Background Federal Roles and Responsibilities in Responding to Disasters Under the National Response Framework, the Department of Homeland Security is the federal department with primary responsibility for coordinating disaster response, and within the department, FEMA has lead responsibility. Due to the massive response needed after Hurricanes Irma and Maria in the U.S. Virgin Islands and Puerto Rico, FEMA utilized the National Response Framework to activate all 14 ESFs, including ESF#8. The National Response Framework designates state, local, tribal, and territorial agencies as primarily responsible for response activities in their jurisdictions, including those related to public health and medical services. However, when effective disaster response is beyond the capabilities of the state, territorial, or tribal government and affected local governments, such as was the case for Hurricanes Irma and Maria, those governments can request federal assistance. The federal response for a specific ESF is designed to supplement the state, local, tribal, or territorial resources that respond to a disaster or other emergency. However, due to the physical destruction of the two hurricanes in the U.S. Virgin Islands and Puerto Rico, the territorial government agencies that were tasked with coordinating resources to respond to such disasters were largely incapacitated. This resulted in an unprecedented federal role in the response to these disasters. ASPR’s Role in Responding to Disasters As the lead agency for an ESF#8 response, ASPR is responsible for coordinating the ESF#8 response core capabilities outlined in the National Response Framework. These core capabilities include assessment of public health and medical needs, patient evacuation, patient care, the provision of medical equipment and supplies, and public health communication, among others. ASPR coordinates these core capabilities through two main roles defined in the National Response Framework—the coordinator and the primary agency. As the coordinator, ASPR oversees and coordinates the preparedness activities for ESF#8 support agencies, nongovernmental organizations, and the private sector. For example, ASPR must maintain contact with support agencies through conference calls, training, and other activities, prior to events; monitor the ESF’s progress in being able to meet the outlined core capabilities; as well as coordinate planning and preparedness efforts with nongovernmental organizations and the private sector. As the primary agency, ASPR has significant authorities, roles, resources, and capabilities to fulfill during an ESF#8 response. Its responsibilities include notifying and requesting assistance from support agencies and coordinating resources, as well as working with all types of organizations, such as ESF#8 support agencies, territory officials, and other stakeholders to maximize the use of all available resources. As part of a response, ASPR may activate the National Disaster Medical System (NDMS)—an interagency partnership among HHS, DOD, VA, and the Department of Homeland Security to supplement health and medical systems and response capabilities during a public health emergency. Under NDMS, ASPR and its partner agencies provide medical response (by deploying medical personnel teams, for example), evacuate patients, and provide medical care in NDMS medical facilities when requested by state, local, tribal, and territorial governments or other federal agencies. For example, as part of NDMS, DOD and FEMA may provide transportation to evacuate seriously ill or injured inpatients. DOD and VA may operate and staff NDMS Federal Coordinating Centers, which are activated during an emergency to receive, triage, stage, track, and transport patients affected by a disaster or national emergency to a participating NDMS medical facility capable of providing the required care to manage the patient’s condition. After an ESF#8 response, ASPR evaluates HHS’s disaster response activities through an after-action review. According to the Department of Homeland Security’s Homeland Security Exercise and Evaluation Program guidance, which ASPR follows, this review should include collecting feedback about the response activities to identify strengths and areas for improvement, and developing corrective actions to address identified areas for improvement. This information is then documented in an after-action report and corrective action improvement plan. Population Demographics and Hospital Systems in the U.S. Virgin Islands and Puerto Rico The populations in the U.S. Virgin Islands and Puerto Rico are older than the general U.S. population. Estimates indicate that the total population in the U.S. Virgin Islands in 2018 was approximately 107,000 and about 18 percent (or about 19,000 individuals) were age 65 or older. Estimates for Puerto Rico indicate that the total population in 2018 was approximately 3.3 million and about 20 percent (or about 666,000 individuals) were age 65 or older. In comparison, almost 16 percent of the general population in the 50 states and the District of Columbia, totaling approximately 329.3 million, were age 65 or older in 2018. To serve these populations, the U.S. Virgin Islands has two hospitals, one on St. Thomas and one on St. Croix, each with a capacity of 150 beds. Puerto Rico has 68 hospitals scattered throughout the island. The capacity of beds ranges from less than 10 to 515, with a total of almost 10,000 hospital beds to serve the territory. Hurricanes Irma and Maria and Their Effects on the U.S. Virgin Islands and Puerto Rico The 2017 Atlantic Hurricane season was one of the most active seasons in U.S. history, causing widespread damage and destruction to significant populations in the continental United States and the territories. In particular, two hurricanes—Irma and Maria—struck in quick succession and devastated the U.S. Virgin Islands and Puerto Rico. Hurricane Irma – a category 5 storm passed by the U.S. Virgin Islands—St. Thomas and St. John—on September 6, and continued by Puerto Rico. In the U.S. Virgin Islands, the storm caused high storm surge, flooding, extensive damage to buildings and infrastructure, and widespread power outages. It became one of the strongest Atlantic hurricanes on record. Hurricane Maria – a category 5 storm passed by the U.S. Virgin Islands—St. Croix—on September 20, and made landfall in Puerto Rico as a category 4 storm. Hurricane Maria compounded the damage caused by Hurricane Irma in the U.S. Virgin Islands, and devastated Puerto Rico. Heavy flooding and high winds led to the catastrophic damage to Puerto Rico’s power grid, as well as severe damage to the water, communications, transportation, and health care infrastructure. The majority of Puerto Rico’s power grid was down for nearly two months following Hurricane Maria, with outages continuing through 2018. Figure 1 depicts the paths of Hurricanes Irma and Maria. Figure 2 contains photographs of damage sustained in the U.S. Virgin Islands. Figure 3 contains photographs of damage sustained in Puerto Rico. Additional 2017 Hurricanes Requiring an ASPR Response At the same time ASPR was responding to the catastrophic hurricanes in the U.S. Virgin Islands and Puerto Rico, the agency was also responding, or had recently responded, to hurricanes in other areas. Specifically, ASPR led the ESF#8 response to Hurricane Harvey, a category 4 hurricane that made landfall in Texas on August 25, 2017. Further, in addition to responding to the effects of Hurricane Irma on the U.S. Virgin Islands, ASPR was leading the response to that hurricane in Florida. Also, while ASPR was still responding to Hurricanes Irma and Maria, Hurricane Nate, a category 1 hurricane, hit Louisiana and Mississippi on October 7 and 8, 2017, respectively. While not as severe as the prior hurricanes, Hurricane Nate resulted in wind damage, flooding, and storm surge, and required a public health and medical services response. (See figure 4 for a timeline of the 2017 hurricanes requiring ASPR to lead an ESF#8 response.) ASPR and Support Agencies Evacuated Patients and Deployed Medical Staff and Facilities to the U.S. Virgin Islands and Puerto Rico ASPR and support agencies evacuated critical care and dialysis patients and deployed medical staff and temporary medical facilities as part of the response to Hurricanes Irma and Maria. These activities centered on saving lives and preventing human suffering. Evacuations of Critical Care and Dialysis Patients During the response to Hurricanes Irma and Maria, ASPR led the NDMS evacuation of critical care and dialysis patients. According to ASPR officials, Hurricane Irma damaged critical health care infrastructure and created a deteriorating situation in St. Thomas that necessitated life-saving evacuations to Puerto Rico, particularly as St. Croix’s health care facilities could not support the needs of both islands. Specifically, after Hurricane Irma damaