GAO: CMS Isn't Doing Enough to Address Failures

Gil C/

After the botched rollout, the Centers for Medicare & Medicaid Services haven't adequately improved itsIT processes, a recent report found.

Despite attempts to address's technical failures -- the crashes and response-time lag, among other issues -- the Centers for Medicare and Medicaid Services hasn't fixed underlying flaws in the IT management process, a new report finds. 

In a performance audit of the agency, conducted between December 2013 and March 2015, the Government Accountability Office concluded that CMS still shows deficiencies in systems testing, oversight and the management of requirements for IT projects, more than a year after's October 2013 launch. 

CMS began implementing new IT governance processes in June 2014, but they're not fully in place, the report said. For instance, though a new process calls for sign-off on certain requirements from a CMS business partner, a CMS approving authority, and a contract organization's approving authority, only one of 18 documents related to the federal insurance marketplace had all the necessary approvals, GAO found.

It wasn't clear from documents which requirements were being approved, the report said -- while some pages were scanned and uploaded to an agency project management system, 10 of 18 signature pages were not linked to documents specifying the requirements being approved.

In one case, 84 percent of the requirements related to the site's insurance eligibility and enrollment modules didn't have adequate documentation of related business processes. 

CMS' new plans for product-testing parts of still lack key elements, GAO found. For instance, none of the 11 test plans for the federal insurance marketplace, drawn up after's initial rollout, specified how to assure the quality of the testing process. Nine of 11 test plans did not include criteria that would determine whether a test item had passed or failed testing. 

Still, GAO acknowledged CMS has taken steps to address technical failures -- including doubling the numbers of servers for the system supporting, and reducing response time on the site from 8 seconds in October to less than 1 second in December. 

After the audit, GAO recommended the agency improve and better document its requirement management, system testing and project oversight. The Department of Health and Human Services concurred with that recommendation, according to comments provided in the report, though CMS did not respond to a request for additional response. 

(Image via  /