Senator Thomas McLain Middleton April 3, 2014 Delegate Peter A. Hammen 2 2)
Procurement documents. These documents consisted of various MHBE-issued Request for Proposals (RFP), proposals received from interested vendors, proposal evaluation documents prepared by MHBE and certain contracts. 3)
Emails. There was an assortment of emails to and from a variety of individuals. Many of the documents we received (26 percent) contained redactions, with the procurement documents being heavily redacted. The scope of the review was guided by the Joint Oversight Committee’s request. Generally, the primary areas included in the review were: procurement and contracting; project planning and management; HIX system design; resource management; HIX system testing and contingency planning; and training of consumer assistance groups. Our review was limited to examining the documents received from MHBE. We did not perform tests, interview relevant parties and stakeholders, or attempt to substantiate or refute the accuracy of the information in the documents or determine their completeness. We also do not know whether we received all documents that MHBE made available to the public. We did submit a few questions to BerryDunn to obtain clarification on specific matters concerning the IV&V reports. Our review was not conducted in accordance with generally accepted government auditing standards. Our observations are based on our understanding and interpretation of the information in the documents reviewed. Because of the limitations of this review, we do not believe our observations provide a complete understanding of the processes employed and decisions made by MHBE. We believe the most informative documents made available to us were the IV&V reports issued by BerryDunn from January 2013 through September 2013. Generally, these reports addressed all areas included in this review and were the primary source of our observations, with the exception of contract procurements.
Summary Observations
The documents we reviewed indicate that the HIX development process faced many challenges. The early IV&V reports identified several critical project planning and management processes and protocols that had not been established even though the contract to develop HIX was awarded ten months prior to the issuance of the first IV&V report. For example, IV&V reports with January and February 2013 dates identified the lack of an overall project plan, insufficient staffing by MHBE and the vendors, and the lack of a State program director to manage project development efforts. At the end of February, only seven months remained before the October 1, 2013 go-live date for the Maryland Health Connection. With each IV&V report, the consultant identified new risks and issues, including recommendations to mitigate those risks and resolve the issues. In the IV&V reports issued through September 30, 2013, the consultant identified 46 risks and 48 issues
4
, of which 9 risks and 28 issues were outstanding as of September 30, 2013. (See Exhibit C for a listing of all risks and issues.) Many were designated as high-impact risks and issues, covering many aspects of the HIX system development process, including project management, software development, and system testing and security.
4
Per BerryDunn’s IV&V reports, “A project risk is something that has not yet happened that could adversely impact project schedule, scope or cost. A project issue is something that is already happening and that adversely impacts project schedule and cost.” Over time, a risk can be resolved, accepted with no action, replaced by another risk or developed into an issue. For example, 18 of the 46 risks were either elevated to an issue or replaced by another risk.