Screenshot from one of the reports from Maximus, the company the state hired to provide quality-control assessments of Cover Oregon.
As the state launches a new independent investigation into the failure of the Cover Oregon website, keep one thing in mind.
It’s been done before.
Exhaustively.
KATU’s Investigators spent weeks digging through thousands of pages of audits conducted by Maximus, the company the state hired to provide quality-control assessments of the project beginning in its early days.
The company’s analysts interviewed dozens of staff members, attended regular meetings and analyzed data and events in real time.
What it found is enough to provide an exhaustively detailed roadmap of the problems that plagued Cover Oregon, both at its inception and throughout the process.
From its very first report, Maximus foretold nearly all of the major problems that would eventually doom Cover Oregon’s website to a catastrophic launch – one to which there’s still no end in sight.
On Friday, however, the state released the details of its contract with First Data, a company it will pay $228,000 to determine when Cover Oregon went off the rails, who knew about it, and how to parcel out blame among various state agencies and Oracle, the contractor brought in to provide technical support and much of the website’s software.
The report will be delivered to Gov. John Kitzhaber, who on Thursday said he wasn’t aware the project was in jeopardy until late October – nearly two years after the first state-funded report from Maximus described a project that was already in serious jeopardy.
Kitzhaber has not said how much, if any, of the Maximus reports he and his staff reviewed. His interview with KATU on Thursday was cut short before the question could be posed.
While Maximus officials will be involved to some degree in the new investigation, the state did not explain why the costly new investigation is necessary.
Here’s a partial accounting of information that’s publicly available – information that was sent directly to state officials, including current Cover Oregon director Bruce Goldberg – both from Cover Oregon’s own accounting and Maximus’ reports, which end in October.
Date headings showing month and year are links to Maximus reports. — Eds.
With just under two years to go, there are already red flags about the scope of the project – namely Oracle’s future support for the aging software the state has decided on; the overall budget; and the questionable decision to reorganize and move away from a “Systems Integrator” structure that would have given one person oversight over the complex project.
Worse, the deadline had already been pegged as functionally impossible.
“The delivery date is being driven by a need to meet a deadline unrelated to technical estimates,” reads Maximus audit.
The project is more than $3 million over budget (based on earlier projections), despite having not hired many key staff members. All 13 people interviewed for the report believe the project’s scope is ill-defined and classify it as a major risk.
Four of the six tasks that are audited are estimated to be at least 15 percent behind schedule.
Also problematic – 75 percent of the staff have yet to be hired.
Things are up and running, albeit very slowly.
The budget – at least what’s been made available – is incomplete. The problem this time is under-spending – a likely sign the project is behind schedule.
The staff is short-handed. There is no detailed schedule, and there’s less than a year until the deadline to begin testing.
Maximus analyzes 23 categories and finds eight are high risk and 13 more are medium risk.
The project is still dangerously understaffed and under-budget.
Maximus notes that staff members are quitting faster than they can be hired, and they’re left with a shortage of upper and mid-level management. That lack of continuity is exacerbating the hiring problem – if there are no managers, there is nobody around to hire lower-level workers – which is keeping it from the job of nailing down the project’s scope and schedule.
To that end, Maximus recommends looking for ways to circumvent the state hiring process – a suggestion what will be batted around for months.
Despite the fact only $6,825,342 has been spent – that’s barely half the projected budget – the audit points to problems with cost controls.
In particular, it flags a lack of standards for contractor Oracle’s invoicing.
Maximus also issues an oblique call for CIO Carolyn Lawson to get her hands dirty, and soon: “Given the criticality of Governance in supporting success of the project, changes in regard to the Executive Steering Committee need to be implemented ASAP.”
Maximus pivots from pointing out that the project is doing a poor job of getting organized to pointing out that it’s putting out a poor product.
The IT team has gone through multiple iterations of the software, and there are serious worries about security.
“Commingling of individual and business accounts is highly unusual, especially in the health insurance field,” the report reads. “While it seems like a convenience, it may not be desirable from a user, technical, or security perspective.”
Attempts to organize the schedule and scope seem to be complicating matters when they should be simplifying them.
In part, this is because managers of different teams are using different project roadmaps without properly consulting each other. This is leading to both redundant efforts on the one hand and neglected tasks on the other.
“Without a professional and collegiate working relationship between agencies at the highest executive level, conflicts and communication issues will continue and likely worsen,” the audit reads.
Though some progress has finally been made on putting together a project schedule, things are still running poorly.
“There was broad consensus by the individuals interviewed that this is a high risk initiative, operating in an uncertain and fluid environment, under a very aggressive timeline,” the audit reads.
To follow Cover Oregon is to follow a confounding mess of acronyms and terminology.
At this point, it’s worth pointing out that there were two major arms of what still, at this point, was called the Oregon Health Exchange.
There’s ORHIX, which is the arm dealing with insurance logistics. It will later be known as Cover Oregon.
Then there’s the Oregon Health Authority (OHA), which is charged with putting together the technical aspects of the website itself.
Got it?
As the summer ends, Maximus finds that ORHIX is more or less ready to move forward, but is waiting for OHA to catch up.
The IT team is quickly shedding personnel, and, with just over a year to go, there’s still neither schedule nor scope in place. Oracle is beginning to send in some of its own people to mitigate the staffing problems.
Just over a year away from the date this enormous project is supposed to go live, there is still much hand-wringing over things like “roadmaps.”
With just over a year to go, Maximus portrays a project that’s dangerously close to out of control.
It suggests that Cover Oregon narrow the scope of what it’s trying to achieve, and begin working on contingency plans in case things fall apart as the deadline nears.
The problems it finds are almost too numerous to count. Try to keep track of all the things found to be out of whack in this sentence alone:
“This overall business transformational effort that is being undertaken is also not currently being tracked like a formal project,” the audit reads. “Typically a project of this size would have specific governance reporting, charter, scope, tasks, milestones, deliverables, and deadlines for the interagency work that is to be accomplished both operationally and technically.”
There’s also been a decision to change the software that will be used – a decision that comes at a very late date, and that brings in software the state has no experience with.
Oh, one more thing – as the website is rapidly progressing through complicated new iterations, they’re being signed off on without any formal review.
First the good news: The state has officially decided to change the name from ORHIX to Cover Oregon.
The bad news, of course, is plentiful.
Through only four of 16 categories are rated “high-risk,” two of those are huge: Schedule and inter-organizational cooperation. Contingency plans are actively being drawn up.
With less than a year to go until the deadline, the progress that’s been made is insignificant in comparison with what’s left to be done.
Time for another lesson on Cover Oregon terminology.
Before the project began, the Powers That Be decided Oregon would try something that had never been attempted.
That something was called “No Wrong Door,” and there was a reason it had never been attempted.
No Wrong Door means a citizen can go to a website, plug in their information, and find out all the government stuff they’re eligible for – not just health care, but things like food stamps and WIC benefits.
This means that instead of undergoing one impossibly massive project – you’ve seen the struggles other states have had implementing just a new health-care website, right? – Oregon was simultaneously undergoing several, all of which were highly interdependent.
In theory, this was supposed to make things less redundant – saving the taxpayers money.
But Maximus now points out an enormous problem – nobody ever ran a cost-benefit analysis to make sure money would, indeed, be saved. The state, in other words, undertook its most ambitious project in recent memory without making sure the project was working undertaking.
Maximus’ estimate, in fact, is that there was only about a 10 percent overlap between the agencies’ programs – hardly enough to justify endangering a project of Cover Oregon’s importance.
And just to keep us grounded here: “Final deadline of 10/1/2013 continues to be of high concern,” Cover Oregon writes in its own monthly report.
Cover Oregon administrators brief a legislative oversight committee about their progress.
After an “open and frank discussion,” there’s an agreement to refine and simplify the website’s architecture. A committee is formed to keep track of the project’s scope.
