prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.



Report 2: To varying extents, Internet content providers—also called “edge providers”—and Internet service providers collect, use, and share information from their customers to enable their services, support advertising, and for other purposes  Many companies describe these and other privacy-related practices in privacy policies, to which consumers may be required to consent in order to use the service  Consumers access such services through a variety of devices, including mobile phones and tablets, computers, and other devices connected to the Internet by wired or wireless means  A nationwide survey that the U S  Census Bureau conducted for NTIA in 2017 found that 78 percent of Americans ages 3 and older used the Internet  Another nationwide survey that the Pew Research Center conducted in 2018 found that 69 percent of American adults reported that they use some kind of social media platform such as Facebook  No comprehensive federal privacy law governs the collection, use, and sale or other disclosure of personal information by private-sector companies in the United States  Rather, the federal privacy framework for private-sector companies is comprised partly of a set of tailored laws that govern the use and protection of personal information for specific purposes, in certain situations, or by certain sectors or types of entities  These laws include the Fair Credit Reporting Act, which protects the security and confidentiality of personal information collected or used to help make decisions about individuals’ eligibility for such products as credit or for insurance or employment; the Gramm-Leach-Bliley Act, which protects nonpublic personal information that individuals provide to financial institutions or that such institutions maintain; and the Health Insurance Portability and Accountability Act which establishes a set of national standards for the protection of certain health information  In addition, as detailed in this report, FTC addresses consumer concerns about Internet privacy using its broad authority to protect consumers from unfair and deceptive trade practices  We have reported on a variety of Internet privacy concerns in recent years that include the collection and use of data such as people’s Internet browsing histories, purchases, locations, and travel routes, including: Internet of things: In 2017, we found that as new and more devices become connected, they increase not only the opportunities for security and privacy breaches, but also the scale and scope of any resulting consequences  Vehicle data privacy: We found in 2017 that most selected automakers reported limiting their data collection, use, and sharing, but their written notices did not clearly identify data sharing and use practices  Information resellers: In a 2013 report on companies that collect and resell information on individuals, we found that no overarching federal privacy law governs the collection and sale of personal information among private-sector companies, including information resellers  We found that gaps exist in the federal privacy framework, which does not fully address changes in technology and the marketplace  Among the issues we noted were the potential need for changes to privacy controls for web tracking, mobile devices, and other technologies  We recommended that Congress consider strengthening the consumer privacy framework to reflect the effects of changes in technology and the marketplace  Such legislation has not been enacted to date  Mobile device location data: In 2012, we found that, according to privacy advocates, consumers are generally unaware of how their location data are shared with and used by third parties  We recommended that FTC consider issuing guidance establishing FTC’s views regarding mobile companies’ appropriate actions to protect location data privacy  FTC implemented that recommendation in 2013  To guide their privacy practices, many organizations and governments have used the Fair Information Practice Principles  As noted above, these principles—which are not limited to Internet privacy—address the collection and use of personal information, data quality and security, and transparency, among other things, and have served as the basis for many of the privacy recommendations federal agencies have made  The Organisation for Economic Co-Operation and Development developed a version of these principles in 1980 that has been widely adopted and was updated in 2013  In 2000, FTC recommended that Congress enact a consumer Internet privacy statute that would require companies to comply with broad and flexible definitions of the principles, and an FTC commissioner said in a 2014 speech that they are a solid framework and are flexible and effective  While they are principles, not legal requirements, they provide a possible approach for balancing the need for privacy with other interests  Table 1 provides more detailed information about the principles  FTC is primarily a law enforcement agency that, among other responsibilities, currently has the lead in overseeing Internet privacy at the federal level  Specifically, it addresses consumer concerns about Internet privacy, both for Internet service providers and content providers, using its general authority under section 5 of the FTC Act  Section 5, as amended in 1938, prohibits “unfair or deceptive acts or practices in or affecting commerce ” Although the FTC Act generally empowers FTC to take enforcement action, it prohibits FTC from taking action against common carriers such as telecommunication services, airlines, and railroads under certain circumstances  FTC also does not have jurisdiction over banks, credit unions, or savings and loans institutions  Even though the FTC Act does not speak in explicit terms about protecting consumer privacy, the Act authorizes such protection to the extent it involves practices FTC defines as unfair or deceptive  According to FTC, an act or practice is “unfair” if it causes, or is likely to cause, substantial injury not reasonably avoidable by consumers and not outweighed by countervailing benefits to consumers or competition as a result of the practice  FTC has used this “unfairness” authority to address situations where a company has allegedly failed to properly protect consumers’ data  According to FTC, a representation or omission is “deceptive” if it is material and is likely to mislead consumers acting reasonably under the circumstances  For example, the omission of terms in an advertisement would need to be material and likely to mislead consumers in order to be deceptive  FTC applies this “deceptive” authority to address deceptions or violations of written privacy policies and representations concerning data security  FTC’s Bureau of Consumer Protection investigates Internet privacy complaints from various sources, including consumers, other agencies, Congress, and industry, and also initiates investigations on its own  If the bureau has reason to believe that an entity is engaging in an unfair or deceptive practice, it may forward an enforcement recommendation to the commission  The commission then determines whether to pursue an enforcement action, which can include the following: litigating commission-filed administrative complaints before an FTC administrative law judge; filing and litigating complaints in federal district court seeking preliminary and permanent injunctions, monetary redress for consumers or other equitable relief; or referring complaints seeking civil penalties for violations of rules authorizing such penalties or for violations of administrative orders to the Department of Justice (DOJ) and assisting DOJ in litigating those cases (if DOJ does not take action, FTC can pursue the action on its own)  FTC’s Internet privacy enforcement cases may be settled without the imposition of civil penalties  Instead, FTC typically enters into settlement agreements requiring companies to take actions such as: implementing reasonable privacy and security programs; being subject to long-term monitoring of compliance with the settlements by outside entities; providing monetary redress to consumers; forfeiting any money gained from the unfair or deceptive conduct; deleting illegally obtained consumer information; and providing transparency and choice mechanisms to consumers  If a company violates an FTC final consent order, the agency can then request civil monetary penalties in court for the violations  In addition, as discussed below, FTC can seek to impose civil monetary penalties directly for violations of certain privacy statutes and regulations such as the statute pertaining to the Internet privacy of children and its implementing regulations  Although FTC can levy civil penalties up to $41,484 per violation, per day, against an entity that violates a trade regulation rule under the FTC Act, it has not promulgated trade regulation rules under section 5 specific to privacy  Although FTC has not implemented its section 5 authority by issuing regulations regarding Internet privacy, it has issued regulations to implement other statutory authorities  Likewise, other federal agencies use regulations to implement the statutes they are charged with administering  The process by which federal agencies typically develop and issue regulations is spelled out in the Administrative Procedure Act (APA)  Section 553 of the APA establishes procedures and requirements for what is known as “informal” rulemaking, also known as notice-and- comment rulemaking  Among other things, section 553 generally requires agencies to publish a notice of proposed rulemaking in the Federal Register  After giving interested persons an opportunity to comment on the proposal by providing “data, views, or arguments,” the statute then requires the agency to publish the final rule in the Federal Register  Regulations may be enforced in various ways, for example, by seeking civil penalties for non-compliance  FTC has authority to seek civil penalties, for example, when a company knowingly violates a regulation or, as discussed below, a final consent order  In contrast to the APA section 553 rulemaking process, the rulemaking process that FTC generally must follow to issue rules under the FTC Act is spelled out in the Magnuson-Moss Warranty Act amendments to the FTC Act (Magnuson-Moss)  The Magnuson-Moss amendments— enacted in 1975 partly in response to industry opposition to FTC’s trade regulations, and amended in 1980—require additional rulemaking steps beyond APA section 553  For example, Magnuson-Moss requires FTC to publish an advance notice of proposed rulemaking in addition to the notice of proposed rulemaking required by the APA, and to offer interested parties the opportunity for an informal hearing involving oral testimony  FTC has not promulgated any regulations using the Magnuson-Moss procedures since 1980; according to FTC staff, the additional steps required under Magnuson-Moss add time and complexity to the rulemaking process  The Children’s Online Privacy Protection Act (COPPA), enacted in 1998, governs the online collection of personal information from children under the age of 13 by operators of websites or online services, including mobile applications  COPPA required FTC to issue and enforce regulations concerning children’s online privacy and directed FTC to promulgate these regulations using the APA section 553 notice-and- comment rulemaking process  COPPA contained a number of specific requirements that FTC was directed to implement by regulation, such as requiring websites to post a complete privacy policy, to notify parents directly about their information collection practices, and to obtain verifiable parental consent before collecting personal information from their children or sharing it with others  The commission’s original COPPA regulations became effective on April 21, 2000, and amended COPPA regulations took effect on July 1, 2013  According to an FTC staff member, COPPA and FTC’s implementing regulations reflect various principles that are similar to the Fair Information Practice Principles  FCC regulates the telecommunications industry pursuant to the Communications Act of 1934, as amended (Communications Act)  FCC follows the APA section 553 notice-and-comment rulemaking process to promulgate regulations implementing the Communications Act  FCC also has an enforcement bureau that pursues violations of its regulations and the Communications Act  The Communications Act establishes separate definitions for “information services” and “telecommunications services” and treats these two types of services differently  Specifically, information services are subject to less regulation by FCC than telecommunications services under the Communications Act  However, FTC is prohibited from regulating telecommunications carriers (a provider of telecommunications services) under the common carrier exemption  Prior to 2015, Internet services were considered information services under the Communications Act, and thus FTC was not prohibited from considering the privacy practices of Internet service providers under its FTC Act authority to protect consumers from unfair and deceptive practices  This changed in 2015 when FCC classified broadband as a telecommunications service, which meant that broadband Internet service providers were considered telecommunications carriers and FCC asserted primary oversight over them  As a result of the reclassification, FTC no longer had jurisdiction over Internet service providers  Once FCC had asserted primary oversight over Internet service providers, FCC promulgated privacy regulations specific to them  However, before the privacy regulations went into effect, Congress repealed them under the Congressional Review Act  In December 2017, FCC reclassified broadband as an information service—reverting Internet service providers’ classification to what it had been prior to 2015  When that reclassification became effective in June 2018, jurisdiction of Internet privacy for Internet service providers was effectively transferred from FCC back to FTC  As a result, FCC currently has limited Internet privacy oversight responsibilities, as shown in figure 1  Perspectives on the benefits of and concerns about the collection and use of consumers’ data from the Internet varied somewhat across stakeholder groups  Various stakeholders we interviewed—including those from academia, industry, and government—said that there should be a balance between the freedom of companies to collect and use consumers’ data needed to provide services and the necessity to protect consumers’ privacy  In general, industry stakeholders highlighted the benefits of data collection and use, such as facilitating innovation, while consumer advocacy groups and other stakeholders emphasized concerns about consumers’ loss of control over their data and their lack of understanding of how companies collect and use their information  Additionally, surveys and other literature that we reviewed on Internet privacy highlighted concerns among consumers  The key benefits of information collection were identified as: Enables certain services  According to two industry stakeholders, the collection and use of consumer data from the Internet enable content providers to provide services  These stakeholders said that sometimes a content provider must collect and use information from consumers to provide the service  For example, a mapping service must collect and use consumers’ current location to provide them with up-to-date directions  Provides low-cost or free services  A representative from a content provider said that revenue from targeted advertising helps allow some content providers’ services to be offered to consumers at little or no charge  Instead of charging a subscription fee, a social media company may be able to provide free service because it uses information that it collects from consumers to target advertisements to users on a customized, user-by-user basis  These ads are targeted to users based on interests they express through their use of social media, among other things  According to a representative from an Internet search engine, using consumer data for targeted advertising may be relatively less important for some kinds of content providers, such as search engines  This company representative said that search engines may use keywords entered for a particular Internet search to provide advertisements relevant to the search  For example, a search for “car insurance” can offer the consumer advertisements from car insurance companies without any additional data from the consumer other than the search’s keywords  Supports innovation and customization  According to some stakeholders, the collection and use of data also benefit consumers through other means such as providing innovative products or customized services  According to a representative from a content provider, the collection of personal information, with consent, for commercial purposes can at times have benefits  The representative said, for example, that collection of images containing identifiable information, like faces, can help in the development of new technologies such as object and facial recognition  According to two content providers, consumers may also benefit from customized services and content  For example, according to a representative from a travel-related company, that company can collect information about a consumer to suggest travel itineraries and suggestions for activities  Additionally, representatives from a consumer advocacy group and a content provider stated that direct-marketing approaches are enabled through data collection  Such marketing approaches allow consumers to receive advertisements that are uniquely tailored to their interests  For example, a consumer that a content provider has identified as being a hiker may receive advertisements for hiking boots  Despite these benefits, public opinion surveys have shown concerns about the collection and use of consumers’ information on the Internet  For instance, recent analyses based on surveys by the Pew Research Center and NTIA showed that the public lacks trust in Internet privacy, a concern that may limit economic activities  NTIA’s survey results show that privacy concerns may lead to lower levels of economic productivity as people decline to make financial transactions on the Internet  According to the NTIA analysis, in 2017, 24 percent of American households surveyed avoided making financial transactions on the Internet due to privacy or security concerns  Consumers NTIA surveyed indicated that their specific concerns were identity theft, credit card or banking fraud, data collection by online services, loss of control over personal information, data collection by government, and threats to personal safety  Stakeholders we interviewed elaborated on some of these concerns: Public disclosure and data breaches  Some stakeholders, including representatives from content providers, said that personal information from the Internet can be publicly disclosed, including through data breaches  An academic and a former FCC commissioner told us that such disclosures are becoming more frequent  Various consumer advocacy groups and state governments continue to report data breaches  This personal information can include financial information such as credit card information, the disclosure of which can result in financial harm to the consumer  It can also include other kinds of sensitive information such as political views or medical conditions, the disclosure of which can cause non-financial harms such as embarrassment or harassment  According to public reports, the 2017 breach of consumer information from Equifax, a credit-reporting agency, resulted in the disclosure of 143 million American consumers’ sensitive information  According to NTIA’s 2017 survey, 45 percent of households surveyed reported major concerns about credit card fraud  Regarding non-financial information, in a recent case FTC alleged that an Internet-based company publicly disclosed patients’ sensitive medical information without their knowledge after patients submitted what they thought were confidential reviews of physicians  According to FTC, these reviews were then publicly posted on