oversight

Reported Medicaid Year 2000 Readiness

Published by the Government Accountability Office on 1999-10-05.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

United States General Accounting        Office                                               Accounting   and Information
Washington, DC 20548                                                                                 Management    Division




           8-2838 15

          October 5, 1999

          The Honorable William V. Roth, Jr.
          Chairman
          The Honorable Daniel Patrick Moynihan
          Ranking Minority Member
          Committee on Finance
          United States Senate

          Subject: Reported Medicaid Year 2000 Readiness

           At your request, we determined (1) what the Health Care Financing Administration       (HCFA)
          was doing to ensure that the Year 2000 computing challenge does not adversely affect the
          delivery of Medicaid benefits and (2) the readiness of states’ to successfully transition to year
          2000 for Medicaid. On September 30, 1999, we briefed your offices on the results of our
          work. This report provides a high-level summary of information presented at that briefing.
          Our briefing slides are enclosed.

          Background

          In fiscal year 1998, Medicaid paid about $169 billion for medical services to millions of
          recipients. A joint federal-state program overseen by HCFA and administered by the states,
          Medicaid provides health coverage for about 33 million low-income people, which include
          children, the elderly, blind, and disabled individuals.

          The federal government has a large vested interest, both programmatically and monetarily, in
          automated state systems that support the Medicaid program. Accordingly, it is essential that
          states successfully address the Year 2000 computing problem. Unless they do, beneficiaries
          could be denied critical medical services, incorrect eligibility decisions could be made, and
          payments could be made for the wrong amounts-or not at all.

           HCFA’s Actions Have Reduced the
           Risk of Year 2000-Induced Failures

          HCFA has taken several actions that have significantly reduced the risk that the Medicaid
          program will encounter Year 2000 failures. In particular, it has adopted an approach that

           ‘In the context of this report, the term state includes the District of Columbia, Puerto Rico, and the Virgin
           Islands.


                                                            GAO/A&ID-00-22R               Year 2000 Status of Medicaid
United States General Accounting           Office                                         Accounting   and Information
Wzhington,   DC 20548                                                                             Management     Division




          B-2838 15

          October 5, 1999

          The Honorable William V. Roth, Jr.
          Chairman
          The Honorable Daniel Patrick Moynihan
          Ranking Minority Member
          Committee on Finance
          United States Senate

           Subject: Renorted Medicaid Year 2000 Readiness

           At your request, we determined (1) what the Health Care Financing Administration (HCFA)
           was doing to ensure that the Year 2000 computing challenge does not adversely affect the
           delivery of Medicaid benefits and (2) the readiness of states’ to successfully transition to year
           2000 for Medicaid. On September 30, 1999, we briefed your offices on the results of our
           work. This report provides a high-level summary of information presented at that briefing.
           Our briefing slides are enclosed.

          Background

           In fiscal year 1998, Medicaid paid about $169 billion for medical services to millions of
           recipients. A joint federal-state program overseen by HCFA and administered by the states,
           Medicaid provides health coverage for about 33 million low-income people, which include
           children, the elderly, blind, and disabled individuals.

           The federal government has a large vested interest, both programmatically and monetarily, in
           automated state systems that support the Medicaid program. Accordingly, it is essential that
           states successfully addressthe Year 2000 computing problem. Unless they do, beneficiaries
           could be denied critical medical services, incorrect eligibility decisions could be made, and
           payments could be made for the wrong amounts-or not at all.

           HCFA’s Actions Have Reduced the
           Risk of Year 2000-Induced Failures

           HCFA has taken several actions that have significantly reduced the risk that the Medicaid
           program will encounter Year 2ooO failures. In particular, it has adopted an approach that

           ‘In the context of this   report,thetermstateincludesthe Districtof Columbia,Puerto Rico, and the Virgin
           Islands.


