United States General Accounting Office GAO Testimony Before the Subcommittee on Government Management, Information and Technology, Committee on Government Reform, and the Subcommittee on Technology, Committee on Science, House of Representatives For Release on Delivery Expected at 2 p.m. YEAR 2000 COMPUTING Monday, September 27, 1999 CHALLENGE HCFA Action Needed to Address Remaining Medicare Issues Statement of Joel C. Willemssen Director, Civil Agencies Information Systems Accounting and Information Management Division GAO/T-AIMD-99-299 Mr. Chairman, Ms. Chairwoman, and Members of the Subcommittees: Thank you for inviting us to participate in today’s hearing on Medicare Y2K (Y2K) issues. Successful Y2K conversion of the automated systems that are used by the Department of Health and Human Services’ (HHS) Health Care Financing Administration (HCFA) and its contractors to process Medicare claims is essential to ensuring that the delivery of health care services to millions of Americans is not negatively affected. We initially reported on HCFA’s Y2K program in 1997, making recommendations to improve the agency’s program management. 1 In our last report in April 1999, we stated that HCFA had been responsive to our recommendations, but that critical Y2K risks and challenges remained.2 At that time, we also reported that HCFA’s final tests of its mission-critical systems that are expected to be completed by November 1, 1999, will ultimately determine whether HCFA’s systems are Y2K compliant. Due to the late time frames associated with these final tests and the many challenges still confronting HCFA, we stressed the importance of the agency’s business continuity and contingency planning efforts. As requested, after a brief background discussion, today I will summarize HCFA’s progress in addressing its Y2K challenges to date and describe the key challenges that confront HCFA in completing the final Y2K tests of its mission-critical systems by November 1, 1999. I will also discuss that HCFA must (1) ensure that Medicare contractors are testing with providers, (2) monitor managed care organization’s (MCO) efforts to address their Y2K risks, and (3) complete and validate internal, contractor, and MCO business continuity and contingency plans. Background Medicare is the nation’s largest health insurer, serving about 39 million Americans by providing federal health insurance to individuals 65 or older and to many of the nation’s disabled. By 2000, HCFA expects to process over 1 billion claims and pay $288 billion in fee-for-service and managed 1 Medicare Transaction System: Success Depends Upon Correcting Critical Managerial and Technical Weaknesses (GAO/AIMD-97-78, May 16, 1997). 2 Year 2000 Computing Crisis: Readiness of Medicare and the Health Care Sector (GAO/T-AIMD-99-160, April 27, 1999). Page 1 GAO/T-AIMD-99-299 care benefits annually. The consequences, then, of its systems’ not being Y2K compliant could be enormous. Medicare Claims Processing HCFA operates and maintains 25 internal mission-critical systems; it also Systems Are Numerous and relies on 75 external mission-critical systems operated by contractors throughout the country to process Medicare claims. These external Complex systems consist of 68 claims processing contractor systems, 6 standard systems, and the Common Working File (CWF). Each of the claims processing contractor systems relies on one of the six standard systems to process its claims, adding its own front-end and back-end processing systems. The CWF is a set of databases located at nine sites that works with internal and external systems to authorize claims payments and determine beneficiary eligibility. In addition to the 25 internal and 75 external contractor systems, the claims process involves over 1 million health care providers and numerous banks serving both contractors and providers. HCFA also relies on external systems located at 383 MCOs. Although HHS has not designated the MCOs as mission-critical in its Y2K quarterly status reports to the Office of Management and Budget (OMB), these systems are nevertheless vital since they are used to serve 6.9 million of the 39 million Medicare beneficiaries. Past Recommendations to We originally highlighted our concerns with HCFA’s management of Improve HCFA’s Medicare Y2K in May 1997. 3 At that time, we made several recommendations for improvement, including that HCFA identify Management of Its Medicare responsibilities for managing Y2K actions and that Medicare contractors Y2K Program submit to HCFA their Y2K plans and validation strategies. In our report last September, we warned that although HCFA had made improvements in its Y2K management, the agency and its contractors were severely behind schedule in making mission-critical systems that process Medicare claims Y2K compliant.4 Our conclusions and recommendations at that time reflected our concern about the high level of risk and large number of tasks still facing HCFA. Among our specific recommendations was that the HCFA Administrator 3 GAO/AIMD-97-78, May 16, 1997. 