This is the accessible text file for GAO report number GAO-09-966 
entitled 'Information Technology: Social Security Administration's Data 
Exchanges Support Current Programs, but Better Planning Is Needed to 
Meet Future Demands' which was released on October 16, 2009. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Report to the Chairman, Committee on Finance, U.S. Senate: 

United States Government Accountability Office: 
GAO: 

September 2009: 

Information Technology: 

Social Security Administration's Data Exchanges Support Current 
Programs, but Better Planning Is Needed to Meet Future Demands: 

GAO-09-966: 

GAO Highlights: 

Highlights of GAO-09-966, a report to the Chairman, Committee on 
Finance, U.S. Senate. 

Why GAO Did This Study: 

The Social Security Administration (SSA) receives electronic data from 
other agencies to support its own programs, and provides electronic 
data to support more than 800 state and federal agency partners. This 
information aids in, among other things, the processing and 
distribution of beneficiary payments and the delivery of services such 
as driver’s license issuance and voter registration. SSA relies on its 
information technology (IT) infrastructure—its databases, applications, 
networks, and IT management practices—to support its current and future 
needs for exchanging data with its state and federal partners. GAO was 
asked to (1) determine the extent to which SSA’s IT infrastructure 
effectively and efficiently supports current data exchanges, and any 
system-related problems affecting its exchange partners; and (2) 
describe SSA’s efforts to ensure that its IT infrastructure can support 
the agency’s and its partners’ future data exchange environment. To do 
this, GAO analyzed agency documentation and interviewed SSA officials, 
as well as federal and state data exchange partners. 

What GAO Found: 

Systems-related problems that affect SSA’s ability to support outgoing 
data exchange programs have been few, and the agency has established 
effective procedures and mechanisms for addressing the problems that do 
occur. In this regard, SSA provides help-desk and on-site support to 
data exchange partners to help prevent or resolve problems, and uses 
procedures supported by a problem-identification and tracking system to 
facilitate problem resolution. State and federal partners with whom GAO 
held discussions stated that these efforts resulted in quick responses 
from SSA and effective resolution of problems that occurred. For 
example, a system that provides information for two data exchange 
programs that support driver’s license issuance and voter registration 
in all 50 states was reported to have had almost 100 percent 
availability during the hours specified in the agreements governing 
these data exchanges. Further, all of the data exchange partners with 
whom GAO held discussions reported that the data that SSA provided were 
reliable. As a result, these partners stated that their ability to 
conduct business operations that depend on SSA data was not adversely 
affected by systems-related problems associated with SSA’s IT 
infrastructure. 

SSA and its partners anticipate that the number of requests for 
outgoing data exchanges will continue to increase and that the 
exchanges will become more complex as agencies request that these 
exchanges take place through online, real-time transactions. However, 
SSA officials stated that the agency’s existing IT infrastructure may 
not be able to support the increased demand that they and their 
partners anticipate. To address overall agency needs for a more cost-
effective and efficient computing environment, the agency is taking 
steps to modernize its computing capabilities and supporting 
infrastructure. For example, the agency is in the process of 
implementing an updated database environment and upgrading its software 
applications—steps that are intended to enable expanded and more 
efficient IT service delivery, including the electronic exchange of 
data. However, the agency has not fully implemented IT management 
practices specifically related to its outgoing data exchange 
environment, such as conducting thorough analyses to project the 
expected increase in requests for data and online access. Conducting 
these analyses and using this information as input to the agency’s 
target architecture (i.e., a formal description of the agency’s future 
environment) are important practices to clearly define future 
requirements to guide the direction of the agency’s data exchange 
programs. Implementing these management practices is essential to 
ensuring that the agency is well positioned to meet the growing needs 
of its data exchange partners. 

What GAO Recommends: 

GAO is recommending that SSA conduct the analyses needed to define 
requirements for delivering data exchange services to its partners in 
the future and use the results of these analyses to update its target 
architecture. In written comments on a draft of this report, SSA agreed 
with the recommendations. 

View [hyperlink, http://www.gao.gov/products/GAO-09-966] or key 
components. For more information, contact Valerie C. Melvin at (202) 
512-6304 or melvinv@gao.gov. 

[End of section] 

Contents: 

Letter: 

Background: 

SSA's IT Infrastructure Supports Its Current Data Exchange Environment: 

SSA Is Taking Steps to Prepare for a Future Data Exchange Environment, 
but Has Not Effectively Planned for Increasing Demands for Outgoing 
Data: 

Conclusions: 

Recommendations for Executive Action: 

Agency Comments and Our Evaluation: 

Appendix I: Objectives, Scope, and Methodology: 

Appendix II: Comments from the Social Security Administration: 

Appendix III: GAO Contact and Staff Acknowledgments: 

Tables: 

Table 1: Contents of SSA's Databases: 

Table 2: SSA's Key Batch Application Systems Providing Data to State 
and Federal Partners: 

Table 3: SSA's Key Online, Real-time Application Systems Providing Data 
to State and Federal Partners: 

Table 4: Increase in the Number of Requests for SSA Data from Seven Key 
Data Exchange Applications, Fiscal Years 2007 to 2008: 

Table 5: SSA Regions Reporting Requests for Online Real-Time Access to 
the State Online Query system: 

Table 6: States and Agencies That We Contacted: 

Figure: 

Figure 1: SSA Databases and Key Systems That Support Outgoing Data 
Exchange Programs: 

Abbreviations: 

AAMVA: American Association of Motor Vehicle Administrators: 

BENDEX: Beneficiary and Earnings Data Exchange: 

EIEI: Electronic Information Exchange Initiative: 

EVSE: numeration Verification System: 

FOLQ: Federal Online Query: 

HAVV: Help America Vote Verification: 

IT: information technology: 

MADAM: Master Data Access Method: 

MBR: Master Beneficiary Record: 

MEF: Master Earnings File: 

Numident: Number Holder Identification: 

PUPS: Prisoner Update Processing System: 

SDX: State Data Exchange: 

SOLQ: State Online Query: 

SSA: Social Security Administration: 

SSOLV: Social Security Online Verification: 

SSR: Supplemental Security Record: 

SVES: State Verification and Exchange System: 

UIQ: Unemployment Insurance Query: 

[End of section] 

United States Government Accountability Office: 
Washington, DC 20548: 

September 16, 2009: 

The Honorable Max Baucus: 
Chairman: 
Committee on Finance: 
United States Senate: 

Dear Mr. Chairman: 

Through more than 3,000 agreements with federal and state agencies, the 
Social Security Administration (SSA) both receives incoming data to 
support its own programs and provides outgoing data to support state 
and other federal agencies' programs. Specifically: 

* Information provided to SSA by other federal agencies aids in the 
processing and electronic disbursement of, for example, beneficiary 
payments or premium withholdings for entitlement programs such as the 
Retirement, Survivors, and Disability Insurance Program and the 
Supplemental Security Income Program. 

* Information that SSA provides to state and other federal agencies 
enables more efficient processing of services such as driver's license 
issuance, voter registration, social services administration (such as 
food stamps), employment verification and eligibility, and passport 
issuance. 

The data that SSA provides are essential to helping state and federal 
partners streamline operations, reduce costs, and eliminate 
overpayments and fraud. To carry out these transactions--over 1 billion 
each year--the agency relies on an information technology (IT) 
infrastructure consisting of the hardware, software, networks, and 
management practices that support capabilities to provide electronic 
data to and communicate with a variety of external systems belonging to 
the agency's data exchange partners.[Footnote 1] 

Given the significance of the data provided by these transactions, you 
requested that we examine the effectiveness of the agency's IT 
infrastructure in supporting data exchanges that provide information to 
state and other federal agencies. Our objectives were to (1) determine 
the extent to which SSA's IT infrastructure effectively and efficiently 
supports its current data exchange programs, and describe any systems- 
related problems that affect the agency's state and federal data 
exchange partners and (2) describe SSA's efforts to ensure that its IT 
infrastructure can support the agency's and its partners' future data 
exchange environment. 

As requested, we focused our study on SSA's data exchange programs that 
affect the ability of state and federal partners' to provide services 
to individuals. These data exchanges provide electronic information 
that is used to support state and other federal agencies' programs-- 
that is, "outgoing" data exchanges--through the use of several 
components of SSA's IT infrastructure.[Footnote 2] SSA considers these 
to be "non-program" data exchanges since they do not support the 
agency's mission. 

To address both of the objectives, we identified the components of 
SSA's IT infrastructure that support the agency's data exchange 
programs, and obtained and analyzed agency documentation describing 
these components and SSA's data exchange operations as well as plans to 
make improvements to the agency's IT infrastructure. We interviewed SSA 
officials, including two regional office data exchange coordinators 
from New York City and Kansas City,[Footnote 3] as well as officials of 
selected state and federal data exchange partners, to obtain their 
views on the effectiveness of SSA's IT infrastructure in supporting 
data exchanges and on the agency's plans for improvements. We spoke 
with and collected documentation from partners who represent various 
state agencies in New York, California, Idaho, North Carolina, and 
Iowa, and from federal data exchange partners within the Departments of 
Veterans Affairs, State, Homeland Security, and Health and Human 
Services. We determined that the data provided by SSA about the 
agency's data exchange IT infrastructure were sufficiently reliable for 
the purposes of our engagement. Appendix I contains more details on our 
objectives, scope, and methodology. 