So far, staff members have categorized a whopping 108 risks to the project. (The very first risk identified – back in May 2012, it was labeled R-0001 – was the “aggressive timeline” that would ultimately leave the project where it is now.)
Maximus identifies a problem with the state’s contract with Oracle – Oracle is being billed by the hour, rather than on the basis of finished projects. Maximus points out there’s not much incentive, given that structure, for Oracle to work as quickly as possible.
On the plus side, Oregon becomes one of the first six states to receive conditional approval to operate a state-based health-insurance exchange.
The year starts with a huge budgetary victory – Cover Oregon has secured $226 million in “Level 2” funding, $90 million of which is earmarked for IT.
A decision on the project’s final scope, which still has yet to be locked down, is pushed from February to March.
Cover Oregon leaders have begun talking to other states in an effort to work out some problems with Medicaid enrollee modeling.
Meanwhile, the organization is growing quickly, leaving leaders to scramble to integrate and train new staff members.
Security issues are getting worse, and Maximus recommends that a national firm be hired to deal with them.
Cover Oregon takes that advice – eight months later.
There’s a marked change in relations between Cover Oregon and Maximus, and a new focus from both on Oracle.
Maximus attaches a long addendum to its monthly report hammering hard on Cover Oregon for a number of new issues. Notably, it points out that project has slipped so far behind it will be difficult to market and explain the new exchange, because perceptions are going to grow more negative over time, reducing the effect of potential advertising.
Cover Oregon begins to change its message, suggesting the task was impossible to begin with.
“CO is confused by any mention of “ample slack” in the schedule since the 10/1/2013 date has been seen as overly aggressive and unreasonable for an extended period,” Cover Oregon wrote in the comments section of Maximus’ report. “The highly aggressive schedule has been recognized by the LFO and reported by the LFO to the Legislature as unreasonable.”
Maximus for the first time says it thinks No Wrong Door might fail due to a lack of coordination between organizations with respect to Medicaid processing.
Pay attention, because this is where things really start to spin out of control.
There’s been a misallocation of $16 million – a big deal in itself, of course. But it creates massive organizational problems for the project.
You’ll remember that the IT portion was being handled by OHA, and that the insurance side was being handled by something called ORHIX, and that ORHIX is now what is known as Cover Oregon.
So we’ve got this high-tech website on the one hand, and then all insurance stuff on the other. They were supposed to merge in June, with the technical stuff mostly ready to go.
Well, that missing $16 million means the handoff date has been moved up by a full two months – on a project where things are already running way, way behind. And Cover Oregon is now on the hook for the remainder of the costs.
Emotions run high. Fingers are pointed.
Lawson – you’ll remember, she’s the head of the technical side – runs tests before the handoff.
They’re disastrous.
“All of the connecting pieces in between were not working … and our team could not get all the way through,” Lawson told The Associated Press. “That was the first ‘really?’ It was not the outcome we expected.”
Cover Oregon head Rocky King said he was taken by surprise.
“To say that I’m spitting mad would be an understatement,” King wrote to the governor’s two health advisers.
Oddly, in the middle of this mess, Cover Oregon decides “case closed” on one of the risks it’s identified over the course of the project: Risk R-0029, which refers to the high-stress environment the short timeline is creating.
In an early draft of the project, June is when systems testing was supposed to be fully operational. Instead, Cover Oregon seems to be resigning itself to the fact that things aren’t going to wrap up neatly in time for Oct. 1 launch.
The question isn’t if it will happen. The questions are how bad will it be? And what can be done to mitigate the mess.? (Or, in a wonderful bit of government-ese: “Scope deferral.”)
King begins to point to the job’s size.
“We have contingency plans if things go wrong,” he tells the Portland Business Journal. “Whenever you try to do four to five years of work in less than two years, the time for testing and repairing every bug is compressed.”
More development staff members are added in a rush to squeeze in as many features and as much function as possible by the Oct. 1 deadline.
You might remember July as the month when those “Long Live Oregonians” ads began running.
