Background TRICARE T-2017 Contracts and Transition Process Under T-2017, DHA reduced the number of TRICARE regions by merging the North and South regions to form the East region, which has approximately 6 million beneficiaries, while the West region remained the same with approximately 3.4 million beneficiaries (see figure 1). In July 2016, DHA awarded the East region contract to Humana Government Business, the incumbent South region contractor, and the West region contract to Health Net Federal Services, the incumbent North region contractor. The T-2017 contracts include five 1-year performance periods and are scheduled to expire on December 31, 2022. As a result of the changes in regional structure, the T-2017 contract transition included a transition from Health Net Federal Services (North region) and Humana Government Business (South region) to Humana Government Business in the East region as well as a transition from UnitedHealth Military & Veterans to Health Net Federal Services in the West Region. The start of the T-2017 transition was initially planned for August 2016, with a health care delivery start date of August 2017. However, due to bid protests filed against each contract, the transition start date was pushed out to January 1, 2017 with a health care delivery start date of October 1, 2017. To manage the T-2017 transition, DHA assigned individuals to lead the transition in each region, who were responsible for coordinating all major transition activities. The transition leads were supported by other staff, including contracting officers, contracting officer representatives, and subject matter experts. In addition, DHA established an organizational structure comprised of several groups to oversee the T-2017 transition from day-to-day oversight to leadership updates. The TRICARE Operations Manual, which is part of the managed care support contract, establishes transition guidance that includes requirements for both the incoming and outgoing contractors. The T- 2017 transition guidance focused on the incoming contractors’ readiness to perform in seven critical areas: (1) provider network, (2) referral management, (3) enrollment, (4) medical management, (5) claims processing, (6) customer service, and (7) management. For the T-2017 transition, DHA introduced two new oversight methods to ensure contractors’ readiness in the seven critical areas prior to the start of health care delivery. These methods and other guidance are outlined in the TRICARE Operations Manual and T-2017 contracts. The performance readiness validation (PRV) and performance readiness assessment and verification (PRAV)—referred to as PRV/PRAV—tested contractors’ functionality in the seven critical areas outlined in the TRICARE Operations Manual. For the PRV, contractors validated their own readiness for specific requirements within each area. For example, the contractor had to validate that it had a complete provider directory online and operational 60 days prior to the start of health care delivery at a 95 percent accuracy rate. The number of requirements varied by critical area. For the PRAV, DHA subsequently assessed and verified contractors’ validation prior to the start of health care delivery. DHA also established financial penalties—referred to as transition performance guarantees—for five of the seven critical areas. The T- 2017 contracts specify that if a contractor does not meet a transition- in requirement in any one of these five areas, DHA will assess a financial penalty (see table 1). In December 2016—prior to the start of the transition—DHA held transition specification meetings with the incoming and outgoing contractors to begin planning critical T-2017 transition activities. The incoming contractors were also required to provide DHA with an integrated master plan and an integrated master schedule outlining processes and specific steps for the transition as well as a risk management plan that identified risks to the successful execution of the contractor’s schedule. Contractors were required to provide weekly updates to DHA on the status of their transition schedule progress. In April 2018—several months after the transition had ended—DHA produced an “after action” report to identify best practices, lessons learned, and recommendations to improve future TRICARE contract transitions. DHA is currently in the process of developing its fifth generation of contracts, referred to as the T-5 contracts. TRICARE Select As required by the NDAA 2017, DHA established a new preferred provider benefit option called TRICARE Select and terminated the TRICARE Standard and Extra benefit options by January 1, 2018. Prior to 2018, beneficiaries primarily had a choice between three basic options— TRICARE Prime (a managed care option), TRICARE Standard (a fee-for- service option), or TRICARE Extra (a preferred provider organization option). The TRICARE Standard and Extra options did not require beneficiaries to enroll. However, beneficiaries who choose the TRICARE Select option must enroll during an annual open enrollment period or within 90 days of experiencing a qualifying life event. Beneficiary cost sharing responsibilities were also modified for the new benefit option. DHA Delayed Time Frames for Key Transition Activities to Implement TRICARE Select The implementation of TRICARE Select delayed timeframes for the T- 2017 transition and was the primary challenge of the T-2017 transition, according to DHA and contractor officials. Because the T-2017 contracts were awarded prior to the enactment of the NDAA 2017, DHA had to incorporate TRICARE Select requirements into the ongoing T-2017 transition process, including developing updated guidance for contractors. As a result of the time needed to plan for and implement a new benefit, DHA delayed timeframes for the following key transition activities. DHA postponed the start of health care delivery by 3 months. DHA moved the start of health care delivery from October 1, 2017 to January 1, 2018 (see fig. 2). According to DHA officials, DHA made this change to align the start of health care delivery with the implementation of TRICARE Select to minimize the impact that two, successive changes could have had on the continuity of care for beneficiaries. On March 30, 2017—three months into the transition— DHA sent a letter to the contractors informing them of this decision. DHA also directed its incoming contractors to submit modified transition schedules and risk management plans. DHA had to delay the start of a planned enrollment freeze and lengthen its duration. According to DHA officials, in a typical transition, DMDC requires 3 to 4 days to make adjustments to beneficiaries’ records in the Defense Enrollment Eligibility Reporting System, including assigning beneficiaries to incoming contractors and regions for the T-2017 contracts. During this time, which is referred to as an enrollment freeze, contractors cannot access this system to process any enrollments. For the T-2017 transition, DHA and DMDC officials stated that, given the termination of two benefit options and the new enrollment requirements for TRICARE Select, DMDC needed additional time to adjust every beneficiary enrollment record (over 9 million). Therefore, DHA delayed the start of the T-2017 enrollment freeze from August to December 2017 and increased its duration from 3 to 4 days to 19 days—December 1-19, 2017 (see fig. 2). Contractors had less time to process enrollments and make other system changes. Once an enrollment freeze has ended, incoming and outgoing contractors have a designated period of time, referred to as a dual operations period, to process beneficiaries’ enrollments and make other systems changes, such as assigning Prime beneficiaries to a primary care manager (PCM). Due to the extended enrollment freeze, contractors had a shorter dual operations period—less than 2 weeks in December 2017 rather than 6 to 8 weeks beginning in August 2017 (see fig. 2). According to contractors, the shorter dual operations period for T-2017 transition contributed to a backlog of enrollment requests and PCM assignments that they were unable to process prior to the start of health care delivery. To mitigate the financial effect on beneficiaries, DHA issued point of service waivers and waived referral requirements for TRICARE Prime enrollees for both regions and provided an enrollment grace period for beneficiaries so they did not have to pay higher copayments for receiving care from non-network providers or care that was not referred by a PCM. DHA’s communications to TRICARE beneficiaries were delayed. TRICARE Select complicated and delayed DHA’s communications to beneficiaries about TRICARE program changes, which led to customer service problems after the start of health care delivery. DHA engaged in various efforts to inform beneficiaries of the new changes, such as through website updates, blog posts, and direct mailings. However, DHA’s “after action” report acknowledged that on multiple occasions its communication division posted incorrect information on its website because of changing policy language. In addition, DHA planned to send a direct mailing to beneficiaries to inform them of TRICARE program changes in October 2017. However, DHA and DMDC officials told us that this date was delayed due to the additional time needed to prepare for TRICARE Select. As a result, DHA mailed information to beneficiaries starting in December 2017, and some beneficiaries did not receive this mailing until after the start of health care delivery, according to DHA. An organization representing TRICARE beneficiaries told us that some beneficiaries were unaware of the various benefit changes that went into effect on January 1, 2018 because of inadequate communication from DHA. Contractors also told us that the delayed communication to beneficiaries contributed to the high volume of customer service calls they received after the start of health care delivery. DHA officials told us that they took several steps to minimize the risks these delays and the implementation of TRICARE Select created, including the use of various transition oversight meetings to discuss and track related challenges. For example, the regional transition management staff participated in a monthly Risk Review Board meeting to discuss concerns related to the schedule of transition activities, such as the impact of TRICARE Select on the time needed for performance testing in critical areas. DHA also discussed transition risks related to TRICARE Select during weekly meetings with contractors throughout the transition. Furthermore, in August 2017, DHA hosted an Enrollment Summit for all stakeholders involved with the transition and implementation of TRICARE Select, where they discussed the schedule of transition steps and the coordination needed to implement the interrelated T-2017 and NDAA 2017 requirements. In addition, DHA kept contractors informed about TRICARE Select as they developed the related policies. Beginning in June 2017, DHA provided contractors with draft guidance on the new benefit to keep them informed of potential changes and obtain their feedback. According to DHA, this also allowed contractors to plan for and begin implementing the program changes they would be required to make once the policies were finalized. DHA issued the final TRICARE Select policies to its contractors in late October 2017, which left contractors with less than 3 months to implement the finalized changes prior to the start of health care delivery on January 1, 2018. According to DHA officials and contractors, contractors ideally would have had the final TRICARE policies at the start of the 9-to-12 month transition period. Challenges Experienced during the T-2017 Transition Process Reflect Weaknesses in DHA’s Guidance and Oversight Lack of Specificity and Accuracy in DHA’s Guidance Contributed to Disagreements between Contractors, Which DHA Failed to Resolve in a Timely Manner During the T-2017 transition, outgoing and incoming contractors had disagreements over data transfers. According to DHA officials and contractors, DHA’s transition guidance to contractors was not always specific or accurate regarding the amount and type of data to be shared, as well as how these data should be transferred. Furthermore, according to contractors, DHA did not always resolve contractors’ guidance-related disagreements in a timely manner. Contractors said this contributed to delays in implementing some transition steps and problems after the start of health care delivery. DHA faced challenges related to the following data transfer issues: Referral and authorization data. The contractors in the West region disagreed on how many years of historical referral and authorization data the outgoing contractor would provide the incoming contractor because this was not specified in the guidance, according to the contractors and DHA’s contracting officers. While the contractors in the East region mutually agreed on the years of data to transfer, the West region contractors did not. As a result, the incoming West region contractor reached out to DHA for resolution on August 2, 2017 by letter, and continued to discuss it with DHA officials during weekly meetings, as documented in meeting minutes we reviewed. However, DHA did not address the issue until December 12, 2017, at which point DHA rejected the incoming contractor’s request for additional historical data because the outgoing contractor would not have enough time to provide it by the start of health care delivery on January 1, 2018. The incoming contractor reported that not receiving the anticipated historical referral information contributed to several problems related to referrals after the start of health care delivery. First, it contributed to delays in processing referrals within timeliness standards. Second, the lack of data made it difficult for contractors to help MTFs address customer referral inquiries, which negatively affected the contractor’s relationship with MTFs. Finally, the contractor had limited ability to resolve beneficiaries’ customer service questions related to referrals and had to reissue authorizations for some referrals. Claims data. The incoming and outgoing West region contractors also disagreed on which elements of claims data needed to be transferred. For example, the incoming contractor requested information from the claims notes section, which the outgoing contractor stated contained some proprietary information. According to the incoming contractor, this section typically contains information important for claims processing, such as medical necessity reviews— medical record reviews to determine that health care services are appropriate for payment. When the outgoing contractor refused to provide the claims notes, the incoming contractor raised the issue several times to DHA during weekly meetings and through letters, as documented in meeting minutes and correspondence we reviewed. However, DHA determined that the outgoing contractor did not need to provide the information requested, as the non-proprietary information was available in other claims data sections. According to the incoming contractor, without access to more detailed historical information from the claims notes, there were instances in which they were unable to adjust payment determinations for certain claims paid prior to transition, which resulted in provider and beneficiary dissatisfaction. Beneficiary payment information. The incoming contractors faced challenges obtaining payment information for TRICARE beneficiaries who paid their health insurance premiums using credit cards or electronic funds transfers. According to a contracting officer, DHA initially directed the outgoing contractor to transfer beneficiary payment data to the incoming contractor. However, the outgoing contractors told us that they were unable to transfer this data due to banking laws and proprietary information security standards. DHA agreed that the outgoing contractors could not legally transfer this information and resolved the problem by requiring incoming contractors to reach out directly to beneficiaries to obtain the payment information. According to incoming contractor officials, this created additional, unanticipated effort, since they had to contact beneficiaries for this information directly, which diverted transition resources, such as enrollment staff, away from ongoing transition activities. In addition, contractors reported that this put certain TRICARE plan beneficiaries at risk since those who did not resubmit their payment information risked disenrollment and gaps in health care coverage. The contractors and DHA made attempts to notify affected beneficiaries that they needed to contact the contractor to reestablish their automated premium payments. However, approximately 224,000 beneficiaries’ credit card or electronic funds transfer enrollments for premium payments did not continue after January 1, 2018. To give beneficiaries more time to provide this information, DHA provided a 150-day grace period for premium payments. Still, certain beneficiaries were disenrolled from TRICARE plans for failure to establish a recurring form of payment. For example, more than 15,000 beneficiaries were disenrolled in the East region. In its “after action” report, DHA acknowledged that it did not always provide specific and accurate requirements for data transfers in its transition guidance and that this should be addressed for the next transition. However, the report did not address the difficulties related to resolving contractors’ questions and disagreements on these issues. For example, DHA officials told us that they followed an informal process for tracking and handling issues raised by contractors during the transition, which was explained in the initial transition specifications meeting in December 2016. However, the outgoing and incoming contractors in the West region expressed concerns about this process, explaining that it was difficult to resolve issues, particularly with the amount of time it took for DHA to provide a response, such as with the referral and authorization disagreement. Federal standards for internal control note that an agency should implement control activities through policies, such as by providing guidance with greater specificity for data transfers. These standards also indicate that agencies should remediate deficiencies in a timely manner, such as the prompt resolution of contractors’ guidance-related disputes so as to not disrupt the transition schedule. Without more specific guidance and a process that ensures timely dispute resolution, DHA risks disagreements and delays for future contract transitions, which could hinder health care delivery. Some of DHA’s Requirements for Determining Contractors’ Readiness for Health Care Delivery Were Not Feasible or Effective DHA experienced challenges executing its new T-2017 transition oversight methods—PRV/PRAV and performance guarantees—as planned because of fundamental problems with how some requirements were written and the implementation of TRICARE Select. As a result, some of the requirements were not feasible or effective in assessing contractors’ readiness for health care delivery. 1. Certain PRV/PRAV requirements were not feasible as originally written or were not aligned with the corresponding performance guarantee, according to DHA officials. For example, one of the PRV requirements in the critical area of medical management focused on testing the contractors’ web-based systems for exchanging information electronically with the government and providers, but this was not always possible as some information continues to be transferred in hard copy, such as by fax. In addition, the performance guarantee related to provider network development did not align with the corresponding PRV/PRAV requirements. A DHA official told us that aligning the performance guarantee and PRV/PRAV requirements would have resulted in a higher financial penalty for one of the contractors. 2. Contractors noted that some PRV/PRAV requirements were not complete or effective measures of readiness. For example, contractors told us that requirements for claims and referrals did not effectively test the actual volume of administrative tasks that they would have to process after the start of health care delivery. According to the West region contractor, one of the referral PRAV tests required contractors to demonstrate that they could process 300 referrals during DHA’s onsite review, whereas they typically need to process 9,000 referrals a day after the start of health care delivery. 3. The original PRV/PRAV requirements did not account for TRICARE Select, since the contracts were awarded prior to the enactment of the NDAA 2017. Furthermore, due to the delayed and extended enrollment freeze that ended on December 19, 2017, DHA determined that contractors could not demonstrate a fully operational enrollment system sixty days prior to the start of health care delivery as originally required. Additionally, the contractors had limited access to DHA’s information technology systems for testing scenarios that included TRICARE Select. As a result, contractors had to test the majority of the critical areas (claims, enrollment, customer service, and referral management) with information technology systems that did not include TRICARE Select, which was not a true test of their readiness. To address issues with feasibility and TRICARE Select, DHA modified the PRV requirements for four of the seven critical areas during transition. Specifically, DHA modified all of the PRV requirements for enrollment, referral management, and claims processing as well as one PRV requirement for medical management. DHA also waived the corresponding performance guarantees for the three of these critical areas that had such guarantees (enrollment, referral management, and claims processing). As a result, the contractors were not subjected to financial penalties for not meeting the requirements for these critical areas. According to DHA officials, the problems with the PRV/PRAV requirements experienced during the T-2017 transition occurred in part because DHA subject matter experts did not review the requirements prior to the release of the final request for proposal. As a result, officials said that it was not until after the contracts were awarded that subject matter experts determined that some of the requirements could not be performed as written. Nonetheless, DHA officials and contractors agreed that the PRV/PRAV processes are good conceptual measures, and should continue to be used for the next transition with improvements to their feasibility and effectiveness. Having subject matter experts review contractors’ readiness requirements for feasibility and contract alignment could help ensure that these requirements are appropriate measures of contractor readiness. In addition, DHA’s “after action” report included feedback and lessons learned from officials and contractors on the PRV/PRAV requirements, which DHA could incorporate for future transitions. Federal standards for internal control state that an agency should internally communicate quality information to enable personnel to perform key roles in achieving objectives. By considering lessons learned from this transition and having subject matter experts review the requirements, DHA would be able to better ensure their metrics are appropriate to prepare contractors for health care delivery. DHA Required Contractors to Develop Corrective Action Plans to Address Problems after the Start of Health Care Delivery DHA reported that the T-2017 contractors had overall better performance meeting contract requirements after the start of health care delivery than the two previous generations of TRICARE contracts. Nonetheless, DHA has acknowledged that both T-2017 contractors did experience some problems meeting certain contract requirements. DHA addressed most of these problems through the issuance of corrective action requests, which require the contractors to submit and implement a corrective action plan (see table 