June 19, 2018, the Marine Corps selected BAE Systems to produce the ACV  Reportedly, the initial contract—valued at $198 million—will be for low-rate production of 30 vehicles to be delivered by the autumn of 2019  Eventually, 204 vehicles are to be delivered under the ACV 1 1 phase of the project  BAE will also produce the ACV 1 2 variant and, all told, the entire ACV 1 1 and 1 2 project is expected to deliver 700 vehicles, and, if all options are exercised, the total contract will reportedly be worth $1 2 billion  In December 2018, the Navy reportedly awarded BAE Systems a $140 million contract modification to build 30 Low Rate Initial Production (LRIP) ACVs as part of Lot 2, with the first vehicles expected to be delivered in the summer of 2020  Lot 1 is reportedly still scheduled to start delivery in the summer of 2019  In DOT&E's December 2018 FY2018 Annual Report, it was noted During the operational evaluation (OA), the ACV-equipped unit demonstrated the ability to maneuver to an objective, conduct immediate action drills, and provide suppressive fires in support of dismounted infantry maneuver in a desert environment  The ACV-equipped unit was able to maneuver in the littorals; embark aboard a landing craft air cushioned (LCAC), transit the open ocean and surf zone, and debark from the LCAC  The ACV demonstrated water mobility and the ability to self-deploy from the beach, cross the surf zone, enter the ocean, swim, and return to the beach  Based on data from the OA, reliability is below the program reliability growth curve (58 hours Mean Time Between Operational Mission Failures [MTBOMF])  BAE vehicles demonstrated 24 9 hours MTBOMF  There were no systemic problems identified that indicate a major redesign is required  The ACV section was successful in 15 of 16 missions and demonstrated the capability to negotiate terrain in the desert and littorals, operate with tanks and light armored vehicles, and maneuver to achieve tactical advantage over the opposing threat force  ACV crews, supported infantry, and the opposing force noted that the vehicles performed better than the legacy vehicle in a wide variety of areas  In terms of recommendations, DOT&E noted the Program Manager, Advanced Amphibious Assault should do the following: Modify the infantry troop commander's station to make it easier to move between the hatch and seat  Assess the capability of all existing Marine Corps recovery assets to recover the ACV  Investigate options for preventing damage to steering/suspension when encountering battlefield debris, such as concertina wire  According to reports, the Marines envisioned that the successor to ACV 1 1—the ACV 1 2—would have a threshold requirement of 12 miles from ship-to-shore  If this threshold can be achieved, it could help to reduce the vulnerability of U S  naval vessels supporting Marine amphibious operations to enemy shore fire  On April 10, 2019, during testimony to the Subcommittee on Seapower of the Senate Armed Services Committee, Navy and Marine Corps leadership noted During the fall of 2018, ACV 1 1 prototypes demonstrated satisfactory water mobility performance in high surf conditions, and in doing so met the full water mobility transition requirement for ACV 1 2 capability  Subsequently, the Milestone Decision Authority Assistant Secretary of the Navy for Research, Development and Acquisition (ASN (RD&A)) approved the consolidation of increments one and two into a single program to enable continuous production of ACVs to completely replace the AAV  The next key acquisition event is the Full Rate Production decision scheduled for the third quarter of FY 2020 following Initial Operational Test & Evaluation  ACV remains on schedule to achieve Initial Operational Capability in the fourth quarter of FY 2020  With the consolidation of ACV variants into a single variant, there will likely be a number of programmatic changes and potential ramifications for the ACV and ACV 2 0 programs  Reportedly, the Marines plan to develop an ACV 2 0, capable of carrying 10 to 13 Marines plus crew, capable of high water speeds and deployment from ships far from the coast  ACV 2 0 is planned to be capable of operating on land alongside tanks and light armored vehicles  According to the Marines ACV 2 0 serves as a conceptual placeholder for a future Decision Point (~ 2025, or sooner) at which time knowledge gained in the fielding and employment of the first phase of ACV (1 1 and 1 2), the state of the naval connector strategy, and science & technology work towards a high water speed capable self-deploying vehicle will support an informed decision  The FY2020 presidential budget request includes RDT&E and Procurement funding requests in the Base Budget, as well as FY2020 requested quantities  The Marines did not request ACV Overseas Contingency operations (OCO) funding in FY2020  According to DOD, the FY2020 ACV budget request will fund The ACV 1 1 Full Rate Production (FRP) Lot 3 of 56 vehicles, plus procurement of related items such as production support, systems engineering, program management, Engineering Change Orders (ECOs), Government Furnished Equipment (GFE), and integrated logistics support  Research and Development efforts include the procurement of ACV 1 2 MRV test articles, associated GFE, and initiation of a Vehicle Protective System trade study and integration efforts  While from an overall programmatic perspective, the consolidation of the ACV 1 1 and ACV 1 2 variants could be viewed as a favourable programmatic outcome, there are likely ramifications that might be of interest to policymakers  Potential issues include the following: Will the consolidation of ACV 1 1 and ACV 1 2 result in an overall cost savings? Will this consolidation permit the acquisition of additional ACVs because of potential cost savings? With the consolidation and the stated intent to replace AAVs, what is the revised timeline for the replacement of AAVs and will this result in cost savings from not having to upgrade and maintain AAVs longer than previously intended? How will the consolidation of ACV 1 1 and ACV 1 2 affect the ACV 2 0 program? If the Navy and Marine Corps decide to adopt Expeditionary Advance Base Operations (EABO) as an operational concept, it could possibly have implications for the ACV program, including the following: At the weapon systems level, would EABO require any changes to the vehicles themselves, such as enhanced survivability, lethality, or Command, Control, Communications, Computer, Intelligence, Surveillance, and Reconnaissance (C4ISR) features? If changes are required to facilitate EABO, how would this affect the program's overall acquisition timeline and cost? If EABO does not require any technical changes in the ACV program, would the adoption of EABO modify the Marines' current procurement quantities of ACVs? If EABO requires different procurement quantities for the different ACV versions (more or fewer), how might this affect program timelines and program costs?

ground_truth: The federal government plans to invest almost $96 billion in IT in fiscal year 2018. Historically, IT investments have too often failed or contributed little to mission-related outcomes. Further, increasingly sophisticated threats and frequent cyber incidents underscore the need for effective information security. As a result, GAO added two areas to its high-risk list: IT security in 1997 and the management of IT acquisitions and operations in 2015. This statement summarizes agencies' progress in improving IT management and ensuring the security of federal IT. It is primarily based on GAO's prior reports issued between February 1997 and May 2018 (and an ongoing review) on (1) CIO responsibilities, (2) agency CIOs' involvement in approving IT contracts, (3) data center consolidation efforts, (4) the management of software licenses, and (5) compliance with cybersecurity requirements. The Office of Management and Budget (OMB) and federal agencies have taken steps to improve the management of information technology (IT) acquisitions and operations and ensure the security of federal IT through a series of initiatives. As of May 2018, agencies had fully implemented about 61 percent of the approximately 800 IT management-related recommendations that GAO made from fiscal years 2010 through 2015. Likewise, since 2010, agencies had implemented about 66 percent of the approximately 2,700 security-related recommendations as of May 2018. Even with this progress, significant actions remain to be completed. Chief Information Officer (CIO) responsibilities . Laws such as the Federal Information Technology Acquisition Reform Act (FITARA) and related guidance assigned 35 key IT management responsibilities to CIOs to help address longstanding challenges. However, in a draft report on CIO responsibilities, GAO's preliminary results suggest that none of the 24 selected agencies have policies that fully address the role of their CIO, as called for by federal laws and guidance. GAO intends to recommend that OMB and each of the selected 24 agencies take actions to improve the effectiveness of CIO's implementation of their responsibilities. IT contract approval . According to FITARA, covered agencies' CIOs are required to review and approve IT contracts. Nevertheless, in January 2018, GAO reported that most of the CIOs at 22 selected agencies were not adequately involved in reviewing billions of dollars of IT acquisitions. Consequently, GAO made 39 recommendations to improve CIO oversight over IT acquisitions. Consolidating data centers . OMB launched an initiative in 2010 to reduce data centers, which was codified and expanded in FITARA. According to agencies, data center consolidation and optimization efforts have resulted in approximately $3.9 billion of cost savings through 2018. Even so, additional work remains. GAO has made 160 recommendations to OMB and agencies to improve the reporting of related cost savings and to achieve optimization targets; however, as of May 2018, 80 of the recommendations have not been fully addressed. Managing software licenses . Effective management of software licenses can help avoid purchasing too many licenses that result in unused software. In May 2014, GAO reported that better management of licenses was needed to achieve savings, and made 135 recommendations to improve such management. Four years later, 78 of the recommendations remained open. Improving the security of federal IT systems . While the government has acted to protect federal information systems, agencies need to improve security programs, cyber capabilities, and the protection of personally identifiable information. Over the last several years, GAO has made about 2,700 recommendations to agencies aimed at improving the security of federal systems and information. These recommendations identified actions for agencies to take to strengthen their information security programs and technical controls over their computer networks and systems. As of May 2018, about 800 of the information security-related recommendations had not been implemented. From fiscal years 2010 through 2015, GAO made about 800 recommendations to OMB and federal agencies to address shortcomings in IT acquisitions and operations. Since 2010, GAO also made about 2,700 recommendations to federal agencies to improve the security of federal systems. These recommendations include those to improve the implementation of CIO responsibilities, the oversight of the data center consolidation initiative, software license management efforts, and the strength of security programs and technical controls. Most agencies agreed with these recommendations, and GAO will continue to monitor their implementation.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.

