You are given two reports by the government agency.  

Report 1:
Federal and state Medicaid spending on long-term care continues to increase; for example it increased from $146 billion in 2013 to $158 billion in 2015. Individuals seeking long-term care generally need care that is, by definition, longer term in nature and more costly than other types of care. Spending on long-term care services provided in home and community settings, including assisted living facilities, exceeds the amount spent on institutional settings such as nursing homes. State Medicaid programs may cover certain medical and non-medical services that assisted living facilities provide; however, the Medicaid statute does not provide for coverage of room and board charges of an assisted living facility. In their federal-state partnership, both CMS and states play important roles in the oversight of Medicaid. CMS is responsible for oversight of state Medicaid programs. To conduct this oversight, CMS issues program requirements in the form of regulations and guidance, approves changes states make to their programs, provides technical assistance to states, collects and reviews required information and data from states and, in some cases, reviews individual state programs. States are responsible for the day-to-day administration of their Medicaid programs, including monitoring and oversight of the different HCBS programs through which they cover assisted living services, within broad federal rules and requirements. Each state is required to identify and designate a single state agency to administer or supervise the administration of its Medicaid program. The state Medicaid agency may partially or fully delegate the administration and oversight of the state’s HCBS programs to another state agency or other entity, such as a state unit on aging, a mental health department, or other state departments or agencies with jurisdiction over a specific population or service. However, the state Medicaid agency is ultimately accountable to the federal government for compliance with the HCBS requirements. Under different authorizing provisions of federal law, states have considerable flexibility to establish multiple HCBS programs including those covering assisted living services. A state Medicaid program can have multiple HCBS programs operating under different federal authorities. CMS is responsible for ensuring that states meet the requirements associated with their HCBS programs under these different authorities. Key to states’ monitoring of the health and welfare of Medicaid beneficiaries is their tracking of, and response to, incidents that may cause harm to a beneficiary’s health or welfare, such as abuse, neglect, or exploitation—commonly referred to as critical incidents. Such monitoring is required for most HCBS programs; however, we previously found that requirements for states related to oversight of the health and welfare of beneficiaries in different types of HCBS programs varied, and recommended that CMS take steps to harmonize those requirements across programs. The most common HCBS programs with the most stringent federal requirements are HCBS waiver programs. These programs serve beneficiaries who are eligible for an institutional level of care; that is, beneficiaries must have needs that rise to the level of care usually provided in a nursing facility, hospital, or other institution. CMS oversees states’ HCBS waiver programs specifically by reviewing and approving applications and reviewing HCBS program reports that states submit. HCBS waiver program applications include specific requirements implementing various statutory and regulatory provisions. (See text box below.) One requirement is that states have the necessary safeguards in place to protect the health and welfare of beneficiaries receiving services covered by HCBS waiver programs. For each of their HCBS waiver programs, states must demonstrate to CMS that they are meeting various requirements CMS has established regarding beneficiary health and welfare. The Six Requirements States Must Demonstrate for Home- and Community-Based Services Waiver Programs 1. Administrative authority: The Medicaid agency retains ultimate administrative authority and responsibility for the operation of the waiver program by exercising oversight of the performance of waiver functions by other state and local/regional non-state agencies (if appropriate) and contracted entities. 2. Level of care: The state demonstrates that it implements the processes and instrument(s) specified in its approved waiver for evaluating/re-evaluating an applicant’s/waiver participant’s level of care consistent with care provided in a hospital, nursing facility, or intermediate care facility. 3. Qualified providers: The state demonstrates that it has designed and implemented an adequate system for assuring that all waiver services are provided by qualified providers. 4. Service plan: The state demonstrates it has designed and implemented an effective system for reviewing the adequacy of service plans for the waiver participants. 5. Health and welfare: The state demonstrates it has designed and implemented an effective system for assuring waiver participant health and welfare. 6. Financial accountability: The state must demonstrate that it has designed and implemented an adequate system for insuring financial accountability of the waiver program. CMS also provides ongoing oversight of state HCBS programs through annual reports that states must submit for each of their HCBS waiver programs as well as renewal reports submitted about two years before an HCBS waiver is scheduled to end. The state reports are intended to provide CMS with information on the operation of state HCBS waiver programs. In contrast to long-term care services provided in nursing facilities, less is known at the federal level about the oversight and quality of care in assisted living facilities. Generally, states establish their own licensing and oversight requirements for assisted living facilities. As a result, the requirements for assisted living facilities and the type and frequency of oversight can vary across states. In contrast, nursing homes must meet a comprehensive set of federal requirements in order to receive payment for long-term care services for Medicaid and Medicare beneficiaries in addition to state requirements. CMS contracts with state entities to regularly inspect nursing facilities and investigate complaints to assess whether nursing homes meet these federal quality requirements. Annually CMS publishes a comprehensive report on nursing homes that serve Medicaid and Medicare beneficiaries, including the extent that beneficiaries are at risk for harm, based on these investigations and inspections. In addition, CMS publicly reports a summary of each nursing home’s quality data using a five-star quality rating based on health inspection results, staffing data, and quality measure data. The goal of this rating system is to help consumers make meaningful distinctions among high- and low-performing nursing homes. This type of standardized framework for oversight, investigation and inspections, and reporting on quality of care concerns does not exist for assisted living facilities and other types of HCBS providers. Forty-eight state Medicaid agencies reported collectively spending about $10 billion in state and federal Medicaid funds for assisted living services in 2014, according to our survey. The other 3 states reported that they did not pay for assisted living services. We estimate that this spending for services provided by assisted living facilities represents 12.4 percent of the $80.6 billion Medicaid spent on HCBS in all settings that year. More than 330,000 Medicaid beneficiaries received assisted living services, based on data reported to us by the 48 states. Nationally, the average spending per beneficiary on assisted living services in the 48 states in 2014 was about $30,000; states provided these HCBS services through fee-for-service and managed care delivery models. Fee-for-service spending comprised 81 percent of total spending on assisted living services and managed care spending was about 19 percent of the total. The cost per beneficiary reported by surveyed states also varied based on payment type; average per beneficiary cost was $31,000 for fee-for-service and $27,000 for managed care. About 21 percent of Medicaid assisted living enrollment was for beneficiaries receiving these services under a managed care delivery model. (See table 1.) Average per-beneficiary spending varied significantly across the states. For example, for the nine states with the lowest spending per beneficiary, average Medicaid spending ranged from about $1,700 to about $9,500 per beneficiary. In contrast, in the nine states with the highest per- beneficiary spending, the average spending ranged from about $43,000 to $108,000 per beneficiary. (See Figure 1.) For more information on each state’s enrollment, total spending, and average per beneficiary spending on assisted living services, see appendix I. The 48 states that reported covering assisted living services in 2014 said they did so through 132 different programs. The majority of the states, 31 of the 48, reported administering more than one program that covered assisted living services. As illustrated in table 2 below, of the different types of HCBS programs under which states can provide coverage for assisted living services, HCBS waivers were the most common type of program they used. Specifically, 39 states and 69 percent of the programs that provided assisted living services, were operated under the HCBS waiver program. (See appendix II for additional details on each state’s number of programs by program type and total number of HCBS programs that covered assisted living facility services in 2014.) Almost all of the 48 states that covered assisted living services did so for two groups of Medicaid beneficiaries eligible through their programs. In 45 of 48 states, aged beneficiaries received services provided by assisted living facilities. Similarly, in 43 of 48 states, physically disabled beneficiaries received services. (See Figure 2.) In 38 or more of the 48 states that covered assisted living services, six types of services were provided. For example, 45 states covered assistance with activities of daily living, such as bathing and dressing; 44 states covered medication administration; and 41 states covered coordination of meals. (See Figure 3.) State Medicaid agency approaches for oversight of assisted living services varied widely in terms of who provided the oversight for their largest programs, according to their responses to our survey. Thirteen of the 48 state Medicaid agencies reported delegating administrative responsibilities, including oversight of beneficiary health and welfare, to other state or local agencies. State Medicaid agencies may delegate the administration of programs to government or other agencies through a written agreement; however, state Medicaid agencies retain the ultimate oversight responsibility for those delegated functions. For example, among the 13 states that delegated HCBS program administration, the administering agencies were those that provided services to the aged, disabled, or both of these populations, such as the states’ Departments of Aging. (See text box, below, for examples of states’ delegation.) Examples of State Medicaid Agencies’ Delegation of Authority for Administration of Home- and Community-based Services’ Programs Covering Assisted Living Services Georgia’s Elderly & Disabled Waiver Program was operated in 2014 by the Georgia Department of Human Services Division of Aging Services, a separate agency of the state that was not a division/unit of the Medicaid agency. The Georgia Medicaid Agency maintained a formal interagency agreement with the Division of Aging Services which describes by function the required deliverables to support compliance and a schedule for delivery of reports. Nebraska’s Waiver for Aged and Adults and Children with Disabilities is operated by the state Medicaid agency Division of Medicaid and Long Term Care. The majority of services are provided by independent contractors in order to allow service delivery in the rural and frontier areas of the state. The state Medicaid agency contracts with the Area Agencies on Aging, Independent Living Centers, and Early Development Network agencies to perform a variety of operational and administrative functions including authorizing services and monitoring the delivery of services. States also varied in the types of information they reported reviewing as part of the oversight of assisted living services, and the extent to which state Medicaid agencies review the information when another agency is responsible for administration. For example, other entities outside the state Medicaid agency—such as the agency delegated to administer an HCBS program, or a contractor that manages provider enrollment—may check to ensure a provider is allowed to deliver services to Medicaid beneficiaries; in such cases, however, the state Medicaid agency might not be aware of the results of such checks. As illustrated in table 3, in all 48 states the types of information generally reviewed by either the state Medicaid