2). One exception where DHA did not issue formal corrective action requests was for problems both contractors experienced with processing enrollment backlogs after the start of health care delivery due to the extended TRICARE Select enrollment freeze during transition. Although most of the problems have been resolved, some problems have persisted into the second year of health care delivery, which DHA and contractors reported they are continuing to address. Provider directory accuracy. Both contractors have continued to fall short of the requirement for 95 percent accuracy of their online provider directories—problems they also experienced during the transition. As of June 2019, the West region contractor’s directory was 76 percent accurate and the East region’s was 64 percent accurate, according to DHA officials. Both contractors expressed concern about the methodology used to assess their performance against this requirement and stated that the 95 percent standard is too high. DHA officials acknowledged that the 95 percent standard is high and that the provider directory corrective action requests may remain open indefinitely because of the high standard, though they continue to monitor the corrective action requests. Claims processing timeliness and accuracy. The East region contractor has struggled to meet timeliness and accuracy standards for processing claims. The contract requires contractors to process 98 percent of claims within 30 calendar days of receipt and 100 percent of claims within 90 days with a 98 percent accuracy rate. As of June 2019, the contractor was meeting the 30 day timeliness requirement and was close to meeting the 90 day timeliness requirement (99.99 percent within 90 days). However, the contractor continued to miss the performance standard for claims processing accuracy, according to DHA officials. DHA officials told us that the department had completed multiple on-site reviews and continues to monitor this issue to ensure the contractor improves its ability to meet claims processing standards. Contractor officials acknowledged that they needed to improve their oversight of claims functions and improve training and job aids with their claims processing subcontractor, which was a new partner for their T-2017 contract. Conclusions A smooth transition of health care delivery between outgoing and incoming managed care support contractors helps ensure continuity of care for TRICARE beneficiaries. In the most recent transition, the need to concurrently implement a new benefit option—TRICARE Select— presented some unique challenges that delayed the transition timeline and limited DHA’s ability to ensure contractors’ readiness in certain areas. While the implementation of a new benefit option during the T-2017 contract transition was a one-time occurrence, our review highlighted weaknesses in DHA’s transition guidance and oversight that could pose challenges to future contract transitions. By improving the specificity of its transition guidance, revising its process for resolving contractors’ issues, and ensuring review of PRV/PRAV requirements for feasibility and effectiveness, DOD could mitigate these challenges and thus improve future transitions. Recommendations for Executive Action We are making the following three recommendations to DHA: The Director of DHA should define data sharing requirements with more specificity in its transition guidance for outgoing and incoming contractors, including the time period covered and the types of data that must be shared. (Recommendation 1) The Director of DHA should revise the process the agency has in place for resolving issues raised between contractors during transition to ensure such issues are resolved within time frames that will not adversely affect the transition schedule. (Recommendation 2) The Director of DHA should incorporate lessons learned from this transition and ensure that subject matter experts review PRV/PRAV requirements and performance guarantees prior to the issuance of the request for proposal for the next transition. These requirements should be reviewed to ensure their feasibility and effectiveness for assessing contractor readiness. (Recommendation 3) Agency Comments We provided a draft of this report to DOD for comment. In its written comments, reproduced in appendix I, DOD generally agreed with our findings and concurred with our recommendations. DOD outlined steps the department will take to improve the next TRICARE contract transition, including revising the TRICARE Operations Manual to better define data sharing requirements, developing a process to ensure that all contractor questions are answered appropriately and in a timely manner, and ensuring SMEs are involved in writing the PRV/PRAV requirements. DOD also provided technical comments, which we incorporated as appropriate We are sending copies of this report to the Secretary of Defense and appropriate congressional committees. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7114 or cosgrovej@gao.gov. Contact points for our Office of Congressional Relations and Office of Public Affairs can be found on the last page of this report. Other major contributors to this report are listed in appendix II. Appendix I: Comments from the Department of Defense Appendix II: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Bonnie Anderson, Assistant Director; Rebecca Abela, Analyst-in-Charge; Cathleen Hamann; Jacquelyn Hamilton; Rianna Jansen; and Vikki Porter made contributions to this report.


Background TRICARE’s Health Plan Options Prior to January 1, 2018, TRICARE provided benefits through three main plan options for its non-Medicare-eligible beneficiary population— TRICARE Prime, Standard, and Extra. These options varied by enrollment requirements, choices in civilian and military treatment facility providers, and the amount beneficiaries must contribute toward the cost of their care. (See table 1.) The NDAA for Fiscal Year 2017 terminated the TRICARE Standard and Extra plans beginning on January 1, 2018, and introduced TRICARE Select. Beneficiaries who had used the TRICARE Standard and Extra plans as of December 31, 2017 were automatically enrolled in TRICARE Select for the first year of the new plan, but as of January 1, 2019, beneficiaries were required to actively enroll in TRICARE Select. TRICARE’s Regional Structure and Contracts DOD uses two regional managed care support contractors to develop networks of civilian providers to serve all TRICARE beneficiaries. Within the regions, contractors are required to develop these networks of providers in areas called Prime Service Areas (PSA), which are geographic areas usually within an approximate 40-mile radius of a military inpatient treatment facility, as well as in areas outside of PSA locations, or non-PSAs. To develop the networks, the contractors enter into contracts with some providers—referred to as network providers—to treat TRICARE patients at an agreed upon reimbursement rate. Beneficiaries can also receive care from certified nonnetwork providers. However, beneficiaries visiting a nonnetwork provider may have to pay for the care at the time of the visit and later file a claim for reimbursement, whereas beneficiaries visiting a network provider are only responsible for paying a copayment or cost-sharing amount. The NDAA for Fiscal Year 2017 also mandated that DOD ensure at least 85 percent of the TRICARE Select beneficiary population be covered by the TRICARE network of providers by January 1, 2018, and that DOD determine access standards and ensure the program meets or exceeds access standards of “high-performing health care systems in the United States” for health care appointments. DOD has contracted both of these efforts to the two contractors. Surveys Indicate Beneficiary Ratings of TRICARE Were Generally Unchanged in the First Year of Select, but Ratings of Primary Care Providers Decreased Non-Prime beneficiaries’ ratings of TRICARE were generally unchanged during the first year following the transition from TRICARE Standard and Extra to TRICARE Select. Specifically, there was no statistically significant change from the 2017/2018 surveys to the 2019 survey in the percent of beneficiaries who positively rated their health care and their health plans—defined as giving responses of 8 or higher (out of 10) on each survey question. In the 2019 survey, 80 percent of beneficiaries rated their health care positively, and 67 percent rated the TRICARE health plan positively. (See fig. 1.) Non-Prime TRICARE beneficiaries also rated three different types of providers and of the three, ratings of primary care providers decreased from the 2017/2018 to 2019 surveys. The percent of beneficiaries who positively rated their primary care providers decreased from 85 to 80 percent in the 2019 survey. We found no statistically significant differences from the 2017/2018 surveys to the 2019 survey in beneficiaries’ positive ratings of specialty care and mental health care providers, with 83 and 73 percent of beneficiaries reporting positive ratings of their specialty care and mental health care providers, respectively in 2019. (See fig. 2.) Beneficiary Surveys Indicate More Problems Finding Providers in First Year of TRICARE Select, but No Change in Ability to Get Appointments Beneficiaries Were More Likely to Report Problems Finding Providers in the First Year of Select In the first year of TRICARE Select, a higher percentage of non-Prime beneficiaries reported experiencing problems finding civilian health care providers who accepted TRICARE than before the transition, particularly for specialty care. We found there was a statistically significant increase in the percentage of beneficiaries who reported problems finding a provider that would accept TRICARE from 27 to 32 percent from the 2017/2018 surveys to the 2019 survey. In particular, there was a statistically significant increase in the percentage of beneficiaries who reported problems finding a specialty care provider in the 2019 survey (24 percent) compared to the 2017/2018 surveys (18 percent). The percent of beneficiaries who reported problems accessing primary care or mental health care remained statistically unchanged with 26 and 31 percent reporting problems, respectively, in the 2019 survey. (See fig. 3.) We also found that a higher percentage of beneficiaries located in PSAs reported experiencing problems finding providers, whereas there was no change for beneficiaries located in non-PSA areas. Specifically, from the 2017/2018 surveys to the 2019 survey, there was a statistically significant increase in the percentage of beneficiaries located in PSAs who reported problems finding any type of civilian provider (27 to 34 percent), primary care providers (21 to 29 percent), and specialty care providers (18 to 25 percent). There was no statistically significant change among beneficiaries in PSAs reporting problems finding mental health care providers or among beneficiaries in non-PSAs for any provider types. (See fig. 4.) To help beneficiaries find providers that accept TRICARE patients, managed care support contractors develop networks of providers in PSAs and some non-PSA locations. Each month, these contractors report to DOD the percent of Select beneficiaries who were covered by the TRICARE network of providers, according to contractor-developed measures of adequate access to care. Although nearly one-third of beneficiaries reported experiencing problems finding a civilian provider, DOD officials told us that nearly 100 percent of beneficiaries in the East have had adequate access to a network provider since January 1, 2018, exceeding the 85 percent requirement. For the West, DOD officials said the contractor reported that more than 85 percent of beneficiaries had adequate access to a network provider as of August 2018. According to DOD officials, the two contractors used different methods to ensure adequate access to a network provider: In the East region, the contractor decided to develop networks of civilian providers in the entire region. In the West region, the spread-out geography of the region made it difficult to develop networks of civilian providers throughout the entire region. Therefore, the contractor used mapping software to determine areas within non-PSAs which had large populations of TRICARE Select beneficiaries. As a result, the contractor identified 12 areas in the West region—which it called Select Areas—to develop additional networks of civilian providers in order to meet the requirement. Contractors also provide resources to beneficiaries to help them identify providers that accept TRICARE patients. Contractors maintain lists of network and other TRICARE-certified providers that accept TRICARE patients, and monitor and report on the accuracy of these lists to DOD monthly. However, contractor representatives noted that providers can decide to accept or not accept TRICARE patients at any time, and these changes are not always reflected in the lists. Contractor representatives explained that if a beneficiary cannot find a provider to accept TRICARE for needed care, the beneficiary can submit a complaint to the contractor. Contractor representatives said that they can address beneficiary complaints by attempting to identify and certify new providers, but noted that some subspecialty providers are not available in all areas. Representatives from one contractor told us that they have identified alternative sources of care when providers are not available. For example, when no civilian psychiatrists were accepting new patients in a remote area, the contractor offered beneficiaries telehealth services from a military treatment facility. Beneficiaries’ Reported Ability to Obtain an Appointment When Needed Was Unchanged in First Year of TRICARE Select There was no statistically significant change after the transition to TRICARE Select in the percent of non-Prime beneficiaries who reported being able to get an appointment as soon as they needed. In the 2019 survey, 88 percent of beneficiaries reported that they could usually or always obtain an appointment for primary care as soon as they needed and 86 percent reported being able to do so for specialty care. (See fig. 5.) Similarly, about 65 percent of beneficiaries reported waiting a week or less between scheduling an appointment for non-urgent care and meeting with their doctor in the 2019 survey, and 83 percent of beneficiaries reported waiting 2 weeks or less. Surveys Indicate Few Changes in Civilian Providers’ Acceptance of TRICARE Patients in First Year of Select There was no change in the percent of civilian providers nationwide who reported accepting new TRICARE patients if they were also accepting other new patients after the transition to TRICARE Select. Across all provider types, 67 percent of providers in the 2019 survey reported accepting new TRICARE patients if they were also accepting other new patients; this percentage was not statistically significantly different from the 2017/2018 surveys. There was also no statistically significant change among specific provider types—in the 2019 survey, 47 percent of mental health care providers and about 90 percent of primary care and specialty care providers reported accepting new TRICARE patients if they were accepting any new patients. When we analyzed provider responses by network status and specialty, the surveys indicated a decrease in the percentage of network mental health providers who were accepting new TRICARE patients if they were also accepting other new patients. The percent of these network mental health providers decreased a statistically significant amount from 91 percent in the 2017/2018 surveys to 84 percent in the 2019 survey. (See fig. 6.) However, there was no change in the overall percentage of all network or all nonnetwork providers that were accepting new TRICARE patients if they were also accepting any new patients—93 percent of network and 58 percent of nonnetwork providers in the 2019 survey. When we analyzed provider responses by location, we found that provider acceptance of new TRICARE patients decreased by a statistically significant amount in non-PSAs. Specifically, a lower percentage of providers located in non-PSAs reported accepting new TRICARE patients if they were accepting other new patients, decreasing from 72 percent in the 2017/2018 surveys to 68 percent in the 2019 survey. This percentage did not significantly change for providers in PSAs. (See fig. 7.) There were few changes in the reasons providers gave for not accepting TRICARE patients in the first year of TRICARE Select. (See Table 2 for a list of reasons providers offered in the 2019 survey.) Of 14 categories of reasons that providers gave, there was a statistically significant change in two categories between the 2017/2018 surveys to the 2019 survey. Specifically, the percentage of providers who listed reimbursement as a reason for not accepting new TRICARE patients declined from 11 percent to 8 percent, and the percentage of providers who listed that the doctor was not available or too busy increased from 4 percent to 8 percent. Agency Comments and Our Evaluation DOD provided technical comments on a draft of this report, which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees, the Secretary of Defense, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-7114 or cosgrovej@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Appendix I: GAO Contact and Staff Acknowledgments GAO Contact James Cosgrove, (202) 512-7114 or cosgrovej@gao.gov. Staff Acknowledgments In addition to the contact named above, individuals making key contributions to this report include Tom Conahan (Assistant Director), A. Elizabeth Dobrenz and Jeffrey Mayhew (Analysts-in-Charge), Jennie Apter, Alexander Cattran, Jacquelyn Hamilton, Vikki Porter, and Jeffrey Tamburello. Related GAO Products Defense Health Care: TRICARE Surveys Indicate Nonenrolled Beneficiaries’ Access to Care Has Generally Improved, GAO-18-361 (Washington, D.C.: Mar. 29, 2018). Defense Health Care: More-Specific Guidance Needed for Assessing Nonenrolled TRICARE Beneficiaries’ Access to Care, GAO-14-384 (Washington, D.C.: Apr. 28, 2014). Defense Health Care: TRICARE Multiyear Surveys Indicate Problems with Access to Care for Nonenrolled Beneficiaries, GAO-13-364 (Washington, D.C.: Apr. 2, 2013). Defense Health Care: DOD Lacks Assurance That Selected Reserve Members Are Informed About TRICARE Reserve Select, GAO-11-551 (Washington, D.C.: June 3, 2011). Defense Health Care: Access to Civilian Providers under TRICARE Standard and Extra, GAO-11-500 (Washington, D.C.: June 2, 2011). Defense Health Care: 2008 Access to Care Surveys Indicate Some Problems, but Beneficiary Satisfaction Is Similar to Other Health Plans, GAO-10-402 (Washington, D.C.: Mar. 31, 2010).


Background TSA and Industry Roles in Securing Passenger Rail The Aviation and Transportation Security Act designated TSA as the primary federal agency responsible for security in all modes of transportation, which includes physical security and cybersecurity. Passenger rail operators, however, have the day to day responsibility for carrying out safety and security measures for their systems. Unlike the aviation environment, where TSA has operational responsibility for screening passengers and baggage for prohibited items prior to boarding a commercial aircraft, the agency has a limited operational role for securing mass transit (including rail). To secure passenger rail, TSA primarily partners with public and private transportation operators to address their security needs by conducting vulnerability assessments and sharing intelligence information and key practices, among other measures. The agency also engages with the passenger rail industry through associations, such as APTA and Association of American Railroads. Additionally, TSA is responsible for assessing the risk from terrorism and cyber threats to passenger rail, as well as other transportation modes. In addition to engaging with domestic passenger rail stakeholders, TSA’s Office of Policy, Plans, and Engagement is responsible for coordinating domestic and international multimodal transportation security polices, programs, directives, strategies, and initiatives, including conducting outreach to foreign stakeholders. TSA also engages with foreign stakeholders through TSARs. TSARs are primarily located in posts overseas and communicate with foreign government officials to address transportation security matters involving all modes of transportation, including aviation, rail, mass transit, highways, and pipelines. The TSAR role was originally created in response to the 1988 bombing of Pan Am Flight 103 over Lockerbie, Scotland, when the Aviation Security Improvement Act of 1990 was enacted, which provided that foreign security liaison officers were to serve as liaisons to foreign governments in carrying out U.S. government security requirements at specific airports. TSARs are responsible for ensuring the implementation of TSA’s requirements primarily as they relate to passenger and cargo air transportation departing the specific country en route to the United States. The primary focus of the role remains on aviation; however it has evolved over time to include maritime and land transportation. Physical and Cybersecurity Threats to Passenger Rail According to TSA, recent attacks overseas and online terrorist messaging point to public transportation systems, which include passenger rail systems, as continued high-value targets for terrorists. In general, passenger rail systems are open and designed to expedite the free flowing movement of large numbers of passengers through multiple stations. As such, these systems are inherently vulnerable to physical attacks (such as improvised explosive devices, active shooters, and chemical or biological attacks) due in part to factors such as high ridership, open access points, limited exit lanes, and fixed, publically available schedules. In addition, TSA has reported that risks increase in urban areas where multiple transportation systems and high volumes of travelers merge at intermodal stations. Transportation systems, including passenger rail systems, rely on technology and internet-connected devices to manage and secure certain business/enterprise functions, such as the operation’s website, communications, and reservations and ticketing mechanisms. They also increasingly rely on computer-networked systems for tracking, signals, and operational controls of transportation equipment and services. As dependence on these systems increases, so does risk to the system. Cyberattacks have the potential to significantly affect both business/enterprise systems and operational control systems. Business/Enterprise systems. Cybersecurity threats include ransomware, malware, phishing, and website attacks that may compromise sensitive information and affect an operator’s ability to communicate with passengers or engage in day-to-day business functions. Operational control systems. Cybersecurity threats, which may include malware or physical manipulation of a system, such as jamming signals or damaging equipment, include threats to the systems that control signaling and train speed. For example, attackers could attempt to access positive train control systems, a computer-based system designed to automatically slow or stop a train that is not being operated safely, to disrupt services. Unintentional cybersecurity threat sources may include failures in equipment or software due to aging or user errors, such as unintentionally inserting a flash drive infected with malware or clicking on a phishing email. Intentional cybersecurity threats may include corrupt employees, criminal groups, terrorists, and nations and may be used, for example, to achieve monetary gain, or for political or military purposes. Figure 1 shows examples of the types of physical and cyber threats passenger rail systems face. DHS Risk Management Framework The NIPP outlines a risk management framework for critical infrastructure protection. In accordance with the Homeland Security Act of 2002, as amended, DHS created the NIPP in 2006 to guide the national effort to manage security risk to the nation’s critical infrastructure, including through coordination of agencies and 16 various critical infrastructure sectors, including transportation systems. Most recently updated in 2013, the NIPP uses a risk management framework as a planning methodology intended to inform how decision makers take actions to manage risk. The framework calls for public and private partners to conduct risk assessments. The NIPP defines risk as a function of three elements: threat, vulnerability, and consequence, as shown in Figure 2. Threat is an indication of the likelihood that a specific type of attack will be initiated against a specific target or class of targets. Vulnerability is the probability that a particular attempted attack will succeed against a particular target or class of targets. Consequence is the effect of a successful attack. In 2010, DHS, through TSA and the U.S. Coast Guard, developed the Transportation Systems Sector-Specific Plan to conform to requirements in the NIPP. Most recently updated in 2015, this plan describes shared goals, priorities, and activities to mitigate critical infrastructure risks, and acknowledges the increasing dependence of transportation companies on cyber systems for business, security, and operational functions. Regarding cybersecurity risks, DHS produced the Cybersecurity Strategy in 2018 to help execute its cybersecurity responsibilities during the next 5 years. In order to meet one of its objectives, DHS is to encourage the adoption of applicable cybersecurity best practices, including the NIST Framework for Improving Critical Infrastructure Cybersecurity (referred to as the NIST Cybersecurity Framework). The framework is a set of voluntary industry standards and best practices to help organizations manage security risks specific to cybersecurity. The framework consists of five functions: Identify, Protect, Detect, Respond, and Recover. When considered together, these functions provide a high-level view of an organization’s management of cybersecurity risk. NIST issued the framework in 2014 and updated it in April 2018. CISA, formerly DHS’s National Protection and Programs Directorate, manages the national effort to secure and protect against critical infrastructure risks, including cybersecurity risk, for all 16 critical infrastructure sectors, including transportation. CISA’s responsibilities include coordinating with sector-specific agencies to carry out its cybersecurity and critical infrastructure activities. TSA Conducts Passenger Rail Risk Assessments and Coordinates with CISA on Cybersecurity Risk TSA Uses Three Mechanisms to Assess Passenger Rail Risk According to TSA officials, TSA uses the TSSRA, the BASE, and threat assessments to assess risk elements for physical and cyber security in passenger rail. Such assessments may address different elements of risk—threat, vulnerability, or consequence—or the total risk for specific assets, such as airport perimeters and pipeline critical facilities. Table 1 below shows the type of risk element each assessment addresses, and whether the assessment addresses risks to intermodal stations or cybersecurity risk. TSSRA. TSA uses the TSSRA, a periodic risk assessment, to assess threat, vulnerability, and consequence for various attack scenarios across the five transportation modes for which TSA is responsible. The scenarios define a type of threat actor—including homegrown violent extremists and transnational extremists, such as Al Qaeda and its affiliates—a target, and an attack mode. For example, a scenario might assess the risk of attacks using varying types of weapons on passenger rail system assets. As part of the assessment process, TSA engages with subject matter experts from TSA and industry stakeholder representatives to compile vulnerabilities for each mode, and TSA analyzes both direct and indirect consequences of the various attack scenarios. According to TSA, the agency uses the TSSRA to provide strategic insights to inform the administration’s risk mitigation strategies, policy considerations, security countermeasures and programs, and resource allocation decisions. Our analysis of the TSSRAs issued during calendar years 2015 through 2017 indicates that TSA included intermodal station attack scenarios, but did not include cybersecurity scenarios. Specifically, the assessments featured various scenarios that targeted intermodal stations, which could include rail systems. For example, a scenario might describe attacks using various numbers of improvised explosive devices on an intermodal station. TSA did not include cybersecurity attack scenarios in the calendar year 2015, 2016, or 2017 assessments. According to the 2016 assessment and TSA officials we interviewed, threat experts have indicated that cyber threats, due to their unique nature and other factors, do not lend themselves to traditional TSSRA attack scenarios. However, as discussed below, the agency does conduct cyber threat assessments. Further, TSA’s Cybersecurity Roadmap 2018, states that, as one objective, the agency will include cybersecurity in its risk assessments for all modes. According to TSA officials, the implementation plan for the Roadmap, which was approved in September 2019, provides guidance and direction for meeting this objective. TSA officials confirmed that they plan to include basic cybersecurity scenarios for all modes in the 2020 TSSRA, and that they plan to engage with TSA mass transit experts and consult with industry experts as needed to inform future cyberattack scenarios. BASE. The BASE is a voluntary security assessment of national mass transit, passenger rail, and highway systems conducted by TSA surface transportation inspectors that addresses potential vulnerabilities, among other things. It consists of an assessment template with 17 security action items developed by TSA and the Federal Transit Administration that address, among other best practices, security training programs, risk information sharing, and cybersecurity. TSA developed this assessment in 2006 to increase domain awareness, enhance prevention and protection capabilities, and further response preparedness of passenger transit systems nationwide. The agency uses the BASE assessments to track progress in implementing specific security measures over time, offer technical assistance and share best practices to help improve the overall security posture of agencies, and inform transportation security grant funding by, among other things, identifying actions agencies have taken to reduce vulnerability. TSA officials stated that the most recent formal update to the assessment template began in 2014 and was fully implemented in 2015. The update included, among other changes, revised guidance for TSA surface inspectors and the addition of questions concerning active shooter events. In fiscal year 2016, the agency also developed a more targeted BASE assessment that focuses the assessment on an entity’s areas of concern as identified by surface inspectors in a previous BASE review of that operator. As of 2017, TSA had completed initial and follow-up assessments for the top 100 mass transit agencies in the country, which comprise approximately 80 percent of the ridership in the United States. TSA officials told us that their goal is to conduct follow-up assessments every one to three years. As previously shown in table 1, our analysis of the BASE template for mass transit and passenger rail indicates that it includes questions that address selected rail agency concerns about intermodal station security, and questions related to cybersecurity issues. Specifically, we found that while the template does not contain security action items or questions that directly refer to intermodal stations, questions in the template do correspond to topics that domestic rail agencies we interviewed identified as significant to intermodal station security, such as coordination among security forces, visible security measures, and establishing roles and responsibilities. For example, one BASE question asks if the agency’s system security plan has procedures or protocols for responding to security events with external agencies such as law enforcement or fire departments. This question corresponds to the challenge of coordination among security forces in intermodal stations identified by six of the seven agencies we interviewed. Cybersecurity is the focus of one of the security action items, which includes a series of general questions related to whether the transit agency has developed a comprehensive cybersecurity strategy. According to TSA officials, the agency added cybersecurity questions to the BASE in 2013 and the questions are intended to be a high level review. For example, the BASE addresses whether the transit agency has conducted a cybersecurity risk assessment, ensured employee training covers cybersecurity roles and threats, and established a protocol for reporting cyber incidents. It also provides a list of available cybersecurity resources for agencies to consult. Threat Assessments. TSA’s Intelligence and Analysis Office identifies security threats to mass transit and passenger rail systems through various threat assessments, including annual and semiannual Mass Transit and Passenger Rail Terrorism Threat Assessments and annual Cyber Modal Threat Assessments. TSA’s Mass Transit and Passenger Rail Terrorism Threat Assessment is produced annually and establishes the current mass transit passenger rail threat level and reviews terrorist threats against mass transit passenger rail for the past year. Threat information includes terrorist attacks on passenger rail trains, train tracks, buses, bus stops, and various stations. Additionally, the threat assessment analyzes intelligence gaps for the mass transit mode. TSA supplements the annual assessment with a semiannual threat assessment that reviews terrorist threats against mass transit and passenger rail for a 6-month period. Our analysis of threat assessments TSA issued for calendar years 2015 through 2019 indicates that they addressed stations, in general, and intermodal stations specifically, when they are the subject of an attack. For example, an attack on Manchester, England’s Victoria station, an intermodal station, was included in the 2018 Mass Transit and Passenger Rail Terrorism Threat Assessment. TSA’s Cyber Modal Threat Assessment reviews cyber threats to transportation over the course of the previous year, establishes cyber threat levels for the transportation modes for which TSA is responsible, and evaluates the threat through the next year or two. This annual assessment examines cyber threats to business and industrial control systems from state and non-state actors, including terrorist groups, pro-terrorist hacker groups, and hacktivists. Moreover, it analyzes incidents of cyberattacks and cyber espionage against U.S. and foreign transportation. Both assessments analyze threat actors and their capabilities, intent, and activities—including attacks occurring internationally—as well as tactics, techniques, and procedures that could be employed in future attacks. TSA calculates threat levels for transportation and cyber modes based on assessments of threat actor intent and capability. It may also issue additional situation-based products on emerging threats. TSA routinely shares these threat assessments with rail agencies and other stakeholders, such as industry security professionals. TSA Coordinates with CISA to Facilitate Voluntary Cybersecurity Assessments and Industry Outreach In addition to TSA’s risk assessment efforts, the agency coordinates with CISA, which conducts voluntary cybersecurity assessments as needed and requested by TSA and industry stakeholders. Specifically, CISA offers eight different voluntary cyber assessment options for public and private sector stakeholders, including mass transit and passenger rail agencies. Because CISA provides services to all 16 critical infrastructure sectors, including the transportation systems sector, officials noted that it must balance the resources it devotes to each sector. For example, CISA officials stated that they have conducted six Validated Architecture Design Review assessments on rail agencies since 2015, and currently have four pending requests from transportation agencies. The Validated Architecture Design Review evaluates systems, networks, and security services to determine if they are designed, built, and operated in a reliable and resilient manner. CISA officials also stated that they have conducted weekly vulnerability scans for one rail agency since 2015. While CISA coordinates with federal and private sector stakeholders to identify and address significant risks to critical infrastructure through its assessments, agency officials stated that they defer to TSA (as the co- sector specific agency for transportation) to take the lead in broader cyber initiatives and outreach to the transportation sector. For example, TSA officials stated that the agency included CISA in planning its cybersecurity workshops, a series of half-day workshops for surface transportation agencies to learn about cybersecurity resources from DHS and discuss nontechnical cybersecurity actions to improve their cybersecurity posture. According to TSA’s Cybersecurity Roadmap 2018, the agency plans to assess the resilience of the transportation modes to malicious cyber activity in conjunction with CISA, among other things. According to officials, TSA and CISA are collaborating or planning to collaborate on several cybersecurity assessments for passenger rail systems, including a cyber risk assessment for passenger rail cars and a cyber assessment of the mass transit and passenger rail mode. CISA officials told us that TSA, DHS’s Science and Technology Directorate, and CISA’s National Risk Management Center are in early phases of developing a cyber risk assessment for select passenger rail cars that they plan to produce in fiscal year 2020. CISA officials stated that they intend to address cyber vulnerability in the rail car assessments and plan to reach out to operators to discuss results. TSA officials told us that TSA and CISA also are considering a mass transit and passenger rail cyber assessment similar to one being developed for the pipeline mode. CISA officials stated that the planned pipeline assessment effort will include a total of 10 Validated Architecture Design Review assessments, in which TSA will help make arrangements with industry and will observe the process. TSA officials explained that expanding this effort to include passenger rail would depend on CISA’s availability to conduct assessments and balance demands in other sectors. CISA officials noted that they currently do not have the resources to support a similar plan for rail. TSA Actively Works with Domestic Stakeholders to Identify Standards and Key Practices but Provides Limited Guidance on Foreign Stakeholder Engagement TSA Works with Stakeholder Groups to Develop Domestic Standards and Recommended Practices TSA participates in APTA working groups that review and develop standards and recommended practices for passenger rail security, including those that apply to intermodal station security and cybersecurity. Specifically, from 2009 through 2019, APTA produced 45 documents related to security and emergency management standards and recommended practices, among other things. TSA is listed as a participant in 37 of the 45 documents. TSA officials noted that APTA working groups regularly review documents and issues related to security topics, including through monthly phone calls in some cases, and update them as needed. According to APTA’s Manual for the Standards Development Program, standards address safety-critical subjects and establish requirements that must be met by industry; recommended practices describe an established or generally recommended approach that does not rise to the level of a standard; and white papers are intended to provide information about complex issues that present the industry’s prevailing philosophy on the subject matter. For example: APTA offers a series of general standards, recommended practices, and white papers targeted at physical infrastructure protection at passenger facilities. These documents are not specifically directed at intermodal stations, but, according to our analysis and APTA officials, apply to such facilities as well as others. The documents address factors such as exterior door and window security, as well as securing mailrooms and utility openings, among other issues. Another APTA standard addresses security and emergency management considerations during planned special events, such as identifying transit hubs that are likely to be inundated with passengers going to and from the event. APTA offers cybersecurity recommended practices that are targeted at transit agencies in the early stages of starting a cybersecurity program, including how to obtain executive-level awareness and support and how to develop a cybersecurity awareness and training program. APTA also offers recommended practices for securing control and communications systems in transit environments, such as train control systems and fare collection systems. Table 2 provides additional examples of industry standards and key practice documents, as they relate to threats identified by domestic passenger rail stakeholders we interviewed. In addition to working with industry through APTA to develop standards and practices, TSA officials stated that the Surface Transportation Security Advisory Committee, which was established in 2019 to provide advice and recommendations to the TSA Administrator on transportation security matters, may serve as a mechanism for discussing or recommending key practices as the Committee develops. Officials noted that the Committee, which includes industry and community groups, could serve as a source for identifying forward looking best practices for rail security. The Committee held initial meetings in July 2019, October 2019, and January 2020, and proposed establishing subcommittees on topics such as cybersecurity and insider threats. None of the seven domestic rail agencies we contacted identified any security areas in which they felt recommended practices were missing. Officials from five agencies specifically commented on the usefulness of APTA publications. Officials from three agencies however, noted that many transit and rail agencies are still in the early stages of starting a cybersecurity program and that cybersecurity recommended practices are generally targeted at those agencies, as compared to agencies that already have a more sophisticated approach to cybersecurity. Officials from one agency further noted that publications related to the more technical aspects of cybersecurity (such as industrial control systems) can become outdated quickly as industry outpaces the development of security standards. TSA, CISA, and passenger rail agency officials we interviewed identified the NIST Cybersecurity Framework as the primary key practices document they reference for cybersecurity. Domestic and foreign rail agency, and industry association officials, as well as academic experts we interviewed noted that the possibility or likelihood of a cyberattack causing physical damage or harm to rail passengers or infrastructure is unlikely and largely hypothetical at this time. Academic experts we interviewed pointed to an incident in Poland in 2008 as one of the few, if only, known incidents in which a cyber-related attack on rail resulted in physical harm. In this incident, according to news reports, a Polish teenager modified a television remote control so that it could be used to control signals and switch points in a local tram system. Four vehicles derailed and 12 people were injured in the incident. Several rail agency officials and stakeholders we spoke with noted that successfully hacking into train control systems would require a highly sophisticated knowledge of the system. Officials further noted that train systems are designed to fail to safe mode and stop a train in the event of an abnormal signal, and that train operators have the ability to take over controls and manually stop trains if necessary. Officials from three rail agencies, however, stated that as agencies continue to adopt new technologies and systems become more interconnected, the potential for a cyberattack increases. Additionally, CISA officials and officials from one rail agency stated that, despite the lack of many incidents to date, protecting control systems is critical given the potential catastrophic impact of a successful attack. TSA Identifies Foreign Standards and Key Practices through Multilateral Working Groups and Bilateral Relationships, but Provides Limited Guidance to TSARs on Engaging with Foreign Rail Stakeholders According to TSA officials, TSA identifies foreign passenger rail security standards and key practices through engagement in multilateral groups and by leveraging bilateral relationships. Examples of multilateral groups include the International Working Group on Land Transport Security and the European Association of Railway Police Forces (RAILPOL). The working group, established in 2006, consists of 19 member states, including the United States. It is intended as a framework for members to openly share best practices, exchange information, and contribute to the development of surface transportation security initiatives. For example, TSA and members of the working group developed a searchable database of international surface transportation security measures (known as the SMARTbox) as a resource for surface transportation professionals to gain insights into security practices used by their peers. RAILPOL, founded in 2004, is an international association of government railway police organizations. It has 22 members, including TSA and the Amtrak Police Department. Information about intermodal stations and cybersecurity can be identified and exchanged through both of these mechanisms. For example, representatives from the United Kingdom delivered a presentation on securing intermodal stations at a 2016 working group meeting, and both working group and RAILPOL meetings have included cybersecurity discussions. Figure 3 provides an image of St. Pancras International Station in London, an intermodal station where international, local, and long distance trains converge with the London Underground. Regarding bilateral engagement, TSA identifies foreign rail security standards and practices through one-on-one relationships with other countries. TSA officials noted that their level of engagement with other countries can depend on a variety of factors, including how much the countries have in common regarding transportation systems and threats, and whether or not there are formal agreements in place that allow for regular, detailed information sharing. While some relationships are ongoing, officials stated that TSA interactions with other countries are often situational or transactional—countries may reach out either directly to TSA or through the TSAR for information about a specific issue, such as perimeter protection for surface transportation. For example: TSA holds biannual meetings with Transport Canada, the Canadian government department responsible for transportation policies and programs. Discussion topics from the meetings in 2017 and 2018 included Canadian efforts to develop passenger rail regulations, results from TSA derailment device testing, and opportunities for collaboration. According to TSA officials, TSARs in several countries have facilitated engagement with foreign surface transportation officials, including passenger rail officials. For example, officials stated that one TSAR facilitated the use of TSA’s Exercise Information System for an exercise on the metro system in a foreign city, as well as joint rail security training at TSA facilities in the United States. Officials further noted that another TSAR has taken initiative to facilitate quarterly