SSA also depends on 54 state DDS offices, along with one federally administered DDS, to help process claims under its disability insurance programs. State DDSs rely primarily on their internal systems to process medical determinations. Systems may contain up to several million lines of software code that must be examined for potential date-format problems. Renovation. Significant Progress Made in Awareness, Assessment, and Renovation of SSA’s Mission-Critical Mainframe Systems

SSA began examining the Year 2000 problem almost a decade ago and since then has taken various steps to raise agency awareness of the issue. SSA did not include the DDS systems in its initial assessment of systems that it considered a priority for correction. Within these offices, the contractors also are responsible for ensuring that the production databases and NDDSS interfaces are Year 2000 compliant. Even with Year 2000 action now underway, however, the potential magnitude of the DDS problem makes systems correction by January 1, 2000, a high-risk area. Disruptions to this service due to incomplete Year 2000 conversions will prevent or delay SSA’s assistance to millions of individuals across the country. Resolving Data Exchange Issues and Developing Contingency Plans Will Help Reduce Risk

An essential yet challenging aspect of SSA’s Year 2000 work will be ensuring that data exchanges with other federal and state agencies and businesses are Year 2000 compliant. SSA recognizes the importance of this matter and has taken a number of steps to address it. At the same time, SSA needs to have contingency plans to ensure that strategies exist for mitigating any risks associated with this and any of the other Year 2000 related issues that can affect the agency’s ability to provide Social Security and other benefits and services to the public. SSA exchanges data files with hundreds of federal and state agencies and thousands of businesses. In addition, to facilitate data exchange compliance, SSA has developed a database that maintains information on the status of compliance activities related to all of its incoming and outgoing file exchanges. Given the magnitude of its data exchanges, one of SSA’s biggest challenges will be coordinating its compliance work with that of its exchange partners and, where necessary, developing mechanisms to ensure the continued processing of its data. SSA has identified approximately 100 files in this category, although the Year 2000 project director stated that this number could change as SSA continues to review and include compliance information in its tracking system. SSA has made significant progress in addressing many of the systems that are critical to its mission and is regarded by many as a leader in the federal arena. Nonetheless, the agency is at risk of not being able to adequately process disability benefits at the turn of the century because it has not assessed and corrected systems used by the state DDS offices to support the processing of initial disability claims. Recommendations

In light of the importance of SSA’s function to most Americans and the risks associated with its Year 2000 program, we recommend that the Commissioner of Social Security direct SSA’s Chief Information Officer, in conjunction with the Deputy Commissioner for Systems, to take the following actions:
Require expeditious completion of the assessment of mission-critical systems at all state DDS offices and use the results of this assessment to develop a Year 2000 plan that identifies, for each system, the specific tasks and resources required and specific schedules and milestones for completing all tasks and phases of the conversion for each state system. GAO Comment

1.
Why GAO Did This Study

Pursuant to a congressional request, GAO reviewed the Social Security Administration's (SSA) actions to achieve Year 2000 information systems compliance, focusing on the adequacy of steps taken by SSA to ensure that computing problems related to the year 2000 are fully addressed, including its oversight of state disability determinations services' (DDS) Year 2000 program activities.

What GAO Found

GAO noted that: (1) SSA first recognized the potential impact of the Year 2000 problem almost a decade ago, and was able to launch an early response to this challenge; (2) it initiated early awareness activity and has made significant progress in assessing and renovating mission-critical mainframe software that enables it to provide social security benefits and other assistance to the public; (3) because of the knowledge and experience gained through its early Year 2000 efforts, SSA has come to be regarded as a federal leader in addressing this issue; (4) SSA's Assistant Deputy Commissioner for Systems chairs the Chief Information Officers Council's Subcommittee on the Year 2000 and works with other federal agencies to address Year 2000 issues across government; (5) while SSA deserves credit for its leadership, the agency remains at risk that not all of its mission-critical systems--those necessary to prevent the disruption of benefits--will be corrected before January 1, 2000; (6) at particular risk are the systems that have not yet been assessed for the 54 state DDSs that provide vital support to SSA in administering its disability insurance programs; (7) private contractors SSA hired to make 42 of the 54 state DDS systems Year 2000 compliant reported that these offices had at least 33 million additional lines of software code that must be assessed and, where necessary, renovated; (8) given the potential magnitude of this undertaking, SSA could face major disruptions in its ability to process initial disability claims for millions of individuals throughout the country if these systems are not addressed in time for corrective action to be completed before the change of century; (9) SSA also faces the challenge of ensuring that its critical data exchanges with federal and state agencies and other businesses are Year 2000 compliant; (10) it has taken a number of positive steps in this direction, such as identifying incoming and outgoing file exchanges with the external business community and developing a database to maintain information on the status of compliance activities; (11) however, because SSA must rely on the hundreds of federal and state agencies and the thousands of businesses with which it exchanges files to make their systems compliant, SSA faces a definite risk that inaccurate data will be introduced into its databases; and (12) that risk could be magnified if SSA does not develop contingency plans to ensure the continuity of its critical systems and activities should systems not be corrected in time.