U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Publishing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

24–057—PDF 2017

S. HRG. 114–557 

HEALTHCARE.GOV: A REVIEW OF 

OPERATIONS AND ENROLLMENT 

HEARING 

BEFORE THE

COMMITTEE ON FINANCE 

UNITED STATES SENATE 

ONE HUNDRED FOURTEENTH CONGRESS 

SECOND SESSION 

MARCH 17, 2016 

( 

Printed for the use of the Committee on Finance 

COMMITTEE ON FINANCE 

ORRIN G. HATCH, Utah, Chairman 

CHUCK GRASSLEY, Iowa 

MIKE CRAPO, Idaho 

PAT ROBERTS, Kansas 

MICHAEL B. ENZI, Wyoming 

JOHN CORNYN, Texas 

JOHN THUNE, South Dakota 

RICHARD BURR, North Carolina 

JOHNNY ISAKSON, Georgia 

ROB PORTMAN, Ohio 

PATRICK J. TOOMEY, Pennsylvania 

DANIEL COATS, Indiana 

DEAN HELLER, Nevada 

TIM SCOTT, South Carolina 

RON WYDEN, Oregon 

CHARLES E. SCHUMER, New York 

DEBBIE STABENOW, Michigan 

MARIA CANTWELL, Washington 

BILL NELSON, Florida 

ROBERT MENENDEZ, New Jersey 

THOMAS R. CARPER, Delaware 

BENJAMIN L. CARDIN, Maryland 

SHERROD BROWN, Ohio 

MICHAEL F. BENNET, Colorado 

ROBERT P. CASEY, Jr., Pennsylvania 

MARK R. WARNER, Virginia 

CHRIS CAMPBELL, Staff Director 

JOSHUA SHEINKMAN, Democratic Staff Director 

(II) 

C O N T E N T S 

OPENING STATEMENTS 

Page 

Hatch, Hon. Orrin G., a U.S. Senator from Utah, chairman, Committee on 

Finance .................................................................................................................. 1 

Wyden, Hon. Ron, a U.S. Senator from Oregon .................................................... 3 

WITNESSES 

Bliss, Erin, Assistant Inspector General for Evaluation and Inspections, Office 

of Inspector General, Department of Health and Human Services, Washington, DC ............................................................................................................. 6 

Bagdoyan, Seto J., Director of Audits, Forensic Audits and Investigative Service, Government Accountability Office, Washington, DC ................................. 8 

ALPHABETICAL LISTING AND APPENDIX MATERIAL 

Bagdoyan, Seto J.: 

Testimony .......................................................................................................... 8 

Prepared statement .......................................................................................... 21 

Responses to questions from committee members ......................................... 27 

Bliss, Erin: 

Testimony .......................................................................................................... 6 

Prepared statement .......................................................................................... 31 

Responses to questions from committee members ......................................... 37 

Hatch, Hon. Orrin G.: 

Opening statement ........................................................................................... 1 

Prepared statement .......................................................................................... 43 

Wyden, Hon. Ron: 

Opening statement ........................................................................................... 3 

Prepared statement .......................................................................................... 45 

(III) 

(1) 

HEALTHCARE.GOV: A REVIEW OF 

OPERATIONS AND ENROLLMENT 

THURSDAY, MARCH 17, 2016 

U.S. SENATE, COMMITTEE ON FINANCE, Washington, DC. 

The hearing was convened, pursuant to notice, at 10:03 a.m., in 

room SD–215, Dirksen Senate Office Building, Hon. Orrin G. Hatch 

(chairman of the committee) presiding. 

Present: Senators Burr, Isakson, Coats, Heller, Scott, Wyden, 

Stabenow, Brown, and Bennet. 

Also present: Republican Staff: Chris Campbell, Staff Director; 

Christopher Armstrong, Deputy Chief Oversight Counsel; Kimberly 

Brandt, Chief Health-care Investigative Counsel; and Jill Wright, 

Detailee. Democratic Staff: Joshua Sheinkman, Staff Director; 

David Berick, Chief Investigator; Elizabeth Jurinka, Chief Health 

Advisor; and Juan Machado, Professional Staff Member. 

OPENING STATEMENT OF HON. ORRIN G. HATCH, A U.S. 

SENATOR FROM UTAH, CHAIRMAN, COMMITTEE ON FINANCE 

The CHAIRMAN. The committee will come to order. It has been a 

little bit disruptive here this morning. We have a lot on our plate. 

It is a pleasure to welcome everybody here this morning. 

Today, we will be talking with representatives from the Office of 

Inspector General for the Department of Health and Human Services and from the Government Accountability Office about their ongoing oversight work with respect to HealthCare.gov and enrollment in the Federal health insurance marketplace. I want to thank 

both entities for their hard work on these issues and acknowledge 

the contributions both have made to help this committee perform 

more accurate and timely oversight. 

Now, it is no secret that I have never been a fan of the so-called 

Affordable Care Act, and, as we approach the sixth anniversary of 

this law and look closely into how it is working and being implemented, the evidence overwhelmingly shows that I and the many 

others who opposed the law from the beginning have been right all 

along. 

The facts speak for themselves. Since Obamacare was signed into 

law, HHS/OIG and GAO have cumulatively released at least six 

dozen reports detailing various operation and implementation issues, demonstrating the numerous areas where the law is falling 

short. These reports are specific and focused on key operational 

failures, like enrollment controls or system issues, some of which 

we will hear more about today. 

2 

Let us keep in mind that GAO and HHS/OIG are not partisan 

entities. They are independent watchdogs tasked with the responsibility of objectively and dispassionately assessing what is and what 

is not working in various Federal programs, including those created or amended by the Affordable Care Act. And there is no better 

record showing how this happened than the reports we received 

from these offices. 

Today, we are going to specifically discuss operations issues related to HealthCare.gov and enrollment problems at the Federal insurance marketplace, otherwise known as the Federal exchange. 

Let us start with the HealthCare.gov launch. As a result of numerous problems and shortcuts taken with the initial development 

and deployment of HealthCare.gov and its supporting systems, consumers encountered widespread performance issues when trying to 

create accounts and enroll in health plans. 

After numerous inquiries and reports, we now know what ultimately caused these performance issues. For example, there was 

inadequate capacity planning. The Centers for Medicare and Medicaid Services, CMS, cut corners and did not plan for adequate capacity to maintain HealthCare.gov and its supporting systems. 

There were also problems with the software that were entirely 

avoidable. CMS and its contractors identified errors in the software 

coding for the website, but did not adequately correct them prior 

to the launch, and we saw a lack of functionality as CMS did not 

adequately prepare the necessary systems and functions of the 

website and its supporting systems prior to the initial launch. 

CMS also failed to apply recognized best practices for system development, which contributed to the problem. Admittedly, since the 

initial launch, CMS has taken steps to address these problems, including increasing capacity, requiring additional software quality 

reviews, and awarding a new contract to complete development and 

improve the functionality of key systems. However, many of the 

problems have still not been entirely resolved and continue to 

cause frustration, especially for consumers trying to obtain health 

insurance. 

I wish we could boil down all of Obamacare’s problems to the 

functions of a single website. Indeed, if this was just an IT problem, all of our jobs would be a lot easier. However, the problems 

with Obamacare, and the Federal insurance marketplace in particular, go much deeper, and many of them remain unaddressed. 

We know, for example, that the enrollment controls for the Federal marketplace have been inadequate. During undercover testing 

by GAO, the Federal marketplace approved insurance coverage 

with taxpayer-funded subsidies for 11 out of 12 fictitious phone or 

online applicants. In 2014, the GAO applicants—which, once again, 

were fake, made-up people—obtained a total of about $30,000 in 

annual advanced premium tax credits, plus eligibility for lower insurance costs at the time of the service. These fictitious enrollees 

maintained subsidized coverage throughout the year even though 

GAO sent either clearly fabricated documents or no documents at 

all to resolve the application inconsistencies. 

While the subsidies, including those granted to GAO’s fictitious 

applicants, are paid to health-care insurers, they nevertheless represent a benefit to consumers and a cost to the government. 

3 

Now, GAO did find that CMS relies on a contractor charged with 

document processing to basically uncover and report possible instances of fraud. Yet, GAO also found that the agency does not require that the contractor have any fraud detection capability. 

According to GAO, CMS has not performed a single comprehensive fraud risk assessment—the recommended best practice—of the 

Obamacare enrollment and eligibility process. Until such assessment is completed, CMS is unlikely to know whether existing control activities are suitably designed and implemented to reduce inherent fraud risk to an acceptable level. In other words, CMS is not 

even sure if CMS’s fraud prevention systems are designed correctly 

or if they are effective. 

Lastly, while it is not the focus of the reports that will be covered 

by the testimony today, another matter we have been tracking 

closely and where the GAO is issuing a report today is CMS’s oversight of the health care CO-OPs. We had a hearing on this topic 

in late January, where we examined a number of financial and 

oversight-related explanations for the abject failure of the CO-OP 

programs. 

Today’s GAO report describes CMS’s efforts to deal with financial 

or operations issues at the CO-OPs, including the use of an escalation plan for CO-OPs with serious problems that may require corrective actions or enhanced oversight. 

As of November 2015, 18 CO-OPs had enough problems that they 

had to submit to a CMS escalation plan, including nine that have 

discontinued operation. And just last week, we heard that yet another CO-OP, this time the one in Maine, is on the verge of financial insolvency, despite the fact that it had been on a CMSmandated escalation plan. 

In other words, CMS’s efforts to address all the problems faced 

by CO-OPs appear to have failed, just like virtually every other element of this program. The failure of CMS to adequately implement 

the CO-OP program is well-documented here on the Finance Committee and elsewhere. As with so many other parts of Obamacare, 

the high-minded rhetoric surrounding this program has fallen short 

of reality. 

With nearly half of the CO-OPs now closed, the failed experiment 

has wasted taxpayer dollars and forced patients and families to 

scramble for new insurance. With so many CO-OPs now in financial jeopardy, I believe that CMS should work with and not against 

States to safeguard taxpayer dollars. 

So as always, we have a lot to discuss, and I look forward to 

hearing more from the officials we have testifying here today. 

So with that, I will turn to Senator Wyden for his opening remarks. 

[The prepared statement of Chairman Hatch appears in the appendix.] 

OPENING STATEMENT OF HON. RON WYDEN, 

A U.S. SENATOR FROM OREGON 

Senator WYDEN. Thank you, Mr. Chairman. 

Mr. Chairman and colleagues, it is old news that the initial rollout of HealthCare.gov 3 years ago was botched. It is new news that 

the Inspector General of the Health and Human Services DepartVerDate Mar 15 2010 15:50 Feb 09, 2017 Jkt 000000 PO 00000 Frm 00007 Fmt 6633 Sfmt 6633 R:\DOCS\24057.000 TIMD
4 

ment recently said, and I want to quote here—this is a quote, colleagues, from the Inspector General: ‘‘CMS recovered the HealthCare.gov website for high consumer use within 2 months and 

adopted more effective organizational practices.’’ That is what the 

Inspector General said, that the Department recovered the website 

for high consumer use within 2 months. That quote comes from one 

of two reports looking back at 2013 and 2014 that the Finance 

Committee will be presented with today. 

I think we ought to start by recognizing that the story here is 

well-documented. After the launch went badly, some of the best 

minds in technology and a new contractor were brought in. They 

scrambled to overhaul the system, and the exchange was soon up 

and running, and the Centers for Medicare and Medicaid Services 

are now following up on each of the Inspector General’s recommendations, which the Inspector General notes in its report. 

In the most recent enrollment period, nearly 10 million Americans used HealthCare.gov to sign up for a plan or reenroll automatically. In my home State, which had its own problems, close to 

150,000 people have used the website to sign up for a plan as of 

January 31st. That is up by more than 30 percent compared to last 

year. 

The committee will also hear an update from the Government 

Accountability Office on what has been called the secret shopper 

investigation. The Government Accountability Office first brought 

this study before the committee in July of last year. I am going to 

repeat what I said back then. 

On this side of the aisle, we do not take a back seat to anybody 

in fighting fraud and protecting taxpayer dollars—$1 ripped off is 

$1 too many. But let us recognize that what was true last summer 

remains true today. 

This GAO investigation has not uncovered one single shred of 

real-world fraud in the insurance marketplace. It was built on fictitious characters with specially created identities, not real consumers and not real fraudsters. It is true that the Government Accountability Office found that there are sometimes differences between the information on somebody’s insurance application and 

their tax forms and citizenship records. But when it comes to these 

inconsistencies in people’s data, this investigation cannot differentiate between fraud and a typo. 

Meanwhile, Health and Human Services does not look the other 

way when it finds the red flags. In 2014, the year of GAO’s investigation, the Centers for Medicare and Medicaid Services closed 

more than 100,000 insurance policies because documents did not 

match or were not provided. Tax credits were adjusted for nearly 

100,000 households. In 2015, Health and Human Services closed 

more policies and adjusted more tax credits. 

If you come at this from the left, you might say that is too harsh. 

If you come at it from the right, you might take a different view. 

But there is no basis whatsoever for the argument that Health and 

Human Services ignores problems in people’s records or leaves the 

door open to fraud. It seems to me, rather than rehashing old news, 

we ought to be looking at the facts and talking in a bipartisan way 

about how to move forward together. 

5 

Because of the Affordable Care Act, the number of Americans 

without health insurance is at or near its lowest point in half a 

century. For the 160 million people who get their insurance from 

their employer, colleagues, premiums climbed 4 percent last year. 

Let me repeat that. For 160 million people who get their insurance 

from their employer, premiums climbed only 4 percent. Workingage Americans in Oregon and nationwide with preexisting conditions—80 million people or more—can no longer be denied insurance. 

So, instead of battling out what happened 3 years ago, we ought 

to be pulling on the same end of the rope and solving some problems. For example, Democrats and Republicans ought to be working together to look at ways in which we can provide even more 

competition and bring costs down for consumers, and a lot of you 

in this room have worked with me on that issue for some time. 

Second, there are going to be spectacular new cures in the future, 

and there are real questions as to whether our health-care system 

is going to be able to afford them. Here, Senator Grassley has 

worked very closely with me to put together a bipartisan case 

study, which looked at one blockbuster drug involving hepatitis C. 

Solving the cost of these blockbuster drugs is going to take a lot 

of hard work. It, again, can only be done on a bipartisan basis. 

Finally, I want to express my appreciation to colleagues on both 

sides of the aisle, because I think we are on the cusp of being able 

to make real progress on a huge opportunity for older people in our 

country, and that is protecting the Medicare guarantee, this very 

sacred guarantee we have for seniors, while updating the program 

to look at the great new challenge, which is chronic illness. 

I want to thank Senator Bennet, who was out in front on this 

issue for some time. He is not here, but Senator Isakson and Senator Warner were champions as well. I want to express my appreciation to the chairman for the progress that we are making. 

I have to make some comments with respect to something we did 

not know about until about an hour ago, and that is this matter 

of the CO-OPs. 

What we have said is that we want to work in a bipartisan way 

to improve a variety of sections of the Affordable Care Act. Now, 

this new material on the CO-OPs, which neither I nor anyone on 

this side knew anything about, was available something like an 

hour ago. I intend to look at it with an eye to what can be done 

on a bipartisan basis going forward. 

But my work, and I think the work of colleagues here, always 

ought to come back to this idea of making health-care policy more 

accessible and more affordable. And for now—and I certainly have 

not seen this report—I am not going to be participating in any celebration of people suffering, because the CO-OPs were tied up in a 

congressionally induced economic straightjacket. 

Thank you, Mr. Chairman. 

[The prepared statement of Senator Wyden appears in the appendix.] 

The CHAIRMAN. Thank you, Senator. 

I am going to introduce today’s witnesses. Our first witness is 

Ms. Erin Bliss, the Assistant Inspector General for Evaluation and 

Inspections in the Office of Inspector General, or OIG, at HHS. 

6 

Ms. Bliss has served in many roles at OIG since her career 

began. I think your career began in 2000, if I have it correctly. She 

started as an analyst for the Office of Evaluation and Inspections 

and later went on to serve as a senior advisor, where she provided 

management advice and expert analysis to the Inspector General 

and other senior executives on programmatic priorities and internal policies and operations. 

Afterwards, she worked from 2009 to 2014 as Director of External Affairs at OIG and was responsible for overseeing and implementing OIG’s communication strategies and relationship management with the administration, Congress, media, the health-care industry and providers, and the public. 

Ms. Bliss received her bachelor’s degree in government from the 

University of Notre Dame before receiving her master’s degree in 

public policy from the University of Chicago. 

Our second witness is Mr. Seto Bagdoyan, the Director for Audit 

Services in GAO’s Forensics, Audits, and Investigative Service Mission Team. During his GAO career, Mr. Bagdoyan has served in a 

variety of positions, including as Legislative Advisor in the Office 

of Congressional Relations and as Assistant Director for Homeland 

Security in Justice. 

Mr. Bagdoyan has also served on congressional details with the 

Senate Finance Committee and the House Committee on Homeland 

Security. We are glad to see you back here again. 

Mr. Bagdoyan has also held a number of senior positions in consultancies in the private sector, including most recently focusing on 

political risk in homeland security. 

Mr. Bagdoyan received his bachelor’s degree in international relations and economics from Claremont McKenna College and an 

MBA in strategy from Pepperdine University. 

I want to thank you both for coming. We will hear the witness 

testimonies in the order that they were introduced. 

Ms. Bliss, please proceed with your 5-minute statement. 

STATEMENT OF ERIN BLISS, ASSISTANT INSPECTOR GENERAL 

FOR EVALUATION AND INSPECTIONS, OFFICE OF INSPECTOR GENERAL, DEPARTMENT OF HEALTH AND HUMAN 

SERVICES, WASHINGTON, DC 

Ms. BLISS. Thank you. Good morning, Chairman Hatch and other 

distinguished members of the committee. Thank you for the opportunity to testify today about the Office of Inspector General’s case 

study which examines the management of HealthCare.gov. This is the website consumers use to apply for health insurance 

through the Federal marketplace. As is well known, on October 1, 

2013, the HealthCare.gov website failed almost immediately upon 

launch. Yet, within 2 months, CMS had substantially improved the 

site’s performance. 

How did such a high priority project start so poorly, and how did 

CMS turn the website around? Our case study provides insights 

into these questions and lessons learned to help HealthCare.gov 

and other Federal projects work better. 

We believe that our assessment of the intersection of technology, 

policy, and management can benefit a broad range of Federal projects and programs. Our report chronicles the breakdown and turnVerDate Mar 15 2010 15:50 Feb 09, 2017 Jkt 000000 PO 00000 Frm 00010 Fmt 6633 Sfmt 6633 R:\DOCS\24057.000 TIMD
7 

around of HealthCare.gov over a 5-year period. This morning I will 

summarize the highlights. 

From the outset, the HealthCare.gov project faced a high risk of 

failure. It was technically complex, with a fixed deadline and many 

uncertainties. Still, HHS and CMS made many missteps in its implementation. Most critical was the absence of clear leadership and 

overall project responsibility, which had ripple effects. 

Policy decisions were delayed, affecting the technical decisions. 

Policy and technical staff were in silos and not well-coordinated, 

and contract management was disjointed. Changes to the project 

were not well-documented and progress not adequately monitored. 

This culminated in CMS not fully communicating or acting upon 

many warnings of problems before the launch. CMS failed to fully 

grasp the poor status of the build. One reason was that no one had 

a full view into all of the problems and how they fit together. 

Red flags raised to leadership did not always flow to staff working on the build, and staff did not always alert leadership to problems on the front lines. CMS was unduly optimistic. 

Last-minute attempts to correct problems were rushed and insufficient. In the 2 months before the launch, CMS added twice the 

staff to the project and cut many planned website functions. And 

just 72 hours ahead, CMS asked its contractor to double its computing capacity. 

Even with these efforts, the HealthCare.gov website experienced 

major problems within hours of its launch. The website received 

five times the number of expected users, but the problems went beyond capacity. The website entry tool worked poorly, and software 

coding defects caused malfunctions. CMS and its contractors did 

not have coordinated tools to diagnose these problems. However, 

CMS pivoted quickly to make corrections to the website. They 

brought in additional staff and expertise from across government 

and the private sector. 

One key was creating a badgeless culture, where Federal employees and contractors worked together as a team. CMS designated 

clear leadership, integrated policy and technical staff, and developed redundant systems to avoid future website problems. 

CMS also took a more realistic approach to building website 

functions. It practiced what officials called ruthless prioritization, 

which focused on effectively developing the most critical functions, 

like reenrollment, and delaying other features. They measured 

progress and monitored problems to respond more quickly and effectively. These factors contributed to an improved website and important organizational changes. 

Looking ahead, CMS continues to face challenges in improving 

HealthCare.gov and managing the Federal marketplace. This includes addressing more than 30 recommendations from OIG’s other 

Federal marketplace reports. We will continue to monitor CMS’s 

actions in response to our recommendations and its overall management of this and other programs. 

Thank you again for inviting OIG to speak with the committee 

today, and I will be happy to answer your questions. 

[The prepared statement of Ms. Bliss appears in the appendix.] 

The CHAIRMAN. Thank you so much. 

Mr. Bagdoyan, we will turn to you. 

8 

STATEMENT OF SETO J. BAGDOYAN, DIRECTOR OF AUDITS, 

FORENSIC AUDITS AND INVESTIGATIVE SERVICE, GOVERNMENT ACCOUNTABILITY OFFICE, WASHINGTON, DC 

Mr. BAGDOYAN. Good morning, Chairman Hatch, Ranking Member Wyden, and members of the committee. I am pleased to be here 

today to discuss results from our February 2016 report on enrollment and verification controls for ACA health-care coverage obtained through the Federal marketplace during the 2014 open enrollment period. 

Our results are based on extensive forensic analyses of relevant 

data from CMS and other agencies, such as SSA, IRS, and DHS— 

involving originally the entire 2014 applicant and enrollee universe—and are independent of the undercover work we performed 

for that period. 

A central feature of ACA’s enrollment controls is the Federal 

data services hub, which is the primary vehicle for CMS to initially 

check information provided by applicants against various Federal 

data sources. In addition, the ACA established a process to resolve 

inconsistencies, i.e., instances where applicant information does not 

match that from marketplace sources. 

In terms of context for our work, coverage offered through the 

Federal marketplace is a significant expenditure for the Federal 

Government. Current levels of coverage involve millions of enrollees, of whom about 85 percent receive subsidies. CBO has estimated Fed subsidy costs at about $880 billion for fiscal years 2016 

through 2025. 

I would note that while subsidies are paid to insurers and not 

directly to enrollees, they nevertheless represent a financial benefit 

to them. As I have stressed before, a program of this scope and 

scale remains inherently at risk for errors, including improper payment and fraud. Accordingly, it is essential that effective enrollment controls are in place to help narrow the window of opportunity for such risk and safeguard the government’s investment. 

Against this backdrop, I will now discuss our two principal analytical results. 

First, we found that CMS does not track or analyze aggregate 

outcomes of data hub inquiries or the extent to which a queried 

agency delivers information responsive to a request or whether an 

agency reports that that information was not available. 

In this regard, for example, we found that SSA could not match 

4.3 million queries related to names, dates of birth, or Social Security numbers, and 8.2 million queries related to citizenship claims. 

IRS could not match queries involving about 31 million people related to income and family size, and, within this, 1.3 million people 

had ID theft issues. Finally, DHS could not match 510,000 queries 

related to citizenship and immigration status. 

Accordingly, CMS foregoes opportunities for gaining valuable insights about significant program integrity issues, including vulnerabilities to potential fraud, as well as information useful for enhancing overall program management. 

Second, we found that CMS did not have an effective process for 

resolving inconsistencies for applicants using the Federal marketplace. For example, we found that about 431,000 applications, with 

about $1.7 billion in associated subsidies, still had about 679,000 

9 

inconsistencies unresolved as of April 2015. That is 4 months after 

the close of the 2014 coverage year. 

Within these, CMS did not resolve Social Security number inconsistencies for about 35,000 applications, with about $154 million in 

associated subsidies, or incarceration inconsistencies for about 

22,000 applications, with about $68 million in associated subsidies. 

By leaving inconsistencies unresolved, CMS risks granting eligibility to and making subsidy payments on behalf of individuals who 

are ineligible to enroll in qualified health plans. One important example emphasizes this point. According to IRS, accurate data are 

vital for income tax compliance and the reconciliation of advanced 

premium tax credits through filing tax returns, which is a key 

backend control under ACA. 

In closing, our work to date collectively shows that CMS has assumed a generally passive approach to managing fraud risks in 

ACA, weakening the program’s integrity. Accordingly, we continue 

to underscore that CMS needs to make ACA program integrity a 

priority and implement effective controls to help reduce improper 

payment and fraud risks and preclude them from being embedded 

early in the program’s life cycle. 

In this regard, we made eight recommendations to CMS in our 

February report, which are intended to help mitigate the vulnerabilities and risks we identified. While the agency agreed with the 

recommendations, it is incumbent on CMS to implement them in 

a timely fashion and achieve and sustain measurable results. 

Mr. Chairman, this concludes my statement. I look forward to 

the committee’s questions, and I appreciate the indulgence for an 

extra 30 seconds. 

[The prepared statement of Mr. Bagdoyan appears in the appendix.] 

The CHAIRMAN. I am happy to give you that extra time. 

Ms. Bliss, previous reports at the Office of Inspector General 

criticized HealthCare.gov and the marketplace, describing important problems with internal controls, such as inadequate procedures for checking the eligibility of enrollees. 

How does the case study differ from previous reports of the Office 

of Inspector General on the same topic? 

Ms. BLISS. Thank you for your question, Mr. Chairman. The case 

study is one of a dozen reports that OIG has issued on the Federal 

marketplaces. Most of those were more-targeted audits or evaluations examining aspects of eligibility controls, payment accuracy, 

contracting, and security of information. 

The case study took a different approach and cast a wide lens at 

CMS’s management of the project in its entirety, from multiple perspectives and over a long period of time, in order to glean lessons 

learned about what went wrong and what went right in an effort 

to help improve both this HealthCare.gov project and other Federal 

projects moving forward. 

The CHAIRMAN. Thank you. 

Mr. Bagdoyan, your report pointed out the key role played by 

the, quote, ‘‘data services hub,’’ which is the electronic clearinghouse for checking applicant information against Federal databases. 

10 

Now, you said that CMS needs to make better use of this important enrollment control process. Would you explain that a little bit? 

Mr. BAGDOYAN. I would be happy to do that, Mr. Chairman. 

Basically, the data hub is a key cog, if you will, in the overall 

control environment for ACA. It is up-front. It processes a lot of 

queries for information. A lot of those queries—all of those queries, 

in fact, are not captured for future analysis. 

We believe that such capture and analysis would provide CMS 

with a lot of insight into potential indicators of improper payments, 

as well as fraud. So a comprehensive control system would theoretically enable that sort of analysis for the long term, and we do 

actually have a recommendation to that effect to CMS. 

The CHAIRMAN. Thank you. We have been long told by CMS, ‘‘Do 

not worry. Even if there are issues with awarding subsidies, everything eventually gets fixed when people file their income taxes.’’ 

The GAO found practices that undermine tax compliance. Am I 

right about that? 

Mr. BAGDOYAN. Yes. We identified a number of inconsistencies. 

Out of the 431,000, I believe we had about 35,000 that involved tax 

or SSN inconsistencies. And according to IRS, when we discussed 

this at length, they told us that this was not only important for tax 

compliance purposes, but also for the tax reconciliation process to 

reconcile the advanced premium tax credits at the end. 

This is the third main back-end control, if you will, in the overall 

setup. So without that information that is accurate and reliable, 

IRS pointed out that their job is made much more difficult, not only 

to do the tax return processing, but also to reconcile the subsidies. 

So it is a long-term problem if it is not addressed. 

The CHAIRMAN. All right. Ms. Bliss, what are the most important 

lessons learned from HealthCare.gov for the administration, and do 

you think that the lessons learned from your case study apply to 

other large programs and projects, whether being planned by the 

Department of Health and Human Services or other government 

agencies? 

Ms. BLISS. Thank you. We certainly do. The intersection between 

policy, technology, and management is not only essential for 

HealthCare.gov, but we believe these lessons will apply to other 

Federal projects and Federal programs. 

We gleaned 10 lessons learned, and I will highlight what I believe to be the three most significant. 

First is establishing clear leadership. We found that the lack of 

clear leadership in overall responsibility and clear lines of delegation had ripple effects, caused a number of cascading problems 

across the project, and made problem resolution more difficult. 

We also found that a disconnect between those working on the 

policy and making decisions and those working on the technical aspects of the project created problems on both sides. And delays in 

policy decision-making compressed an already tight time frame for 

achieving the technical build successfully. 

So, better integration across lines of business, policy, and technical, as well as across government and contractors through this 

badgeless culture, are some of the keys we saw to correction and 

success. 

11 

And then, finally, taking a posture of continuous learning is essential, which means being flexible and adaptable, especially with 

a startup-type project like HealthCare.gov was. We found that CMS 

got stuck on an unwinnable path, and it was too late before they 

realized it and tried to make changes. 

So keeping that continuous learning posture, being innovative 

and flexible, and constantly monitoring for problems to adjust 

plans where needed are all important. 

Thank you. 

The CHAIRMAN. Thank you. 

Senator Stabenow, we will turn to you. 

Senator STABENOW. Thank you very much, Mr. Chairman. And 

welcome and thank you to both of you. 

Ms. Bliss, I am wondering—to start, just a ‘‘yes’’ or ‘‘no’’ question. 

Based on your case study, do you think that the HealthCare.gov 

website should be taken down and a completely new website be 

built? 

Ms. BLISS. No. 

Senator STABENOW. Thank you. Like many of my colleagues, we 

were very frustrated about what happened in the past, and clearly 

you have laid out the problems with the launch, and I think everyone agrees that there were serious problems with the launch of 

HealthCare.gov and it created a lot of difficulties, and certainly for 

people in Michigan, to get coverage in 2013. 

But that was 3 years ago, and we are now in year 3 of the Affordable Care Act marketplace operations. So when we look at the 

report, the report is really looking backwards, and we can agree 

there were problems. 

The question is moving forward and how do we ignore the fact 

that over 20 million people have received health-care coverage because of the Affordable Care Act, literally saving people’s lives? 

That is not just a rhetorical statement. I have talked to people who 

were able to get surgery or were able to get care for their children 

that they have never been able to receive before and save lives, and 

I think that is a good part of things when we talk about the numbers, the real-life experiences of people. 

The un-insurance rate is the lowest it has ever been, and Medicaid expansion has resulted in literally millions of our most vulnerable families receiving the care that they deserve. 

So, given the fact that the ACA is the law of the land and it is 

our responsibility to make it better, I first want to say that I hope 

that all of us will work on how to make it better, and that is why 

we appreciate your recommendations as we look forward, not just 

in the case of this particular website and process, but others as 

well. 

But the question is, how do we make it better? So we want to 

make sure that we have quality access to health care for every 

American, whether it is Medicare, Medicaid, the Children’s Health 

Program, and so on and so on. 

So with that in mind, Mr. Bagdoyan, let me ask about any other 

recommendations from a GAO standpoint that you have not already spoken of today on how we can make these better, because, 

frankly, I want the over 20 million people who have health insurance today who did not have it before to have the peace of mind 

12 

going to bed at night of knowing they are going to be able to take 

their children to a doctor if they get sick. I want to keep that. And 

I am hopeful we can even get as close to zero as possible in terms 

of the number of people in our country who do not have access to 

health care. 

So I am interested in your recommendations on how we go forward to work together to make this system work better. 

Mr. BAGDOYAN. Sure. Thank you for your question, Senator 

Stabenow. 

As you mentioned, we operate under the premise that this is the 

law on the books, and my charge is to help make it work as intended. With that in mind, our report makes eight specific recommendations. We try not to be too prescriptive to allow CMS 

some latitude to explore various options. 

However, the key recommendation, I believe, the big-picture recommendation, is for CMS to conduct a comprehensive risk assessment of the entire program, sort of top to bottom, and identify the 

control vulnerabilities and the risks for improper payments and 

fraud. 

In that regard, GAO issued, in July of 2015, its framework for 

managing fraud risk in Federal programs. So that is a comprehensive leading practice compilation from the private and public sectors that would provide the agency with quite a solid roadmap to 

perform that risk assessment. 

So everything should flow from that assessment in terms of the 

types of actions, policy changes, control improvements, and so 

forth. 

Senator STABENOW. And are you working with CMS? What is 

their reaction on this? Are they objecting to that? 

Mr. BAGDOYAN. No. I think I should give CMS credit that they 

accepted all eight recommendations, including this one. But as they 

say, the proof is in the pudding. They need to execute, do so successfully, and then achieve results and sustain them over the long 

term. This is not a one-and-done proposition by any means. 

Senator STABENOW. Sure. So just to be clear, you have made the 

recommendations. They have accepted all eight recommendations, 

and they are in the process of doing them. 

Mr. BAGDOYAN. That is correct. We had informal discussions, as 

well as the formal letter responding to our recommendations. 

Senator STABENOW. Thank you, Mr. Chairman. 

The CHAIRMAN. Senator Coats? 

Senator COATS. Thank you, Mr. Chairman. And I want to thank 

our two witnesses. 

Lord knows where we would be if we did not have GAO and Inspectors General. The alarming malfeasance and incompetence of 

the rollout of this plan is just stunning. And here we are, we cannot just simply brush it off and say, well, this was a bad start, but 

everything is going great now. 

On the cost to the taxpayer, probably we will never know. But 

thank goodness that we have your organizations providing us information and spurring on a seemingly bureaucratic nightmare that 

exists within the Federal Government in terms of handling these 

kinds of programs. 

13 

Anybody in the private sector who had done this would have 

been bankrupt; investors would have lost all their money. It is just 

stunning to continue to observe what it takes to get these agencies 

to—I think they are well-intended, they are just overwhelmed in 

terms of the complexity of getting this done. 

I go the floor of the Senate every week and talk about a waste 

of the week, and, Mr. Bagdoyan, I have referenced your name, not 

as part of the problem, but as part of the solution. And the information that you have provided here for me continues to stun people 

when they hear about some of the incompetency. 

I was particularly interested, because I think it speaks to a bigger problem, in your, what was called the secret shopper investigation, where you deliberately made applications as a test—you made 

applications for compliance with the Affordable Care Act and receiving subsidies. And 11 of the 12—I think my numbers are 

right—everything you submitted was fraudulent, but 11 of the 12 

were accepted. And even after it was revealed that they were accepted, follow-up phone calls, pretending to be that person who was 

given notice that they were not eligible, were accepted. 

That percentage is pretty high, and if you multiply that out, it 

just really makes you wonder if this whole thing was not gamed 

or at least so intent on providing numbers to make it look successful that we really were not getting the information, the verification, 

that we needed. 

Then there was the question with CMS at one point releasing a 

statement, ‘‘Well, we are not in the verification business.’’ I think 

basically what you just said was that they are now taking a different stand on that. 

But I wonder if you could respond to where are we now in terms 

of verification capacity so that we do not have this fraudulent and 

wasteful situation moving on. I am happy to have either one of you 

or both of you address that. But it just seems easy: an evaluation 

of Social Security numbers to determine their validity would make 

it fairly easy to make a determination as to whether they qualify 

or whether they do not qualify. 

But where is CMS in terms of putting that process in place, and 

what is the success to date of that process? 

Mr. BAGDOYAN. Sure. If I may, Ms. Bliss, take first crack on that. 

First, I appreciate the plug on the floor, Senator. 

Senator COATS. Sure. [Laughter.] 

Keep sending us stuff; I will keep going to the floor. 

Mr. BAGDOYAN. So in terms of where CMS is with the controls, 

what we call the control environment, which is a series of controls 

designed to verify information, identify potential indicators of 

fraud, and so forth, as our undercover work indicated, both for 

2014 and 2015, where we were equally successful, there is a semblance of controls in place. 

Senator COATS. A semblance? 

Mr. BAGDOYAN. A semblance of controls in place, some basic 

things in place, like identity-proofing the document reconciliation 

process to clear inconsistencies, for example. But in each case, we 

were able to work around those reasonably easily and obtain coverage both for 2014 and 2015. So the vulnerabilities are still in 

place. 

14 

Now, with the recommendations we made in this report, actually, 

in late February, we made eight recommendations. As I explained 

to Senator Stabenow, the big one is to perform a comprehensive 

risk assessment. 

Now, that is going to take time. It is going to take time for CMS 

to absorb the results and then craft, hopefully, appropriate solutions for the future. So this is a long-term proposition. It is not 

going to be an easy fix. 

Senator COATS. Well, I think this speaks to the point that we got 

a bad start and everything is going great right now. Everything is 

not going great right now. As you said, this is going to take a longterm effort to try to put these verification procedures in place and 

to be able to say that we are successfully avoiding fraud and waste 

and an inefficiency and taxpayer cost level that is just absolutely 

astounding. 

So, with due respect to my colleagues, to tout this as something 

that has happened in the past but is corrected now and we are sailing into the bright future, I think we have a lot of work to do. 

Thanks, Mr. Chairman. 

The CHAIRMAN. Senator Wyden? 

Senator WYDEN. Thank you, Mr. Chairman. 

I want to again say that the initial rollout was botched, and I 

appreciated the Inspector General making it clear that a couple 

months in, there was serious progress. 

So you all reported that after the first open enrollment, the agency demonstrated a strong sense of urgency to take action, accepted 

new work processes, and they, quote, ‘‘improved the HealthCare.gov 

website substantially within 2 months.’’ 

I think it would be helpful, Ms. Bliss, if you could tell us two 

things. What were the operational and strategic changes that were 

made after that first open enrollment, and do you feel they are 

better-equipped to deal with the challenge now? 

Ms. BLISS. Thank you, Ranking Member Wyden, for that question. As we discussed in the case study, some of the key strategic 

and operational changes that were made as part of the correction 

were to, one, establish more clear leadership and designate roles 

and responsibilities, and they did it in a way that really brought 

together staff and contractors across all of the important business 

lines that were affected and needed to be involved in the correction. 

That includes the policy people, the technical, the communications, 

and the contractors all coming together. 

With the influx of experts from across government and the private sector, there was the potential that it could have become more 

chaotic, but, in fact, we saw that the reverse was true. It was wellorganized. Folks were working together in a badgeless culture as 

a team. There was better communication, there was better measurement and monitoring of problems, and there was progress in 

order to apply solutions more quickly and effectively. 

Senator WYDEN. So, in effect, after the first few months, which 

everybody has acknowledged were not ideal, your characterization 

was that essentially it was well-organized. 

Ms. BLISS. It was much better organized—— 

Senator WYDEN. I was using your word—— 

Ms. BLISS [continuing]. And they continue to make progress. 

15 

Senator WYDEN. All right. Good. Mr. Bagdoyan, first, I am probably the biggest user of GAO products here in the Congress. I so 

admire the professionalism of the agency, and I think you heard 

me say I do not take a back seat to anybody when it comes to 

cracking down on actual real-world fraud. 

My question to you is, is it not correct that when you testified 

before the committee last year, you stated that the secret shopper 

investigation failed to uncover a single real-world example of 

fraud? 

Mr. BAGDOYAN. Yes, that is what I said, Senator Wyden, and I 

would also couch that very carefully for you and the committee. 

The intent of that investigation was not to uncover fraud but to 

flag control vulnerabilities, as well as identify indicators of potential fraud, which I think we did quite successfully. 

So I just want to make clear my charge is not to find fraud. 

Fraud is determined through a separate criminal proceeding in 

courts to definitively determine that. So my job, again, is to look 

for vulnerabilities in controls, as well as identify indicators of potential fraud or improper payments. 

Senator WYDEN. So let us go then from last year when there was 

not one single real-world example of fraud to where we are now. 

Is it correct to say that the entire investigation failed to identify 

any actual fraud? 

Mr. BAGDOYAN. Well, again, I would refer you to my answer. 

That was not our intent. So if I am not looking for fraud, I am not 

going to find it. What I am looking for is vulnerabilities in controls 

and indicators of potential fraud, such as the inconsistencies with 

the Social Security numbers, as well as, in the case of the IRS, 1.3 

million people having potential ID theft issues, which is a significant red flag. 

Senator WYDEN. I think that, as is always the case, you all are 

right to talk about various issues that ought to be part of the debate. That is not what is going on here. What people are saying is, 

this is fraud, fraud, fraud, fraud, and I appreciate your taking us 

through this in, I think, a better-balanced view. 

Ms. Bliss, at HHS, you all do audits, OIG does audits. Have you 

uncovered, in connection with this, any confirmed cases of fraud? 

Ms. BLISS. No, we have not had any cases that have resulted in 

criminal convictions or civil settlements to date. We do have a few 

investigations that are ongoing, and I cannot predict what those 

outcomes will be. 

Senator WYDEN. Look, I do not know how many times I have 

said in this committee that when there are big, important issues— 

and certainly the Affordable Care Act is right at the top—we need 

to work in a bipartisan fashion, and there is not a program anywhere in government where you cannot find opportunities to work 

together and be bipartisan. 

I ticked off a number of them. The chairman and I are working 

together on what I think is the future of the Medicare program, 

chronic care; Senator Grassley and I are finishing what I think is 

a blockbuster study looking at hepatitis C. And it raises the question of, when we have cures, will people be able to afford them? 

What I think is important is that, to do bipartisan work, we have 

to move away from, first, the past, because everybody has acknowlVerDate Mar 15 2010 15:50 Feb 09, 2017 Jkt 000000 PO 00000 Frm 00019 Fmt 6633 Sfmt 6633 R:\DOCS\24057.000 TIMD
16 

edged that the first few months were botched. I do not know how 

many times you can say it. But you all said—and I read your comments—after the first few months, you said they had made substantial improvements. I think I can come back to it and perhaps 

read it one more time. 

‘‘The Centers for Medicare and Medicaid Services recovered the 

health care government website for high consumer use within 2 

months.’’ Now, that is the new news. That is just a few weeks old. 

That is new news, and I want people to hear that, and I want people to hear that there were no actual real-world cases of fraud uncovered. 

Now, one final question, if I might, for you, Ms. Bliss. Do you disagree with the statement that I made with respect to the accomplishments of the Affordable Care Act? That is not your formal role 

as Inspector General, but does anything strike you as being inaccurate there with respect to the uninsured rate or anything of that 

nature? 

Ms. BLISS. As an independent oversight agency, we do not take 

positions on whether particular programs should exist, but we look 

to make sure they are operating correctly. 

Senator WYDEN. That is not the question. The question was 

about the facts, and what I think, again, is, this is a hard fact that 

is not in dispute, that the uninsured rate is now at or near the lowest level recorded across 5 decades of data, with about 20 million 

previously uninsured Americans gaining coverage since the Act’s 

provisions went into effect. 

So I will keep the record open so that if you or your agency has 

any information suggesting that is wrong, I would surely like to 

know about it. 

Ms. BLISS. Thank you. I do not have any information suggesting 

that that is wrong. 

Senator WYDEN. Wonderful. Mr. Chairman, thank you. 

The CHAIRMAN. Senator Scott? 

Senator SCOTT. Ms. Bliss, do you have any information suggesting that those numbers are right? 

Ms. BLISS. I cannot validate those numbers. I do not have any 

reason to believe they are not. 

Senator SCOTT. But you have no indication either way, actually. 

Ms. BLISS. I have no basis, no. 

Senator SCOTT. If I tell you that the number is 30 million, you 

have no reason to believe that it is not 30 million. 

Ms. BLISS. I do not have a basis for validating that number. Our 

case study—I am sorry. 

Senator SCOTT. Thank you. Mr. Bagdoyan, our ranking member 

asked you several questions about fraud, and I certainly understand and appreciate why so many Americans look at this process 

and become disenchanted. 

Your objective was never to figure out how much fraud was in 

the system. Your objective, it appeared to me, was to show us how 

fraud could happen. 

Mr. BAGDOYAN. Yes, essentially, Senator, you are correct. The big 

picture we are looking at is for any vulnerabilities in the controls 

that are in place and also for any indicators of potential fraud that 

pop up. For example, our ability to circumvent the controls we enVerDate Mar 15 2010 15:50 Feb 09, 2017 Jkt 000000 PO 00000 Frm 00020 Fmt 6633 Sfmt 6633 R:\DOCS\24057.000 TIMD
17 

countered during our undercover work—we did that for 2014, and 

we repeated that experience in 2015, in which case we were successful 17 out of 18 attempts. 

Now, I would have to caution that, of course, further to the point 

that Senator Coats made earlier, that is not a projectable number. 

So we have to be very careful that that does not represent the actual universe; that is just a data set that we use to continue our 

work in this area. 

Senator SCOTT. Thank you very much. No one is going to mistake 

me for a fan of Obamacare or the ACA, without any question. For 

a number of reasons, I am not a fan of the website nor the actual 

policy itself, the legislation. 

I think of the Independent Payment Advisory Board, what some 

have referred to as a death panel, and the ability to ration care 

into the future. This is one of the classic examples of why so few 

Americans have the same appreciation of the ACA that others have 

talked about. 

I think the fact that we are talking about taxing Americans, 

whether it is their income or their profits, an additional 3.8-percent 

tax, raising somewhere over $120 billion, is another reason why so 

few Americans have the same positive theme that we have heard 

from some of our friends on the other side. 

Think about the whole notion of how the health-care law is going 

to regulate the posting of calories at pizza parlors, grocery stores, 

all over the place, and, by default, increase the price of these groceries, these pizzas and other non-food items, reducing the number 

of employees’ hours, talking about the impact on middle-income 

America, so many Americans losing perhaps up to 25 percent of 

their income because of the ACA. 

We can see why so many Americans have found frustration with 

where we are with the ACA, that it is not old news to them. 

It is not old news, actually, when you think about the fact that 

so many Americans are facing higher premiums. We have heard so 

many different numbers this morning. We know that at least some 

States have seen an increase of more than 25 percent in their 

health-care costs. Two States have seen those numbers go over 35 

percent. Those are real dollars for struggling Americans who cannot afford the cost of health insurance. 

Not only are the premiums higher, the deductibles are higher, 

the out-of-pocket expenses are higher. The only thing that is actually lower are the doctors to choose from and the hospitals to go 

to. 

We have seen a catastrophic occurrence under this health-care 

law. And even at one of the most recent Democratic town halls, a 

young lady, supportive of President Obama, who supports the 

health-care law, said that her premiums had doubled, tripled. Her 

concerns were strong, clear. 

Here is one real case example that, Ms. Bliss, I hope is no longer 

happening. A young man named Tom Dougall from Elgin, SC, who 

created an account on HealthCare.gov, was called shortly thereafter 

by a man named Mr. Justin Hadley from North Carolina who had 

done the exact same thing: gone online to HealthCare.gov and created an account. But what he found populating his account was information from Mr. Dougall. 

18 

He called HHS and could not get any assistance. Finally, they 

called our office, and, during one of the hearings, we were able to 

get that situation solved, or at least the beginning of that situation 

solved. 

Can you guarantee me that that situation is no longer occurring 

anywhere within HealthCare.gov? 

Ms. BLISS. I cannot guarantee that. We have overseen and conducted reviews of the controls to ensure that the website and other 

parts of the program for identity verification, no eligibility verification, are working properly. But we have raised concerns about some 

flaws or weaknesses in those controls, similar to GAO, and I cannot 

make that guarantee. But we are certainly working hard to identify 

where there is a vulnerability of that happening and make recommendations on how to improve it. 

Senator SCOTT. My last statement, since I am out of time so 

quickly here today, is, it appears that as we have celebrated the 

success of improving the system in the first couple months—I will 

note it was a new $1-trillion program—one of the recommendations 

is for clear leadership. Earth-shattering. Thank you. 

The CHAIRMAN. Senator Isakson? 

Senator ISAKSON. Thank you, Mr. Chairman. 

I apologize for missing your testimony, and I apologize for being 

late. But I do have one question based on a letter that I have sent 

previously to CMS, and I want to ask this question. 

Mr. Bagdoyan, do you agree that increasing the utilization of existing, tested data sources is one easy way that CMS could reach 

the mutual goal of expanding program integrity and management 

and better assess fraud risk? 

Mr. BAGDOYAN. Yes. That is, in fact, one of our recommendations 

to CMS: to consider doing that on an active basis, both to capture 

the data and then analyze the data for whatever indicators that 

they may throw off and act upon those. Yes. 

Senator ISAKSON. Then do you have any idea when CMS is going 

to move forward to actually take advantage of that and do it? 

Mr. BAGDOYAN. Well, as I stated before in response to several 

Senators’ questions, CMS has accepted those recommendations. 

They are on record in writing as having done so. And as I said in 

my opening statement, it is now incumbent on the agency to take 

action on a timely basis. But as I said, it will take time to work 

through this. It is not an easy fix. It is not a short-term fix. It is 

not a one-and-done fix. 

Senator ISAKSON. Well, I apologize for being late, because obviously you covered it in your opening statement. But there is readily 

available data and companies that are already under contract to 

CMS that are available to provide information that could greatly 

enhance the integrity of the program and uproot fraud a lot easier, 

and I appreciate your testimony to that effect. 

Mr. BAGDOYAN. Yes. The data are available, definitely. 

Senator ISAKSON. Thank you. Thank you, Mr. Chairman. 

The CHAIRMAN. Thank you. I want to thank our witnesses for appearing here today. The work that each of you does is very important, as far as we are concerned, you and your organizations. It is 

vitally important to this committee, and we are thankful for the 

19 

quality product that both the HHS/OIG and GAO produce to assist 

us in our policymaking and oversight efforts. 

I also want to thank my colleagues for their participation in this 

important hearing. I think the hearing has been insightful. It has 

been enlightening. Unfortunately, I think this hearing further revealed that we are only now getting to the water level of the 

Obamacare iceberg, it seems to me. 

As premiums continue to skyrocket and insurance options become more and more limited, an increasing number of Americans 

are being hung out to dry. Over the past year, we had a reasonable 

amount of consensus on several of the unworkable and failed provisions of Obamacare, but for some reason, many still have their 

heads stuck in the sand hoping that things will finally start working out at some point. 

Now, I implore my Democratic colleagues to work with me and 

my Republican friends to repeal and replace the so-called Affordable Care Act before it is altogether too late. Insurance premiums 

and health-care costs continue to rise, and little is being done to 

stem the tide. 

It is high time to put partisan politicking and bickering aside 

and find workable bipartisan solutions. There is more we can do. 

There is more we, it seems to me, have to do. Honestly, I earnestly 

believe that we can do it. The American people deserve better than 

what they have right now and, more importantly, than what they 

are about to have in the next few years. 

So I encourage each of my colleagues to meet with me and find 

workable solutions, and I encourage both of you to keep doing the 

jobs that you are doing. They are very important to this committee 

and I think to our country at-large. 

I would ask that any written questions for the record be submitted by Thursday, March 31st of this year. 

With that, this hearing will be adjourned. Thank you for being 

here. 

[Whereupon, at 11:10 a.m., the hearing was concluded.] 

(21) 

1Specifically, the act required, by January 1, 2014, the establishment of health-insurance 

marketplaces in all States. In States not electing to operate their own marketplaces, the Federal 

Government was required to operate a marketplace. 2 Enrollees can pay lower monthly premiums by virtue of a tax credit the act provides. 

3 In particular, PPACA requires that consumer-submitted information be verified, and that determinations of eligibility be made, through either an electronic verification system or another 

method approved by HHS. To implement this verification process, CMS developed the data hub, 

which acts as a portal for exchanging information between the Federal Marketplace, State-based 

marketplaces, and Medicaid agencies, among other entities, and CMS’s external partners, including other Federal agencies. The Marketplace uses the data hub in an attempt to verify that 

applicant information necessary to support an eligibility determination is consistent with external data sources. 

A P P E N D I X 

ADDITIONAL MATERIAL SUBMITTED FOR THE RECORD

PREPARED STATEMENT OF SETO J. BAGDOYAN, DIRECTOR OF AUDITS, FORENSIC

AUDITS AND INVESTIGATIVE SERVICE, GOVERNMENT ACCOUNTABILITY OFFICE

Chairman Hatch, Ranking Member Wyden, and members of the committee: 

I am pleased to be here today to discuss enrollment and verification controls for 

health-care coverage that individuals obtain through the Federal health-insurance 

exchange under the Patient Protection and Affordable Care Act (PPACA). The act 

expands the availability of subsidized health-care coverage, and it provides for the 

establishment of health-insurance exchanges, or marketplaces, to help consumers in 

comparing and selecting among insurance plans offered by participating private 

issuers of health-care coverage. Under PPACA, States may elect to operate their 

own health-care marketplaces, or may rely on the federally facilitated marketplace, 

or Health Insurance Marketplace (Marketplace).1 The Centers for Medicare and 

Medicaid Services (CMS), a unit of the Department of Health and Human Services 

(HHS), maintains the Federal Marketplace. 

To be eligible to enroll in a qualified health plan offered through a marketplace, 

an individual must be a U.S. citizen or national, or otherwise lawfully present in 

the United States; reside in the marketplace service area; and not be incarcerated 

(unless incarcerated while awaiting disposition of charges). Marketplaces, in turn, 

are required by law to verify application information to determine eligibility for enrollment and, if applicable, determine eligibility for income-based subsidies the act 

provides. 

PPACA provides subsidies to those eligible to purchase private health-insurance 

plans who meet certain income and other requirements. According to the Congressional Budget Office, the estimated cost of subsidies and related spending under the 

act is $880 billion for fiscal years 2016–2025. While subsidies under the act are not 

paid directly to enrollees, participants nevertheless benefit through reduced monthly 

premiums or lower costs due at time of service, such as copayments.2 Because subsidy costs hinge on eligibility for coverage, enrollment controls that help ensure only 

qualified applicants are approved for coverage with subsidies are a key factor in determining Federal expenditures under the act. 

A central feature of the enrollment controls is the Federal ‘‘data services hub’’ 

(data hub), which, among other things, provides a vehicle to check applicant-provided information against a variety of data sources.3 Verification steps include valiVerDate Mar 15 2010 15:50 Feb 09, 2017 Jkt 000000 PO 00000 Frm 00025 Fmt 6601 Sfmt 6621 R:\DOCS\24057.000 TIMD
22 

4 A marketplace must require an applicant who has a Social Security number to provide the 

number. 42 U.S.C. § 18081(b)(2) and 45 CFR § 155.310(a)(3)(i). However, having a Social Security number is not a condition of eligibility. 5When an inconsistency is generated, the Marketplace is to proceed with determining other 

elements of eligibility using the attestations of the applicant, and ensure that subsidies are provided on behalf of the applicant, if he or she is qualified to receive them, while the inconsistency 

is being resolved. As part of this resolution process, the applicant is generally required to submit 

documentation to substantiate eligibility for the program. In the case of the Federal Marketplace, CMS uses a document-processing contractor, which reviews documentation applicants 

submit, by mail or online upload, to resolve inconsistencies. Inconsistencies are discussed more 

fully later in this testimony. 6GAO, Patient Protection and Affordable Care Act: CMS Should Act to Strengthen Enrollment 

Controls and Manage Fraud Risk, GAO–16–29 (Washington, DC: February 23, 2016). In addition, we have presented two other related testimonies prior to issuance of the report. See GAO, 

Patient Protection and Affordable Care Act: Preliminary Results of Undercover Testing of Enrollment Controls for Health Care Coverage and Consumer Subsidies Provided Under the Act, GAO– 

14–705T (Washington, DC: July 23, 2014); and GAO, Patient Protection and Affordable Care Act: 

Observations on 18 Undercover Tests of Enrollment Controls for Health-Care Coverage and Consumer Subsidies Provided under the Act, GAO–15–702T (Washington, DC: July 16, 2015). 7 In addition to findings presented in this testimony—and as described in detail in our July 

2015 testimony, with additional information provided in our February 2016 report—our work 

also identified vulnerability to fraud, when we obtained, through covert vulnerability testing, 

Federal Marketplace approval of subsidized coverage for 11 of 12 fictitious applicants for 2014, 

with coverage continuing into 2015. We concluded CMS has assumed a passive approach to 

identifying and preventing fraud, and that adopting a more strategic, risk-based approach could 

help identify fraud vulnerabilities before they could be exploited in the enrollment process. We 

recommended that HHS direct CMS to conduct a fraud risk assessment, consistent with best 

practices provided in GAO’s framework for managing fraud risks in Federal programs, of the 

potential for fraud in the process of applying for qualified health plans through the Federal Marketplace. HHS concurred with our recommendation and said it plans to conduct such an assessment. See the framework at GAO, A Framework for Managing Fraud Risks in Federal Programs, GAO–15–593SP (Washington, DC: July 2015). 8 In this testimony, we use ‘‘outcomes’’ to mean results obtained from inquiries made through 

the data hub, and not any ultimate determination made whether an applicant inconsistency exists. 

dating an applicant’s Social Security number, if one is provided; 4 verifying citizenship, status as a national, or lawful presence by comparison with Social Security Administration (SSA) or Department of Homeland Security (DHS) records; and verifying household income and family size by comparison against tax-return data from 

the Internal Revenue Service (IRS), as well as data on Social Security benefits from 

SSA. 

If the eligibility information applicants provide to the Federal Marketplace cannot 

be verified through the external sources, such as SSA, IRS, and DHS, an ‘‘inconsistency’’ will result. In particular, an inconsistency can arise when the data hub query 

process yields no information; or when information is available through the data 

hub, but it does not match information the applicant has provided.5

My testimony today is based on a report we issued on February 23, 2016, that 

examined eligibility and enrollment controls, and fraud risk, of the Federal Marketplace.6 It addresses: 

1. The extent to which applicant information is verified through the data hub— 

the primary means for verifying eligibility; and 

2. The extent to which the Federal Marketplace resolved inconsistencies that resulted from the data hub verification process.7

In our report, to examine outcomes of the data hub applicant verification process, 

we obtained summary data from key Federal agencies involved in the process—SSA, 

IRS, and DHS—on the nature and extent of their responses to electronic inquiries 

made through the data hub, for the 2014 and 2015 coverage years.8 We also interviewed agency officials and reviewed statutes, regulations, and other policy and related information. In addition, we obtained applicant data on inconsistencies, subsidies awarded, and submission of required verification documentation, from CMS 

data systems for coverage year 2014. To determine the reliability of data we used, 

we interviewed CMS officials and others responsible for their respective data, reviewed relevant documentation, and performed electronic testing to determine the 

validity of specific data elements we used to perform our work. Based on this reliability examination, we concluded that the data we used were sufficiently reliable 

for our purposes. 

23 

9 In particular, according to CMS officials, the data hub does not read and store the content 

of requests received. It only validates message structure and determines routing information to 

send the request to the correct destination. The data hub next returns the response it receives 

to the requester. The data hub stores data such as transaction identifier for each request. By 

CMS requirements, the data hub cannot store privacy data, the officials said. 10 According to CMS officials, the data hub only captures a code for type of reply that is generated when agencies respond to the inquiries, and those codes are not associated with any 

other applicant-identifying information or information that may have been provided in response 

to the query. There are no additional data kept on what information might have been transmitted in the source agency’s response, such as income or family size. Likewise, the data hub 

does not track whether information provided through the data hub matches information originally provided by the applicant, the officials said. 11The agencies could not comprehensively identify the number of duplicates. 12For example, SSA accomplished a match on name, Social Security number, and date of birth 

in about 95 percent of cases for PPACA’s first enrollment cycle, for 2014 coverage. However, for 

about 4.4 million inquiries—or about 5 percent of the total—the applicant information did not 

match SSA records. In addition, after completion of the name, Social Security number, and date 

of birth match, when SSA attempted to verify additional information, the agency could not confirm citizenship in about 8.2 million inquiries where individuals claimed they were citizens. 

Additional details on our scope and methodology can be found in our report. We 

conducted our performance audit from January 2014 to February 2016 in accordance 

with generally accepted government auditing standards. 

CMS’S APPROACH TO APPLICANT VERIFICATION INFORMATION NEEDS IMPROVEMENT

HHS officials described the data hub process to us as being part of an innovative, 

multilayered approach to verifying applicant information efficiently and without 

undue burden on individuals and families. Through secure electronic connections, 

the data hub provides real-time responses to eligibility queries, HHS told us. 

In our February 2016 report, however, we found that although the data hub plays 

a key role in the eligibility and enrollment process, CMS officials said the agency 

does not track the extent to which the Federal agencies deliver responsive information to a request, or, alternatively, whether they report that information was not 

available. Additionally, CMS officials said they do not analyze data provided in response to data hub inquiries. This is because, they said, by design, the data hub 

does not store individual transactional data that could be collectively analyzed over 

time. For policy reasons, the officials said, the agency did not want the data hub 

to become a data repository itself, and in particular, a repository of sensitive personal data.9 The CMS officials also said the agency is barred legally from maintaining IRS taxpayer information in the data hub. 

Asked about analysis of data hub responses, CMS officials told us when we conducted work for our February 2016 report that the key performance measures for 

the data hub are the extent to which the system is available for queries, and the 

extent to which transmissions of queries and responses are successfully accomplished; that is, that an inquiry is made and a corresponding reply received, without 

regard to content.10

Further, the Federal agencies responding to data hub queries generally told us 

they do not analyze outcomes of data hub inquiries. Instead, SSA, IRS, and DHS 

officials said they focus on responding to inquiries received. Our review also found 

that SSA, IRS, and DHS had limited information on the nature and extent of the 

inquiries made by the data hub. According to the three agencies, available statistics 

reflect data hub inquiries in general, and cannot be broken out by program, such 

as a qualified health plan or Medicaid. In addition, according to agency officials, an 

unknown number of data hub applicant inquiries were duplicates, which we could 

not eliminate from our examination.11 Instead, agency officials told us, they generally process inquiries sequentially as they are received from the data hub. Thus, 

we found that while the agencies can provide some information on data hub queries, 

they cannot provide comprehensive information specifically on number of inquiries 

and individuals represented by those queries. 

We further found, based on our examination of available statistics from SSA, IRS, 

and DHS, that while the agencies could successfully provide applicant verification 

information in a large percentage of cases, they did not have data in their records 

to verify information for millions of data hub inquiries over the course of PPACA’s 

first two enrollment cycles, for 2014 and 2015 coverage.12

We concluded that by not assessing the extent to which data hub—provided data 

matches applicant-provided information, CMS foregoes analysis of the extent to 

which responding agencies successfully deliver applicant verification information in 

24 

13 By analyzing the outcomes of data hub inquiries, and in particular, clarifying the nature 

and extent of inconsistencies arising from this process, CMS could, for example, assess whether 

other sources of data, such as the National Directory of New Hires, could be useful for more 

current applicant information on income. Similarly, CMS could analyze the information to examine whether other sources of citizenship information, such as the Department of State’s passport 

data, could be used to aid in verifying applicant citizenship. There may also be correlations observed between various types of applicants and types of information available from trusted data 

sources. 14When applicants apply for coverage, they report family size and the amount of projected 

income. Based, in part, on that information, the Marketplace will calculate the maximum allowable amount of APTC. An applicant can then decide if he or she wants all, some, or none of 

the estimated credit paid in advance, in the form of payment to the applicant’s insurer that reduces the applicant’s monthly premium payment. If an applicant chooses to have all or some 

of his or her credit paid in advance, the applicant is required to ‘‘reconcile’’ on his or her Federal 

tax return the amount of advance payments the government sent to the applicant’s insurer on 

the applicant’s behalf with the tax credit for which the applicant qualifies based on actual reported income and family size. 15 In particular, we obtained data from CMS on applicant inconsistencies generated for the 

Federal Marketplace and the value of APTC and CSR subsidies associated with them, for the 

2014 coverage year. Specifically, to observe the number of inconsistencies created and subsequently resolved, we examined applications that were awarded subsidies and that were created 

and submitted during the 2014 open-enrollment period plus a special enrollment period extension that followed. The open-enrollment period ran from October 1, 2013, to March 31, 2014, 

and the extension was through April 19, 2014. 

We excluded from our analysis applications modified after submission, because CMS officials 

told us that inconsistencies can be generated or resolved based on consumer actions, such as 

updating of application information. We selected the unmodified applications that had received 

subsidies as presenting the simplest case for examining inconsistency generation and subsequent resolution. 

Our selection criteria meant excluding 17 percent of the total number of applications with subsidies and inconsistencies because they had been modified. A single application may reflect more 

than one person, each of whom might have different inconsistencies in different stages of resolution. The CMS data provided the APTC and CSR amounts at the application level. Consequently, the results of our analysis are not mutually exclusive by type of inconsistency, and 

applications and their associated subsidy amounts may be represented in multiple categories. 16The remainder were terminations or adjustments based on failure to submit documentation 

to resolve inconsistencies. By comparison with the inconsistency results in our analysis, HHS 

response to data hub requests. In doing so, CMS foregoes information that could 

suggest potential program issues or potential vulnerabilities to fraud, as well as information that might be useful for enhancing program management.13 We recommended that HHS direct CMS to conduct a comprehensive feasibility study on 

actions CMS can take to monitor and analyze, both quantitatively and qualitatively, 

the extent to which data hub queries provide requested or relevant applicant 

verification information, for the purpose of improving the data-matching process and 

reducing the number of applicant inconsistencies; and for those actions identified as 

feasible, create a written plan and schedule for implementing them. HHS said it 

concurred with our recommendation and is reviewing options for such a study. 

THE FEDERAL MARKETPLACE DID NOT RESOLVE ABOUT ONE-THIRD OF APPLICANT IN- CONSISTENCIES FOR COVERAGE YEAR 2014, INVOLVING $1.7 BILLION IN ASSOCIATED

SUBSIDIES

For qualifying applicants, the act provides two forms of subsidies for consumers 

enrolling in individual health plans, both of which are paid directly to insurers on 

consumers’ behalf. One is a Federal income tax credit, which enrollees may elect to 

receive in advance of filing tax returns, and which reduces a consumer’s monthly 

premium payment. This is known as the advance premium tax credit (APTC).14 The 

other, known as cost-sharing reduction (CSR), is a discount that lowers the amount 

consumers pay for out-of-pocket charges such as deductibles, coinsurance, and copayments. 

In our report, for applicants who obtained subsidies but had application inconsistencies, we identified about 1.1 million applications with a total of about 2 million 

inconsistencies.15 These applications had combined APTC and CSR subsidies of 

about $4.4 billion associated with them for coverage year 2014. We found, based on 

our analysis of CMS data, that the agency resolved about 58 percent of the total 

inconsistencies, meaning the inconsistencies were settled by consumer action, such 

as document submission, or removed due to events such as life change, application 

deletion, or consumer cancellation. Meanwhile, our analysis found that about 34 

percent of inconsistencies, with about $1.7 billion in associated subsidies, remained 

open, as of April 2015—that is, inconsistencies still open several months following 

the close of the 2014 coverage year.16

25 

reported that more than 8.84 million people selected or were automatically reenrolled in 2015 

plans through the Federal Marketplace as of the end of the second open enrollment period on 

February 15, 2015. 17These other inconsistencies relate to American Indian status, and presence of qualifying 

employer-sponsored coverage or other minimum essential coverage. 18 45 CFR § 155.315(b). 19 45 CFR § 155.315(b). 20 77 Fed. Reg. 18310, 18355 (March 27, 2012). 21See GAO–16–29 for a full discussion. 

We also found, based on our analysis of the 2014 data, that CMS did not terminate or adjust subsides for any applications with incarceration or Social Security 

number inconsistencies, plus other inconsistencies.17 Further, CMS officials told us 

that they currently do not plan to take any actions on individuals with unresolved 

Social Security number or incarceration inconsistencies. 

Social Security number inconsistencies. Under CMS regulations, the Marketplace must validate all Social Security numbers provided by submitting them to 

SSA along with other identifying information. If the Marketplace is unable to validate the Social Security number, it must follow the standard process for resolving 

all types of inconsistencies.18 In our analysis, we identified about 35,000 applications that had an unresolved Social Security number inconsistency, which were associated with about $154 million in combined subsidies. 

We reported that CMS officials told us they did not take action to terminate coverage or adjust subsidies during 2014 based on Social Security number inconsistencies. They said this was because such inconsistencies are generally related to 

other inconsistencies, such as citizenship or immigration status, and that document 

submissions for citizenship or immigration status may also resolve Social Security 

number inconsistencies. Overall, CMS officials told us they do not consider missing 

or invalid Social Security number information to be a stand-alone inconsistency that 

must be resolved, and do not take adverse action in such cases. 

However, CMS regulations state that ‘‘to the extent that the [Marketplace] is unable to validate an individual’s Social Security number through the Social Security 

Administration,’’ the Marketplace must follow its standard inconsistency procedures.19 Further, when promulgating this regulation, CMS explained that transmitting Social Security numbers to SSA for validation ‘‘is separate from the [PPACA] 

provision regarding citizenship verification, and only serves to ensure that SSNs 

[Social Security numbers] provided to the [Marketplace] can be used for subsequent 

transactions, including for verification of family size and household income with 

IRS.’’ 20

In addition to unresolved Social Security number inconsistencies generally, our 

analysis also found in particular more than 2,000 applications with Social Security 

number inconsistencies that had no corresponding citizenship or immigration inconsistencies. We also identified nearly 5,500 applications with Social Security number 

inconsistencies that had no corresponding income inconsistency. These applications 

had total subsidies of about $10 million and $31 million associated with them, respectively. They indicate that Social Security number inconsistencies can stand 

alone, unrelated to other inconsistencies. 

Social Security number inconsistencies also affect tax compliance. Missing or invalid Social Security numbers can affect IRS verification that taxpayers have properly filed APTC information on their tax returns, as well as impair IRS outreach 

to taxpayers who have received the APTC subsidy.21

We recommended that HHS direct CMS to identify and implement procedures to 

resolve Social Security number inconsistencies where the Marketplace is unable to 

verify Social Security numbers or applicants do not provide them. HHS concurred 

with our recommendation, but did not provide details on how it would seek to implement it. 

Incarceration inconsistencies. In our inconsistency analysis that we reported 

on in February 2016, we identified about 22,000 applications having an unresolved 

incarceration inconsistency, which were associated with about $68 million in combined subsidies. CMS officials, however, told us they did not terminate eligibility for 

incarceration inconsistencies, because the agency determined in fall 2014 that SSA’s 

Prisoner Update Processing System (PUPS) was unreliable for use by the MarketVerDate Mar 15 2010 15:50 Feb 09, 2017 Jkt 000000 PO 00000 Frm 00029 Fmt 6601 Sfmt 6621 R:\DOCS\24057.000 TIMD
26 

22The PUPS system contains information on incarcerated individuals in all 50 State corrections departments, the Federal Bureau of Prisons, and local and other facilities. According to 

SSA, it is the only national database with records of Federal, State, and local incarcerations. 

SSA uses PUPS to identify individuals who may no longer be eligible for SSA benefits due to 

incarceration. In addition to SSA, other Federal programs, such as Medicare, use PUPS data. 23 In the absence of an approved data source, the Marketplace may accept applicant attestation on incarceration status without further verification, unless the attestation is not reasonably 

compatible with other information in its records. 45 CFR § 155.315(e). 

place.22 As a result, CMS officials told us the agency elected to rely on applicant 

attestations on incarceration status.23

PPACA provides that incarcerated individuals are not eligible to enroll in a qualified health plan through a marketplace, with the exception of those incarcerated 

pending disposition of charges. CMS currently uses PUPS to generate incarceration 

inconsistencies when there are indications an applicant may be incarcerated. As 

part of the inconsistency resolution process, the Marketplace notifies applicants to 

send documentation to resolve the inconsistency. To do so, consumers can submit 

documentation such as release papers, CMS officials told us. 

Under CMS’s approach to incarceration inconsistencies, agency officials told us, 

the Marketplace continues to make an initial verification attempt using the PUPS 

data. If a consumer maintains he or she is not incarcerated, CMS will rely on that 

representation and not take adverse action, regardless of what PUPS indicates, officials told us. According to HHS officials, based on the data reliability issue, the 

Marketplace no longer requires applicants to submit documentation on incarceration 

status. 

In its 2013 computer-matching agreement with CMS, SSA acknowledged that 

PUPS is not as accurate as other SSA data and contains information that SSA may 

not have independently verified. Thus, the agreement states that CMS will independently verify information it receives from PUPS and will provide individuals an 

opportunity to contest an incarceration inconsistency before any adverse action in 

an eligibility determination. Overall, according to SSA officials, PUPS information 

can be used to identify individuals who require additional follow-up to determine eligibility. 

We reported that our review of documentation CMS provided for its decision to 

take no adverse action on incarceration inconsistencies showed it did not contain 

key information supporting the agency’s decision to not use PUPS data. Specifically, 

the documentation did not provide specific details on why, or to what extent, people 

were misidentified as incarcerated; why CMS also judged inmate release information to be unreliable; any criteria or assessment employed to conclude that the 

PUPS data were not sufficiently current or accurate; or the potential cost associated 

with not verifying incarceration status. 

We concluded that without clearly identifying such elements as analysis, scope, 

and costs of significant decisions, CMS is at greater risk of providing benefits to ineligible applicants, and also may undermine confidence in the applicant verification 

process and compromise overall program integrity. We further concluded that by not 

using PUPS data as a lead for further investigation, and by relying on applicant 

attestation in the alternative, CMS may be granting eligibility to, and making subsidy payments on behalf of, individuals who are ineligible to enroll in qualified 

health plans. 

We recommended that HHS direct CMS to reevaluate use of PUPS incarceration 

data and make a determination to either (1) use the PUPS data, among other 

things, as an indicator of further research required in individual cases, and to develop an effective process to clear incarceration inconsistencies or terminate coverage; or (2) if no suitable process can be identified to verify incarceration status, 

accept applicant attestation on status in all cases, unless the attestation is not reasonably compatible with other information that may indicate incarceration, and 

forego the inconsistency process. HHS concurred with our recommendation, but did 

not provide details on how it would seek to implement it. 

We also recommended that HHS direct CMS to fully document prior to implementation, and have readily available for inspection thereafter, any significant decision 

on qualified health plan enrollment and eligibility matters, with such documentation to include details such as policy objectives, supporting analysis, scope, and exVerDate Mar 15 2010 15:50 Feb 09, 2017 Jkt 000000 PO 00000 Frm 00030 Fmt 6601 Sfmt 6621 R:\DOCS\24057.000 TIMD
27 

24 In all, our February 2016 report contained eight recommendations to HHS, and the agency 

concurred with all of them. See GAO–16–29 for the complete list of recommendations, as well 

as HHS agency comments and our evaluation of them. 1See GAO, Patient Protection and Affordable Care Act: CMS Should Act to Strengthen Enrollment Controls and Manage Fraud Risk, GAO–16–29 (Washington, DC: February 23, 2016). A 

central feature of enrollment controls under the Patient Protection and Affordable Care Act 

(PPACA) is the Federal ‘‘data services hub’’ (data hub), which, among other things, provides a 

vehicle to check applicant-provided information against a variety of data sources. In particular, 

the act requires that consumer-submitted information be verified, and that determinations of 

eligibility be made, through either an electronic verification system or another method approved 

by the Department of Health and Human Services (HHS). To implement this verification process, CMS developed the data hub, which acts as a portal for exchanging information between 

the Federal Health Insurance Marketplace, State-based marketplaces, and Medicaid agencies, 

among other entities, and CMS’s external partners, including other federal agencies. 2 An ‘‘inconsistency’’ arises when an applicant’s information does not match information from 

marketplace data sources. 

pected costs and effects. HHS concurred with our recommendation, and said it was 

committed to documenting significant decisions.24

Chairman Hatch, Ranking Member Wyden, and members of the committee, this 

completes my prepared statement. I would be pleased to respond to any questions 

that you may have at this time. 

QUESTIONS SUBMITTED FOR THE RECORD TO SETO J. BAGDOYAN

QUESTIONS SUBMITTED BY HON. CHUCK GRASSLEY

I would like the record to show that I was unable to attend this hearing in person. 

As Chairman of the Senate Judiciary Committee, I was overseeing the debate about 

the Supreme Court vacancy. The two hearings were at the same time. 

It was pretty disturbing to hear the report of your undercover testing of the Federal Marketplace last year. 

Eleven of 12—that’s over 90%—of fictitious GAO phone or online applicants were 

able to obtain a total of $30,000 in Obamacare subsidies and were able to maintain 

coverage throughout 2014. People signed up and received subsidies and coverage in 

some cases without any documentation. 

And as shocking as that is, today’s report is even worse. You reveal vulnerabilities 

at the data hub of HealthCare.gov that could cost taxpayers billions of dollars. 

Question. Your report found that CMS does not track the responses to inquiries 

made of Federal agencies at the data hub. If CMS does not track or analyze this 

information, how can eligibility for Obamacare and subsidies be verified, as required 

by law? 

Answer. In accordance with our audit objectives, our work focused on macroanalysis of data hub query outcomes, and did not address the process of making eligibility determinations for individual applications. 

Thus, in our February 2016 report, we found that although the data hub plays 

a key role in the eligibility and enrollment process, Centers for Medicare and Medicaid Services (CMS) officials said the agency does not track the extent to which the 

Federal agencies deliver responsive information to a request, or, alternatively, 

whether they report that information was not available. Additionally, CMS officials 

said they do not analyze data provided in response to data hub inquiries.1

By analyzing the outcomes of data hub inquiries and, in particular, clarifying the 

nature and extent of inconsistencies arising from this process, CMS could, for example, assess whether other sources of data could be useful to provide more current 

information on applicant income.2 There may also be correlations observed between 

various types of applicants and types of information available from data sources. 

We concluded that by not assessing the extent to which data provided through 

the data hub matches applicant-provided information, CMS foregoes analysis of the 

extent to which responding agencies successfully deliver applicant verification information in response to data hub requests. Without such an analysis, CMS foregoes 

information that could suggest potential program issues or potential vulnerabilities 

to fraud, as well as information that might be useful for enhancing program management. 

28 

3For qualifying applicants, PPACA provides two possible forms of subsidies for consumers enrolling in individual health plans, both of which are paid directly to insurers on consumers’ behalf. One is a Federal income tax credit, which enrollees may elect to receive in advance, and 

which reduces a consumer’s monthly premium payment. This subsidy is known as the advance 

premium tax credit. The other, known as cost-sharing reduction, is a discount that lowers the 

amount consumers pay for out-of-pocket charges for deductibles, coinsurance, and copayments. 4See GAO, Patient Protection and Affordable Care Act: Preliminary Results of Undercover 

Testing of the Federal Marketplace and Selected State Marketplaces for Coverage Year 2015, 

GAO–16–159T (Washington, DC: October 23, 2015). In addition to our 10 applications for subsidized private health plans, we also made eight additional fictitious applications for Medicaid 

coverage, in order to test the ability to apply for that program through the marketplaces. In 

these tests, we were approved for subsidized health-care coverage for seven of the eight applications. For three of the eight applications, we were approved for Medicaid, as originally sought. 

For four of the eight applications, we did not obtain Medicaid approval, but instead were subsequently approved for subsidized qualified health-plan coverage. Thus, for the second round of 

testing overall, we obtained coverage for 17 of 18 applicants. 

Question. Monitoring activities are an important part of fraud prevention. What 

does CMS need to do in order to implement effective monitoring activities? 

Answer. In our February 2016 report, we recommended that CMS should conduct 

a comprehensive feasibility study on actions it can take to monitor and analyze, 

both quantitatively and qualitatively, the extent to which data hub queries provide 

requested or relevant applicant verification information, for the purpose of improving the data-matching process and reducing the number of applicant inconsistencies; 

and for those actions identified as feasible, create a written plan and schedule for 

implementing them. The Department of Health and Human Services (HHS), CMS’s 

parent agency, concurred with our recommendation. 

Question. Rather than track the amounts of the subsidies, CMS compiles the number of individuals or households affected when a subsidy is terminated for incomplete information. These changes to these subsidies have a cost to taxpayers. Federal internal control standards state that managers need financial information to 

make operating decisions, among other activities. How can CMS improve in this 

area in order to be a better steward of the taxpayers’ dollars? 

Answer. In our February 2016 report, we recommended that CMS track the value 

of advance premium tax credit and cost-sharing reduction subsidies that are terminated or adjusted for failure to resolve application inconsistencies, and use this information to inform assessments of program risk and performance.3 HHS concurred 

with our recommendation. 

Question. In your testimony, you explained that GAO had used a ‘‘secret shopper’’ 

technique to explore possible vulnerabilities to fraud within HealthCare.gov. 

Is this technique a well-accepted tool for government and private auditors to use? 

Answer. We have not examined the prevalence of covert testing in other settings, 

but GAO has conducted undercover work, including the use of fictitious applicants, 

to test controls in other Federal programs, in addition to health-care coverage provided under the Patient Protection and Affordable Care Act. GAO has received requests for undercover work from chairs or ranking members of a number of congressional committees and subcommittees. 

Question. How do you interpret your findings of this particular ‘‘secret shopper’’ 

activity? 

Answer. Through covert vulnerability testing, we obtained Federal Health Insurance Marketplace (Marketplace) approval of subsidized coverage for 11 of 12 fictitious applicants for 2014, with coverage continuing into 2015. These results, while 

not generalizable, nevertheless illustrate that the Marketplace enrollment process 

is vulnerable to fraud. Further, for a second round of testing—for 2015 coverage, 

and which also included two State marketplaces in addition to the Federal Marketplace—we obtained subsidized marketplace coverage for fictitious applicants in 10 

of 10 instances.4

Question. In your professional opinion, are the findings of this ‘‘secret shopper’’ 

activity concerning? 

Answer. As noted above, our results illustrate that the Marketplace enrollment 

process is vulnerable to fraud. A program of this scope and scale is inherently at 

risk for errors, including improper payments and fraud. Accordingly, it is essential 

that effective enrollment controls are in place to help narrow the window of opportunity for such risk and safeguard the government’s investment. Based on our testVerDate Mar 15 2010 15:50 Feb 09, 2017 Jkt 000000 PO 00000 Frm 00032 Fmt 6601 Sfmt 6621 R:\DOCS\24057.000 TIMD
29 

5See GAO, A Framework for Managing Fraud Risks in Federal Programs, GAO–15–593SP 

(Washington, DC: July 2015). 

ing and related work, we concluded that CMS has assumed a passive approach to 

identifying and preventing eligibility and enrollment fraud. In February 2016, we 

recommended that CMS conduct a fraud risk assessment, consistent with best practices provided in GAO’s framework for managing fraud risks in Federal programs, 

of the potential for fraud in the process of applying for qualified health plans 

through the Federal Marketplace.5 HHS concurred with our recommendation. 

QUESTIONS SUBMITTED BY HON. ROB PORTMAN

Question. I am extremely concerned that a large number of enrollees in Ohio and 

across the country may be receiving coverage when they are not legally eligible to 

do so, because they have already been offered coverage through their employers. 

Many are unaware that they will owe enormous tax bills at the end of the year, 

all because HHS lacks the ability to verify whether an applicant has actually been 

offered coverage and is providing subsidies when they should not. 

That is why I introduced S. 1996, the Commonsense Reporting Act. This would 

allow employers to prospectively report to the IRS before the open enrollment period 

opens whether they are offering coverage to their employees. The government would 

definitively have this information well before enrollment begins—today, they only 

receive this information after employees may already be enrolled in coverage and 

receiving subsidies, meaning the IRS will have to claw back the money. 

Do you believe it would help make subsidy approval more accurate if IRS and 

HHS had this type of information prior to open enrollment beginning? 

Why has HHS been unable to help tax payers avoid these repayment penalties? 

Do you believe it would lower the instances of employees who are offered coverage 

from being hit with surprise tax bills because they were not eligible for the subsidies 

they received? 

Answer. We did not report on the availability of employer-sponsored insurance at 

time of enrollment, and thus we cannot offer any observations. 

Question. Your report also identifies that CMS is not tracking the extent to which 

agencies respond to individual’s inaccuracies. Can you explain how this information 

could potentially be used by CMS, if they were to track it? 

Answer. Please see the answer to Senator Grassley’s first question. As discussed 

there, by not tracking outcomes of data hub queries, CMS foregoes information that 

could suggest potential program issues or potential vulnerabilities to fraud, as well 

as information that might be useful for enhancing program management. 

Question. Wouldn’t a better system provide timely updated information about the 

availability of employer-sponsored insurance at the time of enrollment? 

Answer. We did not report on the availability of employer-sponsored insurance at 

time of enrollment, and thus we cannot offer any observations. 

QUESTIONS SUBMITTED BY HON. DEAN HELLER

Question. As of March 2016, there were 88,145 Nevadans on the Exchange, but 

only 76,821 of these enrollees have selected a plan. 

How can CMS count consumers as ‘‘enrollees’’ if they have not ‘‘enrolled’’ in a 

plan? 

What barriers exist that would have prevented nearly 12,000 Nevadans from selecting a plan? 

Answer. According to the HHS Office of the Assistant Secretary for Planning and 

Evaluation (ASPE), Nevada activity for the 2016 open enrollment period (November 

1, 2015 to February 1, 2016), as of March 2016, was as follows: 

30 

STAGE OF APPLICATION NUMBER 

A. Total completed applications 93,255 

B. Total individuals applying for coverage in completed applications 134,454 

C. Total individuals eligible to enroll in a marketplace plan 107,525 

D. Number of individuals eligible to enroll in a marketplace plan with financial assistance 89,716 

E. Number of individuals who selected a marketplace plan 88,145 

F. Number of individuals with 2016 marketplace plan selections with advance premium tax credit 76,821 

Notes: For items A–E, for complete details, including explanatory notes on the figures shown, see Department of Health and Human Services, Office of the Assistant Secretary for Planning and Evaluation, ‘‘Addendum to the Health Insurance Marketplaces 2016 Open Enrollment 

Period: Final Enrollment Report,’’ ASPE Issue Brief (March 11, 2016). For item F, for complete details and explanatory note, see Department of 

Health and Human Services, Office of the Assistant Secretary for Planning and Evaluation, ‘‘Health Insurance Marketplaces 2016 Open Enrollment Period: Final Enrollment Report,’’ ASPE Issue Brief (March 11, 2016). 

QUESTION SUBMITTED BY HON. MICHAEL F. BENNET

Question. The investigation concludes that no cases of real world fraud were 

found. Did GAO take measures to identify cases of actual fraud in the scope of the 

overall investigation? 

Answer. As we said in our March 17, 2016 testimony, the purpose of our work 

was to seek to identify eligibility and enrollment control vulnerabilities, and not to 

attempt to identify actual cases of fraud. As noted above, our covert vulnerability 

testing demonstrated that the Marketplace enrollment process is vulnerable to 

fraud, as 11 of 12 applicants in our tests obtained coverage through fraudulent 

means. 

QUESTIONS SUBMITTED BY HON. SHERROD BROWN

Question. CMS is responsible for working in collaboration with public and private 

entities—including other Federal agencies, State Medicaid agencies, private contractors, health insurance issuers, and not-for-profit organizations—to manage the Affordable Care Act (ACA) marketplace. 

As part of its responsibilities, CMS must ensure accurate eligibility determinations, process enrollments, facilitate Medicaid enrollment for those who qualify, and 

communicate timely and accurate information to issuers and consumers. 

CMS also provides support functions for the State marketplaces and administers 

Federal financial assistance and premium stabilization programs related to the marketplaces. 

The GAO report discusses some inconsistencies that have come up as CMS has 

balanced these priorities during a period of time where Republicans were doing everything they could to sabotage the law’s implementation. But the GAO report fails 

to acknowledge two things: 

• These inconsistencies are not indicative of any widespread fraud by real-world 

enrollees, and 

• The significant work CMS has undertaken to resolve inconsistencies by either 

eliminating coverage or adjusting an individual’s advance premium tax credit. 

Isn’t it true that, in order to correct these inconsistencies, during the first nine 

months of 2015, CMS ended the enrollments of approximately 471,000 individuals 

because they failed to properly verify their identities? 

Isn’t it also true that CMS has adjusted the tax credits of approximately 1,153,000 

households whose incomes could not be properly verified? 

Answer. We cannot comment on these figures, as CMS provided us with statistics 

covering a different period, which we included in our February 2016 report. Specifically, according to CMS officials, from April through June of 2015, enrollment in 

coverage through the Federal Marketplace was terminated for about 306,000 consumers with citizenship or immigration status data-matching issues who failed to 

produce sufficient documentation. In addition, according to the officials, about 

735,000 households with income inconsistencies had their advance premium tax 

credit or cost-sharing reduction subsidies adjusted for coverage year 2015. 

In February 2016, we also reported on results of a GAO analysis of application 

inconsistencies and subsequent resolutions for the 2014 coverage year. We found 

31 

that for a group of about 1.1 million applications with a total of about 2 million inconsistencies, about 34 percent of the inconsistencies, with about $1.7 billion in associated subsidies, remained open as of April 2015—that is, still open several 

months following the close of the 2014 coverage year. 

Otherwise, as noted above, the objectives of our work were to test enrollment controls and identify vulnerabilities, if any, and not to determine the extent of fraud 

perpetrated by actual enrollees. 

Question. Has the GAO elsewhere acknowledged the work CMS did to correct 

these inconsistencies? 

Answer. Yes, our February 2016 report (p. 34) reflects CMS’s actions on terminations and adjustments. Also in that report (beginning at pp. 17 and 45), as noted 

above, we presented results of an analysis of application inconsistencies, including 

by type of inconsistency (such as income or citizenship/immigration status) and resolution. Terminations of policies and adjustments of subsidies were among resolutions we reported. 

PREPARED STATEMENT OF ERIN BLISS, ASSISTANT INSPECTOR GENERAL FOR EVALUA- TION AND INSPECTIONS, OFFICE OF INSPECTOR GENERAL, DEPARTMENT OF HEALTH

AND HUMAN SERVICES

HEALTHCARE.GOV: CASE STUDY OF CMS MANAGEMENT OF THE FEDERAL MARKETPLACE

Good morning, Chairman Hatch, Ranking Member Wyden, and other distinguished Members of the Committee. I am Erin Bliss, Assistant Inspector General 

for Evaluation and Inspections in the Office of Inspector General (OIG), U.S. Department of Health and Human Services (HHS or the Department). Thank you for 

the opportunity to testify about OIG’s case study reviewing the management of the 

Federal Marketplace website HealthCare.gov by the Centers for Medicare and Medicaid Services (CMS). 

OIG’s mission is to protect the integrity of HHS programs and the health and welfare of the people they serve. We advance our mission through a nationwide network of audits, evaluations, investigations, enforcement actions, and compliance efforts. OIG has identified oversight and operation of the Health Insurance Marketplaces as a Top Management Challenge for HHS. 

The case study is an important component of our marketplace oversight strategy. 

It primarily examines implementation of HealthCare.gov, the consumer-facing 

website for the Federal Marketplace, by CMS from passage of the Patient Protection 

and Affordable Care Act (ACA) in 2010 through the second open enrollment period 

in 2015. As required by the ACA, HealthCare.gov is the Federal website that facilitates purchase of private health insurance for consumers who reside in States that 

did not establish health insurance marketplaces. At its highly publicized launch on 

October 1, 2013, and for some time after, HealthCare.gov users experienced substantial website outages and technical malfunctions. After corrective action by CMS and 

contractors following the launch, CMS ended the first open enrollment period with 

5.4 million individuals having selected a plan through the Federal Marketplace. 

OIG’S STRATEGY FOR OVERSIGHT OF THE MARKETPLACES

OIG has completed and planned a significant body of audits and evaluations regarding the Federal Marketplace and other ACA provisions of high interest and concern to the Department, Congress, and other stakeholders. OIG’s marketplace oversight strategy focuses on four areas that we have determined to be most critical: 

payment, eligibility, management and administration, and security. 

My testimony focuses on the OIG report ‘‘HealthCare.gov: Case Study of CMS 

Management of the Federal Marketplace’’ (OEI–06–14–00350) released on February 

23, 2016. The case study report evaluates CMS’s implementation and management 

of HealthCare.gov. Consistent with the OIG’s statutory purpose to promote economy, 

efficiency, and effectiveness in the administration of Departmental programs, the 

rollout of HealthCare.gov presented a unique opportunity to assess CMS’s management and operations. The implementation of HealthCare.gov provides lessons that 

will be increasingly important as the success of Government programs becomes 

more dependent on the effective intersection of policy, technology, and management. 

The case study enabled OIG to draw conclusions about factors that contributed to 

the website’s breakdown and subsequent improvement, and lessons learned to promote effective Government operations moving forward. 

32 

1Pub. L. No. 111–148 (March 23, 2010), as amended by the Health Care and Education Reconciliation Act of 2010, Pub. L. No. 111–152 (March 30, 2010), collectively referred to as the 

Affordable Care Act (ACA). 2 Ibid. § 1311(a), (b). 3 Ibid. § 1321(c). 4Private health insurance plans certified as meeting certain standards and covering a core 

set of benefits including doctor visits, preventive care, hospitalization, and prescriptions. 5 ACA §§ 1401, 1402. 

6 The Henry J. Kaiser Family Foundation, State Decisions on Health Insurance Marketplaces 

and the Medicaid Expansion, December 17, 2015. Accessed at http://kff.org/health-reform/ 

state-indicator/state-decisions-for-creating-health-insurance-exchanges-and-expanding-medicaid/ 

on January 6, 2016. CMS, Hawaii: For 2016 insurance coverage, use HealthCare.gov to apply 

and enroll. Accessed at https://www.healthcare.gov/hawaii-2016/ on January 6, 2016. 7 Ibid. 

8 76 Fed. Reg. 4703 (Jan. 26, 2011). 

9 ACA §§ 1411, 1412. 

In summary, our case study report provides three takeaways about the development and implementation of HealthCare.gov, presented in chronological order over 

a 5-year period from passage of the ACA through the Marketplace’s second open enrollment period: 

Development and Launch: The poor launch of the website was caused by many 

avoidable organizational missteps, in addition to problems with website technology; 

Correction Through Second Open Enrollment Period: After the breakdown, CMS 

improved processes and worked with contractors and others to fix the website, 

and this approach led to broader organizational changes focused on leadership, 

decisionmaking, and communication; and 

Call for Continued Progress: Challenges remain in managing the Federal Marketplace and improving operations and services provided by HealthCare.gov, including issues identified in related OIG reports. CMS must continue applying 

lessons learned from HealthCare.gov to complete this work and address new 

challenges as they arise. 

BACKGROUND ON THE FEDERAL MARKETPLACE AND HEALTHCARE.GOV

The ACA was signed into law on March 23, 2010, and amended on March 30, 

2010.1 The ACA required the establishment of a health insurance exchange (marketplace) in each State that would be operational on or before January 1, 2014.2 For 

States that elected not to establish their own marketplaces, the Federal Government 

was required to operate a marketplace on behalf of the State.3

The marketplaces provide those seeking health insurance a single point of access 

to view qualified health plan (health plan) 4 options, determine eligibility for coverage, and purchase insurance coverage. Individuals also use the marketplaces to 

determine eligibility for insurance affordability programs (e.g., Medicaid, premium 

tax credits, and cost-sharing reductions) that lower insurance premiums and costs 

of care.5 At the beginning of the third open enrollment period, November 1, 2015, 

the Federal Government operated a marketplace (the Federal Marketplace) for 38 

States, including 7 State-partnership marketplaces for which HHS and the State 

share responsibilities for core functions and 4 federally supported State marketplaces in which States perform most marketplace functions.6 Thirteen States (including the District of Columbia) operated their own State marketplaces.7

CMS has had responsibility for managing the marketplace programs since January 2011.8 To implement the ACA provisions related to the marketplaces, CMS has 

worked in collaboration with public and private entities, including other Federal 

agencies as required by the ACA,9 State Medicaid agencies, private contractors, 

health insurance issuers (issuers), and not-for-profit organizations. As it continues 

to operate the Federal Marketplace, CMS must ensure accurate eligibility determinations, process enrollments, facilitate Medicaid enrollment for those who qualify, 

and communicate timely and accurate information to issuers and consumers. CMS 

also provides support functions for the State marketplaces and administers Federal 

financial assistance and premium stabilization programs related to the marketplaces. 

HealthCare.gov is the public website for the Federal Marketplace through which 

individuals can browse health insurance plans, enroll in plans, and apply for Federal financial assistance to help cover their premiums and other costs. This is the 

consumer-facing, or ‘‘front end,’’ portion of the marketplace. The ‘‘back end’’ systems 

33 

of the Federal Marketplace perform functions such linking consumers’ information 

from HealthCare.gov to multiple supporting systems that facilitate the enrollment 

process and payment to issuers. 

Key components of HealthCare.gov and the Federal Marketplace include an identity management system to enable consumers to create accounts and verify their 

identities; the Data Services Hub, which routes information requests from the marketplaces to other Federal agencies and back, such as the Internal Revenue Service 

(IRS); and the Federally-facilitated Marketplace (FFM) that comprises the core of 

the overall system. The FFM includes three main subcomponents to facilitate various aspects of acquiring health insurance: eligibility and enrollment determinations, plan management, and financial management. 

OIG’S CASE STUDY APPROACH

The objective of the case study was to gain insight into CMS implementation and 

management of the Federal Marketplace, focusing primarily on HealthCare.gov. The 

case study identifies organizational factors that contributed to the website’s poor 

launch and subsequent improvement, and lessons for employing core management 

principles in navigating program implementation and change. These organizational 

factors and the lessons learned identify principles that can contribute not only to 

improving the Marketplace, but also contribute to improving the economy, efficiency, 

and effectiveness of the Department’s other programs and operations. 

Our review examined the 5-year period from March 2010 to February 2015, providing a chronology of events and identifying factors that contributed to the 

website’s breakdown at launch, its recovery following corrective action, and implementation of HealthCare.gov through the second open enrollment period. In conducting this review, we interviewed current and former HHS and CMS officials, 

staff, and contractors involved with the development and management of the 

website. We also reviewed thousands of HHS and CMS documents, including management reports, internal correspondence, and website development contracts. 

OIG FINDINGS FROM PREPARATION AND DEVELOPMENT OF HEALTHCARE.GOV

(MARCH 2010–SEPTEMBER 2013)

The development of HealthCare.gov faced a high risk of failure, given the technical complexity required; the fixed deadline; and a high degree of uncertainty about 

mission, scope, and funding. Still, we found that HHS and CMS made many missteps throughout development and implementation. Most critical was the absence of 

clear leadership, which caused delays in decisionmaking, lack of clarity in project 

tasks, and the inability of CMS to recognize the magnitude of problems as the 

project deteriorated. 

The HealthCare.gov project encountered problems at the beginning of development 

that set the stage for the poor launch. Implementing the Federal Marketplace required substantial policy development and decisionmaking to inform technical planning and implementation of the website. This included not only writing regulations 

to govern the marketplaces, but also establishing partnerships with other entities 

involved in implementation, such as other departments, States, and issuers. This 

policy work was made more difficult and protracted by a lack of certainty regarding 

the mission, scope, and funding for the Federal Marketplace and website and by 

varying internal and external expectations for the marketplaces. Delays caused by 

the lack of certainty used valuable time and made an already compressed time 

frame more difficult. 

Additionally, the project’s poor transition to CMS after 10 months in the HHS Office of the Secretary resulted in problems that lasted long after the move. Initial 

work in the HHS Office of the Secretary made significant strides in establishing the 

policy framework, but did not focus attention on planning for the project’s longerterm technical and operational needs. CMS had to reconfigure roles and timelines, 

determine how it would leverage its resources, and begin work behind schedule. 

Further, while CMS’s infrastructure and experience provided greater resources for 

the project, it led to the Federal Marketplace operating within a large bureaucratic 

structure that separated contract, policy, and technical staff, further diffusing the 

project team and making implementation more complex. Our review found that 

CMS leadership failed to foster effective collaboration and communication, particularly between CMS policy and technical staff and with contractors. 

Lack of clear project leadership led to project diffusion and poor coordination. 

From the beginning and well into the project, CMS did not assign clear project leadVerDate Mar 15 2010 15:50 Feb 09, 2017 Jkt 000000 PO 00000 Frm 00037 Fmt 6601 Sfmt 6621 R:\DOCS\24057.000 TIMD
34 

10 U.S. House of Representatives, House Energy and Commerce Committee, PPACA Implementation Failures: Answers from HHS, October 30, 2013. 

ership, which was particularly problematic for the policy and technological work 

needed to set up HealthCare.gov. For example, CMS continued to make changes to 

the project’s business requirements that then changed technical aspects of the 

website build, in large part because mid-level staff and managers did not have clear 

direction or the authority to make decisions. Effective leadership would have enabled a comprehensive view across the project to better identify problems and determine priorities. Instead, lack of a single lead entity inhibited progress assessments 

and changing course as needed. 

IT contracting for the FFM encountered significant problems. CMS mismanagement of the key HealthCare.gov contract continued throughout the website build. 

CMS did not employ an acquisition strategy to develop contracts and solicit contractors, a tool used to precisely assess project needs and make a systematic assessment 

of the contractors’ ability to meet those needs. Further, due to CMS’s contracting 

process and uncertainty about funding and specifications, CMS received a limited 

number of bids for the contract. CMS hired CGI Federal to build the core of the 

overall FFM system, as well as the online application for consumers. CMS oversight 

of the contract was disjointed and spread across different divisions with little coordination. CMS made frequent changes to contract specifications, and did not effectively communicate these changes or adequately assess how they would affect staffing and schedules. 

Despite many warnings of substantial problems, CMS moved forward without serious discussion of delaying the launch. Throughout the course of building HealthCare.gov, staff at HHS and CMS, as well as outside entities, identified problems 

with the program and warned that these problems warranted action. In all, CMS 

received 18 ‘‘documented warnings’’ of concerns regarding HealthCare.gov between 

July 2011 and July 2013. These documented warnings contained substantial detail 

about the project’s shortcomings and were formally submitted to CMS senior leadership or project managers at CMS. However, these reports were not shared broadly 

due to diffuse leadership and poor communication. As a result, no one person in 

CMS had a comprehensive view of the poor progress and, given the problems were 

complex, information became unwieldy and difficult to prioritize. Without a single 

comprehensive view, CMS leadership and staff took little action to respond to warnings, remained overly optimistic about the launch, and developed few contingency 

plans. As the project degraded further and problems became more well-known, CMS 

officials and staff became desensitized to bad news about progress. 

In early 2013, CMS attempted to take corrective action, but these efforts were 

largely unsuccessful because they were not fully and diligently executed. For example, after criticism that there was no clear leadership, CMS assigned its newly appointed Chief Operating Officer in early 2013 to head the Federal Marketplace program, but the assignment was not formally announced, the position was not supported by clear responsibilities, and the designee had an already large responsibility 

as CMS Chief Operating Officer. As another example, a CMS advisor recommended 

that the project hire a technical systems integrator to coordinate operations, and 

CMS and contractors discussed this need at several points in the project. However, 

in correspondence and congressional testimony, it was clear CMS technical leadership perceived that CMS itself was already serving as the systems integrator.10 CGI 

Federal managers reported that the lack of a true systems integrator created extra 

work that was outside the scope of their contract. 

Due to the poor contract management and ensuing delays, the final months of development and implementation for HealthCare.gov were chaotic. CMS continued to 

make changes to business requirements and technical specifications well into 2013, 

delaying development to a point where it was not feasible to complete and test the 

website as initially planned. Critical tasks went uncompleted, including testing 

website functionality and security and ensuring adequate capacity for users. CMS 

continued with the same plans for a full launch. Changing the project’s path would 

have required a leader or team to conduct a comprehensive assessment of status, 

and to either possess the authority to alter tasks and processes or to fully communicate that assessment to leaders with authority. Instead, CMS and contractors continued with the initial strategy and goals, falling further behind schedule, with 

largely the same diffuse leadership structure, staffing, and project plan. 

By the time CMS took more drastic action to change the project’s path in August 

and September of 2013, it was too late to adequately affect change, given the subVerDate Mar 15 2010 15:50 Feb 09, 2017 Jkt 000000 PO 00000 Frm 00038 Fmt 6601 Sfmt 6621 R:\DOCS\24057.000 TIMD
35 

stantial need for progress and improved execution. CMS cut functions that were at 

one time considered critical to a successful launch, such as the Spanish language 

and SHOP websites, to divert resources to the main build. This occurred in the last 

few weeks before launch, when developers and testers reported they were months 

behind schedule. The rush to launch affected all aspects of the build, including moving forward with only an interim authorization to operate and requesting double 

computing capacity late in September. CMS sought to deliver a version of HealthCare.gov that had only the minimum necessary functions to operate, but did so 

without a comprehensive and thoughtful strategy. 

OIG FINDINGS FROM LAUNCH, CORRECTION AND TURNAROUND OF HEALTHCARE.GOV

(OCTOBER 2013–FEBRUARY 2015)

HealthCare.gov launched at midnight on October 1, 2013, and experienced substantial problems within hours. The website received five times the number of expected users, but the problems involved more than capacity. The website entry tool 

was overwhelmed, and software code defects caused malfunctions. Fixing the 

website required substantial corrections to the software code and to further increase 

capacity. Compounding problems further, some responsible staff were furloughed 

when the Government shut down on October 1, 2013. 

CMS began corrective action, reorganizing the work to focus on key priorities and 

to improve execution. CMS and contractors quickly brought in new staff and expertise following the launch, developing an all-hands environment wherein fixing problems with HealthCare.gov was the key agency mission. Most of the additional staffing came to the project within 3 weeks, including technological and project management experts from CMS, contractors, and the private sector. By late October, CMS 

and contractors began to move command center operations, establishing what would 

become the formal HealthCare.gov command center—the Exchange Operations Center (XOC). The structure at the XOC was based on active coordination between technical and policy staff, a key component missing during the website preparation and 

development. It also employed comprehensive website monitoring tools to identify 

problems and assess performance. The widespread attention to the launch and the 

number of parties involved could have created bureaucratic paralysis, but those 

working on the repairs directed their attention to immediate action and improved 

the HealthCare.gov website substantially in 2 months. 

Before the launch, artificial distinctions and divisions among staff contributed to 

poor collaboration, lack of communication, disjointed management, and slow progress. Following the launch, first with the technological team and then more broadly, 

CMS promoted a culture that was ‘‘badgeless’’ and ‘‘titleless,’’ working as a single 

team regardless of employer and job title. 

According to CMS, this change in culture fostered a greater sense of mission and 

teamwork that further improved daily operations. 

CMS initiated organizational change, such as a deeper integration between policy 

and technological tasks. The Federal Marketplace and HealthCare.gov needed expertise and coordination across CMS divisions and many contractors. CMS integrated 

the various functions within the project, which improved daily work. This integration allowed CMS to identify and address problems more quickly, make informed 

decisions, and provide clearer direction to those involved in the website development 

and operations. CMS also assigned clear project and technical leadership, hiring a 

technical systems integrator, and restructuring its divisions to allow for greater visibility and oversight of technical staff and contractors by senior leadership. 

This greater sense of ‘‘operational awareness’’ also prompted CMS to plan for and 

mitigate potential problems by considering contingencies, building redundant systems, and increasing capacity. CMS’s lack of contingency plans before the launch 

meant that CMS had few options when the functionality and computing capacity of 

HealthCare.gov encountered problems. Essential to success was identifying possible 

problems and developing systems and strategies specific to each concern. 

By the end of the first open enrollment period, CMS had a stable website that 

functioned well at high capacity, but some planned components had yet to be completed. CMS immediately began preparation for the second open enrollment period 

to begin seven months later. CMS practiced what officials called ‘‘ruthless prioritization’’ of tasks to focus on the most urgent needs and functionality. This strategy served to align goals with available resources, guide daily work and accountability, and temper unrealistic expectations about results. According to CMS, officials developed a list of technological needs, then debated and cut about half of the 

36 

11 CMS, Health Insurance Marketplace Open Enrollment Snapshot—Week 13, February 4, 

2016. Accessed at https://www.cms.gov/Newsroom/MediaReleaseDatabase/Fact-sheets/2016- 

Fact-sheets-items/2016-02-04.html on February 8, 2016. 

items requested. Cuts included key elements of the Federal Marketplace system, 

such as completion of the automated financial management system. 

This process for strategic and organized prioritization marked a significant improvement over the rushed reprioritization efforts that occurred prior to launch. 

Project documentation indicated that in 2013, CMS and contractors were frantic to 

establish basic website functionality. They pushed forward faulty and untested 

functionality and hoped to fix it after the launch. Project documentation indicated 

that in 2014, CMS maintained a more disciplined project schedule, meeting deadlines with a goal to implement only technology that had what project documentation 

referred to as optimal functionality, or ‘‘perfect execution.’’ When this standard could 

not be met in time, CMS identified problems more quickly to allow time to employ 

contingency plans. CMS stated that this higher standard led to improved practices 

overall, such as targeting earlier deadlines for delivery and imposing stricter testing 

standards. For example, the new HealthCare.gov consumer application, App 2.0, was 

tested through a ‘‘soft launch’’ prior to open enrollment. This approach meant that 

CMS did not always deliver according to schedule, but was able to test the application’s functionality prior to use in the second open enrollment. 

CMS documentation indicated the technical aspects of the website and supporting 

systems performed well during the second open enrollment period, with no system 

outages and few consumer reports of problems applying for coverage or selecting 

plans. CMS further solidified project leadership, worked to better align project goals 

with resources, and renewed its focus on contract management, particularly emphasizing the agency-contractor relationship. As of February 1, 2016, CMS reported 

that over 9.6 million consumers had selected a health insurance plan through the 

Federal Marketplace or had their coverage automatically renewed.11

CALL FOR CONTINUED PROGRESS

CMS continues to face challenges in implementing the Federal Marketplace, and 

in improving operations and services provided through HealthCare.gov. As CMS 

moves forward, challenges include improving the website and systems as planned, 

such as completing the automated financial management system and improving consumer tools to select plans. CMS must also continue to address areas OIG has identified in past reports as problematic or needing improvement, including contract 

oversight, the accuracy of payments and eligibility determinations, and information 

security controls. 

CMS concurred with OIG’s call for continued progress, stating that it will continue to employ the lessons identified in the case study and that, since OIG’s review, 

it has implemented several initiatives to further improve its management. The 10 

lessons articulated in the report comprise core management principles that could 

apply to other organizations. They include assigning clear project leadership, encouraging staff to identify and communicate problems, and better integrating policy 

and technological work. OIG will continue to monitor CMS’s actions to address specific recommendations from our work, as well as its overall management of this program. 

In addition to the lessons learned from the case study, OIG has also completed 

12 audits and evaluations of the Federal Marketplace, which combined make over 

30 recommendations to CMS. We continue to monitor CMS’s progress toward implementing these recommendations. OIG has also published numerous other reports related to State marketplaces and other significant programs created by the ACA. All 

of our ACA-related work is available at: http://oig.hhs.gov/reports-and-publications/aca/. 

OIG has ongoing and planned work in several areas related to marketplaces, including examining the accuracy of financial assistance payments for individual enrollees for the Federal Marketplace, analysis of CMS’s oversight of the State marketplaces, and a review of the funding that established the Federal Marketplace. We 

are also currently developing work related to the premium stabilization programs. 

In addition, OIG has established relationships with its law enforcement partners to 

investigate fraud and closely monitor activities and concerns related to the marketplaces. 

37 

CONCLUSION

The Department, and the health care system generally, are in the process of implementing major changes to health care delivery. Most of those changes will depend on the successful implementation of information technology, but success will 

require more than just ensuring that the right code is written or that the right technology is purchased. As our case study demonstrates, whether these changes will 

result in more effective, efficient, and economic health care and human service programs will depend on the interaction of technology, management, and policy. 

OIG believes the lessons learned identified in the case study may be beneficial 

to the Department beyond the operation and management of the Federal Marketplace. Assessing Departmental management will continue to be a vital component 

of OIG’s oversight of Department programs going forward. Many programs or 

projects that OIG oversees will not require the same level of coordination or resources required of the Federal Marketplace; however, the principles identified in 

the Case Study can help foster the effectiveness and efficiency of Departmental and 

program management. 

The growing intersection of programs and technology requires OIG to grow its 

own capabilities to provide effective oversight. OIG is building necessary expertise 

in data analytics, information technology, and forensic accounting. Increasing our 

proficiencies and resources in these disciplines will allow OIG to provide meaningful 

analysis to inform decision-makers and program managers. 

Thank you again for inviting OIG to speak with the committee today to share the 

results of the case study reviewing CMS management of HealthCare.gov. I would 

be happy to submit the case study report for the record, and I would be happy to 

answer any questions the committee may have. 

QUESTIONS SUBMITTED FOR THE RECORD TO ERIN BLISS

QUESTION SUBMITTED BY HON. CHUCK GRASSLEY

I would like the record to show that I was unable to attend this hearing in person. 

As Chairman of the Senate Judiciary Committee, I was overseeing the debate about 

the Supreme Court vacancy. The two hearings were at the same time. 

Question. Ms. Bliss, in your recent case study report, you summarized many of 

the mistakes at HHS and CMS that resulted in the disastrous launch of HealthCare.gov. 

Some of the problems identified by OIG included a lack of leadership, a failure 

to act on warnings and address problems, and corrections that were too little too 

late. 

In the final countdown to the launch of HealthCare.gov, it seems CMS was more 

concerned about launching anything rather than following the advice of their own 

advisors and waiting and then releasing a product that would be useful to Americans. 

CMS continues to have problems with implementing and operating the Federal 

Marketplace. 

Ms. Bliss, what are the 10 lessons CMS should have learned? 

Answer. The Centers for Medicare and Medicaid Services (CMS) continue to face 

challenges in implementing the Federal Marketplace and in improving services provided through HealthCare.gov. The HHS OIG called on CMS to continue progress 

in applying lessons learned from HealthCare.gov to avoid future problems and to 

maintain improvement across the agency. These 10 lessons comprise core management principles that address both specific project challenges and organizational 

structure, and could apply to other organizations. 

1. Assign clear project leadership for cohesion across tasks and a comprehensive 

view of progress. 

2. Align project and organizational strategies with the resources and expertise 

available. 

3. Identify and address factors of organizational culture that may affect project success. 

4. Seek to simplify processes, particularly for projects with a high risk of failure. 

38 

5. Integrate policy and technological work to promote operational awareness. 

6. Promote acceptance of bad news and encourage staff to identify and communicate problems. 

7. Design clear strategies for disciplined execution and continually measure 

progress. 

8. Ensure effectiveness of information technology (IT) contracts by promoting innovation, integration, and rigorous oversight. 

9. Develop contingency plans that are quickly actionable, such as redundant and 

scalable systems. 

10. Promote continuous learning to allow for flexibility and changing course 

quickly when needed. 

CMS concurred with OIG’s call for continued progress and stated that it will continue to employ the lessons. Since OIG’s review, CMS has implemented several initiatives to further improve its management. 

QUESTIONS SUBMITTED BY HON. MICHAEL B. ENZI

Question. In the hearing, some of the operational and strategic changes which 

were made after the first enrollment period were briefly discussed. Those changes 

were described as ‘‘clearer leadership amongst staff and contractors,’’ and ‘‘key organizational changes.’’ 

Please list and describe the specific changes made to make the leadership 

amongst HHS staff and contractors more clear. 

Answer. Assigning and supporting clear project leadership was perhaps the most 

critical change CMS made to improve HealthCare.gov project management. Prior to 

the launch, HealthCare.gov lacked clear project leadership to give direction and 

unity of purpose, responsiveness in execution, and a comprehensive view of progress. CMS and its contractors took a number of steps to improve leadership, including the following: 

1. Tasked top agency management to assume daily leadership of the HealthCare.gov project, first the CMS Administrator and subsequently the Principal 

Deputy Administrator. This served to provide project visibility across agency 

functions and clear authority to implement changes. Following the website recovery and before the start of the second open enrollment period, CMS hired 

a Marketplace CEO to serve in that leadership role. CMS senior leaders also 

alternated as the website’s Executive on Call, serving 24-hour shifts to make 

decisions more rapidly. 

2. Improved the coordination and transparency of work shared among CMS staff 

and multiple contractors by hiring a systems integrator to organize technological tasks and report progress and problems to leadership. CMS continues 

to employ a contractor to serve as systems integrator, having established this 

position within weeks of the launch in late October 2013. 

3. Promoted coordination of CMS divisions working on various aspects of the Federal and State-based marketplaces by forming the Strategic Planning and Management Council, composed of five workgroups: appeals; eligibility and enrollment; plan oversight; security and privacy; and workforce planning. 

4. Shifted from following known processes to continually assessing outcomes and 

progress. For example, CMS identified a number of problems in the lead-up to 

the second open enrollment through ‘‘deep dives,’’ assigning staff to scrutinize 

the performance of a specific area or function (such as eligibility) and bring to 

CMS leadership their assessments of weaknesses. 

5. Focused on blending the policy and technical components of CMS with a greater sense of what CMS leaders called ‘‘the physics of operations’’ or ‘‘operational 

awareness.’’ Policymakers acquired a better understanding of the effort required to effectuate policy decisions, both in terms of time and resources, so 

that those considerations could better inform decision making and avoid a longstanding agency bifurcation between operations and policy. 

6. Instructed staff coordinating technological work and supervising contracts 

about rules and provisions related to contracted work; also instructed contractors to work more collaboratively with each other and the CMS divisions. This 

39 

served to avoid staff concerns about violating Government contracting rules, 

promoting closer collaboration and a sense that CMS and contractors were a 

single team working toward the same goals. 

Question. Please list and describe the key organizational changes mentioned by 

Ms. Erin Bliss. 

Answer. CMS also made other key organizational changes as it improved the 

HealthCare.gov website. This required significant and focused effort to measure 

website performance, correct problems with website capacity and functions, and establish a new project structure. To implement these practices, CMS and its contractors took the following steps: 

1. Began correction of website problems immediately following launch, changing 

the project management strategy. CMS and contractors brought in new staff 

and expertise following the launch, developing an all-hands environment 

wherein fixing problems with HealthCare.gov was the key agency mission. 

These changes allowed CMS to make quick progress in identifying the source 

of problems and developing a strategy going forward. 

2. Adopted a ‘‘badgeless’’ culture that encouraged full collaboration by CMS staff 

and contractors regardless of employer status and job title, fostering innovation, problem solving, and communication among teams. The enhanced team 

of CMS staff, contractors, and technological experts correcting problems with 

HealthCare.gov included people at all levels of CMS and contracted entities 

with varied experience on the project. First with the technological team and 

then more broadly, CMS promoted a culture wherein all team members could 

speak out about problems and develop creative solutions. 

3. Integrated all functions into the organizational structure to align with project 

needs, enhancing CMS and contractor accountability and collaboration. The 

Federal Marketplace needed expertise and personnel across CMS, including 

policy, technical, and communications staff, as well as many contractors. Key 

to the correction, CMS integrated the various functions both operationally and 

technically, improving daily work and promoting the larger project mission. 

This integration allowed CMS to identify and address problems more quickly, 

make informed decisions, and provide clearer direction to those involved in the 

website development and operations. 

4. Planned for problems, establishing redundant (backup) systems in the event of 

further breakdowns and restructuring the key development contract to ensure 

better performance. CMS began to plan for and mitigate potential problems by 

considering contingencies, building redundant systems, and increasing capacity. Given limited resources, CMS leadership had to analyze past problems 

with HealthCare.gov and carefully consider how and to what extent it would 

develop new systems and strategies, such as enhancing training for call center 

staff. Key to success was identifying all possible problems and developing systems and strategies specific to the concern. 

5. Adopted a policy of ‘‘ruthless prioritization’’ to reduce planned website functionality, focusing resources on the highest priorities. Because the time frame 

and resources available to prepare for the second open enrollment period were 

fixed, CMS focused on reducing scope to meet deadlines. The day after first 

open enrollment closed, CMS leadership met to prioritize tasks to focus on the 

most urgent needs and functionality. These decisions and resulting changes 

were then locked down and measured for progress and results. Ruthless 

prioritization served to align goals with the resources available, guide daily 

work and accountability, and temper unrealistic expectations about results. 

6. Prioritized quality over on-time delivery, employing extensive testing to identify and fix problems and delaying new website functionality if unready. CMS 

adopted a project management approach of going live with website functionality only when it could ensure what one CMS official called ‘‘perfect execution.’’ This policy of requiring optimal functioning before delivery led to improved practices overall, such as targeting earlier deadlines for delivery and 

imposing stricter testing standards. 

7. Simplified systems and processes to enable closer monitoring of progress, increased transparency and accountability, and clearer prioritization. CMS simplified both technical aspects of the build and the organizational structure of 

the agency itself by closely monitoring progress and results with daily reports 

and close communication with contractors. Reduced complexity in tasks and orVerDate Mar 15 2010 15:50 Feb 09, 2017 Jkt 000000 PO 00000 Frm 00043 Fmt 6601 Sfmt 6621 R:\DOCS\24057.000 TIMD
40 

1 HHS OIG, CMS’s Internal Controls Did Not Effectively Ensure the Accuracy of Aggregate Financial Assistance Payments Made to Qualified Health Plan Issuers Under the Affordable Care 

Act (A–02–14–02006) (June 2015); and HHS OIG, CMS Could Not Effectively Ensure That Advance Premium Tax Credit Payments Made Under the Affordable Care Act Were Only for Enrollees Who Paid Their Premiums (A–02–14–02025) (December 2015). Available at http:// 

www.oig.hhs.gov/reports-and-publications/aca/. 2 HHS CMS, ‘‘Policy-Based Payments Bulletin—INFORMATION’’ (December 2015). Available 

at https://www.cms.gov/CCIIO/Resources/Regulations-and-Guidance/Downloads/Policy-based 

-Payment-Guidance.pdf. 

ganizational structure made it easier for CMS to identify those responsible for 

carrying out tasks and to track progress toward goals. 

8. Adopted continuous learning for policy and technological tasks, balancing 

project plans with system and team capacity and changing course as needed 

to improve operations. In preparation for the second open enrollment period, 

much about the HealthCare.gov project was still unfolding. For example, CMS 

did not know how much website capacity consumers would require, and it was 

still developing and testing new and improved functionality in the final weeks 

before open enrollment. Given that the design and proportion of the project 

was evolving, it was critical to CMS’s success that the organization continuously learn as the project progressed. As the HealthCare.gov project matured, 

CMS’s knowledge and experience became more concrete and its planning more 

effective, but the project continued to require adaptation. 

Question. In the hearing, Ms. Bliss was asked whether or not the office of Inspector General had uncovered, in connection with open enrollment, any confirmed cases 

of fraud. Ms. Bliss responded that there are no fraudulent cases which have resulted 

in criminal convictions or civil settlements. However, she did mention that there are 

some ongoing investigations. 

How many ‘‘ongoing investigations’’ remain since the first open enrollment period? 

Answer. At this time, OIG has two ongoing investigations specifically looking at 

enrollment fraud in the Federally Facilitated or State-Based Marketplaces. The conduct under investigation may involve more than one open enrollment period. 

Question. There have been concerns about the ‘‘back end’’ of the HealthCare.gov 

website, specifically as it concerns subsidy payments to insurance companies. 

Please describe the process in which insurers receive payments of subsidies for 

premiums and out-of-pocket expenses. 

Answer. To date, OIG has performed two audits that specifically examine the 

‘‘back end’’ of the HealthCare.gov website.1 These reports examine the interim manual payment process that CMS utilized during the first 2 years of Marketplace operations. In both reports, OIG found deficiencies that limited the effectiveness of the 

interim manual payment process. Please see these reports for detailed explanations 

of the interim process. 

In response to these reports, CMS explained that it expected all issuers on the 

Federal Marketplace would be using an automated policy-based system in 2016. In 

December 2015, CMS issued guidance related to issuer implementation of the automated policy-based system.2 According to this policy, issuers are expected to transition to this system in early 2016. CMS has provided training regarding the new system, which OIG attended to gain a better understanding as CMS continues to work 

with issuers to implement automated policy-based payments. 

We also plan to conduct work on CMS’s automated policy-based payments system 

at the Federal Marketplace potentially by looking at the accuracy of the determination of financial assistance payments and the use of enrollment and payment data. 

The CMS Center for Consumer Information and Insurance Oversight (CCIIO) would 

be the best source of information about specific details of this process. 

Question. What steps have been taken to ensure that those individuals who have 

signed up for a plan on the HealthCare.gov website end up in the right plan? 

Answer. To date, OIG has not conducted work specifically assessing internal controls at HealthCare.gov that would ensure individuals are enrolled in the Qualified 

Health Plan they select. 

Based on our related work on the interim manual payment process, controls for 

confirming enrollment may be included in the initial and confirmation ‘‘834’’ transVerDate Mar 15 2010 15:50 Feb 09, 2017 Jkt 000000 PO 00000 Frm 00044 Fmt 6601 Sfmt 6621 R:\DOCS\24057.000 TIMD
41 

3For more information about the 834 transaction process, see OIG’s report CMS’s Internal 

Controls Did Not Effectively Ensure the Accuracy of Aggregate Financial Assistance Payments 

Made to Qualified Health Plan Issuers Under the Affordable Care Act (A–02–14–02006) (June 

2015), pp. 6–7. 4For a list of significant unimplemented recommendations related to OIG’s work on both the 

Federal and State-based marketplaces, see HHS OIG, Compendium of Unimplemented Recommendations (April 2016), pp. 34–40. Available at http://oig.hhs.gov/reports-and-publications/compendium/index.asp. 5 All of OIG’s ACA-related work is available at http://oig.hhs.gov/reports-and-publications/ 

aca/. 

actions.3 OIG’s audits did not assess the 834 transactions with respect to this specific issue, and the automated policy-based payment system may utilize different 

processes. Due to those considerations, CMS–CCIIO would be the best source of information about specific internal controls the Federal Marketplace has in place to 

ensure individuals are enrolled in the plans they select. 

Question. Please describe the process of adding new information, like the birth of 

a child or marriage to an existing plan. 

OIG has not assessed the process for adding information to an existing plan. The 

HealthCare.gov website provides instructions for consumers to report information 

about life changes through their Marketplace accounts online or by phone. CMS– 

CCIIO would be the best source of further information about this process. 

QUESTIONS SUBMITTED BY HON. MICHAEL F. BENNET

Question. As HHS and CMS concur with and move toward implementing OIG recommendations, how can you continue to be a resource to the agency based on your 

findings? 

Answer. OIG believes that our case study’s assessment of the intersection of technology, policy, and management, and the lessons that we identified can benefit a 

broad range of Federal projects and programs. These lessons comprise core management principles that address both specific project challenges and organizational 

structure and can be applied broadly. 

We will continue to monitor CMS’s actions in response to our recommendations 

and its overall management of the Federal Marketplace and other programs. OIG 

has ongoing and planned work in several areas related to Marketplaces, including 

examining the accuracy of financial assistance payments for individual enrollees for 

the Federal Marketplace, analysis of CMS’s oversight of the State Marketplaces, 

and a review of the funding that established the Federal Marketplace. We are also 

developing work related to the premium stabilization programs. In addition, OIG 

has established relationships with its law enforcement partners to investigate fraud 

related to the Federal Marketplace and make appropriate referrals to partner agencies. OIG will also draw upon these lessons to examine HHS’s and CMS’s implementation and management of other programs. 

Question. The OIG Case Study report published in February 2016 highlights 

changes that CMS underwent including realignment of project goals and resources 

as well as enhancing coordination between CMS staff and contractors. What are the 

main operational changes that CMS should focus on as they work toward optimizing 

the Federal Marketplace? 

Answer. In addition to the lessons learned from the case study, OIG has also completed 12 audits and evaluations of the Federal Marketplace, which combined make 

over 30 recommendations to CMS.4 We continue to monitor CMS’s progress toward 

implementing these recommendations. OIG has also published numerous other reports related to State Marketplaces and other significant programs created by the 

ACA.5

With regard to the Federal Marketplace, in particular, successful implementation 

of the automated policy-based payment system is one of the main operational challenges facing CMS in 2016. Additionally, CMS must continue to refine the eligibility 

determination systems for the Federal Marketplace to improve the accuracy and 

timeliness of those determinations, and continue to focus on resolving inconsistencies in eligibility determinations. 

In general, as CMS improves the consumer-facing enrollment process for HealthCare.gov, CMS must continue to assess and improve the Federal Marketplace sysVerDate Mar 15 2010 15:50 Feb 09, 2017 Jkt 000000 PO 00000 Frm 00045 Fmt 6601 Sfmt 6621 R:\DOCS\24057.000 TIMD
42 

tems that operate behind the scenes, particularly the eligibility, administrative, and 

financial management functions. CMS must ensure that all pathways for enrollment 

operate with integrity and that consumers’ personal information is secure. Vigilant 

monitoring and testing and rapid mitigation of identified vulnerabilities are essential. Attention must be paid to sound operation of financial assistance and the risk 

corridor, reinsurance, and risk-adjustment programs. CMS must ensure that consumers and issuers receive accurate Marketplace information, including information 

relevant for tax purposes, such as Form 1095A tax forms. Furthermore, Marketplaces must continue to protect personally identifiable information and strengthen 

security controls. 

QUESTIONS SUBMITTED BY HON. SHERROD BROWN

Question. We know that HealthCare.gov had a rocky start. But—as was acknowledged in the HHS OIG report—after just 2 months (during which a wholly preventable government shutdown occurred, furloughing relevant members of staff), the 

Centers for Medicare and Medicaid Services (CMS) managed to ‘‘substantially’’ improve the website. 

By the end of the first open enrollment period, CMS had a website that functioned 

at high capacity. The agency ended the first open enrollment period with 5.4 million 

individuals having selected a plan through the Federal Marketplace. 

Ms. Bliss, what corrective actions were taken by CMS and contractors following 

the website’s launch to address the lack of communication and leadership challenges 

that existed during the first enrollment period? 

Answer. Assigning and supporting clear project leadership was perhaps the most 

critical change CMS made to improve HealthCare.gov project management. Prior to 

the launch, HealthCare.gov lacked clear project leadership to give direction and 

unity of purpose, responsiveness in execution, and a comprehensive view of progress. To improve project leadership, top CMS leadership assumed daily management 

of the HealthCare.gov project, first the CMS Administrator and later the Principal 

Deputy Administrator. This served to provide a view across agency functions and 

clear authority to implement changes. Following the website recovery and before the 

start of the second open enrollment period, CMS hired a Marketplace CEO to serve 

in that role and coordinate project activities across the agency. CMS senior leaders 

also alternated as the website’s Executive on Call, serving 24-hour shifts to make 

decisions more rapidly. 

CMS also worked to improve the coordination and transparency of work shared 

among CMS staff and multiple contractors. These efforts included hiring a systems 

integrator to organize technological tasks and report progress and problems to leadership and merging the work of policy and technical staff more closely to allow for 

a better sense of the work needed to complete project goals and integrate CMS staff 

and contractors into a single team. CMS also promoted coordination of CMS divisions working on various aspects of the Federal and State-based marketplaces by 

forming the Strategic Planning and Management Council, comprising subject area 

workgroups such as health plan oversight and workforce planning. This improved 

coordination across divisions allowed CMS to shift from separated, engrained processes to continually assessing outcomes and progress. 

CMS made other key organizational changes as it improved the HealthCare.gov 

website. Following the poor launch, CMS and contractors pivoted quickly to corrective action, reorganizing the work to focus on key priorities and improve execution. 

These efforts benefited from CMS adopting a ‘‘badgeless’’ culture that encouraged 

full collaboration by CMS staff and contractors regardless of employer status and 

job title, fostering innovation, problem solving, and communication among teams. 

The agency also planned for problems, establishing redundant (backup) systems in 

the event of further breakdowns and restructuring its key development contract to 

ensure better performance. 

Question. What has CMS done to address these challenges and continue to improve operations through the second and third open enrollments? How do you anticipate CMS will build upon these improvements for the upcoming open enrollment period? 

Answer. In preparation for the second open enrollment period, CMS restructured 

project tasks to set more realistic goals and meet core objectives. For example, CMS 

managers met immediately following the first open enrollment to ‘‘ruthlessly 

43 

prioritize’’ remaining tasks and focus resources on the highest priorities. This served 

to align goals with the resources available, guide daily work and accountability, and 

temper unrealistic expectations about results. CMS also prioritized quality over ontime delivery, employing extensive testing to identify and fix problems and delaying 

new website functionality if unready for perfect execution. This contrasted with the 

launch of HealthCare.gov wherein CMS delivered what it knew was faulty functionality, planning to improve the website later. 

To manage these efforts, CMS simplified systems and processes to enable closer 

monitoring of progress, increased transparency and accountability, and clearer 

prioritization. Reduced complexity in tasks and organizational structure made it 

easier for CMS to identify those responsible for carrying out tasks and to track 

progress toward goals. At the same time, the broader CMS organization adopted a 

strategy of continuous learning for policy and technological tasks, balancing project 

plans with system and team capacity and changing course as necessary to improve 

operations. Given that the design and proportion of the HealthCare.gov project was 

evolving, it was critical to CMS’s success that the organization continuously learned 

as the project progressed. CMS continued these strategies, experiencing few technical problems and no system outages during the second open enrollment period. 

Still, the agency faces ongoing challenges in implementing the Federal Marketplace and in improving operations and services provided through HealthCare.gov. 

OIG called on CMS to continue progress in applying lessons learned from HealthCare.gov to avoid future problems and to maintain improvement across the agency. 

As CMS moves forward, challenges include improving the website and systems as 

planned, such as completing the automated financial management system and improving consumer tools to select plans. Also, given CMS’s large organization and 

complex mission, prior management problems could resurface and new problems 

could emerge. CMS placed intense organizational focus on the Federal Marketplace 

during the recovery of the website. This level of focus will, by necessity, change in 

the face of new challenges and priorities within CMS, and inevitably officials and 

staff with key expertise and deep knowledge of the Federal Marketplace will leave 

CMS or the project. Such changes in priorities and resources reinforce the need for 

CMS to fully embed core management principles in its daily work. 

In its comments in response to the Case Study, CMS concurred with OIG’s call 

for continued progress in applying the lessons that CMS learned from the HealthCare.gov recovery in its management of the Federal Marketplace and CMS’s broader 

organization. CMS stated that since the OIG review it has implemented several initiatives to improve its management, striving to incorporate principles aligned with 

this report’s lessons learned in its culture, operations, and daily work. These principles include a focus on leadership and accountability, continuous reevaluation of 

priorities and how the project could be more efficient, program measurement, and 

a flexible and evolving IT strategy aligned with policy requirements. CMS also indicated a commitment to overcoming challenges and deliver results in a transparent 

manner. OIG will continue to monitor CMS operation and management of the Federal and State-based Marketplaces and HealthCare.gov, focusing on oversight of critical aspects such as the integrity of enrollment processes and payment accuracy. 

PREPARED STATEMENT OF HON. ORRIN G. HATCH, A U.S. SENATOR FROM UTAH

WASHINGTON—Senate Finance Committee Chairman Orrin Hatch (R-Utah) today 

delivered the following opening statement at a hearing examining deficiencies with 

HealthCare.gov and the current state of the Patient Protection and Affordable Care 

Act (PPACA) and how it is impacting patients and taxpayers: 

Good morning. It is a pleasure to welcome everyone to today’s hearing. 

Today, we’ll be talking with representatives from the Office of Inspector General 

for the Department of Health and Human Services (HHS–OIG) and from the Government Accountability Office (GAO) about their ongoing oversight work with respect to HealthCare.gov and enrollment in the Federal health insurance marketplace. I want to thank both entities for their hard work on these issues and acknowledge the contributions both have made to help this committee perform more 

accurate and timely oversight. 

Now, it is no secret that I have never been a fan of the so called Affordable Care 

Act. And, as we approach the sixth anniversary of this law and look closely into how 

it’s working and being implemented, the evidence overwhelmingly shows that I— 

44 

and the many others who opposed the law from the beginning—have been right all 

along. 

The facts speak for themselves. 

Since Obamacare was signed into law, HHS–OIG and GAO have cumulatively released at least six dozen reports detailing various operation and implementation 

issues demonstrating the numerous areas where the law is falling short. These reports are specific and focused on key operational failures like enrollment controls 

or system issues, some of which we’ll hear more about today. 

Let’s keep in mind that GAO and HHS–OIG are not partisan entities. They are 

independent watchdogs, tasked with the responsibility of objectively and dispassionately assessing what is and what is not working in various Federal programs, including those created or amended by the Affordable Care Act. And, there is no better record showing how and why Obamacare is not working than the reports we’ve 

received from these offices. 

Today, we are going to specifically discuss operations issues related to HealthCare.gov and enrollment problems at the Federal insurance marketplace, otherwise 

known as the Federal exchange. 

Let’s start with the HealthCare.gov launch. 

As a result of numerous problems and shortcuts taken with the initial development and deployment of HealthCare.gov and its supporting systems, consumers encountered widespread performance issues when trying to create accounts and enroll 

in health plans. After numerous inquiries and reports, we now know what ultimately caused these performance issues. 

For example, there was inadequate capacity planning. The Centers for Medicare 

and Medicaid Services (CMS) cut corners and did not plan for adequate capacity to 

maintain HealthCare.gov and its supporting systems. 

There were also problems with the software that were entirely avoidable. CMS 

and its contractors identified errors in the software coding for the website, but did 

not adequately correct them prior to launch. 

We saw a lack of functionality as CMS did not adequately prepare the necessary 

systems and functions of the website and its supporting systems prior to the initial 

launch. 

CMS also failed to apply recognized best practices for system development, which 

contributed to the problems. 

Admittedly, since the initial launch, CMS has taken steps to address these problems, including increasing capacity, requiring additional software quality reviews, 

and awarding a new contract to complete development and improve the functionality of key systems. 

However, many of the problems have still not been entirely resolved and continue 

to cause frustration for consumers trying to obtain health insurance. 

I wish we could boil down all of Obamacare’s problems to the functions of a single 

website. Indeed, if this was just an IT problem, all of our jobs would be a lot easier. 

However, the problems with Obamacare—and the Federal insurance marketplace in 

particular—go much deeper and many of them remain unaddressed. 

We know, for example, that the enrollment controls for the Federal marketplace 

have been inadequate. 

During undercover testing by GAO, the Federal marketplace approved insurance 

coverage with taxpayer-funded subsidies for eleven out of twelve fictitious phone or 

online applicants. In 2014, the GAO applicants—which, once again, were fake, 

made-up people—obtained a total of about $30,000 in annual advance premium tax 

credits, plus eligibility for lower insurance costs at the time of service. These fictitious enrollees maintained subsidized coverage throughout the year, even though 

GAO sent either clearly fabricated documents or no documents at all to resolve application inconsistencies. 

While the subsidies, including those granted to GAO’s fictitious applicants, are 

paid to health-care insurers, they nevertheless represent a benefit to consumers and 

a cost to the government. Now, GAO did find that CMS relies on a contractor 

charged with document processing to uncover and report possible instances of fraud. 

Yet, GAO also found that the agency does not require that the contractor has any 

fraud detection capabilities. 

45 

And, according to GAO, CMS has not performed a single comprehensive fraud risk 

assessment—a recommended best practice—of the Obamacare enrollment and eligibility process. Until such an assessment is completed, CMS is unlikely to know 

whether existing control activities are suitably designed and implemented to reduce 

inherent fraud risk to an acceptable level. 

In other words, CMS isn’t even sure if CMS’s fraud prevention systems are designed correctly or if they’re effective. 

Lastly, while it is not the focus of the reports that will be covered by the testimony today, another matter we’ve been tracking closely, and where the GAO is 

issuing a report today, is CMS’s oversight of the health care CO–OPs. We had a 

hearing on this topic in late January where we examined a number of financial and 

oversight related explanations for the abject failure of the CO–OP program. 

Today’s GAO report describes CMS’s efforts to deal with financial or operations 

issues at the CO–OPs, including the use of an escalation plan for CO–OPs with serious problems that may require corrective actions or enhanced oversight. 

As of November 2015, 18 CO–OPs had enough problems that they had to submit 

to a CMS escalation plan, including nine that have discontinued operations. And, 

just this week, we heard that yet another CO–OP, this time the one in Maine, is 

on the verge of financial insolvency, despite the fact that it had been on a CMSmandated escalation plan. 

In other words, CMS’s efforts to address all the problems faced by CO–OPs appear to have failed, just like virtually every other element of this program. 

The failure of CMS to adequately implement the CO–OP program is welldocumented here on the Finance Committee and elsewhere. As with so many other 

parts of Obamacare, the high-minded rhetoric surrounding this program has fallen 

short of reality. 

With nearly half of the CO–OPs now closed, the failed experiment has wasted taxpayer dollars and forced patients and families to scramble for new insurance. With 

so many CO–OPs now in financial jeopardy, I believe that CMS should work with, 

not against States, to safeguard taxpayer dollars. 

So, as always, we have a lot to discuss. And I look forward to hearing more from 

the officials we have testifying here today. 

PREPARED STATEMENT OF HON. RON WYDEN, A U.S. SENATOR FROM OREGON

It is old news that the rollout of HealthCare.gov 3 years ago was botched. It is 

new news that the Inspector General of HHS recently said, quote, ‘‘CMS recovered 

the HealthCare.gov website for high consumer use within 2 months, and adopted 

more effective organizational practices. . . .’’ 

That quote comes from one of two reports looking back at 2013 and 2014 that the 

Finance Committee will be presented with today. Let’s recognize that the story here 

is well-documented. After the launch went badly, some of the best minds in tech 

and a new contractor were brought in, they scrambled to overhaul the system, and 

the exchange was soon up and running. And CMS is following up on every one of 

the Inspector General’s recommendations, which the IG notes in its report. 

In the most recent enrollment period, nearly 10 million Americans used HealthCare.gov to sign up for a plan or re-enroll automatically. 

And in my home State, which has had its own problems, close to 150,000 people 

have used the website to sign up for a plan as of January 31st. That’s up by more 

than 30 percent compared to last year. 

The committee will also hear an update today from the Government Accountability Office on what’s called a ‘‘secret shopper’’ investigation. GAO first brought 

this study before the committee in July last year. And I’ll repeat now what I said 

back then: On this side of the aisle, we don’t take a back seat to anybody in fighting 

fraud and protecting taxpayer dollars. One dollar ripped off is one dollar too many. 

But let’s recognize that what was true last summer remains true today. This GAO 

investigation has not uncovered one single shred of real-world fraud in the insurance marketplaces. It was built on fictitious characters with specially-created identities, not real consumers or real fraudsters. 

46 

It’s true the GAO found that there are sometimes differences between the information on somebody’s insurance application and their tax forms and citizenship 

records. But when it comes to these inconsistencies in people’s data, this investigation can’t differentiate between fraud and a typo. 

And meanwhile, HHS does not look the other way when it finds these red flags. 

In 2014, the year of GAO’s investigation, CMS closed more than 100,000 insurance 

policies because documents didn’t match or weren’t provided. Tax credits were adjusted for nearly 100,000 households. In 2015, HHS closed more policies and adjusted more tax credits. If you come at this from the left, you might say that’s too 

harsh. If you come at it from the right, you might take a different view. But there 

is no basis whatsoever for the argument that HHS ignores problems in people’s 

records or leaves the door open to fraud. 

So in closing, rather than rehashing old news, I’d prefer to look at the facts. Because of the ACA, the number of Americans without health insurance is at or near 

its lowest point in half a century. For the 160 million people who get their insurance 

from their employer, premiums climbed only 4 percent last year. Working-age Americans in Oregon and nationwide with preexisting conditions—80 million people or 

more—can no longer be denied insurance. 

Now, instead of battling it out over what happened 3 years ago, let’s start pulling 

on the same end of the rope and solve some real problems. For example, Democrats 

and Republicans ought to be working together to stoke more competition in the insurance marketplace and bring costs down for consumers. 

Next, there are going to be spectacular, new cures available in the future, and 

there are real questions as to whether our health care system will be able to afford 

them. Senator Grassley and I put together a bipartisan case study that looked into 

one such drug, which treats Hepatitis C. Solving this issue of blockbuster drug costs 

is going to take a lot of hard work on a bipartisan basis. 

Congress also has a duty to take Medicare’s historic guarantee and reinforce it 

for a new generation of Americans. In my view, it starts with revolutionizing the 

way Medicare handles caring for seniors with chronic conditions like diabetes, cancer and Alzheimer’s. Members on both sides of this committee, thanks to steadfast 

work by Senators Warner and Isakson, and Chairman Hatch’s leadership, have built 

a bipartisan game plan for chronic care. And it’s my hope that the committee is able 

to continue its progress on that front. 

Those are the kind of health care challenges I believe this committee should be 

focused on tackling. With that, I want to thank our witnesses for being here today. 

Æ