Maximus’ July audit – which was released in September – says this is also when the decision was made to initially launch the website only to agents and community partners at the initial Oct. 1 deadline.
Maximus lists a number of issues yet to be resolved. The timelines range from “compressed” to “extremely compressed.”
The scope is further whittled down, even as CO adds additional developmental staff to incorporate as much as possible. Maximus says “scope identified for the first release is still considered large for the amount of time left until launch.”
Maximus also begins to worry that by trying to fit too much into the Oct. 1 deadline, later deadlines for a more fully-functional website are in jeopardy.
The project is narrowed considerably, even as new staff members are brought onboard to help manage the project.
Cover Oregon announces that, on Oct. 1, people will be able to browse plans, but won’t be able to buy them.
The decision is made to defer Medicaid interfaces to OHA’s Medicaid Management Information systems.
That national security firm Maximus recommended at the beginning of the year is brought in to help.
Decisions are being made on the fly – executives decide to wait until September to decide which will be included in the launch.
Serious plans get underway to implement paper processing for applicants. Maximus is already beginning to worry about plans for the December upgrade.
Oh, by the way: Gov. Kitzhaber is named the second-most influential figure in American health care by Modern Healthcare magazine on Aug. 27.
With two weeks to go, Rocky King delivers a PowerPoint presentation that contains eight astounding words: “Bottom Line: We Are On Track to Launch.”
Not likely.
Internally, Oracle is coming under the microscope from everyone involved.
“Oracle’s ability to release system environments is problematic,” Maximus reports. “Oracle’s ability to properly estimate the work for any release is significantly lacking.
“Oracle continues to underperform. It is recommended that CO withhold payment of any invoices until a thorough review the contract is conducted by (the Department of Justice) for lack of performance.”
A new contractor, Deloitte, is brought in to help with the site – it will end up in charge of the part of the site the public sees. This doesn’t do much to help the budget.
The strain is, of course, affecting everybody working on the project.
“Contractors and other consultants will also be under tremendous stress, some working 16 hour days for weeks on end,” Maximus reports.
There are supposed to be 780 software tests run over the course of one week in September.
Instead, there are 74.
“We are in serious trouble – this whole IT side has gotten away from us and I need to figure out how to best fix,” Rocky King writes in an email that KATU recently uncovered.
“We look like fools on the validation front with the carriers.”
The deadline has come and gone. Remarkably, Cover Oregon says that Oracle promised the deadline would be met right up until the preceding weekend. The website receives 330,000 unique visitors, 244,000 of whom browsed through plans. About 7,300 paper applications are accepted.
Let the finger-pointing begin – much of it at Oracle, which also misses promised deadlines of Oct. 15 and Oct. 31.
Under the “project management” section of Maximus’ report, there is a blistering section discussing Oracle.
“MAXIMUS has reviewed the processes and have found the processes do not meet industry standards,” it reads. “Impact analysis, code review, coding standards and proper parallel development techniques are ad hoc and inconsistently applied or understood.”
Maximus meanwhile is supposed to be reviewing Oracle, but says it’s running into resistance.
“I wanted to express my deep concern about Oracle’s performance,” consultant John Cvetko writes in an email to King. “CO is in a position whereby they have spent a large sum of money with Oracle and their delivery and performance is, at best, unacceptable. I have tried numerous times to penetrate their organization with your support, to get information on fundamental engineering practices only to be ignored.”
In another email, Cvetko writes that “Oracle has a big ass and it will take many highly skilled boots to consistently kick it.”
For the first time, there’s a record of Gov. Kitzhaber saying he’s willing to join the fight.
Kitzhaber’s health policy, Mike Bonetto, writes to Cover Oregon administrators:
“One thing I forgot to ask…Governor is still very interested in helping in any way he can with Oracle and more than willing to make a phone call if necessary,” Bonetto writes. “My sense is that may be off the table for now until early next week?? Anyway…just let me know if/when you would like him to connect with Oracle and the key talking points you would want him to hit.”