4 Medicare Computer Systems: Year 2000 Challenges Put Benefits and Services in Jeopardy (GAO/AIMD-98-284, September 28, 1998). Page 2 GAO/T-AIMD-99-299 • rank remaining Y2K work on the basis of an integrated project schedule and identify the Y2K project’s critical path to ensure that all critical tasks were prioritized and completed in time to prevent unnecessary delays; • develop a risk management process; • ensure that all external and internal systems’ data exchanges had been identified and agreements signed among exchange partners; • define the scope of an end-to-end test of the claims process and develop plans and a schedule for conducting such a test; and • accelerate the development of business continuity and contingency plans. This February, we testified that although HCFA had been responsive to our recommendations and that its top management was actively engaged in its Y2K program, its reported progress was highly overstated.5 We reported that none of HCFA’s 54 external mission-critical systems reported by HHS as compliant as of December 31, 1998, was Y2K ready because all had important associated qualifications (exceptions), some of them significant. Further, we reported that HCFA continued to face serious Y2K challenges, including a significant amount of testing since changes would continue to be made to its mission-critical systems to make them compliant. In April, we testified that HCFA reported that most of the qualifications associated with HCFA’s mission-critical systems had been resolved. 6 Further, we noted that HCFA had continued to be responsive to our recommendations in critical areas such as managing its electronic data exchanges and developing business continuity and contingency plans. Nevertheless, critical Y2K risks and challenges remained. For example, we reported that the mission-critical systems HCFA deemed compliant were not the final systems that would be processing Medicare claims on January 1, 2000, because these systems were to undergo a significant amount of change between then and July 1, 1999, for both Y2K-related and other reasons. In addition, we reported that HCFA’s testing to date of external systems had not been rigorous. Therefore, we stressed the importance of HCFA’s final recertification tests, planned to occur between July 1 and November 1, 1999. 5 Year 2000 Computing Crisis: Readiness Status of the Department of Health and Human Services (GAO/T-AIMD-99-92, February 26, 1999). 6 GAO/T-AIMD-99-160, April 27, 1999. Page 3 GAO/T-AIMD-99-299 HCFA’s Actions to HCFA continues to be responsive to our recommendations and make progress in its Y2K efforts. To more effectively identify and manage risks, Achieve Compliance HCFA is relying on multiple sources of information, including test reports, and Bolster Outreach reports from its independent verification and validation (IV&V) contractors, and weekly status reports from its contractor oversight teams. Efforts to Medicare In addition, HCFA has stationed staff at critical contractor sites to assess Providers the data being reported to them and to identify problems. HCFA is also more effectively managing its electronic data exchanges. It issued instructions to its contractors to inform providers and suppliers that they must submit Medicare claims in an eight-digit format by April 5 of this year. On September 22, HCFA reported that 99 percent of Part A providers and all Part B providers were using the eight-digit format for claims submissions.7 HCFA also issued new instructions to contractors for reporting on data exchanges and created a new database to track status. HCFA has also acted to improve its Y2K testing program. For example, it has more clearly defined its testing procedures for its contractors 8 and is using Y2K analysis tools to measure its testing thoroughness. In addition, HCFA has improved its test coverage (e.g., systems functionality, HCFA- mandated dates, interface coverage) of the external systems. In April 1999, we reported that HCFA’s IV&V contractor had concerns with the documentation of external systems’ test coverage associated with Y2K testing to date.9 HCFA issued instructions on April 9, 1999, that required each contractor to submit a traceability matrix that listed the business functions covered by the recertification tests. Some HCFA contractors continue to improve their test coverage by adding test cases10 to their traceability matrices. 7 Part A claims are those submitted by hospitals, skilled nursing facilities, hospices, home health agencies, and rehabilitation agencies. Part B claims are those submitted by physicians, laboratories, durable medical equipment suppliers, outpatient providers, and other practitioners. 8 From February 2, 1999, through September 22, 1999, HCFA issued 19 updates to its recertification instructions to more clearly define its testing procedures. 9 GAO/T-AIMD-99-160, April 27, 1999. 