We conducted this performance audit from December 2008 to September 
2009 at SSA's headquarters in Baltimore, Maryland. We also met with 
state agency officials in New York, California, Idaho, North Carolina, 
and Iowa and with federal agency officials with the Departments of 
Veteran Affairs, State, Homeland Security, and Health and Human 
Services in Washington, D.C. We conducted our work in accordance with 
generally accepted government auditing standards. Those standards 
require that we plan and perform the audit to obtain sufficient, 
appropriate evidence to provide a reasonable basis for our findings and 
conclusions based on our audit objectives. We believe that the evidence 
obtained provides a reasonable basis for our findings and conclusions 
based on our audit objectives. 

Background: 

SSA currently maintains over 800 agreements that support exchanges 
through which the agency provides data to state and federal partners 
(approximately 700 state and almost 100 federal agency partners). These 
agreements define the requirements, terms, and conditions under which 
the data will be provided to the partners. In many cases, legislation 
mandates the agency to provide electronic data in support of certain 
programs.[Footnote 4] For example, SSA is required to provide data to 
the Veterans Benefits Administration, which is part of the Department 
of Veterans Affairs, in support of the Veterans Benefits 
Administration's efforts to determine benefits eligibility. In other 
cases, SSA voluntarily enters into data exchange agreements with state 
and other federal agency partners. 

IT Infrastructure Components Supporting SSA Data Exchanges: 

SSA's existing IT infrastructure--databases, applications, networks, 
and management practices--supports the agency's daily operations and 
core mission activities, such as administering monthly Retirement, 
Survivors, and Disability Insurance and Supplemental Security Income 
benefits, as well as its data exchange programs.[Footnote 5] Data 
provided to SSA's data exchange partners are accessed from the same 
database infrastructure that supports the agency's overall operations 
and mission. This infrastructure includes several databases that store 
and maintain beneficiary data related to SSA's benefits programs. These 
databases are briefly described in table 1. 

Table 1: Contents of SSA's Databases: 

Database: Master Beneficiary Record (MBR); 
Contents: All data related to Retirement, Survivors, and Disability 
Insurance benefits enrollment and contributions. 

Database: Master Earnings File (MEF); 
Contents: Wage data reported by employers for their employees. 

Database: Supplemental Security Record (SSR); 
Contents: Data about Supplemental Security Income eligibility and 
payments. 

Database: Number Holder Identification (Numident); 
Contents: Social Security number holders' name, date of birth, place of 
birth, parents' names, citizenship status at the time of application, 
date of death (if applicable), and the office where the Social Security 
number application was processed and approved. 

Database: Prisoner database; 
Contents: Prisoner confinement information that various prisons report 
to SSA. 

Source: GAO analysis of SSA data. 

[End of table] 

Among the databases, the Master Beneficiary Record, Master Earnings 
File, and Supplemental Security Record databases are included in the 
agency's legacy database infrastructure, referred to as the Master Data 
Access Method, or MADAM. The Number Holder Identification database has 
recently been updated to a more modern system based on commercially 
available software.[Footnote 6] 

SSA also maintains various application systems that were designed and 
developed specifically to process data exchange transactions and that 
generally support multiple data exchanges. These applications provide 
Social Security number matching and verification information that 
supports various types of federal and state programs, such as driver's 
license issuance, voter registration, social services administration 
(e.g., food stamps), employment eligibility verification, and passport 
issuance. The applications accept requests for information from SSA's 
partners, retrieve and attempt to match or verify data from the 
databases against the information submitted by the partners, and then 
transmit responses--that is, the results of the data matching and 
verification--to the data exchange partners who initiated the requests. 
The applications primarily match Social Security number, name, and date-
of-birth information submitted by the partners against data stored in 
the databases. The request transactions are processed and the responses 
provided through the use of either batch file or online, real-time 
processing.[Footnote 7] 

SSA relies on 11 key application systems to process information 
requests from and provide response data to its state and federal data 
exchange partners. These data exchange applications provide data to 
programs associated with 582 of the state-level agreements and 26 of 
the federal-level agreements--about 75 percent of the outgoing data 
exchange agreements that the agency supports.[Footnote 8] These 11 key 
data exchange application systems process over 1 billion transactions 
annually. 

Six of the 11 applications process transaction requests and responses 
in batch mode. That is, they return single files that contain matching 
or verification information in response to multiple transaction 
requests (i.e., a "batch"). The majority of SSA's state and federal 
data exchange partners receive transaction responses from the agency in 
batch files. Table 2 describes these batch processing application 
systems. 

Table 2: SSA's Key Batch Application Systems Providing Data to State 
and Federal Partners: 

System: State Verification and Exchange System (SVES); 
Function: Provides verification of Social Security numbers and benefits 
information used to establish eligibility for income and health 
maintenance programs. The system allows users to request data from 
other SSA data exchange applications. In these cases, SVES filters the 
requesting transactions to determine the appropriate applications for 
processing. SVES then passes the requests to the applications, which 
process the requests and return responses to the partners; 
Databases accessed: 
* Master Beneficiary Record; 
* Supplemental Security Record; 
* Number Holder Identification; 
Number of data exchange agreements: 214 state, territory, and District 
of Columbia, and 5 federal agency agreements. 

System: Beneficiary and Earnings Data Exchange (BENDEX); 
Function: Provides Retirement, Survivors, and Disability Insurance 
benefit information to states and territories, and provides earnings 
and employer data for the last calendar year; 
Databases accessed: 
* Master Beneficiary Record; 
* Master Earnings File; 
Number of data exchange agreements: 96 state, territory, and District 
of Columbia agency agreements. 

System: Prisoner Update Processing System (PUPS); Function: Provides 
prisoner record information to federal and state agencies to establish 
eligibility or ineligibility for various programs; 
Databases accessed: 
* Prisoner database; 
Number of data exchange agreements: Included in SVES agreements. 

System: Earnings System; 
Function: Provides earnings information and Social Security information 
to federal, state, or local agencies for the purpose of validating 
Social Security numbers used in administering cash or noncash income 
maintenance programs or health maintenance programs, and provides 
information to employers or former employers for correcting or 
reconstructing earnings records for Social Security tax purposes; 
Databases accessed: 
* Master Earnings File; 
Number of data exchange agreements: 4 federal agency agreements. 

System: State Data Exchange (SDX); 
Function: Provides Supplemental Security Income data to states for 
administering income maintenance or health maintenance programs, such 
as state supplementation, interim assistance payments, and Medicaid; 
Databases accessed: 
* Supplemental Security Record; 
Number of data exchange agreements: 51 state, territory, and District 
of Columbia agency agreements. 

System: Enumeration Verification System (EVS); 
Function: Provides Social Security number verifications to several 
partners, including employers and federal and state benefits-paying 
agencies for a number of purposes, such as processing individuals' 
applications for welfare benefits; 
Databases accessed: 
* Number Holder Identification; 
Number of data exchange agreements: 33 state, 15 federal, and District 
of Columbia agency agreements. 

Source: GAO analysis of SSA data. 

[End of table] 

Of the 11 key data exchange application systems, 5 process transaction 
requests and responses in online, real-time mode. These systems 
retrieve data from SSA's databases in several ways. For example, using 
online, real-time processing, a state partner can initiate a query 
transaction from within a state system. The query is transmitted to SSA 
systems via various transmission mechanisms, such as dedicated lines or 
Internet connections, which process the query and then provide an 
immediate, or real-time, response to the requester. In other cases, 
employees of some federal agencies are allowed to remotely log on to 
SSA systems and execute online database inquiry transactions, to which 
they receive a real-time response. Table 3 shows the key application 
systems that support online data exchange transactions. 

Table 3: SSA's Key Online, Real-time Application Systems Providing Data 
to State and Federal Partners: 

System: State Online Query (SOLQ)/Federal Online Query (FOLQ)[A]; 
Function: Provides verifications of Social Security numbers and 
benefits information to both state and federal partners to establish 
eligibility for income and health maintenance programs; 
Databases accessed: 
* Master Beneficiary Record; 
* Supplemental Security Record; 
* Number Holder Identification; 
Number of data exchange agreements: 48 state and 2 federal agency 
agreements. 

System: Unemployment Insurance Query (UIQ); 
Function: Provides Social Security number verification and Social 
Security benefit information that are used by state unemployment 
insurance representatives to offset unemployment payments with the 
receipt of SSA payments. The Unemployment Insurance Query is part of 
SOLQ; 
Databases accessed: 
* Master Beneficiary Record; 
Number Holder Identification; Number of data exchange agreements: 36 
state agency agreements. 