the company’s website  Financial and other harms  Stakeholders identified both potential financial and non-financial harms associated with misuse of personal information from the Internet  A former FTC acting chair has said that privacy and data-security incidents can cause injuries that do not only involve financial loss and that it may be difficult to measure this type of non-financial injury  In a February 2018 speech, this former acting FTC chair cited a case that the agency filed involving the misuse of personal information from the Internet that resulted in people losing jobs or job opportunities or being threatened, stalked, and harassed  The acting chair said that in another case, there was evidence that several people committed suicide after their names and other data were disclosed  The commission can, by bringing suit in district court, obtain an order compelling content providers to provide monetary relief to consumers if a data disclosure results in financial harm to a consumer  However, an academic noted that many data disclosures of sensitive information cannot be financially redressed; information can indefinitely persist on the Internet once it is disclosed  Consumers’ lack of understanding  A range of stakeholders we interviewed, including those from industry, said that consumers lack an understanding of how their data are collected and used  Some stakeholders said content providers are insufficiently transparent about how they collect and use data  For instance, content providers’ privacy policies, according to various stakeholders, may contain technical language that is difficult for typical consumers to understand, may be located in a difficult-to-access or inconspicuous part of the content provider’s website, or may be lengthy to the point where it becomes prohibitively difficult for a consumer to set aside enough time to read  Furthermore, according to an academic, companies may have an incentive to intentionally obscure their privacy practices, since clarity could put the companies at a competitive disadvantage  The academic also stated that different privacy policies may apply to different parts of a consumer’s experience on a single website  For example, the academic described how a website may have contracts with third-party vendors for specific services included on the website that consumers use, such as an online shopping cart’s features  The privacy policy for the website and the third-party shopping cart can be separate and unrelated to each other, and consumers may not be aware of this since these policies may never appear to consumers or be hard to obtain  A representative from a consumer advocacy group also mentioned that consumers may be unaware that companies track consumers’ Internet activity in order to target those consumers with customized prices  An academic said that these practices may disproportionately affect people with low computer literacy, as they may not be aware of tracking or know of ways to counteract it  In 2015, we found that the lack of computer and Internet skills is one of the primary barriers people face in using the Internet and that this is a particular problem for certain demographic segments who may lack exposure to or knowledge about computers, such as those of age 65 and older and those with low levels of income and education  Consumer lack of control  Some academics and consumer advocacy groups also identified a lack of control as a concern with respect to Internet privacy—consumers have little or no control over how their information is collected, used, and shared  In a 2015 survey conducted by Pew Research Center, 65 percent of respondents said it is very important to be in control of what information is collected about them  However, according to an academic and a consumer advocacy group we interviewed, privacy policies offer consumers little or no bargaining power, and consumers may be forced to either accept the terms of the policy as written or not use the application or service at all  Furthermore, we recently reported that sometimes consumers’ information is used for purposes that are altogether separate from what those consumers originally anticipated  For example, FTC alleged in an enforcement action that in 2009 and 2010, a company told consumers that it would track the websites they visited in order to provide them with personalized offers, when in fact the company was also transmitting credit card information it collected through such tracking to third parties  The company settled with FTC  We also recently reported on how devices that comprise the Internet of Things pose privacy concerns for consumers, including that information collected by such Internet-connected devices can be used in ways to which the consumer was not given the option to opt out  As discussed above, stakeholders described various types of harm that could result from Internet privacy violations  Regardless of whether violations involve financial or other types of harm, a challenging factor in providing Internet privacy oversight is identifying the responsible parties  A former federal government official with experience in privacy issues said that it frequently is difficult to identify which Internet entity in the chain is ultimately responsible for a privacy-related harm  For example, if a consumer is harmed by the theft of his or her Social Security number, it can be difficult to determine which entity is responsible if multiple entities have suffered data breaches of information systems that contained the Social Security number  In addition to the challenges in identifying responsible parties, the federal government has faced challenges in providing Internet privacy oversight  Our prior work has found that such efforts lack clearly defined roles, goals and performance measures, and that gaps exist in the current privacy framework  We found that during the last decade, FTC filed 101 Internet privacy enforcement actions for practices that the agency alleged were unfair, deceptive, a violation of COPPA, a violation of a settlement agreement, or a combination of those reasons  Most of these actions pertained to first-time violations of the FTC Act for which FTC does not have the authority to levy civil penalties  In those cases where a party violated an FTC regulation or settlement agreement, however, FTC does have the authority to impose civil penalties  The 101 cases—filed between July 1, 2008 and June 30, 2018—involved a variety of products, services, and industries that collect and use personal information from the Internet  During the years for which we examined full-year data, the number of enforcement actions taken per year ranged from 5 in 2010 and 2016 to 23 in 2015  For example, in recent years, FTC took enforcement action against the following entities for alleged conduct that the agency contended violated section 5 or COPPA: a toy manufacturer for collecting personal information from children online without providing direct notice and obtaining their parents’ consent; a computer manufacturer for pre-loading laptops with software that compromised security protections in order to deliver ads to consumers; a mobile ride-hailing business for misrepresenting the extent to which it monitored its employees’ access to personal information about users; a television manufacturer for installing software on its televisions to collect viewing data on 11 million consumers without their knowledge or consent and providing the viewing data to third parties; and a mobile advertising network for deceptively tracking the locations of hundreds of millions of consumers, including children, without their knowledge or consent, to serve them geographically targeted advertising  Of the 101 actions filed during the 10-year period, 51 involved Internet content providers, 21 involved software developers, 12 involved the sale of information or its use in advertising, 5 involved manufacturers, 1 involved an Internet service provider, and 11 involved a variety of different products, such as those provided by rent-to-own companies or certification services  In nearly all 101 cases, companies settled with FTC, which required the companies to make changes in their policies or practices as part of the settlement  FTC levied civil penalties against two of those companies for violating their settlement agreements  Also during this 10-year period, FTC levied civil penalties against 15 companies (a total of $12 7 million) for alleged violations of the COPPA regulations  The COPPA civil penalties ranged from $50,000 to $4 million and the average amount was $847,333  FTC can also seek to compel companies to provide monetary relief to those they have harmed  During this time period, FTC levied civil penalties against companies for violations of consent decrees or ordered monetary relief to consumers from companies for a total of $136 1 million  These payment orders ranged from $200,000 to $104 5 million and the average amount was $17 million  In the majority of these 101 enforcement actions that FTC settled, FTC alleged that companies engaged in practices that were deceptive  Examples of the charges FTC brought include: “Deceptive practices” cases (61 cases): In 2016, FTC alleged that Turn, Inc , an Internet advertising company, continued to track the Internet activities of consumers for targeted advertising purposes after the company had made representations that it would stop doing so  According to FTC, the company led consumers to believe they could turn off such tracking when in fact they were unable to do so  “Unfair practices” cases (4 cases): In 2014, FTC alleged that LeapLab, a data broker, knowingly provided scammers with hundreds of thousands of consumers’ sensitive personal information, including Social Security and bank account numbers  “Unfair and deceptive” practices cases (19 cases): In 2015, FTC alleged that Equiliv Investments, a software developer, lured consumers into downloading its “rewards” application, saying it would be free of malware, when the application’s main purpose was actually to load the consumers’ mobile phones with malicious software to mine virtual currencies for the developer  COPPA and COPPA regulations cases (6 cases): In 2011, FTC alleged that Broken Thumbs Apps, a software developer, had collected information from Internet applications that the developer specifically targeted toward children under the age of 13  FTC’s complaint stated that the company had, among other things, failed to provide notice of what information it collected and how it was used and also had failed to inform parents of these practices and receive their consent as COPPA required  Violation of settlement agreement cases (2 cases): In 2012, Google agreed to pay a $22 5 million civil penalty to settle FTC charges that it misrepresented to users of Apple’s Safari Internet browser that Google would not place tracking cookies or provide targeted ads to those users, violating an earlier settlement agreement between the company and FTC  In 14 of the 101 cases, FTC required companies to be audited by outside entities to monitor compliance with the terms of the settlement  The audit period ranged from 5 years to 20 years, with an average of 17 5 years  As noted above, 2 of the 101 cases involved a violation of FTC settlement agreements  In addition, in March 2018, FTC announced that it is investigating whether Facebook’s privacy practices violate a 2012 Facebook settlement agreement with FTC  In the case that resulted in the 2012 settlement, FTC charged Facebook with deceiving consumers by telling them they could keep their information private, but then allowing it to be shared and made public  Appendix II contains more detailed information about the 101 cases  As stated earlier, in 2015, FCC classified broadband Internet service as a telecommunications service, placing primary oversight of broadband Internet service providers’ privacy practices under FCC’s jurisdiction instead of FTC’s jurisdiction  In 2016, FCC filed a privacy enforcement action against a mobile Internet service provider, alleging, in part, violation of section 222 of the Communications Act and FCC’s Open Internet Transparency Rule  Section 222 requires telecommunications carriers to protect the confidentiality of customers’ proprietary information  In that case, FCC fined Verizon Wireless $1 4 million for failing to disclose that it was inserting “unique identifier headers,” also called “perma- cookies” or “super cookies” (mobile web tracking cookies that users cannot remove), into customers’ Internet traffic over its wireless network  Although the settlement was finalized during the 2015-2017 period when FCC had asserted jurisdiction over the privacy practices of Internet providers, the Verizon Wireless practices occurred prior to the classification of Internet service providers as telecommunications carriers  The investigation therefore did not rely upon FCC’s subsequent assertion of authority over Internet service providers’ privacy practices  In October 2016, after FCC had reclassified broadband as a telecommunications service, the commission issued Internet service provider privacy regulations, asserting its authority under section 222 of the Communications Act  In April 2017, however, Congress repealed these regulations under the Congressional Review Act before they took effect  In December 2017, FCC then reversed its 2015 classification of broadband, and oversight of broadband Internet service providers’ privacy practices reverted to FTC once the decision took effect in June 2018  In explaining the December 2017 decision, FCC’s new chair said that FTC’s privacy oversight approach regarding Internet service providers—using its authority to protect consumers against unfair, deceptive, and anti- competitive practices—had worked well in the past and that this action would “put the nation’s most experienced privacy cop back on the beat ” Under FCC’s new legal approach, it no longer asserts jurisdiction to take enforcement action against Internet service providers for privacy-related matters, including mobile Internet service providers  As part of FTC’s resumption of Internet service provider oversight, FCC and FTC entered into a memorandum of understanding in December 2017 spelling out their roles and responsibilities regarding oversight of these companies  FTC staff said that they regularly communicate with FCC and have an agreement to share Internet privacy complaints  As previously discussed, no federal statute comprehensively and specifically governs Internet privacy across all sectors  FTC oversees some aspects of Internet privacy by using its FTC Act section 5 authority to protect consumers from unfair and deceptive practices  FTC also uses its specific COPPA authority to police the collection and use of personal information from children by online services  Some industry representatives said that FTC’s enforcement has been effective because the agency has expertise and experience in privacy issues and has the flexibility to take enforcement action on a case-by-case basis  In addition, a content provider said that FTC has taken enforcement actions against companies of various sizes in different sectors and has a powerful tool by being able to require companies to be audited by outside entities for up to 20 years  Industry stakeholders we interviewed generally said that “direct enforcement” of a statute is preferable to promulgating and enforcing regulations implementing that statute (which constitutes enforcement of the statute as well)  These stakeholders noted several key concerns they believe exist with regulatory versus statutory enforcement of Internet privacy: Regulations can stifle innovation  Two industry stakeholders said that regulations can hinder companies’ ability to innovate  For example, representatives from an Internet service provider said that innovation can stop during the rulemaking process as the industry waits for the regulation to be finalized  Regulations may create loopholes  Representatives from an Internet industry group and a content provider said that regulations can also contain loopholes that can be legally exploited because imprecise language in a regulation may allow a company to legally engage in an action that was originally unforeseen by the regulator  Regulations can become obsolete  Several industry stakeholders said regulations also may become obsolete quickly because the Internet industry is rapidly changing  An Internet industry representative noted that there can be large shifts in the Internet industry from year to year, while it often takes an agency much longer than a year to adopt a rule  Industry stakeholders said the flexibility of FTC’s approach allows FTC to adapt continuously to changing market conditions  Rulemakings can be lengthy  FCC officials said that in some cases, rulemakings can take a long time, especially when the issues are complex and there is no statutory deadline  Our previous work on rulemaking found that length of time required for the development and issuance of final rules varied both within and among agencies  Additionally, while some stakeholders suggested that regulations can clarify acceptable practices, other stakeholders, including from industry and academia, said that enforcement actions can send a similar message  According to both a representative from a content provider and an academic, enforcement actions such as settlement agreements, for example, establish precedents that companies can follow, similar to the way that case law developed by courts provides guidance for companies  Although some industry representatives we interviewed said that FTC’s use of settlement agreements provides companies with guidance, certain trade associations took a different position in a recent case brought before the U S  Court of Appeals for the Third Circuit, FTC v  Wyndham Worldwide Corp  799 F 3d 236 (3d Cir  2015)  However, the court did not agree with the associations’ arguments  The case involved an enforcement action against Wyndham Worldwide Corporation where FTC alleged that data security failures led to three data breaches at the company in less than 2 years  The court considered whether FTC could bring an enforcement case involving cybersecurity using FTC’s section 5 “unfair practices” authority and, if so, whether Wyndham had “fair notice” that its specific cybersecurity practices could be deemed “unfair ” A group of companies and the U S  Chamber of Commerce wrote a friend- of-the-court brief supporting Wyndham, criticizing FTC’s “regulation- through-settlements” approach  The companies argued this approach subjects businesses to “vague, unknowable, and constantly changing data-security standards” and businesses often are unaware of the standards to which they are held until after they receive a notice of investigation from FTC, at which point they must settle or expend considerable resources fighting the agency  Potential Limits on Federal Trade Commission (FTC) Remedies A recently decided federal appeals court case illustrates potential limits on the remedies that FTC can order in an “unfair practices” enforcement proceeding  In this 2018 case, LabMD, Inc  v  FTC, 891 F 3d 1286 (11th Cir  2018), the U S  Court of Appeals for the Eleventh Circuit found that FTC could not direct a medical laboratory to create and implement wholesale data-security protective measures as a remedy to the laboratory’s alleged unfair practices  FTC had filed a complaint against LabMD under section 5 of the FTC Act for allegedly committing an unfair act or practice by failing to provide reasonable and appropriate security for personal information on its computer networks  The commission found that LabMD’s inadequate security constituted an unfair act or practice and ordered LabMD to take various actions, including establishing and maintaining a reasonable and comprehensive information security program  On appeal, the Eleventh Circuit ruled that FTC’s order exceeded its authority because it did not prohibit a specific act or practice but instead, mandated a complete overhaul of the company’s data-security program  FTC had argued that the FTC Act gives it broad discretion to prevent unfair or deceptive acts or practices that injure the general public and that FTC had spelled out standards