10 A test case is a series of test scripts that identifies each testable condition of a system (including valid and invalid conditions), the associated inputs, and the expected results. Page 4 GAO/T-AIMD-99-299 In addition, an independent testing contractor is conducting tests on the six standard systems and the CWF. HCFA also plans to perform end-to-end testing with its Y2K-compliant test sites. These end-to-end tests are to include all internal systems and contractor systems; however, they will not include testing with banks and providers. Another area in which HCFA has demonstrated progress is the development of its overall business continuity and contingency plan, which includes 29 internal plans. The agency established cross-organizational workgroups to develop contingency plans for the following core business functions: health plan and provider payment, eligibility and enrollment issues, program integrity, managed care, quality of care, litigation, and telecommunications. HCFA’s fifth iteration of its overall business continuity and contingency plan (BCCP) was issued on July 1, 1999; the internal plans are currently being validated. As we have also reported, HCFA has taken comprehensive measures in conducting its outreach activities.11 Outreach activities include information dissemination as well as presentations and conferences. For example, the HCFA Administrator sent out individual letters to over 1.1 million Medicare providers in January and May of this year, alerting them to take prompt Y2K action on their information and billing systems. HCFA has also established a toll-free information hotline and plans to film a four-part series in conjunction with the Health and Science television network that is to be broadcast to hospitals and nursing facilities. In addition, as of June 25, 1999, the agency had held 12 Y2K conferences throughout the country, and is planning to hold 10 more. Further, HCFA has a web site dedicated to Y2K issues that contains information and advice to providers on how to assess readiness, test systems, and develop contingency plans. Key Challenges Remain Although HCFA has improved its Y2K testing program, it still faces several hurdles to completing its recertification tests by November 1, 1999. With in Testing Mission- only 5 weeks remaining to complete these critical recertification tests, Critical Systems HCFA has much work ahead. Unfortunately, this tight schedule is not being guided by an overall plan because HCFA has not yet completed a detailed integrated testing plan, including a critical path. In addition to executing the recertification tests and resolving any errors that are discovered, HCFA 11 Year 2000 Computing Crisis: Status of Medicare Providers Unknown (GAO/AIMD-99-243, July 28, 1999). Page 5 GAO/T-AIMD-99-299 is concurrently addressing other issues uncovered by Y2K assessment tools. Further, HCFA is in the process of transitioning six contractors to new data centers. Each of these overlapping efforts introduces risks that could adversely affect the recertification testing of HCFA’s mission-critical systems. HCFA’s Recertification In September 1998, we recommended that HCFA rank its remaining Y2K Testing Program Is Not work on the basis of a schedule that included milestones for renovation and testing of all systems, and that it include time for end-to-end testing Being Guided by an and identify the critical path. 12 Such a schedule is extremely important Integrated Testing Plan That because of the number of systems, their complexity, and interdependencies Identifies the Critical Path among them. The required sequencing of the 75 external and 25 internal systems associated with the recertification requires an integrated testing schedule to avoid testing overlap and scheduling constraints. Since each contractor relies on the CWF and one of the six standard systems to process its claims, these systems should be completely tested before the contractors test their front-end and back-end processing systems with their respective standard systems. Given the limited time remaining, it is not possible for HCFA to conduct the recertification testing in the optimal sequence. Therefore, testing overlap is planned to occur—the 68 claims processing systems, 6 standard systems, and the CWF are being concurrently tested. This testing approach is risky because it results in managing multiple testing baselines and creates challenges in ensuring that resolving one system’s testing errors do not lead to problems in another system. For example, each of the 68 contractors has tested with multiple versions of the CWF and their respective standard system that have been changed to address Y2K errors identified during the recertification testing. 13 HCFA officials acknowledge the added risk associated with this testing overlap of the CWF, standard systems, and contractor systems. 12 GAO/AIMD-98-284, September 28, 1998. 