oversight

Year 2000 Computing Challenge: HCFA Action Needed to Address Remaining Medicare Issues

Published by the Government Accountability Office on 1999-09-27.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                          United States General Accounting Office

GAO                       Testimony
                          Before the Subcommittee on Government Management,
                          Information and Technology, Committee on Government
                          Reform, and the Subcommittee on Technology, Committee
                          on Science, House of Representatives

For Release on Delivery
Expected at
2 p.m.
                          YEAR 2000 COMPUTING
Monday,
September 27, 1999        CHALLENGE

                          HCFA Action Needed to
                          Address Remaining
                          Medicare Issues
                          Statement of Joel C. Willemssen
                          Director, Civil Agencies Information Systems
                          Accounting and Information Management Division




GAO/T-AIMD-99-299
             Mr. Chairman, Ms. Chairwoman, and Members of the Subcommittees:

             Thank you for inviting us to participate in today’s hearing on Medicare Y2K
             (Y2K) issues. Successful Y2K conversion of the automated systems that are
             used by the Department of Health and Human Services’ (HHS) Health Care
             Financing Administration (HCFA) and its contractors to process Medicare
             claims is essential to ensuring that the delivery of health care services to
             millions of Americans is not negatively affected.

             We initially reported on HCFA’s Y2K program in 1997, making
             recommendations to improve the agency’s program management. 1 In our
             last report in April 1999, we stated that HCFA had been responsive to our
             recommendations, but that critical Y2K risks and challenges remained.2 At
             that time, we also reported that HCFA’s final tests of its mission-critical
             systems that are expected to be completed by November 1, 1999, will
             ultimately determine whether HCFA’s systems are Y2K compliant. Due to
             the late time frames associated with these final tests and the many
             challenges still confronting HCFA, we stressed the importance of the
             agency’s business continuity and contingency planning efforts.

             As requested, after a brief background discussion, today I will summarize
             HCFA’s progress in addressing its Y2K challenges to date and describe the
             key challenges that confront HCFA in completing the final Y2K tests of its
             mission-critical systems by November 1, 1999. I will also discuss that HCFA
             must (1) ensure that Medicare contractors are testing with providers,
             (2) monitor managed care organization’s (MCO) efforts to address their
             Y2K risks, and (3) complete and validate internal, contractor, and MCO
             business continuity and contingency plans.



Background   Medicare is the nation’s largest health insurer, serving about 39 million
             Americans by providing federal health insurance to individuals 65 or older
             and to many of the nation’s disabled. By 2000, HCFA expects to process
             over 1 billion claims and pay $288 billion in fee-for-service and managed



             1
               Medicare Transaction System: Success Depends Upon Correcting Critical Managerial and
             Technical Weaknesses (GAO/AIMD-97-78, May 16, 1997).
             2
              Year 2000 Computing Crisis: Readiness of Medicare and the Health Care Sector
             (GAO/T-AIMD-99-160, April 27, 1999).




             Page 1                                                               GAO/T-AIMD-99-299
                             care benefits annually. The consequences, then, of its systems’ not being
                             Y2K compliant could be enormous.


Medicare Claims Processing   HCFA operates and maintains 25 internal mission-critical systems; it also
Systems Are Numerous and     relies on 75 external mission-critical systems operated by contractors
                             throughout the country to process Medicare claims. These external
Complex                      systems consist of 68 claims processing contractor systems, 6 standard
                             systems, and the Common Working File (CWF). Each of the claims
                             processing contractor systems relies on one of the six standard systems to
                             process its claims, adding its own front-end and back-end processing
                             systems. The CWF is a set of databases located at nine sites that works
                             with internal and external systems to authorize claims payments and
                             determine beneficiary eligibility.

                             In addition to the 25 internal and 75 external contractor systems, the claims
                             process involves over 1 million health care providers and numerous banks
                             serving both contractors and providers. HCFA also relies on external
                             systems located at 383 MCOs. Although HHS has not designated the MCOs
                             as mission-critical in its Y2K quarterly status reports to the Office of
                             Management and Budget (OMB), these systems are nevertheless vital since
                             they are used to serve 6.9 million of the 39 million Medicare beneficiaries.



Past Recommendations to      We originally highlighted our concerns with HCFA’s management of
Improve HCFA’s               Medicare Y2K in May 1997. 3 At that time, we made several
                             recommendations for improvement, including that HCFA identify
Management of Its Medicare   responsibilities for managing Y2K actions and that Medicare contractors
Y2K Program                  submit to HCFA their Y2K plans and validation strategies. In our report last
                             September, we warned that although HCFA had made improvements in its
                             Y2K management, the agency and its contractors were severely behind
                             schedule in making mission-critical systems that process Medicare claims
                             Y2K compliant.4 Our conclusions and recommendations at that time
                             reflected our concern about the high level of risk and large number of tasks
                             still facing HCFA. Among our specific recommendations was that the HCFA
                             Administrator


                             3
                                 GAO/AIMD-97-78, May 16, 1997.
                             4
                              Medicare Computer Systems: Year 2000 Challenges Put Benefits and Services in Jeopardy
                             (GAO/AIMD-98-284, September 28, 1998).