Report 1: According to the President’s budget, the federal government plans to invest more than $96 billion for IT in fiscal year 2018—the largest amount ever budgeted  Despite such large IT expenditures, we have previously reported that investments in federal IT too often result in failed projects that incur cost overruns and schedule slippages, while contributing little to the desired mission-related outcomes  For example: The tri-agency National Polar-orbiting Operational Environmental Satellite System was disbanded in February 2010 by the White House’s Office of Science and Technology Policy after the program spent 16 years and almost $5 billion  The Department of Homeland Security’s (DHS) Secure Border Initiative Network program was ended in January 2011, after the department obligated more than $1 billion for the program  The Department of Veterans Affairs’ Financial and Logistics Integrated Technology Enterprise program was intended to be delivered by 2014 at a total estimated cost of $609 million, but was terminated in October 2011  The Department of Defense’s Expeditionary Combat Support System was canceled in December 2012 after spending more than a billion dollars and failing to deploy within 5 years of initially obligating funds  The United States Coast Guard (Coast Guard) decided to terminate its Integrated Health Information System project in 2015  As reported by the agency in August 2017, the Coast Guard spent approximately $60 million over 7 years on this project, which resulted in no equipment or software that could be used for future efforts  Our past work has found that these and other failed IT projects often suffered from a lack of disciplined and effective management, such as project planning, requirements definition, and program oversight and governance  In many instances, agencies had not consistently applied best practices that are critical to successfully acquiring IT  Such projects have also failed due to a lack of oversight and governance  Executive-level governance and oversight across the government has often been ineffective, specifically from CIOs  For example, we have reported that some CIOs’ roles were limited because they did not have the authority to review and approve the entire agency IT portfolio  In addition to failures when acquiring IT, security deficiencies can threaten systems once they become operational  As we previously reported, in order to counter security threats, 23 civilian Chief Financial Officers Act agencies spent a combined total of approximately $4 billion on IT security-related activities in fiscal year 2016  Even so, our cybersecurity work at federal agencies continues to highlight information security deficiencies  The following examples describe the types of risks we have found at federal agencies  In November 2017, we reported that the Department of Education’s Office of Federal Student Aid did not consistently analyze privacy risks for its electronic information systems, and policies and procedures for protecting information systems were not always up to date  In August 2017, we reported that, since the 2015 data breaches, the Office of Personnel Management (OPM) had taken actions to prevent, mitigate, and respond to data breaches involving sensitive personal and background investigation information  However, we noted that the agency had not fully implemented recommendations made to OPM by DHS’s United States Computer Emergency Readiness Team to help the agency improve its overall security posture and improve its ability to protect its systems and information from security breaches  In July 2017, we reported that IT security at the Internal Revenue Service had weaknesses that limited its effectiveness in protecting the confidentiality, integrity, and availability of financial and sensitive taxpayer data  An underlying reason for these weaknesses was that the Internal Revenue Service had not effectively implemented elements of its information security program  In May 2016, we reported that the National Aeronautics and Space Administration, the Nuclear Regulatory Commission, OPM, and the Department of Veteran Affairs did not always control access to selected high-impact systems, patch known software vulnerabilities, and plan for contingencies  An underlying reason for these weaknesses was that the agencies had not fully implemented key elements of their information security programs  In August 2016, we reported that the IT security of the Food and Drug Administration had significant weaknesses that jeopardized the confidentiality, integrity, and availability of its information systems and industry and public health data  Congress and the President have enacted various key pieces of reform legislation to address IT management issues  These include the federal IT acquisition reform legislation commonly referred to as the Federal Information Technology Acquisition Reform Act (FITARA)  This legislation was intended to improve covered agencies’ acquisitions of IT and enable Congress to monitor agencies’ progress and hold them accountable for reducing duplication and achieving cost savings  The law includes specific requirements related to seven areas: Agency CIO authority enhancements  CIOs at covered agencies have the authority to, among other things, (1) approve the IT budget requests of their respective agencies and (2) review and approve IT contracts  Federal data center consolidation initiative (FDCCI)  Agencies covered by FITARA are required, among other things, to provide a strategy for consolidating and optimizing their data centers and issue quarterly updates on the progress made  Enhanced transparency and improved risk management  The Office of Management and Budget (OMB) and covered agencies are to make detailed information on federal IT investments publicly available, and agency CIOs are to categorize their investments by level of risk  Portfolio review  Covered agencies are to annually review IT investment portfolios in order to, among other things, increase efficiency and effectiveness and identify potential waste and duplication  Expansion of training and use of IT acquisition cadres  Covered agencies are to update their acquisition human capital plans to support timely and effective IT acquisitions  In doing so, the law calls for agencies to consider, among other things, establishing IT acquisition cadres (i e , multi-functional groups of professionals to acquire and manage complex programs), or developing agreements with other agencies that have such cadres  Government-wide software purchasing program  The General Services Administration is to develop a strategic sourcing initiative to enhance government-wide acquisition and management of software  In doing so, the law requires that, to the maximum extent practicable, the General Services Administration should allow for the purchase of a software license agreement that is available for use by all executive branch agencies as a single user  Maximizing the benefit of the Federal Strategic Sourcing Initiative  Federal agencies are required to compare their purchases of services and supplies to what is offered under the Federal Strategic Sourcing Initiative  In June 2015, OMB released guidance describing how agencies are to implement FITARA  This guidance is intended to, among other things: assist agencies in aligning their IT resources with statutory establish government-wide IT management controls to meet the law’s requirements, while providing agencies with flexibility to adapt to unique agency processes and requirements; strengthen the relationship between agency CIOs and bureau CIOs; strengthen CIO accountability for IT costs, schedules, performance, and security  The guidance identifies a number of actions that agencies are to take to establish a basic set of roles and responsibilities (referred to as the common baseline) for CIOs and other senior agency officials; and thus, to implement the authorities described in the law  For example, agencies are to conduct a self-assessment and submit a plan describing the changes they intend to make to ensure that common baseline responsibilities are implemented  In addition, in August 2016, OMB released guidance intended to, among other things, define a framework for achieving the data center consolidation and optimization requirements of FITARA  The guidance directs agencies to develop a data center consolidation and optimization strategic plan that defines the agency’s data center strategy for fiscal years 2016, 2017, and 2018  This strategy is to include, among other things, a statement from the agency CIO indicating whether the agency has complied with all data center reporting requirements in FITARA  Further, the guidance indicates that OMB is to maintain a public dashboard to display consolidation-related costs savings and optimization performance information for the agencies  Congress has recognized the importance of agencies’ continued implementation of FITARA provisions, and has taken legislative action to extend selected provisions beyond their original dates of expiration  Specifically, Congress and the President enacted laws to: remove the expiration date for enhanced transparency and improved risk management provisions, which were set to expire in 2019; remove the expiration date for portfolio review, which was set to expire in 2019; and extend the expiration date for FDCCI from 2018 to 2020  In addition, Congress and the President enacted a law to authorize the availability of funding mechanisms to help further agencies’ efforts to modernize IT  The law, known as the Modernizing Government Technology (MGT) Act, authorizes agencies to establish working capital funds for use in transitioning from legacy IT systems, as well as for addressing evolving threats to information security  The law also creates the Technology Modernization Fund, within the Department of the Treasury, from which agencies can “borrow” money to retire and replace legacy systems, as well as acquire or develop systems  Further, in February 2018, OMB issued guidance for agencies to implement the MGT Act  The guidance was intended to provide agencies additional information regarding the Technology Modernization Fund, and the administration and funding of the related IT working capital funds  Specifically, the guidance allowed agencies to begin submitting initial project proposals for modernization on February 27, 2018  In addition, in accordance with the MGT Act, the guidance provides details regarding a Technology Modernization Board, which is to consist of (1) the Federal CIO; (2) a senior official from the General Services Administration; (3) a member of DHS’s National Protection and Program Directorate; and (4) four federal employees with technical expertise in IT development, financial management, cybersecurity and privacy, and acquisition, appointed by the Director of OMB  Congress and the President enacted the Federal Information Security Modernization Act of 2014 (FISMA) to improve federal cybersecurity and clarify government-wide responsibilities  The act addresses the increasing sophistication of cybersecurity attacks, promotes the use of automated security tools with the ability to continuously monitor and diagnose the security posture of federal agencies, and provides for improved oversight of federal agencies’ information security programs  Specifically, the act clarifies and assigns additional responsibilities to entities such as OMB, DHS, and the federal agencies  Table 1 describes a selection of OMB, DHS, and agency responsibilities  Beyond the implementation of FITARA, FISMA, and related actions, the current administration has also initiated other efforts intended to improve federal IT  Specifically, in March 2017, the administration established the Office of American Innovation, which has a mission to, among other things, make recommendations to the President on policies and plans aimed at improving federal government operations and services  In doing so, the office is to consult with both OMB and the Office of Science and Technology Policy on policies and plans intended to improve government operations and services, improve the quality of life for Americans, and spur job creation  In May 2017, the Administration also established the American Technology Council, which has a goal of helping to transform and modernize federal agency IT and how the federal government uses and delivers digital services  The President is the chairman of