HHS, CMS fall short on managing IT investments

A lack of regular reviews by the Health and Human Services Department of HHS agencies’ IT investments by the IT investment board leaves 90 percent of the investments without appropriate executive oversight, according to the Government Accountability Office.HHS has developed basic capabilities to select and control IT projects, but management and oversight of its IT investments have significant weaknesses, GAO said in a recent . The weaknesses prevent HHS from ensuring that it has the best mix of investments for the department.In fiscal 2006, HHS plans to spend more than $5 billion on IT. GAO evaluated the IT investment management capabilities of HHS and its largest agency, the Centers for Medicare and Medicaid Services, at the request of Senate Finance Committee Chairman Charles Grassley (R-Iowa).HHS needs to include business representatives of its agencies on its investment review board, develop written procedures for selecting new IT proposals and regularly review and track the performance of agency IT systems, and take corrective action when needed, GAO said.It also should establish a procedure to ensure that HHS agency IT investments align with department goals, GAO said in its report released earlier this week.Neither HHS nor CMS have developed a comprehensive plan to guide their investment management processes, GAO said. HHS has started up efforts to improve its investment management processes, but has not coordinated them and other efforts that are needed to fix the weaknesses. CMS has established about half of the practices for building the investment foundation but few practices to manage its investments as a portfolio.“Without such a plan and procedures for implementing it, the department risks being unable to effectively establish mature investment management capabilities,” said David Powner, director of GAO IT management issues.HHS said it uses portfolio management software and has begun re-engineering its capital planning and investment control processes. The department has postponed formal documentation of the investment management process until it gains some experience in using it, said HHS IG Daniel Levinson in a written response last month. “HHS has taken what is essentially a rapid prototype development approach to improving its IT investment management,” he added.Now that HHS has used the improved processes over two budget cycles, it will document and issue the policies and procedures.CMS depends on hundreds of IT systems to maintain information on Medicare beneficiaries, health care providers and medical services provided, as well as to carry out oversight of the states’ Medicaid programs for low-income Americans. CMS also provides funding through grants to states to develop and operate automated systems, known as Medicaid Management Information Systems (MMIS), to support their programs. In fiscal 2005, CMS spent $1.79 billion, or 70 percent of its total $2.55 billion in IT appropriations, for the state Medicaid management IT systems, GAO said in , also posted earlier this week.The process for approving state funding requests for Medicaid MMIS activities has standard procedures that are performed across regional offices, but the process for monitoring the development and operations of state MMIS has no standard procedures for regional office staff. That means CMS’ central office will not be able to ensure that state offices are delivering Medicaid benefits in the most effective manner.For example, CMS put in place an IT investment board composed of senior executives to implement the management process. It has also established management controls that ensure that only investments in the operating plan are funded. But it still lacks procedures and resources for management oversight of IT projects and systems.“Until CMS fully establishes the key practices required to build the investment foundation and manage its investments as a portfolio, it will not be able to ensure that investments support its multibillion-dollar Medicare and Medicaid programs and are being managed to minimize risks and maximize returns,” Powner said.CMS disagreed in part with GAO, saying that many improvements were not reflected in the report, including hiring the former CIO of the Social Security Administration to strengthen IT investment and management control, said CMS administrator Mark McClellan.