                             Page 2                                                              GAO/T-AIMD-99-299
• rank remaining Y2K work on the basis of an integrated project schedule
  and identify the Y2K project’s critical path to ensure that all critical
  tasks were prioritized and completed in time to prevent unnecessary
  delays;
• develop a risk management process;
• ensure that all external and internal systems’ data exchanges had been
  identified and agreements signed among exchange partners;
• define the scope of an end-to-end test of the claims process and develop
  plans and a schedule for conducting such a test; and
• accelerate the development of business continuity and contingency
  plans.

This February, we testified that although HCFA had been responsive to our
recommendations and that its top management was actively engaged in its
Y2K program, its reported progress was highly overstated.5 We reported
that none of HCFA’s 54 external mission-critical systems reported by HHS
as compliant as of December 31, 1998, was Y2K ready because all had
important associated qualifications (exceptions), some of them significant.
Further, we reported that HCFA continued to face serious Y2K challenges,
including a significant amount of testing since changes would continue to
be made to its mission-critical systems to make them compliant.

In April, we testified that HCFA reported that most of the qualifications
associated with HCFA’s mission-critical systems had been resolved. 6
Further, we noted that HCFA had continued to be responsive to our
recommendations in critical areas such as managing its electronic data
exchanges and developing business continuity and contingency plans.
Nevertheless, critical Y2K risks and challenges remained. For example, we
reported that the mission-critical systems HCFA deemed compliant were
not the final systems that would be processing Medicare claims on
January 1, 2000, because these systems were to undergo a significant
amount of change between then and July 1, 1999, for both Y2K-related and
other reasons. In addition, we reported that HCFA’s testing to date of
external systems had not been rigorous. Therefore, we stressed the
importance of HCFA’s final recertification tests, planned to occur between
July 1 and November 1, 1999.


5
  Year 2000 Computing Crisis: Readiness Status of the Department of Health and Human
Services (GAO/T-AIMD-99-92, February 26, 1999).
6
    GAO/T-AIMD-99-160, April 27, 1999.




Page 3                                                               GAO/T-AIMD-99-299
HCFA’s Actions to      HCFA continues to be responsive to our recommendations and make
                       progress in its Y2K efforts. To more effectively identify and manage risks,
Achieve Compliance     HCFA is relying on multiple sources of information, including test reports,
and Bolster Outreach   reports from its independent verification and validation (IV&V)
                       contractors, and weekly status reports from its contractor oversight teams.
Efforts to Medicare    In addition, HCFA has stationed staff at critical contractor sites to assess
Providers              the data being reported to them and to identify problems.

                       HCFA is also more effectively managing its electronic data exchanges. It
                       issued instructions to its contractors to inform providers and suppliers that
                       they must submit Medicare claims in an eight-digit format by April 5 of this
                       year. On September 22, HCFA reported that 99 percent of Part A providers
                       and all Part B providers were using the eight-digit format for claims
                       submissions.7 HCFA also issued new instructions to contractors for
                       reporting on data exchanges and created a new database to track status.

                       HCFA has also acted to improve its Y2K testing program. For example, it
                       has more clearly defined its testing procedures for its contractors 8 and is
                       using Y2K analysis tools to measure its testing thoroughness. In addition,
                       HCFA has improved its test coverage (e.g., systems functionality, HCFA-
                       mandated dates, interface coverage) of the external systems. In April 1999,
                       we reported that HCFA’s IV&V contractor had concerns with the
                       documentation of external systems’ test coverage associated with Y2K
                       testing to date.9 HCFA issued instructions on April 9, 1999, that required
                       each contractor to submit a traceability matrix that listed the business
                       functions covered by the recertification tests. Some HCFA contractors
                       continue to improve their test coverage by adding test cases10 to their
                       traceability matrices.




                       7
                        Part A claims are those submitted by hospitals, skilled nursing facilities, hospices, home
                       health agencies, and rehabilitation agencies. Part B claims are those submitted by
                       physicians, laboratories, durable medical equipment suppliers, outpatient providers, and
                       other practitioners.
                       8
                        From February 2, 1999, through September 22, 1999, HCFA issued 19 updates to its
                       recertification instructions to more clearly define its testing procedures.
                       9
                           GAO/T-AIMD-99-160, April 27, 1999.
                       10
                         A test case is a series of test scripts that identifies each testable condition of a system
                       (including valid and invalid conditions), the associated inputs, and the expected results.