                                                             GAO/A&ID-00-22R            Year 2000 Status of Medicaid
includes three rounds of on-site contractor reviews of states (performed in conjunction with
HCFA regional and headquarters offices) using a standard methodology. Between
November 1998 and April 1999, the contractor completed the.initial round of on-site reviews
in all 50 states and the District of Columbia. These reviews included assessmentsof states’
integrated eligibility systems* and Medicaid management information systems (MMIS)3 in
areassuch as project management and planning, remediation progress, testing, and
contingency planning. After completing the on-site state review, the contractor (1) identified
barriers to successful remediation; (2) made recommendations to addressspecific areasof
concern; and (3) placed Medicaid integrated eligibility and management information systems
into low, medium, or high risk categories based on the quality and completeness of project
 management/planning, progress in remediation, quality management, testing, and
 contingency planning.

Since May 1999, HCFA’s contractor has (again, along with officials from HCFA regional
and headquartersoffices) conducted a second round of on-site reviews in 40 states-
primarily those in which at least one system had been categorized as a high or medium risk
during the initial visit. As in the first round, the state systems were placed in low, medium,
or high risk categories. A system’s risk level was determined based on the resolution of
critical issues previously identified, progress in remediation, testing, and senior management
support. During this round, HCFA’s contractor also conducted follow-up telephone calls to
four states not visited. HCFA’s third and final round of contractor visits began during the
last week of September. The list of states to undergo third-round visits has not been
finalized, but among the criteria HCFA plans to use is visiting states with the highest risk
systems and business continuity and contingency plans, as well as states with the largest
number of Medicaid recipients. In addition, agency officials told us that all states will either
be visited or undergo follow-up telephone calls.

To complement its system reviews, HCFA obtained another contractor to review state
business continuity and contingency plans. Such plans are crucial. Without them, if
unpredicted failures occur, an entity will not have well-defined responsesand may not have
enough time to develop and test alternatives. In June 1999, HCFA’s contractor began
reviewing the quality of state plans, based on either a desk audit or on both a desk audit and
an on-site visit. After the contractor’s review, each state’s business continuity and
contingency plan was placed into a high, medium, or low risk category basedon the
contractor’s evaluation of the state’s development process and the quality and completeness
of its plan. In September 1999, HCFA headquarters officials also began reviewing state
business continuity and contingency plans to determine whether any programmatic issues
neededto be addressed.

In addition to evaluating state system remediation activities and business continuity and
contingency plans, HCFA has provided assistance to states through the issuance of guidance
and best practices documents. Moreover, at the behest of HCFA, its contractors provided
three states with technical assistance on the development of business continuity and


‘Integrated eligibility systems determine whether an individual applying for Medicaid meetsthe eligibility
criteria for participation. These systems are also often used to determine eligibility for other public assistance
p’ogr~~, such as Food Stamps.
  Medlcatd management information systems process claims and deliver payments for services rendered.



Page 2                                            GAO/AIMD-00-22R               Year 2000 Status of Medicaid
contingency plans and intends to continue providing such assistance. States can also obtain
technical assistance on testing and Day One strategies.”

Progress Made But Much Work Remains
To Ensure the Continuity of State Medicaid
Operations Into the Next Century

According to the system assessment contractor’s completed round 2 reports of 37 states and
the District of Columbia that had been visited during both rounds,5 half of the state systems
risk ratings improved, 45 percent stayed the same, and 5 percent declined. In summary, as of
October 4, 1999,

l     4 eligibility systems and 5 MMISs were assessedat high risk,
l     13 eligibility systems and .8 MMISs were assessedat medium risk, and
l     36 eligibility systems and 40 MMISs were assessedat low risk.6

While state risk ratings have generally improved, many issues continue to be unresolved.
Examples of open issues are testing in a future-date-compliant environment, which some
states have not scheduled until late in the year, and the lack of top management involvement.

HCFA’s business continuity and contingency plan contractor found problems in state efforts
as well. In particular, of the 33 states and two territories that have been reviewed,’ 11 were
considered high risk, 11 medium risk, and 13 low risk. In addition, many states were
reported to have open issues, such as insufficient plan details, inadequate project
documentation, and incomplete plans.

