However, CMS also used  funding provided by other legislation that was not specifically dedicated to  the private health insurance and health insurance exchange provisions of  PPACA and thus was also available to fund other CMS activities. Limitations in CMS’s Policies and Procedures Impeded Efforts to Determine the Reliability of Most of the CCIIO-Related Resources That CMS Reported It Received and Used

CMS provided most of the CCIIO-related information we requested, but  limitations in its policies and procedures made the process of obtaining it  difficult and time consuming, and we could not determine the reliability of  most of the amounts CMS provided. For several reasons, CMS’s core  financial system—HIGLAS—did not produce CCIIO-specific totals for  much of the financial information we requested, and CMS did not have an  efficient alternate approach for identifying the information. In addition,  information regarding staff reassignments to CCIIO from other CMS and  HHS units was not readily available, and the related information CMS  provided was incomplete and not supported by documentary evidence. In addition, CMS’s procedures for  identifying and obtaining the information and its review and approval were  not documented, so we also could not verify that these procedures had  been properly performed. Because CMS was not able to provide  timely CCIIO-related information whose reliability could be independently  determined, Congress and other decision makers may not have timely  and reliable CCIIO-related financial management information, which could  hamper efforts to make informed resource allocation decisions and  assessment of program performance. CMS Provided Most of the Requested Information

CMS provided most of the CCIIO-related financial management  information we requested, which consisted of (1) total CCIIO-related  obligations and expenditures from the enactment of PPACA through fiscal  year 2013; (2) estimates of total CCIIO-related obligations for  expenditures for fiscal year 2014; (3) the number of full-time CCIIO staff  as of September 30, 2013; and (4) total CCIIO-related expenditures  from the enactment of PPACA through fiscal year 2013 for salaries,  travel, advertising and other public relations activities, polling and focus  groups, and conferences. CMS did not  provide estimates of fiscal year 2014 obligations for these specific  categories because it did not prepare related estimates at this level of  detail. As noted above, total salary  expenditures of $79.8 million from March 2010 through fiscal year 2013  were determined to be reliable. The largely manual, ad hoc process CMS employed was labor intensive  and time consuming, and it often required an extended period of time to  respond to our requests, in some cases several months. As discussed above, this information was  not complete. Consequently, we were unable to independently verify that these reviews  and approvals had taken place. However, CMS does not have documented policies and  procedures governing responses to nonroutine information requests, such  as those that may originate from oversight bodies. Recommendations for Executive Action

We recommend that the Secretary of Health and Human Services direct  the Administrator of the Centers for Medicare and Medicaid Services to  take the following actions:  identify and evaluate options to facilitate more timely and  independently verifiable reporting of CCIIO-related financial  management information, such as enhancing HIGLAS’s standard  reporting or custom reporting capabilities, and develop and implement policies and procedures for responding to  nonroutine CCIIO-related financial management information requests,  including procedures for documenting the preparation process and the  review and approval of the results. In its written  comments, reprinted in appendix II, HHS did not concur with our two  recommendations. For example, as discussed in the report, CMS  did not have a policy or procedures that required documented review and  approval of the information provided in response to nonroutine requests. Appendix I: Objective, Scope, and Methodology

Our objective was to identify the resources related to the Center for  Consumer Information and Insurance Oversight (CCIIO) that the Centers  for Medicare and Medicaid Services (CMS) received, used, and expects  to use from enactment of the Patient Protection and Affordable Care Act  (PPACA) though fiscal year 2014, including certain categories of  expenditures; the source of the funding; the number of CCIIO staff as of  September 30, 2013; and the number of staff reassigned from other units. The scope of our review encompassed the financial and staff resources  provided to and used by CMS to help implement the private health  insurance and health insurance exchange provisions of PPACA from  enactment in March 2010 through fiscal year 2013 and the amounts CMS  estimates it will use for fiscal year 2014.
Why GAO Did This Study

PPACA makes significant changes in the way health insurance in the United States is provided, including changes to private health insurance coverage. GAO was asked to examine the resources that CCIIO used and expects to use in implementing the private health insurance provisions of PPACA. GAO's objective was to identify resources that CCIIO received, used, and expects to use from enactment of PPACA through fiscal year 2014, including certain categories of expenditures, the sources of funding, and the total number of staff, along with the number of staff reassigned from other units.
To perform this work GAO obtained the information requested and compared it to available supporting documentation, reviewed available related policies and procedures, and interviewed CMS officials.

What GAO Found

The Department of Health and Human Service's (HHS) Centers for Medicare and Medicaid Services (CMS) provided GAO with most of the requested data regarding financial resources that the Center for Consumer Information and Insurance Oversight (CCIIO) and other CMS offices received, used, and expect to use to implement the private health insurance and health insurance exchange provisions of the Patient Protection and Affordable Care Act (PPACA) for which CCIIO is responsible from its enactment in March 2010 through fiscal year 2014. However, CMS did not provide estimates of fiscal year 2014 obligations for certain categories of CCIIO-related transactions, such as advertising and other public relations activities. In addition, CMS provided data on CCIIO's staffing levels as of September 30, 2013, but did not provide complete staffing reassignment data.
GAO was unable to consistently verify the reliability of the data received from CMS. Specifically:
GAO was able to determine the reliability of CMS's estimates for total obligations for fiscal year 2014, which was $3.7 billion; the number of staff as of September 30, 2013, which was 347; and total salary expenditures from March 2010 through fiscal year 2013, which were $79.8 million.
GAO could not determine the reliability of any of the other financial information CMS provided because CMS's core financial system did not produce totals for much of the CCIIO-related information requested. For example, the system did not produce expenditure totals for CCIIO-related polling, focus groups, or advertising and other public relations activities because of how these activities are captured in the system. Similarly, information related to reassignment of staff to CCIIO from other CMS and HHS units was not readily available. Consequently, the staff reassignment information provided to GAO was not complete, was not supported by documentary evidence, and could not be verified.
GAO identified several issues that contributed to CMS's inability to provide complete information that is independently verifiable in a timely manner. First, CMS does not have an effective means of identifying CCIIO-related information. While CMS had policies and procedures for its standard financial operations, it did not have documented policies and procedures for responding to nonroutine information requests. Instead, CMS relied on ad hoc manual procedures that were labor intensive and time consuming. As a result, CMS required an extended period of time to provide most of the information GAO requested, in some cases taking several months. Second, CMS does not have documented procedures to ensure that data requests are reviewed and approved for accuracy. CMS officials told GAO that the information they provided had been subject to review and approval at several levels, including review by subject matter experts. However, these procedures were not documented. Consequently, GAO was not able to independently verify that they had been properly performed. Because CMS's processes are inconsistent with certain federal accounting and internal control standards, Congress and other decision makers may not have access to timely and reliable CCIIO-related information that they may need to make resource allocation decisions and assessments of program performance.

What GAO Recommends

GAO recommends that CMS identify and evaluate options to facilitate reporting CCIIO-related financial management information that is independently verifiable in a timely manner, and develop and implement policies and procedures to document the preparation, review, and approval of information produced for nonroutine requests.
HHS did not concur with GAO's recommendations. In its view, CMS's existing procedures are adequate to respond to nonroutine information requests. However, as discussed in this report, GAO continues to believe that enhancements to CMS's procedures are needed and that the recommendations are valid.