System: E-Verify; 
Function: Provides confirmation or noncomfirmation of newly hired 
employees' Social Security numbers to aid employers in verifying 
employment eligibility under the E-Verify program administered by the 
Department of Homeland Security; 
Databases accessed: 
* Number Holder Identification; 
Number of data exchange agreements: 1 federal agency agreement. 

System: Social Security Online Verification (SSOLV); 
Function: Provides Social Security number verification primarily to 
state motor vehicle agencies for the issuance of driver's licenses and 
state identification cards, through the American Association of Motor 
Vehicle Administrators (AAMVA) network[B]; 
Databases accessed: 
* Number Holder Identification; 
Number of data exchange agreements: 52 state, territory, and District 
of Columbia agency agreements. 

System: Help America Vote Verification (HAVV); 
Function: Provides to AAMVA verifications of the last four digits of 
Social Security numbers of voter registrants who do not have driver's 
licenses for use by state AAMVA partners to register new voters; 
Databases accessed: 
* Number Holder Identification; 
Number of data exchange agreements: 45 state, territory, and District 
of Columbia agency agreements. 

Source: GAO analysis of SSA data. 

[A] When the system is used to provide data to federal partners, it is 
referred to as Federal Online Query. The SOLQ/FOLQ application is an 
online version of the batch application State Verification and Exchange 
System. 

[B] The AAMVA network serves as the conduit for transmitting 
verification requests from individual state driver's licensing agencies 
to SSA, as well as receiving verification responses from SSA and 
transmitting them to individual states. 

[End of table] 

Figure 1 provides an overview of the databases and application systems, 
and the data flow between them and the agency's state and federal 
partners. 

Figure 1: SSA Databases and Key Systems That Support Outgoing Data 
Exchange Programs: 

[Refer to PDF for image: illustration] 

State and federal users: 

State and federal systems: 

Among systems the following can occur: 
Query; 
Response; 
Query and Response. 

Batch systems: 
Earnings system; 
Prisoner system; 
SDX; 
BENDIX; 
EVS; 
SVES (filter to other systems). 

Online systems: 
SOLQ/FOLQ (UIG); 
SSOLV; 
HAVV; 
SSA E-Verify. 

SSA systems: 
Prisoner data; 
MEF; 
MBR; 
SSR; 
Numident. 

Source: GAO analysis of SSA data. 

Note: Tables 1, 2, and 3 of this report provide the definitions of 
abbreviations and acronyms and descriptions of systems and databases. 

[End of figure] 

Funding and Management of SSA's Outgoing Data Exchange Programs: 

SSA's outgoing data exchange programs are funded through various 
sources. These include the agency's annual budget and reimbursements 
from the data exchange partners, which are established through the data 
exchange agreement process. For example, the agreement between SSA and 
the Veterans Benefits Administration states that SSA will provide data 
at no cost. In this case, SSA's annual budget provides funds to support 
the administrative and systems-related activities that are required to 
support this agreement, such as the development of agreements and 
technical support for the data exchange partners. SSA receives 
reimbursements from a number of its external partners, including the 
American Association of Motor Vehicle Administrators (AAMVA)[Footnote 
9] along with 2 state agencies and 14 other federal agencies, for data 
exchanges. For example, according to agency documentation, SSA's 
agreement with AAMVA to provide electronic Social Security number 
verifications to all states for processing driver's license 
applications resulted in reimbursements in the amount of $230,882 to 
the agency in 2007. The amounts of reimbursements, if any, are 
determined on the basis of provisions established by the agreements 
with each data exchange partner. For 364 of these agreements, SSA 
provides electronic data at no cost to state and federal partners. 
[Footnote 10] 

According to agency documentation, during fiscal year 2007, SSA 
received about $10 million in total reimbursements for its outgoing 
data exchanges, primarily from federal data exchange partners. The 
documentation indicates that about half of this amount was reimbursed 
on the basis of agreements with the Departments of Homeland Security 
and Health and Human Services. 

The management and oversight of SSA's data exchange programs span 
multiple agency components. Among these, the Associate Commissioner for 
the Office of Earnings, Enumeration and Administrative Systems, has 
primary responsibility for systems activities related to SSA's data 
exchange programs, and the Office of Budget, Finance, and Management, 
Office of Strategic Services has primary responsibility for data 
exchange agreements. 

Prior GAO Reports on SSA's IT Management Practices: 

We have previously reported on SSA's IT management practices and 
challenges. Most recently, we studied and reported on the agency's 
ability to effectively deliver services, including those related to 
electronic data exchanges. In our reports, we made recommendations 
directed toward the agency's need to strengthen its plans for 
delivering services to beneficiaries and to address challenges 
associated with a growing and increasingly complex data exchange 
environment.[Footnote 11] 

In December 2008, we reported specifically on SSA's data exchange 
environment and identified challenges that the agency faced in 
supporting data exchange programs.[Footnote 12] Among these, we noted 
that the agency faced challenges in retaining the expertise needed and 
maintaining the technology required to support an adequate technical 
infrastructure to meet future needs. We also described an agency 
initiative to study ways to better manage the data exchange environment 
and address current and future challenges and limitations. This 
initiative identified actions that the agency should take to address 
challenges related to management and systems-related issues. We 
recommended in our report that SSA set milestones for undertaking these 
actions. The Commissioner of Social Security concurred with our 
recommendation and stated that the agency had established milestones 
for taking action. 

Also in January 2009, we reported that increases in retirement and 
disability filings, along with ongoing and expected increases in 
retirements of SSA's most experienced staff, posed difficult challenges 
for the agency in meeting future service delivery needs. We recommended 
that the agency take steps to address these challenges and develop a 
plan that describes how it will deliver quality service in the future 
while managing growing work demands and constrained resources.[Footnote 
13] In response, SSA stated that it had intensive planning efforts in 
place, but agreed to develop a single planning document that would 
describe service delivery and staffing plans. 

SSA's IT Infrastructure Supports Its Current Data Exchange Environment: 

SSA has implemented technology and procedures within its existing IT 
infrastructure to support its current data exchange environment, 
including processes to identify, track, and resolve systems-related 
problems. Those data exchange partners we included in our study 
[Footnote 14] indicated that the agency's IT infrastructure had 
effectively supported the exchanges in which they participate. The 
partners reported that they had experienced few systems-related 
problems and none that had a significant impact on their ability to 
conduct business. 

SSA Has Established Practices and Procedures for Supporting Data 
Exchange Services: 

An effective IT infrastructure provides performance capabilities, such 
as system availability and reliable data, that are essential to 
enabling the efficient and economical exchange of electronic data. 
[Footnote 15] The Software Engineering Institute defines practices for 
providing effective IT services, including those that are key to an 
agency's ability to ensure that its infrastructure supports business 
operations.[Footnote 16] These practices include, among other things, 
the establishment of (1) monitoring capabilities to proactively 
identify problems; (2) help desks to collect information on incidents 
and initiate problem-solving actions; and (3) capabilities to 
prioritize incidents, track the status and progress of incident 
resolution, and validate the complete resolution of incidents. By 
implementing practices to monitor, track, and resolve systems-related 
problems, agencies can reduce the risk that when problems occur, their 
information systems and support mechanisms will fall short of 
effectively supporting business operations and service commitments. 

To ensure that SSA's IT infrastructure meets the performance 
requirements of the agency's data exchange partners, SSA and its 
partners establish, through data exchange agreements, specific and 
detailed performance standards (e.g., system availability, scheduled 
outages, data accuracy, and response times for each exchange, along 
with protocols for reporting and resolving systems-related problems). 
These elements are critical to an effective IT infrastructure that 
enables the efficient and economical exchange of electronic data. 
[Footnote 17] For example: 

* The data exchange agreement with AAMVA specifies that SSA will 
provide responses for 95 percent of all Social Security Online 
Verification system requests received from AAMVA within 3 seconds or 
less and that responses to 99 percent of requests will be provided 
within 5 seconds or less. The agreement also defines the hours of 
system availability and scheduled outages. 

* The data exchange agreement with the Veterans Benefits Administration 
specifies that SSA is to provide a 99 percent data accuracy rate in 
support of the administration of veterans' benefits. 

To address any systems-related problems that might occur and affect its 
data exchange partners, SSA has implemented several key practices for 
providing effective IT services, as defined by the Software Engineering 
Institute. Specifically, the agency has established processes to 
identify, track, and resolve systems-related problems. For example, the 
agency established a national help desk for responding to systems- 
related problems, and employs a process for recording, prioritizing, 
tracking, and solving IT problems. This process is supported by the 
Change Asset and Problem Reporting System, which is a system that is 
used agencywide to prioritize systems-related problems, track the 
status and progress of resolutions, and validate the resolution of 
problems. System reports from January 2008 to February 2009 identified 
approximately 35 systems-related problems that affected data exchanges. 
These problems were primarily temporary outages lasting less than 1 
minute, including several problems lasting just seconds. 