                       Page 4                                                                     GAO/T-AIMD-99-299
                        In addition, an independent testing contractor is conducting tests on the six
                        standard systems and the CWF. HCFA also plans to perform end-to-end
                        testing with its Y2K-compliant test sites. These end-to-end tests are to
                        include all internal systems and contractor systems; however, they will not
                        include testing with banks and providers.

                        Another area in which HCFA has demonstrated progress is the
                        development of its overall business continuity and contingency plan, which
                        includes 29 internal plans. The agency established cross-organizational
                        workgroups to develop contingency plans for the following core business
                        functions: health plan and provider payment, eligibility and enrollment
                        issues, program integrity, managed care, quality of care, litigation, and
                        telecommunications. HCFA’s fifth iteration of its overall business continuity
                        and contingency plan (BCCP) was issued on July 1, 1999; the internal plans
                        are currently being validated.

                        As we have also reported, HCFA has taken comprehensive measures in
                        conducting its outreach activities.11 Outreach activities include information
                        dissemination as well as presentations and conferences. For example, the
                        HCFA Administrator sent out individual letters to over 1.1 million Medicare
                        providers in January and May of this year, alerting them to take prompt Y2K
                        action on their information and billing systems. HCFA has also established
                        a toll-free information hotline and plans to film a four-part series in
                        conjunction with the Health and Science television network that is to be
                        broadcast to hospitals and nursing facilities. In addition, as of June 25,
                        1999, the agency had held 12 Y2K conferences throughout the country, and
                        is planning to hold 10 more. Further, HCFA has a web site dedicated to Y2K
                        issues that contains information and advice to providers on how to assess
                        readiness, test systems, and develop contingency plans.



Key Challenges Remain   Although HCFA has improved its Y2K testing program, it still faces several
                        hurdles to completing its recertification tests by November 1, 1999. With
in Testing Mission-     only 5 weeks remaining to complete these critical recertification tests,
Critical Systems        HCFA has much work ahead. Unfortunately, this tight schedule is not being
                        guided by an overall plan because HCFA has not yet completed a detailed
                        integrated testing plan, including a critical path. In addition to executing
                        the recertification tests and resolving any errors that are discovered, HCFA

                        11
                         Year 2000 Computing Crisis: Status of Medicare Providers Unknown (GAO/AIMD-99-243,
                        July 28, 1999).




                        Page 5                                                            GAO/T-AIMD-99-299
                               is concurrently addressing other issues uncovered by Y2K assessment
                               tools. Further, HCFA is in the process of transitioning six contractors to
                               new data centers. Each of these overlapping efforts introduces risks that
                               could adversely affect the recertification testing of HCFA’s mission-critical
                               systems.


HCFA’s Recertification         In September 1998, we recommended that HCFA rank its remaining Y2K
Testing Program Is Not         work on the basis of a schedule that included milestones for renovation
                               and testing of all systems, and that it include time for end-to-end testing
Being Guided by an
                               and identify the critical path. 12 Such a schedule is extremely important
Integrated Testing Plan That   because of the number of systems, their complexity, and interdependencies
Identifies the Critical Path   among them.

                               The required sequencing of the 75 external and 25 internal systems
                               associated with the recertification requires an integrated testing schedule
                               to avoid testing overlap and scheduling constraints. Since each contractor
                               relies on the CWF and one of the six standard systems to process its claims,
                               these systems should be completely tested before the contractors test their
                               front-end and back-end processing systems with their respective standard
                               systems.

                               Given the limited time remaining, it is not possible for HCFA to conduct the
                               recertification testing in the optimal sequence. Therefore, testing overlap is
                               planned to occur—the 68 claims processing systems, 6 standard systems,
                               and the CWF are being concurrently tested. This testing approach is risky
                               because it results in managing multiple testing baselines and creates
                               challenges in ensuring that resolving one system’s testing errors do not lead
                               to problems in another system. For example, each of the 68 contractors has
                               tested with multiple versions of the CWF and their respective standard
                               system that have been changed to address Y2K errors identified during the
                               recertification testing. 13 HCFA officials acknowledge the added risk
                               associated with this testing overlap of the CWF, standard systems, and
                               contractor systems.




                               12
                                GAO/AIMD-98-284, September 28, 1998.
                               13
                                On September 24, 1999, HCFA officials told us that since the recertification testing began,
                               the CWF has been changed three times and that each of the standard systems has also been
                               changed.