this council, and the Federal CIO and the United States Digital Service Administrator are among the members  In addition, on May 11, 2017, the President signed Executive Order 13800, Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure  This executive order outlined actions to enhance cybersecurity across federal agencies and critical infrastructure to improve the nation’s cyber posture and capabilities against cyber security threats  Among other things, the order tasked the Director of the American Technology Council to coordinate a report to the President from the Secretary of DHS, the Director of OMB, and the Administrator of the General Services Administration, in consultation with the Secretary of Commerce, regarding the modernization of federal IT  As a result, the Report to the President on Federal IT Modernization was issued on December 13, 2017, and outlined the current and envisioned state of federal IT  The report focused on modernization efforts to improve the security posture of federal IT and recognized that agencies have attempted to modernize systems but have been stymied by a variety of factors, including resource prioritization, ability to procure services quickly, and technical issues  The report provided multiple recommendations intended to address these issues through the modernization and consolidation of networks and the use of shared services to enable future network architectures  Further, in March 2018, the Administration issued the President’s Management Agenda, which lays out a long-term vision for modernizing the federal government  The agenda identifies three related drivers of transformation—IT modernization; data, accountability, and transparency; and the workforce of the future—that are intended to push change across the federal government  The Administration also established 14 related Cross-Agency Priority goals, many of which have elements that involve IT  In particular, the Cross-Agency Priority goal on IT modernization states that modern IT must function as the backbone of how government serves the public in the digital age and provides three priorities that are to guide the Administration’s efforts to modernize federal IT: (1) enhancing mission effectiveness by improving the quality and efficiency of critical services, including the increased utilization of cloud-based solutions; (2) reducing cybersecurity risks to the federal mission by leveraging current commercial capabilities and implementing cutting edge cybersecurity capabilities; and (3) building a modern IT workforce by recruiting, reskilling, and retaining professionals able to help drive modernization with up-to-date technology  Most recently, on May 15, 2018, the President signed Executive Order 13833, Enhancing the Effectiveness of Agency Chief Information Officers  Among other things, this executive order is intended to better position agencies to modernize their IT systems, execute IT programs more efficiently, and reduce cybersecurity risks  The order pertains to 22 of the 24 Chief Financial Officer Act agencies: the Department of Defense and the Nuclear Regulatory Commission are exempt  For the covered agencies, the executive order strengthens the role of agency CIOs by, among other things, requiring to report directly to their agency head; to serve as their agency head’s primary IT strategic advisor; and to have a significant role in all management, governance, and oversight processes related to IT  In addition, one of the cybersecurity requirements directs agencies to ensure that the CIO works closely with an integrated team of senior executives, including those with expertise in IT, security, and privacy, to implement appropriate risk management measures  In the February 2017 update to our high-risk series, we reported that agencies still needed to complete significant work related to the management of IT acquisitions and operations We stressed that OMB and federal agencies should continue to expeditiously implement FITARA and OMB’s related guidance, which include enhancing CIO authority, consolidating data centers, and acquiring and managing software licenses  Our update to this high-risk area also stressed that OMB and agencies needed to continue to implement our prior recommendations in order to improve their ability to effectively and efficiently invest in IT  Specifically, from fiscal years 2010 through 2015, we made 803 recommendations to OMB and federal agencies to address shortcomings in IT acquisitions and operations  In addition, in fiscal year 2016, we made 202 new recommendations, thus, further reinforcing the need for OMB and agencies to address the shortcomings in IT acquisitions and operations  As stated in the update, OMB and agencies should demonstrate government-wide progress in the management of IT investments by, among other things, implementing at least 80 percent of our recommendations related to managing IT acquisitions and operations within 4 years  As of May 2018, OMB and agencies had fully implemented 489 (or about 61 percent) of the 803 recommendations  Figure 1 summarizes the progress that OMB and agencies have made in addressing our recommendations as compared to the 80 percent target  Overall, federal agencies would be better positioned to realize billions in cost savings and additional management improvements if they address these recommendations, including those aimed at implementing CIO responsibilities, review of IT acquisitions; improving data center consolidation; and managing software licenses  In all, the various laws, such as FITARA, and related guidance assign 35 IT management responsibilities to CIOs in six key areas  These areas are: leadership and accountability, budgeting, information security, investment management, workforce, and strategic planning  In a draft report on CIO responsibilities that we have provided to the agencies for comment and plan to issue in June 2018, our preliminary results suggest that none of the 24 agencies we reviewed had policies that fully addressed the role of their CIO, as called for by federal laws and guidance  In this regard, a majority of the agencies fully or substantially addressed the role of their CIOs for the area of leadership and accountability  In addition, a majority of the agencies substantially or partially addressed the role of their CIOs for two areas: information security and IT budgeting  However, most agencies partially or minimally addressed the role of their CIOs for two areas: investment management and strategic planning  These preliminary results are shown in figure 2  Despite these shortfalls, most agency officials stated that their CIOs are implementing the responsibilities even if the agencies do not have policies requiring implementation  Nevertheless, the CIOs of the 24 selected agencies acknowledged in responses to a survey that we administered for our draft report that they were not always very effective in implementing the six IT management areas  Specifically, our preliminary results show that at least 10 of the CIOs indicated that they were less than very effective for each of the six areas of responsibility  We believe that until agencies fully address the role of CIOs in their policies, agencies will be limited in addressing longstanding IT management challenges  Figure 3 depicts that extent to which the CIOs reported their effectiveness in implementing the six areas of responsibility  Beyond the actions of the agencies, however, our preliminary results indicate that shortcomings in agencies’ policies also are partially attributable to two weaknesses in OMB’s FITARA implementation guidance  First, the guidance does not comprehensively address all CIO responsibilities, such as those related to assessing the extent to which personnel meet IT management knowledge and skill requirements, and ensuring that personnel are held accountable for complying with the information security program  Correspondingly, the majority of the agencies’ policies did not fully address nearly all of the responsibilities that were not included in OMB’s guidance  Second, OMB’s guidance does not ensure that CIOs have a significant role in (1) IT planning, programming, and budgeting decisions and (2) execution decisions and the management, governance, and oversight processes related to IT, as required by federal law and guidance  In the absence of comprehensive guidance, CIOs will not be positioned to effectively acquire, maintain, and secure their IT systems  Based on our preliminary results, 24 agency CIOs also identified a number of factors that enabled and challenged their ability to effectively manage IT  As shown in figure 4, five factors were identified by at least half of the 24 CIOs as major enablers and three factors were identified by at least half of the CIOs as major challenges  Specifically, most agency CIOs cited five factors as being enablers to effectively carry out their responsibilities: (1) NIST guidance, (2) the CIO’s position in the agency hierarchy, (3) OMB guidance, (4) coordination with the Chief Acquisition Officer (CAO), and (5) legal authority  Further, three factors were cited by CIOs as major factors that have challenged their ability to effectively carry out responsibilities: (1) processes for hiring, recruiting, and retaining IT personnel; (2) financial resources; and (3) the availability of personnel/staff resources  As our draft report states, although OMB has issued guidance aimed at addressing the three factors that were identified by at least half of the CIOs as major challenges, the guidance does not fully address those challenges  Further, regarding the financial resources challenge, OMB recently required agencies to provide data on CIO authority over IT spending; however, its guidance does not provide a complete definition of the authority  We believe that in the absence of such guidance, agencies have created varying definitions of CIO authority  Further, until OMB updates its guidance to include a complete definition of the authority that CIOs are to have over IT spending, it will be difficult for OMB to identify any deficiencies in this area and to help agencies make any needed improvements  In order to address challenges in implementing CIO responsibilities, we intend to include in our draft report recommendations to OMB and each of the selected 24 federal agencies to improve the effectiveness of CIOs’ implementation of their responsibilities for each of the six IT management areas  FITARA includes a provision to enhance covered agency CIOs’ authority through, among other things, requiring agency heads to ensure that CIOs review and approve IT contracts  OMB’s FITARA implementation guidance expanded upon this aspect of the legislation in a number of ways  Specifically, according to the guidance: CIOs may review and approve IT acquisition strategies and plans, rather than individual IT contracts; CIOs can designate other agency officials to act as their representatives, but the CIOs must retain accountability; CAOs are responsible for ensuring that all IT contract actions are consistent with CIO-approved acquisition strategies and plans; and CAOs are to indicate to the CIOs when planned acquisition strategies and acquisition plans include IT  In January 2018, we reported that most of the CIOs at 22 selected agencies were not adequately involved in reviewing billions of dollars of IT acquisitions  For instance, most of the 22 agencies did not identify all of their IT contracts  In this regard, the agencies identified 78,249 IT- related contracts, to which they obligated $14 7 billion in fiscal year 2016  However, we identified 31,493 additional contracts with $4 5 billion obligated, raising the total amount obligated by these agencies to IT contracts in fiscal year 2016 to at least $19 2 billion  Figure 5 reflects the obligations that the 22 selected agencies reported to us relative to the obligations we identified  The percentage of additional IT contract obligations we identified varied among the selected agencies  For example, the Department of State did not identify 1 percent of its IT contract obligations  Conversely, 8 agencies did not identify over 40 percent of their IT contract obligations  Many of the selected agencies that did not identify these IT contract obligations did not follow OMB guidance  Specifically, 14 of the 22 agencies did not involve the acquisition office in their process to identify IT acquisitions for CIO review, as required by OMB  