Information Technology:

Centers for Medicare & Medicaid Services Needs to Establish Critical Investment Management Capabilities

GAO-06-12: Published: Oct 28, 2005. Publicly Released: Nov 28, 2005.

Additional Materials:

Contact:

David A. Powner
(202) 512-3000
contact@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

To carry out its mission of ensuring health care security for beneficiaries, the Centers for Medicare & Medicaid Services (CMS) relies heavily on information technology (IT) systems. In fiscal year 2005, CMS's total IT appropriations was about $2.55 billion, of which about $760 million, or 30 percent, was to support internal investments, and $1.79 billion was to fund the Medicaid Management Information Systems (MMIS) that states use to support their Medicaid programs. (GAO is using the term "internal" to refer to all of CMS' IT investments excluding state MMISs.) In light of the size and significance of these investments, GAO's objectives were to (1) evaluate CMS's capabilities for managing its internal investments, (2) determine any plans the agency might have for improving these capabilities, and (3) examine CMS's process for approving and monitoring state MMISs.

Judged against GAO's framework for IT investment management, which measures the maturity of an organization's investment management process, CMS's capabilities for effectively managing its internal investments are limited. Specifically, the agency has established a little over half of the foundational practices it needs to manage individual investments and has executed 2 of the 27 key practices needed to manage investments as a portfolio. Until CMS fully establishes foundational and portfolio-level practices, executives will lack the assurance that they are managing the agency's collection of investments in a manner that minimizes risks and maximizes returns. CMS has initiated steps to improve its investment management process; however, these steps do not fully address the weaknesses GAO identifies in this report, nor are they coordinated with other needed improvement efforts into a plan that (1) is based on an assessment of strengths and weaknesses; (2) specifies measurable goals, objectives, and milestones; (3) specifies needed resources; (4) assigns clear responsibility and accountability for accomplishing tasks; and (5) is approved by senior-level management. Without such a plan and procedures for implementing it, CMS will be challenged in sustaining the commitment it needs to fully establish its investment management process. The process for approving requests for federal funding of MMIS activities (including development, operations, and maintenance activities) is characterized by standard procedures, guidance, and reported information to CMS's Center for Medicaid and State Operations. In contrast, the process for monitoring MMIS activities lacks standard procedures, guidance, and reporting requirements. Without these elements for monitoring MMIS activities, CMS may not be able to easily determine whether the state MMISs in which CMS invests close to $1.7 billion annually are facilitating the delivery of Medicaid benefits in the most effective and beneficial manner.

Recommendations for Executive Action

  1. Status: Closed - Implemented

    Comments: In February 2006, CMS issued an updated IT Investment Management Process Guide to reflect its current investment management process for providing an integrated and structured methodology for the selection, implementation, and evaluation of the agency's IT investments. For example, this updated Guide includes the identification of nine Executive Steering Committees chartered by the agency's IT Investment Review Board, to manage the portfolios of IT investments that help CMS achieve its core mission and business functions.

    Recommendation: To strengthen CMS's capability to manage its internal IT investments and address the related weaknesses addressed in this report, the Secretary of the Department of Health and Human Services should direct the CMS Administrator to develop and implement a plan for improving CMS's IT investment management processes. The plan should address the weaknesses described in this report. The plan should (1) first focus on correcting the weaknesses in Stage 2 critical processes, and next focus on the Stage 3 critical processes, and (2) at a minimum, update the agency's investment management guide to reflect current investment management processes.

    Agency Affected: Department of Health and Human Services

  2. Status: Closed - Implemented

    Comments: In February 2006, CMS issued an updated IT Investment Management Process Guide to reflect its current investment management process for providing an integrated and structured methodology for the selection, implementation, and evaluation of the agency's IT investments. According to minutes from IT Investment Review Board (ITIRB) meetings, comments on the Guide were solicited from the ITIRB in January 2006, and the comments submitted were incorporated into the Guide prior to its approval by the ITIRB in February 2006.

    Recommendation: To strengthen CMS's capability to manage its internal IT investments and address the related weaknesses addressed in this report, the Secretary of the Department of Health and Human Services should direct the CMS Administrator to develop and implement a plan for improving CMS's IT investment management processes. The plan should address the weaknesses described in this report. The plan should (1) first focus on correcting the weaknesses in Stage 2 critical processes, and next focus on the Stage 3 critical processes, and (2) at a minimum, establish a process for the board to actively maintain the agency's documented investment management process.

    Agency Affected: Department of Health and Human Services

  3. Status: Closed - Implemented

    Comments: In August 2006, the agency issued its revised CMS Strategic Action Plan, 2006-2009. In the Plan, CMS presented its mission and vision for transforming and modernizing America's health care system with specific goals and objectives. The Plan also indicated how the agency's IT investments support each of the Plan's stated objectives.

