According to the Director of HSWL, who was appointed to the position in August 2015, financial, technical, schedule, and personnel risks led the Coast Guard’s Executive Oversight Council to decide to terminate the IHiS project in October 2015: Financial risks. Internal investigations were initiated in January 2015 and May 2015 to determine whether the HSWL Directorate had violated the Antideficiency Act by using incorrect funding sources and incorrect fiscal year funds for the IHiS project. The Coast Guard ordered project management and contractor staff to cease work on IHiS until a determination was made regarding the antideficiency violation. Technical risks. IHiS lacked an independent security assessment and full interface testing to ensure security and data integrity. In addition, key functionality for the system, such as user verification, had not been completed. Schedule risks. The HSWL Director stated that she requested that the Department of Defense’s (DOD) Defense Health Agency Solution Delivery Information Technology (IT) team independently validate the IHiS timelines and the status of the project in 2015 because of the identified technical risks and concerns as to whether the system would be ready to be piloted in the fall of 2015. According to the Director, the Defense Health Agency team projected the timeline for the first clinic implementation to be approximately 1 year later than originally estimated due, in part, to incomplete interfaces and workflows. Personnel risks. Although HSWL staff had been managing the IHiS project since it was initiated in 2010, Command, Control, Communications, Computers, and Information Technology (C4&IT) was directed to assume the oversight responsibilities for IHiS implementation in May 2015. This action was due to concerns about the project’s adherence to established governance processes raised by the internal investigators looking into the potential Antideficiency Act violations. By August 2015, the key HSWL project management personnel that had overseen the project since 2010 had been removed. As a result of the changes in staff, one vendor noted that it was unclear as to who were the stakeholders, responsible parties, and decision makers. According to an analysis conducted by the Coast Guard, which included obligations and expenditures from September 2010 to August 2017, the agency had obligated approximately $67 million for the IHiS project and, of that amount, had spent approximately $59.9 million at the time of its cancelation. In addition, over 2 years after the project’s cancelation, the Coast Guard continued to pay vendors. In this regard, it paid approximately $6.6 million to vendors between November 2017 and February 2018 to satisfy existing contractual obligations for services such as leased equipment that was damaged or missing; software licensing and support; a data storage center; and removal and shipment of equipment. Further, according to staff in Coast Guard’s Office of Budget and Programs, no equipment or software from the IHiS project could be reused for future efforts. The Coast Guard could not demonstrate that it effectively managed and oversaw the IHiS project prior to its discontinuance, and did not document and share valuable lessons learned from the failed project. Specifically, although the Coast Guard was to follow its System Development Life Cycle (SDLC) Practice Manual to guide its management and oversight of the project, the agency could not provide complete evidence that it had addressed 15 of the 30 SDLC practices we selected for evaluation. For example, the Coast Guard could not demonstrate that it had conducted IHiS system testing, although the agency granted an authority to operate (ATO) and indicated in the ATO memorandum that the system had undergone some form of testing. The Coast Guard’s SDLC specifies that system testing is to take place prior to the issuance of an ATO. Project team members provided inconsistent explanations regarding whether or not documentation existed to demonstrate the actions taken to manage and oversee the project. The absence of the various documents and other artifacts that would support the required SDLC activities raises doubts that the Coast Guard took the necessary and appropriate steps to ensure effective management of the IHiS project. Further, although the Coast Guard developed charters for various governance boards to provide project oversight and direction, the boards were not active and the Chief Information Officer (CIO) was not included as a member of the boards. Taking steps to fully implement governance boards that include the CIO will be important to the Coast Guard’s oversight efforts in implementing a future EHR system and may decrease the risk of IT project failure. Lastly, although Coast Guard officials stated that lessons learned had been identified throughout the process of developing IHiS, as of 2 years after its cancelation, the agency had not documented and shared any lessons learned from the project and did not have established plans for doing so. Until the Coast Guard takes steps to document and share identified lessons learned with individuals charged with developing and acquiring its IT systems, opportunities to protect future systems against the recurrence of mistakes that contributed to the failure of IHiS will likely be missed. In the absence of an EHR system, the Coast Guard is relying on a predominately paper health record management process to document health care services for its nearly 50,000 military members. Currently, the Coast Guard’s clinical staff perform various manual steps to process each paper health record. For example, clinical staff schedule appointments for patients using Microsoft Outlook’s calendar feature and provide the patient with paper forms for completion upon his or her arrival. In addition, clinical staff must handwrite clinical notes in the paper health record during the appointment, as well as handwrite prescriptions, among other manual processes. In response to our survey, the 12 HSWL Regional Managers identified a number of challenges that clinics and sick bays in their regions had experienced in managing and maintaining paper health records. These challenges were grouped into 16 categories. Further, the 120 clinic and sick bay administrators that subsequently responded to a separate survey reported varying degrees to which they viewed each category as challenging. Figure 1 provides the clinic and sick bay respondents’ views of the top four challenges. With regard to these top four challenges to managing and maintaining paper health records, clinic and sick bay respondents offered the following examples: Incomplete records. Ninety-eight (82 percent) of the respondents reported incomplete records as challenging. In this regard, 34 of the survey respondents reported that not all records from the Coast Guard legacy EHR systems were printed out and included in patients’ paper health records as required before the systems were retired. Thus, they had no way to ensure the patients’ paper records were complete. Penmanship. Among the 91 (76 percent) survey respondents that reported penmanship as challenging, several respondents noted that it is difficult for staff to read illegible handwritten medical notes. This, in turn, results in difficulty determining the accurate diagnosis, the required prescription, or a referral. Tracking medications. According to 89 (76 percent) of the respondents, it is challenging to track medications without an EHR. For example, one administrator stated that staff members rely heavily on patients to remember what medications they are taking—potentially causing harm if patients cannot remember what medications they are taking and the medications have dangerous interactions. Amount of time to manage records. According to 86 (72 percent) of the respondents, managing paper health records is challenging and requires more time for staff to complete and file paperwork. Several respondents stated that the size of the paper health records has increased, resulting in additional time required to review and file records. The responding clinic and sickbay administrators described a range of alternative work-around processes that they have developed to help alleviate several of the challenges. Specifically, they reported having developed additional forms, tracking methods, and alternative processes, as well as having notified Coast Guard HSWL management of the challenges they face. However, these alternative processes may not provide sustained solutions to overcoming these challenges. Until Coast Guard implements a new EHR solution, the challenges inherent in a predominantly paper process will likely remain. The Coast Guard has begun taking steps to acquire a new EHR system referred to as the Electronic Health Record Acquisition (eHRa). The Coast Guard plans to manage and oversee the acquisition of eHRa through its non-major acquisition process (NMAP), as described in its Non-Major Acquisition Process (NMAP) Manual. NMAP requires formal approval reviews at three discrete knowledge points called acquisition decision events (ADE) and includes three phases to assess the readiness and maturity of the acquisition. The Coast Guard formally identified the need for a new EHR system on February 1, 2016, and obtained approval for the first of three ADE’s on February 13, 2016. It subsequently initiated market research activities by collecting cost, schedule, and capabilities information from commercial and government solution providers, including DOD and the Department of Veterans Affairs. The Coast Guard used the providers’ responses to develop an alternatives analysis report that was completed in October 2017. The report recommended a solution based on performance, risk, cost, and schedule advantages. The report indicated that the Coast Guard plans to use the results of the alternatives analysis to refine the acquisition strategy, and to support the development of artifacts which are required to successfully achieve the ADE-2 milestone. Staff within the Acquisitions Directorate stated that they were also in the process of finalizing a life cycle cost estimate and a project plan for eHRa—documents necessary for ensuring that appropriate business decisions will be made regarding eHRa’s logistics, affordability, and resources, among other things. As of December 2017, the Coast Guard had not yet made a final determination as to which option would be chosen as the solution for the eHRa acquisition. Our report that is being released today contains four recommendations to the Coast Guard. Specifically, we recommend that the Coast Guard: expeditiously and judiciously pursue the acquisition of a new EHR ensure established processes required for the future acquisition or development of an EHR are effectively implemented and adequately documented; direct the Chief Information Officer and the Chief Acquisition Officer to establish and fully implement project governance boards for the future EHR effort that include the Chief Information Officer; and document any lessons learned from the discontinued IHiS project, share them with the new project management team, and ensure lessons learned are utilized for the future EHR effort. The Department of Homeland Security concurred with our four recommendations and identified actions being taken or planned to implement them. If the Coast Guard fully and effectively implements our recommendations, many of the challenges faced by its clinics and sick bays and the thousands of Coast Guard members utilizing its health services could be diminished. In summary, given the numerous challenges inherent with managing and maintaining paper health records, it will be important for the Coast Guard to prioritize obtaining an EHR for its thousands of members. Until a solution for its EHR system is chosen and successfully implemented, the agency is likely to continue to face these challenges. In addition, ensuring established project management and governance processes are effective, as well as documenting and sharing lessons learned, will be essential in avoiding past mistakes and helping to ensure a successful implementation of a future EHR solution at the Coast Guard. Chairman Hunter, Ranking Member Garamendi, and Members of the Subcommittee, this concludes my prepared statement. I would be pleased to respond to any questions that you may have. If you or your staff have any questions about this testimony, please contact David A. Powner, Director, Information Technology Management Issues, at (202) 512-9286 or pownerd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony statement. GAO staff who made key contributions to this statement are Nicole Jarvis (Assistant Director), Ashfaq Huda (Analyst in Charge), Sharhonda Deloach, Rebecca Eyler, Monica Perez-Nelson, and Scott Pettis. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: In 2010, the Coast Guard initiated an effort—known as IHiS—to replace its aging EHR system with a new system that was to modernize various health care services for its nearly 50,000 military members. However, in October 2015, the Coast Guard announced that the modernization project would be canceled. GAO was asked to summarize its report that is being released today on the Coast Guard's actions related to its EHR modernization initiative. GAO's testimony specifically addresses Coast Guard's (1) reasons for deciding to terminate further IHiS development; (2) management and oversight actions for the discontinued project and whether lessons learned were identified; (3) current process for managing health records and the challenges it is encountering; and (4) plans for effectively implementing a new EHR system and the current status of its efforts. In preparing the report on which this testimony is based, GAO reviewed IHiS project expenditures; analyzed key project management documentation; surveyed Coast Guard's Regional Managers and clinical staff; and interviewed key staff. Financial, technical, schedule, and personnel risks led to the United States Coast Guard's (Coast Guard) decision to terminate the Integrated Health Information System (IHiS) project in 2015. According to the Coast Guard (a military service within the Department of Homeland Security), as of August 2017, $59.9 million was spent on the project over nearly 7 years and no equipment or software could be reused for future efforts. In addition, the Coast Guard could not fully demonstrate the project management actions taken for IHiS, lacked governance mechanisms, and did not document lessons learned for the failed project. In the absence of an electronic health record (EHR) system, the Coast Guard currently relies on a predominately paper health record management process to document health care services. Currently, the Coast Guard's clinical staff perform various manual steps to process each paper health record. Coast Guard Regional Managers and clinic and sick bay administrators informed GAO of the many challenges encountered in returning to a paper process. These challenges include the inability for some clinics to adequately track vital information such as medications—potentially causing harm to members if they take medications that have dangerous interactions. To help alleviate several of these challenges, the Coast Guard has developed alternative work-around processes. However, these alternative processes may not provide sustained solutions to overcoming these challenges. In February 2016, the Coast Guard initiated the process for acquiring a new EHR system. As of November 2017, agency officials had conducted research and recommended a solution based on performance, risk, cost, and schedule advantages. However, 2 years after canceling IHiS and moving toward a predominately manual process, the agency has not yet made a final determination on this. Successfully and quickly implementing an EHR system is vital to overcoming the challenges the Coast Guard currently faces in managing paper health records. The expeditious implementation of such a system can significantly improve the quality and efficiency of care to the thousands of Coast Guard active duty and reserve members that receive health care. In the report being released today, GAO is recommending that the Coast Guard (1) expeditiously and judiciously pursue a new EHR system, and in doing so (2) ensure key processes are implemented; (3) establish project governance boards; and (4) document lessons learned from the IHiS project. The Department of Homeland Security concurred with GAO's recommendations.