HHS CIO to get more control over HealthCare.gov

The CIO of the Department of Health and Human Services will get more visibility into the development and governance of HealthCare.gov. In reply comments to a Government Accountability Office report on HealthCare.gov, HHS concurred with a GAO recommendation that the departmental CIO ensure that high-risk IT programs are overseen by the investment review board.

HHS said it "will provide oversight through several mechanisms including the department-wide review board and the increased responsibilities articulated within the Federal Information Technology Acquisition Reform Act."

This is one of the first concrete signs that the oversight weaknesses identified in congressional hearings during the flawed rollout of HealthCare.gov in October 2013 are being remedied by legislation.

The GAO conducted a broad inquiry into the management, planning, and testing of HealthCare.gov, and found that even after full functionality was restored to the service, problems in project management, systems testing, and oversight persisted.

For example, GAO found that in the race to meet the launch deadline, functional requirements were approved for development without the OK of the appropriate Centers for Medicare and Medicaid Services officials. With its new governance process, instituted in June 2014, "CMS has not consistently and appropriately approved requirements," the report found. Until the system for documenting the approval process for new functionality is in place, GAO warned, "CMS may not establish a shared understanding of requirements with its contractors, potentially resulting in critical system functionally not providing needed capabilities." According to reply comments from HHS, this has been addressed with an approval system requiring sign-off from officials who supervise contractors.

Despite improvements in testing procedures, GAO also found that some testing plans lacked key elements. This is a work in progress, according to the HHS reply comments. Teams at CMS are standardizing testing documents and policies. Additionally, GAO is looking for CMS to improve scheduling. HHS concurred with all of the recommendations made in the report.

The Office of Management and Budget came in for a few dings for not selecting the HealthCare.gov project for a TechStat accountability session, where project managers would come in and explain the status of flagging development efforts. While HHS had the primary role in selecting its own projects for TechStat, OMB did have the authority to intervene and target high-risk projects for review. 

The GAO inquiry covered project documents and data through July 2014, covering the period when developers at CMS were fixing HealthCare.gov for the first open enrollment season, and when they were preparing for the open enrollment season that kicked off last November.