Additionally, network support personnel proactively monitor data 
exchange components through the agency's full-time (24 hours a day, 7 
days a week) network operations and monitoring centers, which provide 
support for agencywide IT infrastructure components. Other SSA support 
staff also regularly monitor systems resource usage and work with state 
and federal partners to help resolve problems as they occur. For 
example, according to SSA officials, if a partner notifies the agency 
of slow response time, support staff members monitor the partner site's 
bandwidth usage and make upgrades as necessary. SSA has established 
other specific procedures for speedy response to resolve systems- 
related problems. For example, according to AAMVA partners, SSA's 
network operations and monitoring centers are responsible for 
monitoring the performance of the data exchange system that is used to 
support driver's license issuance and voter registration (the Social 
Security On-Line Verification system). When SSA personnel at the 
centers receive an alert indicating that the system is not performing 
properly, they investigate the problem and assign responsibility for 
resolving the problem to the appropriate SSA unit. Responsible 
personnel then notify AAMVA of the problem and the status of the 
resolution process, which is updated through the Change Asset and 
Problem Reporting System. Reports from the reporting system show that, 
in one case of a system outage, SSA support staff resolved the problem 
in 34 seconds by moving the AAMVA network connection to a backup 
system. 

SSA Has Effectively Provided Data to Support Partners' Business 
Operations: 

All of the federal and state data exchange partners included in our 
study stated that SSA's IT infrastructure adequately supported the 
performance standards established by existing agreements and 
effectively provided data that supported their business operations. 
They agreed that SSA was responsive and quickly resolved problems when 
they did occur and stated that, as a result of SSA's efforts, their 
ability to conduct business operations that depend on data provided by 
the agency had not been adversely affected by systems-related problems 
associated with SSA's IT infrastructure. These partners, which had been 
receiving electronic data from SSA for 2 to more than 30 years, 
reported that they experienced no or only minor systems-related 
problems caused by SSA's IT infrastructure. For example: 

* AAMVA partners reported that the SSA system that supports their data 
exchange historically was fully available during the hours of system 
availability specified in their exchange agreement. According to these 
officials, the system experienced virtually no downtime through 
calendar year 2008--it was operational 99.8 percent of the time that 
the system was available. 

* Officials with Idaho's Departments of Labor and Transportation told 
us that SSA's problem resolution procedures and support staff were 
effective and provided ample support and timely response to reported 
problems. These officials added that while 4 percent of Social Security 
number verification responses that they received from SSA via the AAMVA 
system were not confirmed, these nonverifications were predominantly 
caused by name changes that were not updated by the Social Security 
number holders (e.g., changes from maiden names to married names), 
rather than by problems with SSA's data exchange systems or data. 

* Officials with the Iowa state agencies stated that SSA's systems 
performance was satisfactory. Specifically, officials with the state's 
Department of Transportation, which receives data through the AAMVA 
network, reported that although they occasionally experienced 
unscheduled outages and slow system response times, SSA's overall 
performance was satisfactory. Officials with the state's Department of 
Human Services said that they had not experienced any problems. 

* Officials with the eight California agencies included in our study 
reported no problems associated with SSA's data exchange systems. 
[Footnote 18] 

Beyond these reports, the two SSA regional office data exchange 
coordinators with whom we spoke stated that state and territory agency 
partners within their regions, New York City and Kansas City,[Footnote 
19] had not reported systems-related problems associated with SSA's 
existing IT infrastructure. Specifically, the Kansas City coordinator 
stated that the region had not reported any problems with data exchange 
systems since the coordinator came on board in September 2008. 

Similarly, the federal data exchange partners with whom we met did not 
report any problems associated with SSA's IT infrastructure that 
negatively affected their ability to carry out business operations. For 
example: 

* Data exchange officials with the Department of Homeland Security 
reported as of June 2009 that no systems-related problems had affected 
their ability to conduct business.[Footnote 20] 

* Veterans Benefits Administration and Veterans Health Administration 
officials also stated that SSA's IT infrastructure was effective in 
delivering data that supported their benefits administration programs 
and that they had experienced no problems with the quality or delivery 
of data from SSA's systems. 

* Officials with the Centers for Medicare and Medicaid Services stated 
that they occasionally experienced late delivery of files that delayed 
the processing of Medicare entitlement information. However, these 
officials described this matter as a situation that they considered to 
be within the norm, given the very large amounts of data that are being 
exchanged between systems. These partners did not view these occasional 
late deliveries to be a significant issue with the SSA systems that 
provided data. 

SSA Is Taking Steps to Prepare for a Future Data Exchange Environment, 
but Has Not Effectively Planned for Increasing Demands for Outgoing 
Data: 

Although SSA's existing IT infrastructure is sufficient to support 
current outgoing data exchanges, SSA officials and the agency's 
partners anticipate that the number of these exchanges will continue to 
increase and become more complex, placing greater demands on the 
infrastructure and systems. To address overall agency needs for a more 
cost-effective and efficient computing environment, SSA is currently 
taking steps to modernize its IT infrastructure, including components 
that support its data exchange programs. For example, the agency is 
updating its 30-year-old database infrastructure, converting outdated 
software applications, and expanding its physical data processing 
capacity. However, the agency has not established and executed IT 
management practices needed to effectively guide and oversee the 
direction of its outgoing electronic data exchange programs, such as 
conducting the analyses required to project future workload needs and 
performance requirements--information that is essential to developing a 
target architecture that identifies business and technical requirements 
for a future data exchange environment. If these analyses are not 
completed, SSA's ability to provide and maintain an IT infrastructure 
that meets requirements to effectively support its data exchange 
programs in the future could be at risk. 

SSA and Partners Anticipate Increased Demand for Data Exchanges: 

Based on recent increased numbers of requests for data provided by data 
exchange services, both SSA and its data exchange partners anticipate 
that the agency's outgoing data exchange programs will continue to grow 
and will outpace current capabilities. SSA reported that from fiscal 
years 2007 to 2008, the number of data requests made to seven of SSA's 
key data exchange applications increased from 1.19 billion to 1.37 
billion, or about 15 percent. Table 4 shows details of the increase in 
data requests for these applications. 

Table 4: Increase in the Number of Requests for SSA Data from Seven Key 
Data Exchange Applications, Fiscal Years 2007 to 2008: 

System: EVS; 
Description: Batch verifications other than for Social Security 
numbers, and for non-SVES users (up to 250,000 numbers per requester 
per file); 
Number of data requests, by fiscal year (in millions): 2007: 377.3; 
Number of data requests, by fiscal year (in millions): 2008: 451.4. 

System: EVS; 
Description: Social Security number batch verifications through EVS;
Number of data requests, by fiscal year (in millions): 2007: 62.6; 
Number of data requests, by fiscal year (in millions): 2008: 88.7. 

System: EVS; 
Description: SVES batch verifications through EVS; E-Verify: 
Number of data requests, by fiscal year (in millions): 2007: 497.8; 
Number of data requests, by fiscal year (in millions): 2008: 542.2. 

System: E-Verify; 
Description: Online, real-time verifications for employers via 
Department of Homeland Security; 
Number of data requests, by fiscal year (in millions): 2007: 3.3; 
Number of data requests, by fiscal year (in millions): 2008: 6.7. 

System: SSOLV; 
Description: Online, real-time verifications for state motor vehicle 
departments via AAMVA; 
Number of data requests, by fiscal year (in millions): 2007: 18.3; 
Number of data requests, by fiscal year (in millions): 2008: 20.2. 

System: HAVV; 
Description: Online, real-time verifications for voter registration via 
AAMVA; 
Number of data requests, by fiscal year (in millions): 2007: 2.3; 
Number of data requests, by fiscal year (in millions): 2008: 7.7. 

System: SOLQ/FOLQ; 
Description: Online, real-time verifications for federal and state 
agencies (includes UIQ); 
Number of data requests, by fiscal year (in millions): 2007: 32.8; 
Number of data requests, by fiscal year (in millions): 2008: 41.3. 

System: BENDEX; 
Description: Benefit Information to the states; 
Number of data requests, by fiscal year (in millions): 2007: 157.8 
(starting February 2007); 
Number of data requests, by fiscal year (in millions): 2008: 180.0. 

System: SDX; 
Description: State Data Exchange--Daily File; 
Number of data requests, by fiscal year (in millions): 2007: 38.4; 
Number of data requests, by fiscal year (in millions): 2008: 30.0. 

System: Total; 
Number of data requests, by fiscal year: 2007: 1.19 billion; 
Number of data requests, by fiscal year: 2008: 1.37 billion. 

Source: SSA. 

Note: Tables 1, 2, and 3 of this report provide the definitions of 
system abbreviations. 

[End of table] 

An example of one data exchange application that has been required to 
process large increases in data requests for Social Security number 
confirmations is SSA's E-Verify application. This application supports 
the Department of Homeland Security E-Verify program, which is used to 
help employers verify the employment eligibility of newly hired 
workers.[Footnote 21] Participation in the program has been voluntary 
at the private and state levels since its implementation 10 years ago 
and, since then, utilization of SSA's E-Verify application has 
increased dramatically. In the past 2 years alone, usage has doubled 
twice. Further, federal legislation has been proposed to, among other 
things, require the use of the E-Verify program by employers across the 
nation. If such legislation is enacted, agency officials estimate that 
the number of queries to E-Verify could quickly surpass 60 million per 
year--nearly 10 times the number of requests in fiscal year 2008. 

