More Recent Headlines
GAO Reports
News stories and news briefs of Government Accountability Office audits, news, reports and testimony.
Featured Stories
GAO Issues Report: Defense Industrial Base - DOD Should Take Actions to Strengthen Its Risk Mitigation Approach
WASHINGTON, July 8 -- The Government Accountability Office has issued a report (GAO-22-104154) entitled "Defense Industrial Base - DOD Should Take Actions to Strengthen Its Risk Mitigation Approach".Here are excerpts of summaries associated with the report.
What GAO Found: "The Department of Defense's (DOD) Industrial Base Policy office does not yet have a consolidated and comprehensive strategy to mitigate risks to the industrial base--the companies that develop and manufacture technologies and weapon systems for DOD. The office is using a combination of four previously issued reports that ... Show Full Article WASHINGTON, July 8 -- The Government Accountability Office has issued a report (GAO-22-104154) entitled "Defense Industrial Base - DOD Should Take Actions to Strengthen Its Risk Mitigation Approach". Here are excerpts of summaries associated with the report. What GAO Found: "The Department of Defense's (DOD) Industrial Base Policy office does not yet have a consolidated and comprehensive strategy to mitigate risks to the industrial base--the companies that develop and manufacture technologies and weapon systems for DOD. The office is using a combination of four previously issued reports thatwere created for other requirements because it devoted its resources to completing other priorities. Collectively, the reports do not include several elements GAO has previously identified that would help DOD achieve results, evaluate progress, and ensure accountability (see figure https://www.gao.gov/products/gao-22-104154).
DOD must update its industrial base strategy following the submission of the next National Security Strategy Report, which is expected to be issued later in 2022. By including all elements in a consolidated strategy, DOD could better ensure that all appropriate organizations are working toward the same priorities, promoting supply chain resiliency, and supporting national security objectives.
DOD is carrying out numerous efforts to mitigate risks to the industrial base. This includes more than $1 billion in reported efforts under Navy submarine and destroyer programs and $125 million to sustain a domestic microelectronics manufacturer. However, DOD has limited insight into the effectiveness of these efforts and how much progress it has made addressing risks. For example:
* The Industrial Base Policy office and military services have not established enterprise-wide performance measures to monitor the aggregate effectiveness of DOD's mitigation efforts.
* DOD's annual Industrial Capabilities Reports do not include information about the progress the department has made in mitigating risks.
GAO's prior work on enterprise risk management establishes that agencies should monitor and report on the status and effectiveness of their risk mitigation efforts. Without key monitoring and reporting information, DOD and Congress do not have sufficient information to help determine whether industrial base risks have been mitigated and what additional resources or actions may be needed."
Why GAO Did This Study: "A healthy defense industrial base that provides the capacity and capability to produce advanced weapon systems is critical to maintaining U.S. national security objectives. The U.S. industrial base currently consists of over 200,000 companies. Mitigating risks--such as reliance on foreign and single-source suppliers--is essential for DOD to avoid supply disruptions and ensure that the industrial base can meet current and future needs.
Since 2017, the White House has issued executive orders directing DOD and other agencies to assess risks to the defense industrial base and high priority supply chains such as semiconductors.
Congress also directed DOD to develop an analytical framework for mitigating risks and included a provision for GAO to review DOD's efforts. This report assesses (1) DOD's strategy for mitigating industrial base risks, and (2) the extent to which DOD is monitoring and reporting on its progress in mitigating risks. GAO analyzed DOD policies and reports and interviewed DOD officials."
What GAO Recommends: "GAO is making six recommendations, including that DOD develop a consolidated and comprehensive strategy to mitigate industrial base risks; develop and use enterprise-wide performance measures to monitor the aggregate effectiveness of its efforts; and report on its progress in mitigating risks. DOD generally concurred with the recommendations and identified some actions to address them."
The report was sent to Sen. Jack Reed, D-Rhode Island, chairman, Sen. James M. Inhofe, R-Oklahoma, ranking member of the Senate Armed Services Committee, Sen. Jon Tester, D-Montana, chairman, Sen. Richard C. Shelby, R-Alabama, ranking member of the Senate Appropriations subcommittee on Defense, Rep. Adam Smith, D-Washington, chairman, Rep. Mike Rogers, R-Alabama, ranking member of the House Armed Services Committee, Rep. Betty McCollum, D-Minnesota, chairman, Rep. Ken Calvert, R-California, ranking member of the House Appropriations subcommittee on Defense, on July 7, 2022.
* * *
July 7, 2022
To: Congressional Committees
Each year, the Department of Defense (DOD) spends billions of dollars acquiring and sustaining weapon systems to ensure that it can meet U.S.
national security objectives and maintain military superiority. A critical element of U.S. power is a healthy defense industrial base-that is, one that has secure supply chains and skilled workers that are able to develop and produce new technologies and advanced weapon systems.
Currently, the U.S. defense industrial base consists of over 200,000 companies that provide the capacity and capability to produce advanced weapon systems. Supporting a vibrant domestic manufacturing sector and resilient supply chains is a national priority and key to ensuring that DOD has access to industrial capabilities to meet current and future needs.
However, for decades, DOD has reported on complex challenges that the defense industrial base is experiencing that necessitate continued and accelerated focus. These challenges include relying on foreign and single-source suppliers for critical materials, replacing obsolete parts on weapon systems that could be in operation for decades, and protecting weapon systems from cybersecurity threats, among others.
The U.S. has also lost significant domestic manufacturing capacity over the past several decades that threatens the resilience of the defense supply chain. For example, DOD reported that capacity and competition in the shipbuilding sector declined significantly over the past 50 years, with 14 shipyards that built Navy ships closing. Three other shipyards also exited the defense industry, and just one new shipyard opened-- leaving only seven shipyards owned by four prime contractors. Similarly, for the semiconductor sector, DOD determined that from 1990 to 2019, domestic semiconductor production capacity decreased from 37 to 12 percent of the global total manufacturing market, while Asia controls nearly 80 percent of the outsourced aspects of semiconductor production./1 Industry groups have also reported on the declining health of the defense industrial base, specifically with DOD's supply chain and production capacity and surge readiness--areas that are critical to U.S. national security interests./2
Over the past 5 years, the White House issued executive orders aimed at improving DOD's ability to identify and navigate supply chain disruptions, such as with semiconductors./3 Congress also enacted legislation, including section 845 of the National Defense Authorization Act for Fiscal Year 2020 that directs DOD to develop a comprehensive analytical framework for risk mitigation across the acquisition process./4 The act includes a provision for us to assess DOD's efforts to mitigate defense industrial base risks. This report assesses (1) DOD's strategy for mitigating defense industrial base risks, and (2) the extent to which DOD is monitoring and reporting on its progress in mitigating risks.