13 On September 24, 1999, HCFA officials told us that since the recertification testing began, the CWF has been changed three times and that each of the standard systems has also been changed. Page 6 GAO/T-AIMD-99-299 Given that HCFA does not have enough time to conduct the recertification tests in the proper sequence, it must now aggressively manage the risks associated with the testing overlap. HCFA officials believe the risks are manageable due to their oversight of contractor Y2K efforts. However, effectively managing these risks calls for a more precise and focused effort, namely, an integrated testing schedule that defines individual system schedules and their interdependencies. Unfortunately, HCFA still does not have such a schedule. Although HCFA has a high-level integrated project plan that contains activities associated with its Y2K program, this plan does not identify individual system testing schedules or the interdependencies among all internal and external systems. In addition, it does not include the detail necessary to identify the critical path that would establish the sequence in which tasks must be completed to ensure that this complex undertaking can be finished on time. Such a critical path remains an essential tool that HCFA needs to have to manage risks. HCFA Needs to Monitor In addition to the challenge posed by the many system interdependencies, Recertification Test HCFA is making progress in the individual recertification testing of each of the six standard systems and the CWF; however, this progress is uneven. Execution by Contractors For example, the MCS standard system contractor has executed 6,509 of its and Address Y2K Errors planned 6,734 recertification test scripts (97 percent), while the CWF Expeditiously contractor has only executed 55,606 of its 112,418 planned test scripts (49 percent). Figure 1 shows the number of test scripts for each of the six standard systems planned to be completed by October 8, and those actually completed as of August 31, 1999. 14 14 In obtaining comments on a draft of this testimony, HCFA officials told us that they provided us with incorrect information on the number of CWF planned recertification test scripts as of August 31, 1999. They added that the correct number is 15,002 and that as of September 24, 1999, 14,877 of these had been executed. They also provided updated information on planned and executed test scripts for the six standard systems. We did not present this updated information since HCFA officials were unable to provide supporting documentation and were unable to provide the number of failures associated with these executed test scripts. Page 7 GAO/T-AIMD-99-299 Figure 1: Recertification Test Scripts Planned and Reported Executed for the Six Standard Systems as of August 31, 1999 Note: The six standard systems consists of two Part A systems—Arkansas Part A Standard System (APASS) and Fiscal Intermediaries Standard System (FISS)—and four Part B systems—GTE Medicare System (GTEMS), Medicare Claims System (MCS), United Healthcare (UHC), and VIPS Medicare System (VMS). Source: HCFA. The executed test scripts as of August 31, 1999, for the six standard systems and the CWF have uncovered Y2K errors, as shown in table 1. Table 1: Reported Failed Test Scripts for the Six Standard Systems and the CWF as of August 31, 1999 APASS FISS GTEMS MCS UHC VMS CWF Priority 1,2 3 0 0 0 12 4 0 Priority 3,4,5 3 3 1 28 127 1 3,236 Source: HCFA. As defined by HCFA, the priority 1 and 2 failures represent errors that would result in Y2K failures of the system. The priority 3, 4, and 5 errors Page 8 GAO/T-AIMD-99-299 represent lesser impacts, such as those for which there are either alternative workarounds, those that do not affect a required mission capability, or those that were reported as operator errors that need to be retested. Because of the significance of the priority 1 and 2 failures, these not only require correction, but the systems changes to address them need to be retested to ensure that these changes do not introduce additional errors. Since the final recertification tests will ultimately determine whether HCFA’s mission-critical systems are Y2K compliant, it is essential that HCFA and its IV&V contractor closely monitor test execution and the resolution of these errors. HCFA Needs to Assess Y2K As an additional mechanism to ensure that mission-critical systems are free Renovation Quality and Test of Y2K errors and that ongoing recertification testing is adequate, HCFA is using Y2K analysis tools on each of the six standard systems and the CWF. Coverage Using Automated These tools are to determine (1) the Y2K readiness of the software code Tools (i.e., Y2K renovation quality) and (2) the adequacy of test coverage. Preliminary results of the Y2K renovation quality tool reveal Y2K errors in the code. This tool identifies potential Y2K errors in three categories— (1) Y2K noncompliant errors, (2) suspect errors that may have a Y2K impact, and (3) warnings that have the potential for Y2K problems—that must be further analyzed to determine if indeed they are Y2K problems. For example, the FISS standard system had 775 noncompliant findings and 100 warnings identified by the renovation quality tool; but, according to HCFA officials, an analysis of the 875 potential problems found 49 actual Y2K problems, 2 of which required renovation. In addition, HCFA officials told us on September 24, 1999, that seven updates to the VMS standard system have already occurred to address Y2K problems uncovered by the renovation quality tool. Figure 2 presents the preliminary results of executing the renovation quality tool for the six standard systems and the CWF. Page 9 GAO/T-AIMD-99-299 Figure 2: Preliminary Results of the Renovation Quality Tool for