SSA and Partners Anticipate Expanded Need for Online Access to Data 
Exchange Systems: 

In addition to growth in the numbers of data exchange requests, the 
complexity of the exchanges is expected to increase, in that agencies 
are increasingly asking for online access (a more complex requirement 
than batch access). Officials from four of the state and federal 
agencies with whom we spoke stated that their needs for online access 
to SSA's data exchange systems are expanding. For example, officials 
with New York, Idaho, and California reported that their programs will 
need expanded online access to SSA's data exchange systems to support 
increasing workloads and to provide more efficient processing of data 
requests. Specifically, officials with New York's Office of Temporary 
and Disability Assistance explained that their programs will be 
requiring increased online or Web-based service from SSA in the future 
to support expected general workload growth as their need for Social 
Security number verifications and other SSA information grows. 
Officials with California's Department of Child Support Services stated 
that online access is needed to improve efficiencies in caseworkers' 
ability to verify benefits, schedule court hearings to determine 
amounts of child support payments, and process and close eligible 
cases. Officials with Idaho's Department of Labor also projected that 
they would need more online access to SSA's data exchange systems 
through Web-based transaction processing to support more efficient case 
processing and access to SSA's data exchange systems 24 hours a day, 7 
days a week. 

In 2008, SSA officials polled the agency's 10 regional offices to 
identify current data exchange partners that had requested online, real-
time access to the agency's State Online Query system over the previous 
24 months.[Footnote 22] The poll identified state partners in 8 of the 
regions that had made such requests.[Footnote 23] Table 5 shows these 
regions along with the 24 state agencies that had requested online 
access for their programs (in addition to the 50 partners that already 
had access to the State Online Query system). 

Table 5: SSA Regions Reporting Requests for Online Real-Time Access to 
the State Online Query system: 

SSA region: Boston; 
State: Rhode Island; 
Agencies and programs: 
* Department of Labor Temporary Disability Insurance and Worker's 
Compensation. 

SSA region: Philadelphia; 
State: Virginia; 
Agencies and programs: 
* Department of Medical Assistance Services. 

SSA region: New York; 
State: New York; 
Agencies and programs: 
* Human Services Organizations, including: 
- Child Support Enforcement.
- State Children's Health Insurance Program and state health programs.
- Home Energy Assistance.
- Foster Care and Adoption.
- Prescription coverage for the elderly.
- Lifeline state-funded, low cost telephone service. 

SSA region: New York; 
State: New Jersey; 
Agencies and programs: 
* Human Services Organizations, including: 
- Foster Care and Adoption.
- Home Energy Assistance.
- State Children's Health Insurance Program and state health programs.
- Commission for the Blind and Visually Handicapped. 

SSA region: Chicago; 
State: Illinois; 
Agencies and programs: 
* Department of Human Services' Division of Vocational Rehabilitation 
Services. 

SSA region: Chicago; 
State: Michigan; 
Agencies and programs: 
* Workers' Compensation Agency. 

SSA region: Dallas; 
State: Arkansas; 
Agencies and programs: 
* Department of Human Services' Foster Care Program. 

SSA region: Denver; 
State: Wyoming; 
Agencies and programs: 
* Department of Human Services' State Child Protection Services. 

SSA region: San Francisco; 
State: California; 
Agencies and programs: 
* Department of Health and Human Services for county General Assistance 
programs. 

SSA region: Seattle; 
State: Washington; 
Agencies and programs: 
* Department of Labor and Workforce Development for Vocational 
Rehabilitation Program and Workers Compensation Program; 
* Department of Health and Welfare for Vocational Rehabilitation 
Program, Child Welfare Programs, State Payment Accuracy, Aging and 
Disability Services, Welfare Fraud, Institutional Revenue, Overpayment 
Writing Unit; 
* Tribal Entities for Temporary Assistance for Needy Families, Food 
Stamps, Medicaid; 
* Department of Services for the Blind for Blind and Visually Impaired 
Services and Programs, Vocational Rehabilitation Program.
* Youth Authority for Temporary Assistance for Needy Families, Food 
Stamps, Medicaid.
* Vocational Rehabilitation Commission for Vocational Rehabilitation 
Services.
* Public Utility Commission for Utility Assistance Program. 

Source: SSA. 

[End of table] 

SSA Is Taking Steps to Modernize Its IT Infrastructure, but It Has Not 
Effectively Planned for Increasing Demands on Its Outgoing Data 
Exchange Programs: 

Office of Management and Budget Circular A-130 and industry best 
practices stress the importance of agencies taking advantage of cost- 
effective technology to improve operations.[Footnote 24] Additionally, 
industry studies have shown that modern technology can offer 
organizations more efficient and effective automation capabilities to 
meet service delivery demands. Further, more advanced technology is 
important to support online, real-time transaction processing, which is 
more demanding than batch processing due to the need for increased 
systems availability and more sophisticated technology.[Footnote 25] 

SSA officials are taking steps to update key components of the agency's 
IT infrastructure, including those that directly support its data 
exchange services, to provide expanded and extended processing 
capabilities. In particular, the agency is in the process of 
modernizing the agency's database infrastructure, upgrading software, 
and building new data centers. 

According to an SSA Senior Enterprise Architect, the agency's legacy 
database infrastructure--MADAM--was created in-house in the early 1980s 
and, over time, became outdated and difficult to support, limiting the 
agency's ability to provide expanded data processing services.[Footnote 
26] For example, the MADAM databases must be backed up and maintained 
daily and are not available during the time that maintenance occurs. 
This down time prevents the agency from providing complete data 
processing services 24 hours a day, 7 days a week to support the 
agency's core mission and operations as well as its data exchange 
programs.[Footnote 27] 

Thus, SSA is in the process of converting its MADAM environment to a 
modern and commercially available system that is intended to support 
online processing 24 hours a day, 7 days a week. According to SSA 
officials, the agency has already converted its Numident database, and 
plans to convert its Master Earnings File, Supplemental Security 
Record, and Master Beneficiary Record databases in 2009, 2011, and 
2012, respectively. Further, SSA is in the process of updating its E- 
Verify data exchange operating environment. In this regard, the agency 
is implementing an environment in which E-Verify data requests will be 
processed against a dedicated database and will provide continuity of 
operations and disaster recovery capabilities, which are currently not 
available. These upgrades are intended to support the projected 
increase in demand for E-Verify services and reduce the risks of system 
slowdowns and disruptions. The E-Verify upgrades are expected to be 
completed and implemented in August 2009. 

The agency is also upgrading its current systems environment, including 
the systems that support data exchanges. This environment contains 
aging software that is based on about 36 million lines of COBOL code, a 
programming language that is generally viewed as obsolete and that 
makes it difficult to implement new business processes and new service 
delivery models, such as online, real-time processing. According to SSA 
officials, the agency is upgrading its software applications to Web- 
based technology that is intended to better enable online, real-time 
access to data processing services. 

Further, SSA has recently built a new data center to provide expanded 
data processing capacity in addition to that provided by its National 
Computer Center. The agency also has plans to replace the 30-year-old 
National Computer Center to, according to SSA officials, provide more 
efficient and economical processing capabilities and support growing 
requirements of a full-time electronic service delivery 
operation.[Footnote 28] By taking these steps to modernize its 
agencywide IT infrastructure, including components that support data 
exchange programs, SSA is aiming to provide the computing capabilities 
needed to support increasing and future demands for electronic data 
exchange services. 

SSA's IT strategic plan reflects the priorities that are intended to 
guide the agency's operational and tactical IT planning through fiscal 
year 2012.[Footnote 29] Regarding data exchanges, the plan discusses an 
agency initiative that is intended to study various data exchanges and 
ways to allow partners to link more efficiently to the agency's 
systems. Also, the agency's IT vision document[Footnote 30] describes 
plans to replace various methods of sharing data with an easy-to-use, 
Web-based portal that provides data to partners through a menu-driven 
system, along with a plan to use a single registration process and a 
secure, controlled environment that ensures data are protected. The 
vision document identifies as a key initiative the need to maintain a 
robust data exchange architecture that fully supports the growing 
demand for information sharing. 

Even as SSA proceeds with planned updates to its IT infrastructure, the 
agency has not fully implemented IT management practices that are 
essential to help guide its direction related to data exchanges. Sound 
management practices require organizations to perform the necessary 
planning for investments to ensure that they effectively support 
current and future business needs, such as a more demanding data 
exchange environment.[Footnote 31] In planning for future business 
operations, agencies should also, among other things, project their 
programs' anticipated workloads, such as increases in data requests and 
transaction volumes--information that is essential for making informed 
decisions concerning workload management and the technological 
solutions needed to sustain efficient and effective performance in the 
future.[Footnote 32] Further, this information can provide critical 
input to the agency's planning efforts, including the development of a 
target architecture. 