To assess DOD's strategy for mitigating defense industrial base risks, we compared information in documents that DOD identified as its strategy to desirable characteristics for a national strategy that we identified in prior work./5 We also reviewed key legislation, statutes, and executive orders related to mitigating defense industrial base risks and interviewed officials from the Office of the Assistant Secretary of Defense for Industrial Base Policy (Industrial Base Policy).
To assess the extent to which DOD is monitoring and reporting its progress in mitigating risks, we reviewed relevant DOD policies, guidance, and charters to identify what requirements, if any, existed for DOD organizations to monitor and report the outcomes and progress of its risk mitigation efforts. To understand monitoring efforts, we reviewed examples of project documentation from fiscal years 2018 to 2021 from department-wide investment programs to identify how DOD monitors the effectiveness of industrial base projects individually and collectively. To understand DOD's reporting efforts, we reviewed DOD's annual Industrial Capabilities Reports for fiscal years 2018 through 2020 and the statute governing these reports, section 4814 of title 10, U.S. Code. We selected two of 16 defense industrial base sectors--shipbuilding and microelectronics--as case studies for detailed analysis. We also interviewed officials from the Office of Industrial Base Policy, military services, and DOD-wide industrial base investment programs. A more detailed description of our scope and methodology assessment is included in appendix I.
We conducted this performance audit from March 2020 to July 2022 in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.
See footnotes here: https://www.gao.gov/assets/gao-22-104154.pdf
* * *
Conclusions
DOD recognizes the importance of maintaining a healthy industrial base to support U.S. national security goals and is well versed at identifying risks. However, the Industrial Base Policy office has struggled to provide the leadership and strategic vision needed to mitigate risks, some of which have been known for decades, such as in the shipbuilding and microelectronics sectors. DOD's current industrial base strategy, spread out over four different reports, does not contain some desirable characteristics that our prior work shows are essential for guiding the investment of billions of dollars to mitigate risks, including an implementation plan. By addressing in a single document all desirable characteristics of a national strategy--the purpose, risks, milestones, performance measures, required resources, responsible organizations, and implementation plan for mitigating risks--DOD can better ensure its organizations are working toward the same priorities, promoting supply chain resiliency, and ensuring the industrial base supports national security objectives.
Congress and other stakeholders have limited insight on how effectively DOD used the billions of dollars it spent on risk mitigation efforts since fiscal year 2018. This is because the Industrial Base Policy office and the military services have not developed performance measures to gauge their enterprise-wide progress or consistently reported on DOD's efforts through the annual Industrial Capabilities Report. DOD acknowledged these shortcomings and is working on ways to consolidate available data in its various information systems that could facilitate better monitoring and reporting. Such data efforts could be helpful but are years away from completion. Until DOD makes improvements to its monitoring and reporting practices, it will continue to be at risk of investing billions of dollars in mitigation efforts without an accurate understanding of how successful these efforts are in addressing industrial base risks or what additional actions and resources may be needed.
* * *
Recommendations for Executive Action
We are making the following six recommendations to DOD:
The Secretary of Defense should ensure that the National Technology and Industrial Base strategy is in a consolidated document and comprehensive, such as by including required resources and an implementation plan. (Recommendation 1)
The Secretary of Defense should ensure that the Assistant Secretary of Defense for Industrial Base Policy, in coordination with the Industrial Base Council, develops and uses performance measures to monitor the aggregate effectiveness of mitigation efforts for DOD-wide industrial base risks. (Recommendation 2)
The Secretary of the Air Force should ensure that the Assistant Secretary of the Air Force for Acquisition, Technology and Logistics develops and uses performance measures to monitor the aggregate effectiveness of mitigation efforts for Air Force and Space Force industrial base risks. (Recommendation 3)
The Secretary of the Army should ensure that the Assistant Secretary of the Army for Acquisition, Logistics, and Technology develops and uses performance measures to monitor the aggregate effectiveness of mitigation efforts for Army industrial base risks. (Recommendation 4)
The Secretary of the Navy should ensure that the Assistant Secretary of the Navy for Research, Development, and Acquisition develops and uses performance measures to monitor the aggregate effectiveness of mitigation efforts for Navy and Marine Corps industrial base risks. (Recommendation 5)
The Secretary of Defense should ensure that DOD reports its progress toward mitigating industrial base risks. For example, this information could be included in DOD's annual Industrial Capabilities Reports, which already include sector risk assessments. (Recommendation 6)
* * *
Agency Comments
We provided DOD a draft of this product for review and comment. In its written comments, reproduced in appendix II, DOD and the military services concurred with five recommendations. DOD stated that it is aware of the need for performance measures to monitor the aggregate effectiveness of mitigation efforts for DOD-wide industrial base risks and that it is actively developing metrics aligned to the five focus areas in the Executive Order 14017 report. The Navy also stated that it is working to establish measures to track industrial base supply efforts within the military service. Further, DOD plans to identify the best way to report progress based on the metrics and performance measures.
DOD partially concurred with recommendation 1. DOD stated that it agrees with the importance of a comprehensive National Technology and Industrial Base strategy that includes (among other things) resourcing and an implementation plan. With the reorganization of Industrial Base Policy, DOD also plans for more routine and consolidated reports to streamline responses to existing reporting requirements. Particularly, DOD stated that it will evaluate ways to streamline similar reports that cover aspects of the National Technology and Industrial Base strategy into other industrial base analytical products for a cohesive picture of the problem and strategy. DOD noted, however, that a separate strategy document is not necessary as information is already provided in other existing required reports and would unnecessarily divert limited resources. As DOD works to make its strategy more comprehensive and cohesive, we will monitor its efforts to implement the recommendation.
* * *
The text of the GAO report is available at https://www.gao.gov/products/gao-22-104154
GAO Issues Report: Defense Health Care - Actions Needed to Improve Billing and Collection of Debt for Civilian Emergency Care
WASHINGTON, July 8 -- The Government Accountability Office has issued a report (GAO-22-104770) entitled "Defense Health Care - Actions Needed to Improve Billing and Collection of Debt for Civilian Emergency Care".Here are excerpts of summaries associated with the report.
What GAO Found: "Department of Defense (DOD) documentation and officials have identified several benefits to providing care to civilian emergency patients at DOD medical treatment facilities (MTFs). For example, providing such care can promote the readiness of military health care providers because it increases the volume of ... Show Full Article WASHINGTON, July 8 -- The Government Accountability Office has issued a report (GAO-22-104770) entitled "Defense Health Care - Actions Needed to Improve Billing and Collection of Debt for Civilian Emergency Care". Here are excerpts of summaries associated with the report. What GAO Found: "Department of Defense (DOD) documentation and officials have identified several benefits to providing care to civilian emergency patients at DOD medical treatment facilities (MTFs). For example, providing such care can promote the readiness of military health care providers because it increases the volume ofpatients they treat and allows them to treat a broader range of cases, including complex cases. However, DOD has not assessed and monitored the extent to which providing emergency medical care to civilians offers the relevant mix and volume of cases needed to maintain readiness. Doing so would better position DOD to determine if continuing or expanding this care maintains readiness.
DOD has limited oversight of billing and collection of debt for civilian emergency care patients. GAO found that MTFs do not always update DOD's billing system to reflect payments collected while debt was with the Department of the Treasury (see figure https://www.gao.gov/products/gao-22-104770) because DOD has not issued guidance that clarifies the extent to which MTFs should do so. Without guidance to ensure accurate accounting of billing and collection efforts, DOD leaders risk being unable to account for potentially millions of dollars collected each year. DOD also risks making decisions about civilian care using incomplete information.
DOD does not consistently use or communicate options for financial relief for civilian emergency patients, according to GAO's analysis of DOD and Treasury data. Specifically, DOD rarely uses certain financial relief options--including waiving or settling medical debt for less than the full amount owed. For example, only the Navy confirmed approving waivers from fiscal years 2016 through 2021, and does not consistently inform civilian emergency patients about options to request financial relief, to include waivers or settling of medical debt.
By systematically tracking and monitoring the use of waivers, DOD may better understand the number of waiver requests it receives, the amount of debt it waives, and the circumstances under which it approves them to ensure timeliness and consistency. Additionally, by clearly communicating financial relief options, DOD could help civilian emergency patients better understand those options and pursue them in a timely manner."
Why GAO Did This Study: "DOD primarily provides medical care to servicemembers, their dependents, and retirees. In 2010, DOD became authorized to provide emergency care to civilians at MTFs. DOD is generally required to bill civilians for care provided at MTFs, but the cost of such care may create financial hardships for these civilian patients. When the debt becomes delinquent, DOD turns it over to Treasury for collection.
The National Defense Authorization Act for Fiscal Year 2021 contained a provision for GAO to assess DOD's efforts to bill and collect debts for civilian emergency care at MTFs, among other things. This report assesses the extent to which DOD (1) has identified benefits of providing emergency care to civilians, (2) oversees billing and debt collection for emergency care provided to civilians, and (3) uses and communicates options for financial relief to lessen the effect of the cost of care on civilian emergency patients.
GAO analyzed DOD and Treasury billing data for services provided from fiscal years 2016 through 2021; reviewed information related to benefits of providing care to civilians; and interviewed DOD and Treasury officials."
What GAO Recommends: "GAO is recommending that DOD assess and monitor how providing civilian emergency care maintains medical readiness, issue guidance to update systems with complete collection information, track and monitor waiver requests, and communicate financial relief options. DOD did not provide comments on a draft of this report."
The report was sent to Sen. Jack Reed, D-Rhode Island, chairman, Sen. James M. Inhofe, R-Oklahoma, ranking member of the Senate Armed Services Committee, Rep. Adam Smith, D-Washington, chairman, and Rep. Mike Rogers, R-Alabama, ranking member of the House Armed Services Committee, on July 7, 2022.
* * *
July 7, 2022
To: The Honorable Jack Reed, Chairman, The Honorable James M. Inhofe, Ranking Member, Committee on Armed Services, United States Senate
The Honorable Adam Smith, Chairman, The Honorable Mike Rogers, Ranking Member, Committee on Armed Services, House of Representatives
The Department of Defense's (DOD) Military Health System exists to ensure that military medical personnel are ready to provide medical care in support of missions that include operational, wartime, and mass casualty events. To that end, DOD's clinics, hospitals, and medical centers--referred to collectively as medical treatment facilities (MTFs)-- and the patients they treat are critical to maintaining the medical readiness of military servicemembers and the military readiness of medical personnel./1
To maintain this readiness, MTFs provide care to beneficiaries, including servicemembers, their dependents, and retirees, among others./2 In certain circumstances, non-beneficiaries, such as civilian emergency patients, may also receive care at MTFs. In such cases, DOD is generally required to bill them for their care./3 Collecting payment for the care of non-beneficiaries can be challenging when these patients do not have medical insurance, are underinsured, or collection of the debt imposes a financial burden, according to DOD officials.
In an emergency, any person is authorized care in MTFs to prevent undue suffering or loss of life or limb. In 2010, DOD became authorized to provide medical care to civilians at MTFs in specific circumstances, thereby broadening its authority to provide care to civilians./4 In 2016, the National Defense Authorization Act (NDAA) for Fiscal Year 2017 authorized DOD to provide medical care to civilians at MTFs in specific circumstances, including when such treatment is necessary to maintain providers' readiness./5 Under this authority, three MTFs (Naval Medical Center Camp Lejeune, Mike O'Callaghan Military Medical Center, and Womack Army Medical Center) provide medical care to civilians as of March 2022 through the Section 717 Pilot program. In 2021, the William M. (Mac) Thornberry NDAA for Fiscal Year 2021 authorized the Secretary of Defense to waive medical debt for care provided to a civilian when the civilian is unable to pay the costs of the care provided and such care enhances the knowledge, skills, and abilities of the military health care providers./6
Section 749 of the William M. (Mac) Thornberry NDAA for Fiscal Year 2021 included a provision for us to assess, among other things, the billing and collection of debts for emergency medical care provided to civilians who are not covered beneficiaries at MTFs. This report assesses the extent to which DOD (1) has identified benefits of providing emergency medical care to civilians at MTFs, (2) oversees billing and debt collection for emergency medical care provided to civilians at MTFs, and (3) uses and communicates options for financial relief to lessen the effect of the cost of care on civilian medical emergency patients./7
For each of our objectives, we interviewed officials from the Under Secretary of Defense for Personnel and Readiness (USD (P&R)),
Assistant Secretary of Defense for Health Affairs (ASD (HA)), Defense Health Agency (DHA), each of the military departments, and eight selected MTFs./8 For our first objective, we reviewed relevant statutes and DOD policies and guidance. We also reviewed other DOD documentation, including relevant studies conducted by MTFs, which included information on the benefits and challenges of providing civilian emergency medical care. Additionally, we interviewed DOD officials to obtain their perspectives on the benefits and challenges of providing civilian emergency medical care.
For our second objective, we reviewed and analyzed data from DOD and the Department of the Treasury for all 44 military hospitals and medical centers that offer emergency care for services performed from fiscal years 2016 through 2021./9 We chose fiscal year 2016 to determine trends over time and fiscal year 2021 because it was the last complete fiscal year with available data. We identified limitations to the DOD billing data and took steps in our analysis to mitigate these limitations in order to report on the number of civilian emergency patients receiving care and the minimum amounts collected for their care. DOD's financial audit report also identified limitations that affected our ability to assess the completeness and accuracy of the data entered into its systems./10 However, based on the steps taken using DOD and Treasury data in our analysis, we determined these data are sufficiently reliable to report on 1) the number of civilian emergencies receiving care and 2) the minimum amounts billed and collected for care provided to civilian emergencies for services performed from fiscal years 2016 through 2021.
