prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.



Report 2: Medicare pays for laboratory tests that are performed individually or in a group  For individual tests, laboratories submit claims to Medicare for each test they perform that is on the CLFS; tests are identified using a billing code  Prior to the implementation of PAMA in 2018, the payment rates on the CLFS were based on rates charged for laboratory tests in 1984 through 1985 adjusted for inflation  Additionally, 57 geographic jurisdictions had their own fee schedules for laboratory tests  CMS used the 57 separate fee schedules to calculate a national limitation amount, which served as the maximum payment for individual laboratory tests  Thus, the payment rate for an individual test was the lesser of the amount claimed by the laboratory, the local fee for a geographic area, or the national limitation amount for a particular test  Medicare pays bundled payment rates for certain laboratory tests that are performed as a group, called panel tests  Panel tests can be divided into two categories—those without billing codes and those with billing codes  Panel tests without billing codes are composed of at least 2 of 23 distinct component tests  Additionally, there are 7 specific combinations of these 23 component tests that are commonly used and have their own billing code  Prior to 2018, Medicare paid for both types of panel tests (those without or with a billing code) using a bundled rate based on the number of tests performed, with modest payment increases for each additional test conducted  For example, in 2017, Medicare paid $7 15 for panel tests with two component tests and $9 12 for panel tests with 3 component tests, with a maximum bundled payment rate of $16 64 for all 23 component tests  Prior to 2018, the Medicare Administrative Contractors would count the number of tests performed before determining the appropriate bundled payment rate  For those panel tests with a billing code, the payment rate was the same if laboratories used the associated billing code for the panel test or listed each of the component tests separately  After PAMA’s implementation in 2018, the 57 separate fee schedules for individual laboratory tests were replaced with a single national fee schedule  The payment rates for this single national fee schedule were based on private-payer rates for laboratory tests paid from January 1, 2016 through June 30, 2016  Specifically, the payment rate for an individual test was generally based on the median private-payer rates for a given test, weighted by test volume  Payment for panel tests also changed in 2018  For panel tests without billing codes, Medicare Administrative Contractors no longer counted the number of component tests performed to determine the bundled payment rate; instead, Medicare paid the separate rate for each component test in the panel  For panel tests with a billing code, the payment rate depended on how the laboratory submitted the claim  If a laboratory used the billing code associated with the panel test, Medicare paid the bundled payment rate for that billing code  If a laboratory submitted a claim for the panel test, but listed each of the component tests separately instead of using the panel test’s billing code, Medicare paid the individual payment rate for each component test  Table 1 below summarizes the changes to payment rates before and after 2018  Multiple types of laboratories receive payment under Medicare  The three laboratory types that received the most revenue from the CLFS in 2016 were independent laboratories, hospital-outreach laboratories, and physician-office laboratories  (See table 2 ) Estimates of the size of the total U S  laboratory market vary  For example, the Healthcare Fraud Prevention Partnership estimated that the laboratory industry received $87 billion in revenue in 2017, while another market report estimated the laboratory industry received $75 billion in revenue in 2016  Similar to Medicare, the three laboratory types that generally receive the most revenue overall are independent laboratories, hospital-outreach laboratories, and physician-office laboratories, when laboratory tests performed in hospital inpatient and outpatient settings were excluded  Estimates of revenue received by these laboratories also vary  For example, in recent years, estimates of the share of laboratory industry revenue generated by independent laboratories ranged from 37 percent to 54 percent  Additionally, estimates of revenue generated by hospital- outreach laboratories recently ranged from 21 to 35 percent, and physician-office laboratories ranged from 4 to 11 percent of total laboratory industry revenue  Private-payer rates for laboratory tests conducted by the three largest laboratory types generally vary by type and other characteristics, according to market reports and the laboratory industry officials we interviewed  Independent laboratories  These laboratories generally receive lower private-payer rates than other types of laboratories, according to industry officials we interviewed  Market reports we reviewed noted that about half of the independent laboratory market is dominated by two national laboratories and that these national laboratories provide more competitive pricing by performing a large volume of tests at one time  Medicare accounted for a smaller proportion of the revenue earned by these two national laboratories (12 percent), compared to other laboratories, according to another market report we reviewed  In contrast, a different market report noted that smaller, independent laboratories tend to earn more of their revenue from Medicare (34 percent)  Hospital-outreach laboratories  These hospital-affiliated laboratories typically receive relatively higher private-payer rates, according to industry officials we interviewed  Although hospital- outreach laboratories perform tests similar to other laboratories, they can obtain above-average payment rates by leveraging the market power of their affiliated hospital when negotiating rates with private payers, according to industry officials and market reports  Hospital-outreach laboratories generally receive about 25 to 30 percent of their revenue from the Medicare CLFS  Physician-office laboratories  Physician-office laboratories typically receive higher private-payer rates than independent laboratories, according to a recent analysis by a laboratory industry association  This industry association also noted that the cost structure to operate in a setting such as a physician-office laboratory is different than in large independent laboratories, as the physician-office laboratory is unable to conduct a large number of tests at one time  Officials from another industry association we interviewed said that payment rates for these laboratories are generally dependent on the size of the physician practice group  These same officials told us that larger physician groups (e g , 10 or more physicians) typically negotiate higher rates from private payers than smaller physician groups  Most physician-office laboratories received less than $25,000 in revenue per year from Medicare, according to CMS  Additionally, in 2013, the Department of Health and Human Services Office of Inspector General found that Medicare’s payment rates on the CLFS were higher than rates paid by some private health insurance plans  Specifically, it found that Medicare rates for laboratory tests were 18 percent to 30 percent higher than rates paid by certain insurers under health benefits plans for federal employees  Definition of Applicable Laboratories Required to Report Private-Payer Data to CMS CMS defined applicable laboratories as those meeting four criteria: (1) they met the definition of laboratory under regulations implementing the Clinical Laboratory Improvement Amendments of 1988; (2) they billed Medicare Part B under their own Medicare billing number, also called the national provider identifier; (3) more than 50 percent of their total Medicare revenues came from the Clinical Laboratory Fee Schedule (CLFS) and/or the Physician Fee Schedule; and (4) they received at least $12,500 in Medicare revenue from the CLFS from January 1, 2016, through June 30, 2016  CMS analyzed private-payer data it collected from about 2,000 laboratories to develop new payment rates for individual laboratory tests on the CLFS  PAMA defined laboratories required to report private-payer data, called applicable laboratories, as laboratories that meet certain criteria  (See sidebar ) Applicable laboratories with their own specific billing number, the NPI, submitted these data to CMS  If one organization operated multiple applicable laboratories, each with its own NPI, then the organization could report data to CMS for multiple applicable laboratories  CMS collected data from applicable laboratories on payments they received from private payers during the first half of 2016  Specifically, CMS collected data on (1) the unique billing code associated with a laboratory test; (2) the private-payer rate for each laboratory test for which final payment was made during the data collection period (January 1, 2016, through June 30, 2016); and (3) the volume of tests performed for each unique billing code at that private- payer rate  For the data CMS collected between January 1, 2017, and May 30, 2017, CMS relied on the entities reporting to CMS to attest to the completeness and accuracy of the data they submitted  CMS relied on each laboratory to identify whether or not it was an applicable laboratory and took steps to assist laboratories in meeting reporting requirements  According to CMS officials, they relied on laboratories to self-identify as applicable laboratories because they were unable to accurately identify the number of laboratories required to report  To assist laboratories, CMS issued multiple guidance documents to the industry outlining the criteria for being an applicable laboratory and describing the type of data CMS intended to collect  CMS also conducted educational calls when the proposed and final rules were issued and prior to the data collection period  CMS officials told us they conducted additional outreach activities, including holding conference calls with national laboratory associations and attending professional conferences  Officials said they used these outreach activities in addition to the guidance issued to inform laboratories of the reporting requirements for applicable laboratories, for example  In addition, CMS established a revenue threshold of $12,500 in an effort to reduce the reporting burden for entities that receive a relatively small amount of revenues under the CLFS  In its final rule, CMS noted that it expected that many of the laboratories that would be below this revenue threshold and, thus exempt from reporting data to CMS, would be physician-office laboratories  CMS also chose to use the NPI in its definition of applicable laboratory in the final rule to allow hospital- outreach laboratories that use their own NPI to submit data to the agency  In its proposed rule, CMS suggested using an alternative identification number to the NPI  However, according to the final rule, CMS chose to use the NPI in its definition of applicable laboratory to allow those hospital-outreach laboratories billing using their own NPI to submit private-payer data to the agency  According to CMS, at the end of the 5-month submission period, the agency had received data from approximately 2,000 applicable laboratories, representing a volume of almost 248 million laboratory tests; these data accounted for about $31 billion in revenue from private payers  CMS reported that the data it collected included private-payer rates for 96 percent of the 1,347 eligible billing codes on the CLFS  CMS used these data to calculate a median, private-payer rate, weighted by volume and phased in this change by limiting payment-rate reductions to 10 percent per year  Beginning in 2018, these new payment rates served as the single, national payment rate for individual laboratory tests  These payment rates were also used for the individual, component tests that make up panel tests and were used when laboratories billed Medicare for panel tests by listing the component tests separately  In general, the median payments rates, weighted for volume, that CMS calculated were lower than Medicare’s previous payment rates for most laboratory tests  According to our analysis, these median payment rates were lower than the corresponding 2017 CLFS national limitation amounts (the maximum that CMS would pay for laboratory tests) for approximately 88 percent of tests  Figure 1 below describes the percentage difference between these median payment rates and Medicare’s 2017 national limitation amounts for laboratory tests  The final payment rates that CMS calculated, which included the 10- percent, phased in, payment-rate reductions, will remain in effect until December 31, 2020; PAMA requires CMS to calculate new payment rates for the CLFS every 3 years  Reporting entities will next be required to submit data on private-payer rates to CMS in early 2020, for final payments made from January 1, 2019 through June 30, 2019  PAMA capped any reductions for the second 3-year cycle after implementation to a maximum of 15 percent per year  CMS did not collect private-payer data from all laboratories required to report this information and did not estimate how much data was not reported by these laboratories, according to agency officials  CMS relied on laboratories to determine whether they met data reporting requirements and submit data accordingly  CMS emphasized the importance of receiving data from all laboratories required to report by stating that it is critical that CMS collect complete data on private-payer rates in order to set accurate Medicare rates  However, agency officials told us that CMS did not receive data from all laboratories required to report  They also told us that CMS did not have the information available to estimate how much data was missing because not all laboratories reported or the extent to which the data collected were representative of all of the data that laboratories were required to report  Prior to collecting private-payer data, CMS estimated that laboratories subject to reporting requirements would receive more than 90 percent of CLFS expenditures to physician-office laboratories and independent laboratories  Specifically, based on its analysis of 2013 Medicare expenditures, CMS estimated that reporting requirements would apply to the laboratories that received 92 percent of CLFS payments to physician- office laboratories and 99 percent of CLFS payments to independent laboratories  After laboratories reported private-payer data, we analyzed the share of CLFS expenditures received by the laboratories that reported  Our analysis found that CMS collected data from laboratories that received the majority of CLFS payments to physician-office, independent, and other non-hospital laboratories in 2016  However, the laboratories that reported private-payer data received less than 70 percent of CLFS expenditures to physician-office, independent, and other non-hospital laboratories  Specifically, using Medicare claims data, we calculated that CMS collected data from laboratories that received 68 percent of 2016 CLFS payments to physician-office, independent, and other non-hospital laboratories  Although it did not collect complete data, CMS concluded that it collected sufficient private-payer data to set Medicare payment rates and that collecting more data from additional laboratories that were required to report would not significantly affect Medicare expenditures  This conclusion was based, in part, on a sensitivity analyses that CMS conducted of the effects that collecting certain types and amounts of additional data would have on weighted median private-payer rates and the effects those rates could have on Medicare payment rates and, thus, expenditures  Results from these analyses showed that Medicare expenditures based on the CLFS would have changed by 2 percent or less after collecting more data from the various types of laboratories  For example, CMS estimated that doubling the amount of private-payer data from physician-office laboratories would increase expenditures by 2 percent and collecting ten times as much data from hospital outreach laboratories would increase expenditures by 1 percent  (See fig  2 ) PAMA’s 10-percent limit on annual payment-rate reductions likely reduced the effect that incomplete private-payer data could have on the CLFS because this limit applied to most Medicare payment rates for laboratory tests  As demonstrated in figure 1, while 59 percent of tests had median private-payer rates that were at least 30 percent less than their respective 2017 national limitation amounts, CMS published Medicare rates for these tests for 2018 through 2020 that were reduced by only 10 percent per year as a result of this limit  For example, a hypothetical laboratory test with a 2017 CLFS national limitation amount of $10 00 and a median private-payer rate of $7 00 would result in CLFS rates of $9 00 in 2018, $8 10 in 2019, and $7 29 in 2020  Changes to median private-payer rates due to collecting more complete data or eliminating inaccurate data would have no effect on Medicare payment rates from 2018 through 2020 for this hypothetical test if they resulted in new median rates of $7 29 or less  Our analysis of the potential effects that collecting data from additional laboratories could have had on Medicare payment rates and expenditures found that the effect of CMS not collecting complete data would likely have been greater absent PAMA’s limits on annual reductions to Medicare payment rates  As a result, CMS may face challenges setting accurate Medicare rates if it does not collect complete data from all laboratories required to report in the future when PAMA allows for greater annual payment-rate reductions  To conduct this analysis, we used the private-payer data CMS collected to analyze the range of effects that collecting additional data could have on Medicare expenditures, assuming 2016 utilization rates remain constant  The extent of these effects depends on the amount of additional data CMS would need to collect to obtain complete data and whether the payment rates in these additional data would have been greater or less than the medians of the rates reported  For example, we estimated that if CMS needed to collect 20 percent more data for its collection to be complete, doing so could increase Medicare CLFS expenditures from 2018 through 2020 by as much as 3 percent or reduce them by as much as 3 percent depending on the payment rates in these additional data  However, if annual limits to Medicare payment-rate reductions were not applied, collecting these additional data could increase CLFS expenditures by as much as 9 percent or reduce them by as much as 9 percent  (See fig  3 and app  II for additional information about these estimates ) As demonstrated in figure 2, CMS did analyze how collecting certain types and amounts of data from additional laboratories would affect Medicare expenditures  However, without valid estimates of how much more data these additional laboratories were required to report and how much these data would change median payment rates, it remains unknown whether CMS’s analyses estimate the actual risk of setting Medicare payment rates that do not reflect private-payer rates from all applicable laboratories, as mandated by PAMA  CMS could have compared the data it collected with independent information on the payment rates laboratories were required to report, for example  The independent information could be estimated by auditing a random sample of laboratories or could be estimated using data from third-party vendors, if these vendors could supply relevant and reliable information  We found that CMS mitigated challenges to setting accurate Medicare payment rates by identifying, analyzing, and responding to potentially inaccurate private-payer data  CMS addressed potentially inaccurate private-payer data and other data that CMS determined did not meet reporting requirements  CMS removed or replaced data from four reporting entities that appeared to have or confirmed having reported revenue—which is the payment rate multiplied by the volume of tests paid at that rate—instead of payment rates  We estimated that if CMS had included these data that CLFS expenditures from 2018 through 2020 would have increased by 7 percent  CMS removed data it determined were reported in error including duplicate submissions and submissions with payment rates of $0 00  We estimated that removing these data will change CLFS expenditures from 2018 through 2020 by less than one percent  CMS identified four other types of potentially inaccurate data that it determined would not significantly impact Medicare payment rates or expenditures and did not exclude them from calculations of median private-payer rates  CMS considered the following potentially inaccurate data to have met its reporting requirements: 1  data from 57 entities that reported particularly high rates in at least 60 percent of their data, 2  data from 12 entities that reported particularly low rates in at least 50 percent of their data, 3  data with payment rates that were 10 times greater than the 2017 national limitation amounts or 10 times less than these amounts, and 4  data from laboratories that may not have met the $12,500 low- expenditure threshold or that reported data from a hospital NPI instead of a laboratory NPI
Report 2:  In addition, HHS has data that could be useful for tracking progress in these areas (see table 1)  However, HHS has not adopted specific performance measures with targets specifying the magnitude of the increases HHS hopes to achieve through its efforts to expand access to MAT, and by when  For example, HHS has not established a long-term target specifying the percentage increase in the number of prescriptions for buprenorphine HHS would like to achieve, which would help to show whether efforts by HHS and others are resulting in sufficient progress in increasing prescriptions for this MAT medication  HHS has also not chosen a specific method of measuring treatment capacity or established targets associated with it, which would help to show whether a sufficient number of providers are becoming available to evaluate and treat patients who may benefit from MAT  Without specifying these performance measures and associated targets, HHS will not have an effective means to determine whether its efforts are helping to expand access to MAT  The lack of such performance measures with associated targets is inconsistent with federal internal control standards that specify that management should define objectives and evaluate results  According to these standards, using performance information such as performance measures can help agencies monitor results and determine progress in meeting program goals  In the context of HHS’s efforts to expand access to MAT, establishing appropriate performance measures with associated targets would allow HHS to determine whether its efforts are making sufficient progress or whether they need to be improved  Gauging this progress is particularly important, given the large nationwide MAT treatment gap identified in 2015 between the total number of individuals who could benefit from MAT and the limited number who can access it based on provider availability  This gap was estimated at nearly 1 million people as of 2012, and according to HHS officials and other stakeholders, lack of providers continues to be a challenge  Until HHS establishes performance measures with associated targets for the factors related to access to MAT, the department will be unable to evaluate its progress expanding access to MAT for opioid use disorders  In addition, as of August 2017, HHS has not finalized its approach for the planned evaluation activities, including timeframes  ASPE officials said that timeframes for a finalized evaluation approach had not been established because they were still working with RTI to finalize the evaluation approach given the new leadership priorities  When we spoke with the officials, they provided us with a draft evaluation schedule that covered the contract period ending September 2018  As of October 2017, HHS had not provided a finalized evaluation approach or schedule  Federal internal controls call for management to establish and operate monitoring activities and evaluate results  Without an implementation timeframe for the evaluation’s activities, HHS increases the risk that its evaluation of its agencies’ efforts will not be completed as expeditiously as possible, including an evaluation of HHS’s efforts to expand access to MAT  Officials from selected state health departments and behavioral health agencies, private health insurers, and national associations reported using several different efforts to help expand patients’ access to MAT for opioid use disorders  All of the stakeholders we interviewed reported conducting outreach efforts to communicate information about the importance of MAT and how to access it, or providing training to educate providers on prescribing MAT medications  Efforts by states  State health officials we spoke to described several planned or ongoing efforts to expand access to MAT, some of which are supported by federal funding, including federal grant programs  Officials from all five selected states told us that they are offering outreach to and training for providers to help expand access to MAT  For example, several state officials told us that they are promoting training to (1) encourage physicians to obtain authorization (DATA 2000 waivers) to prescribe buprenorphine and (2) encourage physicians with waivers to treat patients up to their patient limit or to request a higher patient limit  According to the stakeholders, all five selected states have implemented or are planning to implement a health care delivery model or approach that will expand access to MAT  Specifically, these models or approaches focus on integrating the use of MAT into primary care settings  For example, health officials from three states described use of a hub-and-spoke model  This model generally involves centralized intake and initial management of patients at a “hub” (e g , an OTP) and then connecting these patients to community providers at “spokes” (e g , primary care clinics) for ongoing care, with ongoing support provided by the hub as needed  Additionally, officials from two states described offering remote MAT-related consultations through telehealth that connects patients in rural areas with addiction specialists  According to a 2017 Healthcare Fraud Prevention and Partnership whitepaper, telehealth expands the reach of the addiction professional workforce and the existing pool of MAT providers, and it supports remote forms of behavioral therapy to make trained professionals more accessible to those in underserved or isolated communities  Officials from three states described focusing their MAT expansion efforts in various settings, such as in the criminal justice setting and emergency room departments  State health officials from four of the five states told us that programs in their states are using peer specialists (individuals who have successfully recovered from substance abuse disorders) in emergency rooms and other settings to engage with addicted patients and refer them to addiction specialists or behavioral health counselors  Officials from the selected states said that some of these and other efforts are funded through federal sources, such as MAT expansion grants awarded by SAMHSA, or with state funds to the extent they are available  Efforts by private health insurers  Officials from private health insurers reported that they are expanding access to MAT through outreach or training for providers and through the following three efforts: Eliminating the need for prior authorization to prescribe MAT medications  Officials from three insurers reported removing prior authorization requirements for MAT medications, thereby making it easier for patients to access needed MAT medications more readily, rather than undergoing a waiting period for approval to receive the medications  Other private health insurers told us that they continue to require prior authorization, intended for safety reasons and to reduce drug misuse, and officials from one insurer told us that they will allow a patient to access a limited amount of MAT medications for a period of 24 to 72 hours while making a determination about the appropriate treatment services for the patient  Modifying health benefit coverage  Officials from one private health insurance plan told us that the company is redesigning the benefit coverage for methadone and has removed member copays  This effort is intended to make MAT medications more affordable and allow members who are not able to use buprenorphine to have an alternative, such as methadone, that is not cost-prohibitive  Incentivizing providers and health insurance plan members to use MAT  Officials from four private health insurance plans described plans to offer incentives to providers or patients to use MAT  For example, officials from three health plans stated that they are offering alternative payment models or paying higher rates to providers that offer MAT, and another private health insurer is offering incentives to its members who are enrolled in behavioral health programs that provide access to MAT  Efforts by national associations  Officials we interviewed from the national associations—including the American Society of Addiction Medicine, the National Governors Association, and the Association of State and Territorial Health Officials—told us that they are helping to expand access to MAT through outreach and training for their members and by developing tools and resource guides for their members  An official from one association told us that it shares federal grant announcements, including those that are focused on expanding access to MAT, with its members  Officials from another association said it provides training to providers on how to appropriately prescribe MAT medications  In addition, officials from one association told us that they developed an opioid-related road map that identifies examples of strategies—including MAT—that state policymakers can use in their ongoing efforts to address the opioid epidemic  Examples of strategies include reducing the stigma associated with MAT through educating the public and potential providers  Another strategy in the road map is changing payment policies to expand access to MAT services, such as ensuring that Medicaid and other state health programs adequately cover all MAT medications and behavioral interventions and encouraging or requiring commercial health plans to adopt similar policies  HHS funds grant programs and has taken other steps to expand access to MAT, which has been shown to be effective in reducing the prevalence of opioid use disorders and with them, the likelihood of drug overdoses  HHS’s Opioid Initiative began in 2015, and the grants that support it are ongoing, so it is likely too early to determine how effective HHS’s efforts have been in expanding access to MAT and in meeting HHS’s other priorities related to addressing the opioid epidemic  According to HHS, access to MAT can be measured in terms of the number of prescriptions for MAT and by the treatment capacities of OTPs and practitioners who are authorized to prescribe buprenorphine  Our review suggests, however, that HHS may not be ready to perform this evaluation  While HHS told us that it may evaluate the effectiveness of its efforts in the future, the department has not established performance measures with targets that would specify the results that HHS hopes to achieve through its efforts, and by when  Furthermore, HHS has not established timeframes for the activities that will make up its planned evaluation of whether HHS’s efforts have been implemented as intended  Without performance measures with targets and evaluation timeframes, HHS increases the risk that the evaluation will not be completed in a timely manner or that HHS will not know whether its MAT- related efforts are successful or whether new approaches are needed  The evaluation is particularly important, given the hundreds of millions of dollars HHS has invested in its MAT-related grant programs  We are making the following two recommendations to HHS  The Assistant Secretary for Planning and Evaluation should establish performance measures with targets related to expanding access to MAT for opioid use disorders  (Recommendation 1) The Assistant Secretary for Planning and Evaluation should establish timeframes in its evaluation approach that specify when its evaluation of efforts to expand access to MAT will be implemented and completed  (Recommendation 2) We provided a draft of this report to HHS for review, and HHS provided written comments, which are reprinted in appendix II  HHS also provided technical comments, which we incorporated as appropriate  In its written comments, HHS concurred with both of our recommendations  Specifically, for our first recommendation to establish performance measures with targets related to expanding access to MAT for opioid use disorders, HHS stated that developing such measures is appropriate and that the department will continue to work to develop robust performance measures, including measures related to MAT, as part of its overall Opioid Strategy, which includes the department’s most recent efforts to address the opioid epidemic  For our second recommendation to establish timeframes in its evaluation approach that specify when its evaluation of efforts to expand access to MAT will be implemented and completed, HHS agreed that timeframes are important to any evaluation  HHS noted that its evaluation is being conducted under a 2-year contract that is scheduled to end in September 2018  HHS has also provided us with a draft evaluation schedule  We clarified in our report, however, that HHS has not yet provided a finalized approach for the planned evaluation or a finalized schedule establishing timeframes for the activities that will make up the evaluation  Until it finalizes its evaluation approach and establishes related timeframes, HHS increases the risk that it will not complete its planned evaluation by September 2018  We are sending copies of this report to the HHS, and appropriate congressional committees  In addition, the report will be available at no charge on the GAO website at http://www gao gov  If you or your staff have questions about this report, please contact me at (202) 512-7114 or curdae@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  Major contributors to this report are listed in appendix III  According to the Department of Health and Human Services, a diversion control plan is a set of documented procedures intended to reduce the possibility that controlled substances will be transferred or used illicitly  Opioid treatment programs (OTPs) and practitioners who prescribe buprenorphine at the highest patient level through a Drug Addiction Treatment Act of 2000 (DATA 2000) waiver are required to have these plans  OTPs are programs that may administer or dispense medication- assisted treatment (MAT) for people diagnosed with an opioid use disorder, including the use of methadone and buprenorphine  In addition, under a DATA 2000 waiver, practitioners may prescribe buprenorphine for patients, up to a 30-, 100-, or 275 patient limit  An OTP must maintain a current diversion control plan that contains specific measures to reduce the possibility of diversion of controlled substances from legitimate treatment use  Per federal guidelines, the goal of the diversion control plan is to reduce the scope and significance of diversion and its impact on communities  The guidelines state that each OTP’s diversion control plan should make every effort to balance diversion control against the therapeutic needs of the individual patient  They also state that diversion control plans should address at least four general areas of concern: program environment, dosing and take-home medication, prevention of multiple program enrollment, and prescription medication misuse  The guidelines include details about each of these areas: Program environment: Diversion in the program environment can be deterred and detected by regular surveillance and the monitoring of areas in and around the program, where opportunities for diversion may exist  A visible human presence at a program’s location gives community members the opportunity to approach staff with concerns and communicates the program’s commitment to assuring a safe environment and a positive impact on the surrounding community  Dosing and take-home medication: In the area of dosing and take- home medication, diversion control encompasses careful control of inventory, attentive patient dosing, and close supervision of take- home medication  Observing a patient take his or her dose and having each of them drink and speak after dosing are fundamental components of diversion control  Take-home dosing should be provided with careful attention to regulatory compliance and the therapeutic benefit and safety these regulations are meant to promote  Prevention of multiple program enrollment: Reasonable measures should be taken to prevent patients from enrolling in treatment provided by more than one clinic or individual practitioner  An OTP, after obtaining patient consent, may contact other OTPs within a reasonable geographic distance (100 miles) to verify that a patient is not enrolled in another OTP  Misuse of prescription medication: The misuse of prescription medication has become an area of great concern nationally and impacts diversion control planning at OTPs  All OTP physicians and other healthcare providers, as permitted, should register to use their respective state’s prescription drug monitoring program (PDMP) and query it for each newly admitted patient prior to initiating dosing  The PDMP should be checked periodically (for example, quarterly) through the course of each individual’s treatment and, in particular, before ordering take-home doses as well as at other important clinical decision points  SAMHSA’s best-practice guidelines for using buprenorphine for treating opioid use disorders include multiple references to diversion, including monitoring for diversion, storage of this medication to minimize diversion, and use of formulations that may be less likely to be diverted  Specifically, the best practices state that, when possible, practitioners should use the combination buprenorphine/naloxone product, which increases safety and decreases the likelihood of diversion and misuse  Further, physicians who request and receive a waiver to prescribe buprenorphine to treat up to 275 patients outside of an OTP are required to have a diversion control plan  According to an HHS official, as of July 13, 2017, roughly 3,330 of the over 39,000 practitioners with a waiver had a 275-patient limit waiver  The majority of these practitioners, just over 27,000, have a 30-patient limit  According to SAMHSA guidance, the diversion plan should contain specific measures to reduce the possibility of diversion of buprenorphine from legitimate treatment use and should assign specific responsibilities of the medical and administrative staff of the practice setting for carrying out these measures  Further, the guidance states that the plan should address how: the environment at the practice setting can prevent onsite diversion; to prevent diversion with regard to dosing and take-home medication; and to prevent patients from receiving a prescription from more than one practitioner and later diverting some of the prescribed medication  Elizabeth H  Curda, Director, (202) 512-7114 or curdae@gao gov  In addition to the contact name above, Will Simerl, Assistant Director; Natalie Herzog, Analyst-in-Charge; La Sherri Bush; and Emily Wilson made key contributions to this report  Also contributing were Muriel Brown, Krister Friday, Sandra George, and Christina Ritchie 

ground_truth: More than 2.7 million miles of pipeline transport and distribute oil, natural gas, and other hazardous products throughout the United States. Interstate pipelines run through remote areas and highly populated urban areas, and are vulnerable to accidents, operating errors, and malicious physical and cyber-based attack or intrusion. The energy sector accounted for 35 percent of the 796 critical infrastructure cyber incidents reported to DHS from 2013 to 2015. Several federal and private entities have roles in pipeline security. TSA is primarily responsible for the oversight of pipeline physical security and cybersecurity. GAO was asked to review TSA's efforts to assess and enhance pipeline security and cybersecurity. This report examines, among other objectives: (1) the guidance pipeline operators reported using to address security risks and the extent that TSA ensures its guidelines reflect the current threat environment; (2) the extent that TSA has assessed pipeline systems' security risks; and (3) the extent TSA has assessed its effectiveness in reducing pipeline security risks. GAO analyzed TSA documents, such as its Pipeline Security Guidelines ; evaluated TSA pipeline risk assessment efforts; and interviewed TSA officials, 10 U.S. pipeline operators—selected based on volume, geography, and material transported—and representatives from five industry associations. Pipeline operators reported using a range of guidelines and standards to address physical and cybersecurity risks, including the Department of Homeland Security's (DHS) Transportation Security Administration's (TSA) Pipeline Security Guidelines , initially issued in 2011. TSA issued revised guidelines in March 2018 to reflect changes in the threat environment and incorporate most of the principles and practices from the National Institute of Standards and Technology's Framework for Improving Critical Infrastructure Cybersecurity . However, TSA's revisions do not include all elements of the current framework and TSA does not have a documented process for reviewing and revising its guidelines on a regular basis. Without such a documented process, TSA cannot ensure that its guidelines reflect the latest known standards and best practices for physical security and cybersecurity, or address the dynamic security threat environment that pipelines face. Further, GAO found that the guidelines lack clear definitions to ensure that pipeline operators identify their critical facilities. GAO's analysis showed that operators of at least 34 of the nation's top 100 critical pipeline systems (determined by volume of product transported) deemed highest risk had identified no critical facilities. This may be due, in part, to the guidelines not clearly defining the criteria to determine facilities' criticality. To assess pipeline security risks, TSA conducts pipeline security reviews—Corporate Security Reviews and Critical Facility Security Reviews—to assess pipeline systems' vulnerabilities. However, GAO found that the number of TSA security reviews has varied considerably over the last several years, as shown in the table on the following page. TSA officials stated that staffing limitations have prevented TSA from conducting more reviews. Staffing levels for TSA's Pipeline Security Branch have varied significantly since fiscal year 2010 with the number of staff ranging from 14 full-time equivalents in fiscal years 2012 and 2013 to 1 in 2014. Further, TSA does not have a strategic workforce plan to help ensure it identifies the skills and competencies—such as the required level of cybersecurity expertise—necessary to carry out its pipeline security responsibilities. By establishing a strategic workforce plan, TSA can help ensure that it has identified the necessary skills, competencies, and staffing. GAO also identified factors that likely limit the usefulness of TSA's risk assessment methodology for prioritizing pipeline system reviews. Specifically, TSA has not updated its risk assessment methodology since 2014 to reflect current threats to the pipeline industry. Further, its sources of data and underlying assumptions and judgments regarding certain threat and vulnerability inputs are not fully documented. In addition, the risk assessment has not been peer reviewed since its inception in 2007. Taking steps to strengthen its risk assessment, and initiating an independent, external peer review would provide greater assurance that TSA ranks relative risk among pipeline systems using comprehensive and accurate data and methods. TSA has established performance measures to monitor pipeline security review recommendations, analyze their results, and assess effectiveness in reducing risks. However, these measures do not possess key attributes—such as clarity, and having measurable targets—that GAO has found are key to successful performance measures. By taking steps to ensure that its pipeline security program performance measures exhibit these key attributes, TSA could better assess its effectiveness at reducing pipeline systems' security risks. Pipeline Security Branch officials also reported conducting security reviews as the primary means for assessing the effectiveness of TSA's efforts to reduce pipeline security risks. However, TSA has not tracked the status of Corporate Security Review recommendations for the past 5 years. Until TSA monitors and records the status of these reviews' recommendations, it will be hindered in its efforts to determine whether its recommendations are leading to significant reduction in risk. GAO makes 10 recommendations to TSA to improve its pipeline security program management (many are listed on the next page), and DHS concurred. GAO recommends, among other things, that the TSA Administrator take the following actions: implement a documented process for reviewing, and if deemed necessary, for revising TSA's Pipeline Security Guidelines at defined intervals; clarify TSA's Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities; develop a strategic workforce plan for TSA's Security Policy and Industry Engagement‘s Surface Division; update TSA's pipeline risk assessment methodology to include current data to ensure it reflects industry conditions and threats; fully document the data sources, underlying assumptions and judgments that form the basis of TSA's pipeline risk assessment methodology; take steps to coordinate an independent, external peer review of TSA's pipeline risk assessment methodology; ensure the Security Policy and Industry Engagement‘s Surface Division has a suite of performance measures which exhibit key attributes of successful performance measures; and enter information on Corporate Security Review recommendations and monitor and record their status.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.

Report 1: The national pipeline system consists of more than 2 7 million miles of networked pipelines transporting oil, natural gas, and other hazardous liquids  Hazardous liquid and natural gas pipelines—primarily buried underground in the continental United States—run under remote and open terrain, as well as densely populated areas  These pipelines are of three main types: Hazardous liquid: About 216,000 miles of hazardous liquid pipeline transport crude oil, diesel fuel, gasoline, jet fuel, anhydrous ammonia, and carbon dioxide  Natural gas transmission and storage: About 319,000 miles of pipeline—mostly interstate—transport natural gas from sources to communities  Natural gas distribution: About 2 2 million miles of pipeline—mostly intrastate—transport natural gas from transmission sites to consumers  Figure 1 depicts the network of hazardous liquid and natural gas transmission pipelines in the United States  More than 3,000 pipeline companies operate the nation’s pipeline systems, which can traverse multiple states and the U S  borders with Canada and Mexico  Many pipeline systems are comprised of the pipelines themselves, as well as a variety of facilities, such as storage tanks, compressor stations, and control centers  Most pipeline systems are monitored and moderated through automated ICS or Supervisory Control and Data Acquisition (SCADA) systems using remote sensors, signals, and preprogramed parameters to activate and deactivate valves and pumps to maintain flows within tolerances  Federal agencies and pipeline operators determine the criticality of pipeline systems and their facilities based on their importance to the nation’s energy infrastructure; service to installations critical to national defense; or, if attacked, have the potential to cause mass casualties and significant impact on public drinking water affecting major population centers  Accordingly, those determined to be critical merit increased attention to security  However, as we previously reported, the inherent design and operation of U S  pipeline systems may reduce some potential impacts of lost service  The pipeline sector is generally considered to be resilient and versatile  Historically, pipeline operators have been able to quickly respond to the adverse consequences of an incident—whether it is damage from a major hurricane or a backhoe—and quickly restore pipeline service  Pipeline infrastructure also includes redundancies such as parallel pipelines or interconnections that enable operators to reroute material through the network  Figure 2 depicts the U S  pipeline system, its basic components, examples of vulnerabilities, and the entities to which it supplies energy and raw materials  These entities include utility companies, airports, military sites, and industrial and manufacturing facilities  According to TSA, pipelines are vulnerable to physical attacks—including the use of firearms or explosives—largely due to their stationary nature, the volatility of transported products, and the dispersed nature of pipeline networks spanning urban and outlying areas  The nature of the transported commodity and the potential effect of an attack on national security, commerce, and public health make some pipelines and their assets more attractive targets for attack  Oil and gas pipelines have been and continue to be targeted by terrorists and other malicious groups globally  Terrorists have also targeted U S  pipelines, but have not succeeded in attacking them  Further, environmental activists and lone actors seeking to halt the construction of new pipelines through sabotage have recently emerged as a new threat to pipelines  For example, in March 2017, activists used blowtorches to cut holes in empty portions of the Dakota Access Pipeline in two states  In February 2017, local law enforcement officers fatally shot a man who used an assault rifle to damage the Sabal Trail Pipeline, a natural gas pipeline under construction in Florida  The sophisticated computer systems that pipeline operations rely on are also vulnerable to various cyber threats  According to DOE, the frequency, scale, and sophistication of cyber threats have increased, and attacks have become easier to launch  NCCIC reported that the energy sector, which includes pipelines, experienced more cyber incidents than any sector from 2013 to 2015, accounting for 35 percent of the 796 incidents reported by all critical infrastructure sectors  In 2016, NCCIC reported that the energy sector was the third most frequently attacked sector  Further, according to DOE, the cost of preventing and responding to cyber incidents in the energy sector is straining the ability of companies to adequately protect their critical cyber systems  For example, a 2015 study by the Ponemon Institute estimated the annualized cost of cyber crime for an average energy company to be about $28 million  Ineffective protection of cyber assets from these threats can increase the likelihood of security incidents and cyber attacks that disrupt critical operations; lead to inappropriate access to and disclosure, modification, or destruction of sensitive information; and threaten national security, economic well-being, and public health and safety  Unintentional or nonadversarial threat sources may include failures in equipment or software due to aging, resource depletion, and errors made by end users  They also include natural disasters and failures of critical infrastructure on which the organization depends, but that are outside of the control of the organization  Intentional or adversarial threats may include corrupt employees, criminal groups, terrorists, and nations that seek to leverage the organization’s dependence on cyber resources (i e , information in electronic form, information and communications technologies, and the communications and information-handling capabilities provided by those technologies)  These threat adversaries vary in terms of their capabilities, their willingness to act, and their motives, which can include seeking monetary gain or seeking an economic, political, or military advantage  Cyber threat adversaries make use of various techniques, tactics, practices, and exploits to adversely affect an organization’s computers, software, or networks, or to intercept or steal valuable or sensitive information  For example, an attacker could infiltrate a pipeline’s operational systems via the internet or other communication pathways to potentially disrupt its service and cause spills, releases, explosions, or fires  Moreover, ICS, which were once largely isolated from the Internet and the company’s information technology systems, are increasingly connected in modern energy systems, allowing cyber attacks to originate in business systems and migrate to operational systems  For example, malicious nation-state actors used spear-phishing and other similar approaches in 2018 against energy sector organizations to gain access to their business systems, conduct reconnaissance, and collect information about their ICS  Similarly, in April 2012, the Industrial Control Systems Cyber Emergency Response Team reported that an unidentified cyber attacker had conducted a series of cyber intrusions into U S  natural gas pipeline systems beginning in December 2011  Federal policy and public-private plans establish roles and responsibilities for the protection of critical infrastructure, including pipelines  These include Presidential Policy Directive 21 (PPD-21), the NIPP, and Executive Order 13636  PPD-21, issued in February 2013, reflects an all- hazards approach to protecting critical infrastructure, including natural disasters, terrorism, and cyber incidents  The directive also identifies the 16 critical infrastructure sectors and assigns roles and responsibilities for each critical infrastructure sector among nine designated federal sector-specific agencies  While PPD-21 identified the critical infrastructure sectors and assigned responsibility for each sector’s sector-specific agency, the NIPP outlines critical infrastructure stakeholder roles and responsibilities regarding critical security and resilience  It describes a voluntary partnership model as the primary means of coordinating government and private sector efforts to protect critical infrastructure  As part of the partnership structure, the designated sector-specific agencies serve as the lead coordinators for security programs of their respective sector  As sector-specific agencies, federal departments or agencies lead, facilitate, or support the security and resilience programs and associated activities of their designated critical infrastructure sector  For example, DHS and DOT are both designated as sector-specific agencies for the transportation systems sector, which includes pipelines  Each sector also has a government coordinating council, consisting of representatives from various levels of government, and many have a sector coordinating council (SCC) consisting of owner-operators of these critical assets or members of their respective trade associations  For example, the Transportation Government Coordinating Council has been established, and the Pipeline Modal SCC has been established to represent pipeline operators  The NIPP also outlines a risk management framework for critical infrastructure protection  As shown in Figure 3, the NIPP uses a risk management framework as a planning methodology intended to inform how decision makers take actions to manage risk  The risk management framework calls for public and private critical infrastructure partners to conduct risk assessments to understand the most likely and severe incidents that could affect their operations and communities, and use this information to support planning and resource allocation  According to DHS, the risk management framework is influenced by the nature and magnitude of a threat, the vulnerabilities to that threat, and the consequences that could result, as shown in Figure 4  Federal policy has encouraged voluntary information-sharing mechanisms between the federal government and critical infrastructure owners and operators  For example, Information Sharing and Analysis Centers (ISAC) are formed by critical infrastructure owners and operators to gather, analyze, appropriately sanitize, and disseminate intelligence and information related to critical infrastructure  They typically collect, analyze and disseminate actionable threat information to their members and provide members with tools to mitigate risks and enhance resiliency  ISACs in which pipeline operators may participate have been formed including the Oil and Natural Gas ISAC, Downstream Natural Gas ISAC, and Electricity ISAC  Finally, in February 2013, the president issued Executive Order 13636, Improving Critical Infrastructure Cybersecurity, which cited repeated cyber intrusions into critical infrastructure as demonstrating the need for improved cybersecurity  Executive Order 13636 outlined actions for improving critical infrastructure cybersecurity, including direction for the National Institute of Standards and Technology (NIST) to lead the development of a voluntary risk-based cybersecurity framework that would comprise a set of industry standards and best practices to help organizations manage cybersecurity risks  NIST issued the framework in 2014 and updated it in April 2018  The order also addressed the need to improve cybersecurity information sharing and collaboratively develop risk-based standards and stated that U S  policy was to increase the volume, timeliness, and quality of cyber threat information shared with private sector entities so that these entities may better protect and defend themselves against cyber threats  Protecting the nation’s pipeline systems is a responsibility shared by both the federal government and private industry  As a result, several federal departments, agencies, and the private sector have significant roles in pipeline physical and cyber-related security  These entities include the following: Transportation Security Administration (TSA)  TSA, within DHS, has primary oversight responsibility for the physical security and cybersecurity of transmission and distribution pipeline systems  Within TSA, the Security Policy and Industry Engagement’s Pipeline Security Branch is charged with overseeing its pipeline security program  Pursuant to its authority, TSA’s Pipeline Security Branch first issued its voluntary Pipeline Security Guidelines in 2011, and released revised guidelines in March 2018  In accordance with the 9/11 Commission Act, TSA’s Pipeline Security Branch identifies the top 100 critical pipeline systems in the nation  To do so, it uses system annual throughput, which is based on the amount of hazardous liquid or natural gas product transported through a pipeline in 1 year (i e , annual throughput)  TSA also ranks the relative risk among the top 100 critical pipeline systems, discussed later in the report  Additionally, TSA’s Pipeline Security Branch is responsible for conducting voluntary Corporate Security Reviews (CSR) and Critical Facility Security Reviews (CFSR), which assess the extent to which the 100 most critical pipeline systems are following the intent of TSA’s Pipeline Security Guidelines  See figure 5 below for an overview of the CSR and CFSR processes  In addition, TSA Intelligence and Analysis is responsible for collecting and analyzing threat information related to the transportation network, and sharing relevant threat information to pipeline stakeholders  National Cybersecurity and Communications Integration Center (NCCIC)  Within DHS, NCCIC assists critical infrastructure owners in addressing cyber incidents and attacks, including those targeting industrial control systems  The NCCIC’s mission is to reduce the likelihood and severity of incidents that may significantly compromise the security and resilience of the nation’s critical information technology and communications networks  NCCIC’s role is to serve as the federal civilian interface for sharing information related to cybersecurity risks, incidents, analysis, and warnings with federal and nonfederal entities, and to provide shared situational awareness to enable real-time actions to address cybersecurity risks and incidents to federal and nonfederal entities  Pipeline and Hazardous Materials Safety Administration (PHMSA)  PHMSA, within DOT, is responsible for regulating the safety of hazardous materials transportation and the safety of pipeline systems, some aspects of which can be related to pipeline security  In 2004, PHMSA and TSA entered into a memorandum of understanding regarding their respective roles in all modes of transportation  In 2006, they signed an annex to the memorandum of understanding that further delineates lines of authority and responsibility between TSA and PHMSA on pipeline and hazardous materials transportation security  The annex identifies TSA as the lead federal entity for transportation security, including hazardous materials and pipeline security, and PHMSA as responsible for administering a national program of safety in natural gas and hazardous liquid pipeline transportation, including identifying pipeline safety concerns and developing uniform safety standards  Department of Energy (DOE)  DOE is responsible for protecting electric power, oil, and natural gas delivery infrastructure and, in December 2015, was identified in statute as the sector-specific agency for cybersecurity for the energy sector  The Office of Cybersecurity, Energy Security, and Emergency Response is the lead for DOE’s cybersecurity efforts  In addition, DOE operates the National SCADA Test Bed Program, a partnership with Idaho National Laboratory, Sandia National Laboratories, and other national laboratories which addresses control system security challenges in the energy sector  Among its key functions, the program performs control systems testing, research, and development; control systems requirements development; and industry outreach  Federal Energy Regulatory Commission (FERC)  FERC regulates the U S  bulk electric power system, which is increasingly powered by natural gas pipeline systems  FERC has regulatory authority over interstate natural gas pipelines under the Natural Gas Act  However, its role is limited to natural gas pipeline siting and rate regulation  The North American Electric Reliability Corporation is the federally designated U S  Electric Reliability Organization, and is overseen by FERC  The North American Electric Reliability Corporation, with approval from FERC, has developed mandatory critical infrastructure protection standards for protecting electric utility–critical and cyber-critical assets  Private sector  Although TSA has primary federal responsibility for overseeing interstate pipeline security, private sector pipeline operators are responsible for implementing asset-specific protective security measures  As we previously reported, operators have increased their attention on security by incorporating security practices and programs into their overall business operations  Pipeline operators’ interests and concerns are primarily represented by five major trade associations with ties to the pipeline industry—the Interstate Natural Gas Association of America (INGAA), American Gas Association (AGA), American Public Gas Association, American Petroleum Institute (API), and Association of Oil Pipe Lines  According to TSA officials, pipeline operators, and association representatives, these associations have worked closely with the federal government on a variety of pipeline security-related issues, including collaborating on TSA’s voluntary standards and information sharing  All of the pipeline operators and pipeline association representatives we interviewed reported receiving security information from federal and nonfederal entities  Pipeline operators also reported providing security- related information to federal agencies, including TSA, as incidents occur  Multiple federal entities exchange alerts of physical and cybersecurity incidents and other risk-related information with critical infrastructure partners, including pipeline operators  For example, DHS components including TSA’s Intelligence and Analysis and NCCIC share security- related information on physical and cyber threats and incidents with sector stakeholders  Specifically, Intelligence and Analysis provides quarterly intelligence briefings to pipeline operators  NCCIC also issues indicator bulletins, which can contain information related to cyber threat indicators, defensive measures, and cybersecurity risks and incidents  In addition, TSA and other federal entities have coordinated to address specific pipeline-related security incidents  For example, TSA officials coordinated with DOT, DOE, the Department of Justice, and FERC through the Oil and Natural Gas subsector SCC to address ongoing incidents of vandalism and sabotage of critical pipeline assets by environmental activists in 2016  In July 2017, according to DOT officials, PHMSA and TSA collaborated on a web-based portal to facilitate sharing sensitive but unclassified incident information among federal agencies with pipeline-related responsibilities  See table 1 for the key federal information sharing entities and programs that exchange security-related or incident information with critical infrastructure stakeholders, including the pipeline sector  Pipeline operators also share security-related information with TSA and the NCCIC  In its Pipeline Security Guidelines, TSA requests that pipeline operators report by telephone or email to its Transportation Security Operations Center (TSOC) any physical security incidents that are indicative of a deliberate attempt to disrupt pipeline operations or activities that could be considered precursors to such an attempt  TSA’s Pipeline Security Guidelines also request that operators report any actual or suspected cyber attacks that could impact pipeline industrial control systems or other information technology-based systems to the NCCIC  According to the TSOC’s operating procedures, if a reported incident meets certain criteria, such as the incident was intended to or resulted in damage or requires a general evacuation of a facility, the TSOC watch officer is then to contact Office of Security and Industry Engagement officials  According to TSA officials, the TSOC does not conduct investigations of the specific security incidents that pipeline operators report  However, TSOC staff do analyze the incident information they receive for national trends and common threats  TSA officials stated that they share their observations with pipeline operators and other critical infrastructure asset owners during monthly and quarterly conference calls that TSA holds with pipeline operators  All the pipeline operators and association representatives we interviewed identified other nonfederal information sharing entities, including ISACs, fusion centers, industry associations, and SCCs, which provide forums for exchanging information about physical and cyber incidents throughout the pipeline sector  See table 2 for nonfederal information sharing entities identified as available to pipeline operators  Operators and TSA officials reported that the current backlog in granting security clearances for some key pipeline operator employees was a significant factor affecting information sharing between TSA and pipeline operators  TSA officials acknowledged that some pipeline operators have had difficulty obtaining security clearances for key employees due to