for LabMD to craft a reasonable security program  The court ruled, however, that such a general approach would make it difficult for a reviewing court to determine if LabMD had complied with the order, in the event of a future FTC challenge  company can reasonably foresee that a court could construe its conduct as falling within the meaning of the statute ” A majority of non-industry stakeholders we interviewed identified limitations in the current Internet privacy oversight approach because they view regulations in conjunction with enforcement as being more effective  These stakeholders include all of the former FTC commissioners we interviewed, three of the four former FCC commissioners we interviewed, and representatives from consumer advocacy groups we interviewed  In addition, a former FCC commissioner said that the current Internet privacy oversight approach is limited in part because he viewed regulations applying equally to all players in the Internet ecosystem in conjunction with enforcement as being more effective  A representative from a consumer advocacy group also said that regulations in conjunction with enforcement are essential for effective privacy protection  Some of these stakeholders noted key ways that they believe Internet privacy regulations can provide clarity to industry and consumers, as well as fairness and flexibility in enforcement: Regulations can provide clarity  An Internet industry group representative said that various companies have favorable views of regulations because they can provide clear expectations about what actions are permissible  Similarly, a former congressional staff member with expertise on privacy issues said that some companies have favorable views of regulations because the regulations often provide clearer expectations about what the companies can do  FCC officials said that with respect to telephone privacy provisions of the Communications Act, the telephone industry wanted rules because it sought greater clarity about what it should be doing, what constituted a violation, how to comply, and what behaviors were acceptable  Regulations may promote fairness  Some other stakeholders discussed the ability of regulations to provide fairness  For example, a former federal enforcement official described regulations as creating a fair and consistent oversight regime across the entire industry in a way that case-by-case enforcement actions do not  Another former federal enforcement official said that regulations give companies fair notice of what actions may be violations and thus help those companies avoid surprising or unexpected enforcement  Regulations can be flexible  An academic said that by targeting behaviors and not specific technologies, regulations can be written in such a way that they do not become obsolete  An academic also said that regulations based on broad performance-standards principles can avoid being overly prescriptive  FCC officials also noted that regulations can be amended to adapt to changes in technology often faster than new laws can be enacted  Furthermore, regulations determined to be obsolete can be repealed  FTC staff told us that the agency systematically reviews all of its regulations every 10 years, even though it is only legally required to review its most significant ones, and that the number of FTC regulations has decreased because the agency determined prior ones were obsolete  The Regulatory Flexibility Act requires federal agencies to analyze the effect of their regulations on small entities  Regulations can be a deterrent  FCC officials said that rules can have a deterrent effect on bad practices in the industry or have a role in mitigating the negative effects of bad practices after they occur  They said, for example, that the practice of pretexting (improperly obtaining people’s telephone records) was greatly curtailed by an FCC regulation prohibiting such practices  They also said that rules can foreclose arguments by companies claiming that because no rule was in place, they had no reasonable notice or awareness that they should behave in a particular way  Consumer advocacy groups and other stakeholders, including some former FTC and FCC commissioners, had concerns about the efficacy of an enforcement approach such as FTC’s approach to Internet privacy oversight, which focuses on enforcing a statute rather than implementing regulations  They said that FTC’s enforcement approach limits the ability of the agency to affect companies’ behavior, and that any enforcement activity occurs after the violation, undesirable behavior, harm, or illegal action has already occurred  A former federal enforcement official also said that regulations can prevent companies from engaging in bad practices in the first instance and thus have a preventive effect  A former FCC commissioner said that by the nature of a direct statutory- enforcement approach (as opposed to rulemaking), an agency would only address a harm after it has occurred  As discussed above, for example, data often cannot be removed from the Internet because copies of the data can exist among many bad actors, and it can be difficult to identify the entity responsible for unwanted disclosures  Therefore, it may be more important to avoid such Internet privacy harms from occurring in the first place  Another former FCC commissioner told us that Internet privacy oversight should be returned to FCC because it has APA section 553 notice-and-comment rulemaking authority and considerable enforcement experience  Representatives from consumer advocacy groups said that FTC’s enforcement action has been insufficient because it investigates only a small portion of actual Internet-privacy violations or takes action regarding only the most egregious or outrageous cases that it can win  FTC has also stated in its strategic plan that it focuses on investigating and litigating cases that cause or are likely to cause substantial injury to consumers and that by focusing on practices that are actually harming or likely to harm consumers, FTC can best use its limited resources  Representatives from an Internet association said that FTC’s Internet- privacy enforcement actions should focus on concrete harms  An FTC staff member from the Division of Privacy and Identity Protection said that the agency has been effective with the limited enforcement resources it has available  Furthermore, the staff member said the agency uses no formal written criteria or template to assess individual cases but considers the size and scale of a company’s effect on consumer privacy when deciding whether to take enforcement action  However, a former FTC commissioner told us that the agency needs more resources to effectively oversee Internet privacy  We asked stakeholders whether it was clear under what circumstances FTC will take Internet privacy enforcement action  In response, some stakeholders said that FTC’s enforcement priorities are reflected in its settlement agreements, which provide information that is similar to a body of case law  Individual commissioners also may issue statements explaining their decisions  Two stakeholders also said that FTC’s closing letters, which the agency sends to companies and posts on its website when it closes an investigation without taking enforcement action, may explain its decisions  Other stakeholders said that more guidance would be helpful to provide additional clarity on how the agency uses its Internet privacy enforcement authority  FTC staff and other stakeholders also said that FTC has provided useful Internet privacy guidance  For example, in 2015, FTC published guidance for businesses on complying with COPPA  Various stakeholders we interviewed said that opportunities exist for enhancing Internet privacy oversight  A key component of FTC’s mission, as specified by the FTC Act, is to protect consumers against unfair and deceptive practices  As discussed earlier, some stakeholders believe that FTC’s reliance on its unfair and deceptive practices authority to address Internet privacy issues has limitations  In addition, although the Fair Information Practice Principles provide internationally recognized principles for protecting the privacy and security of personal information, they are not legal requirements and FTC cannot rely on them to define what constitutes unfair and deceptive practices related to privacy and data security  We stated in our 2013 information resellers report that the current U S  privacy framework is not always aligned with the Fair Information Practice Principles and that these principles provide a framework for balancing the need for privacy with other interests  We found that there are limited privacy protections under federal law for consumer data used for marketing purposes  We said that although the Fair Information Practice Principles call for restraint in the collection and use of personal information, the scope of protections provided under current law has been narrow in relation to: (1) individuals’ ability to access, control, and correct their personal data; (2) collection methods and sources and types of consumer information collected; and (3) new technologies, such as tracking of web activity and the use of mobile devices  Although we recommended in that report that Congress consider strengthening the consumer privacy framework to reflect the effects of changes in technology and the marketplace, this matter for congressional consideration was not specific to Internet privacy or to the oversight authorities of any particular agency or agencies  As noted above, various stakeholders expressed concern about the ability of consumers to control their data and understand how that data are used  These concerns suggest that companies are not always following the Fair Information Practice Principles, such as that companies’ data practices should be transparent, allow consumers the right to access and edit their data, and limit the collection of data to the extent feasible  Those stakeholders who believe that FTC’s current authority and enforcement approach is unduly limited identified three main actions that could better protect Internet privacy: (1) enactment of an overarching federal privacy statute to establish general requirements governing Internet privacy practices of all sectors; (2) APA section 553 notice-and- comment rulemaking authority; and (3) civil penalty authority for any violation of a statutory or regulatory requirement, rather than allowing penalties only for violations of settlement agreements or consent decrees that themselves seek redress for a statutory or regulatory violation  Stakeholders from a variety of perspectives—including from academia, industry, consumer advocacy groups, and former FTC and FCC commissioners—told us that a privacy statute could enhance Internet privacy oversight by, for example, clearly articulating to consumers, industry, and privacy enforcers what behaviors are prohibited, among other things  In addition, a former FCC commissioner said that a new privacy statute could enhance Internet privacy oversight by creating uniform standards for all players in the Internet ecosystem that is focused on the consumer rather than the regulatory legacy of the companies involved (regulations that apply to specific types of companies based on what they are or used to be, such as telecommunications carriers, cable companies, broadcasters, and mobile wireless providers)  The former FCC commissioner said that as companies, technologies, and markets change, there is a question about whether existing law should be modernized  In 2015, FTC staff recommended that Congress enact broad-based legislation that is flexible and technology-neutral, while also providing clear rules of the road for companies about such issues as how to provide choices to consumers about data collection and use practices  Some stakeholders suggested that such a framework could either designate an existing agency as responsible for privacy oversight (such as FTC) or create a new privacy-oriented agency  A representative from a consumer advocacy group mentioned that the European Union, for example, has established the European Data Protection Supervisor, an independent data protection authority, to monitor and ensure the protection of personal data and privacy  Similarly, in Canada, the Office of the Privacy Commissioner, an independent body that reports directly to the Parliament, was established to protect and promote individuals’ privacy rights  Some stakeholders also stated that the absence of a comprehensive Internet privacy statute affects FTC’s enforcement  For example, a former federal enforcement official said that FTC is limited in how it can use its authority to take action against companies’ unfair and deceptive trade practices for problematic Internet privacy practices  Similarly, another former federal enforcement official said that FTC is limited in how and against whom it can use its unfair and deceptive practices authority noting, for example, that it cannot pursue Internet privacy enforcement over exempted industries such as common carriers  In addition, a former FCC commissioner said that it is more difficult for FTC to take effective action because its enforcement comes only after a complaint and after an often lengthy review process  The former FCC commissioner also said that without “ex ante” rules (rules that define prohibited activity before it has occurred), there inevitably will be delay, confusion, and lack of knowledge about what is and is not acceptable behavior  In addition, some stakeholders—including a representative from a consumer group, a former federal enforcement official, and a former FCC commissioner—said FTC’s section 5 “unfair or deceptive practices” authority may not enable it to fully protect consumers’ Internet privacy because it can be difficult for FTC to establish that Internet privacy practices are legally “unfair ” For example, under section 5, FTC has charged companies with committing a “deceptive” practice if their privacy policies said they would not collect or use consumers’ personal information but then did so  However, a former congressional staff member said that companies often write broad and vague policy statements, making it difficult for FTC to charge companies with committing deceptive practices  Instead, according to a representative from a consumer advocacy group, FTC would have to show the companies’ actions were “unfair,” which, according to the representative, is legally difficult to establish  We found in our 2017 report on vehicle data privacy that most automakers’ written privacy notices used vague language  Similarly, we found in our 2012 report on mobile device location data that although companies’ policies stated that they shared location data with third parties, they were sometimes vague about which types of companies these were and why they were sharing the data  Some stakeholders said that FTC relies more heavily on its authority to take enforcement action against deceptive trade practices compared with the agency’s unfair trade practices authority  This was confirmed in our analysis of FTC’s Internet privacy enforcement actions discussed previously  However, a representative from a consumer advocacy group said that FTC’s ability to take such action is limited practically to instances where a company violates its own privacy policy—companies generally can collect and use data in any way they want if they include language in their policies asserting their intent to do so  According to a former FCC commissioner, a privacy statute could clarify the situations in which FTC could take enforcement action  Various stakeholders said that there are advantages to overseeing Internet privacy with a statute that provides APA section 553 notice-and- comment rulemaking authority  As discussed above, that provision lays out the basic process by which so-called informal agency rulemaking shall be conducted, namely, publication of proposed regulations in the Federal Register; an opportunity for public comment (written and possibly oral submission of data and views); and publication of final regulations in the Federal Register with an explanation of the rules’ basis and purpose  Also as noted above, Congress imposed additional rulemaking steps on FTC in the Magnuson-Moss Act when FTC is promulgating rules under section 5 of the FTC Act  These additional steps include providing the public and certain congressional committees with advance notice of proposed rulemaking (in addition to notice of proposed rulemaking)  FTC’s rulemaking under Magnuson-Moss also calls for, among other things, oral hearings, if requested, presided over by an independent hearing officer, and preparation of a staff report after the conclusion of public hearings, giving the public the opportunity to comment on the report  Finally, Congress made it easier for the public to appeal FTC’s Magnuson-Moss rules by making the agency meet a higher standard when the rules are challenged in court  FTC staff said that these additional steps add time and complexity to the rulemaking process  In congressional testimony in 2010, the then-Director of FTC’s Bureau of Consumer Protection said that “if Congress enacts privacy legislation, the commission agrees that such legislation should provide APA rulemaking authority to the commission ” According to FTC, this testimony was voted on and approved by the commissioners and, therefore, constituted the commission’s official position at the time  Moreover, according to stakeholders, in many cases regulations can be used to implement statutes  Officials from other consumer and worker protection agencies we interviewed described their enforcement authorities and approaches  For example, officials from the CFPB and the FDA, both of which use APA section 553 notice-and-comment rulemaking, said that their rulemaking authority assists in their oversight approaches and works together with enforcement actions  OSHA officials said that the standards that the agency promulgates under its authority specify what employers are required to do to reduce safety and health risks to workers  Such standards lay out the workplace conditions that must be maintained by employers and require that employers implement certain practices, operations, or processes that ensure worker protections  EEOC officials said that regulations are used to guide investigations that establish whether enforcement action is appropriate  CPSC officials said that the agency conducts consumer protection not only by establishing and enforcing mandatory regulations, but also through collaborative actions such as educating industry, developing consensus voluntary safety standards, removing defective products from the marketplace through voluntary corrective actions, and litigating when necessary  In addition, in contrast to FTC’s approach, FCC has APA section 553 notice-and-comment rulemaking authority and has issued regulations implementing section 222 of the Communications Act using that rulemaking authority to protect the privacy of telephone users  Some stakeholders suggested that FTC’s current ability to levy civil penalties could also be enhanced  Currently, FTC can levy civil penalties against companies for violating certain regulations, such as COPPA regulations, or if the company violates the terms of a settlement agreement already in place  According to most former FTC commissioners and some other stakeholders we interviewed, FTC should be able to levy fines for initial violations of section 5 of the FTC Act  An academic told us that the power of an agency to levy a fine is a tangible way to hold industries accountable  Another academic noted, however, that fines may be relatively less effective in industries where there is limited competition because the costs of those fines may be more effectively passed on to consumers in the form of higher prices for services  In addition, some stakeholders said that payments required by FTC orders are not large enough to act as a deterrent and that companies may consider them to be a cost of doing business  There is a growing debate about the federal government’s role in overseeing Internet privacy  In a July 2018 congressional hearing, FTC’s new chair testified that the FTC Act cannot address all privacy and