For our third objective, we analyzed DOD and Treasury data and documentation on debt compromised (i.e., settled for less than the original amount owed) and waivers of the charges for services performed from fiscal years 2016 through 2021. We also reviewed a non-probability sample of invoices and related documentation from DHA and Army, Navy, and Air Force MTFs to understand what information about financial relief options is communicated to civilians. Additional information about our scope and methodology can be found in appendix I.
We conducted this performance audit from January 2021 to July 2022 in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.
See footnotes here: https://www.gao.gov/assets/gao-22-104770.pdf
* * *
Conclusions
Providing emergency care to civilian patients at MTFs can help medical providers maintain their medical readiness skills and competencies, but it can also leave patients with significant medical debt. DHA has implemented pilot programs at selected MTFs both to expand civilians' access to emergency care and to address the related financial hardships.
However, it lacks quality information about certain key aspects of civilian emergency care. For example, DHA does not reliably identify civilian emergency patients in its systems and use this information to measure the extent to which such care helps maintain readiness.
Moreover, MTFs do not consistently update DHA's billing system with payments received by Treasury, which potentially leaves DHA without upto-date information that is needed to make decisions about civilian emergency care and determine the true cost of providing such care.
While DOD has options to provide financial relief to civilian emergency patients, it does not consistently inform patients about them, rarely uses them, and does not monitor their use. By addressing these issues, DOD could better ensure that civilian emergency care helps promote readiness objectives without placing an undue financial burden on patients and reduce the level of resources DOD and Treasury must expend to collect debt.
* * *
Recommendations for Executive Action
We are making the following four recommendations to DOD:
The Secretary of Defense should ensure that the Director of the Defense Health Agency assesses and monitors the extent to which medical care provided to civilian emergency patients offers the relevant mix and volume of medical casework required to maintain medical readiness skills and competencies. (Recommendation 1)
The Secretary of Defense should ensure that the Director of the Defense Health Agency issues and implements guidance for MTFs to update their billing systems to ensure the systems contain complete and accurate billing and collection information. (Recommendation 2)
The Secretary of Defense should ensure that the Under Secretary of Defense for Personnel and Readiness, in coordination with the Director of the Defense Health Agency and the Secretaries of the military departments, issues and implements guidance to systematically track and monitor waiver requests from and waivers for civilian emergency patients. (Recommendation 3)
The Secretary of Defense should ensure that the Under Secretary of Defense for Personnel and Readiness and the Director of the Defense Health Agency issue and implement guidance for MTFs that clarifies what financial relief options are available to civilian emergency patients and how such information should be communicated to them, such as by including information in patient invoices about how to request applicable forms of financial relief. (Recommendation 4)
* * *
Agency Comments
We provided a draft of this report to DOD and Treasury for review and comment. DOD did not provide comments, and Treasury informed us that it did not have any comments.
* * *
The text of the GAO report is available at https://www.gao.gov/products/gao-22-104770
GAO Issues Report: Higher Education - Testing Companies Most Commonly Granted Extra Time to Accommodate Individuals With Disabilities
WASHINGTON, July 8 -- The Government Accountability Office has issued a report (GAO-22-104430) entitled "Higher Education - Testing Companies Most Commonly Granted Extra Time to Accommodate Individuals with Disabilities".Here are excerpts of summaries associated with the report.
What GAO Found: "Companies that administer standardized higher education tests grant a variety of accommodations to help ensure their tests are accessible to individuals with disabilities. The most common accommodations granted in 2019-2020 were for individuals who needed extra time or adjustments to the testing environment, ... Show Full Article WASHINGTON, July 8 -- The Government Accountability Office has issued a report (GAO-22-104430) entitled "Higher Education - Testing Companies Most Commonly Granted Extra Time to Accommodate Individuals with Disabilities". Here are excerpts of summaries associated with the report. What GAO Found: "Companies that administer standardized higher education tests grant a variety of accommodations to help ensure their tests are accessible to individuals with disabilities. The most common accommodations granted in 2019-2020 were for individuals who needed extra time or adjustments to the testing environment,according to the most recent data from the six testing companies GAO reviewed (see figure https://www.gao.gov/products/gao-22-104430). In determining eligibility for accommodations, officials from those testing companies reported considering factors such as how a disability affects an individual's ability to test under standard conditions and any prior use of accommodations. Officials also said they consider whether a request is appropriate for a particular test (e.g., whether granting it could affect test validity).
Individuals with disabilities and testing companies faced several challenges related to testing accommodations. For example, some individuals had difficulty providing adequate documentation to justify their accommodations, according to representatives from six disability advocacy organizations. Officials from five of the six testing companies described challenges in reviewing and granting accommodation requests. For example, officials from three testing companies said requests that do not sufficiently describe an individual's disability and its impact are difficult to evaluate. In addition, officials from two companies said it can be challenging to provide appropriate accommodation access while also protecting test integrity.
The Department of Justice enforces requirements under the Americans with Disabilities Act of 1990, as amended, (ADA) related to testing accommodations. Justice has investigated or referred reports of potential violations, intervened in private litigation, and clarified requirements to promote compliance. From 2017 through 2020, Justice reported receiving and closing more than 90,000 reports of potential ADA violations, of which fewer than 100 pertained to the selected tests in GAO's review. To manage resources, Justice officials said they prioritize reports that could have a broad impact for investigation or referral to U.S. Attorney's Offices. Justice officials also said the agency can intervene in private lawsuits to address systemic problems with testing accommodations. In 2015, Justice issued a technical assistance document to clarify ADA requirements for testing accommodations."
Why GAO Did This Study: "Each year, millions of individuals take standardized tests--like the SAT or GRE--with the goal of pursuing higher education. Under the ADA, testing companies must provide accommodations to individuals with disabilities. Justice is responsible for enforcing ADA requirements related to testing accommodations.
GAO was asked to review accommodations on higher education tests. This report examines (1) the types of accommodations testing companies grant and how they make those decisions, (2) challenges associated with testing accommodations, and (3) how Justice has enforced compliance with ADA requirements related to testing accommodations.
GAO obtained and reviewed accommodation data from the six testing companies that administer the ACT, AP Exams, GMAT, GRE, LSAT, MCAT, PSAT, and SAT. These tests are commonly associated with admission into higher education programs. The data are from 2019 through 2020, the most recent available. GAO also reviewed relevant federal laws and regulations and Justice's data on closed reports and investigations of potential ADA violations pertaining to the selected tests from 2017 through 2020, the most recent data available. GAO interviewed officials from the six testing companies, six disability advocacy organizations selected to reflect a range of perspectives, and from Justice."
The report was sent to Sen. Robert Casey Jr., D-Pennsylvania, chairman, Sen. Bill Cassidy, R-Louisiana, ranking member of the Senate Health, Education, Labor and Pensions subcommittee on Children and Families, Sen. Maggie Hassan, D-New Hampshire, Sen. Tim Kaine, D-Virginia, Rep. Mark DeSaulnier, D-California, and Rep. Cathy McMorris Rodgers, R-Washington, on July 6, 2022.
* * *
June 6, 2022
To: The Honorable Robert P. Casey, Jr., Chairman, The Honorable Bill Cassidy, Ranking Member, Subcommittee on Children and Families, Committee on Health, Education, Labor and Pensions, United States Senate
The Honorable Margaret Wood Hassan, United States Senate
The Honorable Tim Kaine, United States Senate
The Honorable Mark DeSaulnier, House of Representatives
The Honorable Cathy McMorris Rodgers, House of Representatives
Each year millions of individuals take standardized tests with the goal of enrolling in undergraduate, graduate, or professional school. These tests are designed to measure knowledge in a specific area or predict future academic success. Standardized tests are generally administered under uniform conditions and time limits to ensure test scores are comparable across individuals. However, such standardization may make it challenging for some individuals with disabilities to accurately demonstrate their knowledge or potential. Companies that administer standardized tests (testing companies) are required to provide accommodations, such as extra time or extra breaks, to individuals with disabilities under the Americans with Disabilities Act of 1990, as amended, (ADA) which protects individuals with disabilities from discrimination in certain settings./1 To ensure compliance, the Department of Justice is responsible for enforcing the ADA's requirements related to testing accommodations.
Given the role that standardized tests play in accessing higher education and how accommodations can make those tests accessible for individuals with disabilities, you asked us to examine various issues related to testing accommodations. This report describes (1) the types of accommodations testing companies grant and how they make those decisions; (2) the challenges associated with testing accommodations for individuals and testing companies; and (3) how Justice has enforced compliance with ADA requirements related to testing accommodations.
In conducting this work, we focused on eight tests offered by six companies that are associated with undergraduate, graduate, and professional education. At the undergraduate level, we selected the most common admissions tests, the ACT and SAT, as well as Advanced Placement (AP) Exams and Preliminary SAT (PSAT) assessments generally taken by tenth and eleventh graders. We selected these based on their roles in the college admissions process and in determining merit scholarships./2 At the graduate and professional level, we selected four admissions tests used in the fields of study with the largest number of graduates. They are the Graduate Management Admission Test (GMAT), GRE General Test (GRE), Law School Admission Test (LSAT), and Medical College Admission Test (MCAT)./3
To determine the types of accommodations testing companies grant, we collected and reviewed data from the six testing companies for calendar years 2019 and 2020, the most recent years for which data were available. The data included the number of accommodations requested and granted by accommodation and disability type. We assessed the reliability of these data by asking the testing companies whether they had routine quality control procedures in place, among other things. We also reviewed the accommodation data for consistency and completeness.
Based on these efforts, we believe the data that testing companies provided are sufficiently reliable for the purposes of our reporting objectives. To understand how testing companies made accommodation decisions for selected tests, we reviewed policies and procedures on their websites and interviewed officials from each company./4
To identify challenges related to testing accommodations, we interviewed representatives from six disability advocacy organizations that were selected to reflect a range of perspectives on the experience of individuals with disabilities./5 We also asked officials at the six testing companies about their challenges related to reviewing accommodation requests.
To examine how Justice has enforced compliance with ADA requirements related to testing accommodations, we reviewed pertinent federal laws and regulations and interviewed agency officials. We also obtained data from Justice on closed reports and investigations of potential ADA violations that pertain to the eight tests and six associated testing companies included in our review for calendar years 2017 through 2020, the most recent data available. We assessed the reliability of these data by reviewing documentation about Justice's data systems and by soliciting information from knowledgeable agency officials about the process used to identify reports and investigations in their data systems.
We found the data to be sufficiently reliable for the purposes of describing the total number of closed reports and investigations. A more detailed explanation of our objectives, scope, and methodology can be found in appendix I.
We conducted this performance audit from July of 2020 to June of 2022 in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.
See footnotes here: https://www.gao.gov/assets/gao-22-104430.pdf
* * *
Agency Comments and Our Evaluation
We provided a draft of the report to Justice for review and comment.
Justice provided technical comments, which we incorporated as appropriate. We also provided relevant report statements to the Department of Education, Department of Health and Human Services, and the six testing companies included in our review for technical comment. The Department of Education and testing companies provided technical comments, which we incorporated as appropriate. The Department of Health and Human Services did not have any comments.
* * *
The text of the GAO report is available at https://www.gao.gov/products/gao-22-104430
GAO Issues Report: Facial Recognition Technology - Federal Agencies' Use and Related Privacy Protections
WASHINGTON, July 2 -- The Government Accountability Office has issued a report (GAO-22-106100) entitled "Facial Recognition Technology - Federal Agencies' Use and Related Privacy Protections".Here are excerpts of summaries associated with the report.
What GAO Found: "In August 2021, GAO reported its survey results on facial recognition technology (FRT) activities, which found that 18 of 24 agencies reported using FRT for one or more purposes, with digital access and domestic law enforcement as the most common. For example, two agencies reported testing FRT to verify identities of persons accessing ... Show Full Article WASHINGTON, July 2 -- The Government Accountability Office has issued a report (GAO-22-106100) entitled "Facial Recognition Technology - Federal Agencies' Use and Related Privacy Protections". Here are excerpts of summaries associated with the report. What GAO Found: "In August 2021, GAO reported its survey results on facial recognition technology (FRT) activities, which found that 18 of 24 agencies reported using FRT for one or more purposes, with digital access and domestic law enforcement as the most common. For example, two agencies reported testing FRT to verify identities of persons accessinggovernment websites and other agencies used FRT to generate leads in criminal investigations. Agencies also reported accessing FRT systems of other entities, such as those owned by other federal agencies, state and local governments, and the private sector. In addition, ten agencies reported conducting or supporting FRT-related research and development. For example, the Department of Justice reported conducting applied research on the relationship between skin tone and false match rates in facial recognition algorithms, among other efforts.
In June 2021, GAO reported the results of another survey of 42 federal agencies that employ law enforcement officers. Fourteen agencies reported using FRT to support criminal investigations; however, GAO found that 13 of these agencies did not track employee use of non-federal (e.g., state and commercial) FRT systems. For example, one agency conducted a poll and learned that its employees had used a non-federal system to conduct more than 1,000 facial recognition searches. The lack of awareness about employees' use of non-federal FRT systems can have privacy implications--including a risk of not adhering to privacy laws or that system owners may share sensitive information used for searches. In September 2020, GAO also found that U.S. Customs and Border Protection's (CBP) Biometric Entry-Exit Program incorporated some privacy protections, but the implementation of privacy notices and audits were inconsistent. For example, CBP had audited only one of its more than 20 commercial airline partners and did not have a plan to audit all its partners for compliance with the program's privacy requirements."
Why GAO Did This Study: "Use of FRT has become increasingly common across the government and private sector. As the use of FRT continues to expand, advocacy organizations and others have highlighted the importance of understanding FRT uses in federal agencies and related privacy risks.
This statement describes (1) use of FRT at federal agencies and (2) privacy protections present in FRT systems used by federal agencies.
This statement is based on recent GAO reports on the use of FRT, including (1) an August 2021 report on current and planned use of FRT across federal agencies that included a survey of the 24 largest agencies, (2) a June 2021 report on federal law enforcement agencies' use of FRT that included a survey administered to 42 agencies that employ law enforcement officers, and (3) a 2020 report on use of FRT for airport and port security. To conduct this prior work, GAO reviewed relevant documents and interviewed agency officials."
What GAO Recommends: "In prior reports, GAO made recommendations to 13 agencies to implement a mechanism to track use of non-federal systems by employees and assess the risks of these systems and to CBP to develop and implement a plan to conduct privacy audits of its partners, among others. Agencies generally concurred with the recommendations. Three agencies have implemented mechanisms to track non-federal systems, but have not yet assessed the risks of using such systems. CBP has conducted some, but not all, privacy audits of its partners."
The report was sent to Rep. Bill Foster, D-Illinois, chairman, and Rep. Jay Obernolte, R-California, ranking member of the House Science, Space and Technology subcommittee on Investigations and Oversight, on June 29, 2022.
* * *
Chairman Foster, Ranking Member Obernolte, and members of the Subcommittee:
I am pleased to be here today to discuss the federal government's use of facial recognition technology (FRT). Use of this technology has become increasingly common across the government and private sector. As the use of FRT continues to expand, Members of Congress, academics, and advocacy organizations have highlighted the importance of developing a comprehensive understanding of how it is used by federal agencies. In addition, use of the technology has raised concerns about its accuracy and the privacy implications.
My statement today will focus on (1) use of FRT at federal agencies and (2) privacy protections present in FRT systems used by federal agencies.
This statement is based on findings from a series of recent reports we have issued on FRT./1 In August 2021, we reported on current and planned uses of FRT systems within the federal government, which included a survey of 24 Chief Financial Officers Act agencies./2 In June 2021, we reported on the use of FRT systems by federal law enforcement agencies, which included a survey to 42 federal agencies that employ law enforcement officers. In September 2020, we reported on use of FRT for airport and port security. For each of these reports, we reviewed program documents and interviewed relevant officials. These reports provide detailed descriptions of our scope and methodology.
We conducted the work on which this statement is based in accordance with generally accepted government auditing standards. These standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.
See footnotes here: https://www.gao.gov/assets/gao-22-106100.pdf
* * *
The text of the GAO report is available at https://www.gao.gov/products/gao-22-106100
GAO Issues Report: Amateur Athlete Safety - Certification Related to the Independence of the U.S. Center for SafeSport for FY 2021
WASHINGTON, July 2 -- The Government Accountability Office has issued a report (GAO-22-105572) entitled "Amateur Athlete Safety - Certification Related to the Independence of the U.S. Center for SafeSport for Fiscal 2021".Here are excerpts of summaries associated with the report.
What GAO Found: "The U.S. Center for SafeSport (the Center) is a nonprofit organization that plays a key role in ensuring the safety of amateur athletes. The Center has jurisdiction over the U.S. Olympic and Paralympic Committee (the Corporation) and its affiliated organizations (known as national governing bodies) ... Show Full Article WASHINGTON, July 2 -- The Government Accountability Office has issued a report (GAO-22-105572) entitled "Amateur Athlete Safety - Certification Related to the Independence of the U.S. Center for SafeSport for Fiscal 2021". Here are excerpts of summaries associated with the report. What GAO Found: "The U.S. Center for SafeSport (the Center) is a nonprofit organization that plays a key role in ensuring the safety of amateur athletes. The Center has jurisdiction over the U.S. Olympic and Paralympic Committee (the Corporation) and its affiliated organizations (known as national governing bodies)with regard to safeguarding amateur athletes against abuse in sports.
GAO found no evidence that a former employee or board member of the Corporation worked for or volunteered with the Center during fiscal year 2021 in violation of the 2-year cooling off period set forth in the Empowering Olympic, Paralympic, and Amateur Athletes Act of 2020 (EOPAAA). Further, for fiscal year 2021, GAO found no evidence of a conflict of interest, as defined by the EOPAAA, between the Center's executives or attorneys and the Corporation. According to the EOPAAA, an executive or attorney for the Center shall be considered to have an inappropriate conflict of interest if the executive or attorney also represents the Corporation. In addition, GAO's review of the Center's investigative process found no evidence of interference or influence by the Corporation. Based on the certification provisions of the EOPAAA and GAO's methodology, GAO certifies that the Center was independent from the Corporation during fiscal year 2021."
Why GAO Did This Study: "The EOPAAA included a provision for GAO to annually "make available to the public a certification relating to the Center's independence from the Corporation," including:
* a finding of whether a violation of the prohibition on employment of former employees or board members of the Corporation has occurred during the year preceding the certification (2-year cooling off period);
* a finding of whether an executive or attorney for the Center has had an inappropriate conflict of interest during that year; and
* a finding of whether the Corporation has interfered in, or attempted to influence the outcome of, an investigation by the Center.
GAO reviewed information provided by the Center about its employees and individuals who worked or volunteered for the Center at any point during fiscal year 2021 (January 1, 2021 to December 31, 2021), including conflict of interest verification forms that the Center requires of all such individuals. GAO cross-checked the information provided by the Center to information received from the Corporation about its employees, such as information about attorneys employed, hired, or retained and a brief description of the type of matter each attorney engaged in on behalf of the Corporation. Also, GAO reviewed the Center's written responses to questions and various documents, such as the Center's employee handbook, board bylaws, confidentiality policy, standard operating procedures, and the SafeSport Code, which establishes acceptable standards of conduct for all individuals who participate in U.S. Olympic and Paralympic events and training."
The report was sent to Sen. Maria Cantwell, D-Washington, chairman, Sen. Roger Wicker, R-Mississippi, ranking member of the Senate Commerce, Science and Transportation Committee, Sen. Richard J. Durbin, D-Illinois, chairman, Sen. Charles Grassley, R-Iowa, ranking member of the Senate Judiciary Committee, Rep. Frank Pallone Jr., D-New Jersey, chairman, Rep. Cathy McMorris Rodgers, R-Washington, Republican leader of the House Energy and Commerce Committee, Rep. Jerrold Nadler, D-New York, chairman, and Rep. Jim Jordan, R-Ohio, ranking member of the House Judiciary Committee, on June 29, 2022.