Nevertheless, according to agency officials, SSA has not conducted 
detailed analyses to project future workload requirements resulting 
from the increasing demand and expanded need for outgoing electronic 
data exchanges. Specifically, the agency has not projected increases in 
the number of requests for data or the need for more online, real-time 
access to its data exchange systems. The agency's Director of the 
Division of Information, Verification and Exchange Services and the 
Director of the Office of Systems Security Operations Management 
maintain that the agency's tactical plans for delivering electronic 
services will be sufficient to address future needs for data exchanges. 
However, these plans have not yet been developed. Further, while the 
agency's strategic direction and vision for its data exchange 
environment are important, they do not substitute for the more detailed 
analysis that is essential to identifying the specific business and 
technical requirements for its data exchange programs and partners. 

Moreover, in the absence of such detailed analysis, SSA cannot be 
assured that it will achieve the robust data exchange architecture that 
it envisions. According to federal guidance, an agency should develop 
an enterprise architecture, or modernization blueprint, that describes 
in both business and technology terms how it operates today and how it 
intends to operate and support projected needs in the future--that is, 
its target architecture.[Footnote 33] Federal guidance states that 
enterprise architectures should identify the data that are to be 
exchanged, the frequency and nature of the exchanges, and the business 
processes supported by the data exchanges.[Footnote 34] For SSA to 
ensure that its target architecture provides for a future IT 
infrastructure that will support its expanding data exchange 
environment, the agency should conduct the analyses needed to project 
the numbers of data exchange transactions along with the frequency and 
nature of the data exchanges (that is, whether the transactions are 
batch or online, and how frequently they will be conducted) expected 
from its partners in the future. 

Agency officials have recognized the need for a target architecture 
that addresses requirements for data exchanges. For example, in 2008, 
an SSA workgroup conducted an analysis to address management and 
technical issues related to its data exchanges, which was intended to 
support planning for its growing data exchange program.[Footnote 35] 
Among other things, the workgroup recommended to the Commissioner of 
Social Security that the agency devote sufficient resources to develop 
a well-defined target architecture that is sufficiently scalable to 
meet the agency's future needs for supporting data exchanges.[Footnote 
36] 

However, while SSA has developed a target architecture describing 
applications and service components that are used to support the 
agency's business operations, according to the Directors of the 
Division of Information, Verification and Exchange Services, and of the 
Office of Strategic Services, the agency has not developed a target 
architecture that addresses specific business and technical 
requirements for supporting the agency's data exchange programs. 
Moreover, these directors stated that the current agencywide target 
architecture does not specifically address data exchanges with external 
organizations. 

Lacking sound projections of future workloads, SSA will not be able to 
clearly define specific requirements for meeting the increasing demands 
on its data exchange environment. Moreover, without a target 
architecture that addresses specific requirements for supporting the 
agency's data exchange programs, the agency cannot be assured that its 
IT infrastructure will provide the resources and levels of service 
required to meet the future needs of its data exchange partners. 
Consequently, SSA's ability to continue to effectively and efficiently 
support its partners' future needs for electronic data exchange 
services could be jeopardized. 

Conclusions: 

SSA's existing IT infrastructure effectively supports its current 
outgoing electronic data exchange environment and provides the agency's 
partners with data that support and enhance their abilities to carry 
out business operations. The state and federal partners included in our 
study experienced few or no problems associated with the agency's IT 
infrastructure. However, the agency and its partners anticipate that 
the demand for these exchanges will grow, and that the methods for 
conducting the exchanges will become more complex. Nonetheless, SSA has 
not performed the detailed analyses needed to project the workload and 
performance requirements of a future data exchange environment. While 
it has defined an agencywide target architecture, this architecture 
does not address specific business and technical requirements for 
supporting the agency's data exchange programs. Until it conducts these 
analyses, the agency will lack information essential to developing a 
target architecture for an IT infrastructure that effectively supports 
the ability of data exchange partners to carry out their business 
operations in the future. 

Recommendations for Executive Action: 

To help ensure that SSA's IT infrastructure effectively supports the 
anticipated increase in demand for electronic data exchange services, 
we recommend that the Commissioner of Social Security direct the 
Associate Commissioner, Office of Earnings, Enumeration and 
Administrative Systems to: 

* conduct detailed analyses to determine workload projections and 
define requirements for effectively and efficiently delivering data 
exchange services to the agency's partners in the future and: 

* use the results of these analyses to update the agency's target 
architecture to address business and technical requirements of a future 
data exchange environment. 

Agency Comments and Our Evaluation: 

The Commissioner of Social Security provided written comments on a 
draft of this report. In the comments, the agency agreed with our 
recommendations and stated that it would conduct detailed analyses to 
determine workload projections and define future requirements for 
delivering data exchange services as funding is available. Further, the 
Commissioner stated that it would use the results of the analyses to 
update the agency's target architecture to ensure that it addresses the 
business and technical requirements of a future data exchange 
environment. If these actions are taken, the agency should be better 
positioned to meet the growing needs of its data exchange partners. 

SSA also provided technical comments, which we have incorporated into 
the report as appropriate. The agency's written comments are reproduced 
in appendix II. 

As agreed with your office, unless you publicly announce its contents 
earlier, we plan no further distribution of this report until 30 days 
from the date of this letter. At that time, we will send copies of the 
report to interested congressional committees, the Commissioner of 
Social Security, and other interested parties. This report will also be 
available at no charge on our Web site at [hyperlink, 
http://www.gao.gov]. 

Should you or your staff have questions on matters discussed in this 
report, please contact me at (202) 512-6304 or melvinv@gao.gov. Contact 
points for our Offices of Congressional Relations and Public Affairs 
may be found on the last page of this report. GAO staff who made major 
contributions to this report are listed in appendix III. 

Sincerely yours, 

Signed by: 

Valerie C. Melvin: 
Director, Information Management Human Capital Issues: 

[End of section] 

Appendix I: Objectives, Scope, and Methodology: 

Our objectives were to (1) determine the extent to which the Social 
Security Administration's (SSA) information technology (IT) 
infrastructure effectively and efficiently supports its current data 
exchange programs, and describe any systems-related problems affecting 
the agency's data exchange partners and (2) describe SSA's efforts to 
ensure that its IT infrastructure can support the agency's and its 
partners' future data exchange environment. 

To address both of these objectives, we focused our study on SSA's data 
exchanges that provide information to support state and other federal 
agencies' programs, and that affect partners' abilities to provide 
services to individuals--that is, "outgoing" data exchanges.[Footnote 
37] To determine whether SSA's existing IT infrastructure is effective 
in supporting the agency's data exchange programs, we first identified 
the components of the infrastructure that support the agency's data 
exchange programs. To do this, we obtained and analyzed agency 
documentation, such as internal management reports; spreadsheets 
describing data exchange programs, partners, and systems; descriptions 
of systems development and IT management processes; and descriptions of 
IT infrastructure components. To assess the reliability of the data 
provided by SSA, we held discussions with agency officials who were 
knowledgeable about the agency's data exchange infrastructure and 
determined that the data were sufficiently reliable for the purposes of 
our engagement. 

From our assessment of this information, we identified and selected 
systems that are key to enabling the exchange of electronic data--that 
is, those that support the largest number of outgoing data exchanges, 
are used by the most partners, and process the largest number of data 
requests. We verified our selection through discussions with the 
Director, Division of Information, Verification and Exchange Services. 
We held discussions with additional agency officials, including the 
Associate Commissioner, Office of Earnings, Enumeration and 
Administrative Systems; Associate Commissioner, Office of Systems, 
Electronic Services; Assistant Associate Commissioner, Office of 
Telecommunications and Systems Operations; Director, Office of Systems 
Security Operations Management; Director, Office of Electronic 
Information Exchange; and Director, Office of Strategic Services. We 
also reviewed documentation describing the agency's plans to make 
improvements to its IT infrastructure and discussed these plans with 
agency officials. Additionally, we interviewed state and federal data 
exchange partners to obtain their views on the ability of SSA's IT 
infrastructure to provide data that support their business operations. 

To determine the extent to which systems-related problems exist and 
affect SSA's data exchange partners and their ability to carry out 
business operations, and how the agency resolves these problems, we 
selected and obtained the views of partners from multiple agencies in 
five states, a third-party consortium that represents states and 
territories that participate in two of SSA's data exchange programs, 
and four federal agency partners. Together, these state and federal 
partners represented 24 programs that are supported by SSA's data 
exchanges. Our criteria and methodology for selecting these partners 
are described later in this appendix. We discussed with these partners 
their experiences with SSA's data exchanges, including the extent to 
which their ability to conduct business operations are affected by 
systems-related problems associated with the agency's IT 
infrastructure. We reviewed and assessed documentation provided to us 
that described the types of systems-related problems that partners 
encountered in exchanging data. We also interviewed two SSA regional 
office data exchange coordinators to discuss any systems-related 
problems identified or reported to them by the partners they support, 
and to obtain information about programs that together fully utilize 
the IT infrastructure components that support the data exchange 
environment. 