the Six Standard Systems and the CWF Source: HCFA. Until this analysis is complete, the extent of programming errors that must be renovated and retested is unknown. Additionally, the utility of this tool is minimized if the analysis of the results is not completed quickly and any necessary changes are not incorporated into the recertification testing program. On September 24, 1999, HCFA officials told us that they have established an October 1, 1999, deadline for completing this analysis. Turning to the test coverage tools, results reveal some systems with low test coverage. HCFA uses two Y2K tools that assess test coverage by identifying the total number of date references tested.15 The results of these tools are analyzed, and inadequate test coverage results are remedied by 15 Date references are the actual dates in the computer system. Page 10 GAO/T-AIMD-99-299 adding test cases. Figure 3 shows the percentage of the date references tested for each of the standard systems and the CWF.16 Figure 3: Date References Tested for the Six Standard Systems and the CWF Source: HCFA. Of particular concern are the lower percentages for the GTEMS and, most important, the CWF, which is the heart of the Medicare Claims Processing System. To its credit, HCFA is asking these standard system contractors to improve their test coverage by adding test cases to the ongoing recertification tests. However, HCFA has limited time to plan, execute, and analyze the results of additional test cases. Therefore, it should establish a deadline to accomplish each of these activities. 16 Due to time constraints, HCFA is not running the test coverage tool on all code associated with the six standard systems and the CWF. Rather, according to HCFA officials, it has decided to run the tool on just the eligibility and claims processing portions of these systems, since these are the critical software components for processing Medicare claims. Page 11 GAO/T-AIMD-99-299 HCFA Needs to Expedite The recertification testing for 6 of the 68 contractors has recently been Contractor Transitions to delayed due to the recent departure of a data center 17 that had been providing service to these 6 contractors. These six contractors now have to New Data Centers be transferred to other data centers. Because these six transitions are scheduled to occur from mid-September through early November, these contractors will not be able to complete their recertification testing by November 1. The six contractors intend to complete the recertification testing by December 1, covering the two most immediate planned HCFA testing dates rather than all of the required four future date recertification tests.18 HCFA needs to expedite the transitions to these new data centers and recertification testing associated with these six contractors because of the limited time available to address any schedule delays or problems identified in the recertification testing. HCFA Needs to Minimize As noted in our January 1999 testimony, changes made to systems after System Changes Through they have been certified as Y2K compliant can introduce new Y2K problems.19 To address this risk, we suggested that OMB consider directing March 31, 2000 agencies to adopt a strong change management policy−one that limits new software and systems changes. In response to our suggestion, in May, OMB issued a memorandum to federal department heads stating the importance of considering the potential effect of changes to information technology systems on Y2K readiness, and urging agency heads to adopt a policy that only allows system changes where absolutely necessary. OMB also requested that agency heads summarize in their quarterly Y2K progress reports how they would implement such guidance. HCFA has acted to implement OMB’s request. Specifically, HCFA reported on June 3, 1999, that it implemented controls to minimize system changes after July 1. In addition, HHS reported in its August 1999 quarterly report to 17 HCFA has 23 data centers−large claims processing operations that operate one or more of the standard systems for one or more of the 68 contractors. A data center may also be a host site for the CWF. 18 HCFA’s recertification is to test four future dates−12/31/1999 rollover to 1/4/2000, 2/27/2000 rollover to 3/2/2000, 9/30/2000, and 12/30/2000 rollover to 1/2/2001. 19 Year 2000 Computing Crisis: Readiness Improving, But Much Work Remains to Avoid Major Disruptions (GAO/T-AIMD-99-50, January 20, 1999). Page 12 GAO/T-AIMD-99-299 OMB that HCFA’s formal moratorium that halts systems changes to Y2K- certified systems is October 1, 1999, through March 31, 2000. HHS’ quarterly report also states that exceptions to the moratorium may be allowed through a strict approval process. Such an exception is HCFA’s planned October 1999 and January 2000 provider payment updates. In April, we reported that these updates contribute to HCFA’s already monumental testing challenge. However, HCFA officials told us that these updates are minor and that they do not expect them to impede the recertification testing program. Other Critical Risks In addition to the challenges associated with its recertification