In addition, 7 agencies did not establish guidance to aid officials in recognizing IT  We concluded that until these agencies involve the acquisitions office in their IT acquisition identification processes and establish supporting guidance, they cannot ensure that they will identify all IT acquisitions  Without proper identification of IT acquisitions, these agencies and CIOs cannot effectively provide oversight of these acquisitions  In addition to not identifying all IT contracts, 14 of the 22 selected agencies did not fully satisfy OMB’s requirement that the CIO review and approve IT acquisition plans or strategies  Further, only 11 of 96 randomly selected IT contracts at 10 agencies that we evaluated were CIO-reviewed and approved as required by OMB’s guidance  The 85 IT contracts not reviewed had a total possible value of approximately $23 8 billion  We believe that until agencies ensure that CIOs are able to review and approve all IT acquisitions, CIOs will continue to have limited visibility and input into their agencies’ planned IT expenditures and will not be able to use the increased authority that FITARA’s contract approval provision is intended to provide  Further, agencies will likely miss an opportunity to strengthen CIOs’ authority and the oversight of IT acquisitions  As a result, agencies may award IT contracts that are duplicative, wasteful, or poorly conceived  As a result of these findings, we made 39 recommendations in our January 2018 report  The recommendations included that agencies ensure that their acquisition offices are involved in identifying IT acquisitions and issuing related guidance, and that IT acquisitions are reviewed in accordance with OMB guidance  OMB and the majority of the agencies generally agreed with or did not comment on the recommendations  In our February 2017 high-risk update, we stated that OMB and agencies needed to demonstrate additional progress on achieving data center consolidation savings in order to improve the management of IT acquisitions and operations  Further, data center consolidation efforts are key to implementing FITARA  Specifically, OMB established the FDCCI in February 2010 to improve the efficiency, performance, and environmental footprint of federal data center activities  The enactment of FITARA in 2014 codified and expanded the initiative  In a series of reports that we issued from July 2011 through August 2017, we noted that, while data center consolidation could potentially save the federal government billions of dollars, weaknesses existed in several areas, including agencies’ data center consolidation plans, data center optimization, and OMB’s tracking and reporting on related cost savings  In these reports, we made a total of 160 recommendations to OMB and 24 agencies to improve the execution and oversight of the initiative  Most agencies and OMB agreed with our recommendations or had no comments  As of May 2018, 80 of these 160 recommendations remained unimplemented  Further, we recently reported in May 2018 that the 24 agencies participating in OMB’s Data Center Optimization Initiative (DCOI) had communicated mixed progress toward achieving OMB’s goals for closing data centers by September 2018  Over half of the agencies reported that they had either already met, or planned to meet, all of their OMB- assigned goals by the deadline  This would result in the closure of 7,221 of the 12,062 centers that agencies reported in August 2017  However, 4 agencies reported that they do not have plans to meet all of their assigned goals and 2 agencies are working with OMB to establish revised targets  With regard to agencies’ progress in achieving cost savings, 24 agencies reported $3 9 billion in cost savings through 2018  The 24 agencies also reported limited progress against OMB’s five data center optimization targets for server utilization and automated monitoring, energy metering, power usage effectiveness, facility utilization, and virtualization  As of August 2017, 1 agency reported that it had met four targets, 1 agency reported that it had met three targets, 6 agencies reported having met either one or two targets, and 14 agencies reported meeting none of the targets  Further, as of August 2017, most agencies were not planning to meet OMB’s fiscal year 2018 optimization targets  Specifically, 4 agencies reported plans to meet all of their applicable targets by the end of fiscal year 2018; 14 agencies reported plans to meet some of the targets; and 4 reported that they did not plan to meet any targets  Figure 6 summarizes agency-reported plans to meet or exceed the OMB’s data center optimization targets, as of August 2017  In 2016 and 2017, we made 81 recommendations to OMB and the 24 DCOI agencies to help improve the reporting of data center-related cost savings and to achieve optimization targets  As of May 2018, 71 of these 81 recommendations have not been fully addressed  In our 2015 high-risk report’s discussion of IT acquisitions and operations, we identified the management of software licenses as an area of concern, in part because of the potential for cost savings  Federal agencies engage in thousands of software licensing agreements annually  The objective of software license management is to manage, control, and protect an organization’s software assets  Effective management of these licenses can help avoid purchasing too many licenses, which can result in unused software, as well as too few licenses, which can result in noncompliance with license terms and cause the imposition of additional fees  As part of its PortfolioStat initiative, OMB has developed policy that addresses software licenses  This policy requires agencies to conduct an annual, agency-wide IT portfolio review to, among other things, reduce commodity IT spending  Such areas of spending could include software licenses  In May 2014, we reported on federal agencies’ management of software licenses and determined that better management was needed to achieve significant savings government-wide  Of the 24 selected agencies we reviewed, only 2 had comprehensive policies that included the establishment of clear roles and central oversight authority for managing enterprise software license agreements, among other things  Of the remaining 22 agencies, 18 had policies that were not comprehensive, and 4 had not developed any policies  Further, we found that only 2 of the 24 selected agencies had established comprehensive software license inventories, a leading practice that would help them to adequately manage their software licenses  The inadequate implementation of this and other leading practices in software license management was partially due to weaknesses in agencies’ policies  As a result, we concluded that agencies’ oversight of software license spending was limited or lacking, thus potentially leading to missed savings  However, the potential savings could be significant considering that, in fiscal year 2012, 1 major federal agency reported saving approximately $181 million by consolidating its enterprise license agreements, even when its oversight process was ad hoc  Accordingly, we recommended that OMB issue a directive to help guide agencies in managing software licenses  We also made 135 recommendations to the 24 agencies to improve their policies and practices for managing licenses  Among other things, we recommended that the agencies regularly track and maintain a comprehensive inventory of software licenses and analyze the inventory to identify opportunities to reduce costs and better inform investment decision making  Most agencies generally agreed with the recommendations or had no comments  As of May 2018, 78 of the 135 recommendations had not been implemented  Table 2 reflects the extent to which the 24 agencies implemented the recommendations in these two areas  Since information security was added to the high-risk list in 1997, we have consistently identified shortcomings in the federal government’s approach to cybersecurity  We have previously testified that, even though agencies have acted to improve the protections over federal and critical infrastructure information and information systems, the federal government needs to take the following actions to strengthen U S  cybersecurity: Effectively implement risk-based entity-wide information security programs consistently over time  Among other things, agencies need to (1) implement sustainable processes for securely configuring operating systems, applications, workstations, servers, and network devices; (2) patch vulnerable systems and replace unsupported software; (3) develop comprehensive security test and evaluation procedures and conduct examinations on a regular and recurring basis; and (4) strengthen oversight of contractors providing IT services  Improve its cyber incident detection, response, and mitigation capabilities  DHS needs to expand the capabilities and support wider adoption of its government-wide intrusion detection and prevention system  In addition, the federal government needs to improve cyber incident response practices, update guidance on reporting data breaches, and develop consistent responses to breaches of personally identifiable information  Expand its cyber workforce planning and training efforts  The federal government needs to (1) enhance efforts for recruiting and retaining a qualified cybersecurity workforce and (2) improve cybersecurity workforce planning activities  Expand efforts to strengthen cybersecurity of the nation’s critical infrastructures  The federal government needs to develop metrics to (1) assess the effectiveness of efforts promoting the National Institute of Standards and Technology’s (NIST) Framework for Improving Critical Infrastructure Cybersecurity and (2) measure and report on the effectiveness of cyber risk mitigation activities and the cybersecurity posture of critical infrastructure sectors  Better oversee protection of personally identifiable information  The federal government needs to (1) protect the security and privacy of electronic health information, (2) ensure privacy when face recognition systems are used, and (3) protect the privacy of users’ data on state-based health insurance marketplaces  As we have previously noted, in order to take the preceding actions and strengthen the federal government’s cybersecurity posture, agencies should implement the information security programs required by FISMA  In this regard, FISMA provides a framework for ensuring the effectiveness of information security controls for federal information resources  The law requires each agency to develop, document, and implement an agency- wide information security program  Such a program includes risk assessments; the development and implementation of policies and procedures to cost-effectively reduce risks; plans for providing adequate information security for networks, facilities, and systems; security awareness and specialized training; the testing and evaluation of the effectiveness of controls; the planning, implementation, evaluation, and documentation of remedial actions to address information security deficiencies; procedures for detecting, reporting, and responding to security incidents; and plans and procedures to ensure continuity of operations  Since 2010, we have made 2,733 recommendations to agencies aimed at improving the security of federal systems and information  These recommendations have identified actions for agencies to take to strengthen technical security controls over their computer networks and systems  They also have included recommendations for agencies to fully implement aspects of their information security programs, as mandated by FISMA  Nevertheless, many agencies continue to be challenged in safeguarding their information systems and information, in part because many of these recommendations have not been implemented  As of May 2018, 793 of information security-related recommendations we have made have not been implemented  In order to determine the effectiveness of the agencies’ information security programs and practices, FISMA requires that federal agencies’ inspectors general conduct annual independent evaluations  The agencies are to report the results of these evaluations to OMB, and OMB is to summarize the results in annual reports to Congress  In these evaluations, the inspectors general frame the scope of their analysis, identify key findings, and detail recommendations to address the findings  The