SSA currently maintains over 800 agreements that support exchanges through which the agency provides data to state and federal partners (approximately 700 state and almost 100 federal agency partners). These agreements define the requirements, terms, and conditions under which the data will be provided to the partners. In many cases, legislation mandates the agency to provide electronic data in support of certain programs. For example, SSA is required to provide data to the Veterans Benefits Administration, which is part of the Department of Veterans Affairs, in support of the Veterans Benefits Administration’s efforts to determine benefits eligibility. In other cases, SSA voluntarily enters into data exchange agreements with state and other federal agency partners. SSA’s existing IT infrastructure—databases, applications, networks, and management practices—supports the agency’s daily operations and core mission activities, such as administering monthly Retirement, Survivors, and Disability Insurance and Supplemental Security Income benefits, as well as its data exchange programs. Data provided to SSA’s data exchange partners are accessed from the same database infrastructure that supports the agency’s overall operations and mission. This infrastructure includes several databases that store and maintain beneficiary data related to SSA’s benefits programs. These databases are briefly described in table 1. Master Beneficiary Record (MBR) Master Earnings File (MEF) Supplemental Security Record (SSR) Number Holder Identification (Numident) Among the databases, the Master Beneficiary Record, Master Earnings File, and Supplemental Security Record databases are included in the agency’s legacy database infrastructure, referred to as the Master Data Access Method, or MADAM. The Number Holder Identification has recently been updated to a mor e modern system based on commercially available software. SSA also maintains various application systems that were designed and developed specifically to process data exchange transactions and that generally support multiple data exchanges. These applications provide Social Security number matching and verification information that supports various types of federal and state programs, such as driver’s license issuance, voter registration, social services administration (e.g., food stamps), employment eligibility verification, and passport issuanc e. The applications accept requests for information from SSA’s partners, retrieve and attempt to match or verify data from the databases against the information submitted by the partners, and then transmit responses—that is, the results of the data matching and verification—to the data excha nge partners who initiated the requests. The applications primarily match Social Security number, name, and date-of-birth information submitted by the partners against data stored in the databases. The request transactions are processed and the responses pro file or online, real-time processing. vided through the use of either batch SSA relies on 11 key application systems to process information reques from and provide response data to its state and federal data exchange partners. These data exchange applications provide data to programs associated with 582 of the state-level agreements and 26 of the feder level agreements—about 75 percent of the outgoing data exchange agreements that the agency supports. These 11 key data exchang e application systems process over 1 billion transactions annually. SSA’s outgoing data exchange programs are funded through various sources. These include the agency’s annual budget and reimbursements from the data exchange partners, which are established through the data exchange agreement process. For example, the agreement between SSA and the Veterans Benefits Administration states that SSA will provide data at no cost. In this case, SSA’s annual budget provides funds to support the administrative and systems-related activities that are required to support this agreement, such as the development of agreements and technical support for the data exchange partners. SSA receives reimbursements from a number of its external partners, including the American Association of Motor Vehicle Administrators (AAMVA) along with 2 state agencies and 14 other federal agencies, for data exchanges. For example, according to agency documentation, SSA’s agreement with AAMVA to provide electronic Social Security number verifications to all states for processing driver’s license applications resulted in reimbursements in the amount of $230,882 to the agency in 2007. The amounts of reimbursements, if any, are determined on the basis of provisions established by the agreements with each data exchange partner. For 364 of these agreements, SSA provides electronic data at no cost to state and federal partners. According to agency documentation, during fiscal year 2007, SSA received about $10 million in total reimbursements for its outgoing data exchanges, primarily from federal data exchange partners. The documentation indicates that about half of this amount was reimbursed on the basis of agreements with the Departments of Homeland Security and Health and Human Services. The management and oversight of SSA’s data exchange programs span multiple agency components. Among these, the Associate Commissioner for the Office of Earnings, Enumeration and Administrative Systems, has primary responsibility for systems activities related to SSA’s data exchange programs, and the Office of Budget, Finance, and Management, Office of Strategic Services has primary responsibility for data exchange agreements. We have previously reported on SSA’s IT management practices and challenges. Most recently, we studied and reported on the agency’s ability to effectively deliver services, including those related to electronic data exchanges. In our reports, we made recommendations directed toward the agency’s need to strengthen its plans for delivering services to beneficiaries and to address challenges