data- security concerns in the marketplace  The chair said, for example, that FTC’s lack of civil penalty authority for violations of the FTC Act reduces its deterrent capability  He also noted the agency lacks authority over non-profits and over common carrier activity, even though those entities and activities often have serious implications for consumer privacy and data security  In November 2018, FTC’s chair testified before Congress and urged Congress to consider enacting privacy legislation that would be enforced by FTC  A majority of the commission has indicated support for APA rulemaking and civil penalty authority for privacy  FTC also held hearings in September, November, and December 2018 to advance the discussion around privacy issues, among other topics, and FTC plans to hold an additional hearing on data security and consumer privacy in February 2019  In a Federal Register notice, FTC announced that it is interested in the benefits and costs of various state, federal and international privacy laws and regulations, including the potential conflicts among those standards  FTC also indicated that it is particularly interested in the efficacy of the commission’s use of its current authority and the identification of any additional tools or authorities the commission may need to adequately deter unfair and deceptive conduct related to privacy and data security  Also in July 2018, an NTIA official announced that NTIA, in coordination with the Commerce Department’s International Trade Administration and National Institute of Standards and Technology, had recently started holding stakeholder meetings to identify common ground and formulate core, high-level principles on data privacy  Regarding the development of the Administration’s approach to consumer privacy, in September 2018, NTIA requested comments on ways to advance consumer privacy while protecting prosperity and innovation  Our 2009 report on a framework for assessing proposals for modernizing the financial regulatory system similarly found that regulators should have the authority to carry out and enforce their statutory missions  We further said that a regulatory system should be flexible and forward looking, allowing regulators to readily adapt to market innovations and changes, including identifying and acting on emerging risks in a timely way without hindering innovation  These factors are useful considerations as the federal government explores how it can better oversee privacy and data security  Having sufficient and appropriate authorities and providing flexibility to address a rapidly evolving Internet environment could better ensure that the federal government can protect consumers’ privacy  Recent developments regarding Internet privacy suggest that this is an appropriate time for Congress to consider comprehensive Internet privacy legislation  Although FTC has been addressing Internet privacy through its unfair and deceptive practices authority, among other statutes, and other agencies have been addressing this issue using industry-specific statutes, there is no comprehensive federal privacy statute with specific standards  Debate over such a statute could provide a vehicle for consideration of the Fair Information Practice Principles, which are intended to balance privacy concerns with the need for using consumers’ data  Such a law could also empower a specific agency or agencies to provide oversight through means such as APA section 553 rulemaking, civil penalties for first time violations of a statute, and other enforcement tools  Comprehensive legislation addressing Internet privacy that establishes specific standards and includes APA notice-and-comment rulemaking and first-time violation civil penalty authorities could help enhance the federal government’s ability to protect consumer privacy, provide more certainty in the marketplace as companies innovate and develop new products using consumer data, and provide better assurance to consumers that their privacy will be protected  Congress should consider developing comprehensive legislation on Internet privacy that would enhance consumer protections and provide flexibility to address a rapidly evolving Internet environment  Issues that should be considered include: which agency or agencies should oversee Internet privacy; what authorities an agency or agencies should have to oversee Internet privacy, including notice-and-comment rulemaking authority and first-time violation civil penalty authority; and how to balance consumers’ need for Internet privacy with industry’s ability to provide services and innovate  We provided a draft of this report to FTC, FCC, and the Department of Commerce for their review and comment  FTC and FCC provided technical comments, which we incorporated as appropriate  The Department of Commerce indicated that it did not have comments  As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date  At that time, we will send copies to the FTC chair, the FCC chair, the Secretary of Commerce, and interested congressional committees  In addition, the report will be available at no charge on the GAO website at http://www gao gov  If you or members of your staff have any questions about this report, please contact Alicia Puente Cackley at (202) 512-8678 or cackleya@gao gov or Mark Goldstein at (202) 512-2834 or goldsteinm@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  Major contributors to this report are listed in appendix III  For this review, we interviewed staff from agencies with roles in Internet privacy; officials from other consumer- and worker-protection agencies; stakeholders from consumer advocacy groups, industry groups, Internet service providers, and Internet content providers; academics; and former government officials  To obtain a variety of perspectives, we selected Internet service providers that represented different industry sectors and Internet content providers that provide a variety of information and social media services  Academic stakeholders were selected because of their expertise in privacy, consumer protection, and regulatory issues  We also interviewed former Federal Trade Commission (FTC) and Federal Communications Commission (FCC) commissioners who served during the Barack Obama and George W  Bush administrations and are from different political parties  Consumer Financial Protection Bureau (CFPB) Consumer Product Safety Commission (CPSC) Department of Commerce, National Telecommunications and Information Administration (NTIA) Equal Employment Opportunity Commission (EEOC) Federal Communications Commission (FCC) Federal Trade Commission (FTC) Food and Drug Administration (FDA) Occupational Safety and Health Administration (OSHA) The following table identifies 101 Federal Trade Commission (FTC) Internet privacy enforcement actions filed between July 1, 2008 and June 30, 2018 in which the agency alleged a violation of either the Federal Trade Commission Act (FTC Act) or the Children’s Online Privacy Protection Act (COPPA) and implementing COPPA regulations and subsequently entered into a settlement agreement with the target entity  Although some of these cases may involve both Internet data privacy and security issues, this table does not include cases that involved data security issues only  In addition to the contact names above, Andrew Huddleston, Assistant Director; Kay Kuhlman, Assistant Director; Bob Homan, Analyst-in- Charge; Melissa Bodeau; John de Ferrari; Camilo Flores; Erica Miles; Josh Ormond; and Sean Standley made significant contributions to this report 
Report 2:  The provider emphasized concerns about the long-term viability of caring for those patients at the facility, because their care is paid at lower rates  Our review of Medicare claims data, other information, and interviews with stakeholders indicated the two qualifying hospitals treated Medicare beneficiaries with different conditions than most of those treated at other LTCHs  Our analysis of Medicare claims data indicates Craig Hospital and Shepherd Center treat very few patients in the Medicare diagnosis groups that are most common to other LTCHs  Specifically, for several years, MedPAC has reported that LTCH patient discharges are concentrated in a relatively small number of diagnosis groups  For example, in March 2018, MedPAC reported that 20 diagnosis groups accounted for over 61 percent of LTCH discharges at both for-profit and not-for-profit facilities, in fiscal year 2016  However, in fiscal year 2016, these diagnosis groups accounted for approximately 30 percent of Medicare discharges—26 out of 88—at Shepherd Center, and most of these discharges fell within a single diagnosis group which covers a range of conditions  Craig Hospital did not discharge any Medicare beneficiaries assigned to these 20 diagnosis groups, in fiscal year 2016  The seven diagnosis groups that were used in the statutory criteria to except Craig Hospital and Shepherd Center from site-neutral payments were also not among these 20 diagnosis groups  For more information on the 20 diagnosis groups common to LTCHs in fiscal year 2016, see Appendix III, table 5  Our review of Medicare claims data and other information indicates the two qualifying hospitals also treat a relatively small number of Medicare beneficiaries, a key distinguishing factor from most other LTCHs  In March 2018, MedPAC reported that, on average, Medicare beneficiaries account for about two-thirds of LTCH discharges  However, Medicare claims data and other information provided by the two qualifying hospitals indicate Medicare beneficiaries account for a significantly smaller proportion (about 8 percent) of patients discharged from Craig Hospital and Shepherd Center in 2016  Specifically, 40 of the 486 patients discharged from Craig Hospital in fiscal year 2016 and 75 of the 912 patients discharged from Shepherd Center in calendar year 2016, were Medicare beneficiaries  Officials from the qualifying hospitals told us they treat few Medicare patients primarily because of the younger average age of persons with spinal cord injuries and acquired brain injuries  While patients with spinal cord and brain injuries may receive care in other LTCHs, most stakeholders we interviewed also suggested the two qualifying hospitals treat patients that are different from those treated at most other LTCHs, and can offer specialized care  Officials from the two qualifying hospitals told us that, relative to most other facilities—including most traditional LTCHs—they offer a more complete continuum of care to meet the needs of patients at different stages of spinal cord and brain injury treatment, without the need to transfer to different facilities  Officials also stated that, unlike most traditional LTCHs, they are able to offer more specialized care for patients with spinal cord and brain injuries, including more comprehensive rehabilitation services  Stakeholders we interviewed generally agreed that the two qualifying hospitals have developed expertise in treating spinal cord and brain injury patients and offer intensive rehabilitation services that are not provided in most other LTCHs  In addition, officials from the Colorado Department of Health Care Policy & Financing noted that Craig Hospital treats a patient population that is different from most other LTCHs in the state of Colorado  Specifically, according to officials, in comparison to other LTCHs in the state, Craig Hospital treats: (1) a higher percentage of patients with more severe conditions, (2) more patients from outside the state of Colorado, (3) fewer patients requiring ventilator weaning or requiring wound care— conditions typically characteristic of LTCH patients—and (4) patients that are, on average, younger than most other LTCHs in the state of Colorado  In addition, a 2014 study of LTCHs conducted for the Georgia Department of Community Health found Shepherd Center was “distinctly different” from other LTCHs in the state of Georgia, and most LTCHs nationwide  Most stakeholders we interviewed suggested some IRFs provide specialty care to patients with catastrophic spinal cord, acquired brain injuries, or other paralyzing neuromuscular conditions  Most of the stakeholders we interviewed noted that—like the two qualifying hospitals—some IRFs have the expertise to treat patients with catastrophic spinal cord, acquired brain injuries, or other paralyzing neuromuscular conditions patients and thus, may also treat patients with similar conditions  According to CMS officials, IRFs are specifically designed to provide post-acute rehabilitation services to patients with spinal cord injuries, brain injuries, and other neuromuscular conditions  CMS officials noted that patients with these conditions typically respond well to intensive rehabilitation therapy provided in a resource intensive inpatient hospital environment and to the specific interdisciplinary approach to care that is provided in the IRF setting  Stakeholders also noted that patients with spinal cord injuries, brain injuries, and other neuromuscular conditions may receive care in other settings  However, some stakeholders noted that some of these providers—such as skilled nursing facilities—generally do not offer the specialized care these patients generally require  Differences in payment systems and data limitations make it difficult to directly compare the attributes of Medicare beneficiaries discharged from the two qualifying hospitals and IRFs, including the costs of care they receive  Medicare uses separate payment systems to pay LTCHs and IRFs, for care provided to beneficiaries  LTCHs are paid pre-determined fixed amounts for care provided to Medicare beneficiaries, under the LTCH PPS  Medicare beneficiaries treated in LTCHs are assigned to diagnosis groups (MS-LTC-DRGs) for each stay—based on the patient’s primary and secondary diagnoses, age, gender, discharge status, and procedures performed  IRFs are also paid pre-determined fixed amounts for care provided to Medicare beneficiaries, but under a separate system—IRF PPS  Medicare beneficiaries treated in IRFs are assigned to case-mix groups—based on age, and level of motor and cognitive function—and then further assigned to one of four tiers (within these groups) based on the presence of specific comorbidities that may increase their cost of care  According to CMS officials, because the payment groups and assignments to those groups are different, it is difficult to directly compare LTCH patients, classified in diagnosis groups, with IRF patients, classified in case-mix groups  See Appendix II for more information on these payment systems  MedPAC has previously reported the differences in patient assessment tools used by post-acute care providers undermines Medicare’s ability to compare the patients admitted, costs of care, and outcomes beneficiaries achieve in these settings, on a risk-adjusted basis  MedPAC has also reported that while similar beneficiaries can receive care in each setting, payments can differ considerably for comparable conditions, due to differences in payment systems  It has made recommendations to address these issues  The Improving Medicare Post-Acute Care Transformation Act of 2014 also requires the Secretary of HHS to collect and analyze common patient assessment information and, in consultation with MedPAC, submit a report to Congress recommending a post-acute care PPS  Such efforts may make future comparison of beneficiaries, costs of services, and outcomes of care across these settings possible  While data limitations make a direct comparison difficult, based on our review of other data and information, and interviews with stakeholders, we identified similarities and differences between the qualifying hospitals and certain IRFs that provide specialty treatment for catastrophic spinal cord injuries, acquired brain injuries, or other paralyzing neuromuscular conditions  Key similarities and differences include the following: Volume of services  Our review of Medicare claims data, other information, and interviews with stakeholders indicate that—similar to the two qualifying hospitals—some IRFs treat a high volume (at least 100) of patients with complex spinal cord injury, brain injury, and other related conditions  Officials from the two qualifying hospitals, as well as some other stakeholders we interviewed—including officials from the Christopher & Dana Reeve Foundation and the Brain Injury Association of America—emphasized the importance of facilities treating a high volume of patients with these specialized conditions, which can be an indicator of expertise in treating these patients  Our review of Medicare claims data for 1,148 IRFs in fiscal year 2016 identified 21 IRFs that treated at least 100 Medicare beneficiaries with non-traumatic and traumatic spinal cord injuries and 109 IRFs that treated at least 100 Medicare beneficiaries with non-traumatic and traumatic brain injuries  Our review of Medicare claims data indicated that, similar to the two qualifying hospitals—some IRFs also treat a high volume of patients with “catastrophic” injuries—traumatic brain injury, traumatic spinal cord injury, and major multiple traumas with brain or spinal cord injuries  Specifically, we identified 25 IRFs that treated a high volume (at least 100) of Medicare beneficiaries with catastrophic injuries, in fiscal year 2016  In the absence of patient assessment data from the facilities, we did not independently evaluate the level and severity of these patients’ injuries, which can vary due to the presence of other co-morbid conditions  The Medicare case mix indexes we reviewed for these 25 IRFs indicated that, relative to other IRFs, most of these facilities treat patients who are more resource intensive  Specialty accreditation and designation as model systems  Like Shepherd Center, some IRFs receive CARF-accreditation for specialty programs to treat spinal cord and brain injuries  According to most stakeholders, this accreditation indicates expertise in treating these patients, as CARF International has established standards using evidence-based practices, among other factors  Officials from the two qualifying hospitals also noted CARF International has a specific focus on quality and outcomes  However, officials from Shepherd Center noted similarities in care and services offered at CARF-accredited facilities would depend on the specialties for which they are certified  Most of the stakeholders we interviewed also noted that designation as a NIDILRR model system is an indicator of similar expertise in treating patients with spinal cord and brain injuries  According to the Model Systems Knowledge Translation Center, spinal cord injury and brain injury model systems are recognized as national leaders in medical research and patient care and provide the highest level of comprehensive specialty services from the point of injury through eventual re-entry into full community life  While stakeholders we interviewed from NIDILRR model systems indicated the model system designation is focused primarily on research, rather than clinical care, most noted that model systems’ research often complements the facilities’ clinical efforts to address the unique needs of these patients  Officials from HHS’s Administration for Community Living also noted that all model system grantees must provide a continuum of care—emergency care, acute medical care, acute medical rehabilitation, and post-acute care—and that can happen in various provider types  According to officials from the qualifying hospitals and stakeholders from one other NIDILRR model system we interviewed, Craig Hospital and Shepherd Center are the only two LTCHs currently classified as spinal cord injury model systems; 12 of 14 spinal cord injury model systems are IRFs  Specialized programs and services  Similar to the two qualifying hospitals, some IRFs may also offer specialized programs and services for patients with brain and spinal cord injuries, but the availability of these programs and services may vary by facility  Officials from some of the IRFs that responded to our information request—which included both NIDILRR facilities and IRFs with CARF-accredited programs—told us they provide specialized programs and services for patients with similar conditions as those treated at two qualifying