evaluations also are to capture maturity model ratings for their respective agencies  Toward this end, in fiscal year 2017, the inspector general community, in partnership with OMB and DHS, finalized a 3-year effort to create a maturity model for FISMA metrics that align to the five function areas in the NIST Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework): identify, protect, detect, respond, and recover  This alignment is intended to help promote consistent and comparable metrics and criteria and provides agencies with a meaningful independent assessment of their information security programs  This maturity model is designed to summarize the status of agencies’ information security programs on a five-level capability maturity scale  The five maturity levels are defined as follows: Level 1 Ad-hoc: Policies, procedures, and strategy are not formalized; activities are performed in an ad-hoc, reactive manner  Level 2 Defined: Policies, procedures, and strategy are formalized and documented but not consistently implemented  Level 3 Consistently Implemented: Policies, procedures, and strategy are consistently implemented, but quantitative and qualitative effectiveness measures are lacking  Level 4 Managed and Measurable: Quantitative and qualitative measures on the effectiveness of policies, procedures, and strategy are collected across the organizations and used to assess them and make necessary changes  Level 5 Optimized: Policies, procedures, and strategy are fully institutionalized, repeatable, self-generating, consistently implemented and regularly updated based on a changing threat and technology landscape and business/mission needs  In March 2018, OMB issued its annual FISMA report to Congress, which showed the combined results of the inspectors general’s fiscal year 2017 evaluations  Based on data from 76 agency inspector general and independent auditor assessments, OMB determined that the government-wide median maturity model ratings across the five NIST Cybersecurity Framework areas did not exceed a level 3 (consistently implemented)  Table 3 shows the inspectors general’s median ratings for each of the NIST Cybersecurity Framework areas  In its efforts toward strengthening the federal government’s cybersecurity, OMB also requires agencies to submit related cybersecurity metrics as part of its Cross-Agency Priority goals  In particular, OMB developed the IT modernization goal so that federal agencies will be able to build and maintain more modern, secure, and resilient IT  A key part of this goal is to reduce cybersecurity risks to the federal mission through three strategies: manage asset security, protect networks and data, and limit personnel access  The key targets supporting each of these strategies correspond to areas within the FISMA metrics  Table 4 outlines the strategies and their associated targets  In conclusion, FITARA and FISMA present opportunities for the federal government to address the high-risk areas on improving the management of IT acquisitions and operations, and ensuring the security of federal IT, thereby saving billions of dollars  Most agencies have taken steps to execute key IT management and cybersecurity initiatives, including implementing CIO responsibilities, requiring CIO review of IT acquisitions, realizing data center consolidation cost savings, managing software assets, and complying with FISMA requirements  The agencies have also continued to address the recommendations that we have made over the past several years  However, further efforts by OMB and federal agencies to implement our previous recommendations would better position them to improve the management and security of federal IT  To help ensure that these efforts succeed, we will continue to monitor agencies’ efforts toward implementing these recommendations  Chairmen Meadows and Hurd, Ranking Members Connolly and Kelly, and Members of the Subcommittees, this completes my prepared statement  I would be pleased to respond to any questions that you may have at this time  If you or your staff have any questions about this testimony, please contact David A  Powner, Director, Information Technology, at (202) 512- 9286 or pownerd@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement  GAO staff who made key contributions to this testimony are Kevin Walsh (Assistant Director), Chris Businsky, Rebecca Eyler, Meredith Raymond, and Jessica Waselkow (Analyst in Charge)  This is a work of the U S  government and is not subject to copyright protection in the United States  The published product may be reproduced and distributed in its entirety without further permission from GAO  However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately 


Report 2:  The national limits were set at a percentage (74%) of the median of all local fee schedule amounts for each laboratory test code; therefore, fee schedule amounts may differ by region  In general, annual increases in clinical lab fees have been based on the percentage change in the CPI-U  However, since 1987, Congress has specified lower updates  Beginning in 2014, with certain exceptions, laboratory tests provided in hospital outpatient departments are no longer paid separately under the CLFS and are instead included in the OPPS payments  PAMA introduced a new method for determining clinical laboratory payments and required CMS to base Medicare CLFS reimbursement on reported private insurance payment amounts  Medicare has been using weighted median private insurer rates to calculate Medicare payment rates for laboratory tests paid under the CLFS since January 1, 2018  These payment rates are national and do not vary by geographic area  Part B also covers diagnostic nonlaboratory x-ray tests and other diagnostic tests, as well as x-ray, radium, and radioisotope therapy  Generally, these services are paid for under the physician fee schedule, with beneficiaries responsible for a 20% coinsurance payment  Medicare covers a wide variety of equipment and devices under the heading of durable medical equipment (DME), prosthetics, and orthotics (PO) if they are medically necessary and are prescribed by a physician  DME is defined as equipment that (1) can withstand repeated use, (2) has an expected life of at least three years (effective for items classified as DME after January 1, 2012), (3) is used primarily to serve a medical purpose, (4) is not generally useful in the absence of an illness or injury, and (5) is appropriate for use in the home  DME includes such items as hospital beds, wheelchairs, blood glucose monitors, and oxygen and oxygen equipment  It also includes related supplies (S), such as drugs and biologics that are necessary for the effective use of the product  Prosthetics (P) are items that replace all or part of a body organ or its function, such as colostomy bags, pacemakers, and artificial eyes, arms, or legs  Orthotics (O) are braces that support a weak or deformed body member, such as leg or back braces  Except in competitive bidding areas (CBAs, described below), Medicare pays for most durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) based on fee schedules  Medicare pays 80% of the lower of the supplier's charge for the item or the fee schedule amount  The beneficiary is responsible for the remaining 20%  In general, fee schedule amounts are updated each year by a (1) measure of price inflation, and (2) a measure of economy-wide productivity, which may result in lower fee schedule amounts from one year to the next  Since 2016, the fee schedule rates that applied outside of competitive bidding areas for certain DMEPOS have been reduced based on price information from the competitive bidding program  The reductions were phased in during 2016, and fully phased in starting in January 2017  In response to concerns that the adjusted rates were too low, the Secretary again applied the phase-in rate for rural and noncontiguous areas not subject to competitive bidding starting in June 2018  Currently, two different fee schedules apply outside of CBAs  First, in rural or noncontiguous areas, the fee schedule is a 50/50 blend of the fee schedule with and without the reductions based on information from competitive bidding (i e , the phase-in methodology)  Second, in nonrural and contiguous areas, the fee schedule amounts are fully adjusted by information from the competitive bidding program  Numerous studies and investigations indicated that Medicare paid more for certain items of DME and PO than some other health insurers and some retail outlets  Such overpayments were attributed, in part, to the fee schedule mechanism of payment  MMA required the Secretary to establish a Competitive Acquisition Program for certain DMEPOS in specified areas  Instead of paying for medical equipment based on a fee schedule established by law, payment for items in competitive bidding areas was based on the supplier bids  The program started in 9 metropolitan areas in January 2011 and had expanded to 130 competitive bidding areas in 2018  However, the program has been suspended while a new bidding methodology is established  During the gap, the payments for previously competitively bid items in competitive bidding areas will be the amounts that applied on December 31, 2018, increased, yearly, by a measure of inflation  Certain specified outpatient prescription drugs and biologics are covered under Medicare Part B  (However, most outpatient prescription drugs are covered under Part D, discussed below ) Covered Part B drugs and biologics include drugs furnished incident to physician services, immunosuppressive drugs following a Medicare-covered organ transplant, erythropoietin for treatment of anemia for individuals with ESRD when not part of the ESRD composite rate, oral anticancer drugs (provided they have the same active ingredients and are used for the same indications as chemotherapy drugs that would be covered if furnished incident to physician services), certain vaccines under selected conditions, and drugs administered through DME  Generally, Medicare reimburses physicians and other providers, such as hospital outpatient clinics, for covered Part B drugs and biologics at 106% of the volume weighted average sales price of all drugs billed under the same billing code, although some Part B drugs, such as those administered through DME, are reimbursed at 95% of the drug's average wholesale price  Health care providers also are paid separately for administering Medicare Part B drugs  Medicare pays 80% of the amount paid to providers, and beneficiaries are responsible for the remaining 20%  A hospital outpatient is a person who has not been admitted by the hospital as an inpatient but is registered on the hospital records as an outpatient  Generally, payments under the hospital outpatient prospective payment system (OPPS) cover the operating and capital-related costs that are directly related and integral to performing a procedure or furnishing a service on an outpatient basis  These payments cover services such as the use of an operating suite, treatment, procedure, or recovery room; use of an observation bed as well as anesthesia; certain drugs or pharmaceuticals; incidental services; and other necessary or implantable supplies or services  Payments for services such as those provided by physicians and other professionals as well as therapy and clinical diagnostic laboratory services, among others, are separate  Under the OPPS, the unit of payment for acute care hospitals is the individual service or procedure as assigned to an ambulatory payment classification (APC)  To the extent possible, integral services and items (excluding physician services paid under the physician fee schedule) are bundled within each APC  Specified new technologies are assigned to "new technology APCs" until clinical and cost data are available to permit assignment into a "clinical APC " Medicare's hospital outpatient payment is calculated by multiplying the relative weight associated with an APC by a conversion factor  For most APCs, 60% of the conversion factor is geographically adjusted by the wage index used for the inpatient prospective payment system  Except for new technology APCs, each APC has a relative weight that is based on the median cost of services in that APC  The OPPS also includes pass-through payments for new technologies (specific drugs, biologicals, and devices) and payments for outliers  The Medicare Payment Advisory Commission (MedPAC) has