States that are in a particularly difficult position are those that have a high-risk system as well
as a high risk business continuity and contingency pl,an. Currently, two states fall into this
situation. Also in a difficult position are the six states with at least one medium-risk
Medicaid system and a high-risk business continuity and contingency plan.

ScoDeand Methodology

To determine what HCFA was doing to ensure that the Year 2000 challenge does not
adversely affect the delivery of Medicaid benefits, we reviewed key documents such as the
agency’s Year 2000 guidance and best practices. We also assessedHCFA contractors’
system readiness and business continuity and contingency planning methodologies, and
interviewed HCFA and contractor officials about these methodologies.

To ascertain the readiness of states to successfully transition to year 2000 for Medicaid, we
analyzed the assessmentand business continuity and contingency planning contractors’ final

‘A Day One strategy (also known as a day zero strategy) comprises a comprehensive set of actions to be
executed by a entity during the last days of 1999 and the first days of 2OOO.
‘As of October 4, 1999, 23 final and 17 draft reports for second-roundvisits were completed. Two of the draft
reports were for Puerto Rico and the Virgin Islands,which were not visited in the first round.
6Thirteenstateratings in the low-risk category are basedon the resultsof first-round visits becausethey were
not visited during the secondround.
‘As of October I, 1999, 15 state and the District of Columbia’s businesscontinuity and contingency planshad
not beenreviewed, and 2 stateshad not provided their plans to HCFA.


    Page 3                                     GAO/AIMD-00-22R              Year 2000 Status of Medicaid
and draft reports. In addition, we accompanied the system assessment contractor on its
second round of on-site visits to Delaware, New Hampshire, New York, North Dakota, Ohio,
South Carolina, Tennessee, and Vermont. We also interviewed state officials on their Year
2000 status. Further, we reviewed business continuity and contingency plans for five states
considered to be models by HCFA.

Prior to briefing your offices, we supplied copies of our briefing materials to HCFA officials
for comment, who agreed with the information provided. In addition, we subsequently
updated the information on our briefing slides to reflect the most current state data. We
conducted our review from June through October 4, 1999, in accordance with generally
accepted government auditing standards. Our work was done at HCFA’s headquarters in
Baltimore, MD, the assessment contractor’s headquarters in Columbia, MD, and in the eight
states we visited.



As agreed with your offices, unless you publicly announce the contents of this
correspondence earlier, we will not distribute it until 5 days from the date of this letter. At
that time, we will provide copies to Senators Robert F. Bennett, Chairman, and Christopher
J. Dodd, Vice-Chairman, Senate Special Committee on the Year 2000 Technology Problem;
Representatives Stephen Horn, Chairman, and Jim Turner, Ranking Minority Member,
Subcommittee on Government Management, Information, and Technology, House
Committee on Government Reform; Representatives Constance A. Morella, Chairwoman,
and James A. Barcia, Ranking Minority Member, Subcommittee on Technology, House
Committee on Science; and Representatives Bill Archer, Chairman, and Charles B. Rangel,
Ranking Minority Member, House Committee on Ways and Means. We are also sending
copies to the Honorable Donna Shalala, the Secretary of Health and Human Services; Mr.
Michael Hash, Deputy Administrator, Health Care Financing Administration; the Honorable
Jacob Lew, Director, Office of Management and Budget; and other interested parties. Copies
will also be made available to others upon request.

If you have any questions on matters discussed in this letter, please contact me at (202) 5 12-
6253 or by email me at willemsseni.aimd@gao.gov      or Linda Lambert, Assistant Director, at
(202) 5 12-9556 or by email at lambertl.aimd@gao.gov.     Key contributors to this assignment
were Norman Heyl, John Mollet, and John Snavely.