hospitals, and sometimes compete with the two qualifying hospitals for the same patients  For example, each IRF reported having interdisciplinary treatment teams; the capacity to provide medical management of medically complex and high acuity patients with spinal cord injury, traumatic brain injury, or other major multiple traumas associated with a brain or spinal cord injury; family education and training; and skin and wound programs or services, among other services  However, the availability of certain services—including but not limited to ventilator-dependent weaning programs, diaphragmatic pacing, and outpatient programs for spinal cord and traumatic brain injury patients—varied by facility  Staff with specialized training and clinical expertise  Similar to the two qualifying hospitals, most facilities that responded to our information request also reported having physicians, nurses, and physical and occupational therapists with specialty training in medical rehabilitation, spinal cord, and/or brain injury  However, the number of staff with these trainings, varied by facility  In comparison to the other facilities that responded to our information request, the number of nurses and physical and occupational therapists with these specialty trainings were generally higher at Craig Hospital and Shepherd Center  According to an American Spinal Injury Association consumer guideline that the Christopher & Dana Reeve Foundation typically provides to spinal cord injury patients and families, programs should regularly admit persons with spinal cord injury each year, to develop and maintain the necessary skills to manage a person with spinal cord injury, and a substantial portion of those admitted should have traumatic injuries  Out-of-state Admissions  Officials from the two qualifying hospitals emphasized they admit a significant number of patients from out-of-state, and our review of information provided by the qualifying hospitals and a select group of IRFs indicated the qualifying hospitals admit a higher percentage of patients from out-of-state  Specifically, information provided by these IRFs indicates that less than a quarter of patients admitted to these facilities, in 2016, were from out-of-state  Information provided by Craig Hospital and Shepherd Center indicate that about half of their patients were admitted from out-of-state in 2016  Officials from the Colorado Department of Health Care Policy & Financing also noted Craig Hospital treats a higher percentage of out-of-state patients, compared to IRFs in the state  Ability to treat medically complex patients  Officials from the two qualifying hospitals told us they treat more medically complex patients and provide a more complete range of medical services to spinal cord and brain injury patients, not provided by most IRFs  Specifically, officials from the two qualifying hospitals both noted they are able to treat patients much sooner in their recovery process than most IRFs, due to their LTCH status  Officials from the Shepherd Center noted that they have a 10-bed intensive care unit which allows them to take patients with certain injures that some IRFs may not be equipped to admit—such as patients requiring advance medical management and advanced level procedural services and monitoring  Information provided by Shepherd Center indicated that, in calendar year 2017, approximately 20 percent of all inpatients were admitted to this unit and 13 percent of all inpatients were internally transferred to this unit after developing medical complications  According to officials, Craig Hospital does not have an intensive care unit, but noted their ability to similarly care for medically complex patients—including telemetry (e g , specialized heart monitoring) and one-to-one nursing care, if necessary  Most stakeholders we interviewed agreed that both qualifying hospitals’ LTCH status provides certain advantages over IRFs, such as the ability to admit some medically complex patients earlier in the recovery process and longer lengths of stay  Stakeholders from most of the IRFs we interviewed also reported having the flexibility to admit some medically complex patients requiring more advanced level monitoring and resources earlier in the recovery process—such as patients with disorders of consciousness  Officials from the two qualifying hospitals also said they offer a continuum of care that can meet patient’s changing needs, without the need to transfer them to different facilities  Information provided by Craig Hospital indicated that 83 percent of patients treated at its facility, in 2016, were discharged to home, 13 percent were discharged to another post-acute care facility, and 3 percent were discharged to an acute care hospital  In 2016, approximately 91 percent of patients treated at Shepherd Center were discharged to home, 7 percent were discharged to another post- acute care facility, and 2 percent were discharged to an acute care hospital  Information provided by the IRFs that responded to our written request varied by facility, but—similar to the two qualifying hospitals— each facility discharged more than 65 percent of patients to home  IRF payment criteria  CMS and most other stakeholders we interviewed noted that two Medicare payment policies applicable to IRFs, but not LTCHs, may contribute to their different patient populations  Specifically, to be classified for payment under Medicare’s IRF PPS, at least 60 percent of the IRF’s total inpatient population must require intensive rehabilitative treatment for one or more of 13 conditions—which includes both spinal cord and brain injury  To be admitted to an IRF, Medicare beneficiaries must reasonably be expected to actively participate in and benefit from the intensive rehabilitation therapy program, typically provided in IRFs  According to HHS, per industry standard, the intensive rehabilitation therapy program is often demonstrated by providing three hours of rehabilitation services per day for at least five days per week, but this is not the only way such intensity can be demonstrated  Officials from the two qualifying hospitals told us they generally use Medicare’s intensive rehabilitation requirement as a minimum standard for their rehabilitation patients—even though they are not held to this requirement, for the purposes of Medicare payment—but noted that some of their patients may not meet this requirement, due to their medical complexity  Length of stay and site-neutral payment requirements, for LTCHs  As previously noted, LTCHs—including the two qualifying hospitals—must have an average length of stay of greater than 25 days; IRFs are not subject to this requirement  The average length of stay for patients discharged from the Craig Hospital was about 60 days, in fiscal year 2016, and the average length of stay for patients discharged from Shepherd Center was about 53 days, in calendar year 2016  Stakeholders from the IRFs that responded to our information request reported average lengths of stay ranging from 14 to 31 days, for patients discharged in fiscal year 2016; the ranges of lengths of stay were slightly higher for spinal cord injury and traumatic brain injury inpatients for the IRFs, during the same period  LTCHs are also generally subject to site- neutral payment policy that is not applicable to IRFs and may decrease LTCHs payments for certain discharges, under Medicare  Other services provided  In addition to these Medicare specific differences, a few stakeholders we interviewed also noted the two qualifying hospitals receive additional funding from their strong philanthropic donor base that may allow them to provide other services and resources, not covered by Medicare or offered at some IRFs  For example, while a few IRFs that responded to our information request reported offering housing for families of injured patients, the two qualifying hospitals offer up to 30 days of free housing to families of newly injured rehabilitation patients, if both the family and patient live more than 60 miles from the hospital  Officials from Shepherd Center told us their revenues are supplemented by investment income and donor funds  Craig Hospital has also established a foundation that supports the hospital in achieving its goals through philanthropy  We provided a draft of this report to HHS  HHS provided technical comments, which we incorporated as appropriate  We also provided the two qualifying hospitals summaries of information we collected from them, to confirm the accuracy of statements included in our draft report  We incorporated their comments, as appropriate  We are sending copies of this report to the Secretary of Health and Human Services and other interested parties  In addition, the report will be available at no charge on GAO’s website at http://www gao gov  If you or your staff have any questions about this report, please contact me at (202) 512-7114 or at farbj@gao gov  Contact points for our Office of Congressional Relations and Office of Public Affairs can be found on the last page of this report  Other major contributors to this report are listed in appendix IV  This appendix describes our methodology for conducting simulations of payments for the two qualifying hospitals  We used Medicare claims data to conduct simulations of payments for the two qualifying hospitals  We first identified discharges at each hospital in two baseline years—federal fiscal years 2013 and 2016  We selected fiscal year 2016 because it was the year with the most recent data available at the time of our analysis, and we selected a second baseline year because data for 2016 was different than data for other recent years  For example, the number of discharges for one qualifying hospital declined by nearly half between fiscal years 2013 and 2016  We chose fiscal year 2013 because data from that year was used to help determine which hospitals are subject to the temporary exception  To identify how to appropriately calculate the long-term care hospital (LTCH) payment for each of these discharges in future payment years, we reviewed applicable federal regulation and documents from the Centers for Medicare & Medicaid Services (CMS) and the Medicare Payment Advisory Commission (MedPAC), and interviewed officials from both organizations  See table 4 for the relevant components in the formulas, such as Medicare severity long-term care diagnosis related group (MS-LTC-DRG) weights, identified from final rule tables  When conducting these simulations, we made the following assumptions: For simulated payments for payment policies in effect for fiscal years 2017 and 2018, we used the base rates, relative weights (e g , the MS-LTC-DRG weights), geometric mean length of stay, wage index, geographic adjustment factor, fixed-loss amounts, and outlier thresholds that were published in the final rule tables for LTCH and inpatient prospective payment system (IPPS) hospitals—also known as acute care hospitals—for each respective year  At the time we began our analysis, this information was not known for fiscal years 2019 through 2021  We chose to use the fiscal year 2018 rates when conducting simulations for payment policies in those years because historical trends showed that annual changes were minimal—about 1 percent  Therefore, to the extent that these values continue to change over time, our findings may understate or overstate the amount that the qualifying hospitals would have been paid in our baseline years based on these future payment policies  The site-neutral payment policy did not apply to discharges from the fiscal year 2013 baseline year  Therefore, we examined Medicare claims data to determine whether each discharge would have met the criteria to receive the LTCH standard rate in that year  Specifically, we determined whether each discharge had an acute care hospital stay that immediately preceded their LTCH stay  We then determined whether the time at the acute care hospital included three or more days in the intensive care unit or whether there was a code on the LTCH claim that indicated at least 96 hours of mechanical ventilation services were provided  Per Medicare’s payment policy, we assumed any discharge that met these two criteria would qualify for full LTCH payment rate, unless the case was a psychiatric or rehabilitation stay, as identified by the following MS-LTC-DRG codes: 876, 880, 881, 882, 883, 884, 885, 886, 887, 894, 895, 896, 897, 945, or 946  Under statute, unless 50 percent or more of the hospital’s discharges beginning during or after 2020 qualify for the standard rate, no subsequent payments will be made to a hospital at that rate  Therefore, when calculating simulated payments for fiscal year 2021, we applied the 50 percent threshold  At the time of our analysis, CMS had not yet finalized this policy through rule-making  As of November 2018, CMS officials told us that it is unlikely that any payment adjustment under this provision would apply until 2022 because the percentage cannot be determined until after an LTCH’s cost reporting period has ended and data have been submitted  Shepherd Center’s fiscal year is different than the federal fiscal year  Therefore, the variables used to determine whether discharges in federal fiscal year 2016 met criteria to receive the standard rate were not available to use for some of the discharges that year  Of those discharges, we assumed that the same percentage of discharges that met the criteria to receive the standard rate in Shepherd’s fiscal year—30 percent—met the criteria in federal fiscal year 2016  When calculating site-neutral payments, we assumed that each discharge would be paid at a rate comparable to that for acute care hospitals—the IPPS comparable amount rate  Site-neutral payments may also be based on the estimated cost-of-care, if it is lower than the IPPS comparable amount rate  However, over 90 percent of discharges at the qualifying hospitals were paid at the IPPS comparable amount rate in fiscal year 2016  Per CMS’s recommendation, we applied the cost-to-charge ratio that was effective October 1, 2017, for each qualifying hospital, regardless of discharge date  For Craig Hospital this value was 0 442 and for Shepherd Center this value was 0 464  According to CMS officials, in general, these values do not change significantly when they are updated during the fiscal year  Therefore, they believe that using the values effective at the start of the fiscal year is a reasonable assumption  We excluded indirect medical education adjustments and disproportionate share hospital payments that are part of the IPPS comparable amount rate because, according to CMS, they were unlikely to have much impact for these hospitals  CMS reviewed each of these assumptions and agreed they were reasonable for purposes of our analysis  CMS also verified that we were correctly applying the formulas for calculating these payments and using the appropriate values from the final rules  Figures 3 and 4 illustrate the methodology for calculating Medicare payments under the long-term care hospital (LTCH) prospective payment system (PPS) and the inpatient rehabilitation facility (IRF) PPS, respectively, as reported by the Medicare Payment Advisory Commission (MedPAC)  Appendix III: List of Common Diagnosis Groups for Long-Term Care Hospitals (LTCH) In its March 2018 annual report to the Congress, the Medicare Payment Advisory Commission (MedPAC) reported that 20 diagnosis groups accounted for over 61 percent of LTCH discharges at both for-profit and not-for-profit facilities, in fiscal year 2016  Table 5 provides a list of these 20 diagnosis groups  In addition to the contact named above, Will Simerl, Assistant Director; Kathy King; Amy Leone, Analyst-in-Charge; Todd Anderson; Sam Amrhein; LaKendra Beard; Rich Lipinski; Jennifer Rudisill; and Eric Wedum made key contributions to this report  Also contributing were Leia Dickerson, Diona Martyn, Vikki Porter, and Lisa Rogers 

ground_truth: In addition to more than 2.2 million active duty and reserve personnel, DOD employs about 760,000 federal civilians and more than 560,000 contractors. In the Senate Report 114-49 accompanying a bill for the National Defense Authorization Act for Fiscal Year 2016 included a provision for DOD to issue a report (1) assessing functions performed by federal civilian and service contractor personnel, (2) accounting for the full costs of federal civilian and service contractor personnel performing these functions, (3) comparing these costs, and (4) assessing available hiring and retention authorities for federal civilians. The Senate report also included a provision for GAO to assess DOD's report, which DOD submitted to Congress in April 2017. This report examines the extent to which DOD's report addressed the prescribed congressional elements. GAO reviewed DOD's report and compared it to the prescribed elements, examined documents relevant to DOD's cost estimating and comparison methodology, and interviewed DOD officials, including those in its Office of Cost Assessment and Program Evaluation responsible for the calculations in DOD's report. In response to Congressional direction, the Department of Defense (DOD) issued a report in April 2017 comparing the costs of federal civilian and service contractor personnel at select installations. The report addressed three out of four provision elements and partially addressed one, as discussed below. DOD concluded that neither federal civilians nor service contractors were predominately more or less expensive, with costs being dependent on position, location, and level of seniority. DOD noted that it used a non-probability based sample of personnel for its report, and the results are not generalizable. An assessment of performance of functions being performed by federal civilian and service contractor personnel at six military installations, with four being in the continental United States and two being outside the continental United States. GAO believes that DOD addressed this requirement because it developed a methodology to assess performance of functions performed by federal civilians and service contractors at 17 organizations within nine geographic regions including two locations outside the continental United States. DOD used data from the Defense Civilian Personnel Data System to identify military installations with large reported numbers of federal civilians. DOD determined that personnel need to perform at least 80 percent common tasks to be able to make a comparison. An accounting of the fully-burdened, or full, cost of federal civilian and service contractor personnel performing functions at the selected installations including training, benefits, reimbursable costs, and facility overhead. GAO believes that DOD partially addressed this requirement because while it calculated the labor costs of selected federal civilian and service contractor full-time equivalents performing similar functions for organizations at government-owned facilities, it excluded certain non-labor costs from its calculations. A comparison of the costs of performance of these functions by federal civilians and service contractor personnel at the selected installations. GAO believes that DOD addressed this requirement because it compared calculated costs for selected federal civilians and service contractors performing similar functions at selected installations and included those comparisons in its report. An assessment of the flexible employment authorities for the employment and retention of federal civilian employees. GAO believes that DOD addressed this requirement because it sent questionnaires to DOD hiring officials and human resource professionals to collect information on flexible employment authorities and conducted interviews with these and human resource professionals at the same 17 organizations used for the cost comparison. Based on an analysis of the information collected, DOD's report included several conclusions regarding flexible hiring authorities and made one recommendation. GAO is not making any recommendations; however, DOD non-concurred with GAO's assessment that DOD partially addressed the element to account for the full cost of personnel. GAO believes the assessment is correct as discussed in the report.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.