ongoing backlogs in processing requests by the Office of Personnel Management National Background Investigation Bureau, and that TSA’s ability to share timely information with operators whose staff do not have a clearance may be hindered  Three of the 10 pipeline operators we interviewed identified receiving timely classified security information as a specific challenge due, in part, to difficulties staff have had obtaining security clearances  Further, 7 of the 10 pipeline operators that we interviewed reported experiencing delays in obtaining a security clearance or were aware of others who had experienced this issue  However, according to three operators we interviewed, TSA was helpful in facilitating approval of security clearances for the operators’ personnel to access classified information when necessary  This security clearance challenge is not faced by pipeline operators alone  In January 2018, we designated the backlog of investigations for the clearance process and the government-wide personnel security clearance process as a high-risk area  We will continue to monitor agencies’ progress in reducing the backlog and improving the security clearance process  Pipeline operators that we interviewed reported using a range of guidelines and standards to address their physical and cybersecurity risks, and all of them reported implementing TSA’s voluntary Pipeline Security Guidelines that were applicable to their operations  TSA revised and issued its Pipeline Security Guidelines in March 2018, but the revised guidelines lack a defined process to consider updates to supporting guidance such as to the NIST Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework)  Furthermore, TSA has not clearly defined the terms within the criteria that pipeline operators are to use to determine the criticality of their facilities  Pipeline operators that we interviewed reported using a range of guidelines and standards to address their physical and cybersecurity risks  For example, all 10 of the pipeline operators we interviewed stated they had implemented the voluntary 2011 TSA Pipeline Security Guidelines the operators determined to be applicable to their operations  The guidelines provide TSA’s recommendations for pipeline industry security practices such as establishing a corporate security program and identifying critical facilities among others (see sidebar)  Five of the 10 pipeline operators we interviewed characterized the guidelines as generally or somewhat effective in helping to secure their operations, 1 was neutral on their effectiveness, and 4 did not provide an assessment of the guidelines’ effectiveness  However, one operator pointed out that they had not adopted the guidelines’ recommended interval of 36 months or less for conducting security vulnerability assessments due to staffing limitations  Also, another pipeline operator noted that they were working to implement the guidelines in the operations of a newly acquired asset that they determined was not using the guidelines in the same manner as their company  All of the pipeline operators we interviewed reported using other guidelines or standards to address pipeline systems’ security risks  For example, pipeline operators reported using and industry association representatives reported that their members use INGAA’s Control Systems Cyber Security Guidelines for the Natural Gas Pipeline Industry, API’s Pipeline SCADA Security standard, and the NIST Cybersecurity Framework as sources of cybersecurity standards, guidelines, and practices that may be scaled and applied to address a pipeline operator’s cybersecurity risks  Further, pipeline operators are required to adhere to regulations related to pipeline safety and, depending upon their assets, operations, and location, may be required to adhere to regulations for electrical utilities, chemical storage facilities, and locations near waterways  For example, all pipeline operators must adhere to DOT’s PHMSA safety regulations  In addition, pipeline operators whose systems include chemical facilities may be required to comply with DHS’s Chemical Facility Anti-Terrorism Standards (CFATS)  Pipeline operators whose systems include a terminal located on a U S  port may be required to comply with Maritime Transportation Security Act regulations  For a listing of federal and industry guidelines identified as applicable to security by the pipeline operators, see appendix I  TSA’s Pipeline Security Branch issued its revised Pipeline Security Guidelines in March 2018, but TSA has not established a documented process to ensure that revisions occur and fully capture updates to supporting standards and guidance  The guidelines were revised to, among other things, reflect the dynamic threat environment and to incorporate cybersecurity principles and practices from the NIST Cybersecurity Framework, which were initially issued in February 2014  To revise the guidelines and incorporate feedback, according to Pipeline Security Branch officials, they incorporated outcomes from pipeline modal threat assessments and best practices from security reviews, and collaborated with pipeline sector stakeholders—including industry associations and other federal agencies with a role in pipeline security  Officials from the industry associations we interviewed confirmed that they provided input to the revised pipeline guidelines, including meeting with and consolidating comments from member pipeline operators  See figure 6 for a timeline of events pertinent to federal pipeline security guidelines  TSA’s Pipeline Security Smart Practice Observations for pipeline operators states that security plans should have a documented process to include security plan reviews and updates on a periodic and an as- needed basis  Standards for Internal Control in the Federal Government states that periodic review of policies, procedures, and related control activities should occur to determine their continued relevance and effectiveness in achieving identified objectives or addressing related risks  The NIPP and NIST also emphasize the need to provide updates on incident response guidance and security procedures, respectively  Moreover, other pipeline industry guidance cited by TSA’s guidelines also has a prescribed interval for review and revision  For example, API reviews its standards at least every 5 years  However, TSA has not instituted a documented process to consider the need to update the Pipeline Security Guidelines on a regular basis  Pipeline Security Branch officials acknowledged the value of having a defined process for reviewing and, if necessary, revising TSA’s Pipeline Security Guidelines at regular defined intervals to ensure it includes, among other things, newly identified best practices and updated industry guidance that are relevant to pipeline operators, such as the elements of the latest version of NIST’s Cybersecurity Framework  For example, TSA’s revisions to its guidelines incorporated some, but not all of the elements of the NIST Cybersecurity Framework version 1  Specifically, to improve incident response, the NIST framework recommends implementing an incident response analysis and feedback function to a security program  However, TSA’s Pipeline Security Guidelines do not include similar steps for pipelines operators to include in their pipeline security programs  Further, because NIST released version 1 1 of the Cybersecurity Framework in April 2018, the guidelines that TSA released in March 2018 do not incorporate cybersecurity elements that NIST added to the latest Cybersecurity Framework such as the Supply Chain Risk Management category  Pipeline Security Branch officials said that they have not instituted a review process on a regular basis because they intended to review and revise TSA’s guidelines on an as-needed basis in response to updated supporting guidance, but could provide no timeline for doing so  Without a documented process defining how frequently Pipeline Security Branch staff are to review and revise its guidelines, TSA cannot ensure that its guidelines reflect the latest known standards and best practices for physical and cybersecurity, or address the persistent and dynamic security threat environment currently facing the nation’s pipeline system  Under TSA’s Pipeline Security Guidelines, pipeline operators are to self- identify the critical facilities within their system and report their critical facilities to TSA  TSA’s Pipeline Security Branch conducts CFSRs at the critical facilities that pipeline operators have identified  However, our analysis of TSA’s data found that at least 34 of the top 100 critical pipeline systems deemed highest risk indicated that they had no critical facilities  Accordingly, TSA would not conduct a CFSR at any of these systems’ facilities because their operators identified none of them as critical  The fact that pipeline operators of about one third of the highest risk systems identified no critical facilities may be due, in part, to the Pipeline Security Branch not clearly defining the criteria outlined in the Pipeline Security Guidelines that pipeline operators are to use to determine the criticality of their facilities  Three of the 10 operators we interviewed stated that some companies reported to TSA that they had no critical facilities, and may possibly be taking advantage of the guidelines’ lack of clarity  Accordingly, operators that report no critical facilities would avoid TSA’s reviews of their facilities  service or deliverability resulting in a state or local government's inability to provide essential public services and emergency response for an extended period of time; Significantly damage or destroy national intended use of major rivers, lakes, or waterways (e g , public drinking water for large populations or disruption of major commerce or public transportation routes); service or deliverability to a significant number of customers or individuals for an extended period of time; operations for an extended period of time (i e , business critical facilities)  Our review of the eight criteria included in TSA’s Pipeline Security Guidelines (see sidebar) found that no additional examples or clarification are provided to help operators determine criticality  Although we previously noted that 5 of the 10 operators we interviewed generally found TSA’s Guidelines as a whole helpful in addressing pipeline security, more than half of the operators we interviewed identified TSA’s criticality criteria as a specific area for improvement  Specifically, 3 of the 10 pipeline operators that we interviewed stated that TSA had not clearly defined certain terms within the criteria, and 3 additional operators of the 10 reported that additional consultation with TSA was necessary to appropriately apply the criteria and determine their facilities’ criticality  For example, 2 operators told us that individual operators may interpret TSA’s criterion, “cause mass casualties or significant health effect,” differently  One of these operators that we interviewed stated that this criterion could be interpreted either as a specific number of people affected or a sufficient volume to overwhelm a local health department, which could vary depending on the locality  Another operator reported that because TSA’s criteria were not clear, they created their own criteria which helped the operator identify two additional critical facilities  Pipeline Security Branch officials acknowledged there are companies that report having no critical facilities in their pipeline systems  According to Pipeline Security Branch officials, pipeline operators are in the best position to determine which of their facilities are critical, and the companies that have determined that their pipeline systems have no critical facilities also have reported sufficient redundancies to make none of their facilities critical to the continuity of their operations  According to these officials, they have had extensive discussions with pipeline company officials to assess the validity of their criticality determinations, and have closely questioned companies to ensure they have properly applied TSA’s criteria  However, according to TSA’s Pipeline Security Guidelines, operators should use a consistent set of criteria for determining the criticality of their facilities  In addition, Standards for Internal Control in the Federal Government states that management should define objectives clearly to enable the identification of risks  To achieve this, management generally defines objectives in specific and measurable terms and ensures the terms are fully and clearly set forth so they can be easily understood  Pipeline Security Branch officials acknowledged that the criticality definitions in the Pipeline Security Guidelines could be clarified to be more specific  Additionally, an industry association representative reported that the association, in consultation with TSA, has been developing supplementary guidance for its members to clarify certain terms in TSA’s critical facility criteria  As of October 2018 this guidance is still under review at the association and has not been made available to the association’s members  Pipeline Security Branch officials confirmed they worked with the industry association on its supplementary guidance, but also acknowledged that the supplementary guidance may only be distributed to the association’s membership  Without clearly defined criteria for determining pipeline facilities’ criticality, TSA cannot ensure that pipeline operators are applying its guidance uniformly  Further, because TSA selects the pipeline facilities on which to conduct CFSRs based on operators’ determinations, TSA cannot fully ensure that all of the critical facilities across the pipeline sector have been identified using the same criteria, or that their vulnerabilities have been identified and addressed  TSA’s Intelligence and Analysis identifies security risks to pipeline systems through various assessments  Additionally, TSA’s Pipeline Security Branch conducts security reviews to assess pipeline operators’ implementation of TSA’s Pipeline Security Guidelines, but gaps in staffing and lack of a workforce plan may affect its ability to carry out effective reviews  The Pipeline Security Branch also developed a pipeline risk assessment to rank relative risk of the top 100 critical pipeline systems and to prioritize its security reviews of pipeline companies, but shortfalls in its calculations of threat, vulnerability, and consequence may limit its ability to accurately identify pipeline systems with the highest risk  Finally, the pipeline risk assessment has not been peer reviewed to validate the assessment’s data and methodology, which we previously reported as a best practice in risk management  TSA’s Intelligence and Analysis produces assessments related to pipeline security risks, including Pipeline Modal and Cyber Modal Threat Assessments and the Transportation Sector Security Risk Assessment  The Pipeline and Cyber Modal Threat Assessments are issued on a semiannual basis; TSA Intelligence and Analysis may also issue additional situation-based products on emerging threats  The Pipeline Modal and Cyber Modal Threat Assessments evaluate, respectively, physical and cyber threats to pipelines  The pipeline modal threat assessment evaluates terrorist threats to hazardous liquid and natural gas pipelines, and the cyber modal threat assessment evaluates cyber threats to transportation, including pipelines  Both assessments specifically analyze the primary threat actors, their capabilities, and activities—including attacks occurring internationally—as well as other characteristics of threat  The Transportation Sector Security Risk Assessment assesses threat, vulnerability, and consequence for various attack scenarios across the five transportation modes for which TSA is responsible  The scenarios define a type of threat actor—including homegrown violent extremists and transnational extremists, such as al Qaeda and its affiliates—a target, and an attack mode  For example, a scenario might assess the risk of attacks using varying sizes of improvised explosive devices on pipeline system assets  As part of the assessment process, TSA engages with subject matter experts from TSA and industry stakeholder representatives to compile vulnerabilities for each mode, and TSA analyzes both direct and indirect consequences of the various attack scenarios  According to Pipeline Security Branch officials, the assessments produced by TSA’s Intelligence and Analysis provide key information to inform the pipeline security program’s efforts  According to TSA officials, TSA conducts pipeline security reviews— Corporate Security Reviews (CSRs) and Critical Facility Security Reviews (CFSRs)—to assess pipeline vulnerabilities and industry implementation of TSA’s Pipeline Security Guidelines  However, as shown by Figure 7 below, the number of CSRs and CFSRs completed by TSA has varied during the last five fiscal years, ranging from zero CSRs conducted in fiscal year 2014 to 23 CSRs conducted in fiscal year 2018, as of July 31, 2018  TSA officials reported that staffing limitations have prevented TSA from conducting more reviews  As shown in table 3, TSA Pipeline Security Branch staffing levels (excluding contractor support) have varied significantly over the past 9 years ranging from 14 full-time equivalents (FTEs) in fiscal years 2012 and 2013 to one FTE in fiscal year 2014  They stated that, while contractor support has assisted with conducting CFSRs, there were no contractor personnel providing CSR support from fiscal years 2010 through 2017, but that has now increased to two personnel in fiscal year 2018  TSA prioritizes reviewing and collecting information on the nation’s top 100 critical pipeline systems  According to TSA officials, they would need to conduct 46 CSRs in order to review the top 100 critical pipeline systems  In July 2018, TSA officials stated that TSA’s current target was to assess each pipeline company every 2 to 3 years; this would equate to about 15 to 23 CSRs per year  TSA officials stated that they expect to complete 20 CSRs and 60 CFSRs per fiscal year with Pipeline Security Branch employees and contract support, and have completed 23 CSRs through July 2018 for fiscal year 2018  Given the ever-increasing cybersecurity risks to pipeline systems, ensuring that the Pipeline Security Branch has the required cybersecurity skills to effectively evaluate pipeline systems’ cybersecurity is essential  Pipeline operators we interviewed emphasized the importance of cybersecurity skills among TSA staff  Specifically, 6 of the 10 pipeline operators and 3 of the 5 industry representatives we interviewed reported that the level of cybersecurity expertise among TSA staff and contractors may challenge the Pipeline Security Branch’s ability to fully assess the cybersecurity portions of its security reviews  TSA officials stated that Security Policy and Industry Engagement staff are working with DHS’s National Protection and Programs Directorate to help address cyber- related needs, including identifying specific cybersecurity skills and competencies required for the pipeline security program  The officials were uncertain, however, whether TSA would use contractor support or support from the National Protection and Programs Directorate to provide identified skills and competencies  TSA officials also stated that Security Policy and Industry Engagement staff work with TSA’s human resource professionals to identify critical skills and competencies needed for Pipeline Security Branch personnel, and helps its workforce maintain professional expertise by providing training and education for any identified skill or competency gaps  Our previous work has identified principles that a strategic workforce planning process should follow including developing strategies tailored to address gaps in number, deployment, and alignment of human capital approaches for enabling and sustaining the contributions of all critical skills and competencies  Workforce planning efforts, linked to an agency’s strategic goals and objectives, can enable it to remain aware of and be prepared for its needs, including the size of its workforce, its deployment across the organization, and the knowledge, skills, and abilities needed for it to pursue its mission  Agencies should consider how hiring, training, staff development, performance management, and other human capital strategies can be aligned to eliminate gaps and improve the long-term contribution of skills and competencies identified as important for mission success  TSA has not established a workforce plan for its Security Policy and Industry Engagement or its Pipeline Security Branch that identifies staffing needs and skill sets such as the required level of cybersecurity expertise among TSA staff and contractors  When asked for TSA strategic workforce planning documents used to inform staffing allocations related to the pipeline security program, TSA officials acknowledged they do not have a strategic workforce plan  Rather, according to these officials, TSA determines agency-level staffing allocations through the Planning, Programming, Budgeting and Execution process, which is used to decide policy, strategy, and the development of personnel and capabilities to accomplish anticipated missions  According to TSA officials, when they use this process they look at existing resources and then set priorities based on the TSA Administrator’s needs  However, a strategic workforce plan