Director, Civil Agencies Information   Systems

Enclosure




(511801)




Page 4                                   GAO/AIMD-00-22R          Year 2000 Status of Medicaid
GAO
      Year 2000 (Y2K) Computing Challenge


      Y2K Readiness of State Medicaid
      Systems


      Briefing for the Committee on Finance,
      United States Senate

      September 30, 1999*

      *Information   in the slides   was updated   as of October   4, 1999.
GAO Overview


        l     Objectives
        l     Scope and Methodology
        l     Health Care Financing Administration (HCFA)
              Monitoring and Oversight
        l     Reported Status of States’ Systems Readiness”
        l     Reported Status of States’ Business Continuity and
              Contingency Plans
        l     Overall Observations


2   “In the context   of this briefing,   states can include   the District   of’ Columbia,   Puerto   Rico,   and the Virgin   Islands.
GAO       Objectives


      l   Determine what HCFA is doing to ensure that the
          Year 2000 challenge does not adversely affect the
          delivery of Medicaid benefits
      l   Determine the readiness of states to successfully
          transition to year 2000 for Medicaid




3
GAO Scope and Methodology


    l   Assessed HCFA contractors’ system readiness and
        business continuity and contingency planning
        methodologies
    l   Accompanied HCFA and its contractors on eight site
        visits
    l   Reviewed and analyzed key documents and available
        site visit reports
    l   Reviewed business continuity and contingency plans
        for five states considered to be models by HCFA


4
GAO Scope and Methodology (cont’d)


    l   Interviewed agency, contractor, and selected state
        officials on assessment and business continuity and
        contingency plan methodologies and states’ Y2K
        status.

    l   Our work was performed from June through
        October 4, 1999, in accordance with generally
        accepted government auditing standards.
GAO         HCFA Monitoring and Oversight


    l   HCFA has:
        0
            Obtained a contractor to perform comprehensive Y2K
            readiness assessments of states’ Medicaid systems.
        0
            Obtained another contractor to perform
            comprehensive reviews of states’ business continuity
            and contingency plans.
        0
            Provided states with Y2K guidance and best practices
            examples.
        0
            Provided three states with technical ‘assistance on the’
            development of business continuity and contingency
            plans. Technical assistance is also available in other
            areas, such as testing.      -
6
GAO Reported Status of State Readiness: Systems
    Risk Assessments

           l     HCFA intends that its assessment contractor will
                 conduct three rounds of site visits. During these site
                 visits, the contractor assessesstates’ Eligibility and
                 Medicaid Management Information Systems
                 (MMIS).a
           l    HCFA round 1 (November 1998 through April 1999)
                   l    During round 1, HCFA’s assessmentcontractor
                        (accompanied by HCFA personnel) conducted
                        comprehensive onsite assessmentsof all 50 states
                        and the District of Columbia.

7   ‘Some state integrated eligibility        systems determine  eligibility for the Medicaid     program as well as other state-administered
      public assistance programs, such as Food Stamps. MMIS process Medicaid                  claims and include beneficiary   and provider
      information.   Each state’s eligibility      and MMIS systems are unique due to the differences in state Medicaid        programs.
G-0       Reported Status of State Readiness: Systems
          Risk Assessments (cont’d)

      l   HCFA round 1 (cont’d)
          l   Each state system was placed into a low, medium,
              or high risk category based on the quality and
              completeness of project management/planning,
              remediation process, quality management, test.ing,
              and contingency planning.
          l   Reports to the states included issues (items that
              were considered to be “show stoppers”) and
              recommendations (items that, if completed, would
              improve the quality of the state’s Year 2000
              program).
8
GAO Reported Status of State Readiness: Systems
    Risk Assessments (cont’d)
    l   During round 1 site visits, some states requested
        additional HCFA actions. In response, HCFA
        l   issued guidance on interface agreements with
            Medicaid data exchange partners,
        l   issued a Business Continuity Handbook,
        l   issued seven issue papers on Y2K best practices,
        l   is developing other Y2K issue papers on topics
            such as validating business continuity and
            contingency plans and emergency procedures, and
        l   delayed changes to Medicaid dual eligibility
            reporting requirements until spring 2000.

9
GAO Reported Status of State Readiness: Systems
    Risk Assessments (cont’d)

     l   HCFA round 2 (May through September 1999)
         l   HCFA’s assessment contractor (accompanied by
             HCFA personnel) conducted comprehensive onsite
             assessments of 37 states and the District of
             Columbia, each of which had at least one high or
             medium risk system, to follow up on critical Y2K
             issues and barriers. Onsite assessments of Puerto
             Rico and the Virgin Islands, which were not
             covered in round 1, we.re also conducted.
         l   HCFA’ s contractor conducted follow-up telephone
             calls to four states not visited.
10
GAO Reported Status of State Readiness: Systems
    Risk Assessments(cont’d)
     0 Round 2 (cont’d)
        l   Each state system assessed was placed into low,
            medium, or high risk category, based on
            l   resolution of critical issues previously noted
            l   remediation progress, testing, and senior
                management support
        l   Reports to the states included whether prior issues
            and recommendations were addressed by the states
            as well as any new issues or recommendations.


11
G-0       Reported Status of State Readiness: Systems
          Risk Assessments (cont’d)
      l   HCFA round 3 (September through December 1999)
           l   began in the last week of September
           l   the list of states to undergo visits has not been
               finalized but among the criteria HCFA plans to use
               are to visit states with the highest risk systems and
               business continuity and contingency plans as well
               as states with the greatest number of Medicaid
               recipients
           l   followup phone calls are to be made to other states
           l   additional emphasis will be placed on areas such
               as day one planning, managed care organizations,
               and county eligibility determination
12
GAO Reported Status of State Readiness: Changes
    to System Risk Assessments

               Round One                                                    Round Two”
          l    Eligibility systems                                           Eligibility systems*
                l   8 high(16%)                                              4 high (10%)
                l  20 medium (39%)                                           13 medium (33%)
                l  23 low (45%)                                              23 low (58%)

         l    MMIS                                                           MMIS*
                l11 high (22%)                                               5 high (13%)
                l15 medium (29%)                                             8 medium (20%)                            *Percentages do
               . 25 low (49%)                                                27 low (68%)                              not add to 100%
                                                                                                                       due to rounding




13   “Based on HCFA’s 23 final and 17 draft reports for second round site visits, conducted May-September   1999 and does not
     include 13 states that were not visited in the second round.
       GAO Reported Status of State Readiness: Eligibility
           Systems as of October 4, 1999




t    Rating   improved      from round                    1
1    Rating   declined     from round                 I
c)   Rating   same as round            I
                                                                                                                                                                                                                                                  PR
                                                                                                                                                                                                                                            (No1 visited is
     No symbol indicates that risk ratings were                                                                                                                                                                                                Rousd I)           )
     based on first round visitsb                                                                                                                                                                                                                             VI (high   TILL)
                                                                                                    Low Risk                                Medium Risk                      m                High Risk                                                   (NOI visited ill
                                                                                       I                                                                                                                                                                     Round I)

                Source:   HCFAkontmctor                   sile visirs.     Because         some    of these     the state   visits   look   place       months       ago, their   SIIIUS may         have    chqed.
        14.     *HCFA     assessed     California’s            Meclicaid     eligibility      database.       but nol its many        county        systems      that perform       eligibility      determinalion.

                “Except   for Pucr~o       Rico       and the Virgm          Islands       which    were      not visited    in the first      round.     Thirteen       slates   were      not visited     during    the rscond   rounJ.
      GAO Reported Status of State Readiness:
          MMIS Systems as of October 4, 1999



                                                                                                                                                                                                           ,NH n




                                                                                                                TX




t   Rating   improved      from round I

*   Rating   declined     from round I
#   Rating   same as round I                                                                                                                                                      Wg
                                                                                                                                                                                     PR
    No symbol indicates that risk ratings were                                                                                                                                 (Not visited it1        I
    based on first round visits”                                                                                                                                                  Rowrd I)         VI (high risk)
                                                                                                                                                                                                  (NOI visited ill
                                                                 Low Risk               Medium Risk                  High Risk
                                                        El                                                                                                                                           Round I)