Report 1: Since 2001, DOD’s total workforce has changed in size and composition  DOD’s military, civilian, and contractor workforces peaked around 2011 and have since decreased in size, as shown in figure 1  Several factors have contributed to changes in the size of the workforces including varying levels of U S  involvement in the conflicts in Iraq and Afghanistan, military to civilian and contractor conversions, contractor insourcing, and the growth in certain workforces such as acquisition and cyber  DOD’s management of its workforce is governed by several workforce management statutes, including sections 129, 129a, and 2463 of Title 10 of the United States Code  Section 129 directs that DOD civilian personnel be managed each fiscal year on the basis of, and consistent with, total-force management policies and procedures established under section 129a, the workload required to carry out the functions and activities of the department, and the funds made available to the department each fiscal year  Section 129a directs the Secretary of Defense to establish policies and procedures for determining the most appropriate and cost-efficient mix of military, civilian, and contracted services to perform the mission of the department  Finally, Section 2463 directs the Under Secretary of Defense for Personnel and Readiness to devise and implement guidelines and procedures to ensure that consideration is given to using, on a regular basis, DOD civilian employees to perform new functions and functions performed by contractors that could be performed by DOD civilian employees  DOD Instruction 1100 22, Policy and Procedures for Determining Workforce Mix (April 12, 2010) (Change 1, Dec  1, 2017) establishes policy, assigns responsibilities, and prescribes procedures for determining the appropriate workforce mix of the military, civilian, and contracted services  The instruction provides criteria for workforce-mix decisions and directs DOD components to conduct a cost comparison to determine the low-cost provider for all new or expanding mission requirements and for functions that have been contracted but could be performed by DOD civilian employees  In addition, over the past 10 years DOD has taken steps to better understand the costs associated with its workforces  For example, we found in September 2013 that DOD had improved its methodology for estimating and comparing the full cost of work performed by military and civilian personnel and contractor support, but the methodology continued to have certain limitations, such as the lack of guidance for certain cost elements related to overhead  We made five recommendations, including for DOD to assess the advantages and disadvantages of allowing the continued use of different cost-estimation tools across the department or directing department-wide application of one tool, and revise its guidance in accordance with the findings of its assessment  DOD implemented this recommendation but has not yet implemented the other four recommendations although it concurred or generally concurred with them  DOD’s Cost-Comparison Report addressed three elements and partially addressed one element concerning the accounting for the fully-burdened, or full, cost of federal civilian and service contractor personnel performing functions at the selected installations, as shown in table 1  DOD concluded that for the 21,000 federal civilians and service contractors compared, neither federal civilians nor service contractors were predominately more or less expensive, with the costs being dependent upon the function being performed, location, and level of expertise  DOD noted that the results were not generalizable across the department  Each of the elements and our assessment are discussed below  We believe that DOD addressed the reporting element to assess performance of functions performed by civilian and contractor personnel by developing a methodology to assess performance of functions performed by federal civilians and service contractors at organizations within nine geographic regions including two locations outside the continental United States  Organizations included in DOD’s methodology include the following: Fort Belvoir Community Hospital Defense Threat Reduction Agency US Army Intelligence and Security Command Aviation and Missile Research, Development, and Engineering Center Naval Medical Center San Diego Space and Naval Warfare Systems Command Ogden Air Logistics Complex 75th Air Base Wing Naval Facilities Engineering Command Tripler Army Medical Center DOD’s methodology included the following: Selecting installations and organizations: DOD used data from the Defense Civilian Personnel Data System to identify military installations with large reported numbers of federal civilians  According to DOD officials, they eliminated from consideration those installations that had no reported contractors  From this subset of installations, DOD selected organizations to represent all three military departments and diverse geographical locations, to include two locations outside the continental United States  Assessing the functions performed by civilians and contractors to identify federal civilians and service contractors performing similar functions: DOD assessed the performance of functions at these selected locations to identify federal civilians and service contractors performing similar functions as there is no direct mapping or perfect match between existing taxonomies used to quantify federal civilian positions and contracted services  Further, DOD reported that the day-to-day functions performed by federal civilian employees do not always directly correlate to the designated occupational series or the job title for their position  For example, an individual with an occupational series assigned as an accountant may actually perform work more consistent with that of a financial analyst  According to DOD’s Cost-Comparison Report, DOD did not rely on occupational series names or job titles alone to determine the actual work being performed by federal civilians  Specifically, DOD conducted site visits with each organization and relied on local managers’ direct knowledge of the actual tasks that their federal civilians and service contractor personnel performed  According to DOD’s Cost-Comparison Report, DOD determined that personnel need to perform at least 80 percent common tasks to be able to make a comparison  For the organizations selected, DOD compared the costs of all federal civilians and service contractors identified as performing similar functions  The challenges DOD identified in DOD’s Cost-Comparison Report on determining the functions performed by contractor personnel are similar to those we encountered in our prior work on DOD’s efforts to compile and review of an inventory of contracted services  Section 2330a of Title 10 of the U S  Code directs the Secretary of Defense to annually prepare an inventory of activities performed during the preceding fiscal year pursuant to staff augmentation contracts  Section 2330a also directs the secretary of each military department and head of each defense agency responsible for activities in the inventory to, within 90 days after the Secretary of Defense submits the inventory, review the contracts and activities in the inventory for which that secretary or agency head is responsible, in part to identify activities that should be considered for conversion  Our prior work has identified, among other issues, that the absence of a complete and accurate inventory of contracted services hinders DOD’s management of these services  According to DOD officials, the Office of the Under Secretary of Defense (Personnel and Readiness) has also recognized the challenges associated with the various taxonomies and lexicons associated with articulating the size and composition of federal civilian, military, and contracted services workforces, and has efforts underway with the goal of better aligning those to enable more holistic total force management of all sources of labor  According to DOD officials, by improving available workforce data, DOD can support better-informed leadership decisions, improve accuracy of analyses, and provide consistent explanations of the department’s workforce resources  DOD officials told us that this effort has an estimated completion of December 2018  We believe that DOD partially addressed the reporting element to account for the full cost of civilian and contractor personnel by providing an accounting of the labor costs of selected federal civilian and service contractor full-time equivalents for personnel performing similar functions at government-owned facilities during calendar year 2015, but excluding certain non-labor costs from its cost calculations  According to DOD officials, 2015 was the last year for which complete data were available  DOD developed a methodology for identifying labor costs associated with federal civilian and service contractor full-time equivalents during calendar year 2015 at government-owned facilities for its cost comparisons  Based on reviews of applicable guidance and consultations with the Office of the Under Secretary of Defense – Comptroller, DOD included numerous federal civilian costs collected from several sources in DOD’s Cost Comparison Report, as shown in table 2  In addition, to assure data quality, DOD officials told us that they took steps to identify data errors in the data collected including identifying missing data fields and data entries that might indicate data errors  For example, DOD officials told us that they verified that they had pay records for every pay period in calendar year 2015 by identifying potential errors and outliers and sharing these with the Defense Finance and Accounting Service and the selected DOD organizations for review  Officials also stated that DOD sent its complete calculated data sets to each organization for review against their own pay records and that all errors were corrected or outliers were explained  Additionally, according to our analysis, DOD excluded overtime from its costs related to federal civilians in accordance with Office of Management and Budget Circular A-11  However, DOD included overtime pay in its report separately for context and noted that overtime pay is a significant part of civilian compensation for some organizations  Officials noted that those funded via a working capital fund arrangements, such as depots, use overtime to handle surges in demand throughout the year  DOD noted in its report that selected service contracts at government facilities and developed three methodologies to identify labor costs associated with service contractor full-time equivalents during calendar year 2015, as shown in table 3  DOD stated in its report that identifying service contractor full-time equivalents is a significant challenge because the level of detail available in each contract varied such that DOD could not employ a single methodology, and unlike federal civilian pay data, there is no centralized database on service-contractor pay  DOD reported that contracts are rarely written to address the cost-per-contractor as a full-time equivalent, and some contracts do not differentiate between labor and non-labor costs  DOD noted in its report that the negotiated price of the contract includes direct costs, including labor and non-labor costs, and indirect costs such as overhead  Further, the contract costs include service contractor profit  Based on our review of DOD’s Cost-Comparison Report, DOD used non- excludable contract costs as a basis in two of its methodologies  These costs to DOD are associated with labor, and include pay and benefits provided to service contractor personnel, contractor profit, and overhead the contractor included in the cost of the contract  When the number of service contractor full-time equivalents and full costs for a contract was known, DOD used the first method, dividing contract costs by the number of service contractor full-time equivalents to arrive at the cost per service contractor full-time equivalent  When the number of billable hours was known, DOD used the second method, multiplying the ratio of contract costs divided by billable hours by a standard number of annual billable hours  For contracts in which the labor rate was known but costs could not be disaggregated, DOD multiplied the labor rate by a standard 1,880 annual billable hours unless a contract specified the labor rate as a number of annual billable hours  For example, Defense Logistics Agency contractor-labor rates for wage grade equivalent contractor full-time equivalents are based on 2,080 annual labor hours  We assessed DOD’s report as partially addressing the reporting element to account for the full cost of federal civilian and contractor personnel because DOD excluded certain non-labor costs from its costs calculations—(1) direct non-labor costs for government owned facilities and government provided supplies, (2) indirect costs for general and administrative and overhead for civilians, and (3) costs to manage contracts—from its costs calculations  Senate Report 114-49 stated that DOD is to include an accounting of the full cost of DOD federal civilian and service contractors performing similar functions, including facility overhead  DOD stated in its report that the methodology utilized to compare the costs of federal civilian and service contractor full-time equivalents was consistent with DOD Instruction (DODI) 7041 04, Estimating and Comparing the Full Costs of Civilian and Active Duty Military Manpower and Contract Support (July 3, 2013), hereafter referred to DODI 7041 04  However, DODI 7041 04 states that the full cost of personnel should include direct and indirect non-labor costs, such as those referenced previously  DOD officials stated that they considered including non-labor costs in their calculations but did not because they believe these costs would add approximately the same to both federal civilian and service contractor costs  DODI 7041 04 instructs that if a function is performed on government property, the costs of goods, services, and benefits that are common costs may be excluded provided the number of government and contactor personnel is equivalent  DODI 7041 04 further instructs that when the number of government and contractor personnel differs, adjustments must be made to the cost estimates to account for the difference in number of government and contractor personnel  While there were some instances where it was the case that DOD’s cost estimates involved an equal number of civilian and contractor personnel performing functions on government property, there were many instances in where the personnel numbers differed and common costs should not have been excluded  For example, in DOD’s comparisons of federal civilians and service contractors at Fort Belvoir Community Hospital, DOD conducted comparisons of 19 functions where 2 functions had equal numbers of federal civilian and service contractors and 17 functions had differing numbers of federal civilian and service contractors  In one comparison, the number of contractors was over three times the number of civilians  DOD officials also stated that they believe their methodology is in accordance with DODI 7041 04 because DODI 7041 04 states that the cost elements in the instruction can be modified or augmented in each specific case as necessary, but DOD components should be prepared to support such decisions with sufficient justification  We acknowledge that DODI 7041 04 states that the cost elements can be modified, but by excluding non-labor costs in its cost comparisons, DOD did not account for the full cost of federal civilians and service contractors as requested in the mandate  We believe that DOD addressed the reporting element to compare costs by comparing its calculated costs of selected federal civilians and service contractors performing similar functions at selected installations  DOD reported that its results represent selected personnel performing functions within selected organizations and are not generalizable across the department  DOD concluded that for the federal civilian and contractor full-time equivalents included in the study, the costs varied by organization, location, and function being performed  DOD presented comparisons of federal civilian and service contractor full-time equivalents costs and expressed these results as a cost ratio  However, it is not clear how the results would be different if all costs that encompass full costs of personnel would have been included in DOD’s comparisons  See tables 4 and 5 below for examples of greater costs for the performance of functions by federal civilians or service contractors at Fort Belvoir Community Hospital in Fort Belvoir, Virginia  We believe that DOD addressed the reporting element by assessing the flexible employment authorities for the employment and retention of federal civilian employees at the same 17 organizations used for the cost comparison  Specifically, DOD sent questionnaires to DOD hiring officials and human resource professionals to collect information on flexible employment authorities  DOD included a broad spectrum of organizational missions in its query of management and human resource officials regarding the use and availability of flexible hiring authorities  Noting that this assessment is more subjective than the others in DOD’s Cost-Comparison Report, DOD queried senior leaders, middle managers, front-line supervisors and human resource professionals regarding which authorities are being used and the effectiveness of each  According to DOD’s report, in this way, DOD was able to gauge the extent to which each type of authority was used as well as the satisfaction with and effectiveness of each  DOD’s Cost-Comparison Report made several conclusions regarding flexible hiring authorities and made one recommendation  The findings included that there was a variance in the authorities used between organizations, management unfamiliarity with all available authorities, and a belief among managers that expanded use of some authorities is needed to produce more quality hires  DOD’s Cost- Comparison Report recommended DOD and OPM should explore opportunities to refine, consolidate, or reduce unused, inefficient, or cumbersome hiring authorities  We provided a draft of this report to DOD for review and comment  In written comments, DOD non-concurred with our assessment that DOD partially addressed the mandated reporting element to provide an accounting of the fully-burdened cost of federal civilian and service contractor personnel performing functions at the selected installations to include training, benefits, reimbursable costs, and facility overhead  DOD’s comments are reproduced in their entirely in appendix I  DOD also provided technical comments, which we incorporated as appropriate  DOD stated that we presented the three reporting elements identified in the congressional mandate absent the full context and congressional intent  Specifically, DOD stated that in the congressional mandate, the list of elements to be included in the report is not a stand-alone list and DOD stated that we present the elements as a stand-alone list  DOD further stated that the list of elements in the mandate is preceded by a paragraph that we did not reproduce in our report, but which provides context and congressional intent for the reporting elements  We do not believe that the language omitted from our report changes the meaning of the reporting elements to be included in DOD’s cost comparison report because the paragraph omitted clearly states that the purpose of the report is to provide the results of a study that includes a comparison of the fully-burdened cost of the performance of functions by DOD civilian personnel with the fully-burdened cost of the performance by DOD contractors  The paragraph preceding the reporting elements and the elements reads as follows: The committee directs the Secretary of Defense to submit to the Committees on Armed Services of the Senate and the House of Representatives, and to the Comptroller General of the United States, a report setting forth the results of a study, conducted by the Secretary for the purposes of the report, of a comparison of the fully-burdened cost of performance of functions by Department of Defense (DOD) civilian personnel with the fully-burdened cost of the performance of functions by DOD contractors by no later the February 1, 2016  The study shall include: (1) An assessment of performance of such functions at six DOD installations selected by the Secretary for purposes of the study from among DOD installations at which functions are performed by an appropriate mix of civilian personnel and contractors, with four such installations to be located in the continental United States and two such installations to be located outside the continental United States; (2) An accounting of the fully-burdened cost of DOD civilian personnel and contractors performing functions for DOD (including costs associated with training, benefits, reimbursable costs under chapter 43 of title 41, United States Code, and facility overhead) in order to permit a direct comparison between the cost of performance of