allows an agency to identify and prepare for its needs, such as the size of its workforce, its deployment across the organization, and the knowledge, skills, and abilities needed to pursue its mission  TSA officials stated that the agency has a detailed allocation plan for strategically aligning resources to screen passengers at TSA-regulated airports, but not for the entire agency  By establishing a strategic workforce plan, TSA can help ensure it has identified the knowledge, skills, and abilities that the future workforce of TSA’s Pipeline Security Branch may need in order to meet its mission of reducing pipeline systems’ vulnerabilities to physical and cybersecurity risks, especially in a dynamic and evolving threat environment  Further, as greater emphasis is placed on cybersecurity, determining the long- term staffing needs of the Pipeline Security Branch will be essential  Furthermore, a workforce plan could enable TSA to determine the number of personnel it needs to meet its stated goals for conducting CSRs and CFSRs  After TSA identifies the top 100 critical pipeline systems based on throughput, the Pipeline Security Branch uses the Pipeline Relative Risk Ranking Tool (risk assessment), which it developed in 2007, to assess various security risks of those systems  We previously reported, in 2010, that the Pipeline Security Branch was the first of TSA’s surface transportation modes to develop a risk assessment model that combined all three components of risk—threat, vulnerability, and consequence—to generate a risk score  The risk assessment generates a risk score for each of the 100 most critical pipeline systems and ranks them according to risk  The risk assessment calculates threat, vulnerability, and consequence for each pipeline system on variables such as the amount of throughput in the pipeline system and the number critical facilities  The risk assessment combines data collected from pipeline operators, as well as other federal agencies, such as the Departments of Transportation and Defense, to generate the risk score  However, the last time the Pipeline Security Branch calculated relative risk among the top 100 critical pipeline systems using the risk assessment was in 2014  Pipeline Security Branch officials told us that they use the pipeline risk assessment to rank relative risk of the top 100 critical pipeline systems, and the standard operating procedures for conducting CSRs state the results of the risk ranking are the primary factor considered when prioritizing corporate security reviews of pipeline companies  According to Pipeline Security Branch officials, the risk assessment has not changed since 2014 because the Pipeline Security Branch is still conducting CSRs based on the 2014 ranking of pipeline systems  As outlined in table 4 below, we identified several factors that likely limit the usefulness of the current risk assessment in calculating threat, vulnerability, and consequence to allow the Pipeline Security Branch to effectively prioritize reviews of pipeline systems  For example, because the risk assessment has not changed since 2014, information on threat may be outdated  Additionally, sources of data and underlying assumption and judgments regarding certain threat and vulnerability inputs to the assessment are not fully documented  For example, threats to cybersecurity are not specifically accounted for in the description of the risk assessment methodology, making it unclear if cybersecurity is part of the assessment’s threat factor  Further, the risk assessment does not include information that is consistent with the NIPP and other DHS priorities for critical infrastructure risk mitigation, such as information on natural hazards and the ability to measure risk reduction (feedback data)  According to Pipeline Security Branch officials, the risk ranking assessment is not intended to be a fully developed risk model detailing all pipeline factors influencing risk  Rather, officials said they are primarily interested in assessing risk data that impacts security  However, because TSA’s Pipeline Security Program is designed to enhance the security preparedness of the pipeline systems, incorporating additional factors that enhance security into their risk calculation would better align their efforts with PPD-21  For example, PPD-21 calls for agencies to integrate and analyze information to prioritize assets and manage risks to critical infrastructure, as well as anticipate interdependencies and cascading impacts  For a more detailed discussion of the shortfalls we identified, refer to appendix II  In addition to the shortfalls identified above, the risk assessment has not been peer reviewed since its conception in 2007  In our past work, we reported that independent, external peer reviews are a best practice in risk management and that independent expert review panels can provide objective reviews of complex issues  According to the National Research Council of the National Academies, external peer reviews should, among other things, address the structure of the assessment, the types and certainty of the data, and how the assessment is intended to be used  The National Research Council has also recommended that DHS improve its risk analyses for infrastructure protection by validating the assessments and submitting them to independent, external peer review  Other DHS components have implemented our prior recommendations to conduct peer reviews of their risk assessments  For example, in April 2013, we reported on DHS’s management of its Chemical Facility Anti- Terrorism Standards (CFATS) program and found that the approach used to assess risk did not consider all of the elements of consequence, threat, and vulnerability associated with a terrorist attack involving certain chemicals  The Infrastructure Security Compliance Division, which manages the CFATS program conducted a multiyear effort to improve their risk assessment methodology and included commissioning a peer review by the Homeland Security Studies and Analysis Institute, which resulted in multiple recommendations  As part of the implementation of some of the peer review’s recommendations, DHS conducted peer reviews and technical reviews with government organizations and facility owners and operators, and worked with Sandia National Laboratories to verify and validate the CFATS program’s revised risk assessment methodology, which was completed in January 2017  According to Pipeline Security Branch officials, they are considering updates to the risk assessment methodology including changes to the vulnerability and consequence factors  These officials said the risk assessment was previously reviewed within the past 18 months by industry experts and they consider input from several federal partners including DHS, DOT, and the Department of Defense  Officials also said they will consider input from industry experts and federal partners while working on updating the risk assessment  However, most of the proposed changes to the risk assessment methodology officials described are ones that have been deliberated since our last review in 2010  Therefore, an independent, external peer review would provide the opportunity for integration and analysis of additional outside expertise across the critical infrastructure community  While independent, external peer reviews cannot ensure the success of a risk assessment approach, they can increase the probability of success by improving the technical quality of projects and the credibility of the decision-making process  According to the National Research Council of the National Academies, independent, external peer reviews should include validation and verification to ensure that the structure of the risk assessment is both accurate and reliable  Thus, an independent, external peer review would provide better assurance that the Pipeline Security Branch can rank relative risk among pipeline systems using the most comprehensive and accurate threat, vulnerability, and consequence information  TSA has established performance measures, as well as databases to monitor pipeline security reviews and analyze their results  However, weaknesses in its performance measures and its efforts to record pipeline security review recommendations limit its ability to determine the extent that its pipeline security program has reduced pipeline sector risks  Furthermore, we identified data reliability issues in the information that TSA collects to track the status of pipeline security review recommendations, such as missing data, inconsistent data entry formats, and data entry errors  TSA has three sets of performance measures for its pipeline efforts: the Pipeline Security Plan in the 2018 Biennial National Strategy for Transportation Security (NSTS), a management measure in the DHS fiscal year 2019 congressional budget justification, and summary figures in their CSR and CFSR databases  As a result of our 2010 work, TSA established performance measures and linked them to Pipeline Security Plan goals within the Surface Security Plan of the 2018 NSTS  See table 5 below for the 2018 NSTS Pipeline Security Plan performance measures  As shown in table 6 below, DHS also included a management measure in its fiscal year 2019 congressional budget justification to track the annual number of completed pipeline security reviews  Finally, TSA Pipeline Security Branch officials said they use summary figures in the CFSR status database and the CSR goals and priorities database as performance measures  For example, these include the percentage of CFSR recommendations implemented and the average percentage compliance with the guidelines by fiscal year  We previously found that results-oriented organizations set performance goals to clearly define desired program outcomes and develop performance measures that are clearly linked to the performance goals  Performance measures should focus on whether a program has achieved measurable standards toward achieving program goals, and allow agencies to monitor and report program accomplishments on an ongoing basis  Our previous work on performance metrics identified 10 attributes of effective performance  Table 7 identifies each key attribute of effective performance measures along with its definition  We evaluated the current performance measures included in the 2018 NSTS, the DHS fiscal year 2019 congressional budget justification, the CSR goals and priorities database, and the CFSR status database related to TSA’s Pipeline Security Branch  We primarily focused on key attributes which could be applied to individual measures  These include clarity, linkage, measurable targets, objectivity, reliability, and baseline and trend data  Our prior work on performance measurement found that all performance measure attributes are not equal and failure to have a particular attribute does not necessarily indicate that there is a weakness in that area or that the measure is not useful; rather, it may indicate an opportunity for further refinement  Based on our evaluation, the TSA-identified measures do not possess attributes that we have identified as being key to successful performance measures  As a result, TSA cannot fully determine the extent to which the Pipeline Security Branch has achieved desired outcomes, including the effectiveness of its efforts to reduce risks to pipelines  Specifically, many of TSA’s measures cover agency goals and mission, but they generally lack clarity and measurable targets, provide significantly overlapping information, and do not include baseline and trend data  Clarity  The pipeline-related measures in the 2018 NSTS are not clear because they do not describe the methodology used to calculate them, and the names and definitions are not clearly described  For example, NSTS goal 1 includes an objective to conduct training of employees responding to terrorist attacks  The desired outcome is to improve the capability of industry employees to respond and recover from terrorist attacks  However, the performance measure is the percentage of critical pipeline systems implementing the TSA Pipeline Security Guidelines  It is not clear if this measure is specific to the sections of the guidelines related to employee training or overall implementation of the guidelines  The CFSR status database measures include the percentage of recommendations implemented by topic, such as “Site Specific Security Measures,” “Signage,” or “Miscellaneous ” However, the database does not specifically define these topics or explain the methodology for calculating the measures  Unclear measures could be confusing and misleading to users  Core program activities  The pipeline-related measures in the 2018 NSTS cover some of the agency’s core program activities, such as conducting security exercises with the pipeline industry and providing intelligence and information products to the industry  However, the NSTS Pipeline Security Plan measures do not specifically include some core program activities, such as updating the TSA Pipeline Security Guidelines or the results of conducting CSRs and CFSRs in order to collect the information necessary for the existing performance measures  The CSR goals and priorities database and the CFSR status database include measures intended to track some of the results of pipeline security reviews, such as the average percentage compliance with the guidelines by fiscal year and the percentage of CFSR recommendations implemented  If core program activities are not covered, there may not be enough information available in those areas to managers and stakeholders  Limited overlap  The pipeline-related measures in the 2018 NSTS do not have limited overlap  As discussed previously, four of the five NSTS measures are based on the percentage of critical pipeline systems implementing TSA’s Pipeline Security Guidelines  The management measure is based on the number of complete pipeline security reviews  The CFSR status database measures are based on the percentage of recommendations implemented overall and by groups  Finally, the CSR goals and priorities database measures are based on the average compliance percentage of companies that had CSRs conducted in fiscal years 2016 and 2017  This is similar to four of the five NSTS measures  Significantly overlapping measures may lead to redundant, costly information that does not add value for TSA management  Linkage  The pipeline-related measures in the 2018 NSTS generally exhibited this key attribute  For example, all of the NSTS measures were arranged by agency strategic goals and risk-based priorities  However, the management measure in DHS’s fiscal year 2019 congressional budget justification and the CFSR status database measures did not specify the TSA goals and priorities to which they were aligned  If measures are not aligned with division and agency- wide goals and mission, the behaviors and incentives created by these measures do not support achieving those goals or mission  Measurable target  TSA’s measures generally did not include measurable targets in the form of a numerical goal and none of the NSTS measures had measurable targets  For example, the NSTS measure under the Security Planning priority, which tracks the percentage of critical pipeline systems implementing TSA’s Pipeline Security Guidelines, does not state what specific percentages would be considered an improvement in industry security plans  However, the management measure did include target numbers of pipeline security reviews by fiscal year  Both the CFSR status database measures and CSR goals and priorities database measures did not include measurable targets  Without measurable targets, TSA cannot tell if performance is meeting expectations  Objectivity  Because the pipeline-related measures in the 2018 NSTS, the CFSR status database, and the CSR goals and priorities database generally lack clarity and measurable targets, TSA cannot ensure its measures are free from bias or manipulation, and therefore, are not objective  If measures are not objective, the results of performance assessments may be systematically overstated or understated  Reliability  Because the pipeline-related measures in the 2018 NSTS, the CFSR status database, and the CSR goals and priorities database generally lack clarity, measurable targets, and baseline and trend data, it is not clear if TSA’s measures produce the same result under similar conditions; therefore, the pipeline-related measures are unreliable  If measures are not reliable, reported performance data may be inconsistent and add uncertainty  Baseline and trend data  TSA’s measures generally did not include baseline and trend data  For example, none of the NSTS measures included past results and compared them to measurable targets  TSA officials were unable to identify measures or goals to assess the extent to which pipeline operators have fully implemented the guidelines or increased pipeline security, but did say developing a feedback mechanism to measure progress in closing vulnerability gaps was important  However, the management measure did include the number of completed pipeline security reviews for each fiscal year from 2014 through 2017, as well as numerical goals  The CFSR status database includes information on CFSRs conducted from May 22, 2012, through June 29, 2017, but the measures are calculated for the entire time period rather than year-by-year  The CSR goals and priorities database measures include percentage compliance with the guidelines for CSRs conducted in fiscal years 2016 and 2017, as well as a combined measure  However, baseline and trend data are not tracked or reported in either database  Collecting, tracking, developing, and reporting baseline and trend data allows agencies to better evaluate progress being made and whether or not goals are being achieved  Pipeline Security Branch officials explained that in addition to the measures reported in the 2018 NSTS Pipeline Security Plan, they primarily rely on measures assessing CSR and CFSR implementation for assessing the value of its pipeline security program  TSA officials reported that they collect and analyze data and information collected from CSRs and CFSRs to, among other things, determine strengths and weaknesses at critical pipeline facilities, areas to target for risk reduction strategies, and pipeline industry implementation of the voluntary Pipeline Security Guidelines  For example, TSA officials reported that they analyzed information from approximately 734 CFSR recommendations that were made during fiscal years 2012 through 2016  They found that pipeline operators had made the strongest improvements in security training, public awareness outreach and law enforcement coordination, and site specific security measures  The most common areas in need of improvement were 24x7 monitoring, frequency of security vulnerability assessments, and proper signage  However, as described above, we found those measures also did not comport with key attributes for successful measures and we report below on reliability concerns for underlying data supporting those measures  In addition, while the Pipeline Security Branch may not rely on the measures included in the 2018 NSTS Pipeline Security Plan and the fiscal year 2019 congressional budget justification, they are important for reporting the status of pipeline security efforts to TSA as a whole and to external stakeholders such as Congress  Taking steps to ensure that the pipeline security program performance measures exhibit key attributes of successful performance measures could allow TSA to better assess the program’s effectiveness at reducing pipeline physical and cybersecurity risks  This could include steps such as modifying its suite of measures so they are clear, have measurable targets, and add baseline and trend data  Further examples include the following: Adding measurable targets consisting of numerical goals could allow TSA to better determine if the pipeline security program is meeting expectations  For example, measurable targets could be added to TSA’s existing measures by developing annual goals for the percentage of recommendations implemented to the CFSR status database and then reporting annual results  To make measures clearer, TSA could verify that each measure has a clearly stated name, definition, and methodology for how the measure is calculated  For example, the NSTS objective for security training mentioned above could have more specific language explaining how the measure is calculated and whether it applies to pipeline operators’ implementation of the training-related portions of the TSA Pipeline Security Guidelines or overall implementation  Finally, adding baseline and trend data could allow TSA to identify, monitor, and report changes in performance and help ensure that performance is viewed in context  For example, the NSTS measures, CFSR status database measures, and CSR goals and priorities database measures could have annual results from prior years  This could help TSA and external stakeholders evaluate the effectiveness of the pipeline security program and whether it is making progress toward its goals  According to TSA officials, the primary means for assessing the effectiveness of the agency’s efforts to reduce pipeline security risks is through conducting pipeline security reviews— Corporate Security Reviews (CSRs) and Critical Facility Security Reviews (CFSRs)  However, TSA has not tracked the status of CSR recommendations for over 5 years and related security review data are not sufficiently reliable  When