To describe SSA's efforts to ensure that its IT infrastructure can 
support the agency's and its partners' future data exchange 
environment, we held discussions with the agency officials and state 
and federal partners that we have previously described and examined 
data provided by SSA that illustrated increased transaction volume from 
2007 to 2008. We also obtained and reviewed documentation that 
described increased requests for online access to certain data exchange 
systems over the past 24 months. Additionally, we reviewed relevant SSA 
strategic planning documents, including its IT strategic plan and 
vision document to identify plans related specifically to data 
exchanges.[Footnote 38] We assessed these plans to identify activities 
specifically related to data exchanges and to determine the extent to 
which they addressed projected data exchange workloads and the IT 
resource requirements for efficiently and effectively supporting future 
requirements. In addition, we interviewed SSA officials and data 
exchange stakeholders familiar with the agency's data exchange programs 
to identify the agency's plans for addressing future data exchange 
workloads, including ensuring that its IT infrastructure can adequately 
support future demands for outgoing data exchanges to other federal and 
state agencies. 

We confirmed the information gathered from SSA's regional data exchange 
coordinators and systems officials by corroborating it with selected 
other state and federal exchange partners. We determined that the 
information gathered was sufficiently reliable for the purposes of our 
review. Further, at the conclusion of our study in September 2009, we 
validated the examples of state and federal agencies' experiences with 
SSA's data exchanges with officials from those agencies. 

Method for Selecting Data Exchange Partners: 

To select state and federal data exchange partners for this study, we 
identified a nonprobability sample based on our review of information 
provided by agency officials that listed and described all of the data 
exchange programs supported by SSA. From the list provided by the 
agency, we identified 814 outgoing data exchanges--those through which 
SSA provides data to state and other federal agencies. Of these 
exchanges, we identified 663 that provide SSA data to agencies in all 
50 states, the District of Columbia, and 4 territories (American Samoa, 
American Virgin Islands, Guam, and Puerto Rico), and 83 that provide 
data to 16 federal agencies. 

From the 50 states, we selected 5 states based on the number of SSA 
data exchange programs in which they participate and the types of state 
programs the exchanges support (e.g., driver's license issuance, voter 
registration, unemployment benefits administration, social services 
administration, and other programs). In selecting the 5 states, we 
identified 2 states that participated in the most data exchanges, 1 
state that participated in a intermediate number of exchanges, and 2 
states that participated in the fewest data exchanges. 

* The 2 states participating in the most data exchanges were New York 
and California (25 and 19 data exchanges, respectively). 

* The 1 state we selected with the intermediate number of data 
exchanges was Idaho (12 data exchanges). 

* The 2 states participating in the fewest data exchanges were North 
Carolina and Iowa (10 and 9 data exchanges, respectively). 

We held discussions with officials from each of the states' agencies 
that receive data through SSA's data exchange programs to obtain 
information about any systems-related problems they may have 
experienced and the actions taken by SSA to resolve problems. Table 6 
shows the states and agencies within those states that we contacted. 

Table 6: States and Agencies That We Contacted: 

States: New York; 
Agencies: Six programs under the Office of Temporary and Disability 
Assistance: 
* Family Assistance; 
* Emergency Assistance to Families; 
* Home Energy Assistance; 
* Food Stamps; 
* Temporary Assistance to Needy Families; 
* Medicaid. 

States: California; 
Agencies: 
* State Controller's Office; 
* Employment Development Department; 
* Franchise Tax Board; Health Care Services; 
* Social Services; 
* Board of Equalization; 
* Department of Motor Vehicles; 
* Child Support Services. 

States: Iowa; 
Agencies: 
* Department of Human Services; 
* Department of Transportation. 

States: North Carolina; 
Agencies: 
* Board of Elections; 
* Employment Security Commission. 

States: Idaho; 
Agencies: 
* Department of Motor Vehicles; 
* Department of Labor; 
* Department of Human Services. 

Source: GAO. 

[End of table] 

We also held discussions with SSA's major stakeholder user group 
organization--the American Association of Motor Vehicle Administrators 
(AAMVA)--which provides data exchange support to state driver's 
licensing administrations and supports voter registration through the 
Help America Vote Verification system. We contacted chief information 
officers from each of the five selected states and AAMVA to obtain 
contact information for the officials responsible for the programs and 
systems that receive electronic data through participation in SSA's 
data exchange programs. 

We based our selection of federal data exchange partners on the scope 
and impact of the agencies' programs supported by SSA's data exchanges 
on the country's population, including veterans' programs 
beneficiaries, government and private employers, U.S. passport holders 
and applicants, U.S. tax filers, and Medicare beneficiaries. We held 
discussions with agency officials regarding the following federal 
programs to obtain information about their experiences with SSA's data 
exchange programs and the systems that support them: 

* the Department of Veteran Affairs, Veterans Benefits Administration's 
benefits and insurance programs, and the Veterans Health Administration 
health care administration program; 

* the Department of Homeland Security employment eligibility program; 

* the Department of State's passport verification and foreign service 
retiree benefit payment programs; and: 

* the Department of Health and Human Services, Centers for Medicare and 
Medicaid Services' Medicare benefits administration program. 

Since we selected a nonprobability sample, the information obtained 
through discussions with the selected state and federal data exchange 
partners is not generalizable across the entire population of SSA's 
data exchange partners. 

[End of section] 

Appendix II: Comments from the Social Security Administration: 

Social Security: 
The Commissioner: 
Social Security Administration: 
Baltimore, MD 21235-0001: 

September 9, 2009: 

Ms. Valerie C. Melvin: 
Director, Information Management and Human Capital Issues: 
U.S. Government Accountability Office: 
441 G Street, NW: 
Washington, D.C. 20548: 

Dear Ms. Melvin: 

Thank you for the opportunity to review and comment on the Government 
Accountability Office (GAO) draft report, "Information Technology: 
Social Security Administration's Data Exchanges Support Current 
Programs, but Better Planning Needed to Meet Future Demands" (GAO-PUB 
No. 09-966). Our comments on the report are attached. 

If you have any questions, please contact me or have your staff contact 
Candace Skurnik, Director, Audit Management and Liaison Staff at (410) 
965-4636. 

Sincerely, 

Signed by: 

Michael J. Astrue: 

Enclosure: 

[End of letter] 

Comments On The Government Accountability Office Draft Report, 
"Information Technology: Social Security Administration's Data 
Exchanges Support Current Programs, But Better Planning Needed To Meet 
Future Demands" (GAO-PUB NO. 09-966): 

Recommendation 1: 

Conduct detailed analyses to determine workload projections and define 
requirements for effectively and efficiently delivering data exchange 
services to our partners in the future. 

Comment: 

We agree. We will conduct detailed analyses to determine workload 
projections and define requirements for effectively and efficiently 
delivering data exchange services to our partners in the future, as 
funding is available. 

We routinely conduct analyses to determine workload projections and 
requirements. However, we do not have a separate portfolio for data 
exchanges in our information technology (IT) planning process. We plan 
for data exchanges that are program related in the context of the line 
of business that the exchange supports (e.g., Medicare). We plan 
reimbursable exchanges (e.g., E-Verify) outside of the IT planning 
process. Reimbursable exchanges are nonetheless, subject to the rigor 
and discipline of our systems development process. 

Recommendation 2: 

Use the results of these analyses to update our target architecture to 
address business and technical requirements of a future data exchange 
environment. 

Comment: 

We agree. We will use the results of our analyses to update our target 
architecture to address business and technical requirements of a future 
data exchange environment, as funding becomes available. 

[End of section] 

Appendix III GAO Contact and Staff Acknowledgments: 

GAO Contact: 

Valerie C. Melvin, (202) 512-6304 or melvinv@gao.gov: 

Staff Acknowledgments: 

In addition to the contact named above, key contributions to this 
report were also made by Teresa F. Tucker, Assistant Director; Michael 
A. Alexander; Tonia B. Brown; Barbara S. Collier; Rebecca E. Eyler; 
Neil J. Doherty; Nancy E. Glover; Jacquelyn K. Mai; Lee A. McCracken; 
Thomas E. Murphy; Madhav S. Panwar; and Brandon S. Pettis. 

[End of section] 

Footnotes: 

[1] In this context, the term "data exchange" refers to an ongoing 
mechanism for exchanging data, and the term "transaction" refers to an 
instance of exchanged data, such as the verification of a single Social 
Security number. 

[2] SSA also provides information, such as Social Security number 
verification, to other external entities, such as private companies. 
The scope of this study did not include those partners. We also did not 
include exchanges from SSA to the Department of the Treasury in the 
scope of our study because these administrative exchanges are conducted 
so that Treasury can provide payments (through checks and electronic 
transfers) to beneficiaries on behalf of SSA; these exchanges do not 
support Treasury programs. 