recommended site-neutral payment policies that base payments on the resources needed to provide high-quality care in the most efficient setting  The Bipartisan Budget Act of 2015 (BBA 15; P L  114-74 ) gave CMS the authority to add new restrictions on Medicare payments for services furnished in provider-based off-campus hospital outpatient departments (HOPDs) to address discrepancies between payments under the MPFS and the OPPS for similar services  In its 2019 OPPS Final Rule, CMS explicitly applies the site-neutral policy to clinic visits, the most commonly billed service in hospital outpatient departments  An ambulatory surgical center (ASC) is a distinct entity that furnishes outpatient surgical procedures to patients who do not require an overnight stay after the procedure  According to MedPAC, most ASCs are freestanding facilities rather than part of a larger facility, such as a hospital  Medicare covers surgical and medical services performed in an ambulatory surgical center that are (1) commonly performed on an inpatient basis but may be safely performed in an ASC; (2) not of a type that are commonly performed or that may be safely performed in physicians' offices; (3) limited to procedures requiring a dedicated operating room or suite and generally requiring a postoperative recovery room or short-term (not overnight) convalescent room; and (4) not otherwise excluded from Medicare coverage  Medicare pays for surgery-related facility services provided in ASCs using a prospective payment system based on the OPPS  (Associated physician fees are paid for separately under the physician fee schedule ) Each of the approximately 3,500 procedures approved for payment in an ASC is classified into an APC group on the basis of clinical and cost similarity  The ASC system primarily uses the same payment groups as the OPPS; however, ASC payment rates are generally lower  The ASC weights are scaled (reduced) to account for the different mix of services in an ASC, and the ASC conversion factor (the base payment amount) is lower  A different payment method is used to set ASC payment for office-based procedures, separately payable radiology services, separately payable drugs, and device-intensive procedures  In addition, separate payments are made for certain ancillary items and services when they are integral to surgical procedures, including corneal tissue acquisition, brachytherapy sources, certain radiology services, many drugs, and certain implantable devices  The application of the site-neutral payment policy to clinic visits also affects such payments to ASCs (see discussion above)  Medicare Part B covers emergency and nonemergency ambulance services to or from a hospital, a critical access hospital, a skilled nursing facility, or a dialysis facility for End-Stage Renal Disease (ESRD) beneficiaries who require dialysis when other modes of transportation could endanger the Medicare beneficiary's health  In most cases, the program covers 80% of the allowed amount for the service, and the beneficiary is responsible for the remaining 20%  Generally, ambulance services are covered if (1) transportation of the beneficiary occurs; (2) the beneficiary is taken to an appropriate location (generally, the closest appropriate facility); (3) the ambulance service is medically necessary (other forms of transportation are contraindicated); (4) the ambulance provider or supplier meets state licensing requirements; and (5) the transportation is not part of a Medicare Part A covered stay  Medicare covers both scheduled and nonscheduled nonemergency transports if the beneficiary is bed-confined or meets other medical necessity criteria  Medicare may also cover emergency ambulance transportation by airplane or helicopter if the beneficiary's location is not easily reached by ground transportation or if long distance or obstacles, such as heavy traffic, would prevent the individual from obtaining needed care  Medicare pays for ambulance services according to a national fee schedule  The fee schedule establishes seven categories of ground ambulance services and two categories of air ambulance services  Medicare pays for different levels of ambulance services, which reflect the staff training and equipment required to meet the patient's medical condition or health needs  Generally, basic life support is provided by emergency medical technicians (EMTs)  Advanced life support is provided by EMTs with advanced training or by paramedics  Some rural ground and air ambulance services may qualify for increased payments  Also, ambulance providers that are CAHs, or that are entities that are owned and operated by a CAH, are paid on a reasonable-cost basis rather than the fee schedule if they are the only ambulance provider within a 35-mile radius  Medicare covers Part B services in rural health clinics (RHCs) and federally qualified health centers (FQHCs) provided by (1) physicians and specified nonphysician practitioners; (2) visiting nurses for homebound patients in home health shortage areas; (3) registered dieticians or nutritional professionals for diabetes training and medical nutrition therapy; and (4) others, as well as certain drugs administered by a physician or nonphysician practitioner  RHCs are paid based on an "all-inclusive" cost-based rate per beneficiary visit subject to a per visit upper limit, adjusted annually for inflation  For cost-reporting periods that began on or after October 1, 2014, FQHCs are paid a base payment rate per visit (with a limit, in most cases, of one billable visit per day) under a PPS methodology  Each FQHC's PPS rate is adjusted based on the location where the service is furnished using geographic adjustment factors, which are the geographic practice cost indices (GPCI) used in Medicare's physician fee schedule (MPFS)  This rate is increased by 34% for new patients (those not seen in the FQHC organization within the past three years)  The 34% increase also applies when a beneficiary receives a comprehensive initial Medicare visit (an initial preventive physician examination or an initial annual wellness visit) or a subsequent annual wellness visit  Effective January 1, 2017, the FQHC PPS base rate is updated annually using an FQHC-specific market basket  Medicare's payment to the FQHC is equal to 80% of the lesser of the adjusted PPS rate or the FQHC's actual charges associated with the visit, and the beneficiary is responsible for a 20% coinsurance  Medicare Advantage (MA) is an alternative way for Medicare beneficiaries to receive covered benefits  Under MA, private health plans are paid a per-person amount to provide all Medicare covered benefits (except hospice) to beneficiaries who enroll in their plan  Medicare beneficiaries who are eligible for Part A, enrolled in Part B, and do not have ESRD are eligible to enroll in an MA plan if one is available in their area  Some MA plans may choose their service area (local MA plans), while others agree to serve one or more regions defined by the Secretary (regional MA plans)  In 2019, nearly all Medicare beneficiaries have access to an MA plan and approximately a third of beneficiaries are enrolled in one  Private plans may use different techniques to influence the medical care used by enrollees  Some plans, such as health maintenance organizations (HMOs), may require enrollees to receive care from a restricted network of medical providers; enrollees may be required to see a primary care physician who will coordinate their care and refer them to specialists as necessary  Other types of private plans, such as private fee-for-service (PFFS) plans, may look more like original Medicare, with fewer restrictions on the providers an enrollee can see and minimal coordination of care  In general, MA plans offer additional benefits or require smaller co-payments or deductibles than original Medicare  Sometimes beneficiaries pay for these additional benefits through a higher monthly premium, but sometimes they are financed through plan savings  The extent of extra benefits and reduced cost sharing varies by plan type and geography  However, MA plans are seen by some beneficiaries as an attractive alternative to more expensive supplemental insurance policies found in the private market  By contract with CMS, a plan agrees to provide all required services covered in return for a capitated monthly payment adjusted for the demographics and health history of their enrollees  The same monthly payment is made regardless of how many or few services a beneficiary actually uses  In general, the plan is at-risk if costs, in the aggregate, exceed program payments; conversely, the plan can retain savings if aggregate costs are less than payments  Payments to MA plans are based on a comparison of each plan's estimated cost of providing Medicare covered services (a bid) relative to the maximum amount the federal government will pay for providing those services in the plan's service area (a benchmark)  If a plan's bid is less than the benchmark, its payment equals its bid plus a rebate  The size of the rebate is dependent on plan quality and ranges from 50% to 70% of the difference between the bid and the benchmark  The rebate must be returned to enrollees in the form of additional benefits, reduced cost sharing, reduced Part B or Part D premiums, or some combination of these options  If a plan's bid is equal to or above the benchmark, its payment will be the benchmark amount and each enrollee in that plan will pay an additional premium, equal to the amount by which the bid exceeds the benchmark  The MA benchmarks are determined through statutorily specified formulas that have changed over time  Since BBA 97, formulas have increased the benchmark amounts, in part, to encourage plan participation in all areas of the country  As a result, however, the benchmark amounts (and plan payments) in some areas have been higher than the average cost of original FFS Medicare  The ACA changed the way benchmarks are calculated by tying them closer to (or below) spending in FFS Medicare, and adjusting them based on plan quality  In a recent analysis, MedPAC found that "over the past few years, plan bids and payments have come down in relation to FFS spending while MA enrollment continues to grow  The pressure of lower benchmarks has led to improved efficiencies and more competitive bids that enable MA plans to continue to increase enrollment by offering benefits that beneficiaries find attractive " In 2006, the MA program began to offer MA regional plans  Regional MA plans must agree to serve one or more regions designated by the Secretary  There are 26 MA regions consisting of states or groups of states  Regional plan benchmarks include two components: (1) a statutorily determined amount (comparable to benchmarks described above) and (2) a weighted average of plan bids  Thus, a portion of the benchmark is competitively determined  Similar to local plans, plans with bids below the benchmark are given a rebate, while plans with bids above the benchmark require an additional enrollee premium  In general, MA eligible individuals may enroll in any MA plan that serves their area  However, some MA plans may restrict their enrollment to beneficiaries who meet additional criteria  For example, employer-sponsored MA plans are generally only available to the retirees of the company sponsoring the plan  In addition, Medicare Special Needs Plans (SNPs) are a type of coordinated care MA plan that exclusively enrolls, or enrolls a disproportionate percentage of, special needs individuals  Special needs individuals are any MA eligible individuals who are either institutionalized as defined by the Secretary, eligible for both Medicare and Medicaid, or have a severe or disabling chronic condition and would benefit from enrollment in a specialized MA plan  Medicare Part D provides coverage of outpatient prescription drugs to Medicare beneficiaries who choose to enroll in this optional benefit  (As previously discussed, Part B provides limited coverage of some outpatient prescription drugs ) In 2019, about 47 million (about 77%) of eligible Medicare beneficiaries are estimated to be enrolled in a Part D plan  Prescription drug coverage is provided through private prescription drug plans (PDPs), which offer only prescription drug coverage, or through Medicare Advantage prescription drug plans (MA-PDs), which offer prescription drug coverage that is integrated with the health care coverage they provide