functions by DOD civilian personnel and the cost of the performance of functions by contractors; (3) A comparison of the cost of performance of the full range of functions, required expertise, and managerial qualities required to adequately perform the function to be compared, including: a  Secretarial, clerical, or administrative duties, including data entry; b  Mid-level managers and other personnel possessing special expertise or professional qualifications; c  Managers and other leadership; and d  Personnel responsible for producing congressionally-directed reports  The committee recommends that, in conducting the study, the Secretary should take into account the policy that inherently governmental functions vital to the national security of the United States may not be performed by contractor personnel  The report required shall include an assessment of the flexible employment authorities available to the Secretary for the employment and retention of civilian employees of the DOD, including an identification of such additional flexible employment authorities as the Secretary considers appropriate to shape the civilian personnel workforce of the DOD  Not later than 120 days after receipt of such report, the Comptroller General shall submit to Congress a report that includes an assessment of the adequacy and sufficiency of the report submitted by the Secretary, including any recommendations for policy or statutory change as the Comptroller deems appropriate  As we reported, DOD noted in its cost comparison report that it identified labor costs used in its comparisons  However, DOD did not include direct and indirect non-labor costs and DODI 7041 04 states that the full cost of personnel should include these non-labor costs as we discussed earlier in the report  Therefore, DOD only partially addressed the reporting provision  In addition, DOD stated that we omit relevant language related to congressional intent for the second reporting element (i e , an accounting of the fully-burdened cost of DOD civilian personnel and contractors)  DOD stated that the text, “      in order to permit a direct comparison between the cost of performance of functions by DOD civilian personnel and the cost of the performance of the function by contractors,” conveys the congressional intent that the study is for comparison and our exclusion of the text in our restatement of the element omitted language indicating relevant Congressional intent  We do not believe that the language omitted in our report changed the meaning of the reporting element, which is that DOD was to include an accounting of the fully- burdened costs of federal civilians and service contractors in its cost comparisons  DOD further stated that we did not assess the second reporting element (i e , an accounting of the fully-burdened cost of DOD civilian personnel and contractors) as it is directly stated but rather that we assessed the element by redefining it and then asserting that DOD partially addressed it  DOD noted that the direct language of the second reporting element is for DOD to include an “accounting” of the fully burdened cost of DOD civilian personnel and contractors  DOD asserted that we misinterpreted the meaning of “accounting” when we determined that DOD partially addressed the mandate because it did not “calculate” certain non-labor costs  We disagree  As we discuss in our report, DOD did account for the labor costs associated with federal civilian and service contractors by gathering labor cost data from several sources, but it did not include non- labor costs in its cost calculations  In order to account for the fully burdened costs of federal civilians and service contractors, as directed to do so by the preamble to the reporting elements, as well as the second reporting element, DOD should have included all labor and non-labor costs in the cost calculations  DOD also stated that our assessment incorrectly implies that to “account” for costs is equivalent to “calculating” costs as evidenced by the following quote from our draft report, "We acknowledge that DODI 7041 04 states that the cost elements can be modified, but by excluding non-labor costs in its cost comparisons, DOD did not account for the full cost of federal civilians and service contractors as requested in the mandate " DOD stated that although DOD did not “calculate” some non-labor costs, they did “account” for them in accordance with DODI 7041 04 and as directed in the congressional mandate  DOD asserted that in multiple places, DODI 7041 04 states that common costs "are excluded" and "may be excluded" from cost comparisons  DOD provided facility costs as an example of non-labor costs accounted for but not calculated in its cost comparisons  DOD stated that in its report, all of the civilian positions and contractor functions are performed at government-owned facilities  Thus, facility costs are common costs and may be excluded  DOD stated that their report accounted for facility costs by recognizing that such costs exist and are common costs, thus, DOD properly excluded such costs in accordance with DODI 7041 04, and their report satisfied the Congressional mandate  We disagree  As mentioned above, the preamble to the mandated reporting elements and the second reporting element specifically directed that DOD account for the fully-burdened cost of DOD civilian and contractor personnel  Because there are multiple costs associated with civilian and contractor personnel, calculations are necessary in order to account for the full cost of these workforces  DODI 7041 04 instructs that if a function is performed on government property, the costs of goods, services, and benefits that are common costs may be excluded provided the number of government and contactor personnel is equivalent  While there were some instances where it was the case that DOD’s cost estimates involved an equal number of civilian and contractor personnel performing functions on government property, there were many instances where the personnel numbers differed and common costs should not have been excluded  For example, in DOD’s comparisons of federal civilians and service contractors at Fort Belvoir Community Hospital, DOD conducted comparisons of 19 functions where 2 functions had equal numbers of federal civilian and service contractors and 17 functions had differing numbers of federal civilian and service contractors  In one comparison, the number of contractors was over three times the number of civilians  DODI 7041 04 further instructs that when the number of government and contractor personnel differs, adjustments must be made to the cost estimates to account for the difference in number of government and contractor personnel  DOD did not make these adjustments in is calculations and as result non-labor costs should not have been excluded; therefore, DOD did not account for the fully- burdened costs, as directed by Congress  We are sending copies of this report to the appropriate congressional committees  We are also sending copies to the Secretary of Defense, the Director of the Office of Cost assessment and Program Evaluation and other interested parties  This report will also be available at no charge on our Web site at http://www gao gov  Should you or your staff have any questions concerning this report, please contact Brenda S  Farrell at (202) 512-3604 or farrellb@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix II  In addition to the contact named above, Vincent Balloon, Assistant Director; Timothy Carr, Felicia Lopez, Clarice Ransom, Michael Silver, and Norris “Traye” Smith made key contributions to this report  Department of Defense: Actions Needed to Address Five Key Mission Challenges, GAO-17-369 (Washington, D C : June 13, 2017) DOD Civilian and Contractor Workforces: Additional Cost Savings Data and Efficiencies Plan Are Needed, GAO-17-128 (Washington, D C : October 12, 2016) Federal Hiring: OPM Needs to Improve Management and Oversight of Hiring Authorities, GAO-16-521 (Washington, D C : August 2, 2016) DOD Service Acquisition: Improved Use of Available Data Needed to Better Manage and Forecast Service Contract Requirements, GAO-16-119 (Washington, D C : February 18, 2016) Civilian and Contractor Workforces: Complete Information Needed to Assess DOD’s Progress for Reductions and Associated Savings, GAO-16-172 (Washington, D C : December 23, 2015) DOD Inventory of Contracted Services: Actions Needed to Help Ensure Inventory Data Are Complete and Accurate, GAO-16-46 (Washington, D C : November 18, 2015) Sequestration: Comprehensive and Updated Cost Savings Would Better Inform DOD Decision Makers if Future Civilian Furloughs Occur, GAO-14-529 (Washington, D C : June 17, 2014) Human Capital: Opportunities Exist to Further Improve DOD’s Methodology for Estimating the Costs of Its Workforces, GAO-13-792 (Washington, D C : September 25, 2013) Human Capital: Additional Steps Needed to Help Determine the Right Size and Composition of DOD’s Total Workforce, GAO-13-470 (Washington, D C : May 29, 2013) Defense Outsourcing: Better Data Needed to Support Overhead Rates for A-76 Studies, GAO/NSIAD-98-62 (Washington, D C : Feb  27, 1998)


Report 2:  The provider emphasized concerns about the long-term viability of caring for those patients at the facility, because their care is paid at lower rates  Our review of Medicare claims data, other information, and interviews with stakeholders indicated the two qualifying hospitals treated Medicare beneficiaries with different conditions than most of those treated at other LTCHs  Our analysis of Medicare claims data indicates Craig Hospital and Shepherd Center treat very few patients in the Medicare diagnosis groups that are most common to other LTCHs  Specifically, for several years, MedPAC has reported that LTCH patient discharges are concentrated in a relatively small number of diagnosis groups  For example, in March 2018, MedPAC reported that 20 diagnosis groups accounted for over 61 percent of LTCH discharges at both for-profit and not-for-profit facilities, in fiscal year 2016  However, in fiscal year 2016, these diagnosis groups accounted for approximately 30 percent of Medicare discharges—26 out of 88—at Shepherd Center, and most of these discharges fell within a single diagnosis group which covers a range of conditions  Craig Hospital did not discharge any Medicare beneficiaries assigned to these 20 diagnosis groups, in fiscal year 2016  The seven diagnosis groups that were used in the statutory criteria to except Craig Hospital and Shepherd Center from site-neutral payments were also not among these 20 diagnosis groups  For more information on the 20 diagnosis groups common to LTCHs in fiscal year 2016, see Appendix III, table 5  Our review of Medicare claims data and other information indicates the two qualifying hospitals also treat a relatively small number of Medicare beneficiaries, a key distinguishing factor from most other LTCHs  In March 2018, MedPAC reported that, on average, Medicare beneficiaries account for about two-thirds of LTCH discharges  However, Medicare claims data and other information provided by the two qualifying hospitals indicate Medicare beneficiaries account for a significantly smaller proportion (about 8 percent) of patients discharged from Craig Hospital and Shepherd Center in 2016  Specifically, 40 of the 486 patients discharged from Craig Hospital in fiscal year 2016 and 75 of the 912 patients discharged from Shepherd Center in calendar year 2016, were Medicare beneficiaries  Officials from the qualifying hospitals told us they treat few Medicare patients primarily because of the younger average age of persons with spinal cord injuries and acquired brain injuries  While patients with spinal cord and brain injuries may receive care in other LTCHs, most stakeholders we interviewed also suggested the two qualifying hospitals treat patients that are different from those treated at most other LTCHs, and can offer specialized care  Officials from the two qualifying hospitals told us that, relative to most other facilities—including most traditional LTCHs—they offer a more complete continuum of care to meet the needs of patients at different stages of spinal cord and brain injury treatment, without the need to transfer to different facilities  Officials also stated that, unlike most traditional LTCHs, they are able to offer more specialized care for patients with spinal cord and brain injuries, including more comprehensive rehabilitation services  Stakeholders we interviewed generally agreed that the two qualifying hospitals have developed expertise in treating spinal cord and brain injury patients and offer intensive rehabilitation services that are not provided in most other LTCHs  In addition, officials from the Colorado Department of Health Care Policy & Financing noted that Craig Hospital treats a patient population that is different from most other LTCHs in the state of Colorado  Specifically, according to officials, in comparison to other LTCHs in the state, Craig Hospital treats: (1) a higher percentage of patients with more severe conditions, (2) more patients from outside the state of Colorado, (3) fewer patients requiring ventilator weaning or requiring wound care— conditions typically characteristic of LTCH patients—and (4) patients that are, on average, younger than most other LTCHs in the state of Colorado  In addition, a 2014 study of LTCHs conducted for the Georgia Department of Community Health found Shepherd Center was “distinctly different” from other LTCHs in the state of Georgia, and most LTCHs nationwide  Most stakeholders we interviewed suggested some IRFs provide specialty care to patients with catastrophic spinal cord, acquired brain injuries, or other paralyzing neuromuscular conditions  Most of the stakeholders we interviewed noted that—like the two qualifying hospitals—some IRFs have the expertise to treat patients with catastrophic spinal cord, acquired brain injuries, or other paralyzing neuromuscular conditions patients and thus, may also treat patients with similar conditions  According to CMS officials, IRFs are specifically designed to provide post-acute rehabilitation services to patients with spinal cord injuries, brain injuries, and other neuromuscular conditions  CMS officials noted that patients with these conditions typically respond well to intensive rehabilitation therapy provided in a resource intensive inpatient hospital environment and to the specific interdisciplinary approach to care that is provided in the IRF setting  Stakeholders also noted that patients with spinal cord injuries, brain injuries, and other neuromuscular conditions may receive care in other settings  However, some stakeholders noted that some of these providers—such as skilled nursing facilities—generally do not offer the specialized care these patients generally require  Differences in payment systems and data limitations make it difficult to directly compare the attributes of Medicare beneficiaries discharged from the two qualifying hospitals and IRFs, including the costs of care they receive  Medicare uses separate payment systems to pay LTCHs and IRFs, for care provided to beneficiaries  LTCHs are paid pre-determined fixed amounts for care provided to Medicare beneficiaries, under the LTCH PPS  Medicare beneficiaries treated in LTCHs are assigned to diagnosis groups (MS-LTC-DRGs) for each stay—based on the patient’s primary and secondary diagnoses, age, gender, discharge status, and procedures performed  IRFs are also paid pre-determined fixed amounts for care provided to Medicare beneficiaries, but under a separate system—IRF PPS  Medicare beneficiaries treated in IRFs are assigned to case-mix groups—based on age, and level of motor and cognitive function—and then further assigned to one of four tiers (within these groups) based on the presence of specific comorbidities that may increase their cost of care  According to CMS officials, because the payment groups and assignments to those groups are different, it is difficult to directly compare LTCH patients, classified in diagnosis groups, with IRF patients, classified in case-mix groups  See Appendix II for more information on these payment systems  MedPAC has previously reported the differences in patient assessment tools used by post-acute care providers undermines Medicare’s ability to compare the patients admitted, costs of care, and outcomes beneficiaries achieve in these settings, on a risk-adjusted basis  MedPAC has also reported that while similar beneficiaries can receive care in each setting, payments can differ considerably for comparable conditions, due to differences in payment systems  It has made recommendations to address these issues  The Improving Medicare Post-Acute Care Transformation Act of 2014 also requires the Secretary of HHS to collect and analyze common patient assessment information and, in consultation with MedPAC, submit a report to Congress recommending a post-acute care PPS  Such efforts may make future comparison of beneficiaries, costs of services, and outcomes of care across these settings possible  While data limitations make a direct comparison difficult, based on our review of other data and information, and interviews with stakeholders, we identified similarities and differences between the qualifying hospitals and certain IRFs that provide specialty treatment for catastrophic spinal cord injuries, acquired brain injuries, or other paralyzing neuromuscular conditions  Key similarities and differences include the following: Volume of services  Our review of Medicare claims data, other information, and interviews with stakeholders indicate that—similar to the two qualifying hospitals—some IRFs treat a high volume (at least 100) of patients with complex spinal cord injury, brain injury, and other related conditions  Officials from the two qualifying hospitals, as well as some other stakeholders we interviewed—including officials from the Christopher & Dana Reeve Foundation and the Brain Injury Association of America—emphasized the importance of facilities treating a high volume of patients with these specialized conditions, which can be an indicator of expertise in treating these patients  Our review of Medicare claims data for 1,148 IRFs in fiscal year 2016 identified 21 IRFs that treated at least 100 Medicare beneficiaries with non-traumatic and traumatic spinal cord injuries and 109 IRFs that treated at least 100 Medicare beneficiaries with non-traumatic and traumatic brain injuries  Our review of Medicare claims data indicated that, similar to the two qualifying hospitals—some IRFs also treat a high volume of patients with “catastrophic” injuries—traumatic brain injury, traumatic spinal cord injury, and major multiple traumas with brain or spinal cord injuries  Specifically, we identified 25 IRFs that treated a high volume (at least 100) of Medicare beneficiaries with catastrophic injuries, in fiscal year 2016  In the absence of patient assessment data from the facilities, we did not independently evaluate the level and severity of these patients’ injuries, which can vary due to the presence of other co-morbid conditions  The Medicare case mix indexes we reviewed for these 25 IRFs indicated that, relative to other IRFs, most of these facilities treat patients who are more resource intensive  Specialty accreditation and designation as model systems  Like Shepherd Center, some IRFs receive CARF-accreditation for specialty programs to treat spinal cord and brain injuries  According to most stakeholders, this accreditation indicates expertise in treating these patients, as CARF International has established standards using evidence-based practices, among other factors  Officials from the two qualifying hospitals also noted CARF International has a specific focus on quality and outcomes  However, officials from Shepherd Center noted similarities in care and services offered at CARF-accredited facilities would depend on the specialties for which they are certified  Most of the stakeholders we interviewed also noted that designation as a NIDILRR model system is an indicator of similar expertise in treating patients with spinal cord and brain injuries  According to the Model Systems Knowledge Translation Center, spinal cord injury and brain injury model systems are recognized as national leaders in medical research and patient care and provide the highest level of comprehensive specialty services from the point of injury through eventual re-entry into full community life  While stakeholders we interviewed from NIDILRR model systems indicated the model system designation is focused primarily on research, rather than clinical care, most noted that model systems’ research often complements the facilities’ clinical efforts to address the unique needs of these patients  Officials from HHS’s Administration for Community Living also noted that all model system grantees must provide a continuum of care—emergency care, acute medical care, acute medical rehabilitation, and post-acute care—and that can happen in various provider types  According to officials from the qualifying hospitals and stakeholders from one other NIDILRR model system we interviewed, Craig Hospital and Shepherd Center are the only