conducting CSRs and CFSRs, TSA staff makes recommendations to operators, if appropriate  For example, a CSR recommendation might include a suggestion to conduct annual security-related drills and exercises, and a CFSR recommendation might include a suggestion to install barbed wire on the main gate of a pipeline facility  In response to recommendations that we made in our 2010 report, TSA developed three databases to track CSR and CFSR recommendations and their implementation status by pipeline facility, system, operator, and product type  In addition, the agency recently developed a fourth database to collect and analyze information gathered from pipeline operators’ responses to CSR questions  TSA officials reported that they use this database to assess the extent that TSA’s pipeline security program has met NSTS goals and Pipeline Security Branch priorities  TSA officials stated that they use the CSR goals and priorities database for follow-up on recommendations, indications of improvement in pipeline security, and as an input into TSA performance goals and measures, including the performance measures for the 2018 NSTS Pipeline Security Plan  We found several problems with the databases that indicate that the pipeline security program data are not sufficiently reliable and do not provide quality information that is current, complete, and accurate  First, the CSR recommendations database only included information for reviews conducted from November 2010 through February 2013  TSA officials stated that the agency stopped capturing CSR recommendations and status information in 2014  A TSA official stated that one factor was that the pipeline staffing level was one FTE in fiscal year 2014  However, the Pipeline Security Branch did not resume entering CSR recommendation-related information when staffing levels rose to 6 FTEs in the following year and beyond  As a result, TSA is missing over 5 years of data for the recommendations it made to pipeline operators when conducting CSRs  The agency collected some information from CSRs conducted in fiscal years 2016 and 2017 in the separate CSR goals and priorities database  However, this database does not include all of the information that TSA collects when conducting CSRs  Specifically, the CSR goals and priorities database does not state which companies were reviewed, what specific recommendations were made, or the current status of those recommendations, and only records operators’ responses to 79 of the 222 CSR questions  Second, our review identified instances of missing data, inconsistent data entry formats, and data entry errors in the four databases  For example: The CSR recommendations database had missing data in all 13 of the included fields and a data entry error shifted 50 observations into the wrong fields, impacting both the Status Date and Completion Code fields  The CSR goals and priorities database had seven entries with inconsistent data formatting and five of those entries were not taken into account when calculating summary figures  The CFSR recommendations database had missing data in 3 of 9 fields  There was also inconsistent data entry formats in 3 fields  The CFSR status database had missing data in 7 of 29 fields and inconsistent data entry formats in 4 fields  Finally, TSA has not documented its data entry and verification procedures, such as in a data dictionary or user manual, and does not have electronic safeguards for out-of-range or inconsistent entries for any of the databases it uses to track the status of CSR or CFSR recommendations and analyze operator responses to the CSR  TSA Pipeline Security Branch officials told us that they had not documented data entry and verification procedures and did not have electronic safeguards  This was for two reasons  First, the officials stated that the databases are small and maintained in a commercial spreadsheet program that does not allow for electronic safeguards  However, based on our review of the databases, the spreadsheet program does allow for a variety of electronic safeguards  For example, entries can be restricted to only allow selections from a drop-down list or only allow dates to be entered  Second, only a small number of TSA employees enter information into these databases  TSA officials explained that typically one TSA employee is responsible for entering information from pipeline security reviews, and another individual, usually whoever conducted the review, is tasked to verify the accuracy of the data entered  As a result, according to the officials, any errors would be self-evident and caught during these TSA employees’ reviews  Our work has emphasized the importance of quality information for management to make informed decisions and evaluate agencies’ performance in achieving key objectives and addressing risks  The Standards for Internal Control in the Federal Government states that management should use quality information to achieve agency objectives, where “quality” means, among other characteristics, current, complete, and accurate  In addition, DHS’s Information Quality Guidelines state that all DHS component agencies should treat information quality as integral to every step of the development of information, including creation, collection, maintenance, and dissemination  The guidelines also state that agencies should substantiate the quality of the information disseminated through documentation or other appropriate means  Without current, complete, and accurate information, it is difficult for TSA to evaluate the performance of the pipeline security program  Until TSA monitors and records the status of these reviews’ recommendations, it will be hindered in its efforts to determine whether its recommendations are leading to significant reduction in risk  By entering information on CSR recommendations and monitoring and recording their status, developing written documentation of its data entry and verification procedures and electronic safeguards, and improving the quality of its pipeline security program data, TSA could better ensure it has the information necessary to effectively monitor pipeline operators’ progress in improving their security posture, and evaluate its pipeline security program’s effectiveness in reducing security risks to pipelines  A successful pipeline attack could have dire consequences on public health and safety, as well as the U S  economy  Recent coordinated campaigns by environmental activists to disrupt pipeline operations, and the successful attempts by nation-state actors to infiltrate and obtain sensitive information from pipeline operators’ business and operating systems, demonstrate the dynamic and continuous threat to the security of our nation’s pipeline network  To help ensure the safety of our pipelines throughout the nation, it is important for TSA to address weaknesses in the management of its pipeline security program  TSA’s Pipeline Security Branch revised its security guidelines in March 2018 to, among other things, reflect the dynamic threat environment and incorporate NIST’s Cybersecurity Framework cybersecurity principles and practices  However, without a documented process defining how frequently TSA is to review and, if deemed necessary, revise its guidelines, TSA cannot ensure that its guidelines reflect the latest known standards and best practices for physical and cybersecurity, or address the persistent and dynamic security threat environment currently facing the nation’s pipeline system  Further, without clearly defined criteria for determining pipeline facilities’ criticality, TSA cannot ensure that pipeline operators are applying guidance uniformly and that all of the critical facilities across the pipeline sector have been identified; or that their vulnerabilities have been identified and addressed  TSA could improve its ability to conduct pipeline security reviews and the means that it uses to prioritize which pipeline systems to review based on their relative risk ranking  Establishing a strategic workforce plan could help TSA ensure that it has identified the necessary skills, competencies, and staffing allocations that the Pipeline Security Branch needs to carry out its responsibilities, including conducting security reviews of critical pipeline companies and facilities, as well as their cybersecurity posture  Better considering threat, vulnerability, and consequence elements in its risk assessment and incorporating an independent, external peer review in its process would provide more assurance that the Pipeline Security Branch ranks relative risk among pipeline systems using comprehensive and accurate data and methods  We are making 10 recommendations to TSA: The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to implement a documented process for reviewing, and if deemed necessary, for revising TSA’s Pipeline Security Guidelines at regular defined intervals  (Recommendation 1) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to clarify TSA’s Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities  (Recommendation 2) The TSA Administrator should develop a strategic workforce plan for its Security Policy and Industry Engagement’s Surface Division, which could include determining the number of personnel necessary to meet the goals set for its Pipeline Security Branch, as well as the knowledge, skills, and abilities, including cybersecurity, that are needed to effectively conduct CSRs and CFSRs  (Recommendation 3) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to update the Pipeline Relative Risk Ranking Tool to include up-to-date data to ensure it reflects industry conditions, including throughput and threat data  (Recommendation 4) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to fully document the data sources, underlying assumptions and judgments that form the basis of the Pipeline Relative Risk Ranking Tool, including sources of uncertainty and any implications for interpreting the results from the assessment  (Recommendation 5) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to identify or develop other data sources relevant to threat, vulnerability, and consequence consistent with the NIPP and DHS critical infrastructure risk mitigation priorities and incorporate that data into the Pipeline Relative Risk Ranking Tool to assess relative risk of critical pipeline systems, which could include data on prior attacks, natural hazards, feedback data on pipeline system performance, physical pipeline condition, and cross-sector interdependencies  (Recommendation 6) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool, after the Pipeline Security Branch completes enhancements to its risk assessment approach  (Recommendation 7) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to ensure that it has a suite of performance measures which exhibit key attributes of successful performance measures, including measurable targets, clarity, and baseline and trend data  (Recommendation 8) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to take steps to enter information on CSR recommendations and monitor and record their status  (Recommendation 9) The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to improve the quality of its pipeline security program data by developing written documentation of its data entry and verification procedures, implementing standardized data entry formats, and correcting existing data entry errors  (Recommendation 10) We provided a draft of this report to DHS, DOE, DOT, and FERC  DHS provided written comments which are reproduced in appendix III  In its comments, DHS concurred with our recommendations and described actions planned to address them  DHS, DOE, DOT, FERC, also provided technical comments, which we incorporated as appropriate  We also provided draft excerpts of this product to the American Petroleum Institute (API), the Association of Oil Pipe Lines, the American Gas Association (AGA), the Interstate Natural Gas Association of America (INGAA), the American Public Gas Association, and the selected pipeline operators that we interviewed  For those who provided technical comments, we incorporated them as appropriate  With regard to our first recommendation, that TSA implement a documented process for reviewing, and if deemed necessary, for revising its Pipeline Security Guidelines at regular defined intervals, DHS stated that TSA will implement a documented process for reviewing and revising its Pipeline Security Guidelines at regular defined intervals, as appropriate  DHS estimated that this effort would be completed by March 31, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our second recommendation, that TSA clarify its Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities, DHS stated that TSA will clarify its Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities  DHS estimated that this effort would be completed by May 31, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our third recommendation, that TSA develop a strategic workforce plan for its Security Policy and Industry Engagement's Surface Division, DHS stated that TSA will develop a strategic workforce plan for the division, which includes determining the number of personnel necessary to meet the goals set for the Pipeline Security Branch, as well as the knowledge, skills, and abilities, including cybersecurity, that are needed to effectively conduct CSRs and CFSRs  DHS estimated that this effort would be completed by June 30, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our fourth recommendation, that TSA update the Pipeline Relative Risk Ranking Tool to include up-to-date data in order to ensure it reflects industry conditions, including throughput and threat data, DHS stated that TSA will update the Pipeline Relative Risk Ranking Tool to include up-to-date data in order to ensure it reflects industry conditions, including throughput and threat data  DHS estimated that this effort would be completed by February 28, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our fifth recommendation, that TSA fully document the data sources, underlying assumptions, and judgements that form the basis of the Pipeline Relative Risk Ranking Tool, including sources of uncertainty and any implications for interpreting the results from the assessment, DHS stated that TSA will fully document the data sources, underlying assumptions, and judgements that form the basis of the Pipeline Relative Risk Ranking Tool  According to DHS, this will include sources of uncertainty and any implications for interpreting the results from the assessment  DHS estimated that this effort would be completed by February 28, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our sixth recommendation, that TSA identify or develop other data sources relevant to threat, vulnerability, and consequence consistent with the NIPP and DHS critical infrastructure risk mitigation priorities and incorporate that data into the Pipeline Relative Risk Ranking Tool to assess relative risk of critical pipeline systems, DHS stated that TSA will identify and/or develop other sources relevant to threat, vulnerability, and consequence consistent with the NIPP and DHS critical infrastructure risk mitigation priorities  DHS also stated that TSA will incorporate that data into the Pipeline Risk Ranking Tool to assess relative risk of critical pipeline systems, which could include data on prior attacks, natural hazards, feedback data on pipeline system performance, physical pipeline condition, and cross-sector interdependencies  DHS estimated that this effort would be completed by June 30, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our seventh recommendation, that TSA take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool, after the Pipeline Security Branch completes enhancements to its risk assessment approach, DHS stated that, after completing enhancements to its risk assessment approach, TSA will take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool  DHS estimated that this effort would be completed by November 30, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our eighth recommendation, that TSA ensure that the Security Policy and Industry Engagement's Surface Division has a suite of performance measures which exhibit key attributes of successful performance measures, including measurable targets, clarity, baseline, and trend data, DHS stated that TSA’s Surface Division’s Pipeline Section will develop both physical and cyber security performance measures, in consultation with pipeline stakeholders, to ensure that it has a suite of performance measures which exhibit key attributes of successful performance measures, including measurable targets, clarity, baseline, and trend data  DHS estimated that this effort would be completed by November 30, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our ninth recommendation, that TSA take steps to enter information on CSR recommendations and monitor and record their status, DHS stated that TSA will enter information on CSR recommendations and monitor and record their status  DHS estimated that this effort would be completed by October 31, 2019  This action, if fully implemented, should address the intent of the recommendation  With regard to our tenth recommendation, that TSA take steps to improve the quality of its pipeline security program data by developing written documentation of its data entry and verification procedures, implementing standardized data entry formats, and correcting existing data entry errors, DHS stated that TSA will develop written documentation of its data entry and verification procedures, implementing standardized data entry formats, and correcting existing data entry errors  DHS estimated that this effort would be completed by July 31, 2019  This action, if fully implemented, should address the intent of the recommendation  As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until one day from the report date  At that time, we will send copies to the appropriate congressional committees; the Secretaries of Energy, Homeland Security, and Transportation; the Executive Director of the Federal Energy Regulatory Committee; and other interested parties  In addition, the report is available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact Chris Currie at (404) 679-1875 or curriec@gao gov, and Nick Marinos at (202) 512-9342 or marinosn@gao gov  Key contributors to this report are listed in appendix IV  This appendix lists security guidance and guidance-related tools that the pipeline operators and industry association officials we interviewed identified as adopted or available in order to secure their physical and cyber operations  This list should not be considered to include all physical and cybersecurity guidance that may be available or used by all pipeline operators nor do all operators use all guidance listed  The Transportation Security Administration’s (TSA) Pipeline Security Branch developed the Pipeline Relative Risk Ranking Tool (risk assessment) in 2007  The risk assessment calculates threat, vulnerability, and consequence on variables such as the amount of throughput in the pipeline system (consequence input)  Pipeline Security Branch officials told us that they use the pipeline risk assessment to rank relative risk of the top 100 critical pipeline systems, and the standard operating procedures for conducting Corporate Security Reviews (CSR) state the results of the risk ranking are the primary factor considered when prioritizing CSRs of pipeline companies  However, we identified several factors that likely limit the usefulness of the current assessment in calculating threat, vulnerability, and consequence to allow the Pipeline Security Branch to effectively prioritize reviews of pipeline systems  For example, because the risk assessment has not changed since 2014, information on threat may be outdated  Additionally, sources of data and underlying assumption and judgments regarding certain threat and vulnerability inputs to the assessment are not fully documented  For example, threats to cybersecurity are not specifically accounted for in the description of the risk assessment methodology, making it unclear if cybersecurity is part of the assessment’s threat factor  Further, the risk assessment does not include information that is consistent with the National Infrastructure Protection Plan (NIPP) and other Department of Homeland Security (DHS) priorities for critical infrastructure risk mitigation, such as information on natural hazards and the ability to measure risk reduction (feedback data)  According to Pipeline Security Branch officials, the risk ranking assessment is not intended to be a fully developed risk model detailing all pipeline factors influencing risk  Rather, officials said they are primarily interested in assessing risk data that impacts security  However, because TSA’s Pipeline Security Program is designed to enhance the security preparedness of the pipeline systems, incorporating additional factors that enhance security into their risk calculation of the most critical pipeline systems would better align their efforts with Presidential Policy Directive 21 (PPD-21)  For example, PPD-21 calls for agencies to integrate and analyze information to prioritize assets and manage risks to critical infrastructure, as well as anticipate interdependencies and cascading impacts  Below we present the various shortfalls in the risk assessment—outdated data, limited description of sources and methodology, and opportunities to better align with the NIPP and other DHS