to Medicare beneficiaries under Part C  Plans must meet certain minimum requirements; however, there are significant variations among them in benefit design, including differences in premiums, drugs included on plan formularies, and cost sharing for particular drugs  Part D prescription drug plans are required to offer either "standard coverage" or alternative coverage that has actuarially equivalent benefits  In 2019, "standard coverage" has a $415 deductible and a 25% coinsurance for costs between $415 and $3,820  From this point, there is reduced coverage until the beneficiary has out-of-pocket costs of $5,100 (an estimated $8,139 54 in total spending); this coverage gap has been labeled the "doughnut hole " Once the beneficiary reaches the catastrophic limit, the program pays all costs except for the greater of 5% coinsurance or $3 40 for a generic drug and $8 50 for a brand-name drug  As required by the ACA, in 2010, Medicare sent a tax-free, one-time $250 rebate check to each Part D enrollee who reached the doughnut hole  Additionally, starting in 2011, the coverage gap is being gradually reduced each year  Under the ACA, the coverage gap for both brand-name and generic drugs was to be eliminated in 2020, but Congress moved up the date to 2019 for brand-name drugs as part of BBA 18  In 2019, a 70% discount is provided by drug manufacturers and Medicare pays an additional 5% of the cost of brand-name drugs dispensed during the coverage gap  In 2019, Medicare also pays 63% of the cost of generic drugs dispensed during the coverage gap and enrollees pay 37%  (See Figure 2  ) By 2020, through a combination of manufacturer discounts and increased Medicare coverage, Part D enrollees will be responsible for 25% of the costs for brand-name and generic drugs in the coverage gap (the same as during the initial coverage period)  Most plans offer actuarially equivalent benefits rather than the standard package, including alternatives such as reducing or eliminating the deductible, or using tiered cost sharing with lower cost sharing for generic drugs  Medicare's payments to plans are determined through a competitive bidding process, and enrollee premiums are tied to plan bids  Plans are paid a risk-adjusted monthly per capita amount based on their bids during a given plan year  Part D plan sponsors determine payments for drugs and are expected to negotiate prices  The federal government is prohibited from interfering in the price negotiations between drug manufacturers, pharmacies, and plans (the so-called "non-interference clause")  Part D also provides enhanced coverage for low-income enrolled individuals, such as persons who previously received drug benefits under Medicaid (known as "dual eligibles"—enrollees in both Medicare and Medicaid)  Additionally, certain persons who do not qualify for Medicaid, but whose incomes are below 150% of poverty, may also receive assistance for some portion of their premium and cost-sharing charges  The MMA included significant incentives for employers to continue to offer coverage to their retirees by providing a 28% federal subsidy  In 2019, the maximum potential subsidy per covered retiree is $2,264 for employers or unions offering drug coverage that is at least actuarially equivalent (called "creditable" coverage) to standard coverage  Employers or unions may select an alternative option (instead of taking the subsidy) with respect to Part D, such as electing to pay a portion of the Part D premiums  They may also elect to provide enhanced coverage, though this has some financial consequences for the employer or union  Alternatively, employers or unions may contract with a PDP or MA-PD to offer the coverage or become a Part D plan sponsor themselves for their retirees  A variety of public and private entities are involved in carrying out Medicare administrative and oversight functions  CMS, an agency within HHS, has primary operational responsibilities  Such responsibilities include managing program finances, developing policies and regulations, setting payment rates, and developing the program's information-technology infrastructure  CMS conducts its activities through its headquarters and 10 regional offices  The Social Security Administration, however, enrolls beneficiaries into the program and issues Medicare beneficiary cards  CMS also contracts with various private entities, including private health insurance companies, to help administer the program  For example, Medicare Administrative Contractors (MACs) process and pay Parts A and B reimbursement claims, enroll providers and suppliers, educate providers and suppliers on billing requirements, support appeal processes, and answer provider and supplier inquiries through call centers, as well as other activities  Qualified Independent Contractors (QICs) perform second-level reviews on appeals initially reviewed by MACs  Medicare's quality assurance activities are primarily handled by State Survey Agencies and Quality Improvement Organizations (QIOs), which operate in all states and the District of Columbia, Puerto Rico, and the U S  Virgin Islands  The State Survey Agencies are responsible for inspecting Medicare provider facilities (e g , nursing homes, home health agencies, and hospitals) to ensure that they are in compliance with federal safety and quality standards referred to as Conditions (or Requirements) of Participation  Alternatively, some types of providers, including hospitals, may receive certification through private accrediting agencies, such as the Joint Commission  QIOs are mostly private, not-for-profit organizations that monitor the quality of care delivered to Medicare beneficiaries and educate providers on the latest quality-improvement techniques  Medicare program integrity activities, such as audits, provider education, medical review, and predictive data analysis, also are carried out by a variety of government and private entities  For example, the Center for Program Integrity within CMS works together with the U S  Department of Justice (DOJ) and the HHS Office of Inspector General (OIG) to identify and prevent fraud, waste, and abuse in Medicare  CMS also works with private contractors to carry out certain program-integrity functions  Unified Program Integrity Contractors (UPICs) perform integrity-related activities including data analysis to identify potentially fraudulent claims (bills) for Medicare Parts A and B, home health and hospice services, and DME  Similarly, the National Benefit Integrity Medicare Drug Integrity Contractor (MEDIC) is responsible for identifying and investigating fraud, waste, and abuse in Medicare Advantage and Part D  When appropriate, the UPICs and MEDIC work with and refer cases to law enforcement, including OIG and DOJ  In addition, Recovery Audit Contractors (RACs) are responsible for identifying improper Medicare payments, including both underpayments and overpayments, and for recouping any overpayments made to providers  Each year, the Comprehensive Error Rate Testing (CERT) program quantifies a national improper Medicare payment rate by examining a random sample of claims  In turn, the Supplemental Medical Review Contractor targets medical reviews in areas where OIG, RACs, and CERT have identified vulnerabilities and/or questionable billing patterns to identify ways to lower improper payment rates  As required by the ACA, the Center for Medicare and Medicaid Innovation (CMMI) was established in January 2011 to test and evaluate innovative payment and service delivery models to reduce program expenditures under Medicare  Examples of these models include providing payment incentives for groups of doctors, hospitals, and other health care providers (Accountable Care Organizations, or ACOs) to coordinate the services they provide to Medicare beneficiaries; bundling payments for services provided in different settings during a beneficiary's episode of care; and reimbursing health providers based on the quality of care rather than on the volume of services  CMMI also plays an important role in developing and implementing the new physician payment models required by MACRA  Medicare beneficiary education and outreach duties are shared between CMS and the Social Security Administration  Each year, CMS mails out a "Medicare and You" handbook to beneficiaries, which provides information on their benefits for the upcoming year  Additional educational materials and responses to frequently asked questions may be found on the CMS-maintained "Medicare gov" website, and beneficiaries may call a CMS-operated 1-800 number for assistance with specific questions and help with selecting and enrolling in a Medicare Advantage and/or Part D plan  A Medicare beneficiary ombudsman is also available to provide assistance to Medicare consumers with their complaints, grievances, and requests  The Social Security Administration is responsible for notifying low-income Medicare beneficiaries about programs that may be able to assist them with their medical and prescription drug expenses  The Social Security Administration also provides general Medicare eligibility and enrollment information on its webpage and on Social Security benefit statements  Finally, CMS partners with community-based organizations, such as State Health Insurance Assistance Programs, in every state to provide educational resources and personalized assistance to Medicare beneficiaries  Medicare's financial operations are accounted for through two trust funds maintained by the Department of the Treasury—the Hospital Insurance (HI) trust fund for Part A and the Supplementary Medical Insurance (SMI) trust fund for Parts B and D  For beneficiaries enrolled in Medicare Advantage (Part C), payments are made on their behalf in appropriate portions from the HI and SMI trust funds  HI is primarily funded by payroll taxes, while SMI is primarily funded through general revenue transfers and premiums  (See Figure 3  ) The HI and SMI trust funds are overseen by a Board of Trustees that provides annual reports to Congress  The trust funds are accounting mechanisms  Income to the trust funds is credited to the fund in the form of interest-bearing government securities  Expenditures for services and administrative costs are recorded against the fund  These securities represent obligations that the government has issued to itself  As long as a trust fund has a balance, the Department of the Treasury is authorized to make payments for it from the U S  Treasury  Medicare expenditures are primarily paid for through mandatory spending—generally Medicare pays for all covered health care services provided to beneficiaries  Aside from certain constraints in HI described below, the program is not subject to spending limits  Additionally, most Medicare expenditures (aside from premiums paid by beneficiaries) are paid for by current workers through income taxes and dedicated Medicare payroll taxes, that is, current income is used to pay current expenditures  Medicare taxes paid by current workers are not set aside to cover their future Medicare expenses  The primary source of funding for Part A is payroll taxes paid by employees and employers  Each pays a tax of 1 45% on the employee's earnings; the self-employed pay 2 9%  Beginning in 2013, some higher-income employees pay higher payroll taxes  Unlike Social Security, there is no upper limit on earnings subject to the tax  Other sources of income include (1) interest on federal securities held by the trust fund, (2) a portion of federal income taxes that individuals pay on their Social Security benefits, and (3) premiums paid by voluntary enrollees who are not automatically entitled to Medicare Part A  Income for Part A is credited to the HI trust fund  Part A expenditures for CY2019 are estimated to reach approximately $330 billion  Revenue to the trust fund is expected to consist of about $285 billion in payroll tax income and another $38 billion in interest and other income  The Medicare Trustees project that in CY2019, the HI trust fund will incur a deficit of approximately $7 billion  As long as the HI trust fund has a balance, the Treasury Department is authorized to make payments for Medicare Part A services  To date, the HI trust fund has never run out of money (i e , become insolvent), and there are no provisions in the Social Security Act that govern what would happen if that were to occur  Part A expenditures exceeded HI income each year from 2008 through 2015, and