HHS is the primary organization within the federal government that is devoted to protecting the health of Americans. It provides essential human services, such as ensuring food and drug safety and assisting needy families. HHS administers more grant dollars than all other federal agencies combined, providing over $200 billion of the more than $350 billion in federal funds that were awarded to states and other entities in fiscal year 2002, the most recent year for which these data are available. For fiscal year 2005, HHS had a budget of $581 billion and a workforce of over 67,000 employees. To accomplish its mission, HHS is comprised of 12 component agencies and several staff offices that cover a wide range of activities—including conducting and sponsoring medical and social science research, guarding against the outbreak of infectious diseases, assuring the safety of food and drugs, and providing health care services and insurance. The Office of the Secretary consists of several staff divisions and offices, including the Office of the Assistant Secretary for Budget, Technology, and Finance. The HHS Office of the Chief Information Officer (CIO) is located within this staff office (see fig. 1). Information technology investments play a critical role in helping HHS carry out its diverse mission. According to the President’s most recent budget, HHS expects to spend about $5 billion in IT in fiscal year 2006, making the department’s IT investment budget the third largest in the federal government. As figure 2 illustrates, approximately $3 billion is designated as grants to states for investments for Medicaid programs and other purposes, such as child support enforcement systems. Approximately $2 billion is for discretionary investment spending, of which 89 percent is used to fund IT investments for component agencies; 7 percent is invested in HHS enterprisewide initiatives; and 4 percent is used to fund other initiatives, including Office of the Inspector General IT investments. Table 1 provides additional information about the component agencies and their estimated IT budget for fiscal year 2006. HHS’ investments reflect the diversity of the department’s missions and operating environments. For example, HHS currently has several enterprisewide IT initiatives that enable stakeholders to advance the causes of better health, safety, and well-being for American people. These initiatives include: Unified Financial Management System, a new core financial system, to help management monitor budgets, conduct operations, evaluate program performance, and make financial and programmatic decisions. As a core financial system, it will interface with an estimated 110 other HHS information systems. The Office of the Assistant Secretary for Public Health Emergency Preparedness maintains a command center where it can coordinate the response to public health emergencies from one centralized location. This center is equipped with satellite teleconferencing capability, broadband Internet hookups, and analysis and tracking software. In addition, HHS’s component agencies have several projects and systems that are critical to the effective implementation of HHS’s mission, including the following: The Food and Drug Administration’s Automated Drug Information Management System is to be developed as a fully electronic information management system that will receive, evaluate, and disseminate information about investigational and marketing submissions for human drugs and therapeutic biologics. The National Institutes of Health’s major IT initiative, the Clinical Research Information System, is a comprehensive effort to modernize the systems that support clinical care and the agency’s collection of research data for the intramural clinical research programs. The Centers for Disease Control and Prevention’s major IT initiative, Public Health Information Network, is a national initiative to implement a multiorganizational business and technical architecture for public health information systems. In January 2004, we reported on a broad view of the government’s implementation of investment management practices at 26 major departments and agencies, including HHS. We also reported—and HHS acknowledged—that there were serious weaknesses in investment management. Notably, the department had not yet established selection criteria for project investments or a requirement that investments support work processes that have been simplified or redesigned. In addition, the department did not have decision-making rules to guide oversight of IT investments, review projects at major milestones, or systematically track corrective actions. Accordingly, we made several recommendations, including that HHS revise its investment management policy and require PIRs to address validating benefits and costs. In response to our recommendations, the department has been modifying several of its investment management policies, including its capital planning and investment control guidance and its governance policies. More recently, in June 2005, we reported that the HHS IT Investment Review Board had conducted only budgetary reviews of the Centers for Disease Control and Prevention’s Public Health Information Network and some of its initiatives, until this past February, when HHS initiated steps for better monitoring of system development projects. We concluded that until management implements a systematic method for IT investment reviews, it will have difficulty minimizing risks while maximizing returns on these critical public health investments. HHS has several groups and individuals involved in managing both the enterprisewide and component agency IT investments. They are involved from reviewing and approving a proposed IT project, through the process of budgeting for it, monitoring it through implementation, and evaluating it at its conclusion. The composition, roles, and responsibilities of these individuals and groups are described below: Information Technology Investment Review Board (ITIRB)—Chaired by HHS’s CIO, this board is responsible for selecting, controlling, and evaluating all departmental IT investments. Members include the Deputy Assistant Secretary for Budget, Finance, Performance and Planning; the Directors for Acquisition Management Policy and Human Resources; and the component agency CIOs. The board is supported by an executive secretary who is responsible for, among other things, managing the flow of IT investment documentation, scheduling meetings, and assisting the members in preparing for their meetings. Currently, this board reviews all enterprisewide investments and delegates responsibilities for component agency investments to each individual component agencies investment review boards in accordance with departmental policies and procedures. CIO Council—Also chaired by the HHS CIO and comprised of component agency CIOs, this board advises the HHS ITIRB on the technical soundness of all IT investments that require departmental review and provides recommendations regarding, among other things, technical aspects of affordability, soundness of design, risk, and compliance with architectural and security standards. Critical Partners—Comprised of departmental officials from various functional areas, including enterprise architecture, security and privacy, acquisition management, finance, budget, human resources, and e-government; this group is responsible for ensuring that most investments comply with the HHS policy in each of the functional areas and for advising the HHS ITIRB and individual IT investment managers on issues in their areas of expertise. Each review results in a determination whether the investment is approved, conditionally approved, or not approved. A not approved result is flagged for executive review. Business Case Quality Review Team—Comprised of component agency officials, this group evaluates the justifications for IT investments—both formal business cases and information documented in the department’s portfolio management tool’s Select forms—against the criteria used by the Office of Management and Budget’s to evaluate business cases agencies submit to the office as part of the formulation of the federal budget and provides recommendations for improving these justifications. Capital Planning and Investment Control (CPIC) Reengineering/Portfolio Management Tool (PMT) Implementation Team—Chaired by the Office of the CIO officials with representatives from the Critical Partners and the Business Case Quality Review Team, this group advises the board on issues regarding investment management policies and procedures and the implementation of the department’s portfolio management tool. Investment Managers—Responsible for managing investments in accordance with approved cost, schedule, and performance baselines, and for maintaining information on project status, control, performance, risk, and corrective actions. The department has defined a three-phase process for managing investments that involves selecting proposed projects and reselecting ongoing projects (select phase), controlling ongoing projects through development (control phase), and evaluating projects that have been deployed (evaluate phase). The department retains direct management of HHS enterprisewide IT investments and delegates considerable authority for other investments to component agencies. Specifically, the department selects ongoing and new component agency investments through the process for selecting enterprisewide IT investments described below. Controlling and evaluating component agency IT investments are delegated to the component agencies, which are required by the department to follow a process similar to the one described below. Each phase of the process for enterprisewide investments is comprised of multiple steps that set out requirements needed for the HHS ITIRB to make the decision to move forward with the project. The purpose of the select phase is to ensure that HHS chooses the projects that best support its mission and applies resources to the most important and valuable investments. The select phase is also intended to help the department justify budget requests by demonstrating sound business cases and project plans. To select investments, HHS has established two separate components—investment screening for new investment proposals and investment scoring and screening for ongoing investments. During the new investment screening, the investment manager is expected to develop a project prospectus, which identifies a specific business need and preliminary, high-level system requirements. A high-level determination of resource and schedule requirements is also to be conducted as part of the business need identification activities. Approval of the project prospectus by the HHS ITIRB signifies that the agency agrees that the need is critical enough to proceed to the next step in which the business case is developed. During business case development, the investment manager is required to develop the business case, which establishes the lifecycle cost, schedule, benefits, and performance baselines and includes an analysis for each investment to identify alternatives that may satisfy the needs of the department. In addition, the investment managers sign a document called the accountability agreement form to accept responsibility for reporting on the project status in achieving performance baselines throughout the remaining phases of the investment management process.