associated with a growing and increasingly complex data exchange environment. In December 2008, we reported specifically on SSA’s data exchange environment and identified challenges that the agency faced in supporting data exchange programs. Among these, we noted that the agency faced challenges in retaining the expertise needed and maintaining the technology required to support an adequate technical infrastructure to meet future needs. We also described an agency initiative to study ways to better manage the data exchange environment and address current and future challenges and limitations. This initiative identified actions that the agency should take to address challenges related to management and systems-related issues. We recommended in our report that SSA set milestones for undertaking these actions. The Commissioner of Social Security concurred with our recommendation and stated that the agency had established milestones for taking action. Also in January 2009, we reported that increases in retirement and disability filings, along with ongoing and expected increases in retirements of SSA’s most experienced staff, posed difficult challenges for the agency in meeting future service delivery needs. We recommended that the agency take steps to address these challenges and develop a plan that describes how it will deliver quality service in the future while managing growing work demands and constrained resources. In response, SSA stated that it had intensive planning efforts in place, but agreed to develop a single planning document that would describe service delivery and staffing plans. SSA has implemented technology and procedures within its existing IT infrastructure to support its current data exchange environment, including processes to identify, track, and resolve systems-related problems. Those data exchange partners we included in our study indicated that the agency’s IT infrastructure had effectively supported the exchanges in which they participate. The partners reported that they had experienced few systems-related problems and none that had a significant impact on their ability to conduct business. An effective IT infrastructure provides performance capabilities, such as system availability and reliable data, that are essential to enabling the efficient and economical exchange of electronic data. The Software Engineering Institute defines practices for providing effective IT services, including those that are key to an agency’s ability to ensure that its infrastructure supports business operations. These practices include, among other things, the establishment of (1) monitoring capabilities to proactively identify problems; (2) help desks to collect information on incidents and initiate problem-solving actions; and (3) capabilities to prioritize incidents, track the status and progress of incident resolution, and validate the complete resolution of incidents. By implementing practices to monitor, track, and resolve systems-related problems, agencies can reduce the risk that when problems occur, their information systems and support mechanisms will fall short of effectively supporting business operations and service commitments. To ensure that SSA’s IT infrastructure meets the performance requirements of the agency’s data exchange partners, SSA and its partners establish, through data exchange agreements, specific and detailed performance standards (e.g., system availability, scheduled outages, data accuracy, and response times for each exchange, along with protocols for reporting and resolving systems-related problems). These elements are critical to an effective IT infrastructure that enables the efficient and economical exchange of electronic data. For example: The data exchange agreement with AAMVA specifies that SSA will provide responses for 95 percent of all Social Security Online Verification system requests received from AAMVA within 3 seconds or less and that responses to 99 percent of requests will be provided within 5 seconds or less. The agreement also defines the hours of system availability and scheduled outages. The data exchange agreement with the Veterans Benefits Administration specifies that SSA is to provide a 99 percent data accuracy rate in support of the administration of veterans’ benefits. To address any systems-related problems that might occur and affect its data exchange partners, SSA has implemented several key practices for providing effective IT services, as defined by the Software Engineering Institute. Specifically, the agency has established processes to identify, track, and resolve systems-related problems. For example, the agency established a national help desk for responding to systems-related problems, and employs a process for recording, prioritizing, tracking, and solving IT problems. This process is supported by the Change Asset and Problem Reporting System, which is a system that is used agencywide to prioritize systems-related problems, track the status and progress of resolutions, and validate the resolution of problems. System reports from January 2008 to February 2009 identified approximately 35 systems-related problems that affected data exchanges. These problems were primarily temporary outages lasting less than 1 minute, including several problems lasting just seconds. Additionally, network support personnel proactively monitor data exchange components through the agency’s full-time (24 hours a day, 7 days a week) network operations and monitoring centers, which provide support for agencywide IT infrastructure components. Other SSA support staff also regularly monitor systems resource usage and work with state and federal partners to help resolve problems as they occur. For example, according to SSA officials, if a partner notifies the agency of slow response time, support staff members monitor the partner site’s bandwidth usage and make upgrades as necessary. SSA has established other specific procedures for speedy response to resolve systems-related problems. For example, according to AAMVA partners, SSA’s network operations and monitoring centers are responsible for monitoring the performance of the data exchange system that is used to support driver’s license issuance and voter registration (the Social Security On-Line Verification system). When SSA personnel at the centers receive an alert indicating that the system is not performing properly, they investigate the problem and assign responsibility for resolving the problem to the appropriate SSA unit. Responsible personnel then notify AAMVA of the problem and the status of the resolution process, which is updated through the Change Asset and Problem Reporting System. Reports from the reporting system show that, in one case of a system outage, SSA support staff resolved the problem in 34 seconds by moving the AAMVA network connection to a backup system. All of the federal and state data exchange partners included in our study stated that SSA’s IT infrastructure adequately supported the performance standards established by existing agreements and effectively provided data that supported their business operations. They agreed that SSA was responsive and quickly resolved problems when they did occur and stated that, as a result of SSA’s efforts, their ability to conduct business operations that depend on data provided by the agency had not been adversely affected by systems-related problems associated with SSA’s IT infrastructure. These partners, which had been receiving electronic data from SSA for 2 to more than 30 years, reported that they experienced no or only minor systems-related problems caused by SSA’s IT infrastructure. For example: AAMVA partners reported that the SSA system that supports their data exchange historically was fully available during the hours of system availability specified in their exchange agreement. According to these officials, the system experienced virtually no downtime through calendar year 2008—it was operational 99.8 percent of the time that the system was available. Officials with Idaho’s Departments of Labor and Transportation told us that SSA’s problem resolution procedures and support staff were effective and provided ample support and timely response to reported problems. These officials added that while 4 percent of Social Security number verification responses that they received from SSA via the AAMVA system were not confirmed, these nonverifications were predominantly caused by name changes that were not updated by the Social Security number holders (e.g., changes from maiden names to married names), rather than by problems with SSA’s data exchange systems or data. Officials with the Iowa state agencies stated that SSA’s systems performance was satisfactory. Specifically, officials with the state’s Department of Transportation, which receives data through the AAMVA network, reported that although they occasionally experienced unscheduled outages and slow system response times, SSA’s overall performance was satisfactory. Officials with the state’s Department of Human Services said that they had not experienced any problems. Officials with the eight California agencies included in our study reported no problems associated with SSA’s data exchange systems. Beyond these reports, the two SSA regional office data exchange coordinators with whom we spoke stated that state and territory agency partners within their regions, New York City and Kansas City, had not reported systems-related problems associated with SSA’s existing IT infrastructure. Specifically, the Kansas City coordinator stated that the region had not reported any problems with data exchange systems since the coordinator came on board in September 2008. Similarly, the federal data exchange partners with whom we met did not report any problems associated with SSA’s IT infrastructure that negatively affected their ability to carry out business operations. For example: Data exchange officials with the Department of Homeland Security reported as of June 2009 that no systems-related problems had affected their ability to conduct business. Veterans Benefits Administration and Veterans Health Administration officials also stated that SSA’s IT infrastructure was effective in delivering data that supported their benefits administration programs and that they had experienced no problems with the quality or delivery of data from SSA’s systems. Officials with the Centers for Medicare and Medicaid Services stated that they occasionally experienced late delivery of files that delayed the processing of Medicare entitlement information. However, these officials described this matter as a situation that they considered to be within the norm, given the very large amounts of data that are being exchanged between systems. These partners did not view these occasional late deliveries to be a significant issue with the SSA systems that provided data. Although SSA’s existing IT infrastructure is sufficient to support current outgoing data exchanges, SSA officials and the agency’s partners anticipate that the number of these exchanges will continue to increase and become more complex, placing greater demands on the infrastructure and systems. To address overall agency needs for a more cost-effective and efficient computing environment, SSA is currently taking steps to modernize its IT infrastructure, including components that support its data exchange programs. For example, the agency is updating its 30-year-old database infrastructure, converting outdated software applications, and expanding its physical data processing capacity. However, the agency has not established and executed IT management practices needed to effectively guide and oversee the direction of its outgoing electronic data exchange programs, such as conducting the analyses required to project future workload needs and performance requirements—information that is essential to developing a target architecture that identifies business and technical requirements for a future data exchange environment. If these