Analysis: Health exchange problems could be more serious and expensive than reported

Maryland Reporter’s audit hawk Charlie Hayward gets into the weeds of the Maryland Health Benefit Exchange and finds a few snakes, financial sinkholes and some future traps.

By Charlie Hayward

[email protected]

Health Secretary Joshua Sharfstein answers reporters questions.

The problems at the Maryland Health Benefits Exchange (MHBE) are likely more serious and more expensive to fix than has already been reported, according to an assessment of project documentation by MarylandReporter.com.

Cost overruns and higher costs in future years could easily run to over $100 million, and big decisions loom regarding who will pay and what will happen to the glitch-ridden website.

In addition, the exchange will continue to need regular bailouts to break even until at least 2018, despite collecting a new tax on insurance firms that was supposed to pay for operations.

Recent newspaper accounts have covered tidbits drawn from litigation between contractors fighting over disagreements about building Maryland’s Health Information Exchange website (HIX). More recently, there’s been an abundance of coverage of testimony to the legislature about HIX problems by Joshua Sharfstein, M.D., who is the head of Department of Health and Mental Hygiene (DHMH) as well as the chair of the exchange’s Board of Trustees.

Sharfstein’s testimony brings much-needed openness and welcome transparency to MHBE’s problems, which seem to have surfaced inside the organization about January 2013, not long after $157 million of federal money came into state coffers.

Silent board minutes, some not posted

The media blitzkrieg draws attention to Maryland state law establishing the need for openness and transparency in MHBE’s activity. The law specifically calls for openness “…so the public can understand… [MHBE’s operations.]”

Gov. Martin O’Malley signs the emergency extension of health insurance for those hampered by problems with the Health Benefits Exchange, with Senate President Mike Miller, left, and House Speaker Michael Busch.

Politics continues to cause Maryland officials from being forthright about MHBE’s difficulties. Even its board minutes are silent about problems.

Four of the last five meetings have been “…open to the public for the purpose of voting on a motion to close the session.” Four sets of earlier meeting minutes dating from 2013 are awaiting approval and remain unpublished. And all meeting materials (particularly exchange managers’ updates) posted since August 2013 have no content about exchange problems. The board seems to have lawyered up by keeping its board discussions vague or inaccessible to the public.

Where would we be if not for media coverage and the legislature demanding answers via a newly formed joint committee?

 Guarded testimony

There’s no shortage of culpability for MHBE’s problems — even the federal government can be blamed and many argue that Congress deserves most of it.

Sharfstein, however, casts apparently well-founded blame on contractors, particularly Noridian Administrative Services Inc. and its subcontractor, Cúram/IBM. Notably, Sharfstein’s written testimony does not acknowledge any culpability by MHBE, even while he apologizes in general to state residents.

Any objective look back at MHBE’s formative period would show several important realities bearing on the monumental risks the state had embraced with implementation of the Affordable Care Act, Obamacare.

The exchange’s leader, Rebecca Pearce, was tasked to build an organization and build a website.

On the first track, she had to hire and train 70 highly specialized employees in a tight employment market for these kinds of workers, while managing the duties arrayed on this chart. On the second track, she had to procure and manage 15 to 20 contracts including those to oversee and build, in record time, the most complex information system in the state’s history.

These challenges appear excessive and unreasonable for one leader to overcome in time, a condition her bosses might have seen but could not fix before she resigned. Something had to give, yet there was no room for slippage on the schedule caused by any problem.

The exchange simply was not prepared. Sharfstein’s testimony, however puts all the blame on contractors without admitting any culpability by the exchange or higher state officials, including himself.

If he would sidestep his well-placed concern for politics, state residents likely would understand how honest — albeit major — errors by exchange personnel could happen. People appreciate candor, and Sharfstein should come clean.

Management shortcomings include hasty procurements

Media reports include several MHBE management gaffes. For instance, The Washington Post reported HIX needed to be connected to 13 different state information systems, but “…most agencies had not heard from the exchange or were unaware that the work was even overdue. The findings were summarized in a Nov. 1, 2012, letter to the president of the Maryland Senate and the speaker of the House of Delegates.”

There are plenty of additional indicators of management shortcomings not yet aired publicly. Some but not all are covered below.

For example, consider the high number of MHBE’s emergency procurements. The exchange procured five Program Management Services contractors in April 2013 (committing to pay them $1.5 million) after allowing less than a week for bidders to prepare proposals. Typically bidders are allowed at least 21 days.

These hasty procurements suggest that the exchange was overwhelmed, realizing it could not manage the Noridian work and had no better option than emergency outsourcing. Bidders commonly build extra risks into their prices (increasing costs to the exchange) under the circumstances of these procurements.

Later in the project, the exchange provided a 10-day bidding period for a “comprehensive” Third-Party Computer Security Assessment. The contractor was then given five weeks to do security control assessments of HIX applications and infrastructure, even while programmers and hardware configuration experts were furiously trying to finish building them.

This computer-security work was a vital federal requirement but its timing raises questions about how effective and reliable the results were.

Contractors not held to the terms of their contracts

Another indicator might be the evidence pointing to MHBE’s difficulties holding contractors to the terms of their contracts. For instance, Sharfstein’s Jan. 14 testimony includes excerpts from reports prepared by BerryDunn, a consulting firm responsible for monitoring qualitative and technical aspects of Noridian’s build of the HIX website.

Sharfstein’s testimony (Pages 27 – 59 Appendix 4) describe numerous instances of Noridian’s performance outside the contract requirements, and demonstrate quite clearly that the exchange had lost control over the project’s System Development Life Cycle.

This term refers to the internal control structure of managing large information-technology projects. Adhering to the principles of System Development Life Cycle is an inherent responsibility of the owner of the computer system, in this case the exchange. This responsibility cannot be shifted to contractors, although IT contracts require that private contractors utilize these Life Cycle methodologies. By trying to affix all blame on contractors, Sharfstein demonstrates that he does not understand this distinction.

In retrospect, the state might have managed its risks more fully by having the exchange contract with the Maryland Department of Information Technology to oversee the HIX build. This would have allowed Rebecca Pearce to focus on building the organization and meeting her myriad other administrative duties.

It was the responsibility of the governor and his lieutenant to consider risks at these highest levels.

 Accountability: cost overruns and requests for more federal funding

Sharfstein acknowledges work done by Noridian was deficient and he has not ruled out any possible remedies, such as some combination of the following:

• Sue contractor/s and recover overpayments.
• Obtain more grant funding from the federal Centers for Medicare and Medicaid Services.
• Cover unexpected costs with Maryland taxpayer dollars.

 Avoidable cost overruns due to delay, disruption, acceleration-deceleration, negligence and honest error appear to adversely affect several years of MHBE’s budgets.

For instance, Sharfstein’s testimony shows a 2014 budget of $138 million — including the MHBE’s first bailout, a $33 million deficiency appropriation for unexpected spending. This is more than four times the resources estimated for the exchange’s annual operations just two years earlier.

Some of the easiest overruns to pinpoint include costs for the Optum/QSSI contract, extra call center resources, HIX entire cost if Maryland decides to abandon it, the emergency insurance just enacted because of HIX problems(MHIP Bridge) and state personnel salaries for extensive manual workarounds.

These do not include any indirect costs and could amount to more than $100 million. There are overruns more difficult to deal with, such as higher costs incurred by the exchange’s insurance companies to sign up customers in spite of erroneous HIX outputs.

The federal government will pay for some but not all overruns. The state has applied to Centers for Medicare and Medicaid Services for additional grant funds. This might be viewed as the exchange’s second bailout, but because the centers hasn’t decided what to fund, the exchange will not disclose the amount of the request or the justifications being used.

The exchange hasn’t terminated Noridian because the law dictates it must make its best efforts to mitigate damages. However, O’Malley must establish accountability by deciding — immediately after March 31 — whether to sue Noridian. This is another decision that could be influenced by politics. Noridian’s likely countersuit would almost surely air in public the exchange’s dirty laundry by giving Noridian’s version of events.

Questions remain on self-sustainability and long-term financing

MHBE is a public corporation and independent unit of the state government established in April 2011. Part of the reason it was set up separately was to insulate its decisions from politics. That was the intent, anyway.

The state planned to finance almost all of the exchange’s operating costs through 2014 with federal money. Starting Jan. 1, 2015, Obamacare money runs out and the exchange must be self-sustaining.

In December 2012, DHMH submitted a consultant report prepared by Wakely Consulting Group to the legislature recommending several ways to pay for MHBE’s operations.

The report estimated “…the cost of operating the exchange to be between $24 and $30 million in 2014, between $38 and $51 million in 2015, and between $44 and $61 million in 2016.” However, Gov. O’Malley chose a different financing approach, and the state legislature passed the Maryland Health Progress Act of 2013 to levy a new tax on insurance premiums charged by health insurers and for-profit health maintenance organizations — regardless of whether they offer insurance through the exchange. This tax purportedly would pay for MHBE’s operations.

But according to the Department of Legislative Service’s (DLS) assessment of the exchange’s 2014 budget (page 24), MHBE will face a widening excess of expenses over revenues immediately after the federal grant money dries up.

General Fund bailouts projected for years

In 2015, exchange expenses are projected to exceed revenues by $22 million. That shortfall, however, will be much higher because revenue assumptions include $24 million of unspent federal money — a dubious assumption, given the magnitude of HIX-related overruns.

In the following three years, DLS predicts that the state will need to find more than $100 million to pay for exchange operations because the new tax on premiums is projected to be insufficient. DLS is careful to say its projections are soft because of uncertainty. Nonetheless, its paper projections show the exchange will need General Fund bailouts every year until those uncertainties fade.

The decision over what to do about HIX will have a significant effect on the exchange’s cost of operations. If HIX is fixed, the state would keep the advantages of running its own exchange while committing to bear the costs of fixing or replacing HIX, finishing its functionality and paying significant operations and maintenance including software licensure for proprietary software built into HIX.

If HIX were abandoned, the effects generally would be the opposite. The governor may want to consider procuring an independent study to objectively quantify taxpayers’ cost of his options in lieu of making a decision that may be too influenced by the prevailing political winds.

Charlie Hayward recently retired after 30 years’ experience with performance, IT, and financial auditing of a wide variety of government programs and activities.