the assets credited to the trust fund were drawn down to make up the deficit in those years  Although the HI trust fund accumulated small surpluses in 2016 and 2017, the Medicare Trustees estimate that, beginning in 2018, expenditures will outpace income in all future years, and project that the HI trust fund will become insolvent in 2026 (i e , the balance of the trust fund will reach $0)  At that time there would no longer be sufficient funds to fully cover Part A expenditures  Medicare Part B is financed primarily from federal general revenues and from beneficiary premiums, which are set at 25% of estimated per capita program costs for the aged  (The disabled pay the same premium as the aged ) Income for Part B is credited to the SMI trust fund  Total spending for Part B is estimated to reach about $368 billion in CY2019, with premiums financing about $98 billion of that amount and general revenues financing most of the rest  Most beneficiaries who enroll in Medicare Part B pay a monthly premium  Individuals receiving Social Security benefits have their Part B premium payments automatically deducted from their Social Security benefit checks  Due to a "hold-harmless" provision in the Social Security Act, an individual's Social Security check cannot decrease from one year to the next as a result of the annual Part B premium increase (except in the case of higher-income individuals subject to income-related premiums)  The 2019 monthly Part B premium is $135 50  However, about 3 5% of Medicare enrollees are protected by the hold-harmless provision and pay lower premium amounts because the dollar amount of the 2019 cost-of-living increase in their Social Security benefits was not sufficient to cover the full premium increase  Since 2007, higher-income Part B enrollees have paid higher premiums  In 2019, individuals whose modified adjusted gross income (AGI) exceeds $85,000 and each member of a couple filing jointly whose modified AGI exceeds $170,000 are subject to higher premium amounts  These higher-income premiums range from 35% to 85% of the value of Part B and affect about 5% of Medicare enrollees  (See Appendix B for 2019 Part B premiums and high-income thresholds ) Payments for spending under the Medicare Advantage program are made in appropriate portions from the HI and SMI trust funds  There is no separate trust fund for Part C  Medicare Part D is financed through a combination of beneficiary premiums and federal general revenues  In addition, certain transfers are made from the states  These transfers, referred to as "clawback payments," represent a portion of the amounts states could otherwise have been expected to pay for drugs under Medicaid if drug coverage for the dual eligible population had not been transferred to Part D  Part D revenues are credited to a separate Part D account within the SMI trust fund  In CY2019, total spending for Part D is estimated to reach approximately $98 billion, with about $71 billion of that amount paid for by general revenues, $16 billion from beneficiary premiums, and $12 billion from state transfers  In 2019, the base beneficiary premium is $33 19; however, beneficiaries pay different premiums depending on the plan they have selected and whether they are entitled to low-income premium subsidies  Additionally, beginning in 2011, higher income Part D enrollees pay higher premiums  (The income thresholds are the same as for Part B, as described above ) On average, beneficiary premiums are set at 25 5% of expected total Part D costs for basic coverage  The Budget Control Act of 2011 (BCA; P L  112-25 ) provided for increases in the debt limit and established procedures designed to reduce the federal budget deficit, including the creation of a Joint Select Committee on Deficit Reduction  The failure of the Joint Committee to propose deficit reduction legislation by its mandated deadline triggered automatic spending reductions ("sequestration" of mandatory spending and reductions in discretionary spending) in fiscal years 2013 through 2021  The American Taxpayer Relief Act of 2012 (ATRA; P L  112-240 ) delayed the automatic reductions by two months, while the Bipartisan Budget Act of 2013 (BBA; P L  113-67 ) extended sequestration for mandatory spending for an additional two years—through FY2023  In 2014, the President signed into law an amended version of S  25 ( P L  113-82 ), which included a provision to extend BCA's sequester of mandatory spending through FY2024  BBA 15 extended the sequestration of mandatory spending another year, through FY2025  Most recently, BBA 18 extended the BCA mandatory spending sequester through FY2027  Section 256(d) of the Balanced Budget and Emergency Deficit Control Act of 1985 (BBEDCA; P L  99-177 ) contains special rules for the Medicare program in the event of a sequestration  Among other things, it specifies that for Medicare, sequestration is to begin the month after the sequestration order has been issued  Therefore, as the sequestration order was issued March 2013, Medicare sequestration began April 1, 2013, and will continue through March 31, 2028  Under sequestration, Medicare's benefit structure generally remains unchanged; however, benefit related payments are subject to 2% reductions  In other words, most Medicare payments to health care providers, as well as to MA and Part D plans, are being reduced by 2%  Certain Medicare payments are exempt from sequestration and therefore not reduced  These exemptions include (1) Part D low-income subsidies, (2) the Part D catastrophic subsidy, and (3) Qualified Individual (QI) premiums  Some non-benefit related Medicare expenses, such as administrative and operational spending, are subject to higher reductions, 6 2% in 2019  While Medicare provides broad protection against the costs of many, primarily acute care, services, the program does not cover all services that may be used by its aged and disabled beneficiaries  In general, Medicare does not cover eyeglasses, hearing aids, dentures, or most long-term care services  Further, unlike most private insurance policies, it does not include an annual "catastrophic" cap on out-of-pocket spending on cost-sharing charges for services covered under Parts A and B (except for persons enrolled in Medicare Advantage plans)  Most Medicare beneficiaries have some coverage in addition to Medicare  The following are the main sources of additional coverage for Medicare enrollees: Medicare Advantage  Many MA plans offer services in addition to those covered under original Medicare, reduced cost sharing, or reduced Part B or D premiums  All MA plans have a catastrophic cap  Employer Coverage  Coverage may be provided through a current or former employer  In recent years, a number of employers have cut back on the scope of retiree coverage  Some have dropped such coverage entirely, particularly for future retirees  As noted earlier, the MMA attempted to stem this trend, at least for prescription drug coverage, by offering subsidies to employers who offer drug coverage, at least as good as that available under Part D  Medigap  Individual insurance policies that supplement fee-for-service Medicare are referred to as Medigap policies  Beneficiaries with Medigap insurance typically have coverage for a portion of Medicare's deductibles and coinsurance; they may also have coverage for some items and services not covered by Medicare  Individuals select from a set of standardized plans, though not all plans are offered in all states  Medicaid  Certain low-income Medicare beneficiaries also may be eligible for full or partial benefits under their state's Medicaid program  Individuals eligible for both Medicare and Medicaid are referred to as dual eligibles  The lowest-income dual eligibles qualify for full Medicaid benefits, so that the majority of their health care expenses are paid by either Medicare or Medicaid; Medicare pays first, with Medicaid picking up most of the remaining costs  In addition to full-benefit dual eligibles, state Medicaid programs pay Medicare premiums and some cost sharing for other partial dual eligibles, who have higher income than full-benefit dual eligibles but are still considered to have low income  Other Public Sources  Individuals may have additional coverage through the Department of Veterans Affairs, or TRICARE for military retirees eligible for Medicare (and enrolled in Part B)  In 2015, about 87% of Medicare beneficiaries had some form of additional coverage  Some persons may have had more than one type of additional coverage  Appendix A  Abbreviations Appendix B  2019 Medicare Beneficiary Costs

ground_truth: Medicare is a federal program that pays for covered health care services of qualified beneficiaries. It was established in 1965 under Title XVIII of the Social Security Act to provide health insurance to individuals 65 and older, and has been expanded over the years to include permanently disabled individuals under the age of 65. Medicare, which consists of four parts (A-D), covers hospitalizations, physician services, prescription drugs, skilled nursing facility care, home health visits, and hospice care, among other services. Generally, individuals are eligible for Medicare if they or their spouse worked for at least 40 quarters in Medicare-covered employment, are 65 years old, and are a citizen or permanent resident of the United States. Individuals may also qualify for coverage if they are a younger person who cannot work because they have a medical condition that is expected to last at least one year or result in death, or have end-stage renal disease (permanent kidney failure requiring dialysis or transplant). The program is administered by the Centers for Medicare & Medicaid Services (CMS) within the Department of Health and Human Services (HHS) and by private entities that contract with CMS to provide claims processing, auditing, and quality oversight services. In FY2019, the program is expected to cover approximately 61 million persons (52 million aged and 9 million disabled) at a total cost of about $772 billion. Spending under the program (except for a portion of administrative costs) is considered mandatory spending and is not subject to the annual appropriations process. Services provided under Parts A and B (also referred to as "original" or "traditional" Medicare) are generally paid directly by the government on a "fee-for-service" basis, using different prospective payment systems or fee schedules. Under Parts C and D, private insurers are paid a monthly "capitated" amount to provide enrollees with required benefits. Medicare is required to pay for all covered services provided to eligible persons, so long as specific criteria are met. Since 1965, the Medicare program has undergone considerable change. For example, during the 111th Congress, the Patient Protection and Affordable Care Act (ACA; P.L. 111-148 and P.L. 111-152) made numerous changes to the Medicare program that modified provider reimbursements, provided incentives to increase the quality and efficiency of care, and enhanced certain Medicare benefits. In the 114th Congress, the Medicare Access and CHIP Reauthorization Act of 2015 (MACRA; P.L. 114-10) changed the method for calculating updates to Medicare payment rates to physicians and altered how physicians and other practitioners will be paid in the future. Projections of future Medicare expenditures and funding indicate that the program will place increasing financial demands on the federal budget and on beneficiaries. For example, the Hospital Insurance (Part A) trust fund is projected to become insolvent in 2026. Additionally, although the Supplementary Medical Insurance (Parts B and D) trust fund is financed in large part through federal general revenues and cannot become insolvent, associated spending growth is expected to put increasing strains on the country's competing spending priorities. As such, Medicare is expected to be a high-priority issue in the current Congress, and Congress may consider a variety of Medicare reform options ranging from further modifications of provider payment mechanisms to redesigning the entire program. This report provides a general overview of the Medicare program including descriptions of the program's history, eligibility criteria, covered services, provider payment systems, and program administration and financing. A list of commonly used acronyms, as well as information on beneficiary cost sharing, may be found in the appendixes.