Report of the Vermont State Auditor
Douglas R. Hoffer Vermont State Auditor Rpt. No. 15-03
April 14, 2015
VERMONT HEALTH CONNECT
Future Improvement Contingent on Successful System Development Project
Mission Statement
The mission of the Auditor’s Office is to hold state government accountable.
This means ensuring that taxpayer funds are used effectively and efficiently, and that we foster the prevention of waste, fraud, and abuse. This report is a work of the Office of the State Auditor, State of Vermont, and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from the State of Vermont or the Office of the State Auditor. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Please contact the Office of the State Auditor if you have questions about reproducing this report.
Douglas R. Hoffer STATE AUDITOR
STATE OF VERMONT OFFICE OF THE STATE AUDITOR
132 State Street • Montpel
ier, Vermont 05633-5101 Auditor: (802) 828-
2281 • Toll
-Free (in VT only): 1-877-290-
1400 • Fax: (802) 828
-2198
email: auditor@state.vt.us • website: www.
auditor.vermont.gov
April 14, 2015 Addressees (see page 3 of letter) Dear Colleagues, Since the State launched Vermont Health Connect (VHC) on October 1, 2013, it has struggled to run
the new health insurance exchange. While the State has taken steps to correct problems, gaps in VHC’s
functionality have been patched by manual and time-consuming processes that have caused hardship for Vermonters. While the State has thrown substantial personnel and financial resources at the
problems facing VHC, the ultimate effectiveness of those actions won’t be realized unless new
versions of the exchange are successfully released in May and the fall of this year. The State conducted and contracted for internal and external analyses of VHC that were aimed at pinpointing and troubleshooting problems. Rather than reinvent the wheel, my office drew from this extensive body of analysis. We decided to focus this audit of VHC on assessing the status of the
State’s corrective actions to resolve the identified shortcomings of this state
-run marketplace. The attached report is the product of that performance audit. The audit report is organized into two main sections
–
information technology (IT) and operational areas. The IT section of the report focuses on IT system development, governance and project management, and security. The operational part focuses on enrollment, change of circumstances, renewals, and premium payment processing. Although the State has developed a high-level plan to correct IT shortcomings in 2015, significant obstacles and challenges remain to the successful implementation of the plan. The schedule for the first release is aggressive and the State does not yet have a defined scope of work or a contract with Optum, its current vendor, for a second major release in the fall. The State has improved its project management processes. However, Optum has not produced
documentation deliverables in a timely fashion, and the State’s contract does not include provisions to
measure vendor performance.
In the fall of 2014, the State reported that it had corrected VHC’s highest priority security weaknesses.
Despite this progress, 70 moderate risk weaknesses remained as of January 31, 2015, and the State has known about 91 percent of those weaknesses for at least 13 months. Moderate risk is defined as a threat that could have a serious adverse effect on organizational operations, organizational assets, individuals, other organizations, or the nation.