* * *
June 29, 2022
To: Congressional Committees
Amateur Athlete Safety: Certification Related to the Independence of the U.S. Center for-SafeSport for Fiscal Year 2021
The U.S. Center for SafeSport (the Center), established in March 2017, is a nonprofit-organization that plays a key role in ensuring the safety of amateur athletes, many of whom are-minors, who participate in Olympic, Paralympic, Pan-American, and Parapan American events-and training./1 The Center has jurisdiction over the U.S. Olympic and Paralympic Committee (the-Corporation) and national governing bodies (amateur sports organizations recognized or-certified by the Corporation for a sport included in the Olympic, Paralympic, Pan-American, or-Parapan American Games), with regard to safeguarding amateur athletes against abuse in-sports./2 The Center is required to develop training, oversight practices, policies, and procedures-to prevent abuse of amateur athletes, among other activities. Also, the Center investigates and-resolves allegations of sexual misconduct by coaches, trainers, managers, peers, and others in-violation of the Center's policies and procedures. In addition, the Center may, at its discretion,-investigate and resolve allegations of other policy violations, including non-sexual child abuse-and emotional and physical misconduct./3
The Empowering Olympic, Paralympic, and Amateur Athletes Act of 2020 (EOPAAA) made several amendments to the Ted Stevens Act./4 Among other things, it prohibits former-employees or board members of the Corporation or a national governing body from working or-volunteering at the Center for 2 years and prohibits the Corporation and the national governing bodies from interfering in or attempting to influence the outcome of an investigation./5 It also-provides that an executive or attorney for the Center shall be considered to have an-inappropriate conflict of interest if the executive or attorney also represents the corporation or a-national governing body./6
The EOPAAA included a provision for GAO to annually "make available to the public a-certification relating to the Center's independence from the Corporation," including the-following:/7
* a finding of whether a violation of the prohibition on employment of former employees or-board members of the Corporation has occurred during the year preceding the certification;
* a finding of whether an executive or attorney for the Center has had an inappropriate-conflict of interest during that year; and
* a finding of whether the Corporation has interfered in, or attempted to influence the-outcome of, an investigation by the Center.
In our second annual report, we examined, during the period of January 1, 2021, through-December 31, 2021: (1) whether former board members or employees of the Corporation-observed the required 2-year "cooling-off period" before working or volunteering at the Center;-(2) whether an executive or attorney for the Center had an inappropriate conflict of interest; and-(3) whether the Corporation interfered in, or attempted to influence the outcome of, an-investigation by the Center.
Our certification applies to the Corporation./8 However, we also included information about-national governing bodies in our report because the EOPAAA refers to national governing-bodies as well as the Corporation in connection with the cooling-off period, the definition of an-inappropriate conflict of interest, and the prohibition on interference with Center investigations.
Our findings in this report are based on our review of information and documents that we-obtained from the Center, the Corporation, and national governing bodies./9 Specifically, to-examine whether the cooling-off period was observed and whether inappropriate conflicts of-interest occurred, we reviewed information provided by the Center about its employees and volunteers (including board members, executives, attorneys, contractors, and other staff) who-worked or volunteered for the Center at any point during its fiscal year 2021 (January 1, 2021, to-December 31, 2021). We reviewed conflict of interest verification forms and associated-supplemental statements that the Center requires of all its employees, board and committee-members, contractors, volunteers, and interns./10 The form requires disclosure of any current or-past employment or association with the Corporation or a national governing body.
We also cross-checked the information provided by the Center to information we received from-the Corporation and 47 of 54 national governing bodies about their employees./11 For example,-we obtained from the Corporation and national governing bodies information about attorneys-they employed, hired, or retained; the dates of representation; and a brief description of the type-of matter each attorney or firm engaged in on behalf of the Corporation or national governing-body. We also received information from the Corporation and national governing bodies about-whether, to their knowledge, former employees, including board members, executives,-attorneys, employees of contractors, and volunteers, subsequently became involved with the-Center as employees, board members, volunteers, contractors, or outside counsel after leaving-their organizations./12
To examine whether the Corporation interfered in, or attempted to influence the outcome of, an-investigation, we reviewed the Center's written responses to questions about how employees,-board members, or other representatives of the Corporation or national governing bodies-interacted with the Center during fiscal year 2021. We also reviewed various documents, such-as the Center's employee handbook, the Center bylaws, confidentiality policy, standard-operating procedures, and the SafeSport Code, which establishes acceptable standards of-conduct for all individuals who participate in U.S. Olympic and Paralympic events and training./13-We conducted this performance audit from November 2021 to June 2022 in accordance with-generally accepted government auditing standards. Those standards require that we plan and-perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our-findings and conclusions based on our audit objectives. We believe that the evidence obtained-provides a reasonable basis for our findings and conclusions based on our audit objectives.
See footnotes here: https://www.gao.gov/assets/gao-22-105572.pdf
* * *
The text of the GAO report is available at https://www.gao.gov/products/gao-22-105572
GAO Issues Report: Electronic Health Information - HHS Needs to Improve Communications for Breach Reporting
WASHINGTON, June 30 -- The Government Accountability Office has issued a report (GAO-22-105425) entitled "Electronic Health Information - HHS Needs to Improve Communications for Breach Reporting".Here are excerpts of summaries associated with the report.
What GAO Found: "Since 2015, the Department of Health and Human Services (HHS) has seen an increase in reported breaches while the number of affected individuals has varied each year from approximately 5 to 113 million. Such breaches of health information involve the unauthorized (intentional or unintentional) exposure, disclosure, or loss of ... Show Full Article WASHINGTON, June 30 -- The Government Accountability Office has issued a report (GAO-22-105425) entitled "Electronic Health Information - HHS Needs to Improve Communications for Breach Reporting". Here are excerpts of summaries associated with the report. What GAO Found: "Since 2015, the Department of Health and Human Services (HHS) has seen an increase in reported breaches while the number of affected individuals has varied each year from approximately 5 to 113 million. Such breaches of health information involve the unauthorized (intentional or unintentional) exposure, disclosure, or loss ofan individual's identifiable health information. The figure shows the number of breaches reported by various covered entities from 2015 through 2021.
View chart here: https://www.gao.gov/products/gao-22-105425
The HHS Office for Civil Rights (OCR), the unit responsible for enforcing the Health Insurance Portability and Accountability Act (HIPAA) standards, has taken steps to establish a process on whether entities implemented recognized security practices. A law enacted in January 2021 required HHS, as part of its enforcement activities, to consider whether covered entities had implemented such practices. In response, OCR established standard operating procedures for its investigators, published a request for information to seek public comments on implementation of security practices, and is conducting outreach to the health care sector. OCR expects to finalize the process no later than the summer of 2022.
OCR is charged with implementing and enforcing the HIPAA Privacy, Security and Breach Notification Rules, including the development and management of the breach reporting process. However, OCR does not have a method for covered entities to provide feedback on the breach reporting process, nor did the office indicate that it had plans to develop one. Without a clear mechanism to provide feedback to OCR, covered entities and business associates can face challenges during the breach reporting process. Further, soliciting feedback on the breach reporting process could help OCR improve aspects of the process."
Why GAO Did This Study: "The use of IT allows health care providers and others to share health care information electronically, which enhances care delivery, public health and research; and empowers providers to make informed decisions regarding patient health.
HHS sets and enforces standards for protecting electronic health information. To implement the provisions of HIPAA, HHS issued regulations that govern PHI transmitted or maintained by covered entities, such as health plans and health care providers, and their business associates.