agency, the agency delegated administrative responsibilities, or other agencies were: critical incident reports, the HHS Office of Inspector General’s list of excluded providers, patient service plans, and information on concerns about care received directly from patients, relatives, caregivers or the assisted living facility itself. In many cases, the state Medicaid agency did not review all information sources reviewed by other agencies. For example, although all critical incident reports were reviewed in the 48 states by either the state Medicaid agency, the agency delegated administrative responsibilities, or another agency; in 16 of those states, the state Medicaid agency was not involved in those reviews, according to responses to our survey. Instead, the critical incident reports were reviewed by another entity designated responsible for the HCBS program in the state or another state entity with regulatory responsibility over the assisted living facility. Such reviews, including any critical incidents found, may not have been communicated back to the state Medicaid agency, according to responses to our survey. State Medicaid agencies also varied in reporting the extent to which they were made aware or notified when enforcement actions were taken as a result of concerns with beneficiary care identified by other entities. Various oversight actions may be taken by the state Medicaid agency, the agency delegated to administer an HCBS program, or a state regulatory agency, such as a state agency responsible for licensing and inspecting various types of HCBS providers. When delegated agencies or other licensing agencies take corrective action, the state Medicaid agency may not be aware unless notified by the agencies taking that action. For example, in 23 states, the investigation of potential incidents related to beneficiary health and welfare was delegated to another agency but in only 6 of these states was the state Medicaid agency always notified of such an investigation based on our survey. (See table 4 and text box below.) Example of a Collaborative Approach to Monitoring and Ensuring Quality Care Specifically for Assisted Living Facilities In 2009, the Wisconsin Coalition for Collaborative Excellence in Assisted Living was formed to redesign the way quality is ensured and improved for individuals residing in assisted living communities. This public/private coalition utilizes a collective impact model approach that brings together the state, the industry, the consumer, and academia to identify and implement agreed upon approaches designed to improve the outcomes of individuals living in Wisconsin assisted living communities. The core of the coalition is the implementation of an association developed, department approved, comprehensive quality assurance, quality improvement program. For their largest HCBS programs that covered assisted living services, the 48 states varied in how they monitored “critical incidents” that caused actual or potential harm to Medicaid beneficiaries in assisted living facilities. Specifically, the 48 states varied in their ability to report the number of critical incidents; how they defined incidents, and the extent to which they made information on such incidents readily available to the public. These states varied in whether they could provide us the number of critical incidents involving beneficiaries for their largest programs covering assisted living services, and for those that could report, the number of incidents they reported varied widely. In 26 of the 48 states the Medicaid agencies were unable to report, for their largest program covering assisted living services, the number of critical incidents that had occurred in assisted living facilities in 2014. The remaining 22 states reported a total of 22,921 critical incidents involving Medicaid beneficiaries in their largest programs covering assisted living services. The number of critical incidents reported in these states ranged from 1 to 8,900. For six of these states the number of critical incidents reported was more than 1,000, (See text box, below, for examples of selected state processes managing critical incidents.) Selected States’ Processes for Managing Beneficiary Harm or Potential Harm in Assisted Living Facilities Georgia: According to state officials in 2014 there was no centralized or comprehensive system for capturing and tracking the data on actual and potential violations. State officials acknowledged the lack of a centralized system prevents the Division of Community Health from tracking the status of each problem. Nebraska: According to state officials, Nebraska’s Adult Protective Services operates an electronic system that coordinates across state social service programs. When Adult Protective Services initiates an investigation of reported harm to an assisted living resident, the state Medicaid agency is automatically notified. Reasons state Medicaid agencies reported for being unable to provide us with the number of critical incidents included limitations in the data or data systems for tracking them. Nine states reported an inability to track incidents by provider type, and thus distinguish critical incidents in assisted living facilities from other providers of home and community based services. States also cited lacking a system to collect critical incidents (9 states), and that the system for reporting could not identify whether a resident was a Medicaid beneficiary (5 states). Even in the 32 states where the state Medicaid agencies reported reviewing information about critical incidents, 20 states were unable to provide the actual number of critical incidents that occurred in assisted living facilities. State Medicaid agencies’ definitions of critical incidents also varied. As illustrated in Figure 4, all 48 states cited physical assault, emotional abuse, and sexual assault or abuse as a critical incident in their largest programs providing assisted living services in 2014. However, for other types of incidents, several states did not identify the incident as critical, including discharge and eviction from the facility (not a critical incident in 24 states), medication errors (not a critical incident in 7 states), and unauthorized use of seclusion, (not a critical incident in 6 states). For other serious incidents, a relatively small number of states did not identify the incident as critical, such as unexplained death (not a critical incident in 3 states) and missing beneficiaries (not a critical incident in 2 states). See appendix IV for a full list of the beneficiary-related incidents and the number of states that identify each as critical. Although half of the 48 states that cover assisted living services did not consider discharges or evictions to be critical incidents, according to state responses to our survey, 42 states offered certain protections related to involuntary discharge of Medicaid residents who live in assisted living facilities. The majority of protections consisted of a lease agreement requirement that applied to other housing contracts in the state, such as providing residents with eviction notices. Other protections included an appeals process (10 states) and a requirement for the facility to find an alternative location for the resident (10 states). State Medicaid agencies also varied in whether they made information on critical incidents and other key information readily available to the public. (See table 5.) Beneficiaries seeking care in an assisted living facility may want to know the number of critical incidents related to a particular facility. Through our survey we found that states differed in the availability of information related to health and welfare that was available to the public. For example, 34 of the 48 states reported that they made critical incident information available to the public by phone, website, or in person, and the remaining 14 states did not have such information available at all. Although all 48 states had information in some form on which assisted facilities accepted Medicaid beneficiaries, 8 states could not provide this information by phone and 22 states could not provide the information in person. In recent years, CMS has taken steps to improve oversight of beneficiary health and welfare in HCBS programs by adding new HCBS waiver application requirements for state monitoring of beneficiary health and welfare. CMS requires state waiver applications to include specific requirements that implement various statutory and regulatory provisions, including a provision that states assure that they will safeguard the health and welfare of Medicaid beneficiaries. In March 2014, CMS added unexplained death to the events that states must be able to identify and address on an ongoing basis, as part of their efforts to prevent instances of abuse, neglect, and exploitation, and added four new requirements for states to protect beneficiary health and welfare. (See table 6.) In its guidance implementing the 2014 requirements, CMS noted that state associations and state representatives’ work groups had agreed that “health and welfare is one of the most important assurances to track, and requires more extensive tracking to benefit the individuals receiving services, for instance by using data to prevent future incidents.” As a condition for approval of their HCBS waiver applications for each of the requirements, states must identify and agree with CMS on the type of information they will collect to provide as evidence that they will meet the requirements. However, according to CMS officials, each state Medicaid agency has wide discretion over the information it will collect and report to demonstrate that it is meeting the health and welfare requirements and protecting beneficiaries. Although CMS added the additional requirements in 2014 for safeguarding beneficiary health and welfare, the agency generally did not change requirements for how it oversees state monitoring efforts once HCBS waivers are approved. We found a number of limitations in CMS’s oversight of approved HCBS waivers that undermine the agency’s ability to effectively monitor state oversight of HCBS waivers. These limitations include: unclear guidance on what states should identify and report annually related to any identified program deficiencies; lack of requirements on states to regularly provide CMS information on critical incidents; and CMS’s inconsistent enforcement of the requirement that states submit annual reports. Unclear guidance on what states should identify and report annually related to any identified program deficiencies. Federal law requires states to provide CMS with information annually on an HCBS waiver’s impact on (1) the type and amount, and cost of services provided and (2) the health and welfare of Medicaid beneficiaries receiving waiver services. CMS reporting requirements give states latitude to determine what to report as health and welfare deficiencies found through state monitoring of their HCBS programs. With respect to health and welfare, CMS’s State Medicaid Manual directs states when preparing their annual reports to “check the appropriate boxes regarding the impact of the waiver on the health and welfare” of beneficiaries and to describe relevant information. States are required to provide a brief description of the state process for monitoring beneficiary safeguards, use check boxes to indicate that beneficiary health and welfare safeguards have been met, and identify whether deficiencies were detected during the monitoring process. If states determine that deficiencies were identified through monitoring, states are required to “provide a summary of the significant areas where deficiencies were detected” and an explanation of the actions taken to address deficiencies and ensure the deficiencies do not recur. CMS’s written instructions for completing the HCBS annual report do not provide further guidance regarding reporting of deficiencies. For example, the reporting instructions do not describe or identify 1) what states are supposed to report as deficiencies, 2) how they are to identify which deficiencies are most significant, and 3) the extent to which states need to explain the steps taken to ensure that deficiencies do not recur. The lack of clarity is inconsistent with federal internal control standards, in particular, the need for federal agencies to have processes that identify information needed to achieve objectives and address risk. Without clear instructions as to what states must report, states’ annual reports may not identify deficiencies with states’ HCBS waiver programs that may affect the health and welfare of beneficiaries. States may determine that issues or problems they identified through monitoring do not represent reportable deficiencies and therefore may not report those deficiencies to CMS, increasing the risk that problems are not elevated to CMS’s attention. In the case of one of the selected states we reviewed, no problems were included on the annual reports submitted to CMS between 2011 and 2015. However, when CMS completed its review in the fourth year of the state’s waiver— for purpose of renewing the waiver—it determined the state was not assuring beneficiary health and welfare. CMS found that the information the state submitted for purpose of renewal suggested a “pervasive failure” by the state to assure the health and welfare of beneficiaries receiving services, including assisted living services. In particular, CMS noted the state provided insufficient information regarding the number of unexpected or suspicious beneficiary deaths. CMS concluded that the state failed to demonstrate that it has effective systems and processes for ensuring the health and welfare of beneficiaries. Lack of requirements on states to annually provide CMS information on critical incidents. Despite the importance of state critical incident management and reporting systems to protecting the health and welfare of beneficiaries, CMS lacks written requirements that states provide information needed for the agency oversight of state monitoring of critical incidents. According to CMS, a critical element of effective state oversight is the operation of data systems that support the identification of trends and patterns in the occurrence of critical incidents to identify needed improvements. Such a system is also consistent with federal internal controls standards which specify, in particular, the need for federal agencies to have processes that identify information needed to achieve objectives and address risk. CMS requires states to operate a critical incident reporting system. On their waiver applications states must check a box indicating they operate a system and also describe their system—including who must report and when, and what must be reported. Despite this requirement for states to have critical incident reporting systems, CMS does not require states to report to CMS any data from these systems on critical incidents as part of their required annual reports. Specifically, states are not required to include, in their annual reports, the number of critical incidents reported or substantiated that involve Medicaid beneficiaries. As a result, CMS does not have a method to confirm what states describe about critical incident management systems, which is a required component of states’ waiver applications or to assess the capabilities of states’ systems. For example, CMS cannot confirm whether the state systems can report incidents by location or type of residential provider, such as assisted living facilities; the type and severity of critical incidents that occurred; and the number of incidents that involved Medicaid beneficiaries. Without annual critical incident reporting, CMS may be at risk of (1) not having adequate evidence that states are meeting CMS requirements to have an effective critical incident management and reporting system and of (2) being unaware of problems with states’ abilities to identify, track, and address critical incidents involving Medicaid beneficiaries. Our prior work has shown that the lack of explicit reporting requirements on critical incidents not only impacts HCBS waiver programs but also impacts other types of Medicaid long-term services programs as well. Specifically, In a November 2016 report, we found that CMS requirements for states to report on their critical incident monitoring systems for the HCBS waiver program were more stringent than those for other types of HCBS programs, potentially leaving those other programs at even greater risk. We recommended that CMS take steps to harmonize requirements across different types of HCBS programs. HHS concurred with the recommendation stating it would seek input from states, stakeholders, and the public regarding harmonizing requirements across programs. In an August 2017 report we found similar issues in critical incident reporting requirements for other types of long term services programs, particularly those used to provide HCBS and other long term services under managed care. We found that CMS was not always requiring states that contracted with managed care organizations to provide long term services and supports to report to CMS sufficient information on critical incidents and other key areas needed to monitor beneficiary access and quality. We recommended that CMS take steps to identify and obtain key information needed to better oversee states’ efforts to monitor beneficiary access to quality services in their managed long-term services and supports programs. HHS concurred with this recommendation and stated that the agency would take this recommendation into account as part of an ongoing review of its 2016 Medicaid managed care rule. We continue to believe that the implementation of our prior recommendations is needed to help improve CMS oversight of states monitoring of beneficiary safety. CMS’s inconsistent enforcement of the requirement that states submit annual reports. States must prepare and submit an annual report for each HCBS waiver as a condition of waiver approval. According to CMS guidance, the agency’s review of the annual report is part of the ongoing oversight of HCBS waiver programs and not submitting an annual report jeopardizes the states renewal of HCBS waiver programs. However, some states have not been timely in submitting the required annual reports for their HCBS waivers. A review of 2013 HCBS annual reports by a CMS contractor, published in 2016, found that annual reports were missing for 29 HCBS waivers and multiple years’ of annual reports were missing for 8 waivers. In 2014, CMS adopted new strategies to ensure compliance with HCBS waiver requirements, including the requirement that states submit annual reports on a timely basis. These strategies include withholding federal funding, placing a moratorium on enrollment in the waiver, or other actions the agency determines necessary. CMS officials reported that the agency had not used these new strategies with states that were delinquent in submitting their annual reports. Officials said they were in the process of reviewing how to implement these new strategies in the case of one state; however, as of August 2017 officials had not finalized a decision. CMS’s ability to provide effective oversight of state programs and protect beneficiary health and welfare is undermined by the lack of enforcement and receipt of required annual waiver reports. Effective state and federal oversight is necessary to ensure that the health and welfare of Medicaid beneficiaries receiving assisted living services are protected, especially given the particular vulnerability of many of these beneficiaries to abuse, neglect, or exploitation. CMS has taken steps to strengthen beneficiary health and welfare protections in states’ HCBS waiver programs, the most common type of program that covers assisted living services and one that serves the most vulnerable beneficiaries. In particular, CMS now has multiple requirements for states to safeguard beneficiaries’ health and welfare, including requirements to operate an effective critical incident management and reporting system to identify, investigate, and address incidents of beneficiary abuse, neglect, exploitation, and unexplained death. However, CMS’s ability to effectively monitor how well states are assuring beneficiary health and welfare is limited by gaps in state reporting to CMS. CMS has not provided clear guidance to states on what information to include in annual reports on deficiencies they identify. As a result, CMS lacks assurance that it is receiving consistent, complete, and relevant information on deficiencies that is needed to oversee beneficiary health and welfare. Lacking clear guidance on the reporting of deficiencies may result in a delayed recognition of problems that may affect beneficiary health and welfare. Further, for years, states have been required to check a box attesting that they operate a critical incident management system, but have not always been required to report information on incidents of potential or actual harm to beneficiaries. Given the increasing prevalence of assisted living facilities as a provider of services to Medicaid beneficiaries, it is unclear why more than half of states responding to our survey could not provide us information on the number of critical incidents that occurred in these facilities in their states. Reporting data from their critical incident systems, such as the number of incidents, the type and severity of the incidents, or the location or type of facility in which the incident occurred would provide evidence that an effective system is in place, provide information on the extent beneficiaries are subject to actual or potential harm, and allow for tracking trends over time. Finally, CMS has not ensured that all states submit annual reports on their HCBS waiver programs as required. Without improvements to state reporting, CMS cannot ensure states are meeting their commitments to protect the health and welfare of Medicaid beneficiaries receiving assisted living services, potentially jeopardizing their care. We are making the following three recommendations to CMS: The Administrator of CMS should provide guidance and clarify requirements regarding the monitoring and reporting of deficiencies that states using HCBS waivers are required to report on their annual reports. (Recommendation 1) The Administrator of CMS should establish standard Medicaid reporting requirements for all states to annually report key information on critical incidents, considering, at a minimum, the type of critical incidents involving Medicaid beneficiaries, and the type of residential facilities, including assisted living facilities, where critical incidents occurred. (Recommendation 2) The Administrator of CMS should ensure that all states submit annual reports for HCBS waivers on time as required. (Recommendation 3) We provided a draft of this report to HHS for review and comment. HHS provided written comments, which are reproduced in Appendix V. The department also provided technical comments, which we incorporated as appropriate. In its written comments, the department concurred with two of our three recommendations, specifically, that CMS will clarify requirements for state reporting of program deficiencies and ensure that all states submit required annual reports on time. HHS did not explicitly agree or disagree with our third recommendation to require all states to report information on critical incidents to CMS annually. The department noted it has established a workgroup to learn more about states’ health and welfare systems and that it will use the results of this workgroup to determine which additional reporting requirements would be beneficial. The workgroup’s review will continue through calendar year 2018. In technical comments, HHS indicated that after the workgroup’s review is complete it will consider annual reporting of critical incidents. We believe establishing the workgroup is a positive first step towards improving oversight and state reporting and encourage HHS to require annual reporting on critical incidents when developing additional reporting requirements. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Administrator of CMS, the Administrator of the Administration for Community Living, appropriate congressional committees, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-7114 or at iritanik@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff that made key contributions to this report are listed in appendix VI. Our survey of state Medicaid agencies regarding coverage, spending, enrollment, and oversight of assisted living services in 2014, obtained information on challenges for Medicaid beneficiaries to access assisted living services in their states. States provided information related to factors that create challenges for Medicaid beneficiaries’ ability to access and receive assisted living services and the extent states had policies to help beneficiaries with the cost of room and board. A number of states in our survey cited common factors as creating the greatest challenges to a beneficiary’s ability to access assisted living services, including the number of assisted living facilities willing to accept Medicaid beneficiaries (13 states or 27 percent of the 48 states) program enrollment caps (9 states or 19 percent of the 48 states) beneficiaries’ inability to pay for assisted living facility room and board (9 states or 19 percent of the 48 states), which Medicaid typically does not cover low rates the state Medicaid program paid assisted living facilities (8 states or 17 percent of the 48 states). A number of states reported that they had policies to assist Medicaid beneficiaries with the costs of room and board charged by assisted living facilities, which Medicaid does not typically cover. Two common policies, cited by at least half of the states, were aimed at limiting how much assisted living facilities could charge Medicaid beneficiaries for room and board. For example, 30 of 48 states, limited the amount facilities could charge for room and board to the amount of income certain beneficiaries receive as Supplemental Security Income. The other commonly cited policies focused on providing financial assistance to the beneficiaries to defray the room and board costs. (See table 9.) In addition to the contact named above, Tim Bushfield and Christine Brudevold (Assistant Directors), Jennie Apter, Shirin Hormozi, Anne Hopewell, Kelsey Kreider, Perry Parsons, Vikki Porter, and Jennifer Whitworth made key contributions to this report.

 

 Report 2:
In the United States, both FRA and FTA regulate rail transportation safety. FRA oversees safety of railroads operating on what is known as the general system, a network of standard gage track over which goods may be transported and passengers may travel. This system includes freight railroads, which typically own their own tracks and locomotives, transporting products among states and regions. FRA also oversees safety of intercity passenger and commuter railroads that operate over tracks owned by freight railroads and other entities. FTA oversees safety of rail transit systems that typically serve individual metropolitan areas, using track not shared with freight and other passenger trains. Rail transit includes a variety of modes, such as heavy and light rail, streetcars, automated guideways, cable cars, and others. Rail transit is an important component of the nation’s transportation network, particularly in large metropolitan areas. Rail transit systems provided over 4.4 billion passenger trips in 2016. “Heavy rail” systems in large cities account for much of the total rail transit activity, including 88 percent of passenger trips in 2016. According to FTA, 61 rail transit systems within 28 states, the District of Columbia, and Puerto Rico are subject to safety oversight by one of the 31 agencies in FTA’s state safety oversight program (see fig. 1). The states have long played a central role in conducting safety oversight of rail transit systems. The Intermodal Surface Transportation Efficiency Act of 1991 required, among other things, that states with rail transit operators designate an agency to oversee the safety of those systems, known as a state safety oversight agency. In overseeing state safety agencies, FTA designed the program as one in which FTA, states, and rail transit operators collaborate to ensure the safety and security of rail transit systems. However, limitations have been identified in the state safety oversight program. In 2006, we reported on some state safety agency challenges in overseeing rail transit safety. Specifically, we found many of the state safety agencies lacked enough qualified staff and adequate levels of training to meet their responsibilities. In a 2009 hearing before the Subcommittee on Highways and Transit of the House Committee on Transportation and Infrastructure, then Secretary Ray LaHood of the Department of Transportation discussed some of the weaknesses under the current state safety oversight program and introduced a public transportation safety legislative proposal. In 2010, various bills were introduced in both houses of Congress that would have provided FTA with various enforcement mechanisms and with the authority to issue safety regulations. Additionally, the bills would have required the Secretary to establish a federal certification program for employees and contractors who carry out a state public transportation safety program. In the 112th Congress, the Senate amended a House bill to include a public transportation safety provision, which eventually became section 20021 of MAP-21, the federal public transportation safety program. MAP-21 enhanced FTA’s authority to oversee the safety of rail transit, potentially addressing some of the weaknesses identified by various stakeholders. Specifically, MAP-21 established a comprehensive Public Transportation Safety Program, which continues to rely on state safety agencies to monitor rail transit systems’ safety operations. MAP-21 required that, within 3 years of the effective date of a final state safety oversight program rule, each eligible state have in place a state safety oversight program certified by FTA. An eligible state must, among other things, establish a state safety agency and determine, in consultation with FTA, an appropriate staffing level for this state agency that is commensurate with the number, size, and complexity of the rail transit systems within the state. Additionally, a state safety agency must be financially and legally independent from any rail transit system it oversees and have investigative and enforcement authority with respect to the safety for its rail transit systems, among other things. Each eligible state has until April 15, 2019, to receive FTA approval of its state safety oversight program, or else FTA will be prohibited from obligating certain federal financial assistance to any entity in the state that is otherwise eligible to receive that federal financial assistance. After that approval, state safety agencies will be evaluated for continued compliance with FTA regulations a minimum of once every 3 years through a triennial review process. According to FTA, these requirements represent a dramatic increase in federal expectations for state safety oversight and for the rail transit industry. MAP-21 also established a state safety oversight grant program, offering federal funding to states for their state safety activities. FTA’s Office of Transit Safety and Oversight administers the state safety oversight program. Freight and passenger railroads have played a transformational role in the development of America and continue to be an important part of the economy. The general railroad system consists of a vast network of operations (see fig. 2). The $60 billion freight rail industry is operated by seven Class I, and hundreds of smaller, railroads. In addition, about 40 railroads move passengers, which carry greater than 670 million passengers per year. The federal government has long provided regulatory oversight of railroad safety, both passenger and freight, that operate on the general system. The Interstate Commerce Commission, the first federal regulatory commission in U.S. history, was established in 1887 to regulate interstate commerce by rail. The Commission’s safety functions were transferred to FRA, which was created by the Department of Transportation Act in 1966. In its role as federal regulator and overseer of railroad safety, FRA prescribes and enforces railroad safety regulations and conducts research and development in support of improved railroad safety and rail transportation policy. FRA utilizes safety inspectors and specialists, primarily covering five safety disciplines, to review and enforce compliance with these regulations. FRA’s safety disciplines are track, signal, and train control; motive power and equipment; operating practices; and hazardous materials. Following several fatal rail accidents between 2002 and 2008, the Rail Safety Improvement Act of 2008 was enacted, the first authorization of FRA’s safety programs since 1994. This act directed FRA to, among other things, issue new safety regulations for different aspects of railroad safety, such as hours of service requirements for passenger railroad workers, positive train control implementation, track inspection rules, and safety at highway-rail grade crossings. FRA’s Office of Railroad Safety administers the agency’s safety program. Rail transportation is a relatively safe way to transport people and products though serious incidents continue to occur on railroads and rail transit. According to an analysis of DOT’s Bureau of Transportation Statistics data by the American Public Transportation Association, travel by rail transit is far safer than automobile travel. From 2000-2014, for instance, there were 6.53 and 0.33 fatalities per billion passenger-miles traveled in cars or light trucks and rail transit, respectively. Within rail travel, the fatality rates on both railroads and rail transit operators have remained similar in recent years. Further, the rate of accidents and incidents—including collisions and derailments—also do not appear to differ substantially between railroads and rail transit in recent years. Nevertheless, serious incidents continue to occur on railroads and rail transit, posing safety risks to passengers, railroad employees, and the public. For example, in June 2009, two WMATA trains collided, resulting in 52 injuries and 9 deaths. A smoke incident on WMATA’s Metrorail system in January 2015 also resulted in the death of 1 person and injured over 90. In a 10-month period from May 2013 to March 2014, the Metro- North commuter railroad, which serves New York and Connecticut, was involved in five accidents that resulted in the death of 6 people and 126 injured. In June 2016, two BNSF Railway freight trains collided near Panhandle, Texas, resulting in the death of three crew members. Incidents such as these have prompted investigations into both the causes and contributing factors of the specific accidents as well as broader rail safety oversight. FRA has a more centralized safety oversight program for railroads, while FTA is implementing changes to the rail transit oversight program, established in federal statute, which relies on states to monitor and enforce safety. Key characteristics of both programs include: (1) the establishment of safety regulations, (2) inspections and other oversight activities, such as audits and investigations, based on those regulations, and (3) enforcement mechanisms to ensure that safety deficiencies are addressed (see fig. 3). FRA has developed extensive railroad safety regulations over decades. FRA’s railroad safety regulations include requirements governing track design and inspection, grade crossings, signal and train control, mechanical equipment including locomotives, and railroad-operating practices including worker protection rules. For example, FRA’s regulations for track and equipment include detailed, prescriptive minimum requirements, such as formulas that determine the maximum allowable speeds on curved track. Many of FRA’s rail safety regulations establish minimum safety requirements, though railroads can apply for waivers. As FRA updates its safety regulations, it has proposed more performance-based regulations in recent years. Many of FRA’s current safety regulations specify the behavior or manner of compliance that railroads must adopt, such as inspecting each locomotive at least every 92 days. Performance-based regulations, however, specify a desired outcome rather than a behavior or manner of compliance. For example, FRA’s recent rulemaking to amend its passenger equipment safety regulations proposes performance-based crashworthiness and occupant protection requirements, rather than explicit targets or tolerances. According to FRA, establishing performance requirements in these areas would allow a more open rail market that incorporates recent technologies. FTA is currently assessing the need for rail transit safety regulations, having been provided the authority to issue safety regulations in 2012. Since MAP-21 was enacted, FTA has finalized regulations implementing the public transportation safety program authorized by statute. These include regulations that establish rules for FTA’s administration of a comprehensive safety program to improve rail transit safety as well as updated regulations governing state safety oversight of rail transit. In addition to its public transportation safety program regulations, FTA also has regulations governing its drug and alcohol testing program. MAP-21 also authorized FTA, for the first time, to issue rail transit safety regulations, which would establish minimum safety performance requirements for rail transit operators, as part of its requirement to develop a National Public Transportation Safety Plan. FTA initiated a regulatory development effort after the passage of MAP-21, which included a compilation and evaluation of existing transit safety standards, guidance, and best practices from the federal government, states, industry, and other sources. After the evaluation, FTA issued a report that concluded there was limited documentation or evidence of the effectiveness of these existing rail transit safety standards. The report included recommendations that are intended to enable FTA to undertake further data-driven, risk-based analysis of rail transit safety performance and the applicability and effectiveness of the identified safety standards. FTA is also currently analyzing specific focus areas to determine any areas that should be addressed by federal safety regulations. For example, FTA is studying the need for regulations related to rail transit vehicle crashworthiness. Since no federal rail transit safety regulations that establish minimum safety performance requirements for rail transit operators currently exist, rail transit operators are subject to different safety standards, depending largely on what voluntary standards they have chosen to adopt, according to American Public Transportation Association officials we spoke with. The American Public Transportation Association, for instance, has issued a variety of rail transit safety standards, addressing various aspects of the industry including operations, training, and inspections. In addition, states vary in the extent to which they have regulations for rail transit operators. For example, officials from the California Public Utilities Commission noted that it has issued a variety of safety regulations applicable to rail transit operators within the state of California to improve safety of rail operations. Both FRA and FTA have mechanisms to gather the input of stakeholders—including rail operators, labor unions, industry associations, and others—when considering development of safety regulations. In developing most of its safety regulations, FRA seeks input from stakeholders through its Railroad Safety Advisory Committee. In 1996, FRA established this committee to develop new regulations through a collaborative process, with the rail community working together to create mutually satisfactory solutions to safety issues. FTA is collaborating with stakeholders as it assesses the need for rail transit safety regulations. More specifically, FTA’s research partner, the Center for Urban Transportation Research, established a working group to collaborate with industry stakeholders to inform the safety regulations development process. FTA also solicited comments from industry stakeholders on its compilation of existing rail transit safety standards. More broadly, FTA also has a Transit Advisory Committee for Safety, which provides information, advice, and recommendations to FTA on safety matters. FRA fulfills its mission, in part, through safety compliance audits and inspections, and investigations. FRA ensures compliance with its safety regulations through inspections, using a staff of railroad safety experts, inspectors, and other professionals assigned to eight regional offices across the nation. For example, to determine a railroad’s compliance with FRA safety regulations, inspectors examine track, equipment, signal devices, employee actions, and procedures and review maintenance and accident records. Additionally, 31 states have rail safety programs that partner with FRA. Under this approach, FRA enters into agreements with states to allow state inspectors to participate in investigative and surveillance activities concerning federal railroad safety laws. State inspectors who participate in this program submit inspection reports to FRA. More broadly, FRA’s inspections are guided by a risk-based model. Under this approach, FRA focuses its inspections on locations that, according to the data-driven model, are likely to have safety problems. Like other operating administrations within DOT, FRA has relatively few resources for overseeing railroads, compared with the size of the general system. The risk-based model is designed to help FRA target the greatest safety risks. FRA has begun utilizing automated inspections as well. In particular, according to FRA, new imaging technologies have the potential to better inspect track for cracks in the rail that could lead to breakage as well as measure the track’s geometry to ensure that rails are positioned to meet standards. To further promote safety in railroad operations, FRA conducts accident investigations. Separate from investigations conducted by NTSB, FRA investigates select railroad accidents to determine root causation, and any contributing factors, so that railroad properties can implement corrective actions to prevent similar incidents in the future. Resources for railroad safety oversight activities have increased in recent years. FRA was appropriated about $218 million in fiscal year 2017, an increase over the approximately $187 million it received in fiscal year 2015, for safety and operations, which funds FRA’s personnel, including inspectors, and safety programs. According to FRA, Congress provided FRA with increased funding in recent years for the purpose of increasing staffing related to specific safety issues, such as trespasser prevention and passenger rail safety. As part of this effort, FRA has hired additional inspectors, going from 347 inspectors in fiscal year 2013 to over 360 currently, out of the nearly 930 total full-time equivalent staff. FRA officials told us, as we have reported in the past, that it can be difficult to recruit, train, and certify qualified inspectors in a timely manner, especially in certain areas of expertise. Further, according to FRA, its inspectors have the ability to inspect less than 1 percent of the general system annually. Though FTA now has more robust inspection authorities, states will continue to conduct front-line rail transit safety oversight activities. MAP- 21 provided FTA with new authorities to inspect, audit, and investigate practices at rail transit agencies, including safety practices, while also preserving the role of state safety agencies to monitor rail transit systems’ safety operations. According to FTA officials, any federal inspections of rail transit operators are intended to supplement a state safety agency’s oversight activities, except where FTA assumes temporary, direct oversight of a rail transit system from an inadequate state safety agency. FTA officials told us that establishing a nationwide safety inspection program at the federal level is inconsistent with the statutory framework of the state safety oversight program and with congressional intent, which contemplates preserving the primary role of state safety agencies in providing direct safety oversight of rail transit systems. The officials also noted that the state-based approach to rail transit safety oversight is valuable because states are generally closer to, and more familiar with, rail transit operators. To date, FTA has utilized its new inspection authorities only on WMATA’s rail system. As part of oversight activities, some state safety agencies have conducted inspections of the rail transit systems they oversee, though they were not required to do so, according to FTA officials we spoke with. To strengthen states’ abilities to conduct oversight activities, FTA has recommended that state safety agencies develop risk-based inspection programs. Further, to ensure the independence of state safety agencies, these agencies cannot receive funding from the rail transit entities they oversee. Resources for FTA’s rail transit safety oversight administrative expenses have remained relatively stable in recent years, though more are needed, according to FTA. Since fiscal year 2012, FTA’s appropriations for administrative expenses, which funds FTA personnel and support activities including the Office of Transit Safety and Oversight, has increased $14 million, to about $113 million in fiscal year 2017, according to FTA. However, for several years, FTA has averaged about 508 total full-time equivalent staff agency-wide, and a little over 30 safety staff in the Office of Transit Safety and Oversight. According to FTA, the Office of Transit Safety and Oversight has been under-resourced since it was established in response to new safety authority provided in MAP-21. For fiscal year 2018, FTA requested in their submission for the President’s Budget proposal funding to hire up to an additional 20 positions for various lines of safety work. FRA’s and FTA’s oversight activities also include regular audits of, and communication with, the rail operators under their oversight. Given finite resources and large rail networks, FRA and FTA audit rail operators’ own inspections rather than conducting comprehensive federal inspections. More specifically, FRA inspectors, and state safety agencies in FTA’s oversight program, regularly examine records of rail operators’ internal inspections to identify safety deficiencies. Officials from FRA, FTA, and five rail stakeholders we spoke with told us that FRA and FTA rail safety oversight programs also rely on collaboration and communication between rail operators and regulators to ensure safety. For example, regular meetings between FRA and railroad staff to discuss safety trends and industry developments are important to ensuring safety, according to officials we spoke with from FRA and the railroads. FRA specialists and inspectors participate, with representatives of railroad labor and management, in the implementation of voluntary safety programs. For example, FRA sponsors the Confidential Close Call Reporting System, a voluntary, confidential program allowing railroads and their employees to report accident and incident “close calls.” According to FRA officials, voluntary programs such as this increase industry awareness of railroad safety and engagement with it. FTA also collaborates with state safety agencies as rail transit safety issues arise, according to FTA officials, using federal oversight and enforcement authorities as a “back-stop” against the oversight of state safety agencies. Additionally, according to officials we spoke with from FTA and two rail transit operators, state safety agency staff meet with rail transit operators regularly, using knowledge of local operating conditions to help ensure safety. FRA uses a variety of tools, including civil penalties, to resolve safety issues. While some safety issues are resolved informally through discussion and collaboration between FRA and railroads, as noted above, some defects identified during inspections are classified as violations and subject to financial penalties. More specifically, when railroads do not resolve issues in a timely manner or identified defects are serious, FRA has the authority to cite violations and assess civil penalties, against either railroads or individuals. Further, as authorized by law, FRA negotiates settlements with railroads and other entities subject to its safety jurisdiction to resolve claims for civil penalties. In fiscal year 2016, FRA assessed over $11.8 million in civil penalties against railroads. According to FRA, fiscal year 2016 was the second year in a row that it took steps to increase penalty amounts paid by railroads, as part of a continued effort to increase consequences for violations that negatively affect safety. To ensure the safety of rail transit systems, states will continue to be the primary enforcers of safety requirements, according to FTA officials, though FTA now has more enforcement tools. MAP-21 preserved the role of state safety agencies as the primary enforcement body for rail transit. FTA has now required that state safety agencies have enforcement authorities sufficient to compel action from rail transit entities to address safety deficiencies. Though no specific authorities are required, FTA has suggested that a variety of mechanisms could be appropriate, such as the ability to remove deficient equipment from service or assess fines. According to FTA, this requirement is designed to overcome a long- standing vulnerability in state safety oversight, which allowed safety deficiencies to remain for long periods of time. MAP-21 and the FAST Act also provided FTA with more options for enforcement when rail transit operators are found to be out of compliance with safety requirements. In particular, FTA can withhold federal funding for rail transit operators or direct a rail transit operator to use federal funding for a specific purpose. Additionally, after FTA assumes temporary direct oversight of an inadequate state safety agency, FTA can withhold federal funds from the state until the state safety oversight program has been certified. To date, FTA has utilized this authority only with the states responsible for safety oversight of WMATA’s rail system. In February 2017, FTA announced that it would withhold 5 percent of fiscal year 2017 urbanized area formula funds from Maryland, Virginia, and the District of Columbia until a new state safety oversight program is certified for WMATA’s rail system. This action built upon FTA’s determination that WMATA’s state safety agency was ineffective at “providing adequate oversight consistent with prevention of substantial risk of death or personal injury.” FRA and FTA also have the authority to directly intervene in rail operations. In particular, both FRA and FTA can suspend the service of rail operators in response to certain safety concerns. Additionally, FTA can assume direct safety oversight of a rail transit operator if FTA determines the state safety oversight program is not adequate, among other things. In response to safety incidents on WMATA’s rail system, FTA assumed temporary and direct safety oversight of WMATA in October 2015, as previously noted. FRA and FTA’s approaches to their rail safety oversight missions each have strengths and limitations, including how the agencies develop safety regulations, conduct inspections, and carry out enforcement. Compared to FRA’s long-standing role in providing safety oversight over railroads, FTA is in the process of implementing significant changes to its program for rail transit safety oversight after being granted new authorities in MAP- 21 and the FAST Act. With respect to regulations, FRA’s extensive and well-established safety regulations are a strength. FTA has made some progress toward developing appropriate safety regulations, such as identifying subjects for potential regulatory action. With respect to inspections, FRA’s use of a risk-based approach to distributing inspection resources is a strength. FTA has sought to address previously identified deficiencies in state safety oversight by recommending that state safety agencies develop risk-based inspection programs. FTA, though, has not provided states guidance for these efforts. With respect to enforcement, FRA’s use of its enforcement authorities is a strength. FTA is also implementing new statutory requirements that state safety agencies have enforcement authorities but does not have a process or methodology to evaluate the effectiveness of these enforcement practices. Extensive and well-established safety regulations are a strength of FRA’s safety oversight program based on studies we reviewed and discussions with rail operators and stakeholder organizations. According to NTSB, FRA’s railroad safety regulations are an important and effective part of its oversight program. Our previous work reported that according to stakeholders, the Railroad Safety Advisory Committee provides a collaborative environment where stakeholders in the rail community work with FRA to identify issues and proposals for safety standards and regulations that improved the quality of railroads’ safety initiatives and fostered a greater level of compliance with safety regulations. This is consistent with views of stakeholders we spoke with, who characterized FRA’s safety regulations as a strength. An industry association told us that FRA’s regulations promote safety by helping to ensure that no operator falls below a minimum threshold for safe operations, while a rail operator told us that federal regulations help to standardize the operating environment and prevent a patchwork of various state regulations. Four stakeholders also characterized the Railroad Safety Advisory Committee, which plays a large role in crafting FRA’s railroad safety regulations, as effective and inclusive. However, based on studies we reviewed and discussions with rail operators’ and stakeholders’ organizations, FRA faces limitations in its efforts to regulate safety across railroad systems that differ from one another and sometimes change more quickly than the federal regulatory process. Five railroad operators and an industry association told us that some of FRA’s safety regulations do not account for differences in railroads or innovation in safety practices, with three railroad operators stating that this approach requires the extensive use of waivers for particular regulations. Further, two railroad operators and a rail transit operator we spoke with stated that additional federal regulations are needed to provide minimum baseline requirements in specific areas of railroad safety such as medical fitness for duty. In 2014, NTSB also found that FRA needs to do more to regulate particular safety issues including medical fitness for duty and signal protection. FRA officials acknowledged that time and resources are two of the primary challenges that the agency faces when developing safety regulations but also noted additional ways in which the agency can require railroads to adopt safety practices. FRA officials described the process of creating or significantly amending a regulation as involving years of work, even before the agency commences with the process of drafting a rule. The officials also noted that the agency has additional tools to compel railroads to adopt safety practices. For example, FRA officials discussed the use of compliance agreements, in which railroads can have fines reduced in exchange for adopting safety measures that go beyond what FRA regulations require. FRA officials are considering the use of performance-based regulations as they update their safety regulations. As noted above, FRA’s proposed regulations regarding passenger equipment safety incorporates performance -based safety requirements, rather than explicit safety targets or tolerances. FRA has promulgated performance-based regulations about the implementation of positive train control, a communications-based system designed to prevent certain types of train accidents, as well as system safety programs that set general safety parameters and thresholds by which successful performance is governed. FRA’s consideration of performance-based regulations is in line with federal guidance. OMB’s Circular A-4 states that performance standards “are generally superior to engineering or design standards because performance standards give the regulated parties the flexibility to achieve regulatory objectives in the most cost-effective way.” Additionally, under Executive Order 12866, agencies should (to the extent permitted by law and where applicable) identify and assess alternative forms of regulation and specify performance objectives, rather than specifying the behavior or manner of compliance that regulated entities must adopt. However, as the language of OMB’s Circular A-4 and Executive Order 12866 suggest that performance-based regulations are not always feasible, studies of performance-based regulations find that as with any other form of regulation, performance-based standards have trade-offs. FRA officials told us that under certain circumstances, performance- based regulations are appropriate for issues regarding design, maintenance, operation, and technology-driven safety requirements. FRA officials we spoke with did not think performance-based standards are appropriate for areas that require standardization. One example is track safety standards, where the need for different operators to use the same equipment precludes a performance-based approach that allows railroads to meet requirements through different means. FRA officials added that a key aspect of the success of performance-based regulations concerns how railroads demonstrate compliance. This concern is consistent with other studies of performance-based regulations, which find that these regulations are most appropriate when regulators have capacity to measure and monitor performance. Though FTA has made progress assessing the state of rail transit safety standards, a limitation of FTA’s rail transit safety oversight program is the lack of federal rail transit safety regulations, which may contribute to inconsistent safety practices across the rail transit industry, according to studies we reviewed and discussions with rail operators and stakeholder organizations. NTSB reported that the structure of FTA’s oversight process leads to inconsistent practices, inadequate standards, and marginal effectiveness. In addition, a 2016 DOT OIG report found that because FTA’s safety standards are voluntary, they are unenforceable. In 2012, FTA gained the authority to issue safety regulations, though it has not done so yet, and NTSB and other stakeholders we spoke with indicated that the lack of such federal safety regulations is a weakness in federal rail transit safety oversight. Despite differences across rail transit systems, there is value in establishing federal rail transit safety regulations, according to stakeholders from all categories of those we interviewed, including a state safety agency, three rail transit operators, a railroad operator, and two industry associations. Some stakeholders identified specific areas that would benefit from federal rail transit regulations. For example, two rail transit agencies called for federal regulations to address operator fatigue. Some of these officials stated that federal rail transit safety regulations could help ensure safety by establishing clear and consistent minimum standards. Officials from a rail transit entity and an industry association stated that voluntary standards are not enough to ensure that transit entities will adopt appropriate safety measures. According to our analysis, a past study, and stakeholders we spoke with, FTA’s ability to develop and implement performance-based regulations is limited by its lack of capacity to collect and analyze rail safety performance data. In 2017, DOT OIG found that data limitations of FTA’s National Transit Database results in limited safety performance criteria in FTA’s National Public Transportation Safety Plan. Further, two rail transit entities as well as a state safety agency we spoke with stated that they face challenges in analyzing data due to either the size of their systems or their capacity. FTA officials told us that they need more data to inform their decisions regarding whether to establish rail transit safety regulations, and also added that a limitation to their ongoing assessment of potential areas for rail transit safety regulation is the concern about public disclosure of safety data provided to FTA and its potential use in private litigation. According to FTA officials, they need more information to do a comprehensive evaluation of efficacy of current safety standards and practices. As required by the FAST Act, FTA has entered into an agreement with the National Academies of Sciences, Engineering, and Medicine, to conduct a study to evaluate whether it is in the public interest to withhold from federal or state court proceedings any information collected by DOT through its public transportation safety program oversight activities. The National Academies of Sciences is expected to complete this study in 2018. FTA is taking positive steps toward developing safety regulations that may address inconsistent safety practices across rail transit operators. FTA officials stated that the agency is considering issuing rail transit safety regulations and also employs additional tools to compel rail transit entities to adopt safety measures. As noted above, FTA is currently studying whether federal regulations are appropriate for specific areas of rail transit safety. Executive Order 12866 and OMB’s Circular A-4 direct federal agencies to consider performance-based regulations when developing regulations. Further, as the Transportation Research Board recently reported, any decision to use performance-based regulations “must take into account the regulator’s own ability to enforce and motivate compliance (through methods such as auditing and field inspections) as well as the capacity of regulated entities to meet their obligations.” FTA officials noted that they are actively engaged with members of the Transportation Research Board in reviewing and discussing these recent findings related to safety regulations for high-hazards industries. In January 2017, FTA issued its National Public Transportation Safety Plan, which FTA officials noted is one component of their transit safety standard development program. According to FTA officials, the plan identifies a list of issue areas that the agency is currently studying to determine whether national regulations are needed. FTA officials also stated that the plan includes “voluntary standards,” which are intended to put the industry “on notice” that federal safety regulations may be proposed in those areas. FTA officials stated that they view the National Public Transportation Safety Plan as iterative and more easily updated compared with official regulations. Additional tools that FTA officials stated the agency employs in its approach to safety oversight include general directives as well as the requirements associated with FTA grants. Based on our assessment and studies we reviewed, a strength of FRA’s safety oversight program is its risk-based approach to distributing inspection resources, which may serve as an example for FTA and state safety agencies. According to NTSB, FRA’s qualified inspectors are a strength of its oversight program. To help target these inspectors to the areas of highest risk, FRA developed the National Inspection Plan, which includes a quantitative model for allocating inspection resources in a way that tries to minimize railroad accidents. This model utilizes data including: (1) accident and incident data that railroads are required to report, (2) data from FRA inspection activity, and (3) information on railroad activities such as train miles and other data. Based on our assessment of FRA’s model, we believe that it can be an appropriate and useful tool for directing its inspection resources based on risk because it relies on statistical methods commonly used to predict the risk of a violation for regulated entities. While we did not review FRA’s entire modeling process, nor did we validate the results it generates, we do believe that FRA’s approach to using these statistical models as a key part of its inspection program is appropriate. However, a potential limitation of FRA’s inspection program is the flexibility granted to individual inspectors and whether the manner and extent to which inspectors implement this discretion may be inconsistent with the risk-based National Inspection Plan. FRA’s National Inspection Plan provides guidance for inspectors about how much time they should spend inspecting individual railroads. According to FRA officials, FRA inspectors have considerable flexibility to deviate from the National Inspection Plan based on their judgment regarding where to more effectively use their resources. FRA officials stated that situations arise that call for deviations in planned inspections. For example, a particular railroad may experience a serious accident and therefore require more oversight from FRA. According to FRA officials, regional offices make these decisions based on their understanding of emerging issues. Inspectors are expected to know their region and decide which locations to go to, and are in part evaluated based on these decisions. When a region’s record of total inspection time spent on a particular railroad differs from the National Inspection Plan by more than 5 percent, the region’s leadership submits an explanation to FRA’s Office of Railroad Safety. This practice, if not monitored, could allow inspectors to deviate from the data-driven model results in ways that undermine the goal of the National Inspection Plan to deploy FRA’s limited resources efficiently and based on risk. However, FRA officials told us that flexibility for individual inspectors is important, and that FRA is continuously monitoring the model’s performance and making changes as appropriate. Further, OECD’s Best Practice Principles for Regulatory Policy note that it is important to ensure “that sufficient flexibility is left to enforcement and inspection officials to adapt their response in proportion to the facts on the ground.” A strength of FTA’s approach to rail transit safety oversight is that it is working to overcome weaknesses in state oversight of rail transit identified in our prior work and stakeholders we spoke with. For example, FTA has noted that in the past some state safety agencies lacked sufficient oversight authorities. To now be certified by FTA, state safety agencies must demonstrate that they have authority to review, approve and oversee the implementation of rail transit operator’s safety plans. Additionally, we have found, and FTA has also noted, that some state safety agencies would benefit from more training and additional staff. To now be certified by FTA, state safety agencies must be capable of directly hiring and developing staff and contract support, as well as have a training plan for certain staff. Though FTA is seeking to implement stronger safety oversight activities, a limitation of its program is that state safety agencies have not received the guidance and support necessary to develop effective inspection programs. FTA does not currently plan to conduct widespread inspections itself and recommends that state safety agencies develop risk-based inspection programs. According to FTA, states have discretion to establish their inspection programs in accordance with their program standards, and are not required to actually conduct inspections as the method of verifying rail transit operators’ compliance with safety rules. However, direct observation, audits, and performance indicator tracking are useful methods for an oversight agency in assessing a regulated entity’s safety culture. Officials we spoke with from selected state safety agencies say that they have received little guidance from FTA on what their risk-based inspection programs should look like. In the materials FTA provided to states, it said that it intends to provide guidance to states on risk-based inspections but did not provide us with a plan or timeline for doing so. Without guidance from FTA, state safety agencies may not develop effective risk-based inspection programs and thus not use their resources efficiently. Effective risk-based inspection programs are particularly important given state safety agencies’ limited resources. We have reported in the past that some state safety agencies lack sufficient resources, including training and staff. Officials from two rail transit operators and all four industry associations we spoke with stated that state safety agencies continue to have limited resources and capacity. Several state safety agencies we spoke with rely on contractors or employees with other responsibilities besides oversight of rail transit to meet their increased oversight responsibilities and achieve certification from FTA. Federal standards for internal control as well as leading practices for regulatory inspections state that agency objectives, including those related to inspections and enforcement, should be clearly communicated. Specifically, federal standards for internal control require that management communicate the necessary quality information to achieve the agency’s objectives. Additionally, the OECD’s Best Practice Principles for Regulatory Policy recommends that governments ensure clarity of rules and processes for enforcement and inspections and clearly articulate rights and obligations of officials. According to OECD, the frequency of inspections and the resources employed should be proportional to the level of risk. A strength of FRA’s safety oversight program is that the agency has and utilizes clear enforcement authority, according to NTSB and stakeholders we spoke with. As previously discussed, FRA has several enforcement tools available when inspectors find that railroads are noncompliant with applicable regulations, including civil penalties, individual liability, compliance orders, and emergency orders. According to NTSB, this array of specific enforcement tools helps ensure safety deficiencies are addressed by railroads. FRA officials also told us that the process of adjudicating civil penalties provides a forum for FRA and railroad officials to meet to discuss safety issues. Four rail operators also told us that FRA’s authority to issue civil penalties is necessary to ensure railroads’ compliance with regulations. However, a potential limitation of FRA’s approach to enforcement is that it is difficult to quantify the effectiveness of FRA’s civil penalties. FRA has reported that it cannot determine whether observable safety improvements are directly attributable to discrete civil penalties or whether the amount of civil penalties has any effect on safety. We have reported in the past about the challenges of determining the effect of penalties on compliance in tax policy, though we also noted that, despite these challenges, some analyses likely would be useful for better understanding the effect of penalties on compliance. FRA also reported, though, that according to the judgments of its inspectors, issuing civil penalties yields observable improvements in safety practices and compliance with the law. Further, according to FRA, though it does not quantify the impact of civil penalties, FRA monitors railroad responses to its enforcement activity and adjusts its oversight as necessary. More broadly, civil penalties are not meant, by themselves, to ensure railroad safety. Instead, FRA reported that it uses its entire regulatory regime as a whole to try and ensure safety. FRA officials also noted that the agency has additional tools, apart from civil penalties, to compel railroads to adopt safety practices. A strength of FTA’s rail transit safety oversight is that it seeks to improve historically weak state safety agency enforcement authorities, as described in our previous report as well stakeholders we spoke with. FTA requires state safety agencies to adopt enforcement authorities that are sufficient to enable states to compel action from rail transit agencies to address identified deficiencies. FTA has also communicated to states that it is focusing its evaluation of each state’s enforcement authorities in two major areas: ensuring that the state can carry out its primary responsibility for rail transit safety in response to (1) an imminent threat to public safety on the rail transit system and (2) a lack of action or non- compliance from the rail transit operator in carrying out certain safety plans. FTA has provided states with examples of the enforcement authorities and policies state safety agencies could establish to address these specific concerns. Authorities to address imminent safety threats may include the authority to suspend rail transit agencies’ operations, inspect and remove deficient equipment or system infrastructure from service, or issue an order requiring the rail transit agency to correct an unsafe condition prior to placing equipment or infrastructure back into passenger service. FTA has also provided state safety agencies with examples of authorities to address a lack of action or cooperation by the rail transit operator, including the authority to withhold or redirect funds, levy civil or criminal fines or penalties, and a formal citation or ticketing program. Though federal law requires that state safety agencies have enforcement authorities over the safety of the rail transit entities they oversee, a limitation of FTA’s approach is that FTA has not developed a method to evaluate the effectiveness of states’ enforcement practices. Certified state safety agencies will be evaluated for continued compliance with FTA regulations every 3 years. This triennial review process (for rail transit safety) seeks to ensure that states are effectively carrying out their responsibilities. While FTA officials told us that they will evaluate state safety agencies’ enforcement during the triennial reviews, FTA has not developed a process or methodology to evaluate whether state enforcement authorities and practices as a whole are effective. Without a method for determining the effectiveness of state safety agencies’ enforcement, FTA may not have the information needed to identify ineffective safety enforcement. As a result, deficiencies may remain for long periods of time, potentially contributing to safety incidents. Federal standards for internal control maintain that agency managers should perform a range of practices that would facilitate the establishment of a system to monitor the effectiveness of agency activities, which in the context of FTA’s mission includes the effectiveness of its rail transit safety oversight. Agency managers should define objectives clearly to enable the identification of risks, establish activities to monitor performance measures and indicators, and externally communicate the necessary quality information to achieve the entity’s objectives. Internal control standards further stipulate that agency managers should perform monitoring activities regarding their internal control system and evaluate the results. To do so, federal standards for internal control state that agency managers should monitor ongoing operations and effectiveness, evaluate the results of this monitoring, and identify any changes that need to be made to achieve improvement in agency operations. The effectiveness of state safety agency enforcement is especially important because questions have been raised about the efficacy of FTA’s own enforcement mechanisms, including its ability to withhold funds from and assume direct control over safety oversight for a rail transit entity. Rail transit operators and industry association representatives we spoke with stated that FTA’s authority to withhold funding from states is overly punitive, and two stakeholders said the FTA needs more precise tools. Officials from an industry association added that withholding funds can be counterproductive, as most state safety agencies are already underfunded and understaffed. FTA officials pointed to examples in which the agency successfully supported state safety agencies in compelling action from rail transit agencies as evidence that the state safety oversight model, in which FTA backs up state safety agencies, is effective. Additionally, officials from numerous state safety agencies and others questioned whether FTA has the capacity to effectively assume direct safety oversight of rail transit operators. FTA has not assumed direct safety oversight of any rail transit operators outside of WMATA, and FTA officials noted that they intend to continue supporting state safety agencies in their oversight wherever possible. The approaches to rail safety oversight utilized by FRA and FTA each have strengths and limitations. However, FTA’s program is currently in transition as the agency implements new authorities and responsibilities provided in federal law. Though FTA has made progress by evaluating existing rail transit safety standards and providing some guidance to states as part of the certification process, limitations in FTA’s approach may still hinder the success of the state-based rail transit safety oversight program. Given the looming 2019 deadline for state safety oversight programs to achieve FTA certification, FTA can improve its efforts to implement its new rail transit safety oversight program. In particular, without guidance from FTA on how to develop and carry out risk-based inspection programs, state safety agencies may not use limited resources efficiently, risking that important safety issues will go undetected. Further, without a method for how it will monitor the effectiveness of states safety agencies’ enforcement, FTA will lack the information needed to identify ineffective state enforcement, which risks allowing safety deficiencies to remain for long periods of time. By providing this additional guidance and direction to the state safety agencies, FTA would help ensure that states are able to effectively identify and resolve rail transit safety issues. We are making the following two recommendations to FTA: The Office of Transit Safety and Oversight should create a plan, with a timeline, for developing guidance for state safety agencies about how to develop and implement a risk-based inspection program. (Recommendation 1) The Office of Transit Safety and Oversight should develop and communicate a method for how it will monitor the effectiveness of the enforcement authorities and practices of state safety agencies. (Recommendation 2) We provided a draft copy of this report to DOT, NTSB, and WMATA for review and comment. In written comments, reproduced in appendix I, DOT agreed with both our recommendations. DOT also provided technical comments, which we incorporated as appropriate. In e-mails, NTSB and WMATA provided technical comments, which we incorporated as appropriate. NTSB noted that we do not discuss the role of system safety initiatives, such as safety management systems, in the FRA and FTA rail safety oversight programs. We agree with NTSB that system safety concepts are increasingly influencing the FRA and FTA approaches to rail safety oversight but, as NTSB also noted, both FRA and FTA lack finalized regulations codifying their approaches to system safety initiatives. Because the extent of rail entities’ implementation of these initiatives varies and is not complete we did not include an assessment of the strengths and limitations of those initiatives in our scope. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Transportation, Chairman of NTSB, General Manager of WMATA, and the appropriate congressional committees. In addition, the report will be available at no charge on GAO’s website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-2834 or goldsteinm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Individuals who made key contributions to this report are listed in appendix II. In addition to the contact named above, Steve Cohen (Assistant Director); Kyle Browning (Analyst in Charge); Melissa Bodeau; Lacey Coppage; Serena Lo; Sean Miskell; and Josh Ormond made key contributions to this report.

Question: Write a one-page summary of the report 1.

Answer: The number of individuals receiving long term care services from Medicaid in community residential settings is expected to grow. These settings, which include assisted living facilities, provide a range of services that allow aged and disabled beneficiaries, who might otherwise require nursing home care, to remain in the community. State Medicaid programs and CMS, the federal agency responsible for overseeing the state programs, share responsibility for ensuring that beneficiaries' health and welfare is protected. GAO was asked to examine state and federal oversight of assisted living services in Medicaid. This report (1) describes state spending on and coverage of these services, (2) describes how state Medicaid agencies oversee the health and welfare of beneficiaries in these settings, and (3) examines the extent that CMS oversees state Medicaid agency monitoring of assisted living services. GAO surveyed all state Medicaid agencies and interviewed officials in a nongeneralizeable sample of three states with varied oversight processes for their assisted living programs. GAO reviewed regulations and guidance, and interviewed CMS officials. State Medicaid agencies in 48 states that covered assisted living services reported spending more than $10 billion (federal and state) on assisted living services in 2014. These 48 states reported covering these services for more than 330,000 beneficiaries through more than 130 different programs. Most programs were operated under Medicaid waivers that allow states to target certain populations, limit enrollment, or restrict services to certain geographic areas. With respect to oversight of their largest assisted living programs, state Medicaid agencies reported varied approaches to overseeing beneficiary health and welfare, particularly in how they monitored critical incidents involving beneficiaries receiving assisted living services. State Medicaid agencies are required to protect beneficiary health and welfare and operate systems to monitor for critical incidents—cases of potential or actual harm to beneficiaries such as abuse, neglect, or exploitation. Twenty-six state Medicaid agencies could not report to GAO the number of critical incidents that occurred in assisted living facilities, citing reasons including the inability to track incidents by provider type (9 states), lack of a system to collect critical incidents (9 states), and lack of a system that could identify Medicaid beneficiaries (5 states). State Medicaid agencies varied in what types of critical incidents they monitored. All states identified physical, emotional, or sexual abuse as a critical incident. A number of states did not identify other incidents that may indicate potential harm or neglect such as medication errors (7 states) and unexplained death (3 states). State Medicaid agencies varied in whether they made information on critical incidents and other key information available to the public. Thirty-four states made critical incident information available to the public by phone, website, or in person, while another 14 states did not have such information available at all. Oversight of state monitoring of assisted living services by the Centers for Medicare & Medicaid Services (CMS), an agency within the Department of Health and Human Services (HHS), is limited by gaps in state reporting. States are required to annually report to CMS information on deficiencies affecting beneficiary health and welfare for the most common program used to provide assisted living services. However, states have latitude in what they consider a deficiency. States also must describe their systems for monitoring critical incidents, but CMS does not require states to annually report data from their systems. Under federal internal control standards, agencies should have processes to identify information needed to achieve objectives and address risk. Without clear guidance on reportable deficiencies and no requirement to report critical incidents, CMS may be unaware of problems. For example, CMS found, after an in-depth review in one selected state seeking to renew its program, that the state lacked an effective system for assuring beneficiary health and welfare, including reporting insufficient information on the number of unexpected or suspicious beneficiary deaths. The state had not reported any deficiencies in annual reports submitted to CMS in 5 prior years. GAO recommendations to CMS include clarifying state requirements for reporting program deficiencies and requiring annual reporting of critical incidents. HHS concurred with GAO's recommendations to clarify deficiency reporting and stated that it would consider annual reporting requirements for critical incidents after completing an ongoing review.