testing, HCFA must also address three other critical areas. First, contractor and Challenges Remain progress in testing with providers has been limited. Second, many MCOs have outstanding issues to address in order to become Y2K compliant. Finally, HCFA needs to complete and validate internal, contractor, and MCO business continuity and contingency plans. HCFA Needs to Monitor In addition to individual systems testing, HCFA must also test its systems Provider Testing With end-to-end to verify that defined sets of interrelated systems, which collectively support an organizational core business function, will work as Contractors intended. Since providers submit Medicare claims through claims processing contractors, HCFA has tasked these contractors to future date test with their respective providers and encouraged providers to take advantage of the opportunity to future date test with contractors. In March 1999, HCFA required all Medicare contractors to establish test environments that would allow Medicare claims from providers and submitters20 to be validated in a future date environment. In May 1999, HCFA further defined this requirement by establishing a goal for contractors to future date test with providers that represent at least 50 percent of the annual claims volume. In July, we reported that contractor testing with providers/submitters had been limited and testing that had occurred had identified problems. 21 Specifically, as of June 21, 1999, 38 of 68 contractors had not initiated any testing with their respective providers. Of the remaining 30, only 1 had 20 Submitters are third-party billers or clearinghouses that bill for providers. 21 GAO/AIMD-99-243, July 28, 1999. Page 13 GAO/T-AIMD-99-299 tested with more than 1 percent of its respective providers. We also reported that according to HCFA’s web site, the one Medicare contractor that completed substantial testing of 434 providers encountered initial problems with 123 (28 percent); 9 of these were critical failures that produced dates of 1900 and 1901 during the testing process. We also reported that contractor/provider testing only identifies problems with data exchanges. Accordingly, it does not address whether providers’ systems that process Medicare claims are Y2K compliant. HCFA’s latest information on contractor/provider testing continues to be discouraging. As of September 21, 1999, HCFA’s data showed that of 75 contractors, 69 have initiated testing with their respective providers.22 However, HCFA reports that 40 of the 69 contractors have tested with less than 1 percent of their providers. Table 2 shows the percentage of providers that have future date tested with each of the 69 contractors. Table 2: Contractor/Provider Testing Status as of September 21, 1999 Providers that have tested with Number of contractors contractors 40 Less than 1 % 22 1 to 4 % 6 6 to 12 % 1 100 % Total 69 Source: HCFA. HCFA also continues to report that Y2K failures are occurring during provider/contractor testing. On September 22, HCFA’s chief information officer reported that 10 to 20 percent of the providers/submitters who have tested with contractors have experienced failures due to incorrect claim dates. These failures were attributed to provider hardware and software problems. Concerning HCFA’s goal to test with providers/submitters who 22 HCFA’s most recent data on contractor/provider testing lists 75 instead of 68 claims processing contractors, because HCFA tracks this testing by identification number and some contractors have been assigned more than one identification number. Page 14 GAO/T-AIMD-99-299 represent 50 percent of their total claims volume, HCFA reports that only nine contractors have met this goal as of September 20, 1999. HCFA and the President’s Council on Year 2000 Conversion also have concerns about providers’ Y2K readiness. HCFA officials told us that despite their outreach efforts to the provider community, providers are reluctant to test with Medicare contractors. The President’s Council on Year 2000 Conversion, established in February 1998 to, among other things, increase awareness of and gain cooperation in addressing the Y2K problem in various economic sectors, also recently highlighted concerns about the compliance status of health care provider recordkeeping and billing systems. Last month, the Council reported that Y2K failures in these billing and recordkeeping systems, if not promptly addressed, could interfere with normal payment processes and force smaller, cash-strapped providers to suspend operations.23 Until these data exchanges between providers and contractors are future date tested, the ability of these entities to process Medicare claims in a future date environment is unknown. Therefore, it is essential that HCFA continue to monitor and publicize provider testing with contractors and establish milestones for contractors to test with providers. HCFA Needs to Ensure That In addition to fee-for-service contractors, 6.9 million of Medicare’s Managed Care 39 million beneficiaries are currently enrolled in 383 MCOs. In January 1999, HCFA required that by April 15, 1999, the MCOs certify their systems Organizations Are Y2K as Y2K compliant. In April, we testified that HCFA had received Compliant certifications from 315 MCOs and that, similar to the claims processing contractors, 271 of the 315 contained qualifications (exceptions). 24 HCFA’s most recent data on these certifications continue to be of concern. HCFA had received certifications from 425 MCOs, 25 and reported that as of June 1999, 365 of the 425 certification statements contained qualifications (86 percent) and that only 4 were Y2K compliant. The President’s Council 23 The President’s Council on Year 2000 Conversion: Third Summary of Assessment Information, August 5, 1999. 24 GAO/T-AIMD-99-160, April 27, 1999. 25 Since July 1999, the number of MCOs decreased from 425 to 383 because 52 left the Medicare program while 10 new MCOs joined. Page 15 GAO/T-AIMD-99-299 on Year 2000 Conversion also recently highlighted concerns about the Y2K readiness of MCOs. The Council reported in August that serious concerns exist with MCOs that either started late in addressing the problem or have yet to take significant steps toward achieving full Y2K readiness. 26 To focus the limited remaining time on the higher risk MCOs, HCFA, with assistance from a contractor, performed a risk assessment of each of the 425 MCOs using the certification statements and the associated qualifications, along with other criteria.27 HCFA’s June 1999 risk assessment concluded that • 94 MCOs are high risk (22 percent), • 314 MCOs are medium risk (74 percent), and • 17 MCOs are low risk (4 percent). To ensure that reported qualifications are being addressed and that these MCOs are adequately addressing their Y2K challenges, HCFA is conducting site visits covering 184 MCOs, which include the 94 high-risk MCOs. According to HCFA, the 184 serve about 90 percent of the 6.9 million MCO Medicare beneficiary population. HCFA officials told us that they are using the self-reported results of a Medicare Y2K survey by the HHS Office of the Inspector General to follow up on the status of the MCOs not covered in the site visits. The Inspector General survey results are expected to be released by the end of this month. Although HCFA’s “risk-approach” to determining the Y2K status of MCOs has been useful, it is essential that HCFA now focus on the resolution of reported qualifications and whether each of the MCOs is Y2K compliant. On January 25, 1999, HCFA instructed MCOs that a formal recertification would be required later in 1999; however, HCFA officials now tell us they have decided that a formal recertification will not be required. Without such a recertification, risks are enhanced that MCOs will experience Y2K- related disruptions. Accordingly, we believe that HCFA should reconsider this decision. As part of our ongoing work for the Senate Special 26 The President’s Council on Year 2000 Conversion: Third Summary of Assessment Information, August 5, 1999. 27 The other criteria were size, tax status, corporate experience, sole MCO in region, data exchanges, Y2K risk assessment, contingency planning, independent verification and validation, monitoring of results, centralized management, delegation, stability, and system compliance. Page 16 GAO/T-AIMD-99-299 Committee on Aging, we plan to review the resolution of the qualifications associated with MCO certifications and HCFA’s follow-up actions to determine whether each MCO is Y2K compliant. HCFA Needs to Complete Given the magnitude of the many challenges that HCFA continues to face, and Validate Internal, the development of BCCPs to ensure continuity of critical operations and business processes is essential. HCFA continues to make steady progress Contractor, and MCO on its agencywide and 29 internal BCCPs; however, the status of contractor Business Continuity and plans is unknown, and the results of HCFA’s initial review of MCO plans are Contingency Plans not promising. HCFA has completed its agencywide BCCP that includes 29 internal plans; however, essential validation activities remain. As of September 2, 1999, HCFA reported that it had procedurally validated 25 of these 29 plans. 28 Of the remaining four plans, it plans to procedurally validate three of them. The remaining BCCP−Medicare contractor management−does not require validation because it is currently being used to guide contractor transitions, according to agency officials. In addition to the procedural validations, HCFA reports that 11 of the internal plans require additional validation through extensive simulation and/or operational reviews.29 It is unclear when these more detailed validations will be completed since HCFA has missed its latest milestone of August 30, 1999, to validate BCCPs and has not yet established a new deadline. Such validation activities are essential to ensuring that BCCPs can be executed in the event of Y2K-induced failures. The status of Medicare contractor BCCPs is unknown. In May 1999, HCFA reviewed 7730 contractor plans and concluded that 17 of these required major improvement. However, HCFA’s BCCP technical support contractor stated that not all Medicare contractors have specified detailed procedures that are required for executing and testing BCCPs. Our assessment of these 28 According to HCFA, procedural validation consists of emergency response team members reviewing the BCCP to confirm basic procedures and discussing responsibilities for different failure scenarios to ensure adequate staffing. 