GAO was asked to review covered entities' required reporting to HHS on data breaches. This report examines (1) the number of breaches and affected individuals reported to HHS since 2015; (2) the extent to which HHS established a review process to assess whether covered entities had implemented recognized security practices; and (3) the extent to which improvements can be made related to HHS's breach reporting requirements.
To do so, GAO reviewed privacy and information security laws; analyzed HHS documentation, policies, and procedures; and interviewed cognizant OCR officials. GAO also surveyed HIPAA covered entities and business associates."
What GAO Recommends: "GAO is making one recommendation to HHS to establish a feedback mechanism to improve the effectiveness of its breach reporting process. HHS concurred with GAO's recommendation and described actions it would take to address it."
The report was sent to Sen. Ron Wyden, D-Oregon, chairman, Sen. Mike Crapo, R-Idaho, ranking member of the Senate Finance Committee, Sen. Patty Murray, D-Washington, chairman, and Sen. Richard Burr, R-North Carolina, ranking member of the Senate Health, Education, Labor, and Pensions Committee, on June 27, 2022.
* * *
May 27, 2022
To: The Honorable Ron Wyden, Chairman, The Honorable Mike Crapo, Ranking Member, Committee on Finance, United States Senate
The Honorable Patty Murray, Chair, The Honorable Richard Burr, Ranking Member, Committee on Health, Education, Labor, and Pensions, United States Senate
The health care sector uses a vast array of information systems and technologies across multiple settings, such as physician offices and hospitals. The use of IT, including electronic health records (EHR) systems, has allowed health care providers and others to share health care information electronically. Specifically, interoperable health IT systems enable multiple health IT systems to access, exchange, and use all electronically accessible health information./1 This interoperable exchange allows health care providers and patients to securely find and use vital health information. This, in turn, enhances care delivery, public health, and research; and empowers providers to make informed decisions regarding patient health.
While EHR and interoperable health IT offer many benefits, they are also susceptible to breaches./2 We previously reported on the trends in these breaches from 2009 to 2015, which found that there were over 113 million records that were breached in 2015./3 According to the 2021 Mandiant M Trends Report, the health care industry remains one of the three most targeted industries by cyberattacks since 2016./4 The recent trends of breaches in the health care sector have highlighted the importance of ensuring the security and privacy of electronic health information, including such information maintained in EHRs. Two laws, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH Act), provide for the creation, enforcement, and monitoring of information security and privacy standards for electronic health data./5 Under these two laws, the Department of Health and Human Services (HHS) has primary responsibility for setting and enforcing standards governing protected health information (PHI), including electronic PHI./6 HHS has delegated this HIPAA enforcement function to the Office for Civil Rights (OCR). HHS has issued regulations to implement HIPAA, which among other things, requires covered entities and their business associates to notify HHS of breaches of unsecured PHI./7
You asked us to conduct a study on breaches reported by covered entities to HHS. Accordingly, this report examines:
1. the number of breaches and affected individuals covered entities have reported to HHS since 2015;
2. the extent to which HHS established a review process to assess whether covered entities had implemented recognized security practices; and
3. the extent to which improvements can be made related to HHS's breach reporting requirements.
To address the first objective, we analyzed prior GAO reports that identified security, as well as, privacy threats to electronic heath data and information systems./8 Further, we analyzed information provided by HHS on the number of breaches affecting 500 or more individuals and interviewed cognizant HHS officials about the data./9 We assessed the reliability of the breach data by assessing the sufficiency and appropriateness of the computer-processed data. Specifically, we reviewed written responses to our data reliability questions from knowledgeable HHS officials to clarify any issues. In addition, to verify that the data did not include obvious errors such as missing data fields or unexplained outliers, our analysis was confirmed by a second, independent analyst on the engagement team in consultation with the team's methodologist. Through these steps, we determined that the data were sufficiently reliable for our purposes.
To address the second objective, we reviewed relevant information security and privacy laws, including HIPAA and HITECH Act, as amended, and the implementing regulations./10 We identified requirements in the law governing HHS's responsibilities to consider whether covered entities or business associates implemented recognized security practices. We also interviewed knowledgeable OCR officials to identify any existing processes that relate to considering recognized security practices during an investigation.
To address the third objective, we compared OCR's breach reporting and investigation process against leading practices to determine the extent to which OCR's processes aligned. We also interviewed HHS officials to gain a better understanding of their processes and any relevant efforts under way that could address identified flaws. Lastly, we developed a non-generalizable survey to gather the opinions of covered entities and business associates on OCR's breach reporting requirements and breach investigations. The Health Information Sharing and Analysis Center, Healthcare and Public Health Sector Coordinating Council, and the American Hospital Association distributed the survey questions to over 48,000 of their members./11 While the results of the survey cannot be generalized, they allowed us to learn, in detail, about the actual experiences of many different types of covered entities and business associates. See Appendix I for a more detailed discussion of our objectives, scope, and methodology.
We conducted this performance audit from September 2021 to May 2022 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.
See footnotes here: https://www.gao.gov/assets/gao-22-105425.pdf
* * *
Conclusions
While the increasing use of health IT systems have the potential to improve health care quality, they can be vulnerable to the loss or unauthorized disclosure of PII and PHI. Breaches experienced by covered entities and their business associates have resulted in hundreds of millions of individuals having sensitive information compromised.
OCR is taking steps to finalize its process to considering whether covered entities and business associates have implemented recognized security practices. These efforts, if implemented within the expected timeframes, may help improve the consistency of the breach investigations process and better prepare covered entities and business associates for investigations.
OCR has not provided a formal method for covered entities and business associates to provide feedback to about the breach reporting and investigations processes. Addressing this shortcoming will be an important step toward improving or simplifying aspects of the breach and investigations process and preventing long lapses of communication during ongoing breach reporting investigations.
* * *
Recommendations for Executive Action
The Secretary of HHS should ensure that OCR establishes a mechanism for covered entities and business associates to provide feedback on OCR's breach reporting process. (Recommendation 1)
* * *
Agency Comments
We provided a draft of this report to HHS for review and comment. In its response reproduced in appendix II, HHS generally concurred with our recommendation and stated that it would take actions to implement it. Specifically, HHS officials stated that OCR will solicit feedback related to the breach reporting process when covered entities and business associates submit a breach notification.
In its response, HHS noted that OCR will establish a mechanism for regulated entities to provide feedback on the breach reporting and investigative process. Specifically, OCR plans to add language and contact information to the confirmation email that regulated entities receive when they submit breach reports through the HHS Breach Portal to invite feedback and questions about the breach reporting process. The agency also plans to implement procedures for OCR's regional offices to regularly review and address emails received about the breach reporting process through their respective mailboxes. We will continue to follow-up with HHS to validate its implementation of this recommendation.
HHS also provided technical comments, which we have incorporated in the report, as appropriate.
* * *
The text of the GAO report is available at https://www.gao.gov/p