    Recommendation: To strengthen CMS's capability to manage its internal IT investments and address the related weaknesses addressed in this report, the Secretary of the Department of Health and Human Services should direct the CMS Administrator to develop and implement a plan for improving CMS's IT investment management processes. The plan should address the weaknesses described in this report. The plan should (1) first focus on correcting the weaknesses in Stage 2 critical processes, and next focus on the Stage 3 critical processes, and (2) at a minimum, use an updated strategic plan or other detailed statement of business mission with supporting goals and objectives to align investments with business needs.

    Agency Affected: Department of Health and Human Services

  4. Status: Closed - Implemented

    Comments: The agency's IT Investment Review Board's (ITIRB) charter, dated February 17, 2005, states that the ITIRB is responsible for managing CMS's IT capital investment portfolios, making adjustments to accommodate business scenarios and strategies. To do this, the board is to review the performance of IT investments using established criteria and checkpoints in meeting cost, schedule, risk, and benefit expectations and to take corrective actions when expectations are not being met. In August 2006, CMS reported that the ITIRB had approved the FY 2006/2007 ranked IT projects and systems in alignment of strategic goals and objectives, and that the FY 2007/2008 IT investments would similarly be ranked and approved. The agency provided evidence, which included meeting minutes, that the ITIRB repeatedly evaluates the alignment of its IT projects as the fiscal year progresses to ensure the most pressing ones are funded to meet strategic goals and objectives, and it realigns priorities when corrective actions are needed to address funding constraints.

    Recommendation: To strengthen CMS's capability to manage its internal IT investments and address the related weaknesses addressed in this report, the Secretary of the Department of Health and Human Services should direct the CMS Administrator to develop and implement a plan for improving CMS's IT investment management processes. The plan should address the weaknesses described in this report. The plan should (1) first focus on correcting the weaknesses in Stage 2 critical processes, and next focus on the Stage 3 critical processes, and (2) at a minimum, ensure that the board periodically evaluates the alignment of IT projects and systems with strategic goals and objectives and take corrective actions when misalignment occurs.

    Agency Affected: Department of Health and Human Services

  5. Status: Closed - Implemented

    Comments: In February 2006, CMS issued an updated IT Investment Management Process Guide to reflect its current investment management process for providing an integrated and structured methodology for the selection, implementation, and evaluation of the agency's IT investments. It defines the procedures for selecting and reselecting IT investments for funding by requiring the agency to review all new and ongoing investment projects. Among other things, the procedures require all new investments as well as major enhancements to existing investments to go through a business architecture review to ensure that the investment meets the agency's business needs and architectural requirements. For each investment, the Guide identifies specific information to be provided by an agency component when requesting funding.

    Recommendation: To strengthen CMS's capability to manage its internal IT investments and address the related weaknesses addressed in this report, the Secretary of the Department of Health and Human Services should direct the CMS Administrator to develop and implement a plan for improving CMS's IT investment management processes. The plan should address the weaknesses described in this report. The plan should (1) first focus on correcting the weaknesses in Stage 2 critical processes, and next focus on the Stage 3 critical processes, and (2) at a minimum, fully document procedures that address investment selection and reselection and provide a clear understanding of the selection and reselection process.

    Agency Affected: Department of Health and Human Services

  6. Status: Closed - Implemented

    Comments: In February 2006, CMS issued an updated IT Investment Management Process Guide to reflect its current investment management process for providing an integrated and structured methodology for the selection, implementation, and evaluation of the agency's IT investments. The Guide defines the roles and responsibilities of participating units, from the agency component sponsoring the investment to the IT Investment Review Board (ITIRB) reviewing it. They include the nine Executive Steering Committees which report directly to the ITIRB and are chartered to manage the portfolios of IT investments that help CMS achieve its core mission and business functions.

    Recommendation: To strengthen CMS's capability to manage its internal IT investments and address the related weaknesses addressed in this report, the Secretary of the Department of Health and Human Services should direct the CMS Administrator to develop and implement a plan for improving CMS's IT investment management processes. The plan should address the weaknesses described in this report. The plan should (1) first focus on correcting the weaknesses in Stage 2 critical processes, and next focus on the Stage 3 critical processes, and (2) at a minimum, fully document procedures that address investment selection and reselection and define the roles and responsibilities for each participating unit involved in the project reselection process.

    Agency Affected: Department of Health and Human Services

  7. Status: Closed - Implemented

    Comments: In February 2006, CMS issued an updated IT Investment Management Process Guide to reflect its current investment management process. The guide fully documents the procedures needed for selection and reselection of investments, including decision-making procedures to be followed.