29 According to HCFA, simulation consists of emergency response team role-playing from alternate facilities with minimal test scripts, while operational validation is used to evaluate the most complex and critical BCCPs under full or partial operating conditions using detailed scripts. 30 Some contractors submitted more than oneBCCP. Page 17 GAO/T-AIMD-99-299 plans is consistent with the technical support contractor−HCFA does not yet have the detailed plans from most contractors. To address this situation, HCFA issued a memorandum on August 6, 1999, instructing Medicare contractors to have detailed BCCPs available for HCFA’s review by September 30. HCFA plans to review these at each of the contractor’s site using agency Y2K contractor oversight teams. To prepare these teams for this review, HCFA’s technical assistance contractor recently provided training to them, along with checklists, that will be used to assess the adequacy of Medicare contractor BCCPs. On September 24, 1999, HCFA officials told us that these assessments are to be completed by October 30, 1999. We remain concerned about the late completion dates associated with these plans and whether there will be sufficient time remaining to test them. The status of MCO BCCPs is likewise not encouraging. HCFA required MCOs participating in the Medicare program to submit their plans to HCFA by July 15, 1999. As of September 2, 1999, HCFA had received BCCPs covering 310 of the 383 MCOs. HCFA’s review of these 310 concluded that 69 percent of them need major improvement, 18 percent need minor improvement, and 13 percent were reasonable. HCFA has been active in following up on the MCO BCCPs. For example, it mailed letters to each of the 73 that have not yet submitted plans. In addition, it sent letters to those MCOs with plan deficiencies and has requested that those plans in the “needs major improvement” category be resubmitted by September 28. In addition, HCFA has held three workshops−in Los Angeles, Denver, and Atlanta−to assist MCOs in developing BCCPs. HCFA officials told us they have requested that the MCOs validate their plans by the end of November, but they could not provide documentation to us to substantiate this request. Limited time remains to complete and validate all BCCPs. Therefore, it is essential that HCFA sustain its efforts to validate all internal plans and closely monitor the completion and validation of contractor and MCO plans. In summary, HCFA and its contractors have made progress in addressing Medicare Y2K issues. However, until HCFA completes the ongoing recertification tests, the final status of the agency’s Y2K compliance will remain unknown. Limited time remains to completely test all systems that process Medicare claims for Y2K compliance (internal, fee-for-service Page 18 GAO/T-AIMD-99-299 contractor, MCO, and provider). Nevertheless, HCFA must sustain its efforts, because any progress made in testing these many systems lowers the risk of disruptions to Medicare and the claims payment process. HCFA must also continue to closely monitor contractor testing with providers that to date has been limited but has uncovered Y2K problems. In addition, HCFA needs to continue its efforts to ensure that MCOs are adequately addressing their Y2K challenges. Given the considerable amount of work that remains in the next few months, it is crucial that the development and testing of internal, contractor, and MCO BCCPs move forward rapidly to ensure that no matter what, providers will be paid and beneficiaries will receive care. This concludes my statement, and I would be pleased to respond to any questions at this time. Contact and For information about this testimony, please contact Joel Willemssen at (202) 512-6253 or by e-mail at firstname.lastname@example.org. Individuals Acknowledgments making key contributions to this testimony included Dr. Nabajyoti Barkakati, Christina Bower, Mary Dorsey, Dr. Robert Norris, and Dave Powner. (511797) Leter Page 19 GAO/T-AIMD-99-299 Ordering Information The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary, VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. Orders by mail: U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 or visit: Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists. For information on how to access GAO reports on the INTERNET, send an e-mail message with “info” in the body to: email@example.com or visit GAO’s World Wide Web Home Page at: http://www.gao.gov United States Bulk Mail General Accounting Office Postage & Fees Paid Washington, D.C. 20548-0001 GAO Permit No. GI00 Official Business Penalty for Private Use $300 Address Correction Requested
Year 2000 Computing Challenge: HCFA Action Needed to Address Remaining Medicare Issues
Published by the Government Accountability Office on 1999-09-27.
Below is a raw (and likely hideous) rendition of the original report. (PDF)