The Medicare program’s day-to-day operations rely on numerous large- scale information systems, which house or process information on, among other things, beneficiaries’ enrollment and utilization of services, claims, and payments to providers. These systems serve Medicare’s traditional fee- for-service component, which enrolls the bulk (about 85 percent) of the program’s beneficiaries, and the managed care component, which enrolls the rest. CMS—along with about 50 insurance companies with which it contracts to process Medicare claims—operates these systems. Contractors use one of Medicare’s several standard systems to process fee-for-service claims. Fiscal intermediaries are contractors that process part A claims (claims for hospital services and care provided by other institutional providers, such as skilled nursing facilities), while carriers are contractors that process part B claims (claims for physician care and other covered expenses, such as laboratory services). The fiscal intermediaries use one of two standard systems to process part A claims; the carriers use one of four standard systems to process part B claims. These contractor-run standard systems review claims to ensure that all required fields are complete, conduct utilization checks to determine whether the services provided correspond to the beneficiary’s diagnosis, and calculate the payment amount for the claim. Contractors sometimes modify the standard claims processing systems they have adopted to address local claims processing needs, such as determinations as to whether claims are payable given their local medical coverage policies. Contractor-processed claims are then transmitted to a CMS-operated prepayment validation and authorization system. This system—called the Common Working File (CWF)—screens the priced claims for consistency with rules, eligibility for coverage, and duplication with previously processed claims and then approves, adjusts, or denies payment accordingly. In the early 1990s, HCFA launched a large systems modernization initiative to replace Medicare’s multiple, contractor-operated claims processing systems with a single, more technologically advanced one. It was envisioned that the new, single-system computing environment would result in simplified program administration and reduced administrative costs, comply with Year 2000 standards, and improve the agency’s ability to spot improper billing practices. However, this initiative failed through a series of planning and development missteps. When the contract for this initiative was terminated in August 1997, Medicare was left with numerous independent systems that needed Year 2000 modifications. The Year 2000 work delayed other planned IT initiatives, including the consolidation of Medicare’s standard claims processing systems—an initiative designed to reduce maintenance costs and some inconsistencies across the different contractor systems. CMS is now refocused on modernizing its IT environment to better implement congressionally mandated payment policy and other modifications and on modernizing its information systems. Critical responsibilities for leading these IT efforts reside with the agency’s Chief Information Officer (CIO), who heads CMS’ Office of Information Services (OIS). Under the CIO’s direction, OIS is responsible for managing the acquisition and operation of CMS’ information systems that are enterprisewide—those affecting the agency as a whole. It is also responsible for setting agencywide IT policies with which the agency’s three major organizational units, or programmatic “centers”—such as the Center for Medicare Management and the Center for Beneficiary Choices—and its other administrative offices must comply in their efforts to develop systems to support statutory and administrative program requirements. In addition to OIS, other units share responsibility for various aspects of CMS’ IT activities. CMS’ programmatic centers and its administrative offices are generally charged with developing, acquiring, and maintaining systems that are specific to their individual missions, under the CIO’s guidance and direction. For example, CMS’ Center for Beneficiary Choices is responsible for systems that contain information on Medicare+Choice plans; CMS’ administrative Office of Financial Management is responsible for systems that track agencywide financial transactions for accounting purposes. In the last decade, the agency has faced heightened expectations for payment accuracy, program integrity, and the timely implementation of new and complex payment methods. Efforts to meet these expectations have brought the agency’s IT and data quality deficiencies into sharp focus. In response, CMS has begun several modernization initiatives and has planned others that are intended to help the agency demonstrably boost the performance of its core functions. One of CMS’ fundamental responsibilities, to process and pay health care claims, is a highly automated operation that relies on multiple, large-scale computer systems run by Medicare contractors. Through the computerized screening of claims, the contractors seek to ensure that beneficiaries are properly enrolled in the program and that any changes to their status are promptly updated. The contractors also seek to ensure that payments are made only to health care professionals who are authorized to bill Medicare and that the amount paid for, and the services delivered to, a beneficiary are consistent with program rules. In a static environment, efficiently processing almost a billion claims from almost a million hospitals, and other health care providers each year would be task enough. However, the Medicare claims processing systems are subject to frequent modifications to reflect regular annual updates, new policies, and changes in statutory requirements. In recent years, when major Medicare legislation added new benefits and created new payment methods to improve the program’s fiscal health, many system changes had to be implemented. According to the Blue Cross and Blue Shield Association, which represents many of Medicare’s contractors, in calendar year 2000 contractors received 719 formal change orders—more than two and a half times the number received in fiscal year 1998. These orders are instructions sent by CMS for contractors to modify their claims processing systems. Implementing changes can be complicated and resource-intensive. Even though there are six standard systems, contractors have their own systems, in addition, to perform certain claims administration functions. As a result, for some changes, individual contractor sites require separate programming solutions. In addition, as systems have been altered over the decades, the alterations have not always been properly documented. Thus, implementing new changes, in some instances, takes considerable time and programming expertise. The difficulties