priorities for critical infrastructure risk mitigation—in the context of the components that comprise a risk assessment: threat, vulnerability, and consequence  Whereas in 2010 we made recommendations to improve the consequence component in the pipeline relative risk ranking tool, we have currently identified shortfalls that cut across all risk components: threat, vulnerability, and consequence  We identified several shortfalls in the pipeline risk assessment’s calculation of threat  First, while the risk assessment assesses consequence and vulnerability by pipeline system through use of multiple variables, it currently ranks threat for pipeline systems equally  Second, the evolving nature of threats to pipelines may not be reflected, since the risk assessment was last updated in 2014  Third, the threat calculation does not take into account natural hazards  Pipeline Security Branch officials said they currently rank threat equally across pipeline systems because they do not have granular enough threat information to distinguish threat by pipeline  However, ranking threat equally effectively has no effect on the risk calculation for pipeline systems  Further, this judgment is not documented in the risk assessment’s methodology  According to the NIPP, a risk assessment’s methodology must clearly document what information is used and how it is synthesized to generate a risk estimate, including any assumptions and judgments  Additionally, our analysis of the pipeline risk assessment found that it includes at least one field that TSA could use to differentiate threat by pipeline  Specifically, the risk assessment includes a field that accounts for whether a pipeline experienced a previous security threat (including failed attacks), and information provided by Pipeline Security Branch suggests some pipeline systems have experienced such threats  However, the Pipeline Security Branch did not capture these events in the risk assessment’s calculation, which Pipeline Security Branch officials said should be part of the threat calculation, but could not account for why they were not calculated for the systems in the risk assessment  These officials also clarified that incidents such as suspicious photography or vandalism do not constitute an attack to be accounted for in the threat calculation  Documenting such assumptions, judgments, or decisions to exclude information could provide increased transparency to those expected to interpret or use the results  Pipeline Security Branch officials also said that they ranked threat equally because TSA Intelligence and Analysis data show that threats to the oil and natural gas sector have been historically low, and Intelligence and Analysis does not conduct specific threat analysis against individual pipeline systems  However, the Pipeline Security Branch has not updated the risk assessment since June 2014; therefore, the threat information it used to determine threat calculations—and decide to rank threat equally—may be outdated and not reflect the threats to the industry that have emerged in recent years  In fact, pipeline operators we interviewed indicated that the types of threats that concern pipeline operators have evolved  For example, 5 of the 10 operators we interviewed indicated that environmental activists were an increased threat to the pipeline industry because they use sabotage techniques, such as valve turning and cutting in service pipelines with blow torches, against pipelines  Additionally, 6 of 10 pipeline operators we interviewed said cyber attacks from nation-state actors were a primary threat to their industry  Further, when TSA issued its revised Pipeline Security Guidelines in March 2018, it stated that its revisions to the guidelines were made to reflect the ever-changing threat environment in both the physical and cybersecurity realms  However, threats to cybersecurity are not specifically accounted for in the description of the risk assessment methodology  Recent Pipeline Modal and Cyber Modal Threat Assessments include cyber threats to the pipeline industry, but the description of the pipeline risk assessment’s methodology does not specify what types of threat assessments (sources) are used to calculate its threat score  To better align with the guidance in the NIPP for documenting sources of information when conducting risk assessments, the Pipeline Security Branch should document the information used  Keeping the risk assessment updated with current information, as well as documenting those data sources, could help the Pipeline Security Branch ensure it is using its limited resources to review the pipeline systems with greater risk  Natural Hazard Threats to Pipelines The Transportation Systems Sector, of which pipelines are a part, is critical to the Pacific Northwest, but also at risk from natural hazards, like earthquakes  For example, according to the Department of Homeland Security, an earthquake in the Puget Sound region—which relies on the transportation of crude oil from Alaska—could cripple the ports of Seattle and Tacoma, as well as the Olympic and Williams Pipelines greatly impacting the Pacific Northwest Economic Region  Hurricanes are the most frequent disruptive natural hazard for the oil and natural gas subsector and can cause the shutdown of facilities in an area, even when the facilities themselves are not directly affected by the storms  For example, according to the U S  Energy Information Administration, the flow of petroleum into the New York area via pipeline from the Gulf Coast relies on the ability to move it through major terminals  In August 2017, Hurricane Harvey caused major disruptions to crude oil and petroleum product supply chains, including those to New York Harbor from Houston, Texas via the Colonial Pipeline  Due to the hurricane, decreased supplies of petroleum products available for the pipeline in Houston forced Colonial Pipeline to limit operations temporarily  Finally, another shortfall in the current pipeline risk assessment methodology is that it does not account for natural hazards in its threat calculation, even though DHS’s definition of threat includes natural hazards, and security and resilience of critical infrastructure are often presented in the context of natural hazards  According to the NIPP, threat is a natural or manmade occurrence, individual, entity, or action that has or indicates the potential to harm life, information, operations, the environment, and/or property  As such, along with terrorism, criminal activity and cybersecurity, natural disasters are a key element of DHS’s critical infrastructure security and resilience mission  According to Pipeline Security Branch officials, there is not sufficient historical data available that would indicate a significant impact from natural disasters on specific pipeline systems  However, we identified possible sources of data for the Pipeline Security Branch to consider  For example, a 2016 RAND Corporation study examined national infrastructure systems’ exposure to natural hazards, including pipelines  Additionally, the Federal Emergency Management Agency (FEMA) has collaborated with stakeholders to develop the National Risk Index to, among other things, establish a baseline of natural hazards risk for the United States While there may not be historical data of natural hazard impact for every pipeline system, consulting other sources or experts could provide regional data or analysis to build a more comprehensive threat picture to help distinguish threats by pipeline system  According to the NIPP, hazard assessments should rely not only on historical information, but also future predictions about natural hazards to assess the likelihood or frequency of various hazards  We also identified multiple shortfalls in the vulnerability factors used in the risk assessment methodology, such as the potential uncertainty of the number of critical facilities and incorporating a feedback mechanism to calculate overall risk reduction  Other considerations for vulnerability calculations include physical condition of the pipeline system, cybersecurity activities, and interdependencies among sectors  The number of critical facilities a pipeline system has identified is used as an input for its vulnerability calculation in the Pipeline Security Branch’s risk assessment methodology  As discussed earlier, we identified deficiencies in TSA’s criteria for identifying critical facilities, and found that well-defined criteria and consistent application of the criteria for identifying critical facilities could improve the results of the Pipeline Security Branch’s risk assessment  Nevertheless, communicating in the risk assessment the uncertainty that may be inherent in this self-reported information would better align the risk assessment with the NIPP  Measuring Effectiveness in a Voluntary Environment According to the National Infrastructure Protection Plan, the use of performance metrics is an important step in the critical infrastructure risk management process to enable assessment of improvements in critical infrastructure security and resilience  The metrics provide a basis for the critical infrastructure community to establish accountability, document actual performance, promote effective management, and provide a feedback mechanism to inform decision making  By using metrics to evaluate the effectiveness of voluntary partnership efforts to achieve national and sector priorities, critical infrastructure partners can adjust and adapt their security and resilience approaches to account for progress achieved, as well as changes in the threat and other relevant environments  Metrics are used to focus attention on areas of security and resilience that warrant additional resources or other changes through an analysis of challenges and priorities at the national, sector, and owner/operator levels  Metrics also serve as a feedback mechanism for other aspects of the critical infrastructure risk management approach  Another shortfall in the risk assessment is its inability to reliably measure the progress a pipeline system made in addressing vulnerability gaps between security reviews  The current risk assessment includes a CSR score as part of its vulnerability calculation, which was developed in part in response to our 2010 recommendation to use more reliable data to measure a pipeline system’s vulnerability gap  However, during our review, Pipeline Security Branch officials said they plan to remove pipeline companies’ CSR scores from the risk assessment calculations, because they and industry partners do not have confidence that the score appropriately measures a pipeline system’s vulnerability  For example, Pipeline Security Branch officials explained that pipeline companies consider security factors differently, which can lead to variation in implementing risk reduction activities and by extension lead to different CSR scores  However, removing the CSR score eliminates the only feedback mechanism in the risk assessment from a pipeline company’s actual security review conducted by the Pipeline Security Branch  The NIPP and DHS’s Risk Management fundamentals emphasize the important role that such feedback mechanisms play in risk management  Officials from the Pipeline Security Branch agree on the importance of a feedback mechanism tying results of reviews to a revised vulnerability metric, but said they need a better measure than the current CSR score which is unreliable for comparative and analytic purposes  Developing a feedback mechanism based on implementation of TSA’s Pipeline Security Guidelines could be an important input to the risk assessment’s vulnerability calculation  This information would also inform the amount of risk pipeline companies are reducing by implementing the guidelines and could be used to inform overall risk reduction  The physical and cyber environments in which the pipeline sector operates also present vulnerabilities not accounted for in the pipeline risk assessment  In recent years, DHS has listed the potential for catastrophic losses to dramatically increase the overall risk associated with failing infrastructure and highlighted risks due to climate change and natural hazards to pipelines  For example, DHS reported extreme temperatures—such as higher and lower temperatures over prolonged periods of time—increase vulnerability to the critical infrastructure by causing elements to break and cease to function  Pipelines that freeze and then rupture can affect the energy and transportation systems sectors  As noted above, according to the NIPP, a natural or man-made occurrence or action with the potential to harm life is considered a threat, whereas vulnerability is defined as a physical feature or operational attribute that renders an entity open to exploitation or susceptible to a given threat or hazard  While pipeline physical condition is typically thought of in context of safety, pipeline condition or location (such as above or below ground) could touch upon pipeline security as it relates to system vulnerability  For example, a pipeline system or segment of a system with a compromised physical condition due to corrosion or age could affect the system’s vulnerability to threats and affect its ability to recover from such threats by potentially increasing the time a system is offline  According to the Transportation Systems Sector-Specific Plan, vulnerabilities to damage in aging transportation infrastructure—of which pipelines are a part—are projected to increase with the continued effects of climate change  Further, according to TSA’s Pipeline Security and Incident Recovery Protocol Plan, pipeline integrity efforts—including the design, construction, operation, and maintenance of pipelines—are important to pipeline security because well-maintained, safe pipelines are more likely to tolerate a physical attack  The Pipeline Security Branch already collects information from the Pipeline and Hazardous Materials Safety Administration (PHMSA) for its risk assessment, specifically information on High Consequence Area and High Threat Urban Area mileage  By considering additional information PHMSA collects on pipeline integrity, the Pipeline Security Branch could also use the information to help pipeline operators identify security measures to help reduce the consequences related to the comparatively higher vulnerability of an aging or compromised system  This would align with the Pipeline Security Branch’s efforts to improve security preparedness of pipeline systems and could better inform its vulnerability calculations for relative risk ranking of pipeline systems  Capturing cybersecurity in the risk assessment is also an area for improvement  Pipeline Security Branch officials told us they consulted with the National Cybersecurity and Communications Integration Center to revise TSA’s Pipeline Security Guidelines to align with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and that absent data specific to pipelines on their cybersecurity vulnerabilities, they are unable to include a pipelines’ vulnerability to cyber attack in the risk assessment  However, the Pipeline Security Branch recently updated the security review questions asked of pipeline operators during corporate and critical facility reviews based on the recently updated Pipeline Security Guidelines  Using these updated questions related to companies’ cybersecurity posture, the Pipeline Security Branch could collect additional information on cybersecurity vulnerabilities which could inform the risk assessment  This could be an element of the feedback mechanism described above and emphasized in the NIPP  Additionally, NIST identified several supply chain vulnerabilities associated with cybersecurity, which are not currently accounted for in TSA’s Pipeline Security Guidelines  As pipeline operators implement increasing levels of network technologies to control their systems, the Pipeline Security Branch may not be fully accounting for pipeline systems’ cybersecurity posture by not including the cybersecurity-related vulnerabilities in its risk assessment inputs  Finally, we identified shortfalls in cross-sector interdependencies, which could affect vulnerability calculations  According to the NIPP, understanding and addressing risks from cross-sector dependencies and interdependencies is essential to enhancing critical infrastructure security and resilience  The Pipeline Security Branch’s pipeline risk assessment currently considers the effects of a pipeline system’s ability to service assets such as major airports, the electric grid, and military bases  However, consequence is calculated on the loss or disruption of the pipeline system to these other assets and does not capture the dependency of the pipeline system on other energy sources, such as electricity  Weather events such as Gulf of Mexico hurricanes and Superstorm Sandy highlighted the interdependencies between the pipeline and electrical sectors  Specifically, according to a 2015 DHS annual report on critical infrastructure, power failures during Superstorm Sandy in 2012 closed major pipelines for 4 days, reducing regional oil supplies by 35 to 40 percent  The report goes on to say that the interconnected nature of infrastructure systems can lead to cascading impacts and are increasing in frequency  Pipeline Security Branch officials are considering cross-sector interdependencies and said they discuss these factors with operators as they relate to system resiliency  Considering interdependencies of sectors in both directions—such as calculating the likelihood that an input like electricity could fail and cause disruptions to critical pipelines—could improve the calculations in the pipeline risk assessment  As previously discussed, the Pipeline Security Branch last calculated relative risk among the top 100 pipeline systems in 2014  When doing so, it used pipeline systems’ throughput data from 2010 to assess relative risk  According to Pipeline Security Branch officials, the amount of throughput in pipeline systems does not change substantially year to year  However, Standards for Internal Control in the Federal Government calls for management to use quality information to achieve the entity’s objectives, including using relevant data from reliable sources obtained in a timely manner  The Pipeline Security Branch uses throughput data as a consequence factor in the risk assessment to determine a pipeline system’s relative risk score  Throughput changes could affect relative risk ranking and the Pipeline Security Branch’s ability to accurately prioritize reviews based on relative risk  Chris P  Currie at (404) 679-1875 or curriec@gao gov Nick Marinos at (202) 512-9342 or marinosn@gao gov  In addition to the contacts named above, Ben Atwater, Assistant Director; Michael W  Gilmore, Assistant Director; and Michael C  Lenington, Analyst-in-Charge, managed this assignment  Chuck Bausell, David Blanding, Dominick Dale, Eric Hauswirth, Kenneth A  Johnson, Steve Komadina, Susanna Kuebler, Thomas Lombardi, David Plocher, and Janay Sam made significant contributions to this report 


