The Centers for Medicare & Medicaid Services has improved Healthcare.gov since its disastrous launch in 2013, but still lacks the IT management policies to fully fix the system, according to a new report from the Government Accountability Office.
The report dings CMS for failing to follow best practices for IT management with the project, leading to problems with inadequate capacity, coding errors and limited functionality. Essentially, it said agency was too hands-off with its contractors.
"Specifically, by not managing requirements to ensure that they addressed all needed functionality and not fully documenting and executing key testing activities, CMS did not have reasonable assurance that Healthcare.gov and its supporting systems would perform as intended," the report said.
In particular, it found:
- Requirements for the project were not managed effectively. When requirements were approved, it was without ensuring they aligned with lower-level requirements
- Inadequate system testing. Even when tests were performed, documentation lacked the criteria on which evaluations were made
- Ineffective project oversight, including unreliable schedules, lack of estimates of work needed to complete the project, unorganized and outdated documentation and inconsistent reviews of project progress
Many of these problems have yet to be corrected. For instance, officials knew the project contained coding errors prior to launch, but contractors said the compressed time schedule made it impossible to fix them all. Many of those errors are still there, it said.
The site also launched with incomplete security plans, lack of a privacy risk analysis, incomplete security tests and no alternate processing site to avoid major service disruptions, according to the report. A GAO report from last September pointed to continuing security problems.
In an evaluation of task orders for the contractors, GAO said in a report last July that the site was developed without effective planning or oversight. Contractors faced a compressed timetable, changing requirements and began the task without having key pieces of information--including the number of participating states and the number of potential enrollees.
A report from the Office of Inspector General (OIG) released two months ago said CMS failed to develop a written acquisition strategy for the project, which would, influence how contractors would be chosen.
To learn more:
- read the report (.pdf)