```

[Senate Hearing 114-557]
[From the U.S. Government Publishing Office]

                                                        S. Hrg. 114-557

         HEALTHCARE.GOV: A REVIEW OF OPERATIONS AND ENROLLMENT

=======================================================================

                                HEARING

                               before the

                          COMMITTEE ON FINANCE
                          UNITED STATES SENATE

                    ONE HUNDRED FOURTEENTH CONGRESS

                             SECOND SESSION

                               __________

                             MARCH 17, 2016

                               __________

                                     
      
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
      
      
      
      
      
      
      
      
      
      
      
      

            Printed for the use of the Committee on Finance
                                  ______

                         U.S. GOVERNMENT PUBLISHING OFFICE 

24-057-PDF                     WASHINGTON : 2017 
-----------------------------------------------------------------------
  For sale by the Superintendent of Documents, U.S. Government Publishing 
  Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; 
         DC area (202) 512-1800 Fax: (202) 512-2104 Mail: Stop IDCC, 
                          Washington, DC 20402-0001

                          COMMITTEE ON FINANCE

                     ORRIN G. HATCH, Utah, Chairman

CHUCK GRASSLEY, Iowa                 RON WYDEN, Oregon
MIKE CRAPO, Idaho                    CHARLES E. SCHUMER, New York
PAT ROBERTS, Kansas                  DEBBIE STABENOW, Michigan
MICHAEL B. ENZI, Wyoming             MARIA CANTWELL, Washington
JOHN CORNYN, Texas                   BILL NELSON, Florida
JOHN THUNE, South Dakota             ROBERT MENENDEZ, New Jersey
RICHARD BURR, North Carolina         THOMAS R. CARPER, Delaware
JOHNNY ISAKSON, Georgia              BENJAMIN L. CARDIN, Maryland
ROB PORTMAN, Ohio                    SHERROD BROWN, Ohio
PATRICK J. TOOMEY, Pennsylvania      MICHAEL F. BENNET, Colorado
DANIEL COATS, Indiana                ROBERT P. CASEY, Jr., Pennsylvania
DEAN HELLER, Nevada                  MARK R. WARNER, Virginia
TIM SCOTT, South Carolina

                     Chris Campbell, Staff Director

              Joshua Sheinkman, Democratic Staff Director

                                  (ii)

                            C O N T E N T S

                              ----------                              

                           OPENING STATEMENTS

                                                                   Page
Hatch, Hon. Orrin G., a U.S. Senator from Utah, chairman, 
  Committee on Finance...........................................     1
Wyden, Hon. Ron, a U.S. Senator from Oregon......................     3

                               WITNESSES

Bliss, Erin, Assistant Inspector General for Evaluation and 
  Inspections, Office of Inspector General, Department of Health 
  and Human Services, Washington, DC.............................     6
Bagdoyan, Seto J., Director of Audits, Forensic Audits and 
  Investigative Service, Government Accountability Office, 
  Washington, DC.................................................     8

               ALPHABETICAL LISTING AND APPENDIX MATERIAL

Bagdoyan, Seto J.:
    Testimony....................................................     8
    Prepared statement...........................................    21
    Responses to questions from committee members................    27
Bliss, Erin:
    Testimony....................................................     6
    Prepared statement...........................................    31
    Responses to questions from committee members................    37
Hatch, Hon. Orrin G.:
    Opening statement............................................     1
    Prepared statement...........................................    43
Wyden, Hon. Ron:
    Opening statement............................................     3
    Prepared statement...........................................    45

                                 (iii)

 
         HEALTHCARE.GOV: A REVIEW OF OPERATIONS AND ENROLLMENT

                              ----------                              

                        THURSDAY, MARCH 17, 2016

                                       U.S. Senate,
                                      Committee on Finance,
                                                    Washington, DC.
    The hearing was convened, pursuant to notice, at 10:03 
a.m., in room SD-215, Dirksen Senate Office Building, Hon. 
Orrin G. Hatch (chairman of the committee) presiding.
    Present: Senators Burr, Isakson, Coats, Heller, Scott, 
Wyden, Stabenow, Brown, and Bennet.
    Also present: Republican Staff: Chris Campbell, Staff 
Director; Christopher Armstrong, Deputy Chief Oversight 
Counsel; Kimberly Brandt, Chief Health-care Investigative 
Counsel; and Jill Wright, Detailee. Democratic Staff: Joshua 
Sheinkman, Staff Director; David Berick, Chief Investigator; 
Elizabeth Jurinka, Chief Health Advisor; and Juan Machado, 
Professional Staff Member.

 OPENING STATEMENT OF HON. ORRIN G. HATCH, A U.S. SENATOR FROM 
              UTAH, CHAIRMAN, COMMITTEE ON FINANCE

    The Chairman. The committee will come to order. It has been 
a little bit disruptive here this morning. We have a lot on our 
plate. It is a pleasure to welcome everybody here this morning.
    Today, we will be talking with representatives from the 
Office of Inspector General for the Department of Health and 
Human Services and from the Government Accountability Office 
about their ongoing oversight work with respect to 
HealthCare.gov and enrollment in the Federal health insurance 
marketplace. I want to thank both entities for their hard work 
on these issues and acknowledge the contributions both have 
made to help this committee perform more accurate and timely 
oversight.
    Now, it is no secret that I have never been a fan of the 
so-called Affordable Care Act, and, as we approach the sixth 
anniversary of this law and look closely into how it is working 
and being implemented, the evidence overwhelmingly shows that I 
and the many others who opposed the law from the beginning have 
been right all along.
    The facts speak for themselves. Since Obamacare was signed 
into law, HHS/OIG and GAO have cumulatively released at least 
six dozen reports detailing various operation and 
implementation issues, demonstrating the numerous areas where 
the law is falling short. These reports are specific and 
focused on key operational failures, like enrollment controls 
or system issues, some of which we will hear more about today.
    Let us keep in mind that GAO and HHS/OIG are not partisan 
entities. They are independent watchdogs tasked with the 
responsibility of objectively and dispassionately assessing 
what is and what is not working in various Federal programs, 
including those created or amended by the Affordable Care Act. 
And there is no better record showing how this happened than 
the reports we received from these offices.
    Today, we are going to specifically discuss operations 
issues related to HealthCare.gov and enrollment problems at the 
Federal insurance marketplace, otherwise known as the Federal 
exchange.
    Let us start with the HealthCare.gov launch. As a result of 
numerous problems and shortcuts taken with the initial 
development and deployment of HealthCare.gov and its supporting 
systems, consumers encountered widespread performance issues 
when trying to create accounts and enroll in health plans.
    After numerous inquiries and reports, we now know what 
ultimately caused these performance issues. For example, there 
was inadequate capacity planning. The Centers for Medicare and 
Medicaid Services, CMS, cut corners and did not plan for 
adequate capacity to maintain HealthCare.gov and its supporting 
systems.
    There were also problems with the software that were 
entirely avoidable. CMS and its contractors identified errors 
in the software coding for the website, but did not adequately 
correct them prior to the launch, and we saw a lack of 
functionality as CMS did not adequately prepare the necessary 
systems and functions of the website and its supporting systems 
prior to the initial launch.
    CMS also failed to apply recognized best practices for 
system development, which contributed to the problem. 
Admittedly, since the initial launch, CMS has taken steps to 
address these problems, including increasing capacity, 
requiring additional software quality reviews, and awarding a 
new contract to complete development and improve the 
functionality of key systems. However, many of the problems 
have still not been entirely resolved and continue to cause 
frustration, especially for consumers trying to obtain health 
insurance.
    I wish we could boil down all of Obamacare's problems to 
the functions of a single website. Indeed, if this was just an 
IT problem, all of our jobs would be a lot easier. However, the 
problems with Obamacare, and the Federal insurance marketplace 
in particular, go much deeper, and many of them remain 
unaddressed.
    We know, for example, that the enrollment controls for the 
Federal marketplace have been inadequate. During undercover 
testing by GAO, the Federal marketplace approved insurance 
coverage with taxpayer-funded subsidies for 11 out of 12 
fictitious phone or online applicants. In 2014, the GAO 
applicants--which, once again, were fake, made-up people--
obtained a total of about $30,000 in annual advanced premium 
tax credits, plus eligibility for lower insurance costs at the 
time of the service. These fictitious enrollees maintained 
subsidized coverage throughout the year even though GAO sent 
either clearly fabricated documents or no documents at all to 
resolve the application inconsistencies.
    While the subsidies, including those granted to GAO's 
fictitious applicants, are paid to health-care insurers, they 
nevertheless represent a benefit to consumers and a cost to the 
government.
    Now, GAO did find that CMS relies on a contractor charged 
with document processing to basically uncover and report 
possible instances of fraud. Yet, GAO also found that the 
agency does not require that the contractor have any fraud 
detection capability.
    According to GAO, CMS has not performed a single 
comprehensive fraud risk assessment--the recommended best 
practice--of the Obamacare enrollment and eligibility process. 
Until such assessment is completed, CMS is unlikely to know 
whether existing control activities are suitably designed and 
implemented to reduce inherent fraud risk to an acceptable 
level. In other words, CMS is not even sure if CMS's fraud 
prevention systems are designed correctly or if they are 
effective.
    Lastly, while it is not the focus of the reports that will 
be covered by the testimony today, another matter we have been 
tracking closely and where the GAO is issuing a report today is 
CMS's oversight of the health care CO-OPs. We had a hearing on 
this topic in late January, where we examined a number of 
financial and oversight-related explanations for the abject 
failure of the CO-OP programs.
    Today's GAO report describes CMS's efforts to deal with 
financial or operations issues at the CO-OPs, including the use 
of an escalation plan for CO-OPs with serious problems that may 
require corrective actions or enhanced oversight.
    As of November 2015, 18 CO-OPs had enough problems that 
they had to submit to a CMS escalation plan, including nine 
that have discontinued operation. And just last week, we heard 
that yet another CO-OP, this time the one in Maine, is on the 
verge of financial insolvency, despite the fact that it had 
been on a CMS-
mandated escalation plan.
    In other words, CMS's efforts to address all the problems 
faced by CO-OPs appear to have failed, just like virtually 
every other element of this program. The failure of CMS to 
adequately implement the CO-OP program is well-documented here 
on the Finance Committee and elsewhere. As with so many other 
parts of Obamacare, the high-minded rhetoric surrounding this 
program has fallen short of reality.
    With nearly half of the CO-OPs now closed, the failed 
experiment has wasted taxpayer dollars and forced patients and 
families to scramble for new insurance. With so many CO-OPs now 
in financial jeopardy, I believe that CMS should work with and 
not against States to safeguard taxpayer dollars.
    So as always, we have a lot to discuss, and I look forward 
to hearing more from the officials we have testifying here 
today.
    So with that, I will turn to Senator Wyden for his opening 
remarks.
    [The prepared statement of Chairman Hatch appears in the 
appendix.]

             OPENING STATEMENT OF HON. RON WYDEN, 
                   A U.S. SENATOR FROM OREGON

    Senator Wyden. Thank you, Mr. Chairman.
    Mr. Chairman and colleagues, it is old news that the 
initial rollout of HealthCare.gov 3 years ago was botched. It 
is new news that the Inspector General of the Health and Human 
Services Department recently said, and I want to quote here--
this is a quote, colleagues, from the Inspector General: ``CMS 
recovered the HealthCare.gov website for high consumer use 
within 2 months and adopted more effective organizational 
practices.'' That is what the Inspector General said, that the 
Department recovered the website for high consumer use within 2 
months. That quote comes from one of two reports looking back 
at 2013 and 2014 that the Finance Committee will be presented 
with today.
    I think we ought to start by recognizing that the story 
here is well-documented. After the launch went badly, some of 
the best minds in technology and a new contractor were brought 
in. They scrambled to overhaul the system, and the exchange was 
soon up and running, and the Centers for Medicare and Medicaid 
Services are now following up on each of the Inspector 
General's recommendations, which the Inspector General notes in 
its report.
    In the most recent enrollment period, nearly 10 million 
Americans used HealthCare.gov to sign up for a plan or reenroll 
automatically. In my home State, which had its own problems, 
close to 150,000 people have used the website to sign up for a 
plan as of January 31st. That is up by more than 30 percent 
compared to last year.
    The committee will also hear an update from the Government 
Accountability Office on what has been called the secret 
shopper investigation. The Government Accountability Office 
first brought this study before the committee in July of last 
year. I am going to repeat what I said back then.
    On this side of the aisle, we do not take a back seat to 
anybody in fighting fraud and protecting taxpayer dollars--$1 
ripped off is $1 too many. But let us recognize that what was 
true last summer remains true today.
    This GAO investigation has not uncovered one single shred 
of real-world fraud in the insurance marketplace. It was built 
on fictitious characters with specially created identities, not 
real consumers and not real fraudsters. It is true that the 
Government Accountability Office found that there are sometimes 
differences between the information on somebody's insurance 
application and their tax forms and citizenship records. But 
when it comes to these inconsistencies in people's data, this 
investigation cannot differentiate between fraud and a typo.
    Meanwhile, Health and Human Services does not look the 
other way when it finds the red flags. In 2014, the year of 
GAO's investigation, the Centers for Medicare and Medicaid 
Services closed more than 100,000 insurance policies because 
documents did not match or were not provided. Tax credits were 
adjusted for nearly 100,000 households. In 2015, Health and 
Human Services closed more policies and adjusted more tax 
credits.
    If you come at this from the left, you might say that is 
too harsh. If you come at it from the right, you might take a 
different view. But there is no basis whatsoever for the 
argument that Health and Human Services ignores problems in 
people's records or leaves the door open to fraud. It seems to 
me, rather than rehashing old news, we ought to be looking at 
the facts and talking in a bipartisan way about how to move 
forward together.
    Because of the Affordable Care Act, the number of Americans 
without health insurance is at or near its lowest point in half 
a century. For the 160 million people who get their insurance 
from their employer, colleagues, premiums climbed 4 percent 
last year. Let me repeat that. For 160 million people who get 
their insurance from their employer, premiums climbed only 4 
percent. Working-age Americans in Oregon and nationwide with 
preexisting conditions--80 million people or more--can no 
longer be denied insurance.
    So, instead of battling out what happened 3 years ago, we 
ought to be pulling on the same end of the rope and solving 
some problems. For example, Democrats and Republicans ought to 
be working together to look at ways in which we can provide 
even more competition and bring costs down for consumers, and a 
lot of you in this room have worked with me on that issue for 
some time.
    Second, there are going to be spectacular new cures in the 
future, and there are real questions as to whether our health-
care system is going to be able to afford them. Here, Senator 
Grassley has worked very closely with me to put together a 
bipartisan case study, which looked at one blockbuster drug 
involving hepatitis C. Solving the cost of these blockbuster 
drugs is going to take a lot of hard work. It, again, can only 
be done on a bipartisan basis.
    Finally, I want to express my appreciation to colleagues on 
both sides of the aisle, because I think we are on the cusp of 
being able to make real progress on a huge opportunity for 
older people in our country, and that is protecting the 
Medicare guarantee, this very sacred guarantee we have for 
seniors, while updating the program to look at the great new 
challenge, which is chronic illness.
    I want to thank Senator Bennet, who was out in front on 
this issue for some time. He is not here, but Senator Isakson 
and Senator Warner were champions as well. I want to express my 
appreciation to the chairman for the progress that we are 
making.
    I have to make some comments with respect to something we 
did not know about until about an hour ago, and that is this 
matter of the CO-OPs.
    What we have said is that we want to work in a bipartisan 
way to improve a variety of sections of the Affordable Care 
Act. Now, this new material on the CO-OPs, which neither I nor 
anyone on this side knew anything about, was available 
something like an hour ago. I intend to look at it with an eye 
to what can be done on a bipartisan basis going forward.
    But my work, and I think the work of colleagues here, 
always ought to come back to this idea of making health-care 
policy more accessible and more affordable. And for now--and I 
certainly have not seen this report--I am not going to be 
participating in any celebration of people suffering, because 
the CO-OPs were tied up in a congressionally induced economic 
straightjacket.
    Thank you, Mr. Chairman.
    [The prepared statement of Senator Wyden appears in the 
appendix.]
    The Chairman. Thank you, Senator.
    I am going to introduce today's witnesses. Our first 
witness is Ms. Erin Bliss, the Assistant Inspector General for 
Evaluation and Inspections in the Office of Inspector General, 
or OIG, at HHS.
    Ms. Bliss has served in many roles at OIG since her career 
began. I think your career began in 2000, if I have it 
correctly. She started as an analyst for the Office of 
Evaluation and Inspections and later went on to serve as a 
senior advisor, where she provided management advice and expert 
analysis to the Inspector General and other senior executives 
on programmatic priorities and internal policies and 
operations.
    Afterwards, she worked from 2009 to 2014 as Director of 
External Affairs at OIG and was responsible for overseeing and 
implementing OIG's communication strategies and relationship 
management with the administration, Congress, media, the 
health-care industry and providers, and the public.
    Ms. Bliss received her bachelor's degree in government from 
the University of Notre Dame before receiving her master's 
degree in public policy from the University of Chicago.
    Our second witness is Mr. Seto Bagdoyan, the Director for 
Audit Services in GAO's Forensics, Audits, and Investigative 
Service Mission Team. During his GAO career, Mr. Bagdoyan has 
served in a variety of positions, including as Legislative 
Advisor in the Office of Congressional Relations and as 
Assistant Director for Homeland Security in Justice.
    Mr. Bagdoyan has also served on congressional details with 
the Senate Finance Committee and the House Committee on 
Homeland Security. We are glad to see you back here again.
    Mr. Bagdoyan has also held a number of senior positions in 
consultancies in the private sector, including most recently 
focusing on political risk in homeland security.
    Mr. Bagdoyan received his bachelor's degree in 
international relations and economics from Claremont McKenna 
College and an MBA in strategy from Pepperdine University.
    I want to thank you both for coming. We will hear the 
witness testimonies in the order that they were introduced.
    Ms. Bliss, please proceed with your 5-minute statement.

   STATEMENT OF ERIN BLISS, ASSISTANT INSPECTOR GENERAL FOR 
   EVALUATION AND INSPECTIONS, OFFICE OF INSPECTOR GENERAL, 
    DEPARTMENT OF HEALTH AND HUMAN SERVICES, WASHINGTON, DC

    Ms. Bliss. Thank you. Good morning, Chairman Hatch and 
other distinguished members of the committee. Thank you for the 
opportunity to testify today about the Office of Inspector 
General's case study which examines the management of 
HealthCare.gov.
    This is the website consumers use to apply for health 
insurance through the Federal marketplace. As is well known, on 
October 1, 2013, the HealthCare.gov website failed almost 
immediately upon launch. Yet, within 2 months, CMS had 
substantially improved the site's performance.
    How did such a high priority project start so poorly, and 
how did CMS turn the website around? Our case study provides 
insights into these questions and lessons learned to help 
HealthCare.gov and other Federal projects work better.
    We believe that our assessment of the intersection of 
technology, policy, and management can benefit a broad range of 
Federal projects and programs. Our report chronicles the 
breakdown and turnaround of HealthCare.gov over a 5-year 
period. This morning I will summarize the highlights.
    From the outset, the HealthCare.gov project faced a high 
risk of failure. It was technically complex, with a fixed 
deadline and many uncertainties. Still, HHS and CMS made many 
missteps in its implementation. Most critical was the absence 
of clear leadership and overall project responsibility, which 
had ripple effects.
    Policy decisions were delayed, affecting the technical 
decisions. Policy and technical staff were in silos and not 
well-coordinated, and contract management was disjointed. 
Changes to the project were not well-documented and progress 
not adequately monitored.
    This culminated in CMS not fully communicating or acting 
upon many warnings of problems before the launch. CMS failed to 
fully grasp the poor status of the build. One reason was that 
no one had a full view into all of the problems and how they 
fit together.
    Red flags raised to leadership did not always flow to staff 
working on the build, and staff did not always alert leadership 
to problems on the front lines. CMS was unduly optimistic.
    Last-minute attempts to correct problems were rushed and 
insufficient. In the 2 months before the launch, CMS added 
twice the staff to the project and cut many planned website 
functions. And just 72 hours ahead, CMS asked its contractor to 
double its computing capacity.
    Even with these efforts, the HealthCare.gov website 
experienced major problems within hours of its launch. The 
website received five times the number of expected users, but 
the problems went beyond capacity. The website entry tool 
worked poorly, and software coding defects caused malfunctions. 
CMS and its contractors did not have coordinated tools to 
diagnose these problems. However, CMS pivoted quickly to make 
corrections to the website. They brought in additional staff 
and expertise from across government and the private sector.
    One key was creating a badgeless culture, where Federal 
employees and contractors worked together as a team. CMS 
designated clear leadership, integrated policy and technical 
staff, and developed redundant systems to avoid future website 
problems.
    CMS also took a more realistic approach to building website 
functions. It practiced what officials called ruthless 
prioritization, which focused on effectively developing the 
most critical functions, like reenrollment, and delaying other 
features. They measured progress and monitored problems to 
respond more quickly and effectively. These factors contributed 
to an improved website and important organizational changes.
    Looking ahead, CMS continues to face challenges in 
improving HealthCare.gov and managing the Federal marketplace. 
This includes addressing more than 30 recommendations from 
OIG's other Federal marketplace reports. We will continue to 
monitor CMS's actions in response to our recommendations and 
its overall management of this and other programs.
    Thank you again for inviting OIG to speak with the 
committee today, and I will be happy to answer your questions.
    [The prepared statement of Ms. Bliss appears in the 
appendix.]
    The Chairman. Thank you so much.
    Mr. Bagdoyan, we will turn to you.

  STATEMENT OF SETO J. BAGDOYAN, DIRECTOR OF AUDITS, FORENSIC 
  AUDITS AND INVESTIGATIVE SERVICE, GOVERNMENT ACCOUNTABILITY 
                     OFFICE, WASHINGTON, DC

    Mr. Bagdoyan. Good morning, Chairman Hatch, Ranking Member 
Wyden, and members of the committee. I am pleased to be here 
today to discuss results from our February 2016 report on 
enrollment and verification controls for ACA health-care 
coverage obtained through the Federal marketplace during the 
2014 open enrollment period.
    Our results are based on extensive forensic analyses of 
relevant data from CMS and other agencies, such as SSA, IRS, 
and DHS--involving originally the entire 2014 applicant and 
enrollee universe--and are independent of the undercover work 
we performed for that period.
    A central feature of ACA's enrollment controls is the 
Federal data services hub, which is the primary vehicle for CMS 
to initially check information provided by applicants against 
various Federal data sources. In addition, the ACA established 
a process to resolve inconsistencies, i.e., instances where 
applicant information does not match that from marketplace 
sources.
    In terms of context for our work, coverage offered through 
the Federal marketplace is a significant expenditure for the 
Federal Government. Current levels of coverage involve millions 
of enrollees, of whom about 85 percent receive subsidies. CBO 
has estimated Fed subsidy costs at about $880 billion for 
fiscal years 2016 through 2025.
    I would note that while subsidies are paid to insurers and 
not directly to enrollees, they nevertheless represent a 
financial benefit to them. As I have stressed before, a program 
of this scope and scale remains inherently at risk for errors, 
including improper payment and fraud. Accordingly, it is 
essential that effective enrollment controls are in place to 
help narrow the window of opportunity for such risk and 
safeguard the government's investment.
    Against this backdrop, I will now discuss our two principal 
analytical results.
    First, we found that CMS does not track or analyze 
aggregate outcomes of data hub inquiries or the extent to which 
a queried agency delivers information responsive to a request 
or whether an agency reports that that information was not 
available.
    In this regard, for example, we found that SSA could not 
match 4.3 million queries related to names, dates of birth, or 
Social Security numbers, and 8.2 million queries related to 
citizenship claims. IRS could not match queries involving about 
31 million people related to income and family size, and, 
within this, 1.3 million people had ID theft issues. Finally, 
DHS could not match 510,000 queries related to citizenship and 
immigration status.
    Accordingly, CMS foregoes opportunities for gaining 
valuable insights about significant program integrity issues, 
including vulnerabilities to potential fraud, as well as 
information useful for enhancing overall program management.
    Second, we found that CMS did not have an effective process 
for resolving inconsistencies for applicants using the Federal 
marketplace. For example, we found that about 431,000 
applications, with about $1.7 billion in associated subsidies, 
still had about 679,000 inconsistencies unresolved as of April 
2015. That is 4 months after the close of the 2014 coverage 
year.
    Within these, CMS did not resolve Social Security number 
inconsistencies for about 35,000 applications, with about $154 
million in associated subsidies, or incarceration 
inconsistencies for about 22,000 applications, with about $68 
million in associated subsidies.
    By leaving inconsistencies unresolved, CMS risks granting 
eligibility to and making subsidy payments on behalf of 
individuals who are ineligible to enroll in qualified health 
plans. One important example emphasizes this point. According 
to IRS, accurate data are vital for income tax compliance and 
the reconciliation of advanced premium tax credits through 
filing tax returns, which is a key backend control under ACA.
    In closing, our work to date collectively shows that CMS 
has assumed a generally passive approach to managing fraud 
risks in ACA, weakening the program's integrity. Accordingly, 
we continue to underscore that CMS needs to make ACA program 
integrity a priority and implement effective controls to help 
reduce improper payment and fraud risks and preclude them from 
being embedded early in the program's life cycle.
    In this regard, we made eight recommendations to CMS in our 
February report, which are intended to help mitigate the 
vulnerabilities and risks we identified. While the agency 
agreed with the recommendations, it is incumbent on CMS to 
implement them in a timely fashion and achieve and sustain 
measurable results.
    Mr. Chairman, this concludes my statement. I look forward 
to the committee's questions, and I appreciate the indulgence 
for an extra 30 seconds.
    [The prepared statement of Mr. Bagdoyan appears in the 
appendix.]
    The Chairman. I am happy to give you that extra time.
    Ms. Bliss, previous reports at the Office of Inspector 
General criticized HealthCare.gov and the marketplace, 
describing important problems with internal controls, such as 
inadequate procedures for checking the eligibility of 
enrollees.
    How does the case study differ from previous reports of the 
Office of Inspector General on the same topic?
    Ms. Bliss. Thank you for your question, Mr. Chairman. The 
case study is one of a dozen reports that OIG has issued on the 
Federal marketplaces. Most of those were more-targeted audits 
or evaluations examining aspects of eligibility controls, 
payment accuracy, contracting, and security of information.
    The case study took a different approach and cast a wide 
lens at CMS's management of the project in its entirety, from 
multiple perspectives and over a long period of time, in order 
to glean lessons learned about what went wrong and what went 
right in an effort to help improve both this HealthCare.gov 
project and other Federal projects moving forward.
    The Chairman. Thank you.
    Mr. Bagdoyan, your report pointed out the key role played 
by the, quote, ``data services hub,'' which is the electronic 
clearinghouse for checking applicant information against 
Federal databases.
    Now, you said that CMS needs to make better use of this 
important enrollment control process. Would you explain that a 
little bit?
    Mr. Bagdoyan. I would be happy to do that, Mr. Chairman.
    Basically, the data hub is a key cog, if you will, in the 
overall control environment for ACA. It is up-front. It 
processes a lot of queries for information. A lot of those 
queries--all of those queries, in fact, are not captured for 
future analysis.
    We believe that such capture and analysis would provide CMS 
with a lot of insight into potential indicators of improper 
payments, as well as fraud. So a comprehensive control system 
would theoretically enable that sort of analysis for the long 
term, and we do actually have a recommendation to that effect 
to CMS.
    The Chairman. Thank you. We have been long told by CMS, 
``Do not worry. Even if there are issues with awarding 
subsidies, everything eventually gets fixed when people file 
their income taxes.''
    The GAO found practices that undermine tax compliance. Am I 
right about that?
    Mr. Bagdoyan. Yes. We identified a number of 
inconsistencies. Out of the 431,000, I believe we had about 
35,000 that involved tax or SSN inconsistencies. And according 
to IRS, when we discussed this at length, they told us that 
this was not only important for tax compliance purposes, but 
also for the tax reconciliation process to reconcile the 
advanced premium tax credits at the end.
    This is the third main back-end control, if you will, in 
the overall setup. So without that information that is accurate 
and reliable, IRS pointed out that their job is made much more 
difficult, not only to do the tax return processing, but also 
to reconcile the subsidies.
    So it is a long-term problem if it is not addressed.
    The Chairman. All right. Ms. Bliss, what are the most 
important lessons learned from HealthCare.gov for the 
administration, and do you think that the lessons learned from 
your case study apply to other large programs and projects, 
whether being planned by the Department of Health and Human 
Services or other government agencies?
    Ms. Bliss. Thank you. We certainly do. The intersection 
between policy, technology, and management is not only 
essential for HealthCare.gov, but we believe these lessons will 
apply to other Federal projects and Federal programs.
    We gleaned 10 lessons learned, and I will highlight what I 
believe to be the three most significant.
    First is establishing clear leadership. We found that the 
lack of clear leadership in overall responsibility and clear 
lines of delegation had ripple effects, caused a number of 
cascading problems across the project, and made problem 
resolution more difficult.
    We also found that a disconnect between those working on 
the policy and making decisions and those working on the 
technical aspects of the project created problems on both 
sides. And delays in policy decision-making compressed an 
already tight time frame for achieving the technical build 
successfully.
    So, better integration across lines of business, policy, 
and technical, as well as across government and contractors 
through this badgeless culture, are some of the keys we saw to 
correction and success.
    And then, finally, taking a posture of continuous learning 
is essential, which means being flexible and adaptable, 
especially with a startup-type project like HealthCare.gov was. 
We found that CMS got stuck on an unwinnable path, and it was 
too late before they realized it and tried to make changes.
    So keeping that continuous learning posture, being 
innovative and flexible, and constantly monitoring for problems 
to adjust plans where needed are all important.
    Thank you.
    The Chairman. Thank you.
    Senator Stabenow, we will turn to you.
    Senator Stabenow. Thank you very much, Mr. Chairman. And 
welcome and thank you to both of you.
    Ms. Bliss, I am wondering--to start, just a ``yes'' or 
``no'' question. Based on your case study, do you think that 
the HealthCare.gov website should be taken down and a 
completely new website be built?
    Ms. Bliss. No.
    Senator Stabenow. Thank you. Like many of my colleagues, we 
were very frustrated about what happened in the past, and 
clearly you have laid out the problems with the launch, and I 
think everyone agrees that there were serious problems with the 
launch of HealthCare.gov and it created a lot of difficulties, 
and certainly for people in Michigan, to get coverage in 2013.
    But that was 3 years ago, and we are now in year 3 of the 
Affordable Care Act marketplace operations. So when we look at 
the report, the report is really looking backwards, and we can 
agree there were problems.
    The question is moving forward and how do we ignore the 
fact that over 20 million people have received health-care 
coverage because of the Affordable Care Act, literally saving 
people's lives? That is not just a rhetorical statement. I have 
talked to people who were able to get surgery or were able to 
get care for their children that they have never been able to 
receive before and save lives, and I think that is a good part 
of things when we talk about the numbers, the real-life 
experiences of people.
    The un-insurance rate is the lowest it has ever been, and 
Medicaid expansion has resulted in literally millions of our 
most vulnerable families receiving the care that they deserve.
    So, given the fact that the ACA is the law of the land and 
it is our responsibility to make it better, I first want to say 
that I hope that all of us will work on how to make it better, 
and that is why we appreciate your recommendations as we look 
forward, not just in the case of this particular website and 
process, but others as well.
    But the question is, how do we make it better? So we want 
to make sure that we have quality access to health care for 
every American, whether it is Medicare, Medicaid, the 
Children's Health Program, and so on and so on.
    So with that in mind, Mr. Bagdoyan, let me ask about any 
other recommendations from a GAO standpoint that you have not 
already spoken of today on how we can make these better, 
because, frankly, I want the over 20 million people who have 
health insurance today who did not have it before to have the 
peace of mind going to bed at night of knowing they are going 
to be able to take their children to a doctor if they get sick. 
I want to keep that. And I am hopeful we can even get as close 
to zero as possible in terms of the number of people in our 
country who do not have access to health care.
    So I am interested in your recommendations on how we go 
forward to work together to make this system work better.
    Mr. Bagdoyan. Sure. Thank you for your question, Senator 
Stabenow.
    As you mentioned, we operate under the premise that this is 
the law on the books, and my charge is to help make it work as 
intended. With that in mind, our report makes eight specific 
recommendations. We try not to be too prescriptive to allow CMS 
some latitude to explore various options.
    However, the key recommendation, I believe, the big-picture 
recommendation, is for CMS to conduct a comprehensive risk 
assessment of the entire program, sort of top to bottom, and 
identify the control vulnerabilities and the risks for improper 
payments and fraud.
    In that regard, GAO issued, in July of 2015, its framework 
for managing fraud risk in Federal programs. So that is a 
comprehensive leading practice compilation from the private and 
public sectors that would provide the agency with quite a solid 
roadmap to perform that risk assessment.
    So everything should flow from that assessment in terms of 
the types of actions, policy changes, control improvements, and 
so forth.
    Senator Stabenow. And are you working with CMS? What is 
their reaction on this? Are they objecting to that?
    Mr. Bagdoyan. No. I think I should give CMS credit that 
they accepted all eight recommendations, including this one. 
But as they say, the proof is in the pudding. They need to 
execute, do so successfully, and then achieve results and 
sustain them over the long term. This is not a one-and-done 
proposition by any means.
    Senator Stabenow. Sure. So just to be clear, you have made 
the recommendations. They have accepted all eight 
recommendations, and they are in the process of doing them.
    Mr. Bagdoyan. That is correct. We had informal discussions, 
as well as the formal letter responding to our recommendations.
    Senator Stabenow. Thank you, Mr. Chairman.
    The Chairman. Senator Coats?
    Senator Coats. Thank you, Mr. Chairman. And I want to thank 
our two witnesses.
    Lord knows where we would be if we did not have GAO and 
Inspectors General. The alarming malfeasance and incompetence 
of the rollout of this plan is just stunning. And here we are, 
we cannot just simply brush it off and say, well, this was a 
bad start, but everything is going great now.
    On the cost to the taxpayer, probably we will never know. 
But thank goodness that we have your organizations providing us 
information and spurring on a seemingly bureaucratic nightmare 
that exists within the Federal Government in terms of handling 
these kinds of programs.
    Anybody in the private sector who had done this would have 
been bankrupt; investors would have lost all their money. It is 
just stunning to continue to observe what it takes to get these 
agencies to--I think they are well-intended, they are just 
overwhelmed in terms of the complexity of getting this done.
    I go the floor of the Senate every week and talk about a 
waste of the week, and, Mr. Bagdoyan, I have referenced your 
name, not as part of the problem, but as part of the solution. 
And the information that you have provided here for me 
continues to stun people when they hear about some of the 
incompetency.
    I was particularly interested, because I think it speaks to 
a bigger problem, in your, what was called the secret shopper 
investigation, where you deliberately made applications as a 
test--you made applications for compliance with the Affordable 
Care Act and receiving subsidies. And 11 of the 12--I think my 
numbers are right--everything you submitted was fraudulent, but 
11 of the 12 were accepted. And even after it was revealed that 
they were accepted, follow-up phone calls, pretending to be 
that person who was given notice that they were not eligible, 
were accepted.
    That percentage is pretty high, and if you multiply that 
out, it just really makes you wonder if this whole thing was 
not gamed or at least so intent on providing numbers to make it 
look successful that we really were not getting the 
information, the verification, that we needed.
    Then there was the question with CMS at one point releasing 
a statement, ``Well, we are not in the verification business.'' 
I think basically what you just said was that they are now 
taking a different stand on that.
    But I wonder if you could respond to where are we now in 
terms of verification capacity so that we do not have this 
fraudulent and wasteful situation moving on. I am happy to have 
either one of you or both of you address that. But it just 
seems easy: an evaluation of Social Security numbers to 
determine their validity would make it fairly easy to make a 
determination as to whether they qualify or whether they do not 
qualify.
    But where is CMS in terms of putting that process in place, 
and what is the success to date of that process?
    Mr. Bagdoyan. Sure. If I may, Ms. Bliss, take first crack 
on that.
    First, I appreciate the plug on the floor, Senator.
    Senator Coats. Sure. [Laughter.]
    Keep sending us stuff; I will keep going to the floor.
    Mr. Bagdoyan. So in terms of where CMS is with the 
controls, what we call the control environment, which is a 
series of controls designed to verify information, identify 
potential indicators of fraud, and so forth, as our undercover 
work indicated, both for 2014 and 2015, where we were equally 
successful, there is a semblance of controls in place.
    Senator Coats. A semblance?
    Mr. Bagdoyan. A semblance of controls in place, some basic 
things in place, like identity-proofing the document 
reconciliation process to clear inconsistencies, for example. 
But in each case, we were able to work around those reasonably 
easily and obtain coverage both for 2014 and 2015. So the 
vulnerabilities are still in place.
    Now, with the recommendations we made in this report, 
actually, in late February, we made eight recommendations. As I 
explained to Senator Stabenow, the big one is to perform a 
comprehensive risk assessment.
    Now, that is going to take time. It is going to take time 
for CMS to absorb the results and then craft, hopefully, 
appropriate solutions for the future. So this is a long-term 
proposition. It is not going to be an easy fix.
    Senator Coats. Well, I think this speaks to the point that 
we got a bad start and everything is going great right now. 
Everything is not going great right now. As you said, this is 
going to take a long-term effort to try to put these 
verification procedures in place and to be able to say that we 
are successfully avoiding fraud and waste and an inefficiency 
and taxpayer cost level that is just absolutely astounding.
    So, with due respect to my colleagues, to tout this as 
something that has happened in the past but is corrected now 
and we are sailing into the bright future, I think we have a 
lot of work to do.
    Thanks, Mr. Chairman.
    The Chairman. Senator Wyden?
    Senator Wyden. Thank you, Mr. Chairman.
    I want to again say that the initial rollout was botched, 
and I appreciated the Inspector General making it clear that a 
couple months in, there was serious progress.
    So you all reported that after the first open enrollment, 
the agency demonstrated a strong sense of urgency to take 
action, accepted new work processes, and they, quote, 
``improved the HealthCare.gov website substantially within 2 
months.''
    I think it would be helpful, Ms. Bliss, if you could tell 
us two things. What were the operational and strategic changes 
that were made after that first open enrollment, and do you 
feel they are better-equipped to deal with the challenge now?
    Ms. Bliss. Thank you, Ranking Member Wyden, for that 
question. As we discussed in the case study, some of the key 
strategic and operational changes that were made as part of the 
correction were to, one, establish more clear leadership and 
designate roles and responsibilities, and they did it in a way 
that really brought together staff and contractors across all 
of the important business lines that were affected and needed 
to be involved in the correction. That includes the policy 
people, the technical, the communications, and the contractors 
all coming together.
    With the influx of experts from across government and the 
private sector, there was the potential that it could have 
become more chaotic, but, in fact, we saw that the reverse was 
true. It was well-organized. Folks were working together in a 
badgeless culture as a team. There was better communication, 
there was better measurement and monitoring of problems, and 
there was progress in order to apply solutions more quickly and 
effectively.
    Senator Wyden. So, in effect, after the first few months, 
which everybody has acknowledged were not ideal, your 
characterization was that essentially it was well-organized.
    Ms. Bliss. It was much better organized----
    Senator Wyden. I was using your word----
    Ms. Bliss [continuing]. And they continue to make progress.
    Senator Wyden. All right. Good. Mr. Bagdoyan, first, I am 
probably the biggest user of GAO products here in the Congress. 
I so admire the professionalism of the agency, and I think you 
heard me say I do not take a back seat to anybody when it comes 
to cracking down on actual real-world fraud.
    My question to you is, is it not correct that when you 
testified before the committee last year, you stated that the 
secret shopper investigation failed to uncover a single real-
world example of fraud?
    Mr. Bagdoyan. Yes, that is what I said, Senator Wyden, and 
I would also couch that very carefully for you and the 
committee.
    The intent of that investigation was not to uncover fraud 
but to flag control vulnerabilities, as well as identify 
indicators of potential fraud, which I think we did quite 
successfully.
    So I just want to make clear my charge is not to find 
fraud. Fraud is determined through a separate criminal 
proceeding in courts to definitively determine that. So my job, 
again, is to look for vulnerabilities in controls, as well as 
identify indicators of potential fraud or improper payments.
    Senator Wyden. So let us go then from last year when there 
was not one single real-world example of fraud to where we are 
now. Is it correct to say that the entire investigation failed 
to identify any actual fraud?
    Mr. Bagdoyan. Well, again, I would refer you to my answer. 
That was not our intent. So if I am not looking for fraud, I am 
not going to find it. What I am looking for is vulnerabilities 
in controls and indicators of potential fraud, such as the 
inconsistencies with the Social Security numbers, as well as, 
in the case of the IRS, 1.3 million people having potential ID 
theft issues, which is a significant red flag.
    Senator Wyden. I think that, as is always the case, you all 
are right to talk about various issues that ought to be part of 
the debate. That is not what is going on here. What people are 
saying is, this is fraud, fraud, fraud, fraud, and I appreciate 
your taking us through this in, I think, a better-balanced 
view.
    Ms. Bliss, at HHS, you all do audits, OIG does audits. Have 
you uncovered, in connection with this, any confirmed cases of 
fraud?
    Ms. Bliss. No, we have not had any cases that have resulted 
in criminal convictions or civil settlements to date. We do 
have a few investigations that are ongoing, and I cannot 
predict what those outcomes will be.
    Senator Wyden. Look, I do not know how many times I have 
said in this committee that when there are big, important 
issues--and certainly the Affordable Care Act is right at the 
top--we need to work in a bipartisan fashion, and there is not 
a program anywhere in government where you cannot find 
opportunities to work together and be bipartisan.
    I ticked off a number of them. The chairman and I are 
working together on what I think is the future of the Medicare 
program, chronic care; Senator Grassley and I are finishing 
what I think is a blockbuster study looking at hepatitis C. And 
it raises the question of, when we have cures, will people be 
able to afford them?
    What I think is important is that, to do bipartisan work, 
we have to move away from, first, the past, because everybody 
has acknowledged that the first few months were botched. I do 
not know how many times you can say it. But you all said--and I 
read your comments--after the first few months, you said they 
had made substantial improvements. I think I can come back to 
it and perhaps read it one more time.
    ``The Centers for Medicare and Medicaid Services recovered 
the health care government website for high consumer use within 
2 months.'' Now, that is the new news. That is just a few weeks 
old. That is new news, and I want people to hear that, and I 
want people to hear that there were no actual real-world cases 
of fraud uncovered.
    Now, one final question, if I might, for you, Ms. Bliss. Do 
you disagree with the statement that I made with respect to the 
accomplishments of the Affordable Care Act? That is not your 
formal role as Inspector General, but does anything strike you 
as being inaccurate there with respect to the uninsured rate or 
anything of that nature?
    Ms. Bliss. As an independent oversight agency, we do not 
take positions on whether particular programs should exist, but 
we look to make sure they are operating correctly.
    Senator Wyden. That is not the question. The question was 
about the facts, and what I think, again, is, this is a hard 
fact that is not in dispute, that the uninsured rate is now at 
or near the lowest level recorded across 5 decades of data, 
with about 20 million previously uninsured Americans gaining 
coverage since the Act's provisions went into effect.
    So I will keep the record open so that if you or your 
agency has any information suggesting that is wrong, I would 
surely like to know about it.
    Ms. Bliss. Thank you. I do not have any information 
suggesting that that is wrong.
    Senator Wyden. Wonderful. Mr. Chairman, thank you.
    The Chairman. Senator Scott?
    Senator Scott. Ms. Bliss, do you have any information 
suggesting that those numbers are right?
    Ms. Bliss. I cannot validate those numbers. I do not have 
any reason to believe they are not.
    Senator Scott. But you have no indication either way, 
actually.
    Ms. Bliss. I have no basis, no.
    Senator Scott. If I tell you that the number is 30 million, 
you have no reason to believe that it is not 30 million.
    Ms. Bliss. I do not have a basis for validating that 
number. Our case study--I am sorry.
    Senator Scott. Thank you. Mr. Bagdoyan, our ranking member 
asked you several questions about fraud, and I certainly 
understand and appreciate why so many Americans look at this 
process and become disenchanted.
    Your objective was never to figure out how much fraud was 
in the system. Your objective, it appeared to me, was to show 
us how fraud could happen.
    Mr. Bagdoyan. Yes, essentially, Senator, you are correct. 
The big picture we are looking at is for any vulnerabilities in 
the controls that are in place and also for any indicators of 
potential fraud that pop up. For example, our ability to 
circumvent the controls we encountered during our undercover 
work--we did that for 2014, and we repeated that experience in 
2015, in which case we were successful 17 out of 18 attempts.
    Now, I would have to caution that, of course, further to 
the point that Senator Coats made earlier, that is not a 
projectable number. So we have to be very careful that that 
does not represent the actual universe; that is just a data set 
that we use to continue our work in this area.
    Senator Scott. Thank you very much. No one is going to 
mistake me for a fan of Obamacare or the ACA, without any 
question. For a number of reasons, I am not a fan of the 
website nor the actual policy itself, the legislation.
    I think of the Independent Payment Advisory Board, what 
some have referred to as a death panel, and the ability to 
ration care into the future. This is one of the classic 
examples of why so few Americans have the same appreciation of 
the ACA that others have talked about.
    I think the fact that we are talking about taxing 
Americans, whether it is their income or their profits, an 
additional 3.8-percent tax, raising somewhere over $120 
billion, is another reason why so few Americans have the same 
positive theme that we have heard from some of our friends on 
the other side.
    Think about the whole notion of how the health-care law is 
going to regulate the posting of calories at pizza parlors, 
grocery stores, all over the place, and, by default, increase 
the price of these groceries, these pizzas and other non-food 
items, reducing the number of employees' hours, talking about 
the impact on middle-income America, so many Americans losing 
perhaps up to 25 percent of their income because of the ACA.
    We can see why so many Americans have found frustration 
with where we are with the ACA, that it is not old news to 
them.
    It is not old news, actually, when you think about the fact 
that so many Americans are facing higher premiums. We have 
heard so many different numbers this morning. We know that at 
least some States have seen an increase of more than 25 percent 
in their health-care costs. Two States have seen those numbers 
go over 35 percent. Those are real dollars for struggling 
Americans who cannot afford the cost of health insurance.
    Not only are the premiums higher, the deductibles are 
higher, the out-of-pocket expenses are higher. The only thing 
that is actually lower are the doctors to choose from and the 
hospitals to go to.
    We have seen a catastrophic occurrence under this health-
care law. And even at one of the most recent Democratic town 
halls, a young lady, supportive of President Obama, who 
supports the health-care law, said that her premiums had 
doubled, tripled. Her concerns were strong, clear.
    Here is one real case example that, Ms. Bliss, I hope is no 
longer happening. A young man named Tom Dougall from Elgin, SC, 
who created an account on HealthCare.gov, was called shortly 
thereafter by a man named Mr. Justin Hadley from North Carolina 
who had done the exact same thing: gone online to 
HealthCare.gov and created an account. But what he found 
populating his account was information from Mr. Dougall.
    He called HHS and could not get any assistance. Finally, 
they called our office, and, during one of the hearings, we 
were able to get that situation solved, or at least the 
beginning of that situation solved.
    Can you guarantee me that that situation is no longer 
occurring anywhere within HealthCare.gov?
    Ms. Bliss. I cannot guarantee that. We have overseen and 
conducted reviews of the controls to ensure that the website 
and other parts of the program for identity verification, no 
eligibility verification, are working properly. But we have 
raised concerns about some flaws or weaknesses in those 
controls, similar to GAO, and I cannot make that guarantee. But 
we are certainly working hard to identify where there is a 
vulnerability of that happening and make recommendations on how 
to improve it.
    Senator Scott. My last statement, since I am out of time so 
quickly here today, is, it appears that as we have celebrated 
the success of improving the system in the first couple 
months--I will note it was a new $1-trillion program--one of 
the recommendations is for clear leadership. Earth-shattering. 
Thank you.
    The Chairman. Senator Isakson?
    Senator Isakson. Thank you, Mr. Chairman.
    I apologize for missing your testimony, and I apologize for 
being late. But I do have one question based on a letter that I 
have sent previously to CMS, and I want to ask this question.
    Mr. Bagdoyan, do you agree that increasing the utilization 
of existing, tested data sources is one easy way that CMS could 
reach the mutual goal of expanding program integrity and 
management and better assess fraud risk?
    Mr. Bagdoyan. Yes. That is, in fact, one of our 
recommendations to CMS: to consider doing that on an active 
basis, both to capture the data and then analyze the data for 
whatever indicators that they may throw off and act upon those. 
Yes.
    Senator Isakson. Then do you have any idea when CMS is 
going to move forward to actually take advantage of that and do 
it?
    Mr. Bagdoyan. Well, as I stated before in response to 
several Senators' questions, CMS has accepted those 
recommendations. They are on record in writing as having done 
so. And as I said in my opening statement, it is now incumbent 
on the agency to take action on a timely basis. But as I said, 
it will take time to work through this. It is not an easy fix. 
It is not a short-term fix. It is not a one-and-done fix.
    Senator Isakson. Well, I apologize for being late, because 
obviously you covered it in your opening statement. But there 
is readily available data and companies that are already under 
contract to CMS that are available to provide information that 
could greatly enhance the integrity of the program and uproot 
fraud a lot easier, and I appreciate your testimony to that 
effect.
    Mr. Bagdoyan. Yes. The data are available, definitely.
    Senator Isakson. Thank you. Thank you, Mr. Chairman.
    The Chairman. Thank you. I want to thank our witnesses for 
appearing here today. The work that each of you does is very 
important, as far as we are concerned, you and your 
organizations. It is vitally important to this committee, and 
we are thankful for the quality product that both the HHS/OIG 
and GAO produce to assist us in our policymaking and oversight 
efforts.
    I also want to thank my colleagues for their participation 
in this important hearing. I think the hearing has been 
insightful. It has been enlightening. Unfortunately, I think 
this hearing further revealed that we are only now getting to 
the water level of the Obamacare iceberg, it seems to me.
    As premiums continue to skyrocket and insurance options 
become more and more limited, an increasing number of Americans 
are being hung out to dry. Over the past year, we had a 
reasonable amount of consensus on several of the unworkable and 
failed provisions of Obamacare, but for some reason, many still 
have their heads stuck in the sand hoping that things will 
finally start working out at some point.
    Now, I implore my Democratic colleagues to work with me and 
my Republican friends to repeal and replace the so-called 
Affordable Care Act before it is altogether too late. Insurance 
premiums and health-care costs continue to rise, and little is 
being done to stem the tide.
    It is high time to put partisan politicking and bickering 
aside and find workable bipartisan solutions. There is more we 
can do. There is more we, it seems to me, have to do. Honestly, 
I earnestly believe that we can do it. The American people 
deserve better than what they have right now and, more 
importantly, than what they are about to have in the next few 
years.
    So I encourage each of my colleagues to meet with me and 
find workable solutions, and I encourage both of you to keep 
doing the jobs that you are doing. They are very important to 
this committee and I think to our country at-large.
    I would ask that any written questions for the record be 
submitted by Thursday, March 31st of this year.
    With that, this hearing will be adjourned. Thank you for 
being here.
    [Whereupon, at 11:10 a.m., the hearing was concluded.]

                            A P P E N D I X

              Additional Material Submitted for the Record

                              ----------                              

 Prepared Statement of Seto J. Bagdoyan, Director of Audits, Forensic 
   Audits and Investigative Service, Government Accountability Office
    Chairman Hatch, Ranking Member Wyden, and members of the committee:

    I am pleased to be here today to discuss enrollment and 
verification controls for health-care coverage that individuals obtain 
through the Federal health-insurance exchange under the Patient 
Protection and Affordable Care Act (PPACA). The act expands the 
availability of subsidized health-care coverage, and it provides for 
the establishment of health-insurance exchanges, or marketplaces, to 
help consumers in comparing and selecting among insurance plans offered 
by participating private issuers of health-care coverage. Under PPACA, 
States may elect to operate their own health-care marketplaces, or may 
rely on the federally facilitated marketplace, or Health Insurance 
Marketplace (Marketplace).\1\ The Centers for Medicare and Medicaid 
Services (CMS), a unit of the Department of Health and Human Services 
(HHS), maintains the Federal Marketplace.
---------------------------------------------------------------------------
    \1\ Specifically, the act required, by January 1, 2014, the 
establishment of health-insurance marketplaces in all States. In States 
not electing to operate their own marketplaces, the Federal Government 
was required to operate a marketplace.

    To be eligible to enroll in a qualified health plan offered through 
a marketplace, an individual must be a U.S. citizen or national, or 
otherwise lawfully present in the United States; reside in the 
marketplace service area; and not be incarcerated (unless incarcerated 
while awaiting disposition of charges). Marketplaces, in turn, are 
required by law to verify application information to determine 
eligibility for enrollment and, if applicable, determine eligibility 
---------------------------------------------------------------------------
for income-based subsidies the act provides.

    PPACA provides subsidies to those eligible to purchase private 
health-insurance plans who meet certain income and other requirements. 
According to the Congressional Budget Office, the estimated cost of 
subsidies and related spending under the act is $880 billion for fiscal 
years 2016-2025. While subsidies under the act are not paid directly to 
enrollees, participants nevertheless benefit through reduced monthly 
premiums or lower costs due at time of service, such as copayments.\2\ 
Because subsidy costs hinge on eligibility for coverage, enrollment 
controls that help ensure only qualified applicants are approved for 
coverage with subsidies are a key factor in determining Federal 
expenditures under the act.
---------------------------------------------------------------------------
    \2\ Enrollees can pay lower monthly premiums by virtue of a tax 
credit the act provides.

    A central feature of the enrollment controls is the Federal ``data 
services hub'' (data hub), which, among other things, provides a 
vehicle to check applicant-provided information against a variety of 
data sources.\3\ Verification steps include validating an applicant's 
Social Security number, if one is provided; \4\ verifying citizenship, 
status as a national, or lawful presence by comparison with Social 
Security Administration (SSA) or Department of Homeland Security (DHS) 
records; and verifying household income and family size by comparison 
against tax-return data from the Internal Revenue Service (IRS), as 
well as data on Social Security benefits from SSA.
---------------------------------------------------------------------------
    \3\ In particular, PPACA requires that consumer-submitted 
information be verified, and that determinations of eligibility be 
made, through either an electronic verification system or another 
method approved by HHS. To implement this verification process, CMS 
developed the data hub, which acts as a portal for exchanging 
information between the Federal Marketplace, State-based marketplaces, 
and Medicaid agencies, among other entities, and CMS's external 
partners, including other Federal agencies. The Marketplace uses the 
data hub in an attempt to verify that applicant information necessary 
to support an eligibility determination is consistent with external 
data sources.
    \4\ A marketplace must require an applicant who has a Social 
Security number to provide the number. 42 U.S.C. Sec. 18081(b)(2) and 
45 CFR Sec. 155.310(a)(3)(i). However, having a Social Security number 
is not a condition of eligibility.

    If the eligibility information applicants provide to the Federal 
Marketplace cannot be verified through the external sources, such as 
SSA, IRS, and DHS, an ``inconsistency'' will result. In particular, an 
inconsistency can arise when the data hub query process yields no 
information; or when information is available through the data hub, but 
it does not match information the applicant has provided.\5\
---------------------------------------------------------------------------
    \5\ When an inconsistency is generated, the Marketplace is to 
proceed with determining other elements of eligibility using the 
attestations of the applicant, and ensure that subsidies are provided 
on behalf of the applicant, if he or she is qualified to receive them, 
while the inconsistency is being resolved. As part of this resolution 
process, the applicant is generally required to submit documentation to 
substantiate eligibility for the program. In the case of the Federal 
Marketplace, CMS uses a document-processing contractor, which reviews 
documentation applicants submit, by mail or online upload, to resolve 
inconsistencies. Inconsistencies are discussed more fully later in this 
testimony.

    My testimony today is based on a report we issued on February 23, 
2016, that examined eligibility and enrollment controls, and fraud 
risk, of the Federal Marketplace.\6\ It addresses:
---------------------------------------------------------------------------
    \6\ GAO, Patient Protection and Affordable Care Act: CMS Should Act 
to Strengthen Enrollment Controls and Manage Fraud Risk, GAO-16-29 
(Washington, DC: February 23, 2016). In addition, we have presented two 
other related testimonies prior to issuance of the report. See GAO, 
Patient Protection and Affordable Care Act: Preliminary Results of 
Undercover Testing of Enrollment Controls for Health Care Coverage and 
Consumer Subsidies Provided Under the Act, GAO-14-705T (Washington, DC: 
July 23, 2014); and GAO, Patient Protection and Affordable Care Act: 
Observations on 18 Undercover Tests of Enrollment Controls for Health-
Care Coverage and Consumer Subsidies Provided under the Act, GAO-15-
702T (Washington, DC: July 16, 2015).

    1.  The extent to which applicant information is verified through 
---------------------------------------------------------------------------
the data hub--the primary means for verifying eligibility; and

    2.  The extent to which the Federal Marketplace resolved 
inconsistencies that resulted from the data hub verification 
process.\7\
---------------------------------------------------------------------------
    \7\ In addition to findings presented in this testimony--and as 
described in detail in our July 2015 testimony, with additional 
information provided in our February 2016 report--our work also 
identified vulnerability to fraud, when we obtained, through covert 
vulnerability testing, Federal Marketplace approval of subsidized 
coverage for 11 of 12 fictitious applicants for 2014, with coverage 
continuing into 2015. We concluded CMS has assumed a passive approach 
to identifying and preventing fraud, and that adopting a more 
strategic, risk-based approach could help identify fraud 
vulnerabilities before they could be exploited in the enrollment 
process. We recommended that HHS direct CMS to conduct a fraud risk 
assessment, consistent with best practices provided in GAO's framework 
for managing fraud risks in Federal programs, of the potential for 
fraud in the process of applying for qualified health plans through the 
Federal Marketplace. HHS concurred with our recommendation and said it 
plans to conduct such an assessment. See the framework at GAO, A 
Framework for Managing Fraud Risks in Federal Programs, GAO-15-593SP 
(Washington, DC: July 2015).

    In our report, to examine outcomes of the data hub applicant 
verification process, we obtained summary data from key Federal 
agencies involved in the process--SSA, IRS, and DHS--on the nature and 
extent of their responses to electronic inquiries made through the data 
hub, for the 2014 and 2015 coverage years.\8\ We also interviewed 
agency officials and reviewed statutes, regulations, and other policy 
and related information. In addition, we obtained applicant data on 
inconsistencies, subsidies awarded, and submission of required 
verification documentation, from CMS data systems for coverage year 
2014. To determine the reliability of data we used, we interviewed CMS 
officials and others responsible for their respective data, reviewed 
relevant documentation, and performed electronic testing to determine 
the validity of specific data elements we used to perform our work. 
Based on this reliability examination, we concluded that the data we 
used were sufficiently reliable for our purposes.
---------------------------------------------------------------------------
    \8\ In this testimony, we use ``outcomes'' to mean results obtained 
from inquiries made through the data hub, and not any ultimate 
determination made whether an applicant inconsistency exists.

    Additional details on our scope and methodology can be found in our 
report. We conducted our performance audit from January 2014 to 
February 2016 in accordance with generally accepted government auditing 
standards.
 cms's approach to applicant verification information needs improvement
    HHS officials described the data hub process to us as being part of 
an innovative, multilayered approach to verifying applicant information 
efficiently and without undue burden on individuals and families. 
Through secure electronic connections, the data hub provides real-time 
responses to eligibility queries, HHS told us.

    In our February 2016 report, however, we found that although the 
data hub plays a key role in the eligibility and enrollment process, 
CMS officials said the agency does not track the extent to which the 
Federal agencies deliver responsive information to a request, or, 
alternatively, whether they report that information was not available. 
Additionally, CMS officials said they do not analyze data provided in 
response to data hub inquiries. This is because, they said, by design, 
the data hub does not store individual transactional data that could be 
collectively analyzed over time. For policy reasons, the officials 
said, the agency did not want the data hub to become a data repository 
itself, and in particular, a repository of sensitive personal data.\9\ 
The CMS officials also said the agency is barred legally from 
maintaining IRS taxpayer information in the data hub.
---------------------------------------------------------------------------
    \9\ In particular, according to CMS officials, the data hub does 
not read and store the content of requests received. It only validates 
message structure and determines routing information to send the 
request to the correct destination. The data hub next returns the 
response it receives to the requester. The data hub stores data such as 
transaction identifier for each request. By CMS requirements, the data 
hub cannot store privacy data, the officials said.

    Asked about analysis of data hub responses, CMS officials told us 
when we conducted work for our February 2016 report that the key 
performance measures for the data hub are the extent to which the 
system is available for queries, and the extent to which transmissions 
of queries and responses are successfully accomplished; that is, that 
an inquiry is made and a corresponding reply received, without regard 
to content.\10\
---------------------------------------------------------------------------
    \10\ According to CMS officials, the data hub only captures a code 
for type of reply that is generated when agencies respond to the 
inquiries, and those codes are not associated with any other applicant-
identifying information or information that may have been provided in 
response to the query. There are no additional data kept on what 
information might have been transmitted in the source agency's 
response, such as income or family size. Likewise, the data hub does 
not track whether information provided through the data hub matches 
information originally provided by the applicant, the officials said.

    Further, the Federal agencies responding to data hub queries 
generally told us they do not analyze outcomes of data hub inquiries. 
Instead, SSA, IRS, and DHS officials said they focus on responding to 
inquiries received. Our review also found that SSA, IRS, and DHS had 
limited information on the nature and extent of the inquiries made by 
the data hub. According to the three agencies, available statistics 
reflect data hub inquiries in general, and cannot be broken out by 
program, such as a qualified health plan or Medicaid. In addition, 
according to agency officials, an unknown number of data hub applicant 
inquiries were duplicates, which we could not eliminate from our 
examination.\11\ Instead, agency officials told us, they generally 
process inquiries sequentially as they are received from the data hub. 
Thus, we found that while the agencies can provide some information on 
data hub queries, they cannot provide comprehensive information 
specifically on number of inquiries and individuals represented by 
those queries.
---------------------------------------------------------------------------
    \11\ The agencies could not comprehensively identify the number of 
duplicates.

    We further found, based on our examination of available statistics 
from SSA, IRS, and DHS, that while the agencies could successfully 
provide applicant verification information in a large percentage of 
cases, they did not have data in their records to verify information 
for millions of data hub inquiries over the course of PPACA's first two 
enrollment cycles, for 2014 and 2015 coverage.\12\
---------------------------------------------------------------------------
    \12\ For example, SSA accomplished a match on name, Social Security 
number, and date of birth in about 95 percent of cases for PPACA's 
first enrollment cycle, for 2014 coverage. However, for about 4.4 
million inquiries--or about 5 percent of the total--the applicant 
information did not match SSA records. In addition, after completion of 
the name, Social Security number, and date of birth match, when SSA 
attempted to verify additional information, the agency could not 
confirm citizenship in about 8.2 million inquiries where individuals 
claimed they were citizens.

    We concluded that by not assessing the extent to which data hub--
provided data matches applicant-provided information, CMS foregoes 
analysis of the extent to which responding agencies successfully 
deliver applicant verification information in response to data hub 
requests. In doing so, CMS foregoes information that could suggest 
potential program issues or potential vulnerabilities to fraud, as well 
as information that might be useful for enhancing program 
management.\13\ We recommended that HHS direct CMS to conduct a 
comprehensive feasibility study on actions CMS can take to monitor and 
analyze, both quantitatively and qualitatively, the extent to which 
data hub queries provide requested or relevant applicant verification 
information, for the purpose of improving the data-matching process and 
reducing the number of applicant inconsistencies; and for those actions 
identified as feasible, create a written plan and schedule for 
implementing them. HHS said it concurred with our recommendation and is 
reviewing options for such a study.
---------------------------------------------------------------------------
    \13\ By analyzing the outcomes of data hub inquiries, and in 
particular, clarifying the nature and extent of inconsistencies arising 
from this process, CMS could, for example, assess whether other sources 
of data, such as the National Directory of New Hires, could be useful 
for more current applicant information on income. Similarly, CMS could 
analyze the information to examine whether other sources of citizenship 
information, such as the Department of State's passport data, could be 
used to aid in verifying applicant citizenship. There may also be 
correlations observed between various types of applicants and types of 
information available from trusted data sources.
---------------------------------------------------------------------------
 the federal marketplace did not resolve about one-third of applicant 
   inconsistencies for coverage year 2014, involving $1.7 billion in 
                          associated subsidies
    For qualifying applicants, the act provides two forms of subsidies 
for consumers enrolling in individual health plans, both of which are 
paid directly to insurers on consumers' behalf. One is a Federal income 
tax credit, which enrollees may elect to receive in advance of filing 
tax returns, and which reduces a consumer's monthly premium payment. 
This is known as the advance premium tax credit (APTC).\14\ The other, 
known as cost-sharing reduction (CSR), is a discount that lowers the 
amount consumers pay for out-of-pocket charges such as deductibles, 
coinsurance, and copayments.
---------------------------------------------------------------------------
    \14\ When applicants apply for coverage, they report family size 
and the amount of projected income. Based, in part, on that 
information, the Marketplace will calculate the maximum allowable 
amount of APTC. An applicant can then decide if he or she wants all, 
some, or none of the estimated credit paid in advance, in the form of 
payment to the applicant's insurer that reduces the applicant's monthly 
premium payment. If an applicant chooses to have all or some of his or 
her credit paid in advance, the applicant is required to ``reconcile'' 
on his or her Federal tax return the amount of advance payments the 
government sent to the applicant's insurer on the applicant's behalf 
with the tax credit for which the applicant qualifies based on actual 
reported income and family size.

    In our report, for applicants who obtained subsidies but had 
application inconsistencies, we identified about 1.1 million 
applications with a total of about 2 million inconsistencies.\15\ These 
applications had combined APTC and CSR subsidies of about $4.4 billion 
associated with them for coverage year 2014. We found, based on our 
analysis of CMS data, that the agency resolved about 58 percent of the 
total inconsistencies, meaning the inconsistencies were settled by 
consumer action, such as document submission, or removed due to events 
such as life change, application deletion, or consumer cancellation. 
Meanwhile, our analysis found that about 34 percent of inconsistencies, 
with about $1.7 billion in associated subsidies, remained open, as of 
April 2015--that is, inconsistencies still open several months 
following the close of the 2014 coverage year.\16\
---------------------------------------------------------------------------
    \15\ In particular, we obtained data from CMS on applicant 
inconsistencies generated for the Federal Marketplace and the value of 
APTC and CSR subsidies associated with them, for the 2014 coverage 
year. Specifically, to observe the number of inconsistencies created 
and subsequently resolved, we examined applications that were awarded 
subsidies and that were created and submitted during the 2014 open-
enrollment period plus a special enrollment period extension that 
followed. The open-enrollment period ran from October 1, 2013, to March 
31, 2014, and the extension was through April 19, 2014.
    We excluded from our analysis applications modified after 
submission, because CMS officials told us that inconsistencies can be 
generated or resolved based on consumer actions, such as updating of 
application information. We selected the unmodified applications that 
had received subsidies as presenting the simplest case for examining 
inconsistency generation and subsequent resolution.
    Our selection criteria meant excluding 17 percent of the total 
number of applications with subsidies and inconsistencies because they 
had been modified. A single application may reflect more than one 
person, each of whom might have different inconsistencies in different 
stages of resolution. The CMS data provided the APTC and CSR amounts at 
the application level. Consequently, the results of our analysis are 
not mutually exclusive by type of inconsistency, and applications and 
their associated subsidy amounts may be represented in multiple 
categories.
    \16\ The remainder were terminations or adjustments based on 
failure to submit documentation to resolve inconsistencies. By 
comparison with the inconsistency results in our analysis, HHS reported 
that more than 8.84 million people selected or were automatically 
reenrolled in 2015 plans through the Federal Marketplace as of the end 
of the second open enrollment period on February 15, 2015.

    We also found, based on our analysis of the 2014 data, that CMS did 
not terminate or adjust subsides for any applications with 
incarceration or Social Security number inconsistencies, plus other 
inconsistencies.\17\ Further, CMS officials told us that they currently 
do not plan to take any actions on individuals with unresolved Social 
Security number or incarceration inconsistencies.
---------------------------------------------------------------------------
    \17\ These other inconsistencies relate to American Indian status, 
and presence of qualifying 
employer-sponsored coverage or other minimum essential coverage.

    Social Security number inconsistencies. Under CMS regulations, the 
Marketplace must validate all Social Security numbers provided by 
submitting them to SSA along with other identifying information. If the 
Marketplace is unable to validate the Social Security number, it must 
follow the standard process for resolving all types of 
inconsistencies.\18\ In our analysis, we identified about 35,000 
applications that had an unresolved Social Security number 
inconsistency, which were associated with about $154 million in 
combined subsidies.
---------------------------------------------------------------------------
    \18\ 45 CFR Sec. 155.315(b).

    We reported that CMS officials told us they did not take action to 
terminate coverage or adjust subsidies during 2014 based on Social 
Security number inconsistencies. They said this was because such 
inconsistencies are generally related to other inconsistencies, such as 
citizenship or immigration status, and that document submissions for 
citizenship or immigration status may also resolve Social Security 
number inconsistencies. Overall, CMS officials told us they do not 
consider missing or invalid Social Security number information to be a 
stand-alone inconsistency that must be resolved, and do not take 
---------------------------------------------------------------------------
adverse action in such cases.

    However, CMS regulations state that ``to the extent that the 
[Marketplace] is unable to validate an individual's Social Security 
number through the Social Security Administration,'' the Marketplace 
must follow its standard inconsistency procedures.\19\ Further, when 
promulgating this regulation, CMS explained that transmitting Social 
Security numbers to SSA for validation ``is separate from the [PPACA] 
provision regarding citizenship verification, and only serves to ensure 
that SSNs [Social Security numbers] provided to the [Marketplace] can 
be used for subsequent transactions, including for verification of 
family size and household income with IRS.'' \20\
---------------------------------------------------------------------------
    \19\ 45 CFR Sec. 155.315(b).
    \20\ 77 Fed. Reg. 18310, 18355 (March 27, 2012).

    In addition to unresolved Social Security number inconsistencies 
generally, our analysis also found in particular more than 2,000 
applications with Social Security number inconsistencies that had no 
corresponding citizenship or immigration inconsistencies. We also 
identified nearly 5,500 applications with Social Security number 
inconsistencies that had no corresponding income inconsistency. These 
applications had total subsidies of about $10 million and $31 million 
associated with them, respectively. They indicate that Social Security 
number inconsistencies can stand alone, unrelated to other 
---------------------------------------------------------------------------
inconsistencies.

    Social Security number inconsistencies also affect tax compliance. 
Missing or invalid Social Security numbers can affect IRS verification 
that taxpayers have properly filed APTC information on their tax 
returns, as well as impair IRS outreach to taxpayers who have received 
the APTC subsidy.\21\
---------------------------------------------------------------------------
    \21\ See GAO-16-29 for a full discussion.

    We recommended that HHS direct CMS to identify and implement 
procedures to resolve Social Security number inconsistencies where the 
Marketplace is unable to verify Social Security numbers or applicants 
do not provide them. HHS concurred with our recommendation, but did not 
---------------------------------------------------------------------------
provide details on how it would seek to implement it.

    Incarceration inconsistencies. In our inconsistency analysis that 
we reported on in February 2016, we identified about 22,000 
applications having an unresolved incarceration inconsistency, which 
were associated with about $68 million in combined subsidies. CMS 
officials, however, told us they did not terminate eligibility for 
incarceration inconsistencies, because the agency determined in fall 
2014 that SSA's Prisoner Update Processing System (PUPS) was unreliable 
for use by the Marketplace.\22\ As a result, CMS officials told us the 
agency elected to rely on applicant attestations on incarceration 
status.\23\
---------------------------------------------------------------------------
    \22\ The PUPS system contains information on incarcerated 
individuals in all 50 State corrections departments, the Federal Bureau 
of Prisons, and local and other facilities. According to SSA, it is the 
only national database with records of Federal, State, and local 
incarcerations. SSA uses PUPS to identify individuals who may no longer 
be eligible for SSA benefits due to incarceration. In addition to SSA, 
other Federal programs, such as Medicare, use PUPS data.
    \23\ In the absence of an approved data source, the Marketplace may 
accept applicant attestation on incarceration status without further 
verification, unless the attestation is not reasonably compatible with 
other information in its records. 45 CFR Sec. 155.315(e).

    PPACA provides that incarcerated individuals are not eligible to 
enroll in a qualified health plan through a marketplace, with the 
exception of those incarcerated pending disposition of charges. CMS 
currently uses PUPS to generate incarceration inconsistencies when 
there are indications an applicant may be incarcerated. As part of the 
inconsistency resolution process, the Marketplace notifies applicants 
to send documentation to resolve the inconsistency. To do so, consumers 
---------------------------------------------------------------------------
can submit documentation such as release papers, CMS officials told us.

    Under CMS's approach to incarceration inconsistencies, agency 
officials told us, the Marketplace continues to make an initial 
verification attempt using the PUPS data. If a consumer maintains he or 
she is not incarcerated, CMS will rely on that representation and not 
take adverse action, regardless of what PUPS indicates, officials told 
us. According to HHS officials, based on the data reliability issue, 
the Marketplace no longer requires applicants to submit documentation 
on incarceration status.

    In its 2013 computer-matching agreement with CMS, SSA acknowledged 
that PUPS is not as accurate as other SSA data and contains information 
that SSA may not have independently verified. Thus, the agreement 
states that CMS will independently verify information it receives from 
PUPS and will provide individuals an opportunity to contest an 
incarceration inconsistency before any adverse action in an eligibility 
determination. Overall, according to SSA officials, PUPS information 
can be used to identify individuals who require additional follow-up to 
determine eligibility.

    We reported that our review of documentation CMS provided for its 
decision to take no adverse action on incarceration inconsistencies 
showed it did not contain key information supporting the agency's 
decision to not use PUPS data. Specifically, the documentation did not 
provide specific details on why, or to what extent, people were 
misidentified as incarcerated; why CMS also judged inmate release 
information to be unreliable; any criteria or assessment employed to 
conclude that the PUPS data were not sufficiently current or accurate; 
or the potential cost associated with not verifying incarceration 
status.

    We concluded that without clearly identifying such elements as 
analysis, scope, and costs of significant decisions, CMS is at greater 
risk of providing benefits to ineligible applicants, and also may 
undermine confidence in the applicant verification process and 
compromise overall program integrity. We further concluded that by not 
using PUPS data as a lead for further investigation, and by relying on 
applicant attestation in the alternative, CMS may be granting 
eligibility to, and making subsidy payments on behalf of, individuals 
who are ineligible to enroll in qualified health plans.

    We recommended that HHS direct CMS to reevaluate use of PUPS 
incarceration data and make a determination to either (1) use the PUPS 
data, among other things, as an indicator of further research required 
in individual cases, and to develop an effective process to clear 
incarceration inconsistencies or terminate coverage; or (2) if no 
suitable process can be identified to verify incarceration status, 
accept applicant attestation on status in all cases, unless the 
attestation is not reasonably compatible with other information that 
may indicate incarceration, and forego the inconsistency process. HHS 
concurred with our recommendation, but did not provide details on how 
it would seek to implement it.

    We also recommended that HHS direct CMS to fully document prior to 
implementation, and have readily available for inspection thereafter, 
any significant decision on qualified health plan enrollment and 
eligibility matters, with such documentation to include details such as 
policy objectives, supporting analysis, scope, and expected costs and 
effects. HHS concurred with our recommendation, and said it was 
committed to documenting significant decisions.\24\
---------------------------------------------------------------------------
    \24\ In all, our February 2016 report contained eight 
recommendations to HHS, and the agency concurred with all of them. See 
GAO-16-29 for the complete list of recommendations, as well as HHS 
agency comments and our evaluation of them.

    Chairman Hatch, Ranking Member Wyden, and members of the committee, 
this completes my prepared statement. I would be pleased to respond to 
---------------------------------------------------------------------------
any questions that you may have at this time.

                                 ______
                                 
         Questions Submitted for the Record to Seto J. Bagdoyan
               Questions Submitted by Hon. Chuck Grassley
    I would like the record to show that I was unable to attend this 
hearing in person. As Chairman of the Senate Judiciary Committee, I was 
overseeing the debate about the Supreme Court vacancy. The two hearings 
were at the same time.

    It was pretty disturbing to hear the report of your undercover 
testing of the Federal Marketplace last year.

    Eleven of 12--that's over 90%--of fictitious GAO phone or online 
applicants were able to obtain a total of $30,000 in Obamacare 
subsidies and were able to maintain coverage throughout 2014. People 
signed up and received subsidies and coverage in some cases without any 
documentation.

    And as shocking as that is, today's report is even worse. You 
reveal vulnerabilities at the data hub of HealthCare.gov that could 
cost taxpayers billions of dollars.

    Question. Your report found that CMS does not track the responses 
to inquiries made of Federal agencies at the data hub. If CMS does not 
track or analyze this information, how can eligibility for Obamacare 
and subsidies be verified, as required by law?

    Answer. In accordance with our audit objectives, our work focused 
on macro-
analysis of data hub query outcomes, and did not address the process of 
making eligibility determinations for individual applications.

    Thus, in our February 2016 report, we found that although the data 
hub plays a key role in the eligibility and enrollment process, Centers 
for Medicare and Medicaid Services (CMS) officials said the agency does 
not track the extent to which the Federal agencies deliver responsive 
information to a request, or, alternatively, whether they report that 
information was not available. Additionally, CMS officials said they do 
not analyze data provided in response to data hub inquiries.\1\
---------------------------------------------------------------------------
    \1\ See GAO, Patient Protection and Affordable Care Act: CMS Should 
Act to Strengthen Enrollment Controls and Manage Fraud Risk, GAO-16-29 
(Washington, DC: February 23, 2016). A central feature of enrollment 
controls under the Patient Protection and Affordable Care Act (PPACA) 
is the Federal ``data services hub'' (data hub), which, among other 
things, provides a vehicle to check applicant-provided information 
against a variety of data sources. In particular, the act requires that 
consumer-submitted information be verified, and that determinations of 
eligibility be made, through either an electronic verification system 
or another method approved by the Department of Health and Human 
Services (HHS). To implement this verification process, CMS developed 
the data hub, which acts as a portal for exchanging information between 
the Federal Health Insurance Marketplace, State-based marketplaces, and 
Medicaid agencies, among other entities, and CMS's external partners, 
including other federal agencies.

    By analyzing the outcomes of data hub inquiries and, in particular, 
clarifying the nature and extent of inconsistencies arising from this 
process, CMS could, for example, assess whether other sources of data 
could be useful to provide more current information on applicant 
income.\2\ There may also be correlations observed between various 
types of applicants and types of information available from data 
sources.
---------------------------------------------------------------------------
    \2\ An ``inconsistency'' arises when an applicant's information 
does not match information from marketplace data sources.

    We concluded that by not assessing the extent to which data 
provided through the data hub matches applicant-provided information, 
CMS foregoes analysis of the extent to which responding agencies 
successfully deliver applicant verification information in response to 
data hub requests. Without such an analysis, CMS foregoes information 
that could suggest potential program issues or potential 
vulnerabilities to fraud, as well as information that might be useful 
---------------------------------------------------------------------------
for enhancing program management.

    Question. Monitoring activities are an important part of fraud 
prevention. What does CMS need to do in order to implement effective 
monitoring activities?

    Answer. In our February 2016 report, we recommended that CMS should 
conduct a comprehensive feasibility study on actions it can take to 
monitor and analyze, both quantitatively and qualitatively, the extent 
to which data hub queries provide requested or relevant applicant 
verification information, for the purpose of improving the data-
matching process and reducing the number of applicant inconsistencies; 
and for those actions identified as feasible, create a written plan and 
schedule for implementing them. The Department of Health and Human 
Services (HHS), CMS's parent agency, concurred with our recommendation.

    Question. Rather than track the amounts of the subsidies, CMS 
compiles the number of individuals or households affected when a 
subsidy is terminated for incomplete information. These changes to 
these subsidies have a cost to taxpayers. Federal internal control 
standards state that managers need financial information to make 
operating decisions, among other activities. How can CMS improve in 
this area in order to be a better steward of the taxpayers' dollars?

    Answer. In our February 2016 report, we recommended that CMS track 
the value of advance premium tax credit and cost-sharing reduction 
subsidies that are terminated or adjusted for failure to resolve 
application inconsistencies, and use this information to inform 
assessments of program risk and performance.\3\ HHS concurred with our 
recommendation.
---------------------------------------------------------------------------
    \3\ For qualifying applicants, PPACA provides two possible forms of 
subsidies for consumers enrolling in individual health plans, both of 
which are paid directly to insurers on consumers' behalf. One is a 
Federal income tax credit, which enrollees may elect to receive in 
advance, and which reduces a consumer's monthly premium payment. This 
subsidy is known as the advance premium tax credit. The other, known as 
cost-sharing reduction, is a discount that lowers the amount consumers 
pay for out-of-pocket charges for deductibles, coinsurance, and 
copayments.

    Question. In your testimony, you explained that GAO had used a 
``secret shopper'' technique to explore possible vulnerabilities to 
---------------------------------------------------------------------------
fraud within HealthCare.gov.

    Is this technique a well-accepted tool for government and private 
auditors to use?

    Answer. We have not examined the prevalence of covert testing in 
other settings, but GAO has conducted undercover work, including the 
use of fictitious applicants, to test controls in other Federal 
programs, in addition to health-care coverage provided under the 
Patient Protection and Affordable Care Act. GAO has received requests 
for undercover work from chairs or ranking members of a number of 
congressional committees and subcommittees.

    Question. How do you interpret your findings of this particular 
``secret shopper'' activity?

    Answer. Through covert vulnerability testing, we obtained Federal 
Health Insurance Marketplace (Marketplace) approval of subsidized 
coverage for 11 of 12 fictitious applicants for 2014, with coverage 
continuing into 2015. These results, while not generalizable, 
nevertheless illustrate that the Marketplace enrollment process is 
vulnerable to fraud. Further, for a second round of testing--for 2015 
coverage, and which also included two State marketplaces in addition to 
the Federal Marketplace--we obtained subsidized marketplace coverage 
for fictitious applicants in 10 of 10 instances.\4\
---------------------------------------------------------------------------
    \4\ See GAO, Patient Protection and Affordable Care Act: 
Preliminary Results of Undercover Testing of the Federal Marketplace 
and Selected State Marketplaces for Coverage Year 2015, GAO-16-159T 
(Washington, DC: October 23, 2015). In addition to our 10 applications 
for subsidized private health plans, we also made eight additional 
fictitious applications for Medicaid coverage, in order to test the 
ability to apply for that program through the marketplaces. In these 
tests, we were approved for subsidized health-care coverage for seven 
of the eight applications. For three of the eight applications, we were 
approved for Medicaid, as originally sought. For four of the eight 
applications, we did not obtain Medicaid approval, but instead were 
subsequently approved for subsidized qualified health-plan coverage. 
Thus, for the second round of testing overall, we obtained coverage for 
17 of 18 applicants.

    Question. In your professional opinion, are the findings of this 
---------------------------------------------------------------------------
``secret shopper'' activity concerning?

    Answer. As noted above, our results illustrate that the Marketplace 
enrollment process is vulnerable to fraud. A program of this scope and 
scale is inherently at risk for errors, including improper payments and 
fraud. Accordingly, it is essential that effective enrollment controls 
are in place to help narrow the window of opportunity for such risk and 
safeguard the government's investment. Based on our testing and related 
work, we concluded that CMS has assumed a passive approach to 
identifying and preventing eligibility and enrollment fraud. In 
February 2016, we recommended that CMS conduct a fraud risk assessment, 
consistent with best practices provided in GAO's framework for managing 
fraud risks in Federal programs, of the potential for fraud in the 
process of applying for qualified health plans through the Federal 
Marketplace.\5\ HHS concurred with our recommendation.
---------------------------------------------------------------------------
    \5\ See GAO, A Framework for Managing Fraud Risks in Federal 
Programs, GAO-15-593SP (Washington, DC: July 2015).

                                 ______
                                 
                Questions Submitted by Hon. Rob Portman
    Question. I am extremely concerned that a large number of enrollees 
in Ohio and across the country may be receiving coverage when they are 
not legally eligible to do so, because they have already been offered 
coverage through their employers. Many are unaware that they will owe 
enormous tax bills at the end of the year, all because HHS lacks the 
ability to verify whether an applicant has actually been offered 
coverage and is providing subsidies when they should not.

    That is why I introduced S. 1996, the Commonsense Reporting Act. 
This would allow employers to prospectively report to the IRS before 
the open enrollment period opens whether they are offering coverage to 
their employees. The government would definitively have this 
information well before enrollment begins--today, they only receive 
this information after employees may already be enrolled in coverage 
and receiving subsidies, meaning the IRS will have to claw back the 
money.

    Do you believe it would help make subsidy approval more accurate if 
IRS and HHS had this type of information prior to open enrollment 
beginning?

    Why has HHS been unable to help tax payers avoid these repayment 
penalties?

    Do you believe it would lower the instances of employees who are 
offered coverage from being hit with surprise tax bills because they 
were not eligible for the subsidies they received?

    Answer. We did not report on the availability of employer-sponsored 
insurance at time of enrollment, and thus we cannot offer any 
observations.

    Question. Your report also identifies that CMS is not tracking the 
extent to which agencies respond to individual's inaccuracies. Can you 
explain how this information could potentially be used by CMS, if they 
were to track it?

    Answer. Please see the answer to Senator Grassley's first question. 
As discussed there, by not tracking outcomes of data hub queries, CMS 
foregoes information that could suggest potential program issues or 
potential vulnerabilities to fraud, as well as information that might 
be useful for enhancing program management.

    Question. Wouldn't a better system provide timely updated 
information about the availability of employer-sponsored insurance at 
the time of enrollment?

    Answer. We did not report on the availability of employer-sponsored 
insurance at time of enrollment, and thus we cannot offer any 
observations.

                                 ______
                                 
                Questions Submitted by Hon. Dean Heller
    Question. As of March 2016, there were 88,145 Nevadans on the 
Exchange, but only 76,821 of these enrollees have selected a plan.

    How can CMS count consumers as ``enrollees'' if they have not 
``enrolled'' in a plan?

    What barriers exist that would have prevented nearly 12,000 
Nevadans from selecting a plan?

    Answer. According to the HHS Office of the Assistant Secretary for 
Planning and Evaluation (ASPE), Nevada activity for the 2016 open 
enrollment period (November 1, 2015 to February 1, 2016), as of March 
2016, was as follows:

------------------------------------------------------------------------
                    STAGE OF APPLICATION                        NUMBER
------------------------------------------------------------------------
A. Total completed applications                                  93,255
B. Total individuals applying for coverage in completed         134,454
 applications
C. Total individuals eligible to enroll in a marketplace        107,525
 plan
D. Number of individuals eligible to enroll in a marketplace     89,716
 plan with financial assistance
E. Number of individuals who selected a marketplace plan         88,145
F. Number of individuals with 2016 marketplace plan              76,821
 selections with advance premium tax credit
------------------------------------------------------------------------
Notes: For items A-E, for complete details, including explanatory notes
  on the figures shown, see Department of Health and Human Services,
  Office of the Assistant Secretary for Planning and Evaluation,
  ``Addendum to the Health Insurance Marketplaces 2016 Open Enrollment
  Period: Final Enrollment Report,'' ASPE Issue Brief (March 11, 2016).
  For item F, for complete details and explanatory note, see Department
  of Health and Human Services, Office of the Assistant Secretary for
  Planning and Evaluation, ``Health Insurance Marketplaces 2016 Open
  Enrollment Period: Final Enrollment Report,'' ASPE Issue Brief (March
  11, 2016).

                                 ______
                                 
              Question Submitted by Hon. Michael F. Bennet
    Question. The investigation concludes that no cases of real world 
fraud were found. Did GAO take measures to identify cases of actual 
fraud in the scope of the overall investigation?

    Answer. As we said in our March 17, 2016 testimony, the purpose of 
our work was to seek to identify eligibility and enrollment control 
vulnerabilities, and not to attempt to identify actual cases of fraud. 
As noted above, our covert vulnerability testing demonstrated that the 
Marketplace enrollment process is vulnerable to fraud, as 11 of 12 
applicants in our tests obtained coverage through fraudulent means.

                                 ______
                                 
               Questions Submitted by Hon. Sherrod Brown
    Question. CMS is responsible for working in collaboration with 
public and private entities--including other Federal agencies, State 
Medicaid agencies, private contractors, health insurance issuers, and 
not-for-profit organizations--to manage the Affordable Care Act (ACA) 
marketplace.

    As part of its responsibilities, CMS must ensure accurate 
eligibility determinations, process enrollments, facilitate Medicaid 
enrollment for those who qualify, and communicate timely and accurate 
information to issuers and consumers.

    CMS also provides support functions for the State marketplaces and 
administers Federal financial assistance and premium stabilization 
programs related to the marketplaces.

    The GAO report discusses some inconsistencies that have come up as 
CMS has balanced these priorities during a period of time where 
Republicans were doing everything they could to sabotage the law's 
implementation. But the GAO report fails to acknowledge two things:

        These inconsistencies are not indicative of any 
widespread fraud by real-world enrollees, and

        The significant work CMS has undertaken to resolve 
inconsistencies by either eliminating coverage or adjusting an 
individual's advance premium tax credit.

    Isn't it true that, in order to correct these inconsistencies, 
during the first nine months of 2015, CMS ended the enrollments of 
approximately 471,000 individuals because they failed to properly 
verify their identities?

    Isn't it also true that CMS has adjusted the tax credits of 
approximately 1,153,000 households whose incomes could not be properly 
verified?

    Answer. We cannot comment on these figures, as CMS provided us with 
statistics covering a different period, which we included in our 
February 2016 report. Specifically, according to CMS officials, from 
April through June of 2015, enrollment in coverage through the Federal 
Marketplace was terminated for about 306,000 consumers with citizenship 
or immigration status data-matching issues who failed to produce 
sufficient documentation. In addition, according to the officials, 
about 735,000 households with income inconsistencies had their advance 
premium tax credit or cost-sharing reduction subsidies adjusted for 
coverage year 2015.

    In February 2016, we also reported on results of a GAO analysis of 
application inconsistencies and subsequent resolutions for the 2014 
coverage year. We found that for a group of about 1.1 million 
applications with a total of about 2 million inconsistencies, about 34 
percent of the inconsistencies, with about $1.7 billion in associated 
subsidies, remained open as of April 2015--that is, still open several 
months following the close of the 2014 coverage year.

    Otherwise, as noted above, the objectives of our work were to test 
enrollment controls and identify vulnerabilities, if any, and not to 
determine the extent of fraud perpetrated by actual enrollees.

    Question. Has the GAO elsewhere acknowledged the work CMS did to 
correct these inconsistencies?

    Answer. Yes, our February 2016 report (p. 34) reflects CMS's 
actions on terminations and adjustments. Also in that report (beginning 
at pp. 17 and 45), as noted above, we presented results of an analysis 
of application inconsistencies, including by type of inconsistency 
(such as income or citizenship/immigration status) and resolution. 
Terminations of policies and adjustments of subsidies were among 
resolutions we reported.

                                 ______
                                 
   Prepared Statement of Erin Bliss, Assistant Inspector General for 
Evaluation and Inspections, Office of Inspector General, Department of 
                       Health and Human Services
healthcare.gov: case study of cms management of the federal marketplace
    Good morning, Chairman Hatch, Ranking Member Wyden, and other 
distinguished Members of the Committee. I am Erin Bliss, Assistant 
Inspector General for Evaluation and Inspections in the Office of 
Inspector General (OIG), U.S. Department of Health and Human Services 
(HHS or the Department). Thank you for the opportunity to testify about 
OIG's case study reviewing the management of the Federal Marketplace 
website HealthCare.gov by the Centers for Medicare and Medicaid 
Services (CMS).

    OIG's mission is to protect the integrity of HHS programs and the 
health and welfare of the people they serve. We advance our mission 
through a nationwide network of audits, evaluations, investigations, 
enforcement actions, and compliance efforts. OIG has identified 
oversight and operation of the Health Insurance Marketplaces as a Top 
Management Challenge for HHS.

    The case study is an important component of our marketplace 
oversight strategy. It primarily examines implementation of 
HealthCare.gov, the consumer-facing website for the Federal 
Marketplace, by CMS from passage of the Patient Protection and 
Affordable Care Act (ACA) in 2010 through the second open enrollment 
period in 2015. As required by the ACA, HealthCare.gov is the Federal 
website that facilitates purchase of private health insurance for 
consumers who reside in States that did not establish health insurance 
marketplaces. At its highly publicized launch on October 1, 2013, and 
for some time after, HealthCare.gov users experienced substantial 
website outages and technical malfunctions. After corrective action by 
CMS and contractors following the launch, CMS ended the first open 
enrollment period with 5.4 million individuals having selected a plan 
through the Federal Marketplace.
            oig's strategy for oversight of the marketplaces
    OIG has completed and planned a significant body of audits and 
evaluations regarding the Federal Marketplace and other ACA provisions 
of high interest and concern to the Department, Congress, and other 
stakeholders. OIG's marketplace oversight strategy focuses on four 
areas that we have determined to be most critical: payment, 
eligibility, management and administration, and security.

    My testimony focuses on the OIG report ``HealthCare.gov: Case Study 
of CMS Management of the Federal Marketplace'' (OEI-06-14-00350) 
released on February 23, 2016. The case study report evaluates CMS's 
implementation and management of HealthCare.gov. Consistent with the 
OIG's statutory purpose to promote economy, efficiency, and 
effectiveness in the administration of Departmental programs, the 
rollout of HealthCare.gov presented a unique opportunity to assess 
CMS's management and operations. The implementation of HealthCare.gov 
provides lessons that will be increasingly important as the success of 
Government programs becomes more dependent on the effective 
intersection of policy, technology, and management. The case study 
enabled OIG to draw conclusions about factors that contributed to the 
website's breakdown and subsequent improvement, and lessons learned to 
promote effective Government operations moving forward.

    In summary, our case study report provides three takeaways about 
the development and implementation of HealthCare.gov, presented in 
chronological order over a 5-year period from passage of the ACA 
through the Marketplace's second open enrollment period:

        Development and Launch: The poor launch of the website was 
        caused by many avoidable organizational missteps, in addition 
        to problems with website technology;

        Correction Through Second Open Enrollment Period: After the 
        breakdown, CMS improved processes and worked with contractors 
        and others to fix the website, and this approach led to broader 
        organizational changes focused on leadership, decisionmaking, 
        and communication; and

        Call for Continued Progress: Challenges remain in managing the 
        Federal Marketplace and improving operations and services 
        provided by HealthCare.gov, including issues identified in 
        related OIG reports. CMS must continue applying lessons learned 
        from HealthCare.gov to complete this work and address new 
        challenges as they arise.
        background on the federal marketplace and healthcare.gov
    The ACA was signed into law on March 23, 2010, and amended on March 
30, 2010.\1\ The ACA required the establishment of a health insurance 
exchange (marketplace) in each State that would be operational on or 
before January 1, 2014.\2\ For States that elected not to establish 
their own marketplaces, the Federal Government was required to operate 
a marketplace on behalf of the State.\3\
---------------------------------------------------------------------------
    \1\ Pub. L. No. 111-148 (March 23, 2010), as amended by the Health 
Care and Education Reconciliation Act of 2010, Pub. L. No. 111-152 
(March 30, 2010), collectively referred to as the Affordable Care Act 
(ACA).
    \2\ Ibid. Sec. 1311(a), (b).
    \3\ Ibid. Sec. 1321(c).

    The marketplaces provide those seeking health insurance a single 
point of access to view qualified health plan (health plan) \4\ 
options, determine eligibility for coverage, and purchase insurance 
coverage. Individuals also use the marketplaces to determine 
eligibility for insurance affordability programs (e.g., Medicaid, 
premium tax credits, and cost-sharing reductions) that lower insurance 
premiums and costs of care.\5\ At the beginning of the third open 
enrollment period, November 1, 2015, the Federal Government operated a 
marketplace (the Federal Marketplace) for 38 States, including 7 State-
partnership marketplaces for which HHS and the State share 
responsibilities for core functions and 4 federally supported State 
marketplaces in which States perform most marketplace functions.\6\ 
Thirteen States (including the District of Columbia) operated their own 
State marketplaces.\7\
---------------------------------------------------------------------------
    \4\ Private health insurance plans certified as meeting certain 
standards and covering a core set of benefits including doctor visits, 
preventive care, hospitalization, and prescriptions.
    \5\ ACA Sec. Sec. 1401, 1402.
    \6\  The Henry J. Kaiser Family Foundation, State Decisions on 
Health Insurance Marketplaces and the Medicaid Expansion, December 17, 
2015. Accessed at http://kff.org/health-reform/state-indicator/state-
decisions-for-creating-health-insurance-exchanges-and-expanding-
medicaid/ on January 6, 2016. CMS, Hawaii: For 2016 insurance coverage, 
use HealthCare.gov to apply and enroll. Accessed at https://
www.healthcare.gov/hawaii-2016/ on January 6, 2016.
    \7\ Ibid.

    CMS has had responsibility for managing the marketplace programs 
since January 2011.\8\ To implement the ACA provisions related to the 
marketplaces, CMS has worked in collaboration with public and private 
entities, including other Federal agencies as required by the ACA,\9\ 
State Medicaid agencies, private contractors, health insurance issuers 
(issuers), and not-for-profit organizations. As it continues to operate 
the Federal Marketplace, CMS must ensure accurate eligibility 
determinations, process enrollments, facilitate Medicaid enrollment for 
those who qualify, and communicate timely and accurate information to 
issuers and consumers. CMS also provides support functions for the 
State marketplaces and administers Federal financial assistance and 
premium stabilization programs related to the marketplaces.
---------------------------------------------------------------------------
    \8\ 76 Fed. Reg. 4703 (Jan. 26, 2011).
    \9\ ACA Sec. Sec. 1411, 1412.

    HealthCare.gov is the public website for the Federal Marketplace 
through which individuals can browse health insurance plans, enroll in 
plans, and apply for Federal financial assistance to help cover their 
premiums and other costs. This is the consumer-facing, or ``front 
end,'' portion of the marketplace. The ``back end'' systems of the 
Federal Marketplace perform functions such linking consumers' 
information from HealthCare.gov to multiple supporting systems that 
---------------------------------------------------------------------------
facilitate the enrollment process and payment to issuers.

    Key components of HealthCare.gov and the Federal Marketplace 
include an identity management system to enable consumers to create 
accounts and verify their identities; the Data Services Hub, which 
routes information requests from the marketplaces to other Federal 
agencies and back, such as the Internal Revenue Service (IRS); and the 
Federally-facilitated Marketplace (FFM) that comprises the core of the 
overall system. The FFM includes three main subcomponents to facilitate 
various aspects of acquiring health insurance: eligibility and 
enrollment determinations, plan management, and financial management.
                       oig's case study approach
    The objective of the case study was to gain insight into CMS 
implementation and management of the Federal Marketplace, focusing 
primarily on HealthCare.gov. The case study identifies organizational 
factors that contributed to the website's poor launch and subsequent 
improvement, and lessons for employing core management principles in 
navigating program implementation and change. These organizational 
factors and the lessons learned identify principles that can contribute 
not only to improving the Marketplace, but also contribute to improving 
the economy, efficiency, and effectiveness of the Department's other 
programs and operations.

    Our review examined the 5-year period from March 2010 to February 
2015, providing a chronology of events and identifying factors that 
contributed to the website's breakdown at launch, its recovery 
following corrective action, and implementation of HealthCare.gov 
through the second open enrollment period. In conducting this review, 
we interviewed current and former HHS and CMS officials, staff, and 
contractors involved with the development and management of the 
website. We also reviewed thousands of HHS and CMS documents, including 
management reports, internal correspondence, and website development 
contracts.

    oig findings from preparation and development of healthcare.gov 
                      (march 2010-september 2013)
    The development of HealthCare.gov faced a high risk of failure, 
given the technical complexity required; the fixed deadline; and a high 
degree of uncertainty about mission, scope, and funding. Still, we 
found that HHS and CMS made many missteps throughout development and 
implementation. Most critical was the absence of clear leadership, 
which caused delays in decisionmaking, lack of clarity in project 
tasks, and the inability of CMS to recognize the magnitude of problems 
as the project deteriorated.

    The HealthCare.gov project encountered problems at the beginning of 
development that set the stage for the poor launch. Implementing the 
Federal Marketplace required substantial policy development and 
decisionmaking to inform technical planning and implementation of the 
website. This included not only writing regulations to govern the 
marketplaces, but also establishing partnerships with other entities 
involved in implementation, such as other departments, States, and 
issuers. This policy work was made more difficult and protracted by a 
lack of certainty regarding the mission, scope, and funding for the 
Federal Marketplace and website and by varying internal and external 
expectations for the marketplaces. Delays caused by the lack of 
certainty used valuable time and made an already compressed time frame 
more difficult.

    Additionally, the project's poor transition to CMS after 10 months 
in the HHS Office of the Secretary resulted in problems that lasted 
long after the move. Initial work in the HHS Office of the Secretary 
made significant strides in establishing the policy framework, but did 
not focus attention on planning for the project's longer-term technical 
and operational needs. CMS had to reconfigure roles and timelines, 
determine how it would leverage its resources, and begin work behind 
schedule. Further, while CMS's infrastructure and experience provided 
greater resources for the project, it led to the Federal Marketplace 
operating within a large bureaucratic structure that separated 
contract, policy, and technical staff, further diffusing the project 
team and making implementation more complex. Our review found that CMS 
leadership failed to foster effective collaboration and communication, 
particularly between CMS policy and technical staff and with 
contractors.

    Lack of clear project leadership led to project diffusion and poor 
coordination. From the beginning and well into the project, CMS did not 
assign clear project leadership, which was particularly problematic for 
the policy and technological work needed to set up HealthCare.gov. For 
example, CMS continued to make changes to the project's business 
requirements that then changed technical aspects of the website build, 
in large part because mid-level staff and managers did not have clear 
direction or the authority to make decisions. Effective leadership 
would have enabled a comprehensive view across the project to better 
identify problems and determine priorities. Instead, lack of a single 
lead entity inhibited progress assessments and changing course as 
needed.

    IT contracting for the FFM encountered significant problems. CMS 
mismanagement of the key HealthCare.gov contract continued throughout 
the website build. CMS did not employ an acquisition strategy to 
develop contracts and solicit contractors, a tool used to precisely 
assess project needs and make a systematic assessment of the 
contractors' ability to meet those needs. Further, due to CMS's 
contracting process and uncertainty about funding and specifications, 
CMS received a limited number of bids for the contract. CMS hired CGI 
Federal to build the core of the overall FFM system, as well as the 
online application for consumers. CMS oversight of the contract was 
disjointed and spread across different divisions with little 
coordination. CMS made frequent changes to contract specifications, and 
did not effectively communicate these changes or adequately assess how 
they would affect staffing and schedules.

    Despite many warnings of substantial problems, CMS moved forward 
without serious discussion of delaying the launch. Throughout the 
course of building HealthCare.gov, staff at HHS and CMS, as well as 
outside entities, identified problems with the program and warned that 
these problems warranted action. In all, CMS received 18 ``documented 
warnings'' of concerns regarding HealthCare.gov between July 2011 and 
July 2013. These documented warnings contained substantial detail about 
the project's shortcomings and were formally submitted to CMS senior 
leadership or project managers at CMS. However, these reports were not 
shared broadly due to diffuse leadership and poor communication. As a 
result, no one person in CMS had a comprehensive view of the poor 
progress and, given the problems were complex, information became 
unwieldy and difficult to prioritize. Without a single comprehensive 
view, CMS leadership and staff took little action to respond to 
warnings, remained overly optimistic about the launch, and developed 
few contingency plans. As the project degraded further and problems 
became more well-known, CMS officials and staff became desensitized to 
bad news about progress.

    In early 2013, CMS attempted to take corrective action, but these 
efforts were largely unsuccessful because they were not fully and 
diligently executed. For example, after criticism that there was no 
clear leadership, CMS assigned its newly appointed Chief Operating 
Officer in early 2013 to head the Federal Marketplace program, but the 
assignment was not formally announced, the position was not supported 
by clear responsibilities, and the designee had an already large 
responsibility as CMS Chief Operating Officer. As another example, a 
CMS advisor recommended that the project hire a technical systems 
integrator to coordinate operations, and CMS and contractors discussed 
this need at several points in the project. However, in correspondence 
and congressional testimony, it was clear CMS technical leadership 
perceived that CMS itself was already serving as the systems 
integrator.\10\ CGI Federal managers reported that the lack of a true 
systems integrator created extra work that was outside the scope of 
their contract.
---------------------------------------------------------------------------
    \10\ U.S. House of Representatives, House Energy and Commerce 
Committee, PPACA Implementation Failures: Answers from HHS, October 30, 
2013.

    Due to the poor contract management and ensuing delays, the final 
months of development and implementation for HealthCare.gov were 
chaotic. CMS continued to make changes to business requirements and 
technical specifications well into 2013, delaying development to a 
point where it was not feasible to complete and test the website as 
initially planned. Critical tasks went uncompleted, including testing 
website functionality and security and ensuring adequate capacity for 
users. CMS continued with the same plans for a full launch. Changing 
the project's path would have required a leader or team to conduct a 
comprehensive assessment of status, and to either possess the authority 
to alter tasks and processes or to fully communicate that assessment to 
leaders with authority. Instead, CMS and contractors continued with the 
initial strategy and goals, falling further behind schedule, with 
largely the same diffuse leadership structure, staffing, and project 
---------------------------------------------------------------------------
plan.

    By the time CMS took more drastic action to change the project's 
path in August and September of 2013, it was too late to adequately 
affect change, given the substantial need for progress and improved 
execution. CMS cut functions that were at one time considered critical 
to a successful launch, such as the Spanish language and SHOP websites, 
to divert resources to the main build. This occurred in the last few 
weeks before launch, when developers and testers reported they were 
months behind schedule. The rush to launch affected all aspects of the 
build, including moving forward with only an interim authorization to 
operate and requesting double computing capacity late in September. CMS 
sought to deliver a version of HealthCare.gov that had only the minimum 
necessary functions to operate, but did so without a comprehensive and 
thoughtful strategy.
 oig findings from launch, correction and turnaround of healthcare.gov 
                      (october 2013-february 2015)
    HealthCare.gov launched at midnight on October 1, 2013, and 
experienced substantial problems within hours. The website received 
five times the number of expected users, but the problems involved more 
than capacity. The website entry tool was overwhelmed, and software 
code defects caused malfunctions. Fixing the website required 
substantial corrections to the software code and to further increase 
capacity. Compounding problems further, some responsible staff were 
furloughed when the Government shut down on October 1, 2013.

    CMS began corrective action, reorganizing the work to focus on key 
priorities and to improve execution. CMS and contractors quickly 
brought in new staff and expertise following the launch, developing an 
all-hands environment wherein fixing problems with HealthCare.gov was 
the key agency mission. Most of the additional staffing came to the 
project within 3 weeks, including technological and project management 
experts from CMS, contractors, and the private sector. By late October, 
CMS and contractors began to move command center operations, 
establishing what would become the formal HealthCare.gov command 
center--the Exchange Operations Center (XOC). The structure at the XOC 
was based on active coordination between technical and policy staff, a 
key component missing during the website preparation and development. 
It also employed comprehensive website monitoring tools to identify 
problems and assess performance. The widespread attention to the launch 
and the number of parties involved could have created bureaucratic 
paralysis, but those working on the repairs directed their attention to 
immediate action and improved the HealthCare.gov website substantially 
in 2 months.

    Before the launch, artificial distinctions and divisions among 
staff contributed to poor collaboration, lack of communication, 
disjointed management, and slow progress. Following the launch, first 
with the technological team and then more broadly, CMS promoted a 
culture that was ``badgeless'' and ``titleless,'' working as a single 
team regardless of employer and job title.

    According to CMS, this change in culture fostered a greater sense 
of mission and teamwork that further improved daily operations.

    CMS initiated organizational change, such as a deeper integration 
between policy and technological tasks. The Federal Marketplace and 
HealthCare.gov needed expertise and coordination across CMS divisions 
and many contractors. CMS integrated the various functions within the 
project, which improved daily work. This integration allowed CMS to 
identify and address problems more quickly, make informed decisions, 
and provide clearer direction to those involved in the website 
development and operations. CMS also assigned clear project and 
technical leadership, hiring a technical systems integrator, and 
restructuring its divisions to allow for greater visibility and 
oversight of technical staff and contractors by senior leadership.

    This greater sense of ``operational awareness'' also prompted CMS 
to plan for and mitigate potential problems by considering 
contingencies, building redundant systems, and increasing capacity. 
CMS's lack of contingency plans before the launch meant that CMS had 
few options when the functionality and computing capacity of 
HealthCare.gov encountered problems. Essential to success was 
identifying possible problems and developing systems and strategies 
specific to each concern.

    By the end of the first open enrollment period, CMS had a stable 
website that functioned well at high capacity, but some planned 
components had yet to be completed. CMS immediately began preparation 
for the second open enrollment period to begin seven months later. CMS 
practiced what officials called ``ruthless prioritization'' of tasks to 
focus on the most urgent needs and functionality. This strategy served 
to align goals with available resources, guide daily work and 
accountability, and temper unrealistic expectations about results. 
According to CMS, officials developed a list of technological needs, 
then debated and cut about half of the items requested. Cuts included 
key elements of the Federal Marketplace system, such as completion of 
the automated financial management system.

    This process for strategic and organized prioritization marked a 
significant improvement over the rushed reprioritization efforts that 
occurred prior to launch. Project documentation indicated that in 2013, 
CMS and contractors were frantic to establish basic website 
functionality. They pushed forward faulty and untested functionality 
and hoped to fix it after the launch. Project documentation indicated 
that in 2014, CMS maintained a more disciplined project schedule, 
meeting deadlines with a goal to implement only technology that had 
what project documentation referred to as optimal functionality, or 
``perfect execution.'' When this standard could not be met in time, CMS 
identified problems more quickly to allow time to employ contingency 
plans. CMS stated that this higher standard led to improved practices 
overall, such as targeting earlier deadlines for delivery and imposing 
stricter testing standards. For example, the new HealthCare.gov 
consumer application, App 2.0, was tested through a ``soft launch'' 
prior to open enrollment. This approach meant that CMS did not always 
deliver according to schedule, but was able to test the application's 
functionality prior to use in the second open enrollment.

    CMS documentation indicated the technical aspects of the website 
and supporting systems performed well during the second open enrollment 
period, with no system outages and few consumer reports of problems 
applying for coverage or selecting plans. CMS further solidified 
project leadership, worked to better align project goals with 
resources, and renewed its focus on contract management, particularly 
emphasizing the agency-contractor relationship. As of February 1, 2016, 
CMS reported that over 9.6 million consumers had selected a health 
insurance plan through the Federal Marketplace or had their coverage 
automatically renewed.\11\
---------------------------------------------------------------------------
    \11\ CMS, Health Insurance Marketplace Open Enrollment Snapshot--
Week 13, February 4, 2016. Accessed at https://www.cms.gov/Newsroom/
MediaReleaseDatabase/Fact-sheets/2016-Fact-sheets-items/2016-02-04.html 
on February 8, 2016.
---------------------------------------------------------------------------
                      call for continued progress
    CMS continues to face challenges in implementing the Federal 
Marketplace, and in improving operations and services provided through 
HealthCare.gov. As CMS moves forward, challenges include improving the 
website and systems as planned, such as completing the automated 
financial management system and improving consumer tools to select 
plans. CMS must also continue to address areas OIG has identified in 
past reports as problematic or needing improvement, including contract 
oversight, the accuracy of payments and eligibility determinations, and 
information security controls.

    CMS concurred with OIG's call for continued progress, stating that 
it will continue to employ the lessons identified in the case study and 
that, since OIG's review, it has implemented several initiatives to 
further improve its management. The 10 lessons articulated in the 
report comprise core management principles that could apply to other 
organizations. They include assigning clear project leadership, 
encouraging staff to identify and communicate problems, and better 
integrating policy and technological work. OIG will continue to monitor 
CMS's actions to address specific recommendations from our work, as 
well as its overall management of this program.

    In addition to the lessons learned from the case study, OIG has 
also completed 12 audits and evaluations of the Federal Marketplace, 
which combined make over 30 recommendations to CMS. We continue to 
monitor CMS's progress toward implementing these recommendations. OIG 
has also published numerous other reports related to State marketplaces 
and other significant programs created by the ACA. All of our ACA-
related work is available at: http://oig.hhs.gov/reports-and-
publications/aca/.

    OIG has ongoing and planned work in several areas related to 
marketplaces, including examining the accuracy of financial assistance 
payments for individual enrollees for the Federal Marketplace, analysis 
of CMS's oversight of the State marketplaces, and a review of the 
funding that established the Federal Marketplace. We are also currently 
developing work related to the premium stabilization programs. In 
addition, OIG has established relationships with its law enforcement 
partners to investigate fraud and closely monitor activities and 
concerns related to the marketplaces.
                               conclusion
    The Department, and the health care system generally, are in the 
process of implementing major changes to health care delivery. Most of 
those changes will depend on the successful implementation of 
information technology, but success will require more than just 
ensuring that the right code is written or that the right technology is 
purchased. As our case study demonstrates, whether these changes will 
result in more effective, efficient, and economic health care and human 
service programs will depend on the interaction of technology, 
management, and policy.

    OIG believes the lessons learned identified in the case study may 
be beneficial to the Department beyond the operation and management of 
the Federal Marketplace. Assessing Departmental management will 
continue to be a vital component of OIG's oversight of Department 
programs going forward. Many programs or projects that OIG oversees 
will not require the same level of coordination or resources required 
of the Federal Marketplace; however, the principles identified in the 
Case Study can help foster the effectiveness and efficiency of 
Departmental and program management.

    The growing intersection of programs and technology requires OIG to 
grow its own capabilities to provide effective oversight. OIG is 
building necessary expertise in data analytics, information technology, 
and forensic accounting. Increasing our proficiencies and resources in 
these disciplines will allow OIG to provide meaningful analysis to 
inform decision-makers and program managers.

    Thank you again for inviting OIG to speak with the committee today 
to share the results of the case study reviewing CMS management of 
HealthCare.gov. I would be happy to submit the case study report for 
the record, and I would be happy to answer any questions the committee 
may have.

                                 ______
                                 
            Questions Submitted for the Record to Erin Bliss
               Question Submitted by Hon. Chuck Grassley
    I would like the record to show that I was unable to attend this 
hearing in person. As Chairman of the Senate Judiciary Committee, I was 
overseeing the debate about the Supreme Court vacancy. The two hearings 
were at the same time.

    Question. Ms. Bliss, in your recent case study report, you 
summarized many of the mistakes at HHS and CMS that resulted in the 
disastrous launch of HealthCare.gov.

    Some of the problems identified by OIG included a lack of 
leadership, a failure to act on warnings and address problems, and 
corrections that were too little too late.

    In the final countdown to the launch of HealthCare.gov, it seems 
CMS was more concerned about launching anything rather than following 
the advice of their own advisors and waiting and then releasing a 
product that would be useful to Americans.

    CMS continues to have problems with implementing and operating the 
Federal Marketplace.

    Ms. Bliss, what are the 10 lessons CMS should have learned?

    Answer. The Centers for Medicare and Medicaid Services (CMS) 
continue to face challenges in implementing the Federal Marketplace and 
in improving services provided through HealthCare.gov. The HHS OIG 
called on CMS to continue progress in applying lessons learned from 
HealthCare.gov to avoid future problems and to maintain improvement 
across the agency. These 10 lessons comprise core management principles 
that address both specific project challenges and organizational 
structure, and could apply to other organizations.

     1.  Assign clear project leadership for cohesion across tasks and 
a comprehensive view of progress.

     2.  Align project and organizational strategies with the resources 
and expertise available.

     3.  Identify and address factors of organizational culture that 
may affect project success.

     4.  Seek to simplify processes, particularly for projects with a 
high risk of failure.

     5.  Integrate policy and technological work to promote operational 
awareness.

     6.  Promote acceptance of bad news and encourage staff to identify 
and communicate problems.

     7.  Design clear strategies for disciplined execution and 
continually measure progress.

     8.  Ensure effectiveness of information technology (IT) contracts 
by promoting innovation, integration, and rigorous oversight.

     9.  Develop contingency plans that are quickly actionable, such as 
redundant and scalable systems.

    10.  Promote continuous learning to allow for flexibility and 
changing course quickly when needed.

    CMS concurred with OIG's call for continued progress and stated 
that it will continue to employ the lessons. Since OIG's review, CMS 
has implemented several initiatives to further improve its management.

                                 ______
                                 
              Questions Submitted by Hon. Michael B. Enzi
    Question. In the hearing, some of the operational and strategic 
changes which were made after the first enrollment period were briefly 
discussed. Those changes were described as ``clearer leadership amongst 
staff and contractors,'' and ``key organizational changes.''

    Please list and describe the specific changes made to make the 
leadership amongst HHS staff and contractors more clear.

    Answer. Assigning and supporting clear project leadership was 
perhaps the most critical change CMS made to improve HealthCare.gov 
project management. Prior to the launch, HealthCare.gov lacked clear 
project leadership to give direction and unity of purpose, 
responsiveness in execution, and a comprehensive view of progress. CMS 
and its contractors took a number of steps to improve leadership, 
including the following:

    1.  Tasked top agency management to assume daily leadership of the 
HealthCare.gov project, first the CMS Administrator and subsequently 
the Principal Deputy Administrator. This served to provide project 
visibility across agency functions and clear authority to implement 
changes. Following the website recovery and before the start of the 
second open enrollment period, CMS hired a Marketplace CEO to serve in 
that leadership role. CMS senior leaders also alternated as the 
website's Executive on Call, serving 24-hour shifts to make decisions 
more rapidly.

    2.  Improved the coordination and transparency of work shared among 
CMS staff and multiple contractors by hiring a systems integrator to 
organize technological tasks and report progress and problems to 
leadership. CMS continues to employ a contractor to serve as systems 
integrator, having established this position within weeks of the launch 
in late October 2013.

    3.  Promoted coordination of CMS divisions working on various 
aspects of the Federal and State-based marketplaces by forming the 
Strategic Planning and Management Council, composed of five workgroups: 
appeals; eligibility and enrollment; plan oversight; security and 
privacy; and workforce planning.

    4.  Shifted from following known processes to continually assessing 
outcomes and progress. For example, CMS identified a number of problems 
in the lead-up to the second open enrollment through ``deep dives,'' 
assigning staff to scrutinize the performance of a specific area or 
function (such as eligibility) and bring to CMS leadership their 
assessments of weaknesses.

    5.  Focused on blending the policy and technical components of CMS 
with a greater sense of what CMS leaders called ``the physics of 
operations'' or ``operational awareness.'' Policymakers acquired a 
better understanding of the effort required to effectuate policy 
decisions, both in terms of time and resources, so that those 
considerations could better inform decision making and avoid a 
longstanding agency bifurcation between operations and policy.

    6.  Instructed staff coordinating technological work and 
supervising contracts about rules and provisions related to contracted 
work; also instructed contractors to work more collaboratively with 
each other and the CMS divisions. This served to avoid staff concerns 
about violating Government contracting rules, promoting closer 
collaboration and a sense that CMS and contractors were a single team 
working toward the same goals.

    Question. Please list and describe the key organizational changes 
mentioned by Ms. Erin Bliss.

    Answer. CMS also made other key organizational changes as it 
improved the HealthCare.gov website. This required significant and 
focused effort to measure website performance, correct problems with 
website capacity and functions, and establish a new project structure. 
To implement these practices, CMS and its contractors took the 
following steps:

    1.  Began correction of website problems immediately following 
launch, changing the project management strategy. CMS and contractors 
brought in new staff and expertise following the launch, developing an 
all-hands environment wherein fixing problems with HealthCare.gov was 
the key agency mission. These changes allowed CMS to make quick 
progress in identifying the source of problems and developing a 
strategy going forward.

    2.  Adopted a ``badgeless'' culture that encouraged full 
collaboration by CMS staff and contractors regardless of employer 
status and job title, fostering innovation, problem solving, and 
communication among teams. The enhanced team of CMS staff, contractors, 
and technological experts correcting problems with HealthCare.gov 
included people at all levels of CMS and contracted entities with 
varied experience on the project. First with the technological team and 
then more broadly, CMS promoted a culture wherein all team members 
could speak out about problems and develop creative solutions.

    3.  Integrated all functions into the organizational structure to 
align with project needs, enhancing CMS and contractor accountability 
and collaboration. The Federal Marketplace needed expertise and 
personnel across CMS, including policy, technical, and communications 
staff, as well as many contractors. Key to the correction, CMS 
integrated the various functions both operationally and technically, 
improving daily work and promoting the larger project mission. This 
integration allowed CMS to identify and address problems more quickly, 
make informed decisions, and provide clearer direction to those 
involved in the website development and operations.

    4.  Planned for problems, establishing redundant (backup) systems 
in the event of further breakdowns and restructuring the key 
development contract to ensure better performance. CMS began to plan 
for and mitigate potential problems by considering contingencies, 
building redundant systems, and increasing capacity. Given limited 
resources, CMS leadership had to analyze past problems with 
HealthCare.gov and carefully consider how and to what extent it would 
develop new systems and strategies, such as enhancing training for call 
center staff. Key to success was identifying all possible problems and 
developing systems and strategies specific to the concern.

    5.  Adopted a policy of ``ruthless prioritization'' to reduce 
planned website functionality, focusing resources on the highest 
priorities. Because the time frame and resources available to prepare 
for the second open enrollment period were fixed, CMS focused on 
reducing scope to meet deadlines. The day after first open enrollment 
closed, CMS leadership met to prioritize tasks to focus on the most 
urgent needs and functionality. These decisions and resulting changes 
were then locked down and measured for progress and results. Ruthless 
prioritization served to align goals with the resources available, 
guide daily work and accountability, and temper unrealistic 
expectations about results.

    6.  Prioritized quality over on-time delivery, employing extensive 
testing to identify and fix problems and delaying new website 
functionality if unready. CMS adopted a project management approach of 
going live with website functionality only when it could ensure what 
one CMS official called ``perfect execution.'' This policy of requiring 
optimal functioning before delivery led to improved practices overall, 
such as targeting earlier deadlines for delivery and imposing stricter 
testing standards.

    7.  Simplified systems and processes to enable closer monitoring of 
progress, increased transparency and accountability, and clearer 
prioritization. CMS simplified both technical aspects of the build and 
the organizational structure of the agency itself by closely monitoring 
progress and results with daily reports and close communication with 
contractors. Reduced complexity in tasks and organizational structure 
made it easier for CMS to identify those responsible for carrying out 
tasks and to track progress toward goals.

    8.  Adopted continuous learning for policy and technological tasks, 
balancing project plans with system and team capacity and changing 
course as needed to improve operations. In preparation for the second 
open enrollment period, much about the HealthCare.gov project was still 
unfolding. For example, CMS did not know how much website capacity 
consumers would require, and it was still developing and testing new 
and improved functionality in the final weeks before open enrollment. 
Given that the design and proportion of the project was evolving, it 
was critical to CMS's success that the organization continuously learn 
as the project progressed. As the HealthCare.gov project matured, CMS's 
knowledge and experience became more concrete and its planning more 
effective, but the project continued to require adaptation.

    Question. In the hearing, Ms. Bliss was asked whether or not the 
office of Inspector General had uncovered, in connection with open 
enrollment, any confirmed cases of fraud. Ms. Bliss responded that 
there are no fraudulent cases which have resulted in criminal 
convictions or civil settlements. However, she did mention that there 
are some ongoing investigations.

    How many ``ongoing investigations'' remain since the first open 
enrollment period?

    Answer. At this time, OIG has two ongoing investigations 
specifically looking at enrollment fraud in the Federally Facilitated 
or State-Based Marketplaces. The conduct under investigation may 
involve more than one open enrollment period.

    Question. There have been concerns about the ``back end'' of the 
HealthCare.gov website, specifically as it concerns subsidy payments to 
insurance companies.

    Please describe the process in which insurers receive payments of 
subsidies for premiums and out-of-pocket expenses.

    Answer. To date, OIG has performed two audits that specifically 
examine the ``back end'' of the HealthCare.gov website.\1\ These 
reports examine the interim manual payment process that CMS utilized 
during the first 2 years of Marketplace operations. In both reports, 
OIG found deficiencies that limited the effectiveness of the interim 
manual payment process. Please see these reports for detailed 
explanations of the interim process.
---------------------------------------------------------------------------
    \1\ HHS OIG, CMS's Internal Controls Did Not Effectively Ensure the 
Accuracy of Aggregate Financial Assistance Payments Made to Qualified 
Health Plan Issuers Under the Affordable Care Act (A-02-14-02006) (June 
2015); and HHS OIG, CMS Could Not Effectively Ensure That Advance 
Premium Tax Credit Payments Made Under the Affordable Care Act Were 
Only for Enrollees Who Paid Their Premiums (A-02-14-02025) (December 
2015). Available at http://www.oig.hhs.gov/reports-and-publications/
aca/.

    In response to these reports, CMS explained that it expected all 
issuers on the Federal Marketplace would be using an automated policy-
based system in 2016. In December 2015, CMS issued guidance related to 
issuer implementation of the automated policy-based system.\2\ 
According to this policy, issuers are expected to transition to this 
system in early 2016. CMS has provided training regarding the new 
system, which OIG attended to gain a better understanding as CMS 
continues to work with issuers to implement automated policy-based 
payments.
---------------------------------------------------------------------------
    \2\ HHS CMS, ``Policy-Based Payments Bulletin--INFORMATION'' 
(December 2015). Available at https://www.cms.gov/CCIIO/Resources/
Regulations-and-Guidance/Downloads/Policy-based
-Payment-Guidance.pdf.

    We also plan to conduct work on CMS's automated policy-based 
payments system at the Federal Marketplace potentially by looking at 
the accuracy of the determination of financial assistance payments and 
the use of enrollment and payment data. The CMS Center for Consumer 
Information and Insurance Oversight (CCIIO) would be the best source of 
---------------------------------------------------------------------------
information about specific details of this process.

    Question. What steps have been taken to ensure that those 
individuals who have signed up for a plan on the HealthCare.gov website 
end up in the right plan?

    Answer. To date, OIG has not conducted work specifically assessing 
internal controls at HealthCare.gov that would ensure individuals are 
enrolled in the Qualified Health Plan they select.

    Based on our related work on the interim manual payment process, 
controls for confirming enrollment may be included in the initial and 
confirmation ``834'' transactions.\3\ OIG's audits did not assess the 
834 transactions with respect to this specific issue, and the automated 
policy-based payment system may utilize different processes. Due to 
those considerations, CMS-CCIIO would be the best source of information 
about specific internal controls the Federal Marketplace has in place 
to ensure individuals are enrolled in the plans they select.
---------------------------------------------------------------------------
    \3\ For more information about the 834 transaction process, see 
OIG's report CMS's Internal Controls Did Not Effectively Ensure the 
Accuracy of Aggregate Financial Assistance Payments Made to Qualified 
Health Plan Issuers Under the Affordable Care Act (A-02-14-02006) (June 
2015), pp. 6-7.

    Question. Please describe the process of adding new information, 
---------------------------------------------------------------------------
like the birth of a child or marriage to an existing plan.

    OIG has not assessed the process for adding information to an 
existing plan. The HealthCare.gov website provides instructions for 
consumers to report information about life changes through their 
Marketplace accounts online or by phone. CMS-CCIIO would be the best 
source of further information about this process.

                                 ______
                                 
             Questions Submitted by Hon. Michael F. Bennet
    Question. As HHS and CMS concur with and move toward implementing 
OIG recommendations, how can you continue to be a resource to the 
agency based on your findings?

    Answer. OIG believes that our case study's assessment of the 
intersection of technology, policy, and management, and the lessons 
that we identified can benefit a broad range of Federal projects and 
programs. These lessons comprise core management principles that 
address both specific project challenges and organizational structure 
and can be applied broadly.

    We will continue to monitor CMS's actions in response to our 
recommendations and its overall management of the Federal Marketplace 
and other programs. OIG has ongoing and planned work in several areas 
related to Marketplaces, including examining the accuracy of financial 
assistance payments for individual enrollees for the Federal 
Marketplace, analysis of CMS's oversight of the State Marketplaces, and 
a review of the funding that established the Federal Marketplace. We 
are also developing work related to the premium stabilization programs. 
In addition, OIG has established relationships with its law enforcement 
partners to investigate fraud related to the Federal Marketplace and 
make appropriate referrals to partner agencies. OIG will also draw upon 
these lessons to examine HHS's and CMS's implementation and management 
of other programs.

    Question. The OIG Case Study report published in February 2016 
highlights changes that CMS underwent including realignment of project 
goals and resources as well as enhancing coordination between CMS staff 
and contractors. What are the main operational changes that CMS should 
focus on as they work toward optimizing the Federal Marketplace?

    Answer. In addition to the lessons learned from the case study, OIG 
has also completed 12 audits and evaluations of the Federal 
Marketplace, which combined make over 30 recommendations to CMS.\4\ We 
continue to monitor CMS's progress toward implementing these 
recommendations. OIG has also published numerous other reports related 
to State Marketplaces and other significant programs created by the 
ACA.\5\
---------------------------------------------------------------------------
    \4\ For a list of significant unimplemented recommendations related 
to OIG's work on both the Federal and State-based marketplaces, see HHS 
OIG, Compendium of Unimplemented Recommendations (April 2016), pp. 34-
40. Available at http://oig.hhs.gov/reports-and-publications/
compendium/index.asp.
    \5\ All of OIG's ACA-related work is available at http://
oig.hhs.gov/reports-and-publications/aca/.

    With regard to the Federal Marketplace, in particular, successful 
implementation of the automated policy-based payment system is one of 
the main operational challenges facing CMS in 2016. Additionally, CMS 
must continue to refine the eligibility determination systems for the 
Federal Marketplace to improve the accuracy and timeliness of those 
determinations, and continue to focus on resolving inconsistencies in 
---------------------------------------------------------------------------
eligibility determinations.

    In general, as CMS improves the consumer-facing enrollment process 
for HealthCare.gov, CMS must continue to assess and improve the Federal 
Marketplace systems that operate behind the scenes, particularly the 
eligibility, administrative, and financial management functions. CMS 
must ensure that all pathways for enrollment operate with integrity and 
that consumers' personal information is secure. Vigilant monitoring and 
testing and rapid mitigation of identified vulnerabilities are 
essential. Attention must be paid to sound operation of financial 
assistance and the risk corridor, reinsurance, and risk-adjustment 
programs. CMS must ensure that consumers and issuers receive accurate 
Marketplace information, including information relevant for tax 
purposes, such as Form 1095A tax forms. Furthermore, Marketplaces must 
continue to protect personally identifiable information and strengthen 
security controls.

                                 ______
                                 
               Questions Submitted by Hon. Sherrod Brown
    Question. We know that HealthCare.gov had a rocky start. But--as 
was acknowledged in the HHS OIG report--after just 2 months (during 
which a wholly preventable government shutdown occurred, furloughing 
relevant members of staff), the Centers for Medicare and Medicaid 
Services (CMS) managed to ``substantially'' improve the website.

    By the end of the first open enrollment period, CMS had a website 
that functioned at high capacity. The agency ended the first open 
enrollment period with 5.4 million individuals having selected a plan 
through the Federal Marketplace.

    Ms. Bliss, what corrective actions were taken by CMS and 
contractors following the website's launch to address the lack of 
communication and leadership challenges that existed during the first 
enrollment period?

    Answer. Assigning and supporting clear project leadership was 
perhaps the most critical change CMS made to improve HealthCare.gov 
project management. Prior to the launch, HealthCare.gov lacked clear 
project leadership to give direction and unity of purpose, 
responsiveness in execution, and a comprehensive view of progress. To 
improve project leadership, top CMS leadership assumed daily management 
of the HealthCare.gov project, first the CMS Administrator and later 
the Principal Deputy Administrator. This served to provide a view 
across agency functions and clear authority to implement changes. 
Following the website recovery and before the start of the second open 
enrollment period, CMS hired a Marketplace CEO to serve in that role 
and coordinate project activities across the agency. CMS senior leaders 
also alternated as the website's Executive on Call, serving 24-hour 
shifts to make decisions more rapidly.

    CMS also worked to improve the coordination and transparency of 
work shared among CMS staff and multiple contractors. These efforts 
included hiring a systems integrator to organize technological tasks 
and report progress and problems to leadership and merging the work of 
policy and technical staff more closely to allow for a better sense of 
the work needed to complete project goals and integrate CMS staff and 
contractors into a single team. CMS also promoted coordination of CMS 
divisions working on various aspects of the Federal and State-based 
marketplaces by forming the Strategic Planning and Management Council, 
comprising subject area workgroups such as health plan oversight and 
workforce planning. This improved coordination across divisions allowed 
CMS to shift from separated, engrained processes to continually 
assessing outcomes and progress.

    CMS made other key organizational changes as it improved the 
HealthCare.gov website. Following the poor launch, CMS and contractors 
pivoted quickly to corrective action, reorganizing the work to focus on 
key priorities and improve execution. These efforts benefited from CMS 
adopting a ``badgeless'' culture that encouraged full collaboration by 
CMS staff and contractors regardless of employer status and job title, 
fostering innovation, problem solving, and communication among teams. 
The agency also planned for problems, establishing redundant (backup) 
systems in the event of further breakdowns and restructuring its key 
development contract to ensure better performance.

    Question. What has CMS done to address these challenges and 
continue to improve operations through the second and third open 
enrollments? How do you anticipate CMS will build upon these 
improvements for the upcoming open enrollment period?

    Answer. In preparation for the second open enrollment period, CMS 
restructured project tasks to set more realistic goals and meet core 
objectives. For example, CMS managers met immediately following the 
first open enrollment to ``ruthlessly prioritize'' remaining tasks and 
focus resources on the highest priorities. This served to align goals 
with the resources available, guide daily work and accountability, and 
temper unrealistic expectations about results. CMS also prioritized 
quality over on-time delivery, employing extensive testing to identify 
and fix problems and delaying new website functionality if unready for 
perfect execution. This contrasted with the launch of HealthCare.gov 
wherein CMS delivered what it knew was faulty functionality, planning 
to improve the website later.

    To manage these efforts, CMS simplified systems and processes to 
enable closer monitoring of progress, increased transparency and 
accountability, and clearer prioritization. Reduced complexity in tasks 
and organizational structure made it easier for CMS to identify those 
responsible for carrying out tasks and to track progress toward goals. 
At the same time, the broader CMS organization adopted a strategy of 
continuous learning for policy and technological tasks, balancing 
project plans with system and team capacity and changing course as 
necessary to improve operations. Given that the design and proportion 
of the HealthCare.gov project was evolving, it was critical to CMS's 
success that the organization continuously learned as the project 
progressed. CMS continued these strategies, experiencing few technical 
problems and no system outages during the second open enrollment 
period.

    Still, the agency faces ongoing challenges in implementing the 
Federal Marketplace and in improving operations and services provided 
through HealthCare.gov. OIG called on CMS to continue progress in 
applying lessons learned from HealthCare.gov to avoid future problems 
and to maintain improvement across the agency. As CMS moves forward, 
challenges include improving the website and systems as planned, such 
as completing the automated financial management system and improving 
consumer tools to select plans. Also, given CMS's large organization 
and complex mission, prior management problems could resurface and new 
problems could emerge. CMS placed intense organizational focus on the 
Federal Marketplace during the recovery of the website. This level of 
focus will, by necessity, change in the face of new challenges and 
priorities within CMS, and inevitably officials and staff with key 
expertise and deep knowledge of the Federal Marketplace will leave CMS 
or the project. Such changes in priorities and resources reinforce the 
need for CMS to fully embed core management principles in its daily 
work.

    In its comments in response to the Case Study, CMS concurred with 
OIG's call for continued progress in applying the lessons that CMS 
learned from the HealthCare.gov recovery in its management of the 
Federal Marketplace and CMS's broader organization. CMS stated that 
since the OIG review it has implemented several initiatives to improve 
its management, striving to incorporate principles aligned with this 
report's lessons learned in its culture, operations, and daily work. 
These principles include a focus on leadership and accountability, 
continuous reevaluation of priorities and how the project could be more 
efficient, program measurement, and a flexible and evolving IT strategy 
aligned with policy requirements. CMS also indicated a commitment to 
overcoming challenges and deliver results in a transparent manner. OIG 
will continue to monitor CMS operation and management of the Federal 
and State-based Marketplaces and HealthCare.gov, focusing on oversight 
of critical aspects such as the integrity of enrollment processes and 
payment accuracy.

                                 ______
                                 
              Prepared Statement of Hon. Orrin G. Hatch, 
                        a U.S. Senator From Utah
WASHINGTON--Senate Finance Committee Chairman Orrin Hatch (R-Utah) 
today delivered the following opening statement at a hearing examining 
deficiencies with HealthCare.gov and the current state of the Patient 
Protection and Affordable Care Act (PPACA) and how it is impacting 
patients and taxpayers:

    Good morning. It is a pleasure to welcome everyone to today's 
hearing.

    Today, we'll be talking with representatives from the Office of 
Inspector General for the Department of Health and Human Services (HHS-
OIG) and from the Government Accountability Office (GAO) about their 
ongoing oversight work with respect to HealthCare.gov and enrollment in 
the Federal health insurance marketplace. I want to thank both entities 
for their hard work on these issues and acknowledge the contributions 
both have made to help this committee perform more accurate and timely 
oversight.

    Now, it is no secret that I have never been a fan of the so called 
Affordable Care Act. And, as we approach the sixth anniversary of this 
law and look closely into how it's working and being implemented, the 
evidence overwhelmingly shows that I--and the many others who opposed 
the law from the beginning--have been right all along.

    The facts speak for themselves.

    Since Obamacare was signed into law, HHS-OIG and GAO have 
cumulatively released at least six dozen reports detailing various 
operation and implementation issues demonstrating the numerous areas 
where the law is falling short. These reports are specific and focused 
on key operational failures like enrollment controls or system issues, 
some of which we'll hear more about today.

    Let's keep in mind that GAO and HHS-OIG are not partisan entities. 
They are independent watchdogs, tasked with the responsibility of 
objectively and dispassionately assessing what is and what is not 
working in various Federal programs, including those created or amended 
by the Affordable Care Act. And, there is no better record showing how 
and why Obamacare is not working than the reports we've received from 
these offices.

    Today, we are going to specifically discuss operations issues 
related to HealthCare.gov and enrollment problems at the Federal 
insurance marketplace, otherwise known as the Federal exchange.

    Let's start with the HealthCare.gov launch.

    As a result of numerous problems and shortcuts taken with the 
initial development and deployment of HealthCare.gov and its supporting 
systems, consumers encountered widespread performance issues when 
trying to create accounts and enroll in health plans. After numerous 
inquiries and reports, we now know what ultimately caused these 
performance issues.

    For example, there was inadequate capacity planning. The Centers 
for Medicare and Medicaid Services (CMS) cut corners and did not plan 
for adequate capacity to maintain HealthCare.gov and its supporting 
systems.

    There were also problems with the software that were entirely 
avoidable. CMS and its contractors identified errors in the software 
coding for the website, but did not adequately correct them prior to 
launch.

    We saw a lack of functionality as CMS did not adequately prepare 
the necessary systems and functions of the website and its supporting 
systems prior to the initial launch.

    CMS also failed to apply recognized best practices for system 
development, which contributed to the problems.

    Admittedly, since the initial launch, CMS has taken steps to 
address these problems, including increasing capacity, requiring 
additional software quality reviews, and awarding a new contract to 
complete development and improve the functionality of key systems.

    However, many of the problems have still not been entirely resolved 
and continue to cause frustration for consumers trying to obtain health 
insurance.

    I wish we could boil down all of Obamacare's problems to the 
functions of a single website. Indeed, if this was just an IT problem, 
all of our jobs would be a lot easier. However, the problems with 
Obamacare--and the Federal insurance marketplace in particular--go much 
deeper and many of them remain unaddressed.

    We know, for example, that the enrollment controls for the Federal 
marketplace have been inadequate.

    During undercover testing by GAO, the Federal marketplace approved 
insurance coverage with taxpayer-funded subsidies for eleven out of 
twelve fictitious phone or online applicants. In 2014, the GAO 
applicants--which, once again, were fake, made-up people--obtained a 
total of about $30,000 in annual advance premium tax credits, plus 
eligibility for lower insurance costs at the time of service. These 
fictitious enrollees maintained subsidized coverage throughout the 
year, even though GAO sent either clearly fabricated documents or no 
documents at all to resolve application inconsistencies.

    While the subsidies, including those granted to GAO's fictitious 
applicants, are paid to health-care insurers, they nevertheless 
represent a benefit to consumers and a cost to the government. Now, GAO 
did find that CMS relies on a contractor charged with document 
processing to uncover and report possible instances of fraud. Yet, GAO 
also found that the agency does not require that the contractor has any 
fraud detection capabilities.

    And, according to GAO, CMS has not performed a single comprehensive 
fraud risk assessment--a recommended best practice--of the Obamacare 
enrollment and eligibility process. Until such an assessment is 
completed, CMS is unlikely to know whether existing control activities 
are suitably designed and implemented to reduce inherent fraud risk to 
an acceptable level.

    In other words, CMS isn't even sure if CMS's fraud prevention 
systems are designed correctly or if they're effective.

    Lastly, while it is not the focus of the reports that will be 
covered by the testimony today, another matter we've been tracking 
closely, and where the GAO is issuing a report today, is CMS's 
oversight of the health care CO-OPs. We had a hearing on this topic in 
late January where we examined a number of financial and oversight 
related explanations for the abject failure of the CO-OP program.

    Today's GAO report describes CMS's efforts to deal with financial 
or operations issues at the CO-OPs, including the use of an escalation 
plan for CO-OPs with serious problems that may require corrective 
actions or enhanced oversight.

    As of November 2015, 18 CO-OPs had enough problems that they had to 
submit to a CMS escalation plan, including nine that have discontinued 
operations. And, just this week, we heard that yet another CO-OP, this 
time the one in Maine, is on the verge of financial insolvency, despite 
the fact that it had been on a CMS-mandated escalation plan.

    In other words, CMS's efforts to address all the problems faced by 
CO-OPs appear to have failed, just like virtually every other element 
of this program.

    The failure of CMS to adequately implement the CO-OP program is 
well-
documented here on the Finance Committee and elsewhere. As with so many 
other parts of Obamacare, the high-minded rhetoric surrounding this 
program has fallen short of reality.

    With nearly half of the CO-OPs now closed, the failed experiment 
has wasted taxpayer dollars and forced patients and families to 
scramble for new insurance. With so many CO-OPs now in financial 
jeopardy, I believe that CMS should work with, not against States, to 
safeguard taxpayer dollars.

    So, as always, we have a lot to discuss. And I look forward to 
hearing more from the officials we have testifying here today.

                                 ______
                                 
                 Prepared Statement of Hon. Ron Wyden, 
                       a U.S. Senator From Oregon
    It is old news that the rollout of HealthCare.gov 3 years ago was 
botched. It is new news that the Inspector General of HHS recently 
said, quote, ``CMS recovered the HealthCare.gov website for high 
consumer use within 2 months, and adopted more effective organizational 
practices. . . .''

    That quote comes from one of two reports looking back at 2013 and 
2014 that the Finance Committee will be presented with today. Let's 
recognize that the story here is well-documented. After the launch went 
badly, some of the best minds in tech and a new contractor were brought 
in, they scrambled to overhaul the system, and the exchange was soon up 
and running. And CMS is following up on every one of the Inspector 
General's recommendations, which the IG notes in its report.

    In the most recent enrollment period, nearly 10 million Americans 
used HealthCare.gov to sign up for a plan or re-enroll automatically.

    And in my home State, which has had its own problems, close to 
150,000 people have used the website to sign up for a plan as of 
January 31st. That's up by more than 30 percent compared to last year.

    The committee will also hear an update today from the Government 
Accountability Office on what's called a ``secret shopper'' 
investigation. GAO first brought this study before the committee in 
July last year. And I'll repeat now what I said back then: On this side 
of the aisle, we don't take a back seat to anybody in fighting fraud 
and protecting taxpayer dollars. One dollar ripped off is one dollar 
too many. But let's recognize that what was true last summer remains 
true today. This GAO investigation has not uncovered one single shred 
of real-world fraud in the insurance marketplaces. It was built on 
fictitious characters with specially-created identities, not real 
consumers or real fraudsters.

    It's true the GAO found that there are sometimes differences 
between the information on somebody's insurance application and their 
tax forms and citizenship records. But when it comes to these 
inconsistencies in people's data, this investigation can't 
differentiate between fraud and a typo.

    And meanwhile, HHS does not look the other way when it finds these 
red flags. In 2014, the year of GAO's investigation, CMS closed more 
than 100,000 insurance policies because documents didn't match or 
weren't provided. Tax credits were adjusted for nearly 100,000 
households. In 2015, HHS closed more policies and adjusted more tax 
credits. If you come at this from the left, you might say that's too 
harsh. If you come at it from the right, you might take a different 
view. But there is no basis whatsoever for the argument that HHS 
ignores problems in people's records or leaves the door open to fraud.

    So in closing, rather than rehashing old news, I'd prefer to look 
at the facts. Because of the ACA, the number of Americans without 
health insurance is at or near its lowest point in half a century. For 
the 160 million people who get their insurance from their employer, 
premiums climbed only 4 percent last year. Working-age Americans in 
Oregon and nationwide with preexisting conditions--80 million people or 
more--can no longer be denied insurance.

    Now, instead of battling it out over what happened 3 years ago, 
let's start pulling on the same end of the rope and solve some real 
problems. For example, Democrats and Republicans ought to be working 
together to stoke more competition in the insurance marketplace and 
bring costs down for consumers.

    Next, there are going to be spectacular, new cures available in the 
future, and there are real questions as to whether our health care 
system will be able to afford them. Senator Grassley and I put together 
a bipartisan case study that looked into one such drug, which treats 
Hepatitis C. Solving this issue of blockbuster drug costs is going to 
take a lot of hard work on a bipartisan basis.

    Congress also has a duty to take Medicare's historic guarantee and 
reinforce it for a new generation of Americans. In my view, it starts 
with revolutionizing the way Medicare handles caring for seniors with 
chronic conditions like diabetes, cancer and Alzheimer's. Members on 
both sides of this committee, thanks to steadfast work by Senators 
Warner and Isakson, and Chairman Hatch's leadership, have built a 
bipartisan game plan for chronic care. And it's my hope that the 
committee is able to continue its progress on that front.

    Those are the kind of health care challenges I believe this 
committee should be focused on tackling. With that, I want to thank our 
witnesses for being here today.

                                [all]
```