       1 5      Source:     HCFA/contractor   site visits.   Because some of these the state visits took place months ago, their status may have changed.
                “Except for Puerto Rico and the Virgin        Islands which   were not visited in the first round.    Thirteen   states w&e not visited during   the second round.
GAO Barriers to Successful Remediation:
    Resolution of Round 1 Eligibility Issues
     Resolution of round 1 eligibility issues for 40 states and the
     District of Columbia (a state may have more than one
     issue)”

                                                                      ckd
                                            IviJder    l4Lliorl PattialAction NoI_ronga
        Issues                              ofIssues Taken Taken                Applicable Unresolved
        Testing                                    49       30               2            1        16
        ProjectMjg-rLManning                        31      22               0            1         8
        ckx&in~yPlarming                            231      111             31        I 1.       , 8
        Atrhiving                                   11        8              2            0         1
                                                      11           6                    1                 2                 2




16    “Based on the completed      round 2 visits for 37 states and the District of Columbia and completed telephone  updates for 3 states.
      This information     was not yet available for 10 states as of October 4, 1999 and Puerto Rico and the Virgin Islands were not
      visited in the first round.
G-0               Barriers to Successful Remediation:
                  R&solution of Round 1 MMIS Issues
Resolution of round 1 eligibility issues for 40 states and the
District of Columbia (a state may have more than one
issue)”

                                                                               ckxed
                                                             Action      partial Action No Ianger
           Issues                             ofrssm         Taken       Taken           Applicable unresolved
           Testing                                  38            20                   7           1         10
           ProjectMgndPlanning                      44            35                   1          0           8
           aairIgency Planning                      18            12                   0          0           6
           Atchiving                                 8             6                   1          0           1
                                                     6             3                   0           1          2




17   “Based on the completed     round 2 visits for 37 states and the District of Columbia and completed telephone updates for 3 states.
 s   This information    was not yet available for IO states as of October 4, 1999 and Puerto Rico and the Virgin Islands were not visited
     in the first round.
GAO               Barriers to Successful Remediation:                                                          Round 2
                  Eligibility Issues
Open issues for 40 states, the District of Columbia, Puerto
Rico and the Virgin Islands at the end of round 2 (a state may
have more than one issue)”




1 8 “Based on the completed round 2 visits for 37 states, the District of Columbia, Puerto Rico and the Virgin Islands and completed
    telephone updates for 3 states. This information was not yet available for 10 states as of October 4, 1999. Also, some round 2
    issues iriclude unresolved round I issues.
GAO Barriers to Successful Remediation: Round 2
    MMIS Issues
   Open issues for 40 states, the District of Columbia, Puerto                                                                         \
   Rico and the Virgin Islands at the end of round 2 (a state
   may hav‘e more t:han one issue)”
                                        25

                                        20

                      Number of 15
                        Issues
                                10

                                          5

                                          n




                                                          &I          u
19 ;‘Based on the completed round 2 visits for 37 states, the District of Columbia, Puerto Rico and the Virgin Islands and completed
   telephone updates for 3 states. This information was not yet available for 10 states as of October 4, 1999. Also, some round 2
   issues include unresolved round I issues.
GAO Barriers to Successful Remediation: Examples
    of Open Issues

     l   Testing
         l   Future-date-compliant environment not planned or
             scheduled late in year
         l   End-to-end testing not planned or scheduled late in
             year
     l   Proiect Management/Planning
         l   No overall project plan
         l   Lack of top management involvement



20
G-0       Remaining Barriers to Successful
          Remediation: HCFA Reported Examples
      l   Contingency Planning;
              l   Contingency’ plan not completed
              l   No hot site for disaster recovery
      l   Archiving of Y2K Program Data
          l       No   archiving policies
          l       No   archiving procedures
      l   Other
          l       Risk of county office failures
          l       Insufficient outreach to providers or beneficiaries
21
GAO Reported Status of States’ Business
    Continuity and Contingency Plans

      HCFA’ s business continuity and contingency planning
      contractor began reviewing the quality of state plans in
      June 1999.
      Some of these plans were reviewed through both a desk
      audit and an onsite visit while other plans underwent just
      a desk audit.




