In fiscal year 2005, about $1.79 billion, or 70  percent, of CMS’s nearly $2.55 billion total appropriations for IT went to  support Medicaid state investments. The remaining approximately $0.76  billion, or 30 percent, was used for CMS’s internal investments. This process is carried out by CMS’s Center for Medicaid and State  Operations and 10 regional offices. While these efforts do not fully address any of the weaknesses we identify  in this report, they enhance the agency’s ability to perform key activities. Although the process for approving states’ funding  requests for MMIS activities is characterized by (1) standard procedures  performed consistently across the regional offices, (2) guidance that staff  can rely on in carrying out their duties, and (3) requirements for reporting  information to the central office, the process for monitoring MMIS  activities is not. Until CMS defines standard procedures for monitoring MMIS activities,  guidance for staff to rely on, and reporting requirements, CMS’s central  office may not be able to easily determine whether state MMISs are  facilitating the delivery of Medicaid benefits in the most effective and  beneficial manner. Specifically, the agency has established about half of the practices  for building the investment foundation, but few practices to manage its  investments as a portfolio. Critical to CMS’s success in going forward will be the development of an  implementation plan that (1) is based on an assessment of strengths and  weaknesses; (2) specifies measurable goals, objectives, and milestones; (3)  specifies needed resources; (4) assigns clear responsibility and  accountability for accomplishing tasks; and (5) is approved by senior-level  management. Although the agency has initiated improvement efforts, it has  not developed a comprehensive plan to guide these and other efforts  needed to improve its investment management process. Without such a  plan and procedures for implementing it, CMS will be challenged in  sustaining the commitment it needs to fully establish its investment  management process. On the basis of this, we state that CMS does not  have the full suite of capabilities to manage its internal investments  because it has only established a little over half of the foundational  practices and 2 of 27 portfolio-level key practices, and we reiterate the  need to fully establish both sets of practices to increase assurance that  executives are selecting and managing the mix of investments that best  meets the agency’s needs and priorities. Objectives, Scope, and Methodology

The objectives of our review were to (1) evaluate Centers for Medicare &  Medicaid Services (CMS) capabilities for managing its internal information  technology (IT) investments, (2) determine any plans the agency might  have for improving these capabilities, and (3) examine CMS’s process for  approving and monitoring the state Medicaid management systems it  funds.
Why GAO Did This Study

To carry out its mission of ensuring health care security for beneficiaries, the Centers for Medicare & Medicaid Services (CMS) relies heavily on information technology (IT) systems. In fiscal year 2005, CMS's total IT appropriations was about $2.55 billion, of which about $760 million, or 30 percent, was to support internal investments, and $1.79 billion was to fund the Medicaid Management Information Systems (MMIS) that states use to support their Medicaid programs. (GAO is using the term "internal" to refer to all of CMS' IT investments excluding state MMISs.) In light of the size and significance of these investments, GAO's objectives were to (1) evaluate CMS's capabilities for managing its internal investments, (2) determine any plans the agency might have for improving these capabilities, and (3) examine CMS's process for approving and monitoring state MMISs.

What GAO Found

Judged against GAO's framework for IT investment management, which measures the maturity of an organization's investment management process, CMS's capabilities for effectively managing its internal investments are limited. Specifically, the agency has established a little over half of the foundational practices it needs to manage individual investments and has executed 2 of the 27 key practices needed to manage investments as a portfolio. Until CMS fully establishes foundational and portfolio-level practices, executives will lack the assurance that they are managing the agency's collection of investments in a manner that minimizes risks and maximizes returns. CMS has initiated steps to improve its investment management process; however, these steps do not fully address the weaknesses GAO identifies in this report, nor are they coordinated with other needed improvement efforts into a plan that (1) is based on an assessment of strengths and weaknesses; (2) specifies measurable goals, objectives, and milestones; (3) specifies needed resources; (4) assigns clear responsibility and accountability for accomplishing tasks; and (5) is approved by senior-level management. Without such a plan and procedures for implementing it, CMS will be challenged in sustaining the commitment it needs to fully establish its investment management process. The process for approving requests for federal funding of MMIS activities (including development, operations, and maintenance activities) is characterized by standard procedures, guidance, and reported information to CMS's Center for Medicaid and State Operations. In contrast, the process for monitoring MMIS activities lacks standard procedures, guidance, and reporting requirements. Without these elements for monitoring MMIS activities, CMS may not be able to easily determine whether the state MMISs in which CMS invests close to $1.7 billion annually are facilitating the delivery of Medicaid benefits in the most effective and beneficial manner.