You are given two reports by the government agency.  

Report 1:
NAS is a withdrawal condition within infants that can result from the prenatal use of opioids by pregnant women. Prenatal opioid use occurs when a woman, during the course of her pregnancy, uses an opioid- based medication or substance. Prenatal opioid use can take various forms, including (1) the use of prescriptions for pain management, such as fentanyl and oxycodone; (2) medication-assisted treatment for opioid addiction, such as methadone and buprenorphine; (3) prescription drug misuse or use disorder (such as using an opioid without a prescription, using a different dosage than prescribed, or continuing to use an opioid when it is no longer needed for pain); and (4) illicit opioid use, such as heroin use. These types of prenatal opioid use are not mutually exclusive. A 2014 study found that almost 22 percent of pregnant Medicaid beneficiaries filled a prescription for an opioid during their pregnancy. Medication-assisted treatment—an approach that combines the use of certain medications and behavioral therapy—is generally considered by HHS and medical specialty societies to be the standard of care for treating pregnant women with opioid use disorders, depending on the individual and her circumstances. SAMHSA and several medical specialty societies, including the American College of Obstetricians and Gynecologists and the American Society of Addiction Medicine, have noted that providing medication-assisted treatment during pregnancy prevents complications associated with illicit opioid use, encourages prenatal care, and reduces the risk of obstetric complications. Further, women may use multiple substances in addition to opioids during pregnancy—known as maternal polysubstance use—such as tobacco, alcohol, or anti-depressants, among others. GAO reported in 2015 that the gaps in efforts to address prenatal opioid use and NAS most commonly cited by federal agency officials and experts were related to the treatment of prenatal opioid use and NAS. Agency officials and experts said that there has not been adequate research comparing different types of treatment approaches and that research is needed on how best to treat a pregnant woman with an opioid use disorder so that the treatment is most effective for the woman while offering minimal risk to the fetus. See GAO-15-203. For more information on factors that can affect access to medication- assisted treatment, see GAO, Opioid Addiction: Laws, Regulations, and Other Factors Can Affect Medication-Assisted Treatment Access, GAO-16-833 (Washington, D.C.: Sept. 2016). respiratory distress. There is currently no national standard of care for screening or treating NAS. There have been a few scoring tools developed to screen the infant to determine the appropriate course of treatment. Health care providers predominantly diagnose NAS using the Finnegan Neonatal Abstinence Scoring Tool, which calculates a score based on a variety of central nervous, metabolic, respiratory, and gastro-intestinal symptoms that might be observed. The American Academy of Pediatrics and the American College of Obstetricians and Gynecologists recommend that infants with NAS should not be initially treated with medication, known as pharmacologic treatment. Instead, these organizations recommend starting with non-pharmacologic treatment, which includes placing the infant in a dark and quiet environment, swaddling, breastfeeding, rooming-in with the mother, and providing high-calorie nutrition, among other things. For example, rooming-in—allowing the mother to reside with the infant during the infant’s treatment—may have benefits, such as helping to develop a bond between the mother and infant and to reduce the severity of the infant’s NAS symptoms. Pharmacologic treatment, such as using methadone or morphine, may be necessary only for the relief of moderate to severe signs of NAS. See figure 1 for more information on non-pharmacologic and pharmacologic treatment. HHS has published several guidance and educational resources related to NAS and prenatal opioid use. These documents serve as tools to help stakeholders, including state entities and health care providers, who work with this population. For example, SAMHSA published a clinical report for health care providers in 2016 that provides recommendations to help them when making decisions regarding the evaluation, care, and treatment of women with opioid use disorders and infants with NAS. As of July 2017, SAMHSA is in the process of producing a clinical guide based on this report and expects to publish an updated report later this year. In another example, SAMHSA published a guidance document in 2016 that aims to support the efforts of states, tribes, and local communities in addressing the needs of pregnant women with opioid use disorders and their infants. Among other things, the document includes strategies and guidance to promote care coordination among stakeholders, including child welfare agencies and medical professionals, when treating infants with NAS. (See app. II for a list of federal educational resources related to NAS and prenatal opioid use published by HHS.) As we previously noted, more than 80 percent of NAS cases are paid for by Medicaid, which is a federal-state health care program that finances health care coverage for low-income and medically needy populations, including children and aged or disabled adults. States administer their Medicaid programs within broad federal requirements and according to a state plan approved by CMS, the federal agency within HHS that oversees Medicaid. The Medicaid program allows states to design and implement their programs within certain federal parameters, resulting in more than 50 distinct state-based programs. For example, states generally determine the type and scope of services to cover, set payment rates that different health care providers will receive for various covered services, and pay these providers for claims submitted for services rendered. In addition, states vary in the extent to which they enroll beneficiaries in managed care versus delivering care through the more traditional fee-for-service model. Under a managed care delivery model, states typically contract with managed care plans to provide a specific set of Medicaid-covered services to beneficiaries and pay them a set amount per beneficiary—referred to as capitation payments—to provide those services. Under fee-for-service, Medicaid pays health care providers a fee for each service provided to a Medicaid beneficiary. Medicaid’s Early and Periodic Screening, Diagnostic, and Treatment benefit, which states are required to provide, covers comprehensive health screenings, preventive health services, and all medically necessary treatment and services—for Medicaid eligible-children under the age of 21—to correct or ameliorate health conditions discovered through screenings. According to the literature we reviewed, most infants with NAS in the United States are treated in a hospital setting, often in the neonatal intensive care unit (NICU), which has a relatively high daily cost of care. Stakeholders we interviewed told us that these infants may also be treated in other hospital settings. According to state and perinatal collaborative officials in the four selected states we reviewed, infants diagnosed with NAS begin—and most complete—treatment for the condition in various hospital settings which provide different levels of care: a well newborn nursery (level I), special care nursery (level II), or NICU (level III or IV). For example, according to these officials, most infants with NAS in Vermont are treated in well newborn nurseries, while most infants with NAS in Kentucky and Wisconsin are treated in NICUs. West Virginia perinatal collaborative officials told us that about a third of infants with NAS are treated in well newborn nurseries, while two-thirds receive treatment in either a special care nursery or NICU. According to perinatal collaborative officials and hospital providers in the four selected states, the severity of the infant’s NAS symptoms or the hospital’s capability to treat NAS can determine whether the infant receives care in a nursery or NICU. Health care providers in the four selected states described the general clinical approach for treating infants with NAS. According to these providers, they generally start with non-pharmacologic treatment—for example, swaddling or placing the infant in a quiet, dark room. Health care providers may continue to monitor and assess the severity of the infant’s NAS symptoms using one of the available scoring tools for NAS. If the infant’s symptoms meet or exceed a certain threshold, these providers may initiate pharmacologic treatment by administering morphine or methadone, for example. Some perinatal collaborative officials that we interviewed in the four selected states told us that not all hospitals may have the capability to provide pharmacologic treatment. For example, these officials told us that level I hospitals—hospitals with only well newborn nurseries—in Kentucky and Wisconsin may not provide pharmacologic treatment to infants with NAS because these hospitals may not have the staff expertise to administer the needed medication and monitor the infants who receive it. Instead, these hospitals may transfer infants with NAS who require pharmacologic treatment to hospitals with higher levels of care, such as those with a NICU. Table 1 provides information on the eight selected hospitals in our review that provide NAS services. According to a 2015 study we reviewed, nationwide, infants with NAS who require pharmacologic treatment generally have longer average hospital stays (23 days) compared with infants with NAS who do not require such medication (17 days). Health care providers from our selected hospitals also indicated a similar trend—the average length of hospital stay in calendar year 2016 for infants with NAS who received pharmacologic treatment ranged from 7 to 30 days, while the stays for infants who did not require such medication ranged from 3 to 7 days. Medicaid generally pays for NAS treatment services in our four selected states using a diagnosis-related group (DRG) based payment system, in which hospitals receive a fixed amount for a bundle of services. In general, the DRG-based system used in Medicaid pays for the medical services necessary for treating infants with NAS, such as medication, bed space, and nursing staff, according to CMS officials. CMS officials said that the DRG-based system generally does not pay for professional services, such as physician visits; instead, these services are typically paid under a fee-for-service payment schedule, in which states or contracted managed care plans pay health care providers directly for their services. Officials in our selected states said information on total Medicaid payments for hospital-based NAS services was not readily available. Several DRGs are typically used to bill Medicaid for services provided to infants. However, these codes alone cannot provide an accurate estimate of Medicaid payments for NAS treatment services because the codes are not used exclusively for NAS. For example, according to some health care providers we interviewed, two DRG codes that may be used to bill Medicaid and other payers for NAS treatment services are 791 (prematurity with major problems) and 793 (full term neonate with major problems). However, these codes could be used to bill for over 2,000 diagnoses—for example, pneumonia or measles. One state official said that while they could provide us with information on Medicaid payments for these infants, they could not parse out the costs by diagnosis codes, such as those related to NAS. Thus, estimates of total Medicaid payments based only on DRG codes likely overstate the amount paid for NAS hospital-based services. Officials from two of the four selected states told us that their state has a public health surveillance system that tracks the incidence of infants diagnosed with NAS; however, the surveillance systems do not capture financial information, including Medicaid payments for NAS. At our request, one of the states cross-referenced their surveillance and Medicaid data and estimated that in 2016, their state Medicaid program spent over $22 million to treat 1,565 infants with NAS. While selected states generally could not provide information on total Medicaid payments for infants with NAS, some hospitals in our selected states were able to generate this information at our request using diagnosis codes that they identified as related to NAS from hospital claims data. Six of our selected eight hospitals reported that in calendar year 2016, the average Medicaid payment for treating infants with NAS ranged from about $1,500 to about $20,200 per infant per stay. The wide range in Medicaid payment averages may be because the averages included both infants who did and did not require pharmacologic treatment and because these hospitals treated infants in various settings, such as a nursery or a NICU. The literature we reviewed also had limited information on Medicaid payments for NAS treatment services provided in hospitals. A recent study reported that from 2009 through 2012—the most recent data available at the time of the study—Medicaid payments to hospitals for NAS treatment services increased from about $564 million to $1.2 billion nationwide. While most infants with NAS typically complete treatment in a hospital setting, stakeholders told us that some of these infants may be transferred to a non-hospital setting to complete pharmacologic treatment and continue non-pharmacologic treatment. HHS officials told us that there is not a comprehensive list of facilities that may treat infants with NAS outside of the hospital. Based on information from the stakeholders we interviewed and the literature we reviewed, we identified two types of non-hospital settings available in certain states that treat infants with NAS: (1) outpatient clinics and programs and (2) neonatal withdrawal centers. For the purposes of this report, we defined neonatal withdrawal centers as facilities that can treat infants who are prenatally exposed to drugs, including infants with NAS, within the facility. Outpatient clinics and programs to treat NAS Through stakeholder interviews and the literature we reviewed, we identified examples of outpatient clinics and programs in certain states where infants with NAS can continue pharmacologic treatment after their discharge from the hospital. For example, some stakeholders we interviewed told us about a Neonatal Medical Follow-Up Clinic in Vermont used to follow-up with infants with NAS who have been discharged from the hospital and are being weaned off methadone on an outpatient basis. Hospital providers train the infant’s family on how to administer the infant’s medication at home and provide a referral to the clinic. After hospital discharge, the infant and family have follow-up visits in the clinic every 1 to 2 weeks, during which the family discusses with health care providers the weaning schedule and demonstrate how they administer the infant’s medication. Health care providers told us that they also encourage the family to continue providing non-pharmacologic treatment to the infant. After weaning is complete, the infant continues to follow-up at the clinic every 1 to 2 months until the infant reaches 12 to 18 months of age. Literature we reviewed indicated that other outpatient treatment clinics or programs such as the one in Vermont have been established or considered in other states. Specifically, four studies we reviewed described instances in which infants began their treatment in the hospital but completed their treatment through a dedicated outpatient program in Florida, Ohio, and Pennsylvania. Each study noted that the inpatient-to- outpatient approach can result in a shorter hospital length of stay. For example, one 2015 study found that infants who began treatment in a hospital and completed their treatment in an outpatient setting stayed in the hospital an average of 11 days, compared to infants who completed treatment in the hospital, where the stays averaged about 25 days. However, the studies also noted that the inpatient-to-outpatient approach resulted in a longer overall treatment duration across the two settings. Neonatal withdrawal centers to treat NAS Some stakeholders we interviewed, including health care providers, described examples of neonatal withdrawal centers in two states, where infants with NAS can continue pharmacologic treatment after their discharge from the hospital. Health care providers in these facilities told us that in Washington and West Virginia, some infants with NAS who began treatment in a hospital may be referred to these facilities, where they reside until they complete treatment and are discharged from the facility. These providers explained that in these facilities, the infants are placed in nursery rooms, where health care providers can monitor them and administer and adjust their medication as needed. In addition, nursing staff or other caregivers are responsible for providing continuous non-pharmacologic treatment, and mothers are encouraged to visit and continue this care. For example, health care providers told us that in Washington, two to three infants may share a nursery room where trained caregivers provide them with non-pharmacologic treatment. In West Virginia, health care providers said infants are typically placed in individual nursery rooms where nurses provide them with non- pharmacologic treatment. The rooms in the West Virginia facility are also equipped with a rocking chair to encourage mothers to visit and provide this care as well. Health care providers told us that the facility currently offers one nursery room equipped with a bed to help prepare mothers on what to expect after discharge; they also said that they encourage mothers to spend the night prior to the infant’s discharge from the facility. (See text box below). Treating infants with neonatal abstinence syndrome (NAS) in a neonatal withdrawal center One health care provider from a neonatal withdrawal center told us that the practice of rooming-in helps to facilitate the bond between the mother and infant. He also said that rooming-in allows health care providers to model care for the mothers and for mothers to learn how to care for their infants with NAS. Health care providers told us that the facility currently offers one nursery room equipped with a bed to help prepare mothers on what to expect after discharge and that they encourage mothers to spend the night prior to the infant’s discharge from the facility. One health care provider told us that one mother, after staying overnight with her infant, realized that she was not prepared to take care of her infant and consequently gave up custody of the infant. Because of rooming-in, health care providers were able to ensure that the infant was safe because the mother came to this realization at the facility, rather than alone at home. Although the lack of physical space at the facility currently makes it difficult to accommodate rooming-in for the entire course of the infant’s treatment, these providers noted the importance of this practice and that they are committed to parental involvement when treating infants with NAS at their facility. Figure 2 depicts nursery rooms in the neonatal withdrawal center in West Virginia. Efforts are also underway to open a neonatal withdrawal center in Arizona and Ohio, according to stakeholders we interviewed. Stakeholders we interviewed and the literature we reviewed suggest some limitations as well as benefits of treating infants with NAS in non- hospital settings, including factors to consider in these settings. Health care providers from one of the hospitals we visited in Vermont told us that their hospital is the only one in the state that allows infants with NAS to complete pharmacologic treatment through the Vermont outpatient clinic because they have established the necessary infrastructure to ensure families’ compliance and safe practices at home. These providers said that they worked with one local pharmacy to ensure proper dispensing of the medication. Additionally, these providers measured the amount of medication left over at each follow- up visit with the families. Some state and perinatal collaborative officials told us that neonatal withdrawal centers may not be the best environment to treat infants with NAS because these settings may limit a mother’s access to her infant, since she may not always be allowed to reside with the infant. Such limits, according to officials, do not facilitate bonding between mother and infant. Another state perinatal collaborative official, as well as health care providers and staff, told us that neonatal withdrawal centers may be better for treating infants with NAS because the environment is quieter and less stimulating than hospital settings, such as NICUs. Several studies we reviewed also emphasized that the inpatient-to- outpatient approach requires ongoing coordination, communication, and commitment from multidisciplinary providers, as well as the families. These studies highlighted instances in which these approaches reduced the length of the infants’ stay in a hospital, though the studies emphasized that more work needs to be done to determine whether these are the optimal approaches for infants with NAS, as well as the potential long-term benefits of such approaches. Medicaid pays for NAS treatment services provided in the non-hospital settings we identified in certain states, according to CMS officials and other stakeholders we spoke with, but generally pays for these services separately, in contrast with the single bundled payment paid to hospitals. State officials and health care providers in the non-hospital settings we examined described various ways in which Medicaid covered services they provided to treat infants with NAS. For example: Outpatient follow-up clinic in Vermont. State officials and staff at this facility told us that the Vermont Medicaid program pays for an infant’s outpatient physician visits using a fee-for-service payment schedule. They added that the Vermont Medicaid program also pays for the infant’s medication used in pharmacologic treatment and explained that the pharmacy that dispenses the medication bills Medicaid for these services. Neonatal withdrawal center in Washington. Health care providers at this facility told us that the Washington Medicaid program or their contracted managed care plans pay for physician visits using a fee- for-service payment schedule, noting that the facility decided to stop billing Medicaid for medical supplies because of the low reimbursement. Additionally, these providers suggested that because the facility does not meet the Medicaid standards required for receiving payment for hospital inpatient, nursing, or other covered facility services, the facility is ineligible to receive Medicaid payment for the costs of room and board. These providers said that they receive funding for the cost of these services through state appropriations, foster care payments, city contracts, grants, and private donations. Neonatal withdrawal center in West Virginia. State officials and health care providers at this facility told us that West Virginia pays for NAS services through two mechanisms, depending on whether the infant is in foster care. Specifically, if the infant is in foster care, the facility receives a bundled payment from the state Medicaid program and the Bureau of Children and Families. However, if the infant is not in foster care, the state Medicaid program pays for physician visits using a fee-for-service schedule. Additionally, the facility can receive payment under a per diem rate that is negotiated with state Medicaid managed care plans. The health care providers said that they also receive funding through grants and private donations to help cover the costs of NAS services. Stakeholders we interviewed and literature we reviewed suggest that the costs of treating infants with NAS in non-hospital settings were lower than treating them in hospital settings. However, supporting data and research of the costs in different settings are anecdotal or otherwise limited. For example: Health care providers from the neonatal withdrawal center in Washington told us that their facility could treat infants at a lower average cost per day than could hospitals—at about $700 per infant per day compared to an average cost of about $1,500-2,500 per infant per day in a hospital. These providers said that this cost savings is in part due to their limited staffing of nurses and their ability to leverage specially trained caregivers to provide infants with non-pharmacologic treatment and hands-on care, such as feeding and bathing. These providers also said they use volunteers to help with household duties, such as laundry and replenishing supplies. A health care provider from the neonatal withdrawal center in West Virginia conducted a study that found that the average daily charges per infant were about $400 in their facility, compared to about $2,600 in a special care nursery and $4,000 in a NICU. Two studies we reviewed found that inpatient-to-outpatient treatment approaches reduced hospital costs for NAS treatment; however, these studies were not generalizable and did not account for the duration of treatment across the two settings. Specifically, one study found that an inpatient-to-outpatient treatment approach reduced hospital length of stay by 55 percent—estimated to save hospitals $396 million annually—compared with treatment provided solely in a hospital. The second study found that infants who received care for NAS through an inpatient-to-outpatient treatment approach had an average length of stay of 13 days and cost about $14,000, while an inpatient- only approach had an average length of stay of 25 days and cost about $28,000. The 32 stakeholders we interviewed and the literature we reviewed identified several recommended practices for addressing NAS—that is, treating women with opioid use disorders during pregnancy or treating infants diagnosed with NAS after birth. The most frequently recommended practices were (1) prioritizing non-pharmacologic treatment, such as allowing the mother to reside with the infant during treatment, to facilitate the mother-infant bond; (2) educating mothers on prenatal care, treatment for NAS, and available resources for after an infant’s discharge; (3) educating health care providers on the stigma faced by women who use opioids during pregnancy and on how to screen for and treat NAS; and (4) using a protocol in a hospital or non-hospital setting for screening and treating infants with NAS. These recommended practices are described in more detail below. Volunteer programs to provide non- pharmacologic treatment for neonatal abstinence syndrome (NAS) Some stakeholders told us that some hospitals have established volunteer cuddler programs that train volunteers to help provide some of these non-pharmacologic treatments—-namely, swaddling, feeding, soothing, and coddling infants. However, health care providers at some facilities noted that volunteers are not necessarily available during late shifts. indicated that non-pharmacologic treatment may (1) facilitate the mother- infant bond, (2) reduce the severity of NAS symptoms, (3) reduce the need for pharmacologic treatment, and (4) reduce the length of an infant’s hospital stay. For example, two of the articles we reviewed noted that rooming-in has been shown to help decrease the need for pharmacologic treatment, the number of admissions to the NICU, and the length of an infant’s hospital stay. Additionally, 17 of the stakeholders we interviewed and nine articles we reviewed recommended that mothers be allowed to breastfeed while their infants are treated for NAS, as it helps to build a bond between the mother and infant. Most of these articles also noted that breastfeeding has been shown to reduce the severity of NAS. Educating mothers on prenatal care, treatment for NAS, and resources for after an infant’s hospital discharge. Most stakeholders we interviewed and several of the literature articles we reviewed recommended providing comprehensive, ongoing education to mothers on prenatal care and treatment for NAS and on the resources that are available after an infant’s discharge. (See text box below). The stakeholders and literature indicated that this education may (1) facilitate a non-combative relationship between the mother and health care providers; (2) help to reassure and support the mother, who may feel responsible for the infant’s suffering, in addition to facilitating treatment of NAS; and (3) help the mother understand her infant’s behavior and develop greater confidence in her parenting skills. For example, one article noted that an infant’s withdrawal behavior, such as fisting, back arching, and jaw clenching, may be misinterpreted by the mother as dislike of touch, and that educating mothers on these behaviors can help alleviate feelings of guilt. Education for mothers on prenatal care, treatment for neonatal abstinence syndrome (NAS), and resources for after an infant’s hospital discharge Explaining to the mother during the prenatal period what she can expect when the infant is born to help ensure she understands the effects of and treatment for NAS; Informing the mother about non-pharmacologic treatment techniques that can help reduce the severity of the infant’s NAS symptoms; Modeling good parenting skills, such as demonstrating how to comfort an infant who may be crying inconsolably for hours because of withdrawal; and Informing the mother about contraception for preventing future pregnancies. Educating health care providers on the stigma faced by women who use opioids during pregnancy, and how to screen for and treat NAS. Most stakeholders we interviewed and several of the literature articles we reviewed recommended educating health care providers, including providers who are not addiction specialists, on both the stigma faced by women who use opioids during pregnancy as well as on how to screen for and treat infants with NAS. The stakeholders and literature indicated that this education may: (1) improve care so that mothers with opioid use disorders feel more comfortable seeking and obtaining prenatal care, (2) help health care providers know how to recognize NAS symptoms to help ensure infants receive appropriate treatment, and (3) allow for more consistency among these providers in NAS screening and treatment. For example, 26 stakeholders told us that educating health care providers about stigma is important because provider attitudes affect how and if pregnant women obtain prenatal care and treatment for their opioid use disorders, which can affect the severity of NAS. Additionally, several articles we reviewed noted the importance of educating and training clinicians on how to administer the screening tools used to identify infants with NAS, which helps ensure infants are identified and receive optimal care. Using a protocol for screening and treating infants with NAS. While there is no single national standard of care for screening and treating NAS, most stakeholders we interviewed and several of the literature articles we reviewed recommended that hospital and non-hospital settings use a protocol to screen for and treat infants with NAS. The stakeholders and literature indicated that having a protocol can help: (1) identify infants at risk for NAS, (2) ensure that care is provided consistently, and (3) reduce the length of stay for infants receiving pharmacologic treatment. For example, the stakeholders we interviewed explained that a standard protocol also helps health care providers understand the tools used to assess the severity of NAS; know the types of medication used in treatment, including amounts and duration; and learn how to wean the infant off these medications. Similarly, one article we reviewed noted that infants who were treated at facilities that adopted standard treatment protocols experienced shorter durations of pharmacologic treatment compared with infants who were treated at facilities that did not use a standard protocol. Stakeholders we interviewed and literature we reviewed identified several challenges health care providers face in their efforts to address NAS. The most frequently cited challenges included (1) the use of multiple substances by pregnant women, which can exacerbate NAS; (2) the stigma faced by women who use opioids during pregnancy, which may affect whether they seek prenatal care to address NAS, among other things; (3) hospital staff burden and limited physical capacity to care for infants with NAS; (4) limited coordination of care for mothers and infants with NAS; and (5) gaps in research and data on NAS. These challenges are described in more detail below. The use of multiple substances by pregnant women, which can exacerbate NAS. Most stakeholders we interviewed and some of the literature we reviewed noted that the use of multiple substances by pregnant women, including opioids—referred to as maternal polysubstance use—can be a challenge, and some stated that the use of these substances can exacerbate NAS symptoms. According to the stakeholders, the substances can include methamphetamines, nicotine, alcohol, cocaine, marijuana, benzodiazepines, and Gabapentin. The stakeholders and literature indicated that maternal polysubstance use can lead to multiple conditions in the infant—such as prematurity or Hepatitis C—that can exacerbate NAS symptoms and prolong the length of an infant’s hospital stay. For example, one expert noted that many women with opioid use disorders are also heavy cigarette smokers, and the nicotine typically exacerbates NAS withdrawal symptoms. Additionally, officials from a hospital and non-hospital setting we visited told us that they had developed a separate protocol for treating infants exposed to multiple substances that includes the use of several medications to address the more severe NAS withdrawal symptoms. Stigma faced by women who use opioids which may affect whether they seek prenatal care to mitigate the severity of NAS, among other things. Most stakeholders we interviewed and several of the literature articles we reviewed noted that the stigma faced by pregnant women with opioid use disorders is a challenge in addressing NAS. The stakeholders and literature indicated that stigma may: (1) prevent pregnant women from seeking substance use treatment or prenatal care; (2) prevent them from disclosing their drug use to health care providers during pregnancy; or (3) cause the women to fear punitive effects, such as losing custody of their children, being detained, or losing their jobs. For example, officials from one perinatal quality collaborative told us that these women may fail to seek care because of stigma, which can ultimately make it more difficult for health care providers to build relationships with these women and identify infants at risk for NAS. Hospital staff burden and limited physical capacity to care for infants with NAS. According to most stakeholders we interviewed and some literature we reviewed, staff burden and a limited physical capacity at facilities can pose challenges for addressing NAS. The stakeholders and literature indicated that there is increased burden on staff to care for these infants because they require frequent, personal attention. For example, the stakeholders explained that a hospital may have to increase the number of nurses on duty in order to provide the care the infants need. Health care providers at one hospital said that nurses still struggle to care for infants with NAS, even with additional staff, because these infants are overstimulated, cry, and do not eat or sleep well. As a result, they require much time and one-on-one attention—including cuddling— from nurses. With respect to physical capacity, some stakeholders told us that limited physical capacity can make it difficult to (1) find space in the facility where the infants can be protected from high levels of stimulation and (2) facilitate the mother-infant bond. For example, some stakeholders told us that hospitals may not have a dedicated space for rooming-in, making it more difficult to facilitate bonding between mothers and infants. Limited coordination of care for mothers and infants with NAS. Most stakeholders we interviewed explained that the lack of coordination among health care providers and others for the mother and infant with NAS during the prenatal period, after the infant is born, and following the infant’s discharge can be a challenge. This coordination includes organizing patient care activities and sharing information among health care providers, social workers, and all other participants concerned with the mother and infant’s care. The stakeholders indicated that this lack of coordination can make it difficult for families to get the resources or support they need. (See text box below). For example, some stakeholders told us that women may miss health care visits because of a lack of access to enabling services such as transportation or child care. Limited coordination of care for mothers and infants with neonatal abstinence syndrome (NAS) One expert told us that there is a disproportionate number of infants with NAS born in rural areas. Infants in these areas may be discharged from the hospital without many follow-up services, such as transportation and care coordination. Gaps in research and data on NAS. Some stakeholders we interviewed noted that gaps in research and data on NAS make it challenging to conduct research on the affected population and fully understand the magnitude of the problem. The stakeholders indicated that there are gaps in adequate research and data on (1) the different types of treatment approaches for NAS; (2) the extent and effects of maternal polysubstance use among pregnant women; (3) the long-term effects of prenatal drug exposure, including the effects seen in childhood and adolescence; and (4) the efforts to ensure more consistent provider diagnosis and screening, such as through an improved screening tool. For example, the stakeholders told us that gaps in research and data may contribute to a lack of a national standard of care for screening and treating infants with NAS. According to some stakeholders, this may result in missed opportunities for identifying and treating infants with NAS. Some stakeholders also told us that because of gaps in research on the long- term effects of prenatal drug exposure, there is limited information on the types of services that infants with NAS may need in early childhood. Additionally, some stakeholders noted they found that because NAS was not consistently diagnosed and coded in medical records using diagnosis codes, the condition may be under-reported, and researchers may be limited in their ability to track these infants. In May 2017, HHS published the Protecting Our Infants Act: Report to Congress, which—among other things—presents a strategy that identifies key recommendations related to addressing NAS. Specifically, HHS’s strategy—known as the Protecting Our Infants Act: Final Strategy—made 39 recommendations related to the prevention, treatment, and related services for NAS and prenatal opioid use. Of the 39 recommendations HHS made in its report, we found that 28 of them directly relate to the recommended practices or challenges that we describe above. For example, the Strategy recommends the following: promoting non-pharmacologic treatment, such as rooming-in; providing continuing medical education to health care providers for managing and treating infants with NAS, such as on NAS treatment protocols; conducting research on the long-term effects of prenatal drug exposure so that appropriate services can be developed for infants with NAS; and establishing clear definitions of NAS and standardizing the use of diagnosis codes to collect more meaningful and actionable data on NAS. According to the Strategy, the recommendations will be used to inform planning and policy across HHS. However, HHS does not include any information in the Strategy on how the department and other stakeholders will implement the recommendations. Specifically, HHS does not include in its Strategy the following: the explicit priorities among the numerous recommendations and associated efforts the department has initiated related to NAS; timeframes for partial or full implementation of these recommendations; clear roles and responsibilities for the recommendations, such as the extent to which HHS will need to rely on the medical community and federal and public stakeholders for implementation; and the methods that will be used to assess the department’s progress in implementing any of these recommendations. HHS officials told us that they expect to develop a separate plan to guide implementation of the recommendations and that efforts to develop this plan were likely to begin in July 2017. However, as of September 2017, HHS could not provide any documentation that it had started to develop this implementation plan or establish a timeline for completing the plan; nor was HHS able to provide any information on what the plan may include. Having such a plan in place is important to ensure priorities are known and responsibilities are clear so that agencies and stakeholders can take appropriate action. Federal internal control standards call for agencies to have defined objectives clearly as part of their objective- setting process and to assign roles and responsibilities for achieving these objectives. Objectives defined in specific and measurable terms allow for the assessment of performance toward achieving objectives. Furthermore, leading principles on sound planning we have identified in our prior work call for developing robust plans to achieve agency goals. Until HHS finalizes an implementation plan that includes specific priorities, timeframes, responsibilities, and methods for evaluating progress, it is at risk of not being able to provide reasonable assurance that it can successfully implement these recommendations in a timely manner and assess the effectiveness of its efforts. The rising opioid crisis has caused a significant increase in the number of infants born and diagnosed with NAS, a condition that affects infants and their families, hospitals, and other health care providers who are treating them. The increase in infants born with NAS also increases medical and other treatment costs experienced by the federal government and states. HHS recently published a strategy with key recommendations that have the potential to address some of the challenges related to treating NAS. However, HHS lacks a sound plan for implementing these recommendations. The absence of such planning raises questions about whether and when HHS will be able to implement these recommendations in a timely manner and be able to assess its progress. The Secretary of HHS should expeditiously develop a plan—that includes priorities, timeframes, clear roles and responsibilities, and methods for assessing progress—to effectively implement the NAS-related recommendations identified in the Protecting Our Infants Act: Final Strategy. (Recommendation 1) We provided a draft of this report to HHS for review, and HHS provided written comments, which are reprinted in appendix III. HHS also provided technical comments, which we incorporated as appropriate. In its written comments, HHS concurred with our recommendation to expeditiously take steps to address NAS and re-stated that its Strategy will be used to inform planning and policy across HHS. Specifically, HHS said that as part of its broader initiative to address the opioid crisis, the department will develop and implement a plan—that will include priorities, timeframes, roles and responsibilities, and methods for assessing progress—to address as appropriate and possible, the NAS-related recommendations in its Strategy. HHS also stated that full implementation would be contingent on funding, though it provided no information on how much funding was needed or how the funding would be used. Developing a plan to guide implementation can help the department determine what resources, if any, are needed to implement the recommendations in its Strategy. We are sending copies of this report to the appropriate congressional addressees, the Secretary of Health and Human Services, and other interested parties. In addition, the report will be available at no charge on GAO’s website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7114 or at iritanik@gao.gov. Contact points for our Office of Congressional Relations and Office of Public Affairs can be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV. To address our first three audit objectives to describe care settings for treating infants with neonatal abstinence syndrome (NAS), Medicaid payment for NAS treatment, and the recommended practices and challenges for addressing NAS, we selected 32 stakeholders based on their relevant experience to cover a range of perspectives on NAS. Specifically, these stakeholders included those from site visits we conducted to four states—Kentucky, Vermont, West Virginia, and Wisconsin. We selected these states because they met the following criteria: 1. the state had one of the top 10 highest incidence rates of NAS, according to data from the Centers for Disease Control and Prevention (CDC) for 2013, the most recent year of publicly available data; 2. the state provided variation in United States geographic regions with high rates of NAS, as of 2012; 3. more than 40 percent of births in the state were financed by Medicaid, according to a 2016 Kaiser Family Foundation Medicaid Budget Survey; and 4. the state has a perinatal quality collaborative—a state or multi-state network of teams working to improve health outcomes for mothers and infants—with work related to NAS, which we identified through the American College of Obstetricians and Gynecologists. As part of these site visits, we interviewed (1) officials from each of the four states, including Medicaid officials, Maternal and Child Health Directors, and Women’s Services Coordinators; (2) representatives from the four state perinatal collaboratives; (3) health care providers (including physicians or nurses) from eight hospitals of varying levels of care (two hospitals in each state), which were selected based on recommendations from the state perinatal collaboratives because of the hospitals’ experience treating NAS; and (4) officials from a residential treatment facility in each of the four states that provide prenatal and postpartum care to mothers, which were also selected based on recommendations from the state perinatal collaboratives regarding the facilities’ experience with pregnant women with opioid use disorders and their infants with NAS. In addition to our site visits, we selected 12 additional stakeholders that included health care providers or administrators in non-hospital settings across the United States; officials from medical specialty societies; and experts. Specifically, we spoke with (1) health care providers (including physicians or nurses) or administrators from four non-hospital settings in Arizona, Ohio, Washington, and West Virginia, which were selected based on recommendations from stakeholders we interviewed and on the availability of such settings and their experience treating NAS; (2) health care providers from five medical specialty societies, including the American Academy of Pediatrics, the American College of Obstetricians and Gynecologists, the American Society of Addiction Medicine, MedNAX (a network of physicians that specialize in neonatal care, including NAS treatment), and the National Association of Neonatal Nurses; and (3) three experts, including the authors of published literature we reviewed. We interviewed each of these 32 stakeholders and requested information from stakeholders about treating infants with NAS, including the utilization of available hospital and non-hospital care settings and associated costs of treatment services. For example, we requested protocols for screening and treating infants with NAS from hospital and non-hospital care settings. We reviewed available protocols provided by hospitals and a non-hospital care setting. We also reviewed available information reported by state officials, hospital and non-hospital providers, and state perinatal collaboratives on the utilization of hospital and non-hospital care settings, the facilities’ cost of treating NAS in hospital and non-hospital settings, the lengths of stay for treating infants with NAS, or the amount of Medicaid payments for treating infants with NAS. We discussed the information provided by stakeholders and examined the information for obvious errors. The information obtained from these stakeholders is not generalizable to other states or other hospital and non-hospital settings. In addition, in some cases, stakeholders used different methods to collect the information they reported, including information on Medicaid payments; as a result, the information reported by stakeholders is not directly comparable. Additionally, we interviewed officials from HHS, including those from the Centers for Medicare & Medicaid Services (CMS) and HHS’s Behavioral Health Coordinating Council—which includes officials from the Substance Abuse and Mental Health Services Administration (SAMHSA), the Indian Health Service, the Centers for Disease Control and Prevention (CDC), and the Food and Drug Administration, among others—concerning NAS treatment services, settings of care, Medicaid payment, and recommended practices and challenges related to addressing NAS. We also conducted a comprehensive literature review to identify relevant studies on NAS published in peer-reviewed journals from January 2013 to December 2016. We searched more than 40 databases for research published in relevant peer-reviewed journals, including BIOSIS Previews®, Embase®, Gale Group Health Periodicals Database, MEDLINE®, and New England Journal of Medicine. Key search terms included “neonatal abstinence syndrome,” “neonatal opioid withdrawal syndrome,” and “newborn infants.” After excluding duplicates, we identified and reviewed 325 abstracts. For those abstracts we found relevant, we obtained and reviewed the full study and selected 40 that were relevant to (1) hospital and non-hospital settings and related treatment services for infants with NAS; (2) the costs associated with treating infants with NAS, including Medicaid payments for services in these care settings; or (3) recommended practices and challenges for addressing NAS. We examined the methodologies for each of these studies and interviewed some of their authors. We determined that the studies were sufficiently reliable for our audit objectives. For a complete list of the studies we reviewed, see below. To examine our last audit objective on HHS’s strategy related to addressing NAS, we interviewed agency officials and reviewed agency documents on the agency’s efforts to develop a strategy. Specifically, we interviewed relevant officials from CMS and HHS’s Behavioral Health Coordinating Council concerning their efforts to develop a strategy related to addressing NAS. In reviewing relevant HHS documents, we focused on HHS’s Protecting Our Infants Act Report to Congress, which includes a strategy to address identified gaps, challenges, and recommendations related to NAS and prenatal opioid use. In addition, we reviewed the relevant standards for internal control in the federal government and the relevant criteria from GAO’s body of work on effectively managing performance under the Government Performance and Results Act (GPRA) of 1993 and the GPRA Modernization Act of 2010. Allocco, E., M. Melker, F. Rojas-Miguez, C. Bradley, K. A. Hahn, and E. M. Wachman. “Comparison of Neonatal Abstinence Syndrome Manifestations in Preterm Versus Term Opioid-Exposed Infants.” Advances in Neonatal Care, vol. 16, no.5 (2016). Artigas, V. “Management of Neonatal Abstinence Syndrome in the Newborn Nursery.” Nursing for Women’s Health, vol. 18, issue 6 (Dec. 2014/Jan. 2015). Asti, L., J. S. Magers, E. Keels, J. Wispe, and R. E. McLead. “A Quality Improvement Project to Reduce Length of Stay for Neonatal Abstinence Syndrome.” Pediatrics, vol. 135, no. 6 (2015). Busch, D. W. “Clinical management of the Breast-Feeding Mother-Infant Dyad in Recovery from Opioid Dependence.” Journal of Addictions Nursery, vol. 27, no. 2 (2016). Casper, T. and M. Arbour. “Evidence-Based Nurse-Driven Interventions for the Care of Newborns with Neonatal Abstinence Syndrome.” Advances in Neonatal Care, vol. 14, no. 6 (2014). Chau, K. T., J. Nguyen, B. Miladinovic, C. M. Lilly, T. L. Ashmeade, and M. Balakrishnan. “Outpatient Management of Neonatal Abstinence Syndrome: A Quality Improvement Project.” The Joint Commission Journal on Quality and Patient Safety, vol. 42, no. 11 (2016). Cirillo, C. and K. Francis. “Does Breast Milk Affect Neonatal Abstinence Syndrome Severity, the Need for Pharmacologic Therapy, and Length of Stay for Infants of Mothers on Opioid Maintenance Therapy During Pregnancy?” Advances in Neonatal Care, vol. 16, no.5 (2016). Clark, L. and A. Rohan. “Identifying and Assessing the Substance- Exposed Infant.” MCN in Advance (2015). Demirci, J. R., D. L. Bogen, and Y. Klionsky. “Breastfeeding and Methadone Therapy: The Maternal Experience.” Substance Abuse, vol. 36, no. 2 (2015). Edwards, L. and L. F. Brown. “Nonpharmacologic Management of Neonatal Abstinence Syndrome: An Integrative Review.” Neonatal Network, vol. 35, no. 5 (2016). Gregory, K. E. “Caring for the Infant with neonatal Abstinence Syndrome in a Community-Based Setting.” The Journal of Perinatal & Neonatal Nursing, (2014). Grim, K., T. E. Harrison, and R. T. Wilder. “Management of Neonatal Abstinence Syndrome from Opioids.” Clinics in Perinatology, (2013). Hahn, J., A. Lengerich, R. Byrd, R. Stoltz, J. Hench, S. Byrd, and C. Ford. “Neonatal Abstinence Syndrome: The Experience of Infant Massage.” Creative Nursing, vol. 22, issue 1 (2016). Hall, E. S., S. L. Wexelblatt, M. Crowley, J. L. Grow, L. R. Jasin, M. A. Klebanoff, R. E. McClead, J. Meinzen-Derr, V. K. Mohan, H. Stein, and M. C. Walsh. “A Multicenter Cohort Study of Treatments and Hospital Outcomes in Neonatal Abstinence Syndrome.” Pediatrics, vol. 134, no. 2 (2014). Hall, E. S., S. L. Wexelblatt, M. Crowley, J. L. Grow, L. R. Jasin, M. A. Klebanoff, R. E. McClead, J. Meinzen-Derr, V. k. Mohan, H. Stein, and M. C. Walsh. “Implementation of a Neonatal Abstinence Syndrome Weaning Protocol: A Multicenter Cohort Study.” Pediatrics, vol. 136, no. 4 (2015). Holmes, A. V., E. C. Atwood, B. Whalen, J. Beliveau, J. D. Jarvis, J. C. Matulis, and S. L. Ralston. “Rooming-In to Treat Neonatal Abstinence Syndrome: Improved Family-Centered Care at Lower Cost.” Pediatrics, vol. 137, no. 6 (2016). Jones, H. E., K. Deppen, M. L. Hudak, L. Leffert, C. McClelland, L. Sahin, J. Starer, M. Terplan, J. M. Throrp Jr., J. Walsh, and A. A. Creanga. “Clinical Care for Opioid-Using Pregnant and Postpartum Women: The Role of Obstetric Providers.” American Journal of Obstetrics & Gynecology, vol. 210, issue 4 (2014). Jones, H.E., C. Seashore, E. Johnson, E. Horton, K.E. O’Grady, K. Andringa, M. R. Grossman, B. Whalen, and A.V. Holmes. “Brief Report: Psychometric Assessment of the Neonatal Abstinence Scoring System and the MOTHER NAS Scale.” American Journal on Addictions, (2016). Kraft, W.K., M. W. Stover, and J. M. Davis. “Neonatal Abstinence Syndrome: Pharmacologic Strategies for the Mother and Infant.” Seminars in Perinatology, vol. 40, issue 3 (2016). Krans, E. E., G. Cochran, and D. L. Bogen. “Caring for Opioid Dependent Pregnant Women: Prenatal and Postpartum Care Considerations.” Clinical Obstetrics and Gynecology, vol. 58, no. 2 (2015). Lee, J., S. Hulman, M. Musci Jr., and E. Stang. “Neonatal Abstinence Syndrome: Influence of a Combined Inpatient/Outpatient Methadone Treatment Regimen on the Average Length of Stay of a Medicaid NICU Population.” Population Health Management, vol. 18, no.5 (2015). MacMullen, N. J., L. A. Dulski, and P. Blobaum. “Evidence-Based Interventions for Neonatal Abstinence Syndrome.” Pediatric Nursing, vol. 40, no. 4 (2014). Maguire, D. J., “Mothers on Methadone: Care in the NICU.” Neonatal Network, vol. 32, no. 6 (2013). Marcellus, L. “Supporting Women with Substance Use Issues: Trauma- Informed Care as a Foundation for Practice in the NICU.” Neonatal Network, vol. 33, no.6 (2014). McKeever, A. E., S. Spaeth-Brayton, and S. Sheerin. “The Role of Nurses in Comprehensive Care Management of Pregnant Women with Drug Addiction.” Nursing for Women’s Health, vol. 18, no.4 (2014). Meyer, M. and J. Phillips. “Caring for Pregnant Opioid Abusers in Vermont: A Potential Model for Non-Urban Areas.” Preventive Medicine, vol. 80 (2015). Newnam, K. M. “The Right Tool at the Right Time: Examining the Evidence Surrounding Measurement of Neonatal Abstinence Syndrome.” Advances in Neonatal Care, vol. 14, no.3 (2014). Orlando, S. “An Overview of Clinical Tools Used to Assess Neonatal Abstinence Syndrome.” Journal of Perinatal and Neonatal Nursing, vol. 28, no.3 (2014). Patrick, S.W., M.M. Davis, C.U. Lehman, and W.O. Cooper. “Increasing Incidence and Geographic Distribution of Neonatal Abstinence Syndrome: United States 2009 to 2012.” Journal of Perinatology, vol. 35 (2015). Patrick, S.W., H.C. Kaplan, M. Passarella, M.M. Davis, and S.A. Lorch. “Variation in Treatment of Neonatal Abstinence Syndrome in U.S. Children’s Hospitals, 2004-2011.” Journal of Perinatology, vol. 34, no. 11 (2014). Patrick, S.W., J. Dudley, P.R. Martin, F.E. Harrell, M.D. Warren, K.E. Hartmann, E.W. Ely, C.G. Grijalva, and W.O. Cooper. “Prescription Opioid Epidemic and Infant Outcomes.” Pediatrics, vol. 135, no.5 (2015). Patrick, S.W., R. E. Schumacher, J. D. Horbar, M. E. Buus-Frank, E. M. Edwards, K. A. Morrow, K. R. Ferrelli, A. P. Picarillo, M. Gupta, and R. F. Soll. “Improving Care for Neonatal Abstinence Syndrome.” Pediatrics, vol. 137, no. 5 (2016). Reece-Stremtan, S., and K. A. Marinelli. “ABM Clinical Protocol #21: Guidelines for Breastfeeding and the Drug-Dependent Woman, Revised 2015.” Breastfeeding Medicine, vol. 10, no.3 (2015). Shaw, M. R., C. Lederhos, M. Haberman, D. Howell, S. Fleming, and J. Roll. “Nurses Perceptions of Caring for Childbearing Women Who Misuse Opioids.” The American Journal of Maternal-Child Nursing, vol. 41, no. 1 (2016). Sublett, J. “Neonatal Abstinence Syndrome: Therapeutic Interventions.” The American Journal of Maternal-Child Nursing, vol. 38, no. 2 (2013). Sutter, M. B., L. Leeman, and A. Hsi. “Neonatal Opioid Withdrawal Syndrome.” Obstetrics and Gynecology Clinics of North America, vol. 41, issue 2 (2014). Teague, A. H., A. J. Jnah, and D. Newberry. “Intraprofessional Excellence in Nursing: Collaborative Strategies for Neonatal Abstinence Syndrome.” Neonatal Network, vol. 34, no.6 (2015). Terplan, M., A. Kennedy-Hendricks, and M. S. Chisolm. “Prenatal Substance Use: Exploring Assumptions of Maternal Unfitness.” Substance Abuse: Research and Treatment (2015). Tolia, V. N., S. W. Patrick, M. M. Bennett, K. Murthy, J. Sousa, P. B. Smith, R. H. Clark, and A. R. Spitzer. “Increasing Incidence of the Neonatal Abstinence Syndrome in U.S. Neonatal ICUs.” The New England Journal of Medicine, vol. 372, no. 22 (2015). Wiles, J. R., B. Isemann, L. P. Ward, A. A. Vinks, and H. Akinbi. “Current Management of Neonatal Abstinence Syndrome Secondary to Intrauterine Opioid Exposure.” Journal of Pediatrics, vol. 165, no. 3 (2014). The Department of Health and Human Services (HHS) has published several guidance and educational resources related to neonatal abstinence syndrome and prenatal opioid use. According to HHS, these documents serve as tools to help stakeholders, including state entities and health care providers, and policymakers. Examples of these resources are listed below. Centers for Disease Control and Prevention (CDC), Pregnancy and Opioid Medications Factsheet, accessed June 8, 2017, https://www.cdc.gov/drugoverdose/pdf/pregnancy_opioid_pain_factsheet- a.pdf. CDC Public Health Grand Rounds, Primary Prevention and Public Strategies to Prevent Neonatal Abstinence Syndrome (Atlanta, GA: CDC, last updated August 18, 2016), accessed July 19, 2017, https://www.cdc.gov/cdcgrandrounds/archives/2016/August2016.htm. CDC, Treating for Two: Safer Medication Use in Pregnancy Initiative (Atlanta, GA: CDC, last updated May 5, 2016), accessed June 8, 2017, https://www.cdc.gov/pregnancy/meds/treatingfortwo. Department of Health and Human Services, Opioids: The Prescription Drug & Heroin Overdose Epidemic (Washington, D.C., last reviewed March 24, 2016), accessed June 8, 2017, https://www.hhs.gov/opioids/index.html. Department of Health and Human Services, National Center for Substance Abuse and Child Welfare, Resources & Topics on Neonatal Abstinence Syndrome, accessed June 8, 2017, https://www.ncsacw.samhsa.gov/resources/opioid-use-disorders-and-me dication-assisted-treatment/neonatal-abstinence-syndrome.aspx. Jean Y. Ko. et al., “CDC Grand Rounds: Public Health Strategies to Prevent Neonatal Abstinence Syndrome,” Morbidity and Mortality Weekly Report (Centers for Disease Control and Prevention, March 10, 2017), accessed June 8, 2017, https://www.cdc.gov/mmwr/volumes/66/wr/mm6609a2.htm. National Institute on Drug Abuse, Principles of Substance Abuse Prevention for Early Childhood: A Research Based Guide (last updated March 2016), accessed June 8, 2017, https://www.drugabuse.gov/publications/principles-substance-abuse-prev ention-early-childhood/principles-substance-abuse-prevention-early-child hood. National Institute on Drug Abuse, Substance Use in Women (last updated September 2016), accessed June 8, 2017, https://www.drugabuse.gov/publications/research-reports/substance-use-i n-women/summary. Reddy, Uma M. J. M. Davis, Z. Ren, and M. F. Greene, “Opioid Use in Pregnancy, Neonatal Abstinence Syndrome, and Childhood Outcomes: Executive Summary of a Joint Workshop.” Obstetrics and Gynecology, vol. 130, issue 1 (July 2017). Substance Abuse and Mental Health Services Administration, A Collaborative Approach to the Treatment of Pregnant Women with Opioid Use Disorders. HHS Publications No. (SMA) 16-4978. Rockville, MD: Substance Abuse and Mental Health Services Administration, 2016. Substance Abuse and Mental Health Services Administration, “Advancing the Care of Pregnant and Parenting Women With Opioid Use Disorder and Their Infants: A Foundation for Clinical Guidance,” Rockville, MD: Substance Abuse and Mental Health Services Administration, 2016. Substance Abuse and Mental Health Services Administration, “Methadone Treatment for Pregnant Women.” HHS Publication No. (SMA) 14-4124 (Rockville, MD: Substance Abuse and Mental Health Services Administration, revised 2014). In addition to the contact named above, Rashmi Agarwal, Assistant Director; Amy Leone, Analyst-in-Charge; Melissa Duong; Krister Friday; Jacquelyn Hamilton; Giao N. Nguyen; and Laurie Pachter made key contributions to this report. Drug Control Policy: Information on Status of Federal Efforts and Key Issues for Preventing Illicit Drug Use. GAO-17-766T. Washington, D.C.: July 26, 2017. Medicaid Expansion: Behavioral Health Treatment Use in Selected States in 2014. GAO-17-529. Washington, D.C.: July 21, 2017. VA Health Care: Actions Needed to Ensure Medical Facility Controlled Substance Inspection Programs Meet Agency Requirements. GAO-17-242. Washington, D.C.: February 15, 2017. Highlights of a Forum: Preventing Illicit Drug Use. GAO-17-146SP. Washington, D.C.: November 14, 2016. Opioid Addiction: Laws, Regulations, and Other Factors Can Affect Medication-Assisted Treatment Access. GAO-16-833. Washington, D.C.: September 27, 2016. Drug Enforcement Administration: Additional Actions Needed to Address Prior GAO Recommendations. GAO-16-737T. Washington, D.C.: June 22, 2016. Office of National Drug Control Policy: Progress toward Some National Drug Control Strategy Goals, but None Have Been Fully Achieved. GAO-16-660T. Washington, D.C.: May 17, 2016. Veterans Justice Outreach Program: VA Could Improve Management by Establishing Performance Measures and Fully Assessing Risks. GAO-16-393. Washington, D.C.: April 28, 2016. State Marijuana Legalization: DOJ Should Document Its Approach to Monitoring the Effects of Legalization. GAO-16-1. Washington, D.C.: December 30, 2015. Prescription Drugs: More DEA Information about Registrants’ Controlled Substances Roles Could Improve Their Understanding and Help Ensure Access. GAO-15-471. Washington, D.C.: June 25, 2015. Mental Health: Better Documentation Needed to Oversee Substance Abuse and Mental Health Services Administration Grantees. GAO-15-405. Washington, D.C.: May 12, 2015. Prenatal Drug Use and Newborn Health: Federal Efforts Need Better Planning and Coordination. GAO-15-203. Washington, D.C.: February 10, 2015. Medicare Program Integrity: CMS Pursues Many Practices to Address Prescription Drug Fraud, Waste, and Abuse. GAO-15-66. Washington, D.C.: October 24, 2014. Office of National Drug Control Policy: Office Could Better Identify Opportunities to Increase Program Coordination. GAO-13-333. Washington D.C.: March 26, 2013. Child Welfare: States Use Flexible Federal Funds, But Struggle to Meet Service Needs. GAO-13-170. Washington, D.C.: January 30, 2013.

 

 Report 2:
To varying extents, Internet content providers—also called “edge providers”—and Internet service providers collect, use, and share information from their customers to enable their services, support advertising, and for other purposes. Many companies describe these and other privacy-related practices in privacy policies, to which consumers may be required to consent in order to use the service. Consumers access such services through a variety of devices, including mobile phones and tablets, computers, and other devices connected to the Internet by wired or wireless means. A nationwide survey that the U.S. Census Bureau conducted for NTIA in 2017 found that 78 percent of Americans ages 3 and older used the Internet. Another nationwide survey that the Pew Research Center conducted in 2018 found that 69 percent of American adults reported that they use some kind of social media platform such as Facebook. No comprehensive federal privacy law governs the collection, use, and sale or other disclosure of personal information by private-sector companies in the United States. Rather, the federal privacy framework for private-sector companies is comprised partly of a set of tailored laws that govern the use and protection of personal information for specific purposes, in certain situations, or by certain sectors or types of entities. These laws include the Fair Credit Reporting Act, which protects the security and confidentiality of personal information collected or used to help make decisions about individuals’ eligibility for such products as credit or for insurance or employment; the Gramm-Leach-Bliley Act, which protects nonpublic personal information that individuals provide to financial institutions or that such institutions maintain; and the Health Insurance Portability and Accountability Act which establishes a set of national standards for the protection of certain health information. In addition, as detailed in this report, FTC addresses consumer concerns about Internet privacy using its broad authority to protect consumers from unfair and deceptive trade practices. We have reported on a variety of Internet privacy concerns in recent years that include the collection and use of data such as people’s Internet browsing histories, purchases, locations, and travel routes, including: Internet of things: In 2017, we found that as new and more devices become connected, they increase not only the opportunities for security and privacy breaches, but also the scale and scope of any resulting consequences. Vehicle data privacy: We found in 2017 that most selected automakers reported limiting their data collection, use, and sharing, but their written notices did not clearly identify data sharing and use practices. Information resellers: In a 2013 report on companies that collect and resell information on individuals, we found that no overarching federal privacy law governs the collection and sale of personal information among private-sector companies, including information resellers. We found that gaps exist in the federal privacy framework, which does not fully address changes in technology and the marketplace. Among the issues we noted were the potential need for changes to privacy controls for web tracking, mobile devices, and other technologies. We recommended that Congress consider strengthening the consumer privacy framework to reflect the effects of changes in technology and the marketplace. Such legislation has not been enacted to date. Mobile device location data: In 2012, we found that, according to privacy advocates, consumers are generally unaware of how their location data are shared with and used by third parties. We recommended that FTC consider issuing guidance establishing FTC’s views regarding mobile companies’ appropriate actions to protect location data privacy. FTC implemented that recommendation in 2013. To guide their privacy practices, many organizations and governments have used the Fair Information Practice Principles. As noted above, these principles—which are not limited to Internet privacy—address the collection and use of personal information, data quality and security, and transparency, among other things, and have served as the basis for many of the privacy recommendations federal agencies have made. The Organisation for Economic Co-Operation and Development developed a version of these principles in 1980 that has been widely adopted and was updated in 2013. In 2000, FTC recommended that Congress enact a consumer Internet privacy statute that would require companies to comply with broad and flexible definitions of the principles, and an FTC commissioner said in a 2014 speech that they are a solid framework and are flexible and effective. While they are principles, not legal requirements, they provide a possible approach for balancing the need for privacy with other interests. Table 1 provides more detailed information about the principles. FTC is primarily a law enforcement agency that, among other responsibilities, currently has the lead in overseeing Internet privacy at the federal level. Specifically, it addresses consumer concerns about Internet privacy, both for Internet service providers and content providers, using its general authority under section 5 of the FTC Act. Section 5, as amended in 1938, prohibits “unfair or deceptive acts or practices in or affecting commerce.” Although the FTC Act generally empowers FTC to take enforcement action, it prohibits FTC from taking action against common carriers such as telecommunication services, airlines, and railroads under certain circumstances. FTC also does not have jurisdiction over banks, credit unions, or savings and loans institutions. Even though the FTC Act does not speak in explicit terms about protecting consumer privacy, the Act authorizes such protection to the extent it involves practices FTC defines as unfair or deceptive. According to FTC, an act or practice is “unfair” if it causes, or is likely to cause, substantial injury not reasonably avoidable by consumers and not outweighed by countervailing benefits to consumers or competition as a result of the practice. FTC has used this “unfairness” authority to address situations where a company has allegedly failed to properly protect consumers’ data. According to FTC, a representation or omission is “deceptive” if it is material and is likely to mislead consumers acting reasonably under the circumstances. For example, the omission of terms in an advertisement would need to be material and likely to mislead consumers in order to be deceptive. FTC applies this “deceptive” authority to address deceptions or violations of written privacy policies and representations concerning data security. FTC’s Bureau of Consumer Protection investigates Internet privacy complaints from various sources, including consumers, other agencies, Congress, and industry, and also initiates investigations on its own. If the bureau has reason to believe that an entity is engaging in an unfair or deceptive practice, it may forward an enforcement recommendation to the commission. The commission then determines whether to pursue an enforcement action, which can include the following: litigating commission-filed administrative complaints before an FTC administrative law judge; filing and litigating complaints in federal district court seeking preliminary and permanent injunctions, monetary redress for consumers or other equitable relief; or referring complaints seeking civil penalties for violations of rules authorizing such penalties or for violations of administrative orders to the Department of Justice (DOJ) and assisting DOJ in litigating those cases (if DOJ does not take action, FTC can pursue the action on its own). FTC’s Internet privacy enforcement cases may be settled without the imposition of civil penalties. Instead, FTC typically enters into settlement agreements requiring companies to take actions such as: implementing reasonable privacy and security programs; being subject to long-term monitoring of compliance with the settlements by outside entities; providing monetary redress to consumers; forfeiting any money gained from the unfair or deceptive conduct; deleting illegally obtained consumer information; and providing transparency and choice mechanisms to consumers. If a company violates an FTC final consent order, the agency can then request civil monetary penalties in court for the violations. In addition, as discussed below, FTC can seek to impose civil monetary penalties directly for violations of certain privacy statutes and regulations such as the statute pertaining to the Internet privacy of children and its implementing regulations. Although FTC can levy civil penalties up to $41,484 per violation, per day, against an entity that violates a trade regulation rule under the FTC Act, it has not promulgated trade regulation rules under section 5 specific to privacy. Although FTC has not implemented its section 5 authority by issuing regulations regarding Internet privacy, it has issued regulations to implement other statutory authorities. Likewise, other federal agencies use regulations to implement the statutes they are charged with administering. The process by which federal agencies typically develop and issue regulations is spelled out in the Administrative Procedure Act (APA). Section 553 of the APA establishes procedures and requirements for what is known as “informal” rulemaking, also known as notice-and- comment rulemaking. Among other things, section 553 generally requires agencies to publish a notice of proposed rulemaking in the Federal Register. After giving interested persons an opportunity to comment on the proposal by providing “data, views, or arguments,” the statute then requires the agency to publish the final rule in the Federal Register. Regulations may be enforced in various ways, for example, by seeking civil penalties for non-compliance. FTC has authority to seek civil penalties, for example, when a company knowingly violates a regulation or, as discussed below, a final consent order. In contrast to the APA section 553 rulemaking process, the rulemaking process that FTC generally must follow to issue rules under the FTC Act is spelled out in the Magnuson-Moss Warranty Act amendments to the FTC Act (Magnuson-Moss). The Magnuson-Moss amendments— enacted in 1975 partly in response to industry opposition to FTC’s trade regulations, and amended in 1980—require additional rulemaking steps beyond APA section 553. For example, Magnuson-Moss requires FTC to publish an advance notice of proposed rulemaking in addition to the notice of proposed rulemaking required by the APA, and to offer interested parties the opportunity for an informal hearing involving oral testimony. FTC has not promulgated any regulations using the Magnuson-Moss procedures since 1980; according to FTC staff, the additional steps required under Magnuson-Moss add time and complexity to the rulemaking process. The Children’s Online Privacy Protection Act (COPPA), enacted in 1998, governs the online collection of personal information from children under the age of 13 by operators of websites or online services, including mobile applications. COPPA required FTC to issue and enforce regulations concerning children’s online privacy and directed FTC to promulgate these regulations using the APA section 553 notice-and- comment rulemaking process. COPPA contained a number of specific requirements that FTC was directed to implement by regulation, such as requiring websites to post a complete privacy policy, to notify parents directly about their information collection practices, and to obtain verifiable parental consent before collecting personal information from their children or sharing it with others. The commission’s original COPPA regulations became effective on April 21, 2000, and amended COPPA regulations took effect on July 1, 2013. According to an FTC staff member, COPPA and FTC’s implementing regulations reflect various principles that are similar to the Fair Information Practice Principles. FCC regulates the telecommunications industry pursuant to the Communications Act of 1934, as amended (Communications Act). FCC follows the APA section 553 notice-and-comment rulemaking process to promulgate regulations implementing the Communications Act. FCC also has an enforcement bureau that pursues violations of its regulations and the Communications Act. The Communications Act establishes separate definitions for “information services” and “telecommunications services” and treats these two types of services differently. Specifically, information services are subject to less regulation by FCC than telecommunications services under the Communications Act. However, FTC is prohibited from regulating telecommunications carriers (a provider of telecommunications services) under the common carrier exemption. Prior to 2015, Internet services were considered information services under the Communications Act, and thus FTC was not prohibited from considering the privacy practices of Internet service providers under its FTC Act authority to protect consumers from unfair and deceptive practices. This changed in 2015 when FCC classified broadband as a telecommunications service, which meant that broadband Internet service providers were considered telecommunications carriers and FCC asserted primary oversight over them. As a result of the reclassification, FTC no longer had jurisdiction over Internet service providers. Once FCC had asserted primary oversight over Internet service providers, FCC promulgated privacy regulations specific to them. However, before the privacy regulations went into effect, Congress repealed them under the Congressional Review Act. In December 2017, FCC reclassified broadband as an information service—reverting Internet service providers’ classification to what it had been prior to 2015. When that reclassification became effective in June 2018, jurisdiction of Internet privacy for Internet service providers was effectively transferred from FCC back to FTC. As a result, FCC currently has limited Internet privacy oversight responsibilities, as shown in figure 1. Perspectives on the benefits of and concerns about the collection and use of consumers’ data from the Internet varied somewhat across stakeholder groups. Various stakeholders we interviewed—including those from academia, industry, and government—said that there should be a balance between the freedom of companies to collect and use consumers’ data needed to provide services and the necessity to protect consumers’ privacy. In general, industry stakeholders highlighted the benefits of data collection and use, such as facilitating innovation, while consumer advocacy groups and other stakeholders emphasized concerns about consumers’ loss of control over their data and their lack of understanding of how companies collect and use their information. Additionally, surveys and other literature that we reviewed on Internet privacy highlighted concerns among consumers. The key benefits of information collection were identified as: Enables certain services. According to two industry stakeholders, the collection and use of consumer data from the Internet enable content providers to provide services. These stakeholders said that sometimes a content provider must collect and use information from consumers to provide the service. For example, a mapping service must collect and use consumers’ current location to provide them with up-to-date directions. Provides low-cost or free services. A representative from a content provider said that revenue from targeted advertising helps allow some content providers’ services to be offered to consumers at little or no charge. Instead of charging a subscription fee, a social media company may be able to provide free service because it uses information that it collects from consumers to target advertisements to users on a customized, user-by-user basis. These ads are targeted to users based on interests they express through their use of social media, among other things. According to a representative from an Internet search engine, using consumer data for targeted advertising may be relatively less important for some kinds of content providers, such as search engines. This company representative said that search engines may use keywords entered for a particular Internet search to provide advertisements relevant to the search. For example, a search for “car insurance” can offer the consumer advertisements from car insurance companies without any additional data from the consumer other than the search’s keywords. Supports innovation and customization. According to some stakeholders, the collection and use of data also benefit consumers through other means such as providing innovative products or customized services. According to a representative from a content provider, the collection of personal information, with consent, for commercial purposes can at times have benefits. The representative said, for example, that collection of images containing identifiable information, like faces, can help in the development of new technologies such as object and facial recognition. According to two content providers, consumers may also benefit from customized services and content. For example, according to a representative from a travel-related company, that company can collect information about a consumer to suggest travel itineraries and suggestions for activities. Additionally, representatives from a consumer advocacy group and a content provider stated that direct-marketing approaches are enabled through data collection. Such marketing approaches allow consumers to receive advertisements that are uniquely tailored to their interests. For example, a consumer that a content provider has identified as being a hiker may receive advertisements for hiking boots. Despite these benefits, public opinion surveys have shown concerns about the collection and use of consumers’ information on the Internet. For instance, recent analyses based on surveys by the Pew Research Center and NTIA showed that the public lacks trust in Internet privacy, a concern that may limit economic activities. NTIA’s survey results show that privacy concerns may lead to lower levels of economic productivity as people decline to make financial transactions on the Internet. According to the NTIA analysis, in 2017, 24 percent of American households surveyed avoided making financial transactions on the Internet due to privacy or security concerns. Consumers NTIA surveyed indicated that their specific concerns were identity theft, credit card or banking fraud, data collection by online services, loss of control over personal information, data collection by government, and threats to personal safety. Stakeholders we interviewed elaborated on some of these concerns: Public disclosure and data breaches. Some stakeholders, including representatives from content providers, said that personal information from the Internet can be publicly disclosed, including through data breaches. An academic and a former FCC commissioner told us that such disclosures are becoming more frequent. Various consumer advocacy groups and state governments continue to report data breaches. This personal information can include financial information such as credit card information, the disclosure of which can result in financial harm to the consumer. It can also include other kinds of sensitive information such as political views or medical conditions, the disclosure of which can cause non-financial harms such as embarrassment or harassment. According to public reports, the 2017 breach of consumer information from Equifax, a credit-reporting agency, resulted in the disclosure of 143 million American consumers’ sensitive information. According to NTIA’s 2017 survey, 45 percent of households surveyed reported major concerns about credit card fraud. Regarding non-financial information, in a recent case FTC alleged that an Internet-based company publicly disclosed patients’ sensitive medical information without their knowledge after patients submitted what they thought were confidential reviews of physicians. According to FTC, these reviews were then publicly posted on the company’s website. Financial and other harms. Stakeholders identified both potential financial and non-financial harms associated with misuse of personal information from the Internet. A former FTC acting chair has said that privacy and data-security incidents can cause injuries that do not only involve financial loss and that it may be difficult to measure this type of non-financial injury. In a February 2018 speech, this former acting FTC chair cited a case that the agency filed involving the misuse of personal information from the Internet that resulted in people losing jobs or job opportunities or being threatened, stalked, and harassed. The acting chair said that in another case, there was evidence that several people committed suicide after their names and other data were disclosed. The commission can, by bringing suit in district court, obtain an order compelling content providers to provide monetary relief to consumers if a data disclosure results in financial harm to a consumer. However, an academic noted that many data disclosures of sensitive information cannot be financially redressed; information can indefinitely persist on the Internet once it is disclosed. Consumers’ lack of understanding. A range of stakeholders we interviewed, including those from industry, said that consumers lack an understanding of how their data are collected and used. Some stakeholders said content providers are insufficiently transparent about how they collect and use data. For instance, content providers’ privacy policies, according to various stakeholders, may contain technical language that is difficult for typical consumers to understand, may be located in a difficult-to-access or inconspicuous part of the content provider’s website, or may be lengthy to the point where it becomes prohibitively difficult for a consumer to set aside enough time to read. Furthermore, according to an academic, companies may have an incentive to intentionally obscure their privacy practices, since clarity could put the companies at a competitive disadvantage. The academic also stated that different privacy policies may apply to different parts of a consumer’s experience on a single website. For example, the academic described how a website may have contracts with third-party vendors for specific services included on the website that consumers use, such as an online shopping cart’s features. The privacy policy for the website and the third-party shopping cart can be separate and unrelated to each other, and consumers may not be aware of this since these policies may never appear to consumers or be hard to obtain. A representative from a consumer advocacy group also mentioned that consumers may be unaware that companies track consumers’ Internet activity in order to target those consumers with customized prices. An academic said that these practices may disproportionately affect people with low computer literacy, as they may not be aware of tracking or know of ways to counteract it. In 2015, we found that the lack of computer and Internet skills is one of the primary barriers people face in using the Internet and that this is a particular problem for certain demographic segments who may lack exposure to or knowledge about computers, such as those of age 65 and older and those with low levels of income and education. Consumer lack of control. Some academics and consumer advocacy groups also identified a lack of control as a concern with respect to Internet privacy—consumers have little or no control over how their information is collected, used, and shared. In a 2015 survey conducted by Pew Research Center, 65 percent of respondents said it is very important to be in control of what information is collected about them. However, according to an academic and a consumer advocacy group we interviewed, privacy policies offer consumers little or no bargaining power, and consumers may be forced to either accept the terms of the policy as written or not use the application or service at all. Furthermore, we recently reported that sometimes consumers’ information is used for purposes that are altogether separate from what those consumers originally anticipated. For example, FTC alleged in an enforcement action that in 2009 and 2010, a company told consumers that it would track the websites they visited in order to provide them with personalized offers, when in fact the company was also transmitting credit card information it collected through such tracking to third parties. The company settled with FTC. We also recently reported on how devices that comprise the Internet of Things pose privacy concerns for consumers, including that information collected by such Internet-connected devices can be used in ways to which the consumer was not given the option to opt out. As discussed above, stakeholders described various types of harm that could result from Internet privacy violations. Regardless of whether violations involve financial or other types of harm, a challenging factor in providing Internet privacy oversight is identifying the responsible parties. A former federal government official with experience in privacy issues said that it frequently is difficult to identify which Internet entity in the chain is ultimately responsible for a privacy-related harm. For example, if a consumer is harmed by the theft of his or her Social Security number, it can be difficult to determine which entity is responsible if multiple entities have suffered data breaches of information systems that contained the Social Security number. In addition to the challenges in identifying responsible parties, the federal government has faced challenges in providing Internet privacy oversight. Our prior work has found that such efforts lack clearly defined roles, goals and performance measures, and that gaps exist in the current privacy framework. We found that during the last decade, FTC filed 101 Internet privacy enforcement actions for practices that the agency alleged were unfair, deceptive, a violation of COPPA, a violation of a settlement agreement, or a combination of those reasons. Most of these actions pertained to first-time violations of the FTC Act for which FTC does not have the authority to levy civil penalties. In those cases where a party violated an FTC regulation or settlement agreement, however, FTC does have the authority to impose civil penalties. The 101 cases—filed between July 1, 2008 and June 30, 2018—involved a variety of products, services, and industries that collect and use personal information from the Internet. During the years for which we examined full-year data, the number of enforcement actions taken per year ranged from 5 in 2010 and 2016 to 23 in 2015. For example, in recent years, FTC took enforcement action against the following entities for alleged conduct that the agency contended violated section 5 or COPPA: a toy manufacturer for collecting personal information from children online without providing direct notice and obtaining their parents’ consent; a computer manufacturer for pre-loading laptops with software that compromised security protections in order to deliver ads to consumers; a mobile ride-hailing business for misrepresenting the extent to which it monitored its employees’ access to personal information about users; a television manufacturer for installing software on its televisions to collect viewing data on 11 million consumers without their knowledge or consent and providing the viewing data to third parties; and a mobile advertising network for deceptively tracking the locations of hundreds of millions of consumers, including children, without their knowledge or consent, to serve them geographically targeted advertising. Of the 101 actions filed during the 10-year period, 51 involved Internet content providers, 21 involved software developers, 12 involved the sale of information or its use in advertising, 5 involved manufacturers, 1 involved an Internet service provider, and 11 involved a variety of different products, such as those provided by rent-to-own companies or certification services. In nearly all 101 cases, companies settled with FTC, which required the companies to make changes in their policies or practices as part of the settlement. FTC levied civil penalties against two of those companies for violating their settlement agreements. Also during this 10-year period, FTC levied civil penalties against 15 companies (a total of $12.7 million) for alleged violations of the COPPA regulations. The COPPA civil penalties ranged from $50,000 to $4 million and the average amount was $847,333. FTC can also seek to compel companies to provide monetary relief to those they have harmed. During this time period, FTC levied civil penalties against companies for violations of consent decrees or ordered monetary relief to consumers from companies for a total of $136.1 million. These payment orders ranged from $200,000 to $104.5 million and the average amount was $17 million. In the majority of these 101 enforcement actions that FTC settled, FTC alleged that companies engaged in practices that were deceptive. Examples of the charges FTC brought include: “Deceptive practices” cases (61 cases): In 2016, FTC alleged that Turn, Inc., an Internet advertising company, continued to track the Internet activities of consumers for targeted advertising purposes after the company had made representations that it would stop doing so. According to FTC, the company led consumers to believe they could turn off such tracking when in fact they were unable to do so. “Unfair practices” cases (4 cases): In 2014, FTC alleged that LeapLab, a data broker, knowingly provided scammers with hundreds of thousands of consumers’ sensitive personal information, including Social Security and bank account numbers. “Unfair and deceptive” practices cases (19 cases): In 2015, FTC alleged that Equiliv Investments, a software developer, lured consumers into downloading its “rewards” application, saying it would be free of malware, when the application’s main purpose was actually to load the consumers’ mobile phones with malicious software to mine virtual currencies for the developer. COPPA and COPPA regulations cases (6 cases): In 2011, FTC alleged that Broken Thumbs Apps, a software developer, had collected information from Internet applications that the developer specifically targeted toward children under the age of 13. FTC’s complaint stated that the company had, among other things, failed to provide notice of what information it collected and how it was used and also had failed to inform parents of these practices and receive their consent as COPPA required. Violation of settlement agreement cases (2 cases): In 2012, Google agreed to pay a $22.5 million civil penalty to settle FTC charges that it misrepresented to users of Apple’s Safari Internet browser that Google would not place tracking cookies or provide targeted ads to those users, violating an earlier settlement agreement between the company and FTC. In 14 of the 101 cases, FTC required companies to be audited by outside entities to monitor compliance with the terms of the settlement. The audit period ranged from 5 years to 20 years, with an average of 17.5 years. As noted above, 2 of the 101 cases involved a violation of FTC settlement agreements. In addition, in March 2018, FTC announced that it is investigating whether Facebook’s privacy practices violate a 2012 Facebook settlement agreement with FTC. In the case that resulted in the 2012 settlement, FTC charged Facebook with deceiving consumers by telling them they could keep their information private, but then allowing it to be shared and made public. Appendix II contains more detailed information about the 101 cases. As stated earlier, in 2015, FCC classified broadband Internet service as a telecommunications service, placing primary oversight of broadband Internet service providers’ privacy practices under FCC’s jurisdiction instead of FTC’s jurisdiction. In 2016, FCC filed a privacy enforcement action against a mobile Internet service provider, alleging, in part, violation of section 222 of the Communications Act and FCC’s Open Internet Transparency Rule. Section 222 requires telecommunications carriers to protect the confidentiality of customers’ proprietary information. In that case, FCC fined Verizon Wireless $1.4 million for failing to disclose that it was inserting “unique identifier headers,” also called “perma- cookies” or “super cookies” (mobile web tracking cookies that users cannot remove), into customers’ Internet traffic over its wireless network. Although the settlement was finalized during the 2015-2017 period when FCC had asserted jurisdiction over the privacy practices of Internet providers, the Verizon Wireless practices occurred prior to the classification of Internet service providers as telecommunications carriers. The investigation therefore did not rely upon FCC’s subsequent assertion of authority over Internet service providers’ privacy practices. In October 2016, after FCC had reclassified broadband as a telecommunications service, the commission issued Internet service provider privacy regulations, asserting its authority under section 222 of the Communications Act. In April 2017, however, Congress repealed these regulations under the Congressional Review Act before they took effect. In December 2017, FCC then reversed its 2015 classification of broadband, and oversight of broadband Internet service providers’ privacy practices reverted to FTC once the decision took effect in June 2018. In explaining the December 2017 decision, FCC’s new chair said that FTC’s privacy oversight approach regarding Internet service providers—using its authority to protect consumers against unfair, deceptive, and anti- competitive practices—had worked well in the past and that this action would “put the nation’s most experienced privacy cop back on the beat.” Under FCC’s new legal approach, it no longer asserts jurisdiction to take enforcement action against Internet service providers for privacy-related matters, including mobile Internet service providers. As part of FTC’s resumption of Internet service provider oversight, FCC and FTC entered into a memorandum of understanding in December 2017 spelling out their roles and responsibilities regarding oversight of these companies. FTC staff said that they regularly communicate with FCC and have an agreement to share Internet privacy complaints. As previously discussed, no federal statute comprehensively and specifically governs Internet privacy across all sectors. FTC oversees some aspects of Internet privacy by using its FTC Act section 5 authority to protect consumers from unfair and deceptive practices. FTC also uses its specific COPPA authority to police the collection and use of personal information from children by online services. Some industry representatives said that FTC’s enforcement has been effective because the agency has expertise and experience in privacy issues and has the flexibility to take enforcement action on a case-by-case basis. In addition, a content provider said that FTC has taken enforcement actions against companies of various sizes in different sectors and has a powerful tool by being able to require companies to be audited by outside entities for up to 20 years. Industry stakeholders we interviewed generally said that “direct enforcement” of a statute is preferable to promulgating and enforcing regulations implementing that statute (which constitutes enforcement of the statute as well). These stakeholders noted several key concerns they believe exist with regulatory versus statutory enforcement of Internet privacy: Regulations can stifle innovation. Two industry stakeholders said that regulations can hinder companies’ ability to innovate. For example, representatives from an Internet service provider said that innovation can stop during the rulemaking process as the industry waits for the regulation to be finalized. Regulations may create loopholes. Representatives from an Internet industry group and a content provider said that regulations can also contain loopholes that can be legally exploited because imprecise language in a regulation may allow a company to legally engage in an action that was originally unforeseen by the regulator. Regulations can become obsolete. Several industry stakeholders said regulations also may become obsolete quickly because the Internet industry is rapidly changing. An Internet industry representative noted that there can be large shifts in the Internet industry from year to year, while it often takes an agency much longer than a year to adopt a rule. Industry stakeholders said the flexibility of FTC’s approach allows FTC to adapt continuously to changing market conditions. Rulemakings can be lengthy. FCC officials said that in some cases, rulemakings can take a long time, especially when the issues are complex and there is no statutory deadline. Our previous work on rulemaking found that length of time required for the development and issuance of final rules varied both within and among agencies. Additionally, while some stakeholders suggested that regulations can clarify acceptable practices, other stakeholders, including from industry and academia, said that enforcement actions can send a similar message. According to both a representative from a content provider and an academic, enforcement actions such as settlement agreements, for example, establish precedents that companies can follow, similar to the way that case law developed by courts provides guidance for companies. Although some industry representatives we interviewed said that FTC’s use of settlement agreements provides companies with guidance, certain trade associations took a different position in a recent case brought before the U.S. Court of Appeals for the Third Circuit, FTC v. Wyndham Worldwide Corp. 799 F.3d 236 (3d Cir. 2015). However, the court did not agree with the associations’ arguments. The case involved an enforcement action against Wyndham Worldwide Corporation where FTC alleged that data security failures led to three data breaches at the company in less than 2 years. The court considered whether FTC could bring an enforcement case involving cybersecurity using FTC’s section 5 “unfair practices” authority and, if so, whether Wyndham had “fair notice” that its specific cybersecurity practices could be deemed “unfair.” A group of companies and the U.S. Chamber of Commerce wrote a friend- of-the-court brief supporting Wyndham, criticizing FTC’s “regulation- through-settlements” approach. The companies argued this approach subjects businesses to “vague, unknowable, and constantly changing data-security standards” and businesses often are unaware of the standards to which they are held until after they receive a notice of investigation from FTC, at which point they must settle or expend considerable resources fighting the agency. Potential Limits on Federal Trade Commission (FTC) Remedies A recently decided federal appeals court case illustrates potential limits on the remedies that FTC can order in an “unfair practices” enforcement proceeding. In this 2018 case, LabMD, Inc. v. FTC, 891 F.3d 1286 (11th Cir. 2018), the U.S. Court of Appeals for the Eleventh Circuit found that FTC could not direct a medical laboratory to create and implement wholesale data-security protective measures as a remedy to the laboratory’s alleged unfair practices. FTC had filed a complaint against LabMD under section 5 of the FTC Act for allegedly committing an unfair act or practice by failing to provide reasonable and appropriate security for personal information on its computer networks. The commission found that LabMD’s inadequate security constituted an unfair act or practice and ordered LabMD to take various actions, including establishing and maintaining a reasonable and comprehensive information security program. On appeal, the Eleventh Circuit ruled that FTC’s order exceeded its authority because it did not prohibit a specific act or practice but instead, mandated a complete overhaul of the company’s data-security program. FTC had argued that the FTC Act gives it broad discretion to prevent unfair or deceptive acts or practices that injure the general public and that FTC had spelled out standards for LabMD to craft a reasonable security program. The court ruled, however, that such a general approach would make it difficult for a reviewing court to determine if LabMD had complied with the order, in the event of a future FTC challenge. company can reasonably foresee that a court could construe its conduct as falling within the meaning of the statute.” A majority of non-industry stakeholders we interviewed identified limitations in the current Internet privacy oversight approach because they view regulations in conjunction with enforcement as being more effective. These stakeholders include all of the former FTC commissioners we interviewed, three of the four former FCC commissioners we interviewed, and representatives from consumer advocacy groups we interviewed. In addition, a former FCC commissioner said that the current Internet privacy oversight approach is limited in part because he viewed regulations applying equally to all players in the Internet ecosystem in conjunction with enforcement as being more effective. A representative from a consumer advocacy group also said that regulations in conjunction with enforcement are essential for effective privacy protection. Some of these stakeholders noted key ways that they believe Internet privacy regulations can provide clarity to industry and consumers, as well as fairness and flexibility in enforcement: Regulations can provide clarity. An Internet industry group representative said that various companies have favorable views of regulations because they can provide clear expectations about what actions are permissible. Similarly, a former congressional staff member with expertise on privacy issues said that some companies have favorable views of regulations because the regulations often provide clearer expectations about what the companies can do. FCC officials said that with respect to telephone privacy provisions of the Communications Act, the telephone industry wanted rules because it sought greater clarity about what it should be doing, what constituted a violation, how to comply, and what behaviors were acceptable. Regulations may promote fairness. Some other stakeholders discussed the ability of regulations to provide fairness. For example, a former federal enforcement official described regulations as creating a fair and consistent oversight regime across the entire industry in a way that case-by-case enforcement actions do not. Another former federal enforcement official said that regulations give companies fair notice of what actions may be violations and thus help those companies avoid surprising or unexpected enforcement. Regulations can be flexible. An academic said that by targeting behaviors and not specific technologies, regulations can be written in such a way that they do not become obsolete. An academic also said that regulations based on broad performance-standards principles can avoid being overly prescriptive. FCC officials also noted that regulations can be amended to adapt to changes in technology often faster than new laws can be enacted. Furthermore, regulations determined to be obsolete can be repealed. FTC staff told us that the agency systematically reviews all of its regulations every 10 years, even though it is only legally required to review its most significant ones, and that the number of FTC regulations has decreased because the agency determined prior ones were obsolete. The Regulatory Flexibility Act requires federal agencies to analyze the effect of their regulations on small entities. Regulations can be a deterrent. FCC officials said that rules can have a deterrent effect on bad practices in the industry or have a role in mitigating the negative effects of bad practices after they occur. They said, for example, that the practice of pretexting (improperly obtaining people’s telephone records) was greatly curtailed by an FCC regulation prohibiting such practices. They also said that rules can foreclose arguments by companies claiming that because no rule was in place, they had no reasonable notice or awareness that they should behave in a particular way. Consumer advocacy groups and other stakeholders, including some former FTC and FCC commissioners, had concerns about the efficacy of an enforcement approach such as FTC’s approach to Internet privacy oversight, which focuses on enforcing a statute rather than implementing regulations. They said that FTC’s enforcement approach limits the ability of the agency to affect companies’ behavior, and that any enforcement activity occurs after the violation, undesirable behavior, harm, or illegal action has already occurred. A former federal enforcement official also said that regulations can prevent companies from engaging in bad practices in the first instance and thus have a preventive effect. A former FCC commissioner said that by the nature of a direct statutory- enforcement approach (as opposed to rulemaking), an agency would only address a harm after it has occurred. As discussed above, for example, data often cannot be removed from the Internet because copies of the data can exist among many bad actors, and it can be difficult to identify the entity responsible for unwanted disclosures. Therefore, it may be more important to avoid such Internet privacy harms from occurring in the first place. Another former FCC commissioner told us that Internet privacy oversight should be returned to FCC because it has APA section 553 notice-and-comment rulemaking authority and considerable enforcement experience. Representatives from consumer advocacy groups said that FTC’s enforcement action has been insufficient because it investigates only a small portion of actual Internet-privacy violations or takes action regarding only the most egregious or outrageous cases that it can win. FTC has also stated in its strategic plan that it focuses on investigating and litigating cases that cause or are likely to cause substantial injury to consumers and that by focusing on practices that are actually harming or likely to harm consumers, FTC can best use its limited resources. Representatives from an Internet association said that FTC’s Internet- privacy enforcement actions should focus on concrete harms. An FTC staff member from the Division of Privacy and Identity Protection said that the agency has been effective with the limited enforcement resources it has available. Furthermore, the staff member said the agency uses no formal written criteria or template to assess individual cases but considers the size and scale of a company’s effect on consumer privacy when deciding whether to take enforcement action. However, a former FTC commissioner told us that the agency needs more resources to effectively oversee Internet privacy. We asked stakeholders whether it was clear under what circumstances FTC will take Internet privacy enforcement action. In response, some stakeholders said that FTC’s enforcement priorities are reflected in its settlement agreements, which provide information that is similar to a body of case law. Individual commissioners also may issue statements explaining their decisions. Two stakeholders also said that FTC’s closing letters, which the agency sends to companies and posts on its website when it closes an investigation without taking enforcement action, may explain its decisions. Other stakeholders said that more guidance would be helpful to provide additional clarity on how the agency uses its Internet privacy enforcement authority. FTC staff and other stakeholders also said that FTC has provided useful Internet privacy guidance. For example, in 2015, FTC published guidance for businesses on complying with COPPA. Various stakeholders we interviewed said that opportunities exist for enhancing Internet privacy oversight. A key component of FTC’s mission, as specified by the FTC Act, is to protect consumers against unfair and deceptive practices. As discussed earlier, some stakeholders believe that FTC’s reliance on its unfair and deceptive practices authority to address Internet privacy issues has limitations. In addition, although the Fair Information Practice Principles provide internationally recognized principles for protecting the privacy and security of personal information, they are not legal requirements and FTC cannot rely on them to define what constitutes unfair and deceptive practices related to privacy and data security. We stated in our 2013 information resellers report that the current U.S. privacy framework is not always aligned with the Fair Information Practice Principles and that these principles provide a framework for balancing the need for privacy with other interests. We found that there are limited privacy protections under federal law for consumer data used for marketing purposes. We said that although the Fair Information Practice Principles call for restraint in the collection and use of personal information, the scope of protections provided under current law has been narrow in relation to: (1) individuals’ ability to access, control, and correct their personal data; (2) collection methods and sources and types of consumer information collected; and (3) new technologies, such as tracking of web activity and the use of mobile devices. Although we recommended in that report that Congress consider strengthening the consumer privacy framework to reflect the effects of changes in technology and the marketplace, this matter for congressional consideration was not specific to Internet privacy or to the oversight authorities of any particular agency or agencies. As noted above, various stakeholders expressed concern about the ability of consumers to control their data and understand how that data are used. These concerns suggest that companies are not always following the Fair Information Practice Principles, such as that companies’ data practices should be transparent, allow consumers the right to access and edit their data, and limit the collection of data to the extent feasible. Those stakeholders who believe that FTC’s current authority and enforcement approach is unduly limited identified three main actions that could better protect Internet privacy: (1) enactment of an overarching federal privacy statute to establish general requirements governing Internet privacy practices of all sectors; (2) APA section 553 notice-and- comment rulemaking authority; and (3) civil penalty authority for any violation of a statutory or regulatory requirement, rather than allowing penalties only for violations of settlement agreements or consent decrees that themselves seek redress for a statutory or regulatory violation. Stakeholders from a variety of perspectives—including from academia, industry, consumer advocacy groups, and former FTC and FCC commissioners—told us that a privacy statute could enhance Internet privacy oversight by, for example, clearly articulating to consumers, industry, and privacy enforcers what behaviors are prohibited, among other things. In addition, a former FCC commissioner said that a new privacy statute could enhance Internet privacy oversight by creating uniform standards for all players in the Internet ecosystem that is focused on the consumer rather than the regulatory legacy of the companies involved (regulations that apply to specific types of companies based on what they are or used to be, such as telecommunications carriers, cable companies, broadcasters, and mobile wireless providers). The former FCC commissioner said that as companies, technologies, and markets change, there is a question about whether existing law should be modernized. In 2015, FTC staff recommended that Congress enact broad-based legislation that is flexible and technology-neutral, while also providing clear rules of the road for companies about such issues as how to provide choices to consumers about data collection and use practices. Some stakeholders suggested that such a framework could either designate an existing agency as responsible for privacy oversight (such as FTC) or create a new privacy-oriented agency. A representative from a consumer advocacy group mentioned that the European Union, for example, has established the European Data Protection Supervisor, an independent data protection authority, to monitor and ensure the protection of personal data and privacy. Similarly, in Canada, the Office of the Privacy Commissioner, an independent body that reports directly to the Parliament, was established to protect and promote individuals’ privacy rights. Some stakeholders also stated that the absence of a comprehensive Internet privacy statute affects FTC’s enforcement. For example, a former federal enforcement official said that FTC is limited in how it can use its authority to take action against companies’ unfair and deceptive trade practices for problematic Internet privacy practices. Similarly, another former federal enforcement official said that FTC is limited in how and against whom it can use its unfair and deceptive practices authority noting, for example, that it cannot pursue Internet privacy enforcement over exempted industries such as common carriers. In addition, a former FCC commissioner said that it is more difficult for FTC to take effective action because its enforcement comes only after a complaint and after an often lengthy review process. The former FCC commissioner also said that without “ex ante” rules (rules that define prohibited activity before it has occurred), there inevitably will be delay, confusion, and lack of knowledge about what is and is not acceptable behavior. In addition, some stakeholders—including a representative from a consumer group, a former federal enforcement official, and a former FCC commissioner—said FTC’s section 5 “unfair or deceptive practices” authority may not enable it to fully protect consumers’ Internet privacy because it can be difficult for FTC to establish that Internet privacy practices are legally “unfair.” For example, under section 5, FTC has charged companies with committing a “deceptive” practice if their privacy policies said they would not collect or use consumers’ personal information but then did so. However, a former congressional staff member said that companies often write broad and vague policy statements, making it difficult for FTC to charge companies with committing deceptive practices. Instead, according to a representative from a consumer advocacy group, FTC would have to show the companies’ actions were “unfair,” which, according to the representative, is legally difficult to establish. We found in our 2017 report on vehicle data privacy that most automakers’ written privacy notices used vague language. Similarly, we found in our 2012 report on mobile device location data that although companies’ policies stated that they shared location data with third parties, they were sometimes vague about which types of companies these were and why they were sharing the data. Some stakeholders said that FTC relies more heavily on its authority to take enforcement action against deceptive trade practices compared with the agency’s unfair trade practices authority. This was confirmed in our analysis of FTC’s Internet privacy enforcement actions discussed previously. However, a representative from a consumer advocacy group said that FTC’s ability to take such action is limited practically to instances where a company violates its own privacy policy—companies generally can collect and use data in any way they want if they include language in their policies asserting their intent to do so. According to a former FCC commissioner, a privacy statute could clarify the situations in which FTC could take enforcement action. Various stakeholders said that there are advantages to overseeing Internet privacy with a statute that provides APA section 553 notice-and- comment rulemaking authority. As discussed above, that provision lays out the basic process by which so-called informal agency rulemaking shall be conducted, namely, publication of proposed regulations in the Federal Register; an opportunity for public comment (written and possibly oral submission of data and views); and publication of final regulations in the Federal Register with an explanation of the rules’ basis and purpose. Also as noted above, Congress imposed additional rulemaking steps on FTC in the Magnuson-Moss Act when FTC is promulgating rules under section 5 of the FTC Act. These additional steps include providing the public and certain congressional committees with advance notice of proposed rulemaking (in addition to notice of proposed rulemaking). FTC’s rulemaking under Magnuson-Moss also calls for, among other things, oral hearings, if requested, presided over by an independent hearing officer, and preparation of a staff report after the conclusion of public hearings, giving the public the opportunity to comment on the report. Finally, Congress made it easier for the public to appeal FTC’s Magnuson-Moss rules by making the agency meet a higher standard when the rules are challenged in court. FTC staff said that these additional steps add time and complexity to the rulemaking process. In congressional testimony in 2010, the then-Director of FTC’s Bureau of Consumer Protection said that “if Congress enacts privacy legislation, the commission agrees that such legislation should provide APA rulemaking authority to the commission.” According to FTC, this testimony was voted on and approved by the commissioners and, therefore, constituted the commission’s official position at the time. Moreover, according to stakeholders, in many cases regulations can be used to implement statutes. Officials from other consumer and worker protection agencies we interviewed described their enforcement authorities and approaches. For example, officials from the CFPB and the FDA, both of which use APA section 553 notice-and-comment rulemaking, said that their rulemaking authority assists in their oversight approaches and works together with enforcement actions. OSHA officials said that the standards that the agency promulgates under its authority specify what employers are required to do to reduce safety and health risks to workers. Such standards lay out the workplace conditions that must be maintained by employers and require that employers implement certain practices, operations, or processes that ensure worker protections. EEOC officials said that regulations are used to guide investigations that establish whether enforcement action is appropriate. CPSC officials said that the agency conducts consumer protection not only by establishing and enforcing mandatory regulations, but also through collaborative actions such as educating industry, developing consensus voluntary safety standards, removing defective products from the marketplace through voluntary corrective actions, and litigating when necessary. In addition, in contrast to FTC’s approach, FCC has APA section 553 notice-and-comment rulemaking authority and has issued regulations implementing section 222 of the Communications Act using that rulemaking authority to protect the privacy of telephone users. Some stakeholders suggested that FTC’s current ability to levy civil penalties could also be enhanced. Currently, FTC can levy civil penalties against companies for violating certain regulations, such as COPPA regulations, or if the company violates the terms of a settlement agreement already in place. According to most former FTC commissioners and some other stakeholders we interviewed, FTC should be able to levy fines for initial violations of section 5 of the FTC Act. An academic told us that the power of an agency to levy a fine is a tangible way to hold industries accountable. Another academic noted, however, that fines may be relatively less effective in industries where there is limited competition because the costs of those fines may be more effectively passed on to consumers in the form of higher prices for services. In addition, some stakeholders said that payments required by FTC orders are not large enough to act as a deterrent and that companies may consider them to be a cost of doing business. There is a growing debate about the federal government’s role in overseeing Internet privacy. In a July 2018 congressional hearing, FTC’s new chair testified that the FTC Act cannot address all privacy and data- security concerns in the marketplace. The chair said, for example, that FTC’s lack of civil penalty authority for violations of the FTC Act reduces its deterrent capability. He also noted the agency lacks authority over non-profits and over common carrier activity, even though those entities and activities often have serious implications for consumer privacy and data security. In November 2018, FTC’s chair testified before Congress and urged Congress to consider enacting privacy legislation that would be enforced by FTC. A majority of the commission has indicated support for APA rulemaking and civil penalty authority for privacy. FTC also held hearings in September, November, and December 2018 to advance the discussion around privacy issues, among other topics, and FTC plans to hold an additional hearing on data security and consumer privacy in February 2019. In a Federal Register notice, FTC announced that it is interested in the benefits and costs of various state, federal and international privacy laws and regulations, including the potential conflicts among those standards. FTC also indicated that it is particularly interested in the efficacy of the commission’s use of its current authority and the identification of any additional tools or authorities the commission may need to adequately deter unfair and deceptive conduct related to privacy and data security. Also in July 2018, an NTIA official announced that NTIA, in coordination with the Commerce Department’s International Trade Administration and National Institute of Standards and Technology, had recently started holding stakeholder meetings to identify common ground and formulate core, high-level principles on data privacy. Regarding the development of the Administration’s approach to consumer privacy, in September 2018, NTIA requested comments on ways to advance consumer privacy while protecting prosperity and innovation. Our 2009 report on a framework for assessing proposals for modernizing the financial regulatory system similarly found that regulators should have the authority to carry out and enforce their statutory missions. We further said that a regulatory system should be flexible and forward looking, allowing regulators to readily adapt to market innovations and changes, including identifying and acting on emerging risks in a timely way without hindering innovation. These factors are useful considerations as the federal government explores how it can better oversee privacy and data security. Having sufficient and appropriate authorities and providing flexibility to address a rapidly evolving Internet environment could better ensure that the federal government can protect consumers’ privacy. Recent developments regarding Internet privacy suggest that this is an appropriate time for Congress to consider comprehensive Internet privacy legislation. Although FTC has been addressing Internet privacy through its unfair and deceptive practices authority, among other statutes, and other agencies have been addressing this issue using industry-specific statutes, there is no comprehensive federal privacy statute with specific standards. Debate over such a statute could provide a vehicle for consideration of the Fair Information Practice Principles, which are intended to balance privacy concerns with the need for using consumers’ data. Such a law could also empower a specific agency or agencies to provide oversight through means such as APA section 553 rulemaking, civil penalties for first time violations of a statute, and other enforcement tools. Comprehensive legislation addressing Internet privacy that establishes specific standards and includes APA notice-and-comment rulemaking and first-time violation civil penalty authorities could help enhance the federal government’s ability to protect consumer privacy, provide more certainty in the marketplace as companies innovate and develop new products using consumer data, and provide better assurance to consumers that their privacy will be protected. Congress should consider developing comprehensive legislation on Internet privacy that would enhance consumer protections and provide flexibility to address a rapidly evolving Internet environment. Issues that should be considered include: which agency or agencies should oversee Internet privacy; what authorities an agency or agencies should have to oversee Internet privacy, including notice-and-comment rulemaking authority and first-time violation civil penalty authority; and how to balance consumers’ need for Internet privacy with industry’s ability to provide services and innovate. We provided a draft of this report to FTC, FCC, and the Department of Commerce for their review and comment. FTC and FCC provided technical comments, which we incorporated as appropriate. The Department of Commerce indicated that it did not have comments. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the FTC chair, the FCC chair, the Secretary of Commerce, and interested congressional committees. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or members of your staff have any questions about this report, please contact Alicia Puente Cackley at (202) 512-8678 or cackleya@gao.gov or Mark Goldstein at (202) 512-2834 or goldsteinm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Major contributors to this report are listed in appendix III. For this review, we interviewed staff from agencies with roles in Internet privacy; officials from other consumer- and worker-protection agencies; stakeholders from consumer advocacy groups, industry groups, Internet service providers, and Internet content providers; academics; and former government officials. To obtain a variety of perspectives, we selected Internet service providers that represented different industry sectors and Internet content providers that provide a variety of information and social media services. Academic stakeholders were selected because of their expertise in privacy, consumer protection, and regulatory issues. We also interviewed former Federal Trade Commission (FTC) and Federal Communications Commission (FCC) commissioners who served during the Barack Obama and George W. Bush administrations and are from different political parties. Consumer Financial Protection Bureau (CFPB) Consumer Product Safety Commission (CPSC) Department of Commerce, National Telecommunications and Information Administration (NTIA) Equal Employment Opportunity Commission (EEOC) Federal Communications Commission (FCC) Federal Trade Commission (FTC) Food and Drug Administration (FDA) Occupational Safety and Health Administration (OSHA) The following table identifies 101 Federal Trade Commission (FTC) Internet privacy enforcement actions filed between July 1, 2008 and June 30, 2018 in which the agency alleged a violation of either the Federal Trade Commission Act (FTC Act) or the Children’s Online Privacy Protection Act (COPPA) and implementing COPPA regulations and subsequently entered into a settlement agreement with the target entity. Although some of these cases may involve both Internet data privacy and security issues, this table does not include cases that involved data security issues only. In addition to the contact names above, Andrew Huddleston, Assistant Director; Kay Kuhlman, Assistant Director; Bob Homan, Analyst-in- Charge; Melissa Bodeau; John de Ferrari; Camilo Flores; Erica Miles; Josh Ormond; and Sean Standley made significant contributions to this report.

Question: Write a one-page summary of the report 1.

Answer: As the opioid crisis has increased in recent years, so has the number of pregnant women who use opioids, which can result in NAS. A recent peer-reviewed study found that cases of NAS have grown nearly five-fold between 2000 and 2012 and that most infants with NAS are covered under Medicaid. The Comprehensive Addiction and Recovery Act of 2016 includes a provision for GAO to examine NAS in the United States and related treatment services covered under Medicaid. This report 1) describes the hospital and non-hospital settings for treating infants with NAS and how Medicaid pays for services, 2) describes recommended practices and challenges for addressing NAS, and 3) examines HHS's strategy for addressing NAS. GAO reviewed HHS documentation and interviewed HHS officials. GAO also conducted site visits to four states—Kentucky, Vermont, West Virginia, and Wisconsin—selected based on several factors, including incidence rates of NAS and geographic variation. GAO interviewed stakeholders from 32 organizations, including health care providers and state officials in the selected states. The prenatal use of opioids or other drugs can produce a withdrawal condition in newborns known as neonatal abstinence syndrome (NAS). Health care providers, state officials, and other stakeholders told GAO that most infants with NAS are treated in the hospital—such as in a neonatal intensive care unit—though some may be referred to a non-hospital setting—such as a neonatal withdrawal center with nursery rooms—to complete their treatment. The table below provides more information on settings for treating infants with NAS and on how Medicaid pays for services in these settings. According to stakeholders GAO interviewed and literature reviewed, there are several recommended practices and challenges associated with addressing NAS. The most frequently recommended practices included prioritizing non-pharmacologic treatment to infants—treatment that does not involve medications—such as allowing the mother to reside with the infant during treatment; educating mothers and health care providers on treatment of NAS, among other things; and using a protocol in the hospital or non-hospital setting for screening and treating infants with NAS. The most frequently cited challenges included the maternal use of multiple drugs—or polysubstance use—as it can exacerbate NAS symptoms; stigma faced by pregnant women who use opioids; hospital staff burden and limited physical capacity to care for infants with NAS; limited coordination of care for mothers and infants with NAS; and gaps in research and data on NAS, such as research on the long-term effects of the condition. In May 2017, the Department of Health and Human Services (HHS) published a strategy document that makes key recommendations to address NAS. The Strategy recommends, for example, that health care providers receive continuing education on managing and treating infants with NAS and promote non-pharmacologic treatment. According to HHS officials, these recommendations will inform planning and policy across the department. However, HHS has yet to determine how and when the recommendations will be implemented, including establishing priorities; the roles and responsibilities of other federal, state, and public stakeholders; implementation timeframes; and methods for assessing progress. HHS officials told GAO that they expect to develop an implementation plan sometime in 2017 but had no timeline for doing so. Without a plan that clearly specifies how HHS will implement the Strategy and assess its progress, the department increases the risk that its recommendations for addressing NAS will not be implemented. HHS should expeditiously develop a plan for implementing the recommendations included in its strategy related to addressing NAS. HHS concurred that it should expeditiously address NAS, but noted implementation of the strategy is contingent on funding.