                               Page 6                                                                  GAO/T-AIMD-99-299
                           Given that HCFA does not have enough time to conduct the recertification
                           tests in the proper sequence, it must now aggressively manage the risks
                           associated with the testing overlap. HCFA officials believe the risks are
                           manageable due to their oversight of contractor Y2K efforts. However,
                           effectively managing these risks calls for a more precise and focused effort,
                           namely, an integrated testing schedule that defines individual system
                           schedules and their interdependencies. Unfortunately, HCFA still does not
                           have such a schedule. Although HCFA has a high-level integrated project
                           plan that contains activities associated with its Y2K program, this plan does
                           not identify individual system testing schedules or the interdependencies
                           among all internal and external systems. In addition, it does not include the
                           detail necessary to identify the critical path that would establish the
                           sequence in which tasks must be completed to ensure that this complex
                           undertaking can be finished on time. Such a critical path remains an
                           essential tool that HCFA needs to have to manage risks.


HCFA Needs to Monitor      In addition to the challenge posed by the many system interdependencies,
Recertification Test       HCFA is making progress in the individual recertification testing of each of
                           the six standard systems and the CWF; however, this progress is uneven.
Execution by Contractors   For example, the MCS standard system contractor has executed 6,509 of its
and Address Y2K Errors     planned 6,734 recertification test scripts (97 percent), while the CWF
Expeditiously              contractor has only executed 55,606 of its 112,418 planned test scripts
                           (49 percent). Figure 1 shows the number of test scripts for each of the six
                           standard systems planned to be completed by October 8, and those actually
                           completed as of August 31, 1999. 14




                           14
                             In obtaining comments on a draft of this testimony, HCFA officials told us that they
                           provided us with incorrect information on the number of CWF planned recertification test
                           scripts as of August 31, 1999. They added that the correct number is 15,002 and that as of
                           September 24, 1999, 14,877 of these had been executed. They also provided updated
                           information on planned and executed test scripts for the six standard systems. We did not
                           present this updated information since HCFA officials were unable to provide supporting
                           documentation and were unable to provide the number of failures associated with these
                           executed test scripts.




                           Page 7                                                                 GAO/T-AIMD-99-299
Figure 1: Recertification Test Scripts Planned and Reported Executed for the Six
Standard Systems as of August 31, 1999




Note: The six standard systems consists of two Part A systems—Arkansas Part A Standard System
(APASS) and Fiscal Intermediaries Standard System (FISS)—and four Part B systems—GTE
Medicare System (GTEMS), Medicare Claims System (MCS), United Healthcare (UHC), and VIPS
Medicare System (VMS).
Source: HCFA.


The executed test scripts as of August 31, 1999, for the six standard
systems and the CWF have uncovered Y2K errors, as shown in table 1.



Table 1: Reported Failed Test Scripts for the Six Standard Systems and the CWF as
of August 31, 1999
                        APASS       FISS       GTEMS        MCS       UHC      VMS       CWF
Priority 1,2                  3         0             0        0        12         4            0
Priority 3,4,5                3         3             1       28       127         1    3,236


Source: HCFA.


As defined by HCFA, the priority 1 and 2 failures represent errors that
would result in Y2K failures of the system. The priority 3, 4, and 5 errors



Page 8                                                                    GAO/T-AIMD-99-299
                              represent lesser impacts, such as those for which there are either
                              alternative workarounds, those that do not affect a required mission
                              capability, or those that were reported as operator errors that need to be
                              retested. Because of the significance of the priority 1 and 2 failures, these
                              not only require correction, but the systems changes to address them need
                              to be retested to ensure that these changes do not introduce additional
                              errors. Since the final recertification tests will ultimately determine
                              whether HCFA’s mission-critical systems are Y2K compliant, it is essential
                              that HCFA and its IV&V contractor closely monitor test execution and the
                              resolution of these errors.


HCFA Needs to Assess Y2K      As an additional mechanism to ensure that mission-critical systems are free
Renovation Quality and Test   of Y2K errors and that ongoing recertification testing is adequate, HCFA is
                              using Y2K analysis tools on each of the six standard systems and the CWF.
Coverage Using Automated      These tools are to determine (1) the Y2K readiness of the software code
Tools                         (i.e., Y2K renovation quality) and (2) the adequacy of test coverage.

                              Preliminary results of the Y2K renovation quality tool reveal Y2K errors in
                              the code. This tool identifies potential Y2K errors in three categories—
                              (1) Y2K noncompliant errors, (2) suspect errors that may have a Y2K
                              impact, and (3) warnings that have the potential for Y2K problems—that
                              must be further analyzed to determine if indeed they are Y2K problems. For
                              example, the FISS standard system had 775 noncompliant findings and 100
                              warnings identified by the renovation quality tool; but, according to HCFA
                              officials, an analysis of the 875 potential problems found 49 actual Y2K
                              problems, 2 of which required renovation. In addition, HCFA officials told
                              us on September 24, 1999, that seven updates to the VMS standard system
                              have already occurred to address Y2K problems uncovered by the
                              renovation quality tool. Figure 2 presents the preliminary results of
                              executing the renovation quality tool for the six standard systems and the
                              CWF.




                              Page 9                                                      GAO/T-AIMD-99-299
Figure 2: Preliminary Results of the Renovation Quality Tool for the Six Standard
Systems and the CWF




Source: HCFA.


Until this analysis is complete, the extent of programming errors that must
be renovated and retested is unknown. Additionally, the utility of this tool
is minimized if the analysis of the results is not completed quickly and any
necessary changes are not incorporated into the recertification testing
program. On September 24, 1999, HCFA officials told us that they have
established an October 1, 1999, deadline for completing this analysis.

Turning to the test coverage tools, results reveal some systems with low
test coverage. HCFA uses two Y2K tools that assess test coverage by
identifying the total number of date references tested.15 The results of these
tools are analyzed, and inadequate test coverage results are remedied by




15
 Date references are the actual dates in the computer system.




Page 10                                                          GAO/T-AIMD-99-299
adding test cases. Figure 3 shows the percentage of the date references
tested for each of the standard systems and the CWF.16



Figure 3: Date References Tested for the Six Standard Systems and the CWF




Source: HCFA.


Of particular concern are the lower percentages for the GTEMS and, most
important, the CWF, which is the heart of the Medicare Claims Processing
System. To its credit, HCFA is asking these standard system contractors to
improve their test coverage by adding test cases to the ongoing
recertification tests. However, HCFA has limited time to plan, execute, and
analyze the results of additional test cases. Therefore, it should establish a
deadline to accomplish each of these activities.




16
 Due to time constraints, HCFA is not running the test coverage tool on all code associated
with the six standard systems and the CWF. Rather, according to HCFA officials, it has
decided to run the tool on just the eligibility and claims processing portions of these
systems, since these are the critical software components for processing Medicare claims.




Page 11                                                                GAO/T-AIMD-99-299
HCFA Needs to Expedite      The recertification testing for 6 of the 68 contractors has recently been
Contractor Transitions to   delayed due to the recent departure of a data center 17 that had been
                            providing service to these 6 contractors. These six contractors now have to
New Data Centers            be transferred to other data centers. Because these six transitions are
                            scheduled to occur from mid-September through early November, these
                            contractors will not be able to complete their recertification testing by
                            November 1. The six contractors intend to complete the recertification
                            testing by December 1, covering the two most immediate planned HCFA
                            testing dates rather than all of the required four future date recertification
                            tests.18 HCFA needs to expedite the transitions to these new data centers
                            and recertification testing associated with these six contractors because of
                            the limited time available to address any schedule delays or problems
                            identified in the recertification testing.


HCFA Needs to Minimize      As noted in our January 1999 testimony, changes made to systems after
System Changes Through      they have been certified as Y2K compliant can introduce new Y2K
                            problems.19 To address this risk, we suggested that OMB consider directing
March 31, 2000              agencies to adopt a strong change management policy−one that limits new
                            software and systems changes.

                            In response to our suggestion, in May, OMB issued a memorandum to
                            federal department heads stating the importance of considering the
                            potential effect of changes to information technology systems on Y2K
                            readiness, and urging agency heads to adopt a policy that only allows
                            system changes where absolutely necessary. OMB also requested that
                            agency heads summarize in their quarterly Y2K progress reports how they
                            would implement such guidance.

                            HCFA has acted to implement OMB’s request. Specifically, HCFA reported
                            on June 3, 1999, that it implemented controls to minimize system changes
                            after July 1. In addition, HHS reported in its August 1999 quarterly report to


                            17
                              HCFA has 23 data centers−large claims processing operations that operate one or more of
                            the standard systems for one or more of the 68 contractors. A data center may also be a host
                            site for the CWF.
                            18
                             HCFA’s recertification is to test four future dates−12/31/1999 rollover to 1/4/2000, 2/27/2000
                            rollover to 3/2/2000, 9/30/2000, and 12/30/2000 rollover to 1/2/2001.
                            19
                             Year 2000 Computing Crisis: Readiness Improving, But Much Work Remains to Avoid Major
                            Disruptions (GAO/T-AIMD-99-50, January 20, 1999).




                            Page 12                                                                   GAO/T-AIMD-99-299
                        OMB that HCFA’s formal moratorium that halts systems changes to Y2K-
                        certified systems is October 1, 1999, through March 31, 2000. HHS’
                        quarterly report also states that exceptions to the moratorium may be
                        allowed through a strict approval process. Such an exception is HCFA’s
                        planned October 1999 and January 2000 provider payment updates. In
                        April, we reported that these updates contribute to HCFA’s already
                        monumental testing challenge. However, HCFA officials told us that these
                        updates are minor and that they do not expect them to impede the
                        recertification testing program.



Other Critical Risks    In addition to the challenges associated with its recertification testing,
                        HCFA must also address three other critical areas. First, contractor
and Challenges Remain   progress in testing with providers has been limited. Second, many MCOs
                        have outstanding issues to address in order to become Y2K compliant.
                        Finally, HCFA needs to complete and validate internal, contractor, and
                        MCO business continuity and contingency plans.


HCFA Needs to Monitor   In addition to individual systems testing, HCFA must also test its systems
Provider Testing With   end-to-end to verify that defined sets of interrelated systems, which
                        collectively support an organizational core business function, will work as
Contractors             intended. Since providers submit Medicare claims through claims
                        processing contractors, HCFA has tasked these contractors to future date
                        test with their respective providers and encouraged providers to take
                        advantage of the opportunity to future date test with contractors. In March
                        1999, HCFA required all Medicare contractors to establish test
                        environments that would allow Medicare claims from providers and
                        submitters20 to be validated in a future date environment. In May 1999,
                        HCFA further defined this requirement by establishing a goal for
                        contractors to future date test with providers that represent at least
                        50 percent of the annual claims volume.

                        In July, we reported that contractor testing with providers/submitters had
                        been limited and testing that had occurred had identified problems. 21
                        Specifically, as of June 21, 1999, 38 of 68 contractors had not initiated any
                        testing with their respective providers. Of the remaining 30, only 1 had

                        20
                         Submitters are third-party billers or clearinghouses that bill for providers.
                        21
                         GAO/AIMD-99-243, July 28, 1999.




                        Page 13                                                                   GAO/T-AIMD-99-299
tested with more than 1 percent of its respective providers. We also
reported that according to HCFA’s web site, the one Medicare contractor
that completed substantial testing of 434 providers encountered initial
problems with 123 (28 percent); 9 of these were critical failures that
produced dates of 1900 and 1901 during the testing process. We also
reported that contractor/provider testing only identifies problems with data
exchanges. Accordingly, it does not address whether providers’ systems
that process Medicare claims are Y2K compliant.

HCFA’s latest information on contractor/provider testing continues to be
discouraging. As of September 21, 1999, HCFA’s data showed that of 75
contractors, 69 have initiated testing with their respective providers.22
However, HCFA reports that 40 of the 69 contractors have tested with less
than 1 percent of their providers. Table 2 shows the percentage of
providers that have future date tested with each of the 69 contractors.



Table 2: Contractor/Provider Testing Status as of September 21, 1999
                                                Providers that have tested with
Number of contractors                           contractors
40                                              Less than 1 %
22                                              1 to 4 %
6                                               6 to 12 %
1                                               100 %
Total 69


Source: HCFA.


HCFA also continues to report that Y2K failures are occurring during
provider/contractor testing. On September 22, HCFA’s chief information
officer reported that 10 to 20 percent of the providers/submitters who have
tested with contractors have experienced failures due to incorrect claim
dates. These failures were attributed to provider hardware and software
problems. Concerning HCFA’s goal to test with providers/submitters who




22
 HCFA’s most recent data on contractor/provider testing lists 75 instead of 68 claims
processing contractors, because HCFA tracks this testing by identification number and
some contractors have been assigned more than one identification number.




Page 14                                                               GAO/T-AIMD-99-299
                            represent 50 percent of their total claims volume, HCFA reports that only
                            nine contractors have met this goal as of September 20, 1999.

                            HCFA and the President’s Council on Year 2000 Conversion also have
                            concerns about providers’ Y2K readiness. HCFA officials told us that
                            despite their outreach efforts to the provider community, providers are
                            reluctant to test with Medicare contractors. The President’s Council on
                            Year 2000 Conversion, established in February 1998 to, among other things,
                            increase awareness of and gain cooperation in addressing the Y2K problem
                            in various economic sectors, also recently highlighted concerns about the
                            compliance status of health care provider recordkeeping and billing
                            systems. Last month, the Council reported that Y2K failures in these billing
                            and recordkeeping systems, if not promptly addressed, could interfere with
                            normal payment processes and force smaller, cash-strapped providers to
                            suspend operations.23

                            Until these data exchanges between providers and contractors are future
                            date tested, the ability of these entities to process Medicare claims in a
                            future date environment is unknown. Therefore, it is essential that HCFA
                            continue to monitor and publicize provider testing with contractors and
                            establish milestones for contractors to test with providers.


HCFA Needs to Ensure That   In addition to fee-for-service contractors, 6.9 million of Medicare’s
Managed Care                39 million beneficiaries are currently enrolled in 383 MCOs. In January
                            1999, HCFA required that by April 15, 1999, the MCOs certify their systems
Organizations Are Y2K       as Y2K compliant. In April, we testified that HCFA had received
Compliant                   certifications from 315 MCOs and that, similar to the claims processing
                            contractors, 271 of the 315 contained qualifications (exceptions). 24

                            HCFA’s most recent data on these certifications continue to be of concern.
                            HCFA had received certifications from 425 MCOs, 25 and reported that as of
                            June 1999, 365 of the 425 certification statements contained qualifications
                            (86 percent) and that only 4 were Y2K compliant. The President’s Council


                            23
                              The President’s Council on Year 2000 Conversion: Third Summary of Assessment
                            Information, August 5, 1999.
                            24
                             GAO/T-AIMD-99-160, April 27, 1999.
                            25
                             Since July 1999, the number of MCOs decreased from 425 to 383 because 52 left the
                            Medicare program while 10 new MCOs joined.




                            Page 15                                                              GAO/T-AIMD-99-299
on Year 2000 Conversion also recently highlighted concerns about the Y2K
readiness of MCOs. The Council reported in August that serious concerns
exist with MCOs that either started late in addressing the problem or have
yet to take significant steps toward achieving full Y2K readiness. 26

To focus the limited remaining time on the higher risk MCOs, HCFA, with
assistance from a contractor, performed a risk assessment of each of the
425 MCOs using the certification statements and the associated
qualifications, along with other criteria.27 HCFA’s June 1999 risk assessment
concluded that

• 94 MCOs are high risk (22 percent),
• 314 MCOs are medium risk (74 percent), and
• 17 MCOs are low risk (4 percent).

To ensure that reported qualifications are being addressed and that these
MCOs are adequately addressing their Y2K challenges, HCFA is conducting
site visits covering 184 MCOs, which include the 94 high-risk MCOs.
According to HCFA, the 184 serve about 90 percent of the 6.9 million MCO
Medicare beneficiary population. HCFA officials told us that they are using
the self-reported results of a Medicare Y2K survey by the HHS Office of the
Inspector General to follow up on the status of the MCOs not covered in the
site visits. The Inspector General survey results are expected to be released
by the end of this month.

Although HCFA’s “risk-approach” to determining the Y2K status of MCOs
has been useful, it is essential that HCFA now focus on the resolution of
reported qualifications and whether each of the MCOs is Y2K compliant.
On January 25, 1999, HCFA instructed MCOs that a formal recertification
would be required later in 1999; however, HCFA officials now tell us they
have decided that a formal recertification will not be required. Without
such a recertification, risks are enhanced that MCOs will experience Y2K-
related disruptions. Accordingly, we believe that HCFA should reconsider
this decision. As part of our ongoing work for the Senate Special


26
  The President’s Council on Year 2000 Conversion: Third Summary of Assessment
Information, August 5, 1999.
27
 The other criteria were size, tax status, corporate experience, sole MCO in region, data
exchanges, Y2K risk assessment, contingency planning, independent verification and
validation, monitoring of results, centralized management, delegation, stability, and system
compliance.




Page 16                                                                 GAO/T-AIMD-99-299
                          Committee on Aging, we plan to review the resolution of the qualifications
                          associated with MCO certifications and HCFA’s follow-up actions to
                          determine whether each MCO is Y2K compliant.


HCFA Needs to Complete    Given the magnitude of the many challenges that HCFA continues to face,
and Validate Internal,    the development of BCCPs to ensure continuity of critical operations and
                          business processes is essential. HCFA continues to make steady progress
Contractor, and MCO       on its agencywide and 29 internal BCCPs; however, the status of contractor
Business Continuity and   plans is unknown, and the results of HCFA’s initial review of MCO plans are
Contingency Plans         not promising.

                          HCFA has completed its agencywide BCCP that includes 29 internal plans;
                          however, essential validation activities remain. As of September 2, 1999,
                          HCFA reported that it had procedurally validated 25 of these 29 plans. 28 Of
                          the remaining four plans, it plans to procedurally validate three of them.
                          The remaining BCCP−Medicare contractor management−does not require
                          validation because it is currently being used to guide contractor transitions,
                          according to agency officials. In addition to the procedural validations,
                          HCFA reports that 11 of the internal plans require additional validation
                          through extensive simulation and/or operational reviews.29 It is unclear
                          when these more detailed validations will be completed since HCFA has
                          missed its latest milestone of August 30, 1999, to validate BCCPs and has
                          not yet established a new deadline. Such validation activities are essential
                          to ensuring that BCCPs can be executed in the event of Y2K-induced
                          failures.

                          The status of Medicare contractor BCCPs is unknown. In May 1999, HCFA
                          reviewed 7730 contractor plans and concluded that 17 of these required
                          major improvement. However, HCFA’s BCCP technical support contractor
                          stated that not all Medicare contractors have specified detailed procedures
                          that are required for executing and testing BCCPs. Our assessment of these

                          28
                           According to HCFA, procedural validation consists of emergency response team members
                          reviewing the BCCP to confirm basic procedures and discussing responsibilities for
                          different failure scenarios to ensure adequate staffing.
                          29
                           According to HCFA, simulation consists of emergency response team role-playing from
                          alternate facilities with minimal test scripts, while operational validation is used to evaluate
                          the most complex and critical BCCPs under full or partial operating conditions using
                          detailed scripts.
                          30
                           Some contractors submitted more than oneBCCP.




                          Page 17                                                                    GAO/T-AIMD-99-299
plans is consistent with the technical support contractor−HCFA does not
yet have the detailed plans from most contractors.

To address this situation, HCFA issued a memorandum on August 6, 1999,
instructing Medicare contractors to have detailed BCCPs available for
HCFA’s review by September 30. HCFA plans to review these at each of the
contractor’s site using agency Y2K contractor oversight teams. To prepare
these teams for this review, HCFA’s technical assistance contractor recently
provided training to them, along with checklists, that will be used to assess
the adequacy of Medicare contractor BCCPs. On September 24, 1999, HCFA
officials told us that these assessments are to be completed by October 30,
1999. We remain concerned about the late completion dates associated
with these plans and whether there will be sufficient time remaining to test
them.

The status of MCO BCCPs is likewise not encouraging. HCFA required
MCOs participating in the Medicare program to submit their plans to HCFA
by July 15, 1999. As of September 2, 1999, HCFA had received BCCPs
covering 310 of the 383 MCOs. HCFA’s review of these 310 concluded that
69 percent of them need major improvement, 18 percent need minor
improvement, and 13 percent were reasonable.

HCFA has been active in following up on the MCO BCCPs. For example, it
mailed letters to each of the 73 that have not yet submitted plans. In
addition, it sent letters to those MCOs with plan deficiencies and has
requested that those plans in the “needs major improvement” category be
resubmitted by September 28. In addition, HCFA has held three
workshops−in Los Angeles, Denver, and Atlanta−to assist MCOs in
developing BCCPs. HCFA officials told us they have requested that the
MCOs validate their plans by the end of November, but they could not
provide documentation to us to substantiate this request.

Limited time remains to complete and validate all BCCPs. Therefore, it is
essential that HCFA sustain its efforts to validate all internal plans and
closely monitor the completion and validation of contractor and MCO
plans.

In summary, HCFA and its contractors have made progress in addressing
Medicare Y2K issues. However, until HCFA completes the ongoing
recertification tests, the final status of the agency’s Y2K compliance will
remain unknown. Limited time remains to completely test all systems that
process Medicare claims for Y2K compliance (internal, fee-for-service



Page 18                                                     GAO/T-AIMD-99-299
                   contractor, MCO, and provider). Nevertheless, HCFA must sustain its
                   efforts, because any progress made in testing these many systems lowers
                   the risk of disruptions to Medicare and the claims payment process. HCFA
                   must also continue to closely monitor contractor testing with providers
                   that to date has been limited but has uncovered Y2K problems. In addition,
                   HCFA needs to continue its efforts to ensure that MCOs are adequately
                   addressing their Y2K challenges. Given the considerable amount of work
                   that remains in the next few months, it is crucial that the development and
                   testing of internal, contractor, and MCO BCCPs move forward rapidly to
                   ensure that no matter what, providers will be paid and beneficiaries will
                   receive care. This concludes my statement, and I would be pleased to
                   respond to any questions at this time.



Contact and        For information about this testimony, please contact Joel Willemssen at
                   (202) 512-6253 or by e-mail at willemssenj.aimd@gao.gov. Individuals
Acknowledgments    making key contributions to this testimony included Dr. Nabajyoti
                   Barkakati, Christina Bower, Mary Dorsey, Dr. Robert Norris, and Dave
                   Powner.




(511797)   Leter   Page 19                                                   GAO/T-AIMD-99-299
Ordering Information

The first copy of each GAO report and testimony is free.
Additional copies are $2 each. Orders should be sent to the
following address, accompanied by a check or money order made
out to the Superintendent of Documents, when necessary, VISA and
MasterCard credit cards are accepted, also.

Orders for 100 or more copies to be mailed to a single address are
discounted 25 percent.

Orders by mail:

U.S. General Accounting Office
P.O. Box 37050
Washington, DC 20013

or visit:

Room 1100
700 4th St. NW (corner of 4th and G Sts. NW)
U.S. General Accounting Office
Washington, DC

Orders may also be placed by calling (202) 512-6000
or by using fax number (202) 512-6061, or TDD (202) 512-2537.

Each day, GAO issues a list of newly available reports and
testimony. To receive facsimile copies of the daily list or any list
from the past 30 days, please call (202) 512-6000 using a touchtone
phone. A recorded menu will provide information on how to obtain
these lists.

For information on how to access GAO reports on the INTERNET,
send an e-mail message with “info” in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web Home Page at:

http://www.gao.gov
United States                       Bulk Mail
General Accounting Office      Postage & Fees Paid
Washington, D.C. 20548-0001           GAO
                                 Permit No. GI00
Official Business
Penalty for Private Use $300

Address Correction Requested