meetings between foreign government and TSA surface transportation officials, including research and development and passenger rail officials. In addition to quarterly meetings facilitated by the TSAR, TSA officials stated that they are in regular contact with research and development officials in one country to share testing information, such as the results of derailment device testing and explosives testing on railcars, and to discuss security issues related to unmanned aircraft systems. TSA officials also reported that representatives attended an APTA- sponsored study trip to Brussels and London after the 2016 and 2017 rail attacks in those cities, in part, to observe lessons learned from the attacks. Foreign governments and international rail associations also produce a variety of passenger rail security standards and key practice documents. Table 3 below provides examples of these documents and the types of threats they address. TSA officials noted that while multilateral forums provide valuable opportunities to communicate with other countries about evolving threats, emerging security technologies, and potential key practices, interest in forums such as the International Working Group on Land Transport Security has been in decline. For example, while the working group charter calls for annual meetings and quarterly conference calls, the full group has not met since 2016. TSA and foreign government officials we spoke with stated that interest in the working group may be in decline due to factors such as retirements of key officials and lack of engagement from certain countries. These officials also noted that, as leaders in rail security, they typically provide more information about key practices to other countries in large forums than they receive. Additionally, TSA officials noted that other countries frequently used the working group- developed SMARTbox initially, but that use declined in recent years in part due to its location on the Homeland Security Information Network because users may find it difficult to navigate. Further, eight of the 10 domestic and foreign rail agencies we interviewed said they were either unfamiliar with the application or did not use it. For example, officials from one domestic agency said that there was little incentive to contribute and that they found informal networks to be more useful for sharing information. In contrast, TSA and other officials we spoke to stated that bilateral relationships with trusted partners with similar sophisticated rail operations may allow for more detailed exchanges of current and emerging key security practices. TSA Provides Limited Guidance to TSARs on Engaging with Foreign Rail Stakeholders TSA has provided limited guidance to TSARs on engagement with foreign passenger rail stakeholders through the TSAR Toolkit (or handbook), which states that TSARs should engage with officials involved in multiple modes of transit, including rail; however, the primary focus of the document is engagement with aviation stakeholders. TSA further provides comprehensive and specific guidance for TSAR aviation engagement as part of its foreign airport assessments and air carrier inspections, but does not do so for surface transportation. As discussed above, according to TSA officials, some TSARs have taken the initiative to facilitate meetings and share testing and training information related to surface transportation, including passenger rail. Passenger rail officials we talked to in one country stated that these TSAR-led initiatives served as a valuable source of information and communication with TSA. In addition, one TSA official cited the value of discussing preliminary testing findings, as well as new guidelines on topics such as security in station designs, which address concerns about security in public spaces. These efforts, however, are dependent on the individual initiative of each TSAR and are not universal. For example, one TSAR we interviewed stated that TSA’s expectations and priorities for surface transportation engagement were unclear and, as a result, he focused almost exclusively on aviation. TSA officials stated that they have focused TSAR guidance on aviation engagement because of the agency’s regulatory role in this area, which, as discussed above, includes foreign airport assessments and air carrier inspections. In lieu of detailed guidance on surface transportation, officials noted they defer to the individual TSARs on how or whether to engage foreign surface transportation stakeholders. Officials emphasized this individual approach and stated that in some countries, TSAR engagement on passenger rail security issues may be limited by legal or cultural barriers. Because rail (unlike aviation) does not directly connect to the United States in most cases, officials noted that there may be less incentive for some host countries to engage. Further, some countries may not have a rail system, or may not be as advanced in rail security policies and procedures, and therefore may be less able to offer key practices. In November 2019, TSA officials noted that they were considering adding guidance for engaging with surface transportation officials and addressing intermodal concerns to TSAR Regional Operational Implementation Plans. According to officials, these plans provide targeted guidance to TSARs for engagement within their specific regions. As of February 2020, officials stated that draft plans for two regions (Western Hemisphere and Africa/Middle East) were under review at TSA. Officials further stated that these drafts, and drafts for the remaining regions currently in development, would include surface transportation-related guidance. TSA officials stated that they hoped to complete all regions’ plans by the end of calendar year 2020, but they did not provide documentation for us to verify that the final plans would contain surface transportation guidance for TSARs. The 2018 TSA Administrator’s Intent document includes a goal to promote security partnerships across surface transportation systems by, in part, identifying and communicating best practices and lessons learned to stakeholders and international partners. In addition, the NIPP states that officials should share actionable and relevant information across the critical infrastructure community to build awareness and enable risk informed decision making. The TSAR Toolkit further states that, even in locations without modal connections to the United States, there is still great value in establishing key points of contact who can share best practices or facilitate the exchange of information in the event of an emergency in modes of transit outside of aviation. As the primary overseas point of contact for security matters involving all modes of transportation, TSARs are responsible for developing bilateral relationships and facilitating information sharing with foreign stakeholders, among other things. Further leveraging formal or informal bilateral relationships could allow TSA to obtain additional passenger rail security information. While several TSARs have individually taken initiative with regard to rail, without additional guidance from TSA, there is no assurance that they will engage in these exchanges with modes outside of aviation. As a result, TSA is less likely to be fully aware of key passenger rail security practices in other countries, such as those listed in table 3 above, among others. Moreover, specific guidance will also provide TSARs with clear expectations for engaging with stakeholders, and provide TSA with greater assurance that they are engaging in a consistent manner. TSA’s new Regional Operational Implementation Plans provide an opportunity for TSA to more clearly incorporate targeted guidance to encourage TSAR outreach and information sharing in specific areas. Recent efforts by TSARs in several countries demonstrate practices, such as opening lines of regular communication on surface transportation, including passenger rail, which could be replicated in other countries. TSA Uses Various Mechanisms to Share Security Standards and Key Practices but Does Not Fully Incorporate NIST Cybersecurity Standards in the BASE TSA Shares Information about Standards and Key Practices through Its Participation in Working Groups, and through Assessments and Exercises According to TSA officials and domestic rail stakeholders we interviewed, TSA uses various mechanisms such as the Transit Policing and Security Peer Advisory Group, monthly conference calls with rail stakeholders, and the annual APTA roundtable meeting to share and discuss a range of security information with stakeholders, including information about standards and key practices. These mechanisms provide opportunities to discuss issues related to intermodal stations and cybersecurity key practices. TSA also shares information about key practices with domestic stakeholders through voluntary TSA programs such as BASE, the Intermodal Security Training and Exercise Program, and the Visible Intermodal Prevention and Response program. TSA officials provided information about how they incorporate information from foreign threats and attacks into these programs. Specifically: TSA officials noted that TSA initially developed the BASE program around standards that were produced by APTA and other industry partners following the 2004 terrorist attacks on commuter trains in Madrid and the 2005 terrorist attacks on the London subway system. According to TSA officials, the APTA standards and recommended practices, which evolve based on threats and lessons learned, form the basis for the BASE assessment template. One way in which TSA helps communicates these standards and practices to agencies is through the questions in the template. Officials noted that lessons learned from foreign rail security incidents have been used to further support certain security concepts in the BASE, such as assessment questions related to whether agencies engage in public outreach for security awareness (e.g. “If You See Something, Say Something”) and report suspicious activity. TSA officials reported that they consider overseas and domestic attack methods and tactics when planning Intermodal Security Training and Exercise Program exercises to raise awareness of emerging tactics and threats. These exercises are intended to share best practices and lessons learned, among other things. Officials noted that they recently incorporated cyber, chemical, and vehicle- ramming attacks into the program’s objectives based on recent domestic and overseas incidents, and that they shared resources, information, and best practices for security solutions. For example, officials reported conducting two regional exercises that focused on chemical threat elements as the result of a 2017 plot in Australia. TSA further reported hosting a series of vehicle ramming program workshops in the wake of attacks in New York City and Europe. According to TSA officials, TSA has not made any recent changes to the Visible Intermodal Prevention and Response program directly as a result of lessons learned or key practices resulting from a foreign rail security incident; however, officials said they regularly integrate information about foreign incidents and threats when planning program deployments. Officials also noted that the majority of current deployments are for surface transportation, which includes rail. Regarding cybersecurity, TSA has shared information about cybersecurity key practices, including the NIST Cybersecurity Framework, through a series of regional cybersecurity Intermodal Security Training and Exercise Program workshops since 2017. These “5N5” workshops listed five nontechnical cybersecurity actions an agency could take in 5 days, including: (1) develop familiarity with the NIST Cybersecurity Framework; (2) implement a unique password change policy; (3) understand the latest phishing and spam trends and how to message awareness; (4) differentiate access control among staff; and (5) report cybersecurity incidents. Six of the seven domestic rail agencies we spoke with were generally satisfied with TSA’s efforts to share security and key practice information; however officials from two of these six agencies also expressed concerns about timeliness and quality of cybersecurity information provided by TSA. For example, officials from one agency stated that they received limited cybersecurity information from TSA and that the information they did receive was of limited use because it was targeted at agencies without a sophisticated cybersecurity program. An official from another agency noted that while there were opportunities to discuss cybersecurity, the information provided was often general in nature and there was limited time for discussion in certain mechanisms because of the large number of people involved. This official also noted that while the information TSA provides is valuable and there are mechanisms available to share information about a range topics, discussions are typically related to security incidents and threats, as opposed to key practices. TSA officials acknowledged that the agency’s cybersecurity efforts were still in the early stages. They further noted that the implementation plan for the 2018 Cybersecurity Roadmap, which, among things, calls for improving information sharing and partnering with stakeholders to promote the adoption of best practices and industry and/or international standards, was only recently signed in September 2019. In addition to TSA’s information sharing mechanisms, domestic rail agency officials we spoke to reported learning about foreign key practices through personal experience and direct engagement with foreign rail counterparts. For example, officials from two agencies we spoke to hosted visits from foreign rail officials to study security measures, among other things. Officials from one agency noted they provided information to Hong Kong through APTA on key practices for managing large protest crowds in an urban transit environment. Officials from another agency noted that they participate in international information sharing surveys and research to learn about cybersecurity practices by foreign rail operators, and sent representatives to an international mass transit training forum on the development of threat, vulnerability, and risk assessments. Domestic rail agencies also identified several changes they have made to their physical security systems as a result of key practices or lessons learned from foreign rail incidents. For example: increasing random patrols and high visibility deployments of security officers, changing security camera placement to better capture station exits, and increasing security awareness messaging to employees and passengers. Additionally, officials from one agency noted that they revised subway evacuation plans to direct people towards areas less vulnerable to an attack after reviewing lessons learned from recent vehicle-based attacks in Europe. With regard to cybersecurity, one domestic agency we spoke to noted that recent wide-spread global cyberattacks reinforced challenges they have securing legacy Information Technology systems against threats such as ransomware threats. As a result, the agency is focused on identifying expiring technologies and replacing those that can no longer be patched or updated. Officials from another agency noted that they have increased the number of firewalls they use to further segment and protect systems. Table 4 below provides information on mechanisms that can be used to identify and share rail security key practice information, as identified by TSA and domestic stakeholders. TSA Does Not Fully Incorporate NIST Cybersecurity Standards into Its BASE Assessments While TSA has taken initial steps to share cybersecurity key practices and other information with passenger rail stakeholders, the BASE assessment, does not fully reflect the updated cyber key practices presented in the NIST Cybersecurity Framework, nor does it include the framework in a list of available cyber resources. As discussed above, TSA uses the BASE assessment to share security best practices with transit agencies, among other things. Our review of the BASE cybersecurity questions in the template found that they cover selected activities associated with three of the five functions outlined in the framework– Identify, Protect, and Respond. For example, the BASE asks agencies if they ensure training reinforces cybersecurity roles and responsibilities, which corresponds to the awareness and training category of the NIST Protect function. However, the remaining two functions—Detect and Recover—are not represented in the BASE. According to the framework, when considered together, these functions provide a high-level, strategic view of the life cycle of an organization’s management of cybersecurity risk. TSA officials stated that they regularly review the BASE and noted that the questions are intended to reflect both industry key practices and agency policy; however, they also stated that the agency has not updated the BASE cybersecurity questions since NIST released its Cybersecurity Framework in 2014. In January 2020, officials responsible for the BASE acknowledged that the cybersecurity questions should be updated to reflect the framework. TSA officials also noted that they would want to align changes to the BASE cybersecurity questions with any new guidance or direction provided by the newly established Surface Transportation Security Advisory Committee. As of January 2020, the Committee is in its initial start-up phase, and has not yet provided any reports or recommendations or published a timeline or project plan. Further, because the framework functions organize basic cybersecurity activities at their highest level, incorporating elements of all five functions into the BASE template should not require additional guidance from the Committee. The 2015 TSA Transportation Systems Sector-Specific Plan states that encouraging the adoption of the NIST Cybersecurity Framework across all transportation modes supports the plan’s goal to manage the security risks to the physical, human, and cyber elements of critical transportation infrastructure. The plan also states that encouraging the adoption of the framework contributes to several of the NIPP’s calls to action related to sharing actionable and relevant information. TSA considers the framework a best practice document. By updating the BASE cybersecurity questions to align more closely with the core functions in the NIST Cybersecurity Framework, TSA could better assist passenger rail and other operators in identifying current key practices and improving their cybersecurity posture. As a result, transit operators would be more aware of cybersecurity vulnerabilities and better prepared to reduce the impact from a cybersecurity incident. In addition, this would create a more consistent cybersecurity approach from TSA, since the agency promotes the framework through other mechanisms, such as the series of cybersecurity workshops, as noted above. Conclusions Recent physical and cyberattacks in U.S. cities and Europe demonstrate the evolving nature of the threats to passenger rail and highlight the importance of working with both domestic stakeholders and foreign rail security partners. As such, TSA actively engages with domestic passenger rail stakeholders, but could do more to engage with foreign stakeholders. TSARs stationed abroad are well positioned to further leverage bilateral relationships with foreign passenger rail stakeholders, and several TSARs have taken initiative to do so. However, TSA provides only limited guidance to TSARs on surface transportation engagement. Without specific guidance, there is no assurance that TSARs will engage in these exchanges with modes outside of aviation. TSA’s new Regional Operational Implementation Plans provide an opportunity to more clearly incorporate targeted guidance to encourage TSAR outreach and information sharing in specific areas. Additionally, such guidance will provide TSA with greater assurance that TSARs are engaging with foreign stakeholders in a consistent manner. TSA uses various mechanisms to share security standards and key practice information with rail stakeholders, including through BASE assessments. The cybersecurity questions in the BASE template, however, do not fully reflect two of the five core areas identified in the NIST Cybersecurity Framework. By updating the BASE cybersecurity questions to align more closely with current key practices such as the framework, TSA could better assist passenger rail and other operators in improving their cybersecurity posture. As a result, transit operators would be more aware of cybersecurity vulnerabilities and better prepared to reduce the impact from a cybersecurity incident. Recommendation for Executive Action We are making two recommendations to TSA. The TSA Administrator should ensure that the TSAR Regional Operational Implementation Plans include guidance on how TSARs are to engage with foreign surface transportation stakeholders, including passenger rail stakeholders. (Recommendation 1) The TSA Administrator should update the BASE cybersecurity template to ensure it reflects cybersecurity key practices, including the Detect and Recover functions outlined in the NIST Cybersecurity Framework. (Recommendation 2) Agency Comments and Our Evaluation We provided a draft of this report to DHS for review and comment. DHS provided written comments, which are reprinted in appendix II, and also provided technical comments, which we incorporated as appropriate. DHS concurred with both recommendations and described actions TSA plans to take to address them. Specifically, to address recommendation 1, TSA plans to draft an Operational Implementation Plan, which will provide guidance to TSARs for engaging with foreign surface transportation stakeholders, including in passenger rail security. According to TSA, this plan will also serve as the outline for the development of Regional Operational Implementation Plans, which will help align resources worldwide. To address recommendation 2, TSA plans to update the BASE Cybersecurity Security Action Item section to ensure it reflects the NIST Cybersecurity Framework Detect and Recover functions. These actions, if fully implemented by TSA, should address the intent of both recommendations. We are sending copies of this report to the appropriate congressional committees and the acting Secretary of Homeland Security. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact Triana McNeil at (202) 512-8777 or McNeilT@gao.gov. Contact points for our Office of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributors to this report are listed in appendix III. Appendix I: Physical Security and Cybersecurity Key Practices Cited by Domestic and Foreign Stakeholders We asked domestic and foreign passenger rail agencies and foreign passenger rail stakeholders we interviewed to identify some security related key practices or lessons learned that they employ, including, but not limited to, intermodal stations and cybersecurity. Table 5 below provides examples of common security practices both domestic and foreign officials identified; table 6 shows several additional key practices foreign rail stakeholders cited. These tables are not intended to be a comprehensive list, but provide examples of key security practices utilized by selected domestic and foreign rail agencies. Figure 4 below shows an example of a Project Servator poster displayed during an exercise at St. Pancras International Station in London. As noted in table 6 above, foreign passenger rail stakeholders cited Project Servator as a key rail security practice. Appendix II: Comments from the U.S. Department of Homeland Security Appendix III: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In additional to the contact named above, Christopher Ferencik (Assistant Director), Sarah Turpin (Analyst in Charge), Chuck Bausell, Benjamin Crossley, Suzanne Kaasa, Tracey King, Ronald La Due Lake, William Reed, and Adam Vogt made key contributions to this report.