22
G.0       Reported Status of States’ Business
          Continuity and Contingency Plans
      l   After the contractor’s review, each state’s business
          continuity and contingency plan was placed into a low,
          medium, or high risk category, based on the evaluation
          of its
              l   development process--including management
                  oversight, risk analysis, assessment of alternative
                  strategies, and testing of plans, and
              l   quality and completeness--including having a well-
                  documented mission statement and the
                  identification of critical business processes,
                  minimum levels of service, triggers, and recovery
                  mechanisms.
23
GAO Reported Status of States’ Business
    Continuity and Contingency Plans




                                                                                                                                                  PR             0
                                                                                                                                                             VI (med. risk)




     I     Low     Risk              Medium   Risk        High   Risk   m    Risk rating not yet completed     m        State did not provide plan to HCFA


24       Source:          HCFA,   based on contractor   reviews conducted   between   June and October       1, 1999.
GAO Business Continuity and Contingency
    Planning Issues

                Business continuity and contingency plan issues for
                31 states and 2 territories (a state may have more
                than one issue)”
                                     14
                                     12
                                     10
                      Number of
                      States           6
                                                                                                             The “other” category
                                       6                                                                     includes areas such as the lack
                                                                                                             of a training program or
                                       4                                                                     standard methodology

                                      2
                                      0




25   “Based on 16 final reports and 17 draft reports of HCFA’s business continuity and contingency plan contractor. Reports were not
     available as of October 1, 1999 for the other 2 state business continuity and contingency plans reviewed.
GAO Business Continuity and Contingency
    Planning: HCFA Reviews

      l   In September 1999, HCFA headquarter personnel
          began reviewing state business continuity and
          contingency plans to determine whether any
          programmatic issues needed to be addressed.




26
GAO Business Continuity and Contingency
    Planning: HCFA Reviews
      l   HCFA is considering policies that could affect
          state business continuity and contingency planning.
          l   States sending interim payments to providers.
              HCFA has drafted a policy paper on this issue
              which is undergoing internal review.
          l   States approving presumptive eligibility
              (approving applicants without completing the
              normal eligibility determination, process).
              HCFA is considering this issue and plans to
              issue a policy paper.


27
GAO Overall Observations


     l   HCFA's efforts in monitoring states’ Medicaid Y2K
         actions have identified critical issues and have
         significantly reduced the risk of Y2K disruptions
     l   Half of the states’ systems reported risk ratings
         improved after second round visits but reported risk
         ratings worsened in the following cases
         l   Alaska (MMIS)
         l   Massachusetts (MMIS)
         l   North Carolina (Eligibility)
         l   New Mexico (Eligibility)


28
GAO Overall Observations

     l   Much work remains on business continuity and
         contingency planning
          l   2 states have not provided HCFA their plans
         l    11 states were reported to have high risk ratings
         l    HCFA’s contractor has not reviewed the plans of
              15 states and the District of Columbia
     l   States at the highest risk are those which have a
         reported high risk system and a reported high, risk
         business continuity and contingency plan
         l    New Hampshire (Eligibility)
         l    New Mexico (Eligibility)
29
GAO Overall Observations


     l   States at significant risk are those with a reported
         medium risk system(s) and a reported high risk
         business continuity and contingency plans
         l   Delaware (Eligibility)
         l   New Mexico (MMIS)
         l   Ohio (MMIS)
         l   Oklahoma (Eligibility and MMIS)
         l   Tennessee (MMIS)
         l   Vermont (Eligibility)  .



30