    Recommendation: To strengthen CMS's capability to manage its internal IT investments and address the related weaknesses addressed in this report, the Secretary of the Department of Health and Human Services should direct the CMS Administrator to develop and implement a plan for improving CMS's IT investment management processes. The plan should address the weaknesses described in this report. The plan should (1) first focus on correcting the weaknesses in Stage 2 critical processes, and next focus on the Stage 3 critical processes, and (2) at a minimum, fully document procedures that address investment selection and reselection and define the decision-making procedures.

    Agency Affected: Department of Health and Human Services

  8. Status: Closed - Implemented

    Comments: In February 2006, CMS issued an updated IT Investment Management Process Guide to reflect its current investment management process for providing an integrated and structured methodology for the selection, implementation, and evaluation of the agency's IT investments. This guide identifies the policies and procedures for integrating funding with the selection of IT investments by describing how the budget process is also used to select projects. For example, the Office of Information Services and the Office of Financial Management, through the use of budget request call letters, require each CMS component to submit information on new investments and to update information on existing investments, often requested for several budget planning years at a time.

    Recommendation: To strengthen CMS's capability to manage its internal IT investments and address the related weaknesses addressed in this report, the Secretary of the Department of Health and Human Services should direct the CMS Administrator to develop and implement a plan for improving CMS's IT investment management processes. The plan should address the weaknesses described in this report. The plan should (1) first focus on correcting the weaknesses in Stage 2 critical processes, and next focus on the Stage 3 critical processes, and (2) at a minimum, document procedures for integrating funding with investment selection.

    Agency Affected: Department of Health and Human Services

  9. Status: Closed - Implemented

    Comments: CMS's February 5, 2007, memo on the selection and reselection of investments for fiscal years 2008 and 2009, required detailed information to be provided to the ITIRB on each of the agency's IT investments, including information on cost, schedule, benefits and risk factors. The April 2007 CMS Policy for Information Technology Investment Management & Governance specified the ITIRB's responsibility for establishing IT portfolio selection criteria and thresholds to ensure that optimal IT investment portfolios with manageable risks and returns are selected and funded.

    Recommendation: To strengthen CMS's capability to manage its internal IT investments and address the related weaknesses addressed in this report, the Secretary of the Department of Health and Human Services should direct the CMS Administrator to develop and implement a plan for improving CMS's IT investment management processes. The plan should address the weaknesses described in this report. The plan should (1) first focus on correcting the weaknesses in Stage 2 critical processes, and next focus on the Stage 3 critical processes, and (2) at a minimum, revise the Information Technology Investment Review Board's (ITIRB) selection and reselection criteria to include cost, benefit, schedule, and risk factors, and establish a mechanism to ensure these criteria continue to reflect organizational objectives.

    Agency Affected: Department of Health and Human Services

  10. Status: Closed - Implemented

    Comments: In January 2007, CMS initiated a control review process for IT investments by collecting and analyzing cost, schedule, risk, and performance information, and reported that control reviews would be conducted by the ITIRB on a quarterly basis. CMS' initial data call letter for this process, dated January 23, 2007, specified the information to be collected, which included cost and schedule performance data, and risk information. The letter also stated that this process was to address key weaknesses identified by GAO. The results of this data call were discussed at the ITIRB's February 15, 2007, meeting. This process was repeated the following quarter with a data call letter issued on April 12, 2007, and the results of the data call discussed at the ITIRB's May 17, 2007, meeting.

    Recommendation: To strengthen CMS's capability to manage its internal IT investments and address the related weaknesses addressed in this report, the Secretary of the Department of Health and Human Services should direct the CMS Administrator to develop and implement a plan for improving CMS's IT investment management processes. The plan should address the weaknesses described in this report. The plan should (1) first focus on correcting the weaknesses in Stage 2 critical processes, and next focus on the Stage 3 critical processes, and (2) at a minimum, define, document, and implement procedures for the ITIRB's oversight of projects and systems.

    Agency Affected: Department of Health and Human Services

  11. Status: Closed - Implemented

    Comments: CMS implemented processes to use investment information to fully support its selection and control processes. Specifically, in its FY 2007/2008 Budget Request Call Letter providing instructions for the selection and reselection of IT investments, CMS required its components to provide information on project costs, schedule, risk and benefit, and to complete an IT project data spreadsheet for each IT investment. Similarly, CMS continued this process with its FY 2008/2009 IT Budget Request Call Letter, dated February 5, 2007, requesting detailed project information for the ITIRB to review for making IT investment recommendations, and for enabling CMS to make sound investment management decisions. Results of these call letter requests were discussed at subsequent ITIRB meetings. Also, in January 2007 CMS implemented a control review process for IT investments, reporting that the control reviews would be conducted by the ITIRB on a quarterly basis. CMS' initial data call for this process, dated January 23, 2007, specified the information to be collected, which included, among other data, cost and schedule performance data, and risk information. The results of this data call, as well as the following one initiated April 12, 2007, were presented at subsequent ITIRB meetings held February 15, 2007, and May 17, 2007, respectively.