[3] We held discussions with these two region coordinators based on the 
extent of their experiences with data exchanges and the number of data 
exchange programs that they support. The New York City region includes 
New York, New Jersey, Puerto Rico, and the U.S. Virgin Islands; the 
Kansas City region includes Kansas, Missouri, Iowa, and Nebraska. 

[4] According to SSA, of the over 800 agreements with state and federal 
partners, about 530 are legislatively mandated to support programs such 
as veterans' and Medicare benefits administration, voter registration, 
and employment eligibility verifications. 

[5] SSA's core mission is to administer the Retirement, Survivors, and 
Disability Insurance program, which provides benefits to workers who 
have paid into the Social Security trust fund, and the Supplemental 
Security Income program, which provides or supplements the income of 
aged, blind, or disabled individuals with limited income and resources. 

[6] The Prisoner database is a separate database that resides outside 
of the MADAM infrastructure. 

[7] Batch transaction processing sequentially matches data files 
containing one or more data items against records in SSA's databases 
and returns responses to multiple requests for data in one file at a 
scheduled time. Online, real-time processes return responses to 
individual requests for data at the time that the requests are made. 

[8] The remaining 25 percent of SSA's outgoing data exchange agreements 
are supported by various applications that provide data to several 
different state and federal agencies. For example, one such application 
was developed to provide all states with information to identify 
individuals who may be eligible for Medicaid continuation following a 
Retirement, Survivors, and Disability Insurance cost-of-living 
adjustment. 

[9] AAMVA reimburses SSA for data exchange services for all 53 
partners: 50 states, 2 territories, and the District of Columbia. 

[10] Data exchange agreements with partners are established for varying 
timeframes. For example, many non-reimbursable agreements are generally 
established for an 18-month timeframe with 12-month renewal. 
Reimbursable agreements, such as those with AAMVA, are generally 
established for 5 years, with annual financial commitment agreements. 

[11] We have also reported on SSA's implementation of IT management 
practices, including the definition of an enterprise architecture and 
IT investment management. See GAO, Information Technology: SSA Has 
Taken Key Steps for Managing Its Investments, but Needs to Strengthen 
Oversight and Fully Define Policies and Procedures, [hyperlink, 
http://www.gao.gov/products/GAO-08-1020] (Washington, D.C.: Sept. 12, 
2008); and Enterprise Architecture: Leadership Remains Key to 
Establishing and Leveraging Architectures for Organizational 
Transformation, [hyperlink, http://www.gao.gov/products/GAO-06-831] 
(Washington, D.C.: Aug. 14, 2006). 

[12] GAO, Information Technology: Demand for the Social Security 
Administration's Electronic Data Exchanges Is Growing and Presents 
Future Challenges, [hyperlink, http://www.gao.gov/products/GAO-09-126] 
(Washington, D.C.: Dec. 4, 2008). 

[13] GAO, Social Security Administration: Service Delivery Plan Needed 
to Address Baby Boom Retirement Challenges, [hyperlink, 
http://www.gao.gov/products/GAO-09-24] (Washington, D.C.: Jan. 9, 
2009). 

[14] These partners represented various state agencies in New York, 
California, Idaho, North Carolina, and Iowa, and federal data exchange 
partners within the Departments of Veterans Affairs, State, Homeland 
Security, and Health and Human Services. See appendix I for more 
details. 

[15] GAO, Executive Guide: Measuring Performance and Demonstrating 
Results of Information Technology Investments, [hyperlink, 
http://www.gao.gov/products/GAO/AIMD-98-89] (Washington, D.C.: Mar. 1, 
1998). 

[16] Software Engineering Institute, CMMI for Services, Version 1.2 
(Pittsburgh, Pa.: February 2009). The Software Engineering Institute is 
a nationally recognized, federally funded research and development 
center established at Carnegie Mellon University to address software 
engineering practices. 

[17] [hyperlink, http://www.gao.gov/products/GAO/AIMD-98-89]. 

[18] The eight California agencies are the State Controller's Office, 
Employment Development Department, Franchise Tax Board, Health Care 
Services, Social Services, Board of Equalization, Department of Motor 
Vehicles, and Child Support Services. 

[19] SSA's New York region includes New York, New Jersey, Puerto Rico, 
and the U.S. Virgin Islands, and the Kansas region includes Kansas, 
Missouri, Iowa, and Nebraska. 

[20] At the conclusion of our study in September 2009, the Department 
of Homeland Security reported that, since our initial discussions in 
June 2009, the department had experienced two extended outages related 
to SSA's E-Verify system when the direct line between SSA and the 
Department of Homeland Security failed. The outages prevented the 
department from completing E-Verify queries. According to department 
officials, SSA addressed the problem and has plans to implement 
enhancements intended to prevent the loss of data if the direct lines 
fail in the future. 

[21] The Department of Homeland Security's employment verification 
program, also called E-Verify, is used by employers to verify 
employment eligibility. Employers query the Department of Homeland 
Security's E-Verify Web site for information, which then requests 
Social Security confirmation from SSA's E-Verify application system. 
The data exchange this report describes is between the two departments' 
systems--that is, SSA's outgoing exchange that provides information to 
the Department of Homeland Security's system. 

[22] SSA's current policy limits access to the State Online Query 
system to Temporary Assistance to Needy Families and Medicaid agencies. 
This decision was made by the SSA's Acting Commissioner in February 
2001. 

[23] The Atlanta and Kansas regional offices did not identify any 
partners that had requested State Online Query access. 

[24] Office of Management and Budget Circular A-130, Management of 
Federal Information Resources; and GAO/AIMD 98-89. 

[25] Specifically, online real-time processing requires full-time 
system availability (24 hours a day, 7 days a week) and technology, 
such as Web-based software, that enables direct, online access to 
computing services and the ability to respond to data requests as soon 
as they are received. In contrast, batch processing transactions are 
processed at scheduled intervals and transmit all responses to requests 
for data at the same scheduled time. 

[26] The MADAM databases include the Master Earnings File, Supplemental 
Security Record, and Master Beneficiary Record databases. 

[27] According to SSA officials, the agency's MADAM databases accept 
traffic during this down time, even if the data processing systems 
themselves are unavailable. These data requests are held, then 
processed when the systems become available. In this regard, the legacy 
database environment is available 24 hours a day, 7 days a week, but is 
not able to complete data processing transactions during maintenance 
down time. 

[28] Provisions of the American Recovery and Reinvestment Act of 2009 
made available $500 million for SSA's replacement of the National 
Computer Center and for associated IT costs. 

[29] Social Security Administration, Social Security Information 
Resources Management Strategic Plan, Fiscal Year 2007. 

[30] Social Security Administration, Information Technology Vision: 
2009-2014. 

[31] OMB Circular No. A-130 and Planning, Budgeting, Acquisition, and 
Management of Capital Assets, Circular No. A-11, Part 7 (Washington, 
D.C.: July 2003). 

[32] GAO, Assessing Risks and Returns: A Guide for Evaluating Federal 
Agencies' IT Investment Decision-making, [hyperlink, 
http://www.gao.gov/products/GAO/AIMD-10.1.13] (Washington, D.C.: 
February 1997); Software Engineering Institute, CMMI for Services, 
Version 1.2. 

[33] OMB Circular A-130. 

[34] Management of Federal Information Resources; DOD Architecture 
Framework, Version 1.5, Volume II (Apr. 23, 2007). 

[35] This activity, called the Electronic Information Exchange 
Initiative, resulted in a report issued in September 2008, that 
included recommendations intended to help address challenges related to 
data exchange management and systems-related issues. Among other 
things, the workgroup found that there was no clear direction regarding 
the implementation of new technologies within the existing or a future 
data exchange environment, and that the agency did not have a clearly 
stated target architecture for data exchanges. 

[36] Although the Commissioner stated in December 2008 that the agency 
had established milestones for acting on these recommendations (the 
statement was in response to our recommendation that the Commissioner 
act on the Electronic Information Exchange Initiative recommendations; 
GAO-09-126), the agency's Director of the Division of Information, 
Verification and Exchange Services recently stated that while the EIEI 
report provided a significant amount of information pertaining to SSA's 
electronic data exchange activities, the recommendations no longer 
reflected the agency's current position. The official told us that the 
recommendations are being reassessed to determine which ones are viable 
in the agency's current and future operating environments. 

[37] SSA also provides data, such as Social Security Number 
verification, to other external entities, such as private companies. 
The scope of our work did not include those partners. 

[38] Social Security Administration, Social Security Information 
Resources Management Strategic Plan, Fiscal Year 2007; and Information 
Technology Vision, 2009-2014. 

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "E-mail Updates." 

Order by Phone: 

The price of each GAO publication reflects GAO’s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO’s Web site, 
[hyperlink, http://www.gao.gov/ordering.htm]. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional 
information. 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: fraudnet@gao.gov: 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Ralph Dawn, Managing Director, dawnr@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, D.C. 20548: 

Public Affairs: 

Chuck Young, Managing Director, youngc1@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: