Editor’s note: This commentary is by Randy Brock, a principal at Rockledge Risk Advisors LLC. He is a former Republican candidate for governor, Vermont state auditor and state senator. He is also a certified fraud examiner.
In that timeless classic, “The Wizard of Oz,” hapless young Dorothy from Kansas is swept away in a tornado, lands in the mythical kingdom of Oz, and seeks help from its all-powerful and all-knowing ruler, the Wizard. But once she finds the Wizard, she finds that despite all the smoke and mirrors, behind the curtain he is just a little old con artist, who has no magical powers at all.
That parable also describes what’s happening to modern day Dorothy. But she is from Vermont, not Kansas, and the Wizard‘s conjuring behind the curtain has produced a magical health care exchange, called Vermont Health Connect. It will be the only option that individuals and small business can use to buy health insurance in Vermont, and it’s supposed to go live on Oct. 1.
But despite the multimillion dollar advertising campaign, despite the governor’s promise that everything is working fine and the system is on target, nothing could be further from the truth.
The fact of the matter is this: The system doesn’t work.
It can’t reliably communicate error-free with the federal data hub. It can’t talk to Vermont’s only three insurers, Blue Cross, MVP and Northeast Delta Dental. It can’t talk to the Benaissance system that is supposed to send Vermonters the bills for the insurance products sold on the exchange. On the eve of the day when it is supposed to be on line, it cannot even be tested in real life because key software code has yet to be finalized. Like the Wizard, it is smoke and mirrors, and behind the curtain there is no Wizard – there is only Peter Shumlin.
And in classic Shumlin-speak, despite knowing that the system will not perform as required, the failures are described as being no big deal.
The core of the system is being built by CGI Systems and Technologies of Fairfax, Va., a subsidiary of giant Montreal-based CGI Systems. CGI’s Vermont contract now totals $83.9 million, covering the development effort and subsequent year follow-up and maintenance. CGI has billed Vermont more than $16 million so far this year. Amendments have already added some $41.5 million to the original contract, effectively doubling it.
CGI was not selected as the result of a truly competitive bid process. The original contractor chosen by the state did not work out. Pressed for time to select a replacement, the administration, encouraged by the federal government, settled on picking an experienced vendor that other states had vetted. Thus, Vermont relied on Hawaii’s and Colorado’s selection decisions to guide Vermont’s.
Overall, the Vermont Health Services Enterprise Budget, of which the exchange software development is only a part, will cost tiny Vermont more than $374 million.
To put that number in perspective, that amounts to $1,456 for every household in Vermont. It’s enough money to pay the tuition of 6,800 Vermont students for four years at UVM. It’s enough money to pay all the expenses of the Vermont State Police for five and a half years. And despite the fact that this expenditure will not pay a dime toward any Vermonter’s heath care premiums, Vermont’s health care exchange will be the third most costly in the country.
CGI is interesting in itself. In 2004 it acquired the non-defense government software development business of American Management Systems (AMS), a Fairfax, Va., company. Today, CGI Technologies and Systems, the CGI subsidiary contracted to build Vermont’s health care exchange, is headquartered at the same address where AMS was housed. AMS had a long and checkered history of taking on government contracts and then allegedly failing to deliver on time or on budget. Some of its projects resulted in huge cost overruns. Interestingly, Vermont was one of them, when the company was contracted to build a tax department software system for the state in 1995. By the time the project was completed, more than six years had passed and what started with a budget of $418,500, with the addition of four sole-source contracts, had grown to cost Vermont more than $9.2 million in the end.
Then-State Auditor Elizabeth Ready said about the project in a 2000 report:
The Department of Taxes adaptation of American Management Systems’ (AMS) tax accounting package … for use in Vermont was initially expected to be relatively straightforward and rapid. Tax law changes and development problems complicated the project, and it is still not completed six years after the first contract. To date, it has cost approximately twice the original estimate.
AMS was the subject of litigation in several jurisdictions, ending with a whopping $474.5 million dollar judgment against the firm for botching a Mississippi government contract. It was also the subject of a suit by the Federal Thrift Investment Board and a subsequent U.S. Senate inquiry into four years of delays and cost overruns. That suit was settled for $5 million.
CGI, itself, has not been free from controversy. A damning 2010 report from the Hawaii state auditor condemned the state’s project management for a CGI-developed tax system in which state employees eased project deliverable requirements and removed the state’s ability to hold the vendor accountable for defects and system integration problems. In 2011, a former employee filed a whistleblower suit under the Sarbanes-Oxley Act accusing CGI Federal, a subsidiary of CGI Technologies and Solutions, for $1.4 million in federal court in New York, alleging he was fired because he spoke out against a proposed CGI contracting scheme to defraud the U.S. Department of Housing and Urban Development. CGI denies the allegation and the suit is still pending.
Thus far, the Vermont health care exchange curtain has been closed, and Vermonters have not been able to see how badly things are going. On July 26, CGI held a demonstration at the Department of Vermont Health Access (DVHA) headquarters in Winooski for upwards of a hundred DVHA employees. Reportedly they showed on a projection screen what the system would look like and how it was working. But was the demonstration misleading? It certainly begs the question: How could they have done a July demonstration purporting to show connectivity when they now report that connectivity does not work?
In a second demonstration held on Aug. 29, no attempt was made to demonstrate an actual connection, and the excuse provided delivered one of the best examples of double-talk heard in years:
“As many of you know we have experienced over the last couple of weeks defects in our environment and the environment we are using today is not optimal because we are continuing development in the environment that is optimal. That is my non-technical interpretation of what’s happening. So you will not see everything that has been built for Iteration 2 because some of it is not able to be accessed in this environment. So there are some Vermont customizations, but not all. That doesn’t mean they do not exist. But it’s hard for us to believe they exist if we don’t see them….”
That was what Deputy DVHA Commissioner Lindsay Tucker said, supported by a CGI official in the background. The real reason, of course, is much simpler: Most of the connections did not work, they never had worked, and with some code not even written, they could not possibly have worked.
In the first week of September, CGI briefed state officials that the Oct. 1 go-live date for connecting with the insurers and the payment processor would not be met. But rather than quickly informing the public of that fact, the administration continued telling us that everything was on schedule. Later in the month, the message was spun to indicate that there were a few glitches, additional testing was prudent, but that the project was continuing to go well. Some close to the project recognize that not only will the system not be fully operational on Oct. 1, but there is a real question if the remaining work can even be completed by Nov. 1. The jury is still out on whether the architecture and software products chosen can ever be made to work as intended.
There have been many warnings. Vermont insurers have expressed their growing concerns. For example, in a Sept. 18 letter to DVHA Commissioner Mark Larson, Vermont Blue Cross President Don George said that inadequate time has been allowed for system testing before the now-revised Nov. 1 go-live date. He warned that this may “cause Vermonters to experience enrollment delays, coverage gaps, obstacles to care and create disruptions in the delivery and payment of health care services” required by Jan. 1.
A Sept. 12 Operational Readiness Review, performed by Gartner Inc., a third-party contractor on behalf of the federal Centers for Medicare and Medicaid Services, highlighted the things that remain undone. The review concluded that the project “should be considered in RED status due to significant risks to meeting the October 1st deadline for Go-Live.”
What is likely on Oct. 1 is that Vermont will have a pretty website. It will show insurance plan pricing and it will collect applicant information. But only a limited amount of data will be checked electronically for validity, and the information collected will not be passed on to the insurance companies. It will be like filling out a paper application and having someone place the unread application in a filing cabinet. In short, it is form without substance.
None of this should be a surprise. Vermont has a long and unfortunate history of failed software development projects. There was the CGI- predecessor’s Tax Department System, there was the unsuccessful five-year $18 million Motor Vehicle Department system, there was the abandoned Vermont Judiciary system, and these are only some of Vermont’s best-known system development debacles. The state has shown conclusively that managing major information technology projects is not a core competency of Vermont state government.
In 2010, the Douglas administration and the General Assembly worked hard to establish better ways to contract, including the concept of contracting for results. That means being clear on the results that taxpayers should expect from a contract, and then holding contractors accountable for delivering what they promise on time and on budget. The CGI contract acknowledges that failure to meet milestone due dates will be harmful and will cost the state money. For example, if the system cannot truly process insurance applications on Oct. 1, there will be additional costs incurred for collecting, storing, validating and subsequently processing the stored information.
To compensate for these costs, the state and the contractor have agreed upon a formula that automatically calculates the amounts, called “liquidated damages,” the contractor must pay to the state for every day beyond which a milestone is missed. For example, for missing a high priority milestone, CGI would be required to pay the state amounts ranging from $18,750 for every date late from one to three days late, up to $125,000 for every day beyond 14 days late for that milestone.
There are 21 critical milestones, and it appears that only four had been clearly met by mid-August and possibly fewer than half of them by late September. It is likely that the state is due as much as $5.1 million in liquidated damages, the maximum amount which can be collected. Liquidated damage liability is capped at $5.1 million, 10 percent of the $51,024,929 base year contract for development and hosting. Hundreds of thousands in damages should have been accruing every day since at least June, when it was clear that things were going wrong.
But on Aug. 12, the state signed an amended agreement which increased the number of milestones from 19 to 21, but retroactively made many of the milestones less precise and more difficult to measure. For example, one earlier milestone required clearly that end-to-end testing be completed by Sept. 1, 2013. But typical of the revised milestones, one simply required that Iteration 2 testing be complete by Sept. 5, but defined completion to mean that “45% of October 1 scripts pass with fewer than 20 severity 1 defects,” an imprecise definition that would allow a contractor to determine which scripts to count. The revision provided no assurance of what was really important: that the end-to-end testing was complete and that the system in fact worked.
There is also a contract provision that allows the state to go beyond the liquidated damages formula and to seek open-ended damages for failure to meet the Oct. 1 go-live date. That’s not exactly a “nothing-burger,” Gov. Shumlin’s dismissive description of CGI contract delays.
The contract clearly states that CGI will pay the state liquidated damages within 30 days of missing a critical milestone due date. But, curiously, the Shumlin administration seems to have taken no steps to collect the millions of dollars that taxpayers are due. Some might suggest that the Shumlin administration is suffering from a localized version of the Stockholm syndrome, a psychological phenomenon in which hostages express empathy and have sympathetic feelings toward their captors, sometimes to the point of defending them. That seems to happen in government information technology projects when a vendor’s failure to deliver on time and on budget as promised is excused by those officials providing oversight, because “we’re all in this together.” Vermont’s embarrassing cascade of troubled systems development projects has also led many to expect that, despite vendors’ promises, systems always will be late and buggy. When officials are heavily invested in demonstrating that their grand projections have been unfailingly correct, these same officials often are extremely reluctant to concede embarrassing failures to the public.
What is clear is that the way Vermont contracts for and oversees major information technology projects is badly broken. A strong, independent and empowered chief information officer, improved depth of project management expertise, more reliance on proven off-the-shelf solutions, more intensive contractor vetting and an insistence that contractors meet their obligations are desperately needed.
It is interesting that CGI, through CGI Federal, is also the contractor for the Federally Facilitated Health Benefit Exchange, and CGI subsidiaries are involved in various roles for at least five other state exchanges. Unlike Vermont, 34 states have chosen to have the federal government provide the exchange at its expense, rather than spending millions of dollars developing their own. CGI’s contract for the Federally Facilitated Exchange amounted to $87.9 million, according to a June report from the U.S. Government Accountability Office (GAO). That the federal government’s giant health care exchange, covering the majority of states, had a cost estimate almost on par with today’s $83.9 million bill for the miniscule Vermont exchange is a source of continuing wonder.
Just five days before the Oct. 1 start date, according to the Washington Post, the Obama administration announced that online small business enrollment in the federal exchanges also will be delayed. Since now 34 other states will be joining Vermont in missing part of the Oct. 1 deadline, someone will probably need a bigger filing cabinet for all those unread paper applications. How well the rest of the federal project is going will become clearer as it is rolled out. But if the Vermont experience is any guide, there will likely be some really big potholes on the interstate portion of the Yellow Brick Road.