    Recommendation: To strengthen CMS's capability to manage its internal IT investments and address the related weaknesses addressed in this report, the Secretary of the Department of Health and Human Services should direct the CMS Administrator to develop and implement a plan for improving CMS's IT investment management processes. The plan should address the weaknesses described in this report. The plan should (1) first focus on correcting the weaknesses in Stage 2 critical processes, and next focus on the Stage 3 critical processes, and (2) at a minimum, implement processes to use investment information to fully support investment management decisions.

    Agency Affected: Department of Health and Human Services

  12. Status: Closed - Implemented

    Comments: CMS has implemented processes for managing its investments as a portfolio. Specifically, the agency developed criteria for selecting the investments to be included in its IT portfolio. To assist in the process of creating the portfolio, the agency developed a tool for collecting performance information on its investments in order to prioritize the investments for inclusion in the portfolio. CMS also instituted a quarterly control process for its investment review board to evaluate and improve the performance of the mix of IT investments included in the portfolio. In addition, the agency developed written policy, including a template, for conducting post-implementation reviews (PIRs) no later than one year following the implementation of each investment/project to determine if the investment/project delivered the anticipated benefits and results. In April 2010 CMS provided results of its first PIR. By implementing the critical processes associated with managing its investments as a portfolio, CMS will have an enterprisewide perspective to make informed decisions about its collection of investments.

    Recommendation: To strengthen CMS's capability to manage its internal IT investments and address the related weaknesses addressed in this report, the Secretary of the Department of Health and Human Services should direct the CMS Administrator to develop and implement a plan for improving CMS's IT investment management processes. The plan should address the weaknesses described in this report. The plan should (1) first focus on correcting the weaknesses in Stage 2 critical processes, and next focus on the Stage 3 critical processes, and (2) at a minimum, implement the Stage 3 critical processes for defining portfolio criteria, creating the portfolio, evaluating the portfolio, and conducting postimplementation reviews, which are necessary for portfolio management.

    Agency Affected: Department of Health and Human Services

  13. Status: Closed - Implemented

    Comments: While CMS did not complete a separate plan that drew together all its efforts to address the weaknesses identified in our report, the agency has taken actions since the issuance of our report in October 2005 to implement each of the recommendations.

    Recommendation: The Secretary for Health and Human Services should direct the CMS Administrator to ensure that the plan draw together ongoing efforts and additional efforts that are needed to address the weaknesses identified in this report. The plan should also (1) specify measurable goals, objectives, and milestones; (2) specify needed resources; (3) assign clear responsibility and accountability for accomplishing tasks; and (4) be approved by senior-level management. In implementing the plan, the Administrator should ensure that progress is measured and reported periodically to the Secretary of Health and Human Services.

    Agency Affected: Department of Health and Human Services

  14. Status: Closed - Implemented

    Comments: In September 2008, CMS provided evidence of regional office procedures for monitoring MMIS activities. The agency issued instructions for its regional office to track the amounts claimed by states under the Medicaid program at the 90% federal financial participation rate under an approved Advance Planning Document, focusing on Health Insurance Portability and Accountability Act (HIPPA) related expenditures. A breakout between HIPAA and non-HIPAA funding is to be reported to the extent that it is identifiable.

    Recommendation: To improve CMS's process for monitoring states' progress in developing and maintaining Medicaid management information systems, the Secretary of the Department of Health and Human Services should direct the CMS Administrator to define standard procedures and supporting guidance for regional offices to monitor MMIS activities.

    Agency Affected: Department of Health and Human Services

  15. Status: Closed - Implemented

    Comments: In September 2008, CMS provided evidence of instructions for its regional offices to track quarterly the amounts claimed by states under the Medicaid program at the 90% federal financial participation rate under an approved Advance Planning Document, focusing on Health Insurance Portability and Accountability Act (HIPPA) related expenditures. A breakout between HIPAA and non-HIPAA funding is to be reported to the extent that it is identifiable. The reports, which are submitted to CMS headquarters, provide information on each individual APD for each state within each regional office, as well as a summary by regional office.

    Recommendation: To improve CMS's process for monitoring states' progress in developing and maintaining Medicaid management information systems, the Secretary of the Department of Health and Human Services should direct the CMS Administrator to require regional offices to regularly report on their MMIS monitoring activities to CMS's central office.

    Agency Affected: Department of Health and Human Services

 

Explore the full database of GAO's Open Recommendations »

Sep 23, 2014

Jun 10, 2014

May 22, 2014

May 12, 2014

May 8, 2014

May 7, 2014

Apr 2, 2014

Feb 26, 2014

Feb 12, 2014

Looking for more? Browse all our products here