of implementing changes complicate CMS’ efforts to respond to new legislative requirements. Changes required by the Balanced Budget Act of 1997 (BBA) provide a recent illustration. In 2000, when the BBA-mandated prospective payment method for home health services was implemented, the standard systems had to adopt a complex claims pricing logic, requiring the retrofitting of systems that were designed to use a much simpler set of payment rules. For a time, some providers reported that claims that should have been promptly paid were inappropriately denied or suspended for further review. Program monitoring and oversight is another critical agency function that is fundamental to ensuring that Medicare beneficiaries have access to quality health care services and that the program is paying claims properly. This function is particularly important to guard against unintended effects as payment methods undergo change. BBA and subsequent legislation gave CMS significant tools to adjust its payment methods, but inadequacies in CMS’ information systems have made it difficult to implement these measures and to track the effect of program changes. For instance, monitoring the effectiveness of program policies requires obtaining timely and accurate information about the services beneficiaries receive and the payments made to their providers. However, CMS’ IT systems have often been of little help. The reason is that several of CMS’ key databases—such as its National Claims History (NCH) database, which maintains the electronic files of Medicare’s paid claims—are structured in a way that makes the quick retrieval of beneficiary utilization and provider payment information difficult. Retrieving data from hundreds of millions of claims and generating statistics to answer policy questions requires special programming for each query and may take months. Similarly, the design and stand-alone nature of the various systems that maintain Medicare’s financial information limit CMS’ ability to respond promptly to financial status questions, such as how much money in overpayments is owed to Medicare. To answer such questions, CMS must rely largely on its claims administration contractors’ systems, which produce a fragmented, rather than coherent, picture of the financial matter at hand. These problems have been exacerbated by lapses in ensuring data quality. At times, CMS has used data from separate systems that were neither updated on the same schedule nor subsequently reconciled. As a result, CMS lacks key financial information needed to properly manage the program. For example, the Medicare fee-for-service accounts receivable net balance was more than $3.7 billion at the end of fiscal year 2000. However, CMS could not generate a complete and up-to-date list of delinquent debts that it could use to monitor the efforts of its contractors to refer such debts for collection. A third critical management function involves the oversight of Medicare+Choice—Medicare’s managed care component. In Medicare+Choice, health plans compete for Medicare beneficiary enrollees by offering additional benefits—such as coverage for outpatient prescription drugs—at low or no premiums. To give beneficiaries managed care choices, CMS has to collect and disseminate information about plans to inform beneficiaries and then be able to record and maintain information on the beneficiaries’ enrollment choices, once they have enrolled in plans. CMS also collects and analyzes information to ensure that payments to managed care organizations are appropriate. The agency’s managed care functions are currently supported by a “family” of systems, and these systems, in turn, interface with other application systems and databases. Some of the systems were developed a decade ago and have been modified many times to meet increasingly complex requirements and growing capacity demands. The current systems are labor-intensive to modify and validate and do not respond promptly to beneficiary enrollment and health plan inquiries. According to CMS officials, the underlying structure of these systems limits the extent to which additional modifications are possible. Properly adjusting plan payments is another area in which CMS’ current systems do not provide adequate support to the agency. BBA required the agency to refine its managed care rate adjuster to better reflect patients’ health status. The adjustment is designed to pay health plans appropriately when they enroll a disproportionate number of healthier or sicker than average beneficiaries. Calculating this adjustment requires data on enrollees’ use of medical services, known as encounter data. However, CMS’ existing systems are not organized to maintain service utilization data at the individual enrollee level, thus impeding efforts to modify the rate adjuster as required. In 1998, HCFA developed a strategic vision for agencywide IT modernization in which modular units that perform different functions would be interconnected with central databases. The central databases— such as those for maintaining beneficiary data and claims history data— are being designed to serve as the source from which agency systems obtain information. This structure is designed to reduce redundancy in data maintenance and modification efforts and improve data consistency and quality. CMS’ current plans for implementing modernization improvements include making incremental changes to some systems while replacing others with more advanced technology. Already under way are CMS efforts to consolidate its standard claims processing systems to ease the burden of modifying multiple systems. CMS is reducing the number of standard processing systems from six to three—one for fiscal intermediaries, one for other carriers, and one for Durable Medical Equipment Regional Carriers (DMERC). (See app. II for more detail on this consolidation.) According to CMS officials, reducing the number of standard systems will reduce maintenance costs and inconsistencies across the different contractor systems and simplify making program changes. CMS is also planning to redesign the CWF, the critical prepayment system in the overall claims process. Prior to paying a claim, the contractors submit their claims to the CWF to check whether the claim is for a valid beneficiary and whether the beneficiary is entitled to the service, in order to authorize the claim for payment. Several key activities are fully dependent on the effectiveness and operational quality of the CWF, including program safeguard checking, query resolution, and compiling information on approved claims for parts A and B services. In other modernization efforts, CMS intends to substantially improve its ability to monitor the care provided to beneficiaries and payment integrity in Medicare’s fee-for-service component. One project is to replace Medicare claims history files with a modern database that can be readily queried and can generate up-to-date information quickly. The new system—the National Medicare Utilization Database (NMUD)—will use advanced database management software to enhance and speed data access. CMS tested the ability of an NMUD prototype to answer complex questions about beneficiaries’ use of services and provider payments and found that it could respond—in a matter of hours—to queries that had taken weeks to answer using CMS’ previous technology. With regard to fiscal management, CMS has a system development initiative under way to improve its underlying financial reporting systems. Called HCFA’s Integrated General Ledger Accounting System (HIGLAS), the system will be designed to interconnect with the agency’s other financial and claims processing systems, including a new system intended to improve contractors’ efforts to recover Medicare payments that should have been made by another insurer. The Medicare payment recovery system is expected to, among other things, establish and maintain accounts receivables associated with contractors’ recovery activities. To improve the use of its systems containing managed care data, CMS has several initiatives under way designed to perform functions required by BBA, such as conducting an information campaign to educate beneficiaries about competing health plans and refining payment adjustments. Among other things, the agency is doing the following work. CMS is building a new data repository within its Health Plan Management System (HPMS) that will collect and maintain data about plan benefit packages, premiums, and service areas. HPMS is expected to enable CMS to conduct an improved information campaign to educate Medicare beneficiaries about plan options and conduct better oversight of health plans’ offerings and the quality of care provided to enrollees. CMS is obtaining medical encounter data from the new NMUD claims history database so that it can develop health plan payment adjusters based on patient health status. With such a large array of routine operations, systems maintenance, and critical system improvement activities under way, CMS needs well- developed IT planning and implementation oversight processes. Although CMS has a strategic vision and has made progress in developing key IT planning documents, certain gaps remain in the documentation of the agency’s current and planned IT environments and in its process to manage IT investments. If not addressed, CMS’ IT planning and investment management weaknesses could put critical modernization efforts at risk. Although CMS has made notable progress in developing the foundation for its blueprint of its current and planned systems environment—its enterprise architecture—critical elements are not in place or have not been developed in sufficient detail. CMS’ enterprise architecture is contained in a multivolume document presented in a framework consistent with Office of Management and Budget (OMB) and other federal guidance. The agency’s enterprise architecture includes, among other things, a broad description of core program and operational activities, their purpose, and the centers or administrative offices responsible for their performance; a discussion of how technology is and will be used to support these activities; a general explanation of the policies, standards, and tools needed to develop IT applications and ensure system security; a broad description of CMS’ hardware, software, and network technologies; and an explanation of the IT decision-making hierarchy and process for resolving disputes. Key pieces of the architecture document, however, are either incomplete or have not been developed at all. To develop some of these, CMS’ programmatic staff play a significant role. For example, Major “business” functions, such as claims processing, are not well documented in terms of the key steps in how the activities are conducted, what agency units are involved, and what might cause the function to change. Without this documentation, CMS cannot easily reengineer its operations in line with the agency’s system modernization efforts. The agency’s information flows—indicating how information is shared across the agency—have not been developed in detail. The data model that is intended to chart the location of, and relationships between, common data elements in CMS’ various IT systems is also incomplete. As of July 2001, the model included data on use of services by Medicare beneficiaries and on enrollment and managed care, as well as Medicaid data. CMS officials told us that they intended to model financial data as part of HIGLAS, but had not begun to do so. There are no plans in the near future to include quality of care data. The officials attributed the data model completion problems to insufficient staff to conduct this effort and budgetary constraints. For a description of additional elements that are weak or missing from the architecture document, see appendix III. With key descriptions of the agency’s IT environment missing from the enterprise architecture, CMS lacks sufficient detail to formally map the implementation steps to move from its existing IT environment to the one outlined in the agency’s enterprise architecture and then take those steps. This map is known as a “migration plan.” It is typically developed from a “gap analysis,” or study of the differences between the agency’s current and desired IT environments and includes required hardware and software changes. A migration plan can suggest the priorities for, and sequencing of, future IT development—with scheduled milestones for system upgrades, modifications, and development consistent with the agency’s capacity to handle these changes. CMS’ 5-year information resources management plan discusses in a broad way certain projects that it considers key to its modernization effort, but it does not indicate how these projects will be ranked in order of priority. CMS is beginning to develop a strategy for moving toward its desired IT environment but has not completed a detailed migration plan. The absence of such a migration plan can create difficulties when CMS is determining its project priorities. In addition to having a blueprint, having a process to manage IT investments can help mitigate modernization risks. CMS’ IT workload includes major systems developments, systems operation maintenance, and systems modifications, such as those designed to implement program changes. An effective IT investment management process is critical to ensure that resources are used as effectively as possible. Federal requirements and guidance direct agencies to manage their IT projects as a portfolio of investments. This involves developing a process that (1) establishes project selection criteria and quantifies the benefits and risks of each project, (2) ensures that projects continue to meet mission needs and provides senior management with progress reports that detail each project’s cost, quality, and timeliness, and (3) includes a project evaluation phase that can inform future project selection and management. An IT investment management process following this guidance is intended to provide agencies with the information needed to better control their IT budgets; reduce the risks associated with building, acquiring, and maintaining systems; and increase the likelihood of improving program operations. The number and complexity of CMS’ IT projects require a strong agencywide IT investment management process. As of January 2001, 102 of the 183 IT projects under way were classified by CMS as complex and expensive (levels C and D). (See table 1.) Because they take longer to implement and are more costly, they pose a greater risk to the agency. The rest were classified as lower cost or short-term projects—such as systems maintenance and 1-year purchases and leases (levels A and B). A little over 40 percent of level C and D projects are managed directly by OIS. The rest are managed primarily by the center or administrative office responsible for the program activity to which the project is linked, while OIS maintains an oversight and technical assistance role. For example, the Office of Financial Management has primary responsibility for nearly half of non- OIS level C and D projects because they generally relate to maintaining or improving systems that provide financial management or program integrity information. CMS’ process for selecting and managing these substantial projects falls short of recognized commercial and public sector best practices and guidance in the following ways. Despite the importance of involving senior-level management in reviews of project cost, quality, and timeliness, executive-level monitoring of critical IT projects at CMS is uneven. CMS’ Executive Council, in conjunction with its Financial Management Investment Board (FMIB), serve as its IT investment review board as required by federal law. The FMIB reviews project funding requests annually when it defines funding priorities and makes its annual funding recommendations to the Executive Council, and the Executive Council is briefed on the progress of some of the projects. The CIO receives monthly status reports on about a third of the major projects OIS manages. However, neither the FMIB nor the CIO routinely receives status reports on projects managed by the agency’s program units, particularly such critical projects as the development of the system needed to maintain information on Medicare+Choice plans. Without their systematic involvement, senior managers will not be able to make timely and appropriate decisions if cost, schedule, and performance outcomes are not achieved. CMS has not formally defined criteria for project funding. The agency’s FMIB bases its decisions on high-level criteria that are used for selecting IT investments. These criteria are focused on meeting mission needs, but do not include explicit cost, schedule, benefit, or risk criteria— considerations that would be helpful in making trade-offs among investments competing for limited resources. In addition, CMS has not developed written selection criteria. Some projects were approved for funding before the benefits and risks, including technical considerations, had been analyzed and reported. HCFA implemented a database for tracking IT projects in mid-1999. However, at the time of our review, the database was not useful for monitoring projects. Our review of records and discussions with project managers indicated that cost, schedule, and milestone information in the database was missing, incomplete, or outdated. CMS does not conduct project evaluations, making efforts to examine a project’s performance relative to expectations and efforts to identify lessons learned largely haphazard. Although officials told us that they intend to add a postimplementation review process, details and milestones to put this step in place have not been developed. In response to these acknowledged weaknesses, CMS officials told us of several improvements planned or under way. During our review, CMS issued a guide to implementing more structured controls in its investment management process. As part of its improvements, the agency has begun to implement a more effective project selection process. For example, “seed money” funding to develop a business case analysis for a project— which includes a study of the project’s estimated costs, benefits, and risks—before proceeding with further development was provided for some CMS’ newest major projects, including the CWF redesign project.The business case analysis is intended to provide the FMIB with more information on the project’s needs, scope, and cost when making funding decisions. CMS also expects to implement more structured management controls, including ongoing CIO monitoring for cost, performance, and scheduling of level C and D projects, with technical reviews performed at critical project milestones. For example, CMS plans to have the CIO Technical Advisory Board perform technical reviews of projects at the end of the design phase and before testing is performed, but the details of this process have not been finalized. In addition, CMS implemented a new version of its IT investment database in November 2000 with enhancements intended to improve its usefulness in tracking project spending and performance. Despite the actions taken and planned, however, achievement of the agency’s IT goals remains at risk until these and other key improvements are fully implemented in its IT planning and management efforts. The weaknesses identified in CMS’ IT planning efforts and project management procedures are part of a larger set of interrelated problems involving the agency’s budget, workforce, and strategic management approach. CMS’ budget and workforce are not commensurate with the agency’s congressionally mandated workload. At the same time, however, CMS has made limited use of performance measures to achieve accountability and results. Developing major projects while maintaining current IT systems and infrastructure and other programmatic operations is an expensive undertaking that involves difficult budgetary trade-offs. As the agency’s mission has grown over the years, its discretionary dollars that fund IT and other operations to adminster its programs have been stretched thinner. Budget pressures have forced the Congress to make difficult decisions to limit agencies’ discretionary spending. Like many other federal agencies, CMS has been operating with a discretionary budget to administer its programs that has only slightly increased over the past 10 years. Yet, during the last decade, mandatory spending on Medicare benefit payments has doubled, and CMS’ overall and IT workload increased appreciably. This is due mainly to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and BBA requirements and new non-Medicare programmatic responsibilities, such as the State Children’s Health Insurance Program (SCHIP). BBA alone had 335 provisions requiring CMS to make substantial changes to the Medicare program. In 1998—a key BBA implementation year—the agency was doing this work with about 1,000 fewer employees than it had in 1980. In fiscal year 2000, Medicare’s operating costs represented less than 2 percent of the program’s benefit outlays, far below the percentage for private or nonprofit insurers, even after accounting for differences in the functions each performs. CMS’ IT projects compete for resources with other agency responsibilities of national importance, some of which are also lacking in funds and staff. For example, in the area of nursing home quality, CMS has made negligible use of its most effective oversight technique—a federally conducted nursing home inspection to assess how well state inspectors have identified serious deficiencies in nursing facilities. Conducting these independent inspections, known as comparative surveys, is important to check the quality of state inspections because some state inspectors have missed significant problems. However, CMS has lacked sufficient staff to perform an adequate number of these checks. CMS’ ability to oversee the performance of its Medicare claims administration contractors is similarly constrained. After weaknesses in contractors’ performance of critical activities to assure accurate payment were detected, in fiscal year 2001, the agency requested funding for 100 additional positions to focus on key contractor oversight activities, such as monitoring claims processing and reviewing payments made to providers. With the many program priorities in CMS—including maintaining current systems—allocating funds for IT improvements is a difficult juggling act. Currently, HIGLAS, which is CMS’ planned financial management system now under development, is one of the agency’s top IT priorities. It is expected to have the capacity to aggregate financial information that now resides in the stand-alone claims processing systems of the contractors. The agency allotted an additional $10 million to HIGLAS for its development in fiscal year 2001 to purchase and customize needed software. At the same time, funding had to be decreased or eliminated entirely for other systems, including the Provider Enrollment, Chain and Ownership System (PECOS), a centralized national provider enrollment database; NMUD; and the Contractor Management Information System (CMIS), a contractor monitoring database. (See table 2 for discussion of the role these systems are designed to play in modernizing Medicare.) Delays in developing these systems have considerably slowed efforts by CMS and its contractors to conduct Medicare program monitoring and policy development activities more competently and efficiently. Because CMS must make trade-offs that affect its ability to manage the Medicare program, having a process to manage its IT and other programmatic investments can help ensure that the most critical activities are funded. The development of CMS’ database for beneficiaries’ use of services—NMUD—is a case in point. CMS originally allotted $600,000 to the NMUD project for fiscal year 2001. However, this amount did not reflect the funds needed to build in the capacity to assemble and maintain beneficiary encounter data used in Medicare+Choice to fulfill the BBA requirement for a health-based risk adjuster. Once staff recognized the necessity of storing encounter data, CMS redistributed IT funds to support developing a component in NMUD that had the capacity to assemble and maintain those data in a user-friendly format. One of the difficulties of trying to conduct long-term improvement projects is that unexpected new priorities requiring immediate attention, such as new program requirements with short implementation time frames, can push longer term projects to the end of the funding queue. For example, due to an unexpected spike in claims processing and appeals workloads, CMS staff told us that claims administration contractors would either need to be allocated more funding than anticipated in fiscal year 2001 or the contractors would have to shift funds from other functions, such as their provider and beneficiary education efforts, to address added claims processing and appeals workload. Statutory mandates often have hidden systems costs that can become ongoing expenses for which the agency does not get additional funding. For example, while adding an improved risk adjuster for Medicare+Choice appeared to be a small legislative provision, maintaining information for the risk adjuster will end up costing the agency about $20 million to $30 million per year as a new, ongoing cost. The success of CMS’ efforts to modernize its systems and implement effective planning and management processes hinges on its ability to build, prepare, and manage its IT workforce. However, CMS already has a shortage of skilled IT staff and, like other agencies, faces challenges to fill its gaps. Staff shortages—in terms of skills and numbers—have seriously undercut CMS’ efforts to carry out IT best practices. The CIO told us that OIS staffing levels and expertise are not adequate to simultaneously conduct the system maintenance, contract monitoring, and system development work that is being demanded of the staff. Specifically, CMS officials pointed to data security and project management as areas where expertise needs strengthening. According to the CIO, some IT security projects have been delayed for at least a year because OIS lacked employees with requisite skills. CMS also faces the possibility of losing its current employees who have technical and managerial expertise. An estimated 36 percent of the agency’s computer and telecommunications specialists are eligible to retire by the end of fiscal year 2005. In efforts to recruit new employees, CMS—like other federal agencies—must cope with the demand for, and at times short supply of, qualified IT workers. Despite the recent economic slowdown, employers from every sector, including the federal government, are still finding it difficult to meet their needs for highly skilled IT workers. In the long term, demand for skilled IT personnel is likely to increase. In order to address its skill needs, CMS has begun an agencywide workforce planning effort, which includes assessing employees’ IT skills through a survey. However, as noted, CMS lacks a complete architecture and migration plan to detail its current capacity and proposed IT needs. Without such information about its needs, CMS will have difficulty determining the skills needed to accomplish its IT modernization. In addition, the agency has not developed a comprehensive plan for using training, hiring, outsourcing, and retention strategies to fill skill gaps and staffing needs. Part of CMS’ challenge for planning its future workforce is to determine the right balance between work performed by CMS employees and by contractors. Despite CMS’ many resource-related challenges—including rehabilitating its information systems—the agency has not documented its resource needs well. In January 1998, we reported that the agency lacked an approach—consistent with the Government Performance and Results Act of 1993 (GPRA)—to develop a strategic plan for its full range of program objectives. Since then, the agency has developed a plan, but it has not tied global objectives to day-to-day program operations. To encourage a greater focus on results and improve federal management, the Congress enacted GPRA—a results-oriented framework that encourages improved decision-making, maximum performance, and strengthened accountability. Managing for results is fundamental to an agency’s ability to set meaningful goals for performance, measure performance against those goals, and hold managers accountable for their results. In May 2001, we reported on the results of our survey of federal managers at 28 departments and agencies on strategic management issues. The proportion of CMS managers who reported having output, efficiency, customer service, quality, and outcome measures was significantly below that of other government managers for each of the performance measures. CMS was the lowest-ranking agency for each measure—except for customer service, where it ranked second lowest. Moreover, CMS managers’ responses concerning whether they were held accountable for results to a great or very great extent—42 percent—was significantly lower than the 63 percent reported by the rest of the government. Apart from any other challenge, no agency can function effectively without adequate resources coupled with appropriate accountability mechanisms. Adequate resources are vital to support the kind of oversight and stewardship activities that Americans have come to count on from the Medicare program—inspection of nursing homes and laboratories, certification of Medicare providers, and collection and analysis of critical health care data, to name a few. In the case of other agencies or programs with serious resource challenges, the Congress has helped jump-start improvements by providing agencies with additional funds tied to improvements in management capability. In conjunction with such an increase in resources, CMS needs to have its IT funded at adequate levels to ensure both that the existing systems can be maintained and replaced by more functional, modernized systems and that its IT can provide more effective and efficient mission support. Providing IT funding that can be obligated over a multiyear period provides added flexibility when developing long-term projects, such as new systems. In the case of CMS, such additional multiyear funding would provide the stability and flexibility the agency needs to maintain and modify some systems while gradually replacing or redesigning others. As it has done in other cases, the Congress could provide CMS the funding in a separate account or line item appropriation, if that were deemed necessary to ensure that the money would be used for IT purposes. CMS’ IT funding levels should support and be commensurate with demonstrated improvements in key IT management capabilities. This includes the further development of its enterprise architecture and migration plan and enhanced IT investment management processes to strengthen its decision-making. Further development of its enterprise architecture and investment management processes will help ensure the most effective use of funds. However, CMS will need support while further developing its enterprise architecture and management process because it cannot abandon its current efforts. These include maintaining current systems and ongoing improvement efforts as well as responding to needed programmatic changes that require IT solutions. Without such concurrent efforts, the performance of key Medicare operations could be jeopardized, a situation that would be unacceptable to beneficiaries and providers and inconsistent with congressional expectations for implementing legislative mandates effectively within reasonable time frames. Providing additional funds could be made contingent on the agency making sufficient progress in developing its enterprise architecture, investment practices, and human capital capabilities, and on providing the Congress with a detailed annual plan for its IT modernization efforts. With Medicare reform at the forefront of the nation’s domestic agenda, the IT environment in which the program operates day-to-day must be capable of supporting effective program management and adaptable to change and innovation. In our view, the successful modernization of CMS’ systems is fundamental to a health financing program that can serve its major stakeholders—beneficiaries, health care providers, and taxpayers—with the efficiency and effectiveness that will be demanded of such a program in the future. The role of CMS in strengthening its IT modernization efforts is clear. To ensure greater rigor in the execution of its systems renovation and development, the agency must develop key IT planning documents and requisite processes that are currently lacking. This includes further developing the enterprise architecture documentation, particularly the agency’s information flows and data elements. However, this cannot be accomplished by OIS alone. The agency’s top leadership must engage the efforts not only of the technical staff in OIS but also of staff members in program and administrative units to complete its enterprise architecture plans. The participation of key program and administrative staff members is particularly important to establish the processes needed to ensure data reliability and relevance. In conjunction with CMS’ other units, the CIO needs to develop a migration plan that will prioritize and sequence IT projects so that officials throughout the agency understand the roadmap they are following to move toward a modernized IT environment. CMS must also tighten project review, approval, and evaluation procedures, ensuring that the selection and management of IT projects receive adequate attention from senior officials agencywide. Selection and management would be strengthened when CMS develops and uses written criteria to prioritize project selection, requires technical reviews, and has an adequate agencywide process for monitoring the status of projects. In addition, CMS is not currently realizing the full value of lessons learned from its modernization efforts because it does not have a systematic process to evaluate them. Such an evaluative process could help the agency capitalize on successes and avoid obstacles in developing its next generation of projects. Furthermore, while CMS has been taking steps to assess its workforce skills, it still needs to complete its assessment of IT staffing needs and identify and fill skill gaps. Given the importance of human capital to achieving mission results, such a deficit leaves the agency more vulnerable to IT development mishaps. The combination of stronger IT management plans and processes, coupled with adequate resources, would improve the chances that CMS’ IT challenges will be met. We believe that the Congress can address both the agency’s resource needs as well as its tactical management shortcomings. The Congress could provide CMS with additional funding—with authority to obligate the funds over several years—but could tie the agency’s authority to obligate funds to a requirement that it invest, and demonstrate improvements, in its IT planning and investment management, as well as its human capital management. With the certainty of longer term project funding tied to an increased expectation for performance and accountability, the likelihood of achieving success in modernizing Medicare’s information systems could be greatly improved. To help CMS successfully modernize its IT environment, the Congress may wish to provide additional, multiyear funding for CMS’ IT projects, under certain conditions that link funding increases to efforts to improve and demonstrated progress in technical, program, and human capital management. Because the absence of an effective enterprise architecture and IT investment management process hinders CMS’ ability to manage its IT environment, the Congress may wish to consider making the authority to obligate funds contingent upon the agency using the funds initially to support only ongoing program operations, maintenance of existing systems, and IT projects currently under way; efforts to develop an effective enterprise architecture and IT investment management process, as well as to obtain the human capital needed to modernize IT practices and operations; and statutorily required activities. The Congress may wish to make subsequent funding available for new IT development projects contingent on the agency’s (1) providing a satisfactory plan specifying the use of funds for the upcoming fiscal years and (2) demonstrating sufficient progress in implementing the following recommendations for improving critical IT capabilities necessary to successfully manage large and more complex projects. We recommend that, to ensure the success of the agency’s IT modernization, the Administrator of CMS and its senior management become more involved in IT planning and management efforts, and thus elevate the priority given to these efforts throughout the agency. To improve development and implementation of the agency’s enterprise architecture, the Administrator should direct center and administrative unit officials to complete, in conjunction with OIS, the enterprise architecture documentation, particularly of the business functions, information flows, and data elements for the systems for which their respective units are responsible, and direct the CIO to specify in a migration plan the priorities for, and sequencing of, IT projects. To improve the investment management process, the Administrator should establish sufficient and written criteria to ensure a consistent process for funding IT projects agencywide; require that major IT projects undergo a technical review before the agency approves them for further development; direct the CIO and FMIB to develop sufficient information to monitor the status of IT projects; establish a systematic process for evaluating completed IT projects that includes cost, milestone, and performance data; and direct the CIO to develop an IT workforce strategy that outlines a plan to assess staffing needs, identify skill gaps, and fill the gaps. In written comments on a draft of this report, CMS officials said that they had undertaken a series of steps to make the agency more responsive to beneficiaries and to changes in the health care industry, and that strengthening management of its IT was essential to the success of these efforts. They stated that resource limitations have hampered their implementation of some IT management processes as well as the development of several key systems modernization efforts. Notwithstanding these resource limitations, agency officials agreed that they would take steps to address the weaknesses identified in this report, but were not specific about the actions that they would take. In addition, CMS provided technical comments, which we incorporated where appropriate. CMS’ written comments are reprinted in appendix IV. As agreed with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days after the date on this letter. At that time, we will send copies to the Secretary of the Department of Health and Human Services, the CMS Administrator, interested congressional committees, and others. We will also make copies available upon request. If you or your staff have any questions about this report, please contact me at (312) 220-7600. Another contact and GAO staff acknowledgments are listed in appendix V. Our review of CMS’ IT modernization efforts described aspects of CMS’ current IT environment and projects CMS has under way to improve its systems, examined the agency’s IT planning efforts and IT management process, and discussed the challenges that need to be addressed to meet the agency’s IT goals. We focused specifically on CMS’ ability to support Medicare’s claims processing, financial management, and managed care activities. To these ends, we did the following. We interviewed the agency’s program managers and staff responsible for contractor oversight, financial management, and managed care activities and discussed the information systems that support these functions as well as the development and management of projects to consolidate, replace, or redesign these systems. In addition, we discussed the architectural plan and investment management processes with the CIO, the Chief Architect, and the Executive Secretary of FMIB as well as other CMS IT officials. We assessed the agency’s compliance with applicable sections of the Clinger-Cohen Act of 1996, OMB’s guidance related to IT architectural plan development and the acquisition and management of information resources, and our architectural plan and IT investment management guidance. We analyzed the agency’s enterprise architecture, IT Investment Management Process Guide, and related documentation. We reviewed internal documents, such as IT Council meeting minutes, funding and spending plans, and the charters for various entities involved in the IT architectural plan and IT investment management processes. We examined the agency’s IT investment database, which is used to track agency IT projects. We examined documents and interviewed officials regarding the agency’s budget formulation and IT funding. This included reviewing documents on Medicare’s administrative budget, such as the agency’s operating plan for fiscal year 2001, and its budget justification and supporting documentation for fiscal years 2000 and 2001. It also included conducting interviews with agency officials in the Office of Financial Management, including the Chief Financial Officer, the Director of Budget Formulation, and the Executive Secretary of the FMIB, and IT project managers. We did not validate the accuracy of the data in the agency’s budget documents. We identified certain system changes mandated by HIPAA; BBA; the Medicare, Medicaid, and SCHIP Balanced Budget Refinement Act of 1999; and the Medicare, Medicaid, and SCHIP Benefits Improvement and Protection Act of 2000. We identified IT workforce challenges by reviewing agency policies, practices, plans, and current data on IT job series, retirement, hiring, training, and retention; interviewed relevant agency officials; and examined the consistency of the agency’s workforce planning efforts with Clinger-Cohen Act requirements and our human capital self-assessment checklist. To gain more insight into how CMS selects and manages IT projects, we reviewed eight IT projects, selected because they were (1) either level C or D, (2) in different life cycle stages (e.g., requirements definition, design, or operations and maintenance), and (3) managed by different CMS centers and offices. The following projects were selected: Medicare Managed Care System Redesign, Common Working File Redesign, Medicare Beneficiary Database, National Medicare Utilization Database, Health Plan Management System, Contractor Management Information System, Provider Enrollment Chain and Ownership System, and Medical Review for Skilled Nursing Facility Prospective Payment System. Our work was conducted from April 2000 through August 2001 in accordance with generally accepted government auditing standards. To reduce variation in claims processing and lower its systems maintenance costs, CMS is consolidating the number of IT systems used by its claims administration contractors to process Medicare fee-for- service claims. At present, the Medicare claims contractors use one of six systems. Two systems are used by fiscal intermediaries and four are used by carriers. All of the DMERCs use a single system. CMS plans to consolidate its claims processing into three selected systems: one for fiscal intermediaries, one for carriers, and one for DMERCs. Table 3 summarizes the planned consolidation for each type of contractor, the current systems used, and the anticipated completion date of these consolidation efforts. CMS’ enterprise architecture—a blueprint of the agency’s current and planned IT environment—is documented in a set of volumes, each detailing a different component of CMS’ IT environment. Described below are examples of missing elements from the business, information, application, infrastructure, and security volumes of CMS’ enterprise architecture and the potential impact on IT modernization efforts. In addition to the person named above, Margaret Davis, Hannah Fein, Sandra Gove, Norm Heyl, Erin Kuhls, Linda Lambert, Anh Le, Henry Sutanto, and Marcia Washington made key contributions to this report. Human Capital: Building the Information Technology Workforce to Achieve Results (GAO-01-1007T, July 31, 2001). Medicare Management: CMS Faces Challenges to Sustain Progress and Address Weaknesses (GAO-01-817, July 31, 2001). Medicare Management: Current and Future Challenges (GAO-01-878T, June 19, 2001). Health and Human Services: Status of Achieving Key Outcomes and Addressing Major Management Challenges (GAO-01-748, June 15, 2001). Managing For Results: Federal Managers’ Views on Key Management Issues Vary Widely Across Agencies (GAO-01-592, May 25, 2001). Major Management Challenges and Program Risks: Department of Health and Human Services (GAO-01-247, Jan. 2001). High-Risk Series: An Update (GAO-01-263, Jan. 2001). Human Capital: A Self-Assessment Checklist for Agency Leaders (GAO/OCG-00-14G, Sept. 2000). Federal Health Care: Comments on H.R. 4401, the Health Care Infrastructure Investment Act of 2000 (GAO/AIMD-00-240, July 11, 2000). Medicare: HCFA Faces Challenges to Control Improper Payments (GAO/T- HEHS-00-74, Mar. 9, 2000). Medicare Post-Acute Care: Better Information Needed Before Modifying BBA Reforms (GAO/T-HEHS-99-192, Sept. 15, 1999). HCFA Management: Agency Faces Multiple Challenges in Managing Its Transition to the 21st Century (GAO/T-HEHS-99-58, Feb. 11, 1999). Medicare Transaction System: Serious Managerial and Technical Weaknesses Threaten Modernization (GAO/T-AIMD-97-91, May 16, 1997). Medicare Transaction System: Success Depends Upon Correcting Critical Managerial and Technical Weaknesses (GAO/AIMD-97-78, May 16, 1997). Executive Guide: Improving Mission Performance Through Strategic Information Management and Technology (GAO/AIMD-94-115, May 1994).

Summary: Congress has questioned whether the Centers for Medicare and Medicaid Services (CMS), formerly the Health Care Financing Administration, adequately implemented new payment methods, effectively safeguarded program payments, and adequately oversaw the quality of care provided to beneficiaries. CMS depends on hundreds of information technology (IT) systems to help manage the Medicare program. With year 2000 systems renovations successfully completed, CMS has focused on modernizing its IT systems. The agency's information systems are crucial to carrying out Medicare's core missions of claims processing and payment, program oversight, and administration of participating health plans. Medicare's major systems are aged, however, and many are incompatible with one another. To address these problems, CMS intends to modify, replace, or redesign systems on which key Medicare missions depend. CMS plans to make incremental system improvements while maintaining current functions and accommodating changes mandated by legislation. The agency's IT planning and management processes--intended to increase the likelihood that new systems will be successful and cost-effective--have shortcomings. The agency's blueprint documenting its existing and planned IT environments, also known as its enterprise architecture, is missing essential detail in critical parts, including well-documented business functions, information flows, and data models. CMS is trying to strengthen its planning and has developed guidance for an improved management process, but will need to make considerable effort to ensure that modernization stays on track. These weaknesses in IT planning and management are part of larger agency management challenges. Resource gaps, both in funding and staff expertise, threaten the success of planned IT improvements. At the same time, CMS has made little use of performance measures to ensure accountability and increase the likelihood of achieving results.