analyses are not completed, SSA’s ability to provide and maintain an IT infrastructure that meets requirements to effectively support its data exchange programs in the future could be at risk. Based on recent increased numbers of requests for data provided by data exchange services, both SSA and its data exchange partners anticipate that the agency’s outgoing data exchange programs will continue to grow and will outpace current capabilities. SSA reported that from fiscal years 2007 to 2008, the number of data requests made to seven of SSA’s key data exchange applications increased from 1.19 billion to 1.37 billion, or about 15 percent. Table 4 shows details of the increase in data requests for these applications. An example of one data exchange application that has been required to process large increases in data requests for Social Security number confirmations is SSA’s E-Verify application. This application supports the Department of Homeland Security E-Verify program, which is used to help employers verify the employment eligibility of newly hired workers. Participation in the program has been voluntary at the private and state levels since its implementation 10 years ago and, since then, utilization of SSA’s E-Verify application has increased dramatically. In the past 2 years alone, usage has doubled twice. Further, federal legislation has been proposed to, among other things, require the use of the E-Verify program by employers across the nation. If such legislation is enacted, agency officials estimate that the number of queries to E-Verify could quickly surpass 60 million per year—nearly 10 times the number of requests in fiscal year 2008. In addition to growth in the numbers of data exchange requests, the complexity of the exchanges is expected to increase, in that agencies are increasingly asking for online access (a more complex requirement than batch access). Officials from four of the state and federal agencies with whom we spoke stated that their needs for online access to SSA’s data exchange systems are expanding. For example, officials with New York, Idaho, and California reported that their programs will need expanded online access to SSA’s data exchange systems to support increasing workloads and to provide more efficient processing of data requests. Specifically, officials with New York’s Office of Temporary and Disability Assistance explained that their programs will be requiring increased online or Web-based service from SSA in the future to support expected general workload growth as their need for Social Security number verifications and other SSA information grows. Officials with California’s Department of Child Support Services stated that online access is needed to improve efficiencies in caseworkers’ ability to verify benefits, schedule court hearings to determine amounts of child support payments, and process and close eligible cases. Officials with Idaho’s Department of Labor also projected that they would need more online access to SSA’s data exchange systems through Web-based transaction processing to support more efficient case processing and access to SSA’s data exchange systems 24 hours a day, 7 days a week. In 2008, SSA officials polled the agency’s 10 regional offices to identify current data exchange partners that had requested online, real-time access to the agency’s State Online Query system over the previous 24 months. The poll identified state partners in 8 of the regions that had made such requests. Table 5 shows these regions along with the 24 state agencies that had requested online access for their programs (in addition to the 50 partners that already had access to the State Online Query system). Office of Management and Budget Circular A-130 and industry best practices stress the importance of agencies taking advantage of cost- effective technology to improve operations. Additionally, industry studies have shown that modern technology can offer organizations more efficient and effective automation capabilities to meet service delivery demands. Further, more advanced technology is important to support online, real- time transaction processing, which is more demanding than batch processing due to the need for increased systems availability and more sophisticated technology. SSA officials are taking steps to update key components of the agency’s IT infrastructure, including those that directly support its data exchange services, to provide expanded and extended processing capabilities. In particular, the agency is in the process of modernizing the agency’s database infrastructure, upgrading software, and building new data centers. According to an SSA Senior Enterprise Architect, the agency’s legacy database infrastructure—MADAM—was created in-house in the early 1980s and, over time, became outdated and difficult to support, limiting the agency’s ability to provide expanded data processing services. For example, the MADAM databases must be backed up and maintained daily and are not available during the time that maintenance occurs. This down time prevents the agency from providing complete data processing services 24 hours a day, 7 days a week to support the agency’s core mission and operations as well as its data exchange programs. Thus, SSA is in the process of converting its MADAM environment to a modern and commercially available system that is intended to support online processing 24 hours a day, 7 days a week. According to SSA officials, the agency has already converted its Numident database, and plans to convert its Master Earnings File, Supplemental Security Record, and Master Beneficiary Record databases in 2009, 2011, and 2012, respectively. Further, SSA is in the process of updating its E-Verify data exchange operating environment. In this regard, the agency is implementing an environment in which E-Verify data requests will be processed against a dedicated database and will provide continuity of operations and disaster recovery capabilities, which are currently not available. These upgrades are intended to support the projected increase in demand for E-Verify services and reduce the risks of system slowdowns and disruptions. The E-Verify upgrades are expected to be completed and implemented in August 2009. The agency is also upgrading its current systems environment, including the systems that support data exchanges. This environment contains aging software that is based on about 36 million lines of COBOL code, a programming language that is generally viewed as obsolete and that makes it difficult to implement new business processes and new service delivery models, such as online, real-time processing. According to SSA officials, the agency is upgrading its software applications to Web-based technology that is intended to better enable online, real-time access to data processing services. Further, SSA has recently built a new data center to provide expanded data processing capacity in addition to that provided by its National Computer Center. The agency also has plans to replace the 30-year-old National Computer Center to, according to SSA officials, provide more efficient and economical processing capabilities and support growing requirements of a full-time electronic service delivery operation. By taking these steps to modernize its agencywide IT infrastructure, including components that support data exchange programs, SSA is aiming to provide the computing capabilities needed to support increasing and future demands for electronic data exchange services. SSA’s IT strategic plan reflects the priorities that are intended to guide the agency’s operational and tactical IT planning through fiscal year 2012. Regarding data exchanges, the plan discusses an agency initiative that is intended to study various data exchanges and ways to allow partners to link more efficiently to the agency’s systems. Also, the agency’s IT vision document describes plans to replace various methods of sharing data with an easy-to-use, Web-based portal that provides data to partners through a menu-driven system, along with a plan to use a single registration process and a secure, controlled environment that ensures data are protected. The vision document identifies as a key initiative the need to maintain a robust data exchange architecture that fully supports the growing demand for information sharing. Even as SSA proceeds with planned updates to its IT infrastructure, the agency has not fully implemented IT management practices that are essential to help guide its direction related to data exchanges. Sound management practices require organizations to perform the necessary planning for investments to ensure that they effectively support current and future business needs, such as a more demanding data exchange environment. In planning for future business operations, agencies should also, among other things, project their programs’ anticipated workloads, such as increases in data requests and transaction volumes—information that is essential for making informed decisions concerning workload management and the technological solutions needed to sustain efficient and effective performance in the future. Further, this information can provide critical input to the agency’s planning efforts, including the development of a target architecture. Nevertheless, according to agency officials, SSA has not conducted detailed analyses to project future workload requirements resulting from the increasing demand and expanded need for outgoing electronic data exchanges. Specifically, the agency has not projected increases in the number of requests for data or the need for more online, real-time access to its data exchange systems. The agency’s Director of the Division of Information, Verification and Exchange Services and the Director of the Office of Systems Security Operations Management maintain that the agency’s tactical plans for delivering electronic services will be sufficient to address future needs for data exchanges. However, these plans have not yet been developed. Further, while the agency’s strategic direction and vision for its data exchange environment are important, they do not substitute for the more detailed analysis that is essential to identifying the specific business and technical requirements for its data exchange programs and partners. Moreover, in the absence of such detailed analysis, SSA cannot be assured that it will achieve the robust data exchange architecture that it envisions. According to federal guidance, an agency should develop an enterprise architecture, or modernization blueprint, that describes in both business and technology terms how it operates today and how it intends to operate and support projected needs in the future—that is, its target architecture. Federal guidance states that enterprise architectures should identify the data that are to be exchanged, the frequency and nature of the exchanges, and the business processes supported by the data exchanges. For SSA to ensure that its target architecture provides for a future IT infrastructure that will support its expanding data exchange environment, the agency should conduct the analyses needed to project the numbers of data exchange transactions along with the frequency and nature of the data exchanges (that is, whether the transactions are batch or online, and how frequently they will be conducted) expected from its partners in the future. Agency officials have recognized the need for a target architecture that addresses requirements for data exchanges. For example, in 2008, an SSA workgroup conducted an analysis to address management and technical issues related to its data exchanges, which was intended to support planning for its growing data exchange program. Among other things, the workgroup recommended to the Commissioner of Social Security that the agency devote sufficient resources to develop a well-defined target architecture that is sufficiently scalable to meet the agency’s future needs for supporting data exchanges. However, while SSA has developed a target architecture describing applications and service components that are used to support the agency’s business operations, according to the Directors of the Division of Information, Verification and Exchange Services, and of the Office of Strategic Services, the agency has not developed a target architecture that addresses specific business and technical requirements for supporting the agency’s data exchange programs. Moreover, these directors stated that the current agencywide target architecture does not specifically address data exchanges with external organizations. Lacking sound projections of future workloads, SSA will not be able to clearly define specific requirements for meeting the increasing demands on its data exchange environment. Moreover, without a target architecture that addresses specific requirements for supporting the agency’s data exchange programs, the agency cannot be assured that its IT infrastructure will provide the resources and levels of service required to meet the future needs of its data exchange partners. Consequently, SSA’s ability to continue to effectively and efficiently support its partners’ future needs for electronic data exchange services could be jeopardized. SSA’s existing IT infrastructure effectively supports its current outgoing electronic data exchange environment and provides the agency’s partners with data that support and enhance their abilities to carry out business operations. The state and federal partners included in our study experienced few or no problems associated with the agency’s IT infrastructure. However, the agency and its partners anticipate that the demand for these exchanges will grow, and that the methods for conducting the exchanges will become more complex. Nonetheless, SSA has not performed the detailed analyses needed to project the workload and performance requirements of a future data exchange environment. While it has defined an agencywide target architecture, this architecture does not address specific business and technical requirements for supporting the agency’s data exchange programs. Until it conducts these analyses, the agency will lack information essential to developing a target architecture for an IT infrastructure that effectively supports the ability of data exchange partners to carry out their business operations in the future. To help ensure that SSA’s IT infrastructure effectively supports the anticipated increase in demand for electronic data exchange services, we recommend that the Commissioner of Social Security direct the Associate Commissioner, Office of Earnings, Enumeration and Administrative Systems to conduct detailed analyses to determine workload projections and define requirements for effectively and efficiently delivering data exchange services to the agency’s partners in the future and use the results of these analyses to update the agency’s target architecture to address business and technical requirements of a future data exchange environment. The Commissioner of Social Security provided written comments on a draft of this report. In the comments, the agency agreed with our recommendations and stated that it would conduct detailed analyses to determine workload projections and define future requirements for delivering data exchange services as funding is available. Further, the Commissioner stated that it would use the results of the analyses to update the agency’s target architecture to ensure that it addresses the business and technical requirements of a future data exchange environment. If these actions are taken, the agency should be better positioned to meet the growing needs of its data exchange partners. SSA also provided technical comments, which we have incorporated into the report as appropriate. The agency’s written comments are reproduced in appendix II. As agreed with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days from the date of this letter. At that time, we will send copies of the report to interested congressional committees, the Commissioner of Social Security, and other interested parties. This report will also be available at no charge on our Web site at http://www.gao.gov. Should you or your staff have questions on matters discussed in this report, please contact me at (202) 512-6304 or melvinv@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III. Our objectives were to (1) determine the extent to which the Social Security Administration’s (SSA) information technology (IT) infrastructure effectively and efficiently supports its current data exchange programs, and describe any systems-related problems affecting the agency’s data exchange partners and (2) describe SSA’s efforts to ensure that its IT infrastructure can support the agency’s and its partners’ future data exchange environment. To address both of these objectives, we focused our study on SSA’s data exchanges that provide information to support state and other federal agencies’ programs, and that affect partners’ abilities to provide services to individuals—that is, “outgoing” data exchanges. To determine whether SSA’s existing IT infrastructure is effective in supporting the agency’s data exchange programs, we first identified the components of the infrastructure that support the agency’s data exchange programs. To do this, we obtained and analyzed agency documentation, such as internal management reports; spreadsheets describing data exchange programs, partners, and systems; descriptions of systems development and IT management processes; and descriptions of IT infrastructure components. To assess the reliability of the data provided by SSA, we held discussions with agency officials who were knowledgeable about the agency’s data exchange infrastructure and determined that the data were sufficiently reliable for the purposes of our engagement. From our assessment of this information, we identified and selected systems that are key to enabling the exchange of electronic data—that is, those that support the largest number of outgoing data exchanges, are used by the most partners, and process the largest number of data requests. We verified our selection through discussions with the Director, Division of Information, Verification and Exchange Services. We held discussions with additional agency officials, including the Associate Commissioner, Office of Earnings, Enumeration and Administrative Systems; Associate Commissioner, Office of Systems, Electronic Services; Assistant Associate Commissioner, Office of Telecommunications and Systems Operations; Director, Office of Systems Security Operations Management; Director, Office of Electronic Information Exchange; and Director, Office of Strategic Services. We also reviewed documentation describing the agency’s plans to make improvements to its IT infrastructure and discussed these plans with agency officials. Additionally, we interviewed state and federal data exchange partners to obtain their views on the ability of SSA’s IT infrastructure to provide data that support their business operations. To determine the extent to which systems-related problems exist and affect SSA’s data exchange partners and their ability to carry out business operations, and how the agency resolves these problems, we selected and obtained the views of partners from multiple agencies in five states, a third-party consortium that represents states and territories that participate in two of SSA’s data exchange programs, and four federal agency partners. Together, these state and federal partners represented 24 programs that are supported by SSA’s data exchanges. Our criteria and methodology for selecting these partners are described later in this appendix. We discussed with these partners their experiences with SSA’s data exchanges, including the extent to which their ability to conduct business operations are affected by systems-related problems associated with the agency’s IT infrastructure. We reviewed and assessed documentation provided to us that described the types of systems-related problems that partners encountered in exchanging data. We also interviewed two SSA regional office data exchange coordinators to discuss any systems-related problems identified or reported to them by the partners they support, and to obtain information about programs that together fully utilize the IT infrastructure components that support the data exchange environment. To describe SSA’s efforts to ensure that its IT infrastructure can support the agency’s and its partners’ future data exchange environment, we held discussions with the agency officials and state and federal partners that we have previously described and examined data provided by SSA that illustrated increased transaction volume from 2007 to 2008. We also obtained and reviewed documentation that described increased requests for online access to certain data exchange systems over the past 24 months. Additionally, we reviewed relevant SSA strategic planning documents, including its IT strategic plan and vision document to identify plans related specifically to data exchanges. We assessed these plans to identify activities specifically related to data exchanges and to determine the extent to which they addressed projected data exchange workloads and the IT resource requirements for efficiently and effectively supporting future requirements. In addition, we interviewed SSA officials and data exchange stakeholders familiar with the agency’s data exchange programs to identify the agency’s plans for addressing future data exchange workloads, including ensuring that its IT infrastructure can adequately support future demands for outgoing data exchanges to other federal and state agencies. We confirmed the information gathered from SSA’s regional data exchange coordinators and systems officials by corroborating it with selected other state and federal exchange partners. We determined that the information gathered was sufficiently reliable for the purposes of our review. Further, at the conclusion of our study in September 2009, we validated the examples of state and federal agencies’ experiences with SSA’s data exchanges with officials from those agencies. To select state and federal data exchange partners for this study, we identified a nonprobability sample based on our review of information provided by agency officials that listed and described all of the data exchange programs supported by SSA. From the list provided by the agency, we identified 814 outgoing data exchanges—those through which SSA provides data to state and other federal agencies. Of these exchanges, we identified 663 that provide SSA data to agencies in all 50 states, the District of Columbia, and 4 territories (American Samoa, American Virgin Islands, Guam, and Puerto Rico), and 83 that provide data to 16 federal agencies. From the 50 states, we selected 5 states based on the number of SSA data exchange programs in which they participate and the types of state programs the exchanges support (e.g., driver’s license issuance, voter registration, unemployment benefits administration, social services administration, and other programs). In selecting the 5 states, we identified 2 states that participated in the most data exchanges, 1 state that participated in a intermediate number of exchanges, and 2 states that participated in the fewest data exchanges. The 2 states participating in the most data exchanges were New York and California (25 and 19 data exchanges, respectively). The 1 state we selected with the intermediate number of data exchanges was Idaho (12 data exchanges). The 2 states participating in the fewest data exchanges were North Carolina and Iowa (10 and 9 data exchanges, respectively). We held discussions with officials from each of the states’ agencies that receive data through SSA’s data exchange programs to obtain information about any systems-related problems they may have experienced and the actions taken by SSA to resolve problems. Table 6 shows the states and agencies within those states that we contacted. We also held discussions with SSA’s major stakeholder user group organization—the American Association of Motor Vehicle Administrators (AAMVA)—which provides data exchange support to state driver’s licensing administrations and supports voter registration through the Help America Vote Verification system. We contacted chief information officers from each of the five selected states and AAMVA to obtain contact information for the officials responsible for the programs and systems that receive electronic data through participation in SSA’s data exchange programs. We based our selection of federal data exchange partners on the scope and impact of the agencies’ programs supported by SSA’s data exchanges on the country’s population, including veterans’ programs beneficiaries, government and private employers, U.S. passport holders and applicants, U.S. tax filers, and Medicare beneficiaries. We held discussions with agency officials regarding the following federal programs to obtain information about their experiences with SSA’s data exchange programs and the systems that support them: the Department of Veteran Affairs, Veterans Benefits Administration’s benefits and insurance programs, and the Veterans Health Administration health care administration program; the Department of Homeland Security employment eligibility program; the Department of State’s passport verification and foreign service retiree benefit payment programs; and the Department of Health and Human Services, Centers for Medicare and Medicaid Services’ Medicare benefits administration program. Since we selected a nonprobability sample, the information obtained through discussions with the selected state and federal data exchange partners is not generalizable across the entire population of SSA’s data exchange partners. In addition to the contact named above, key contributions to this report were also made by Teresa F. Tucker, Assistant Director; Michael A. Alexander; Tonia B. Brown; Barbara S. Collier; Rebecca E. Eyler; Neil J. Doherty; Nancy E. Glover; Jacquelyn K. Mai; Lee A. McCracken; Thomas E. Murphy; Madhav S. Panwar; and Brandon S. Pettis.

Summary: The Social Security Administration (SSA) receives electronic data from other agencies to support its own programs, and provides electronic data to support more than 800 state and federal agency partners. This information aids in, among other things, the processing and distribution of beneficiary payments and the delivery of services such as driver's license issuance and voter registration. SSA relies on its information technology (IT) infrastructure--its databases, applications, networks, and IT management practices--to support its current and future needs for exchanging data with its state and federal partners. GAO was asked to (1) determine the extent to which SSA's IT infrastructure effectively and efficiently supports current data exchanges, and any system-related problems affecting its exchange partners; and (2) describe SSA's efforts to ensure that its IT infrastructure can support the agency's and its partners' future data exchange environment. To do this, GAO analyzed agency documentation and interviewed SSA officials, as well as federal and state data exchange partners. Systems-related problems that affect SSA's ability to support outgoing data exchange programs have been few, and the agency has established effective procedures and mechanisms for addressing the problems that do occur. In this regard, SSA provides help-desk and on-site support to data exchange partners to help prevent or resolve problems, and uses procedures supported by a problem-identification and tracking system to facilitate problem resolution. State and federal partners with whom GAO held discussions stated that these efforts resulted in quick responses from SSA and effective resolution of problems that occurred. For example, a system that provides information for two data exchange programs that support driver's license issuance and voter registration in all 50 states was reported to have had almost 100 percent availability during the hours specified in the agreements governing these data exchanges. Further, all of the data exchange partners with whom GAO held discussions reported that the data that SSA provided were reliable. As a result, these partners stated that their ability to conduct business operations that depend on SSA data was not adversely affected by systems-related problems associated with SSA's IT infrastructure. SSA and its partners anticipate that the number of requests for outgoing data exchanges will continue to increase and that the exchanges will become more complex as agencies request that these exchanges take place through online, real-time transactions. However, SSA officials stated that the agency's existing IT infrastructure may not be able to support the increased demand that they and their partners anticipate. To address overall agency needs for a more cost-effective and efficient computing environment, the agency is taking steps to modernize its computing capabilities and supporting infrastructure. For example, the agency is in the process of implementing an updated database environment and upgrading its software applications--steps that are intended to enable expanded and more efficient IT service delivery, including the electronic exchange of data. However, the agency has not fully implemented IT management practices specifically related to its outgoing data exchange environment, such as conducting thorough analyses to project the expected increase in requests for data and online access. Conducting these analyses and using this information as input to the agency's target architecture (i.e., a formal description of the agency's future environment) are important practices to clearly define future requirements to guide the direction of the agency's data exchange programs. Implementing these management practices is essential to ensuring that the agency is well positioned to meet the growing needs of its data exchange partners.