two LTCHs currently classified as spinal cord injury model systems; 12 of 14 spinal cord injury model systems are IRFs  Specialized programs and services  Similar to the two qualifying hospitals, some IRFs may also offer specialized programs and services for patients with brain and spinal cord injuries, but the availability of these programs and services may vary by facility  Officials from some of the IRFs that responded to our information request—which included both NIDILRR facilities and IRFs with CARF-accredited programs—told us they provide specialized programs and services for patients with similar conditions as those treated at two qualifying hospitals, and sometimes compete with the two qualifying hospitals for the same patients  For example, each IRF reported having interdisciplinary treatment teams; the capacity to provide medical management of medically complex and high acuity patients with spinal cord injury, traumatic brain injury, or other major multiple traumas associated with a brain or spinal cord injury; family education and training; and skin and wound programs or services, among other services  However, the availability of certain services—including but not limited to ventilator-dependent weaning programs, diaphragmatic pacing, and outpatient programs for spinal cord and traumatic brain injury patients—varied by facility  Staff with specialized training and clinical expertise  Similar to the two qualifying hospitals, most facilities that responded to our information request also reported having physicians, nurses, and physical and occupational therapists with specialty training in medical rehabilitation, spinal cord, and/or brain injury  However, the number of staff with these trainings, varied by facility  In comparison to the other facilities that responded to our information request, the number of nurses and physical and occupational therapists with these specialty trainings were generally higher at Craig Hospital and Shepherd Center  According to an American Spinal Injury Association consumer guideline that the Christopher & Dana Reeve Foundation typically provides to spinal cord injury patients and families, programs should regularly admit persons with spinal cord injury each year, to develop and maintain the necessary skills to manage a person with spinal cord injury, and a substantial portion of those admitted should have traumatic injuries  Out-of-state Admissions  Officials from the two qualifying hospitals emphasized they admit a significant number of patients from out-of-state, and our review of information provided by the qualifying hospitals and a select group of IRFs indicated the qualifying hospitals admit a higher percentage of patients from out-of-state  Specifically, information provided by these IRFs indicates that less than a quarter of patients admitted to these facilities, in 2016, were from out-of-state  Information provided by Craig Hospital and Shepherd Center indicate that about half of their patients were admitted from out-of-state in 2016  Officials from the Colorado Department of Health Care Policy & Financing also noted Craig Hospital treats a higher percentage of out-of-state patients, compared to IRFs in the state  Ability to treat medically complex patients  Officials from the two qualifying hospitals told us they treat more medically complex patients and provide a more complete range of medical services to spinal cord and brain injury patients, not provided by most IRFs  Specifically, officials from the two qualifying hospitals both noted they are able to treat patients much sooner in their recovery process than most IRFs, due to their LTCH status  Officials from the Shepherd Center noted that they have a 10-bed intensive care unit which allows them to take patients with certain injures that some IRFs may not be equipped to admit—such as patients requiring advance medical management and advanced level procedural services and monitoring  Information provided by Shepherd Center indicated that, in calendar year 2017, approximately 20 percent of all inpatients were admitted to this unit and 13 percent of all inpatients were internally transferred to this unit after developing medical complications  According to officials, Craig Hospital does not have an intensive care unit, but noted their ability to similarly care for medically complex patients—including telemetry (e g , specialized heart monitoring) and one-to-one nursing care, if necessary  Most stakeholders we interviewed agreed that both qualifying hospitals’ LTCH status provides certain advantages over IRFs, such as the ability to admit some medically complex patients earlier in the recovery process and longer lengths of stay  Stakeholders from most of the IRFs we interviewed also reported having the flexibility to admit some medically complex patients requiring more advanced level monitoring and resources earlier in the recovery process—such as patients with disorders of consciousness  Officials from the two qualifying hospitals also said they offer a continuum of care that can meet patient’s changing needs, without the need to transfer them to different facilities  Information provided by Craig Hospital indicated that 83 percent of patients treated at its facility, in 2016, were discharged to home, 13 percent were discharged to another post-acute care facility, and 3 percent were discharged to an acute care hospital  In 2016, approximately 91 percent of patients treated at Shepherd Center were discharged to home, 7 percent were discharged to another post- acute care facility, and 2 percent were discharged to an acute care hospital  Information provided by the IRFs that responded to our written request varied by facility, but—similar to the two qualifying hospitals— each facility discharged more than 65 percent of patients to home  IRF payment criteria  CMS and most other stakeholders we interviewed noted that two Medicare payment policies applicable to IRFs, but not LTCHs, may contribute to their different patient populations  Specifically, to be classified for payment under Medicare’s IRF PPS, at least 60 percent of the IRF’s total inpatient population must require intensive rehabilitative treatment for one or more of 13 conditions—which includes both spinal cord and brain injury  To be admitted to an IRF, Medicare beneficiaries must reasonably be expected to actively participate in and benefit from the intensive rehabilitation therapy program, typically provided in IRFs  According to HHS, per industry standard, the intensive rehabilitation therapy program is often demonstrated by providing three hours of rehabilitation services per day for at least five days per week, but this is not the only way such intensity can be demonstrated  Officials from the two qualifying hospitals told us they generally use Medicare’s intensive rehabilitation requirement as a minimum standard for their rehabilitation patients—even though they are not held to this requirement, for the purposes of Medicare payment—but noted that some of their patients may not meet this requirement, due to their medical complexity  Length of stay and site-neutral payment requirements, for LTCHs  As previously noted, LTCHs—including the two qualifying hospitals—must have an average length of stay of greater than 25 days; IRFs are not subject to this requirement  The average length of stay for patients discharged from the Craig Hospital was about 60 days, in fiscal year 2016, and the average length of stay for patients discharged from Shepherd Center was about 53 days, in calendar year 2016  Stakeholders from the IRFs that responded to our information request reported average lengths of stay ranging from 14 to 31 days, for patients discharged in fiscal year 2016; the ranges of lengths of stay were slightly higher for spinal cord injury and traumatic brain injury inpatients for the IRFs, during the same period  LTCHs are also generally subject to site- neutral payment policy that is not applicable to IRFs and may decrease LTCHs payments for certain discharges, under Medicare  Other services provided  In addition to these Medicare specific differences, a few stakeholders we interviewed also noted the two qualifying hospitals receive additional funding from their strong philanthropic donor base that may allow them to provide other services and resources, not covered by Medicare or offered at some IRFs  For example, while a few IRFs that responded to our information request reported offering housing for families of injured patients, the two qualifying hospitals offer up to 30 days of free housing to families of newly injured rehabilitation patients, if both the family and patient live more than 60 miles from the hospital  Officials from Shepherd Center told us their revenues are supplemented by investment income and donor funds  Craig Hospital has also established a foundation that supports the hospital in achieving its goals through philanthropy  We provided a draft of this report to HHS  HHS provided technical comments, which we incorporated as appropriate  We also provided the two qualifying hospitals summaries of information we collected from them, to confirm the accuracy of statements included in our draft report  We incorporated their comments, as appropriate  We are sending copies of this report to the Secretary of Health and Human Services and other interested parties  In addition, the report will be available at no charge on GAO’s website at http://www gao gov  If you or your staff have any questions about this report, please contact me at (202) 512-7114 or at farbj@gao gov  Contact points for our Office of Congressional Relations and Office of Public Affairs can be found on the last page of this report  Other major contributors to this report are listed in appendix IV  This appendix describes our methodology for conducting simulations of payments for the two qualifying hospitals  We used Medicare claims data to conduct simulations of payments for the two qualifying hospitals  We first identified discharges at each hospital in two baseline years—federal fiscal years 2013 and 2016  We selected fiscal year 2016 because it was the year with the most recent data available at the time of our analysis, and we selected a second baseline year because data for 2016 was different than data for other recent years  For example, the number of discharges for one qualifying hospital declined by nearly half between fiscal years 2013 and 2016  We chose fiscal year 2013 because data from that year was used to help determine which hospitals are subject to the temporary exception  To identify how to appropriately calculate the long-term care hospital (LTCH) payment for each of these discharges in future payment years, we reviewed applicable federal regulation and documents from the Centers for Medicare & Medicaid Services (CMS) and the Medicare Payment Advisory Commission (MedPAC), and interviewed officials from both organizations  See table 4 for the relevant components in the formulas, such as Medicare severity long-term care diagnosis related group (MS-LTC-DRG) weights, identified from final rule tables  When conducting these simulations, we made the following assumptions: For simulated payments for payment policies in effect for fiscal years 2017 and 2018, we used the base rates, relative weights (e g , the MS-LTC-DRG weights), geometric mean length of stay, wage index, geographic adjustment factor, fixed-loss amounts, and outlier thresholds that were published in the final rule tables for LTCH and inpatient prospective payment system (IPPS) hospitals—also known as acute care hospitals—for each respective year  At the time we began our analysis, this information was not known for fiscal years 2019 through 2021  We chose to use the fiscal year 2018 rates when conducting simulations for payment policies in those years because historical trends showed that annual changes were minimal—about 1 percent  Therefore, to the extent that these values continue to change over time, our findings may understate or overstate the amount that the qualifying hospitals would have been paid in our baseline years based on these future payment policies  The site-neutral payment policy did not apply to discharges from the fiscal year 2013 baseline year  Therefore, we examined Medicare claims data to determine whether each discharge would have met the criteria to receive the LTCH standard rate in that year  Specifically, we determined whether each discharge had an acute care hospital stay that immediately preceded their LTCH stay  We then determined whether the time at the acute care hospital included three or more days in the intensive care unit or whether there was a code on the LTCH claim that indicated at least 96 hours of mechanical ventilation services were provided  Per Medicare’s payment policy, we assumed any discharge that met these two criteria would qualify for full LTCH payment rate, unless the case was a psychiatric or rehabilitation stay, as identified by the following MS-LTC-DRG codes: 876, 880, 881, 882, 883, 884, 885, 886, 887, 894, 895, 896, 897, 945, or 946  Under statute, unless 50 percent or more of the hospital’s discharges beginning during or after 2020 qualify for the standard rate, no subsequent payments will be made to a hospital at that rate  Therefore, when calculating simulated payments for fiscal year 2021, we applied the 50 percent threshold  At the time of our analysis, CMS had not yet finalized this policy through rule-making  As of November 2018, CMS officials told us that it is unlikely that any payment adjustment under this provision would apply until 2022 because the percentage cannot be determined until after an LTCH’s cost reporting period has ended and data have been submitted  Shepherd Center’s fiscal year is different than the federal fiscal year  Therefore, the variables used to determine whether discharges in federal fiscal year 2016 met criteria to receive the standard rate were not available to use for some of the discharges that year  Of those discharges, we assumed that the same percentage of discharges that met the criteria to receive the standard rate in Shepherd’s fiscal year—30 percent—met the criteria in federal fiscal year 2016  When calculating site-neutral payments, we assumed that each discharge would be paid at a rate comparable to that for acute care hospitals—the IPPS comparable amount rate  Site-neutral payments may also be based on the estimated cost-of-care, if it is lower than the IPPS comparable amount rate  However, over 90 percent of discharges at the qualifying hospitals were paid at the IPPS comparable amount rate in fiscal year 2016  Per CMS’s recommendation, we applied the cost-to-charge ratio that was effective October 1, 2017, for each qualifying hospital, regardless of discharge date  For Craig Hospital this value was 0 442 and for Shepherd Center this value was 0 464  According to CMS officials, in general, these values do not change significantly when they are updated during the fiscal year  Therefore, they believe that using the values effective at the start of the fiscal year is a reasonable assumption  We excluded indirect medical education adjustments and disproportionate share hospital payments that are part of the IPPS comparable amount rate because, according to CMS, they were unlikely to have much impact for these hospitals  CMS reviewed each of these assumptions and agreed they were reasonable for purposes of our analysis  CMS also verified that we were correctly applying the formulas for calculating these payments and using the appropriate values from the final rules  Figures 3 and 4 illustrate the methodology for calculating Medicare payments under the long-term care hospital (LTCH) prospective payment system (PPS) and the inpatient rehabilitation facility (IRF) PPS, respectively, as reported by the Medicare Payment Advisory Commission (MedPAC)  Appendix III: List of Common Diagnosis Groups for Long-Term Care Hospitals (LTCH) In its March 2018 annual report to the Congress, the Medicare Payment Advisory Commission (MedPAC) reported that 20 diagnosis groups accounted for over 61 percent of LTCH discharges at both for-profit and not-for-profit facilities, in fiscal year 2016  Table 5 provides a list of these 20 diagnosis groups  In addition to the contact named above, Will Simerl, Assistant Director; Kathy King; Amy Leone, Analyst-in-Charge; Todd Anderson; Sam Amrhein; LaKendra Beard; Rich Lipinski; Jennifer Rudisill; and Eric Wedum made key contributions to this report  Also contributing were Leia Dickerson, Diona Martyn, Vikki Porter, and Lisa Rogers 

ground_truth: In April 2018, Facebook disclosed that a Cambridge University researcher may have improperly shared the data of up to 87 million of its users with a political consulting firm. This disclosure followed other recent incidents involving the misuse of consumers' personal information from the Internet, which is used by about three-quarters of Americans. GAO was asked to review federal oversight of Internet privacy. This report addresses, among other objectives: (1) how FTC and FCC have overseen consumers' Internet privacy and (2) selected stakeholders' views on the strengths and limitations of how Internet privacy currently is overseen and how, if it all, this approach could be enhanced. GAO evaluated FTC and FCC Internet privacy enforcement actions and authorities and interviewed representatives from industry, consumer advocacy groups, and academia; FTC and FCC staff; former FTC and FCC commissioners; and officials from other federal oversight agencies. Industry stakeholders were selected to represent different sectors, and academics were selected because of their expertise in privacy, consumer protection, and regulatory issues. The United States does not have a comprehensive Internet privacy law governing the collection, use, and sale or other disclosure of consumers' personal information. At the federal level, the Federal Trade Commission (FTC) currently has the lead in overseeing Internet privacy, using its statutory authority under the FTC Act to protect consumers from unfair and deceptive trade practices. However, to date FTC has not issued regulations for Internet privacy other than those protecting financial privacy and the Internet privacy of children, which were required by law. For FTC Act violations, FTC may promulgate regulations but is required to use procedures that differ from traditional notice-and-comment processes and that FTC staff said add time and complexity. In the last decade, FTC has filed 101 enforcement actions regarding Internet privacy; nearly all actions resulted in settlement agreements requiring action by the companies. In most of these cases, FTC did not levy civil penalties because it lacked such authority for those particular violations. The Federal Communications Commission (FCC) has had a limited role in overseeing Internet privacy. From 2015 to 2017, FCC asserted jurisdiction over the privacy practices of Internet service providers. In 2016, FCC promulgated privacy rules for Internet service providers that Congress later repealed. FTC resumed privacy oversight of Internet service providers in June 2018. Stakeholders GAO interviewed had varied views on the current Internet privacy enforcement approach and how it could be enhanced. Most Internet industry stakeholders said they favored FTC's current approach—direct enforcement of its unfair and deceptive practices statutory authority, rather than promulgating and enforcing regulations implementing that authority. These stakeholders said that the current approach allows for flexibility and that regulations could hinder innovation. Other stakeholders, including consumer advocates and most former FTC and FCC commissioners GAO interviewed, favored having FTC issue and enforce regulations. Some stakeholders said a new data-protection agency was needed to oversee consumer privacy. Stakeholders identified three main areas in which Internet privacy oversight could be enhanced: Statute . Some stakeholders told GAO that an overarching Internet privacy statute could enhance consumer protection by clearly articulating to consumers, industry, and agencies what behaviors are prohibited. Rulemaking . Some stakeholders said that regulations can provide clarity, enforcement fairness, and flexibility. Officials from two other consumer protection agencies said their rulemaking authority assists in their oversight efforts and works together with enforcement actions. Civil penalty authority. Some stakeholders said FTC's Internet privacy enforcement could be more effective with authority to levy civil penalties for first-time violations of the FTC Act. Comprehensive Internet privacy legislation that establishes specific standards and includes traditional notice-and-comment rulemaking and broader civil penalty authority could enhance the federal government's ability to protect consumer privacy. Congress should consider developing comprehensive legislation on Internet privacy that would enhance consumer protections and provide flexibility to address a rapidly evolving Internet environment. Issues that should be considered include what authorities agencies should have in order to oversee Internet privacy, including appropriate rulemaking authority.