Report 2:  We found that each of these four types of potentially inaccurate data would have changed estimated Medicare CLFS expenditures from 2018 through 2020 by 1 percent or less if CMS had instead excluded the data  To conduct this analysis, we recalculated Medicare rates after excluding each type of data and estimated Medicare expenditures assuming 2016 rates of utilization  Although weighted median private-payer rates were lower than Medicare’s 2017 national limitation amounts for 88 percent of tests, we estimated the total Medicare expenditures based on the 2018 CLFS would likely increase by 3 percent ($225 million overall) compared to 2016 expenditures, assuming test utilization remained at 2016 levels  This increase in estimated expenditures is due, in part, to CMS’s use of above-average payment rates as a baseline to calculate payment rates for those laboratory tests affected by PAMA’s annual payment-rate reduction limit of 10 percent  (See fig  4 ) When applying the 10-percent payment-rate reduction limit, CMS used as its starting point the 2017 national limitation amounts in order to set a single, national payment rate for each laboratory test  Thus, the Medicare payment rate for a test in 2018 could not be less than 90 percent of the test’s 2017 national limitation amount  However, prior to 2018, some payment rates were commonly lower than the national limitation amounts because they were based on the lesser of (1) the amount billed on claims, (2) the local fee for a geographic area, or (3) a national limitation amount, and because panel tests had different bundled payment rates  As a result, by reducing payment rates from national limitation amounts, CMS did not always reduce rates from what Medicare actually paid  Panel tests, in particular, frequently received bundled payment rates that differed substantially from national limitation amounts associated with their billing codes prior to 2018  We compared national limitation amounts, which represent maximum Medicare payment rates for tests, with the average amounts Medicare allowed for payment in 2016, which reflect actual Medicare payment rates  For example, figure 5 below shows that the 2017 national limitation amount for comprehensive metabolic panel tests ($14 49) was substantially higher than both the average amount Medicare allowed for payment in 2016 ($11 45) and the median payment rate laboratories reported receiving from private payers ($9 08)  As a result, using the 2017 national limitation amount as a basis for payment reductions caused Medicare’s payment rate to increase from an average allowed amount of $11 45 in 2016, to a payment rate of $13 04 in 2018, instead of decreasing towards a lower median private- payer rate of $9 08  By increasing average payment rates rather than phasing in reductions to rates, CMS’s implementation may lead to paying more than necessary for some tests  Federal standards for internal control for information and communications require agency management to use quality information to achieve its objectives  Basing reductions on national limitation amounts rather than more relevant information on how much Medicare actually paid—such as the average allowable amounts in 2016, for example—could result in Medicare paying more than necessary by $733 million from 2018 through 2020, according to our estimates  In implementing PAMA, CMS eliminated bundled rates for panel tests that lack billing codes and started paying separately for each component test instead  CMS also implemented the 2018 CLFS in a manner that could lead to unbundling payment rates for panel tests with billing codes  If payment rates for all panel tests were unbundled, we estimated that Medicare expenditures could increase by $218 million for panel tests that lack billing codes and by as much as $10 1 billion for panel tests with billing codes from 2018 through 2020  CMS also estimated that there could be significant risks of paying more than necessary associated with unbundling and has taken initial steps to monitor these risks and explore possible responses, but had not yet responded to these risks as of July 2018  CMS Unbundled Payment Rates for Panel Tests without Billing Codes Beginning in 2018, CMS no longer uses bundled payment rates for panel tests without billing codes and instead pays laboratories individual payments for each component test that comprises these panel tests  However, CMS staff and members of its advisory panel discussed concerns with this approach  At an advisory panel meeting in 2016, CMS staff relayed concerns from stakeholders that CMS would not be able to collect valid data on private-payer rates for these panel tests  According to agency staff, stakeholders had informed CMS that private payers commonly use bundled payment rates for these panel tests, but laboratories would only be able to report unbundled payment rates for individual component tests  We estimated that unbundling these payment rates would increase Medicare expenditures from 2018 through 2020 by $218 million in comparison to the estimated Medicare expenditures over the same time period based on Medicare’s 2016 utilization and allowable amounts  For example, under the 2016 CLFS, Medicare paid approximately 435,000 claims for panel tests that included the laboratory tests assay of creatinine (HCPCS code 82565) and assay of urea nitrogen (HCPCS code 84520) at an average bundled payment rate of $6 82  In contrast, under the 2018 CLFS, these two component tests are reimbursed individually at $6 33 and $4 88, respectively, or $11 21 combined—a 63 percent increase  Despite concerns about the validity of available private-payer data on component tests for panel tests without billing codes, CMS used these data to set payment rates for component tests  CMS officials told us that they stopped using bundled payment rates for these panel tests because it is not clear that CMS has the authority to combine the individual component tests into groups for bundled payment as it did before 2018 due to PAMA’s reference to payments for each test  However, in July 2018, CMS officials told us the agency was reviewing its authority regarding this issue  CMS officials told us they are exploring alternative approaches that could limit increases to Medicare expenditures but had not yet determined what additional legal authority would be needed, if any, and did not know when CMS would make this determination  Agency officials told us that CMS has taken initial steps to monitor unbundling and explore possible responses, including the following: Monitoring unbundling: CMS has begun monitoring changes in panel test utilization, payment rates, and expenditures associated with its implementation of PAMA, according to officials  For example, CMS officials told us that preliminary data indicated that Medicare payments for individual component tests of panel tests has increased substantially in 2018, but, as of July 2018, it was too early to draw conclusions from these data because laboratories have up to one year to submit claims for tests  Collecting input on alternatives: In 2016, a subcommittee of an advisory panel that CMS established reviewed Medicare’s use of bundled payment rates for panel tests and published different approaches for CMS to consider implementing in combination with other changes to implement PAMA  CMS’s Implementation of PAMA May Have Allowed Unbundling of Payment Rates for Panel Tests with Billing Codes Beginning in 2018, laboratories that submit claims for any of the seven panel tests with billing codes by using the billing codes for the individual component tests now receive the payment rate for each component test, rather than the bundled rate  Prior to 2018, laboratories could submit claims for these panel tests either by using the specific codes for panel tests or by billing separately for each of the component tests, and, regardless of how laboratories submitted claims, Medicare Administrative Contractors would pay bundled payment rates based on how many of the 23 component tests were conducted  However, CMS instructed Medicare Administrative Contractors to stop bundling payment rates for tests that are billed individually on claims rather than billed on claims using codes for panel tests, beginning in 2018  CMS did so because it was not clear that CMS had the authority to combine the individual component tests into groups for bundled payment as it did before 2018 due to PAMA’s reference to payments for individual tests, according to agency officials  This change could potentially have a large effect on Medicare spending  For example, if a laboratory submitted a claim individually for the 14 component tests that comprise a comprehensive metabolic panel it would receive a payment of $81 91, a 528 percent increase from the 2018 Medicare bundled payment rate of $13 04 for this panel test  (See fig  6 ) Improving how reductions to payment rates for panel tests are phased in could mitigate, but not completely counteract, the effect of unbundling these payment rates  For example, for the comprehensive metabolic panel test described in figure 6, basing maximum reductions on 2016 average allowable amounts would result in a 2018 Medicare bundled payment rate of $10 31 instead of $13 04 and individual payment rates for the 14 component tests that total $56 06—a 32 percent decrease from $81 91 that Medicare would otherwise pay  If the payment rate for each panel test with a billing code were unbundled, we estimated that Medicare expenditures for these tests from 2018 through 2020 could reach $13 5 billion, a $10 1 billion increase from the $3 3 billion we estimated Medicare would spend using the bundled payment rates in the CLFS  Similarly, prior to implementing PAMA, CMS estimated that Medicare expenditures to physician-office, independent, and other non-hospital laboratories could potentially increase as much as $2 5 billion in 2018, alone if it paid for the same number of panel tests with billing codes as it did in 2016 but paid for each component test individually  These estimates represent an upper limit on the increased expenditures that could occur if every laboratory stopped using panel test billing codes and instead used the billing codes for individual component tests  We do not know the extent to which laboratories will stop filing claims using panel test billing codes  CMS officials also told us that they were aware of the risks associated with paying for the individual component tests instead of the bundled payment rate for a panel test with a billing code  However, CMS guidance, which was effective in 2018, continued to allow laboratories to use the billing codes for individual component tests rather than the billing code for the panel  CMS officials explained that this was due to PAMA’s reference to payments for individual tests, similar to CMS’s decision to stop paying bundled rates for panel tests without billing codes  At the time we did our work, CMS had not implemented a response to these risks but had taken some initial steps to monitor unbundling and consider alternative approaches to Medicare payment rates for these tests  HHS provided additional information on planned activities to address these risks in its written comments on a draft of this report  (See app  III ) CMS collected data on private-payer rates from laboratories that were required to report these data, but not all laboratories complied with the reporting requirement, and the extent of noncompliance remains unclear  PAMA’s provision directing CMS to phase in payment-rate reductions to Medicare payment rates likely moderates the potential adverse effects of incomplete private-payer data  However, in the future, failing to collect complete data could substantially affect Medicare payment rates because private-payer rates alone will determine Medicare payment rates  In addition, we estimated that Medicare expenditures on laboratory tests will be $733 million higher from 2018 through 2020, because CMS started phasing in payment-rate reductions from national limitation amounts instead of more relevant data on actual payment rates, such as average allowable amounts  Finally, changes to payment rates, billing practices, and testing practices could increase Medicare expenditures by as much as $10 3 billion from 2018 through 2020, if CMS does not address the risks associated with unbundling payment rates for panel tests  Agency officials indicated that it was unclear if PAMA limited CMS’s ability to combine individual component tests into groups for bundled payment, and, as of July 2018, CMS was reviewing this matter but did not know when it would make a determination  We are making the following three recommendations to CMS: The Administrator of CMS should take steps to collect all of the data from all laboratories that are required to report  If only partial data can be collected, CMS should estimate how incomplete data would affect Medicare payment rates and address any significant challenges to setting accurate Medicare rates  (Recommendation 1) The Administrator of CMS should phase in payment-rate reductions that start from the actual payment rates Medicare paid prior to 2018 rather than the national limitation amounts  CMS should revise these rates as soon as practicable to prevent paying more than necessary  (Recommendation 2) The Administrator of CMS should use bundled rates for panel tests, consistent with its practice prior to 2018, rather than paying for them individually; if necessary, the Administrator of CMS should seek legislative authority to do so  (Recommendation 3) We provided a draft of this report to HHS for review and comment  HHs provided written comments, which are reproduced in appendix III  HHS also provided technical comments, which we incorporated as appropriate  HHS concurred with our first recommendation to take steps to collect all data from laboratories required to report and commented that it is evaluating ways to increase reporting  In particular, in a November 2018 final rule, HHS changed the definition of an applicable laboratory, which it expects will increase the number of laboratories required to report data on private-payer rates to the agency  HHS neither agreed nor disagreed with our second recommendation to phase in payment-rate reductions that start from the actual payment rates Medicare paid prior to 2018  HHS noted that any changes to the phasing in of payment-rate reductions would need to be implemented through rulemaking  We estimated that by using the national limitation amounts as a starting point for these reductions, Medicare expenditures would increase by $733 million from 2018 through 2020  For this reason, we continue to believe CMS should revise these rates as soon as practicable and through whatever mechanism CMS determines appropriate  HHS neither agreed nor disagreed with our third recommendation to use bundled rates for panel tests  However, HHS commented that it is taking steps to address this issue  More specifically, for panel tests with billing codes, HHS is working to implement an automated process to identify claims for panel tests that should receive bundled payments, similar to the process used to bundle payment rates for these panel tests prior to PAMA’s implementation and anticipates implementing this change by the summer of 2019  In addition, HHS posted guidance on November 14, 2018, stating that the panel tests with billing codes, laboratories should submit claims using the corresponding code rather than the codes for the separate component tests beginning in 2019  To reduce the potential of paying more than necessary, we believe it is important that CMS implement its proposed automated process to allow for these payments as soon as possible  In contrast, for panel tests without billing codes, HHS commented that it is continuing to review its authority and considering other approaches to payment for these panel tests, such as adding codes to the CLFS  We estimate that unbundling the payment for these panel tests could increase Medicare expenditures by $218 million from 2018 through 2020 compared to expenditures based on Medicare’s 2016 utilization, and the actual amount could be higher if utilization increases  For this reason, we believe CMS should implement bundled payment rates for these panel tests to avoid excess payments  We are sending copies of this report to the appropriate congressional committees and the Administrator of CMS  In addition, the report is available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact me at (202) 512-7114 or cosgrovej@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix IV  Appendix I: Table of Key Dates Related to Developing the New Payment Rates for the 2018 Clinical Laboratory Fee Schedule Event Centers for Medicare and Medicaid Services (CMS) issued the CLFS proposed rule  CMS issued responses to frequently asked questions regarding the CLFS proposed rule  CMS issued the CLFS final rule  CMS issued responses to frequently asked questions regarding the CLFS final rule  CMS held the joint Annual Laboratory Public Meeting and Medicare Advisory Panel on Clinical Diagnostic Laboratory Tests meeting  CMS issued laboratory billing codes subject to data collection and reporting  CMS issued guidance to laboratories for collecting and reporting data  CMS held a Medicare Advisory Panel on Clinical Diagnostic Laboratory Tests meeting  CMS issued the CLFS data reporting template  CMS collected data on (1) the billing code associated with a laboratory test; (2) the private-payer rate for each laboratory test for which final payment was made during the data collection period (i e , January 1, 2016, through June 30, 2016); and (3) the volume of tests performed for each billing code at that private-payer rate  CMS issued additional guidance for laboratories as the data collection period began  CMS issued the CLFS fee-for-service data collection user’s manual  CMS issued revised guidance to laboratories for collecting and reporting data  CMS held a Medicare Advisory Panel on Clinical Diagnostic Laboratory Tests meeting  CMS released the proposed CLFS rates  CMS held a Medicare Advisory Panel on Clinical Diagnostic Laboratory Tests meeting  Deadline for stakeholders to submit comments on the proposed CLFS rates to CMS  CMS issued the final CLFS rates  New CLFS rates became effective  Table 4 below demonstrates the challenges the Centers for Medicare & Medicaid Services (CMS) faces in setting accurate Medicare payment rates to the extent it does not collect complete data from laboratories on private-payer rates  Specifically, the table shows the potential effect that collecting additional data for each laboratory test could have on Medicare expenditures and how this effect could vary depending on (1) the amount of additional data collected, (2) payment rates in the additional data, and (3) limits to annual reductions in Medicare payment rates  These limits are in place from 2018 through 2023 to phase in changes to payment rates  In addition to the contact named above, Martin T  Gahart, Assistant Director; Gay Hee Lee, Analyst-in-Charge; Kaitlin Farquharson, Sandra George, Dan Lee, Elizabeth T  Morrison, Laurie Pachter, Vikki Porter, and Russell Voth made key contributions to this report 

ground_truth: Medicare paid $7.1 billion for 433 million laboratory tests in 2017. These tests help health care providers prevent, diagnose, and treat diseases. PAMA included a provision for GAO to review CMS's implementation of new payment rates for these tests. This report addresses, among other objectives, (1) how CMS developed the new payment rates; (2) challenges CMS faced in setting accurate payment rates and what factors may have mitigated these challenges; and (3) the potential effect of the new payment rates on Medicare expenditures. GAO analyzed 2016 Medicare claims data (the most recent data available when GAO started its work and the year on which new payment rates were based) and private-payer data CMS collected. GAO also interviewed CMS and industry officials. The Centers for Medicare & Medicaid Services (CMS) within the Department of Health and Human Services (HHS) revised the Clinical Laboratory Fee Schedule (CLFS) for 2018, establishing new Medicare payment rates for laboratory services. Prior to 2018, these rates were based on historical laboratory fees and were typically higher than the rates paid by private payers. The Protecting Access to Medicare Act of 2014 (PAMA) required CMS to develop a national fee schedule for laboratory tests based on private-payer data. To revise the rates, CMS collected data on private-payer rates from approximately 2,000 laboratories and calculated median payment rates, weighted by volume. GAO found that the median private-payer rates were lower than Medicare's maximum payment rates in 2017 for 88 percent of tests. CMS is gradually phasing in reductions to Medicare payment rates, limited annually at 10 percent over a 3-year period (2018 through 2020), as outlined in PAMA. CMS relied on laboratories to determine whether they met data reporting requirements, but agency officials told GAO that CMS did not receive data from all laboratories required to report. CMS did not estimate the amount of data it should have received from laboratories that were required to report but did not. CMS took steps to exclude inaccurate private-payer data and estimated how collecting certain types and amounts of additional private-payer data could affect Medicare expenditures. However, it is not known whether CMS's estimates reflect the actual risk of incomplete data resulting in inaccurate Medicare payment rates. GAO found that PAMA's phased in reductions to new Medicare payment rates likely mitigated this risk of inaccurate Medicare payment rates from 2018 through 2020. However, GAO found that collecting incomplete data could have a larger effect on the accuracy of Medicare payment rates in future years when PAMA allows for greater payment-rate reductions. CMS's implementation of the new payment rates could lead Medicare to pay billions of dollars more than is necessary and result in CLFS expenditures increasing from what Medicare paid prior to 2018 for two reasons. First, CMS used the maximum Medicare payment rates in 2017 as a baseline to start the phase in of payment-rate reductions instead of using actual Medicare payment rates. This resulted in excess payments for some laboratory tests and, in some cases, higher payment rates than those Medicare previously paid, on average. GAO estimated that Medicare expenditures from 2018 through 2020 may be $733 million more than if CMS had phased in payment-rate reductions based on the average payment rates in 2016. Second, CMS stopped paying a bundled payment rate for certain panel tests (groups of laboratory tests generally performed together), as was its practice prior to 2018, because CMS had not yet clarified its authority to do so under PAMA, according to officials. CMS is currently reviewing whether it has the authority to bundle payment rates for panel tests to reflect the efficiency of conducting a group of tests. GAO estimated that if the payment rate for each panel test were unbundled, Medicare expenditures could increase by as much as $10.3 billion from 2018 through 2020 compared to estimated Medicare expenditures using lower bundled payment rates for panel tests. GAO recommends that the Administrator of CMS (1) collect complete private-payer data from all laboratories required to report or address the estimated effects of incomplete data, (2) phase in payment-rate reductions that start from the actual payment rates rather than the maximum payment rates Medicare paid prior to 2018, and (3) use bundled rates for panel tests. HHS concurred with GAO's first recommendation, neither agreed nor disagreed with the other two, and has since issued guidance to help address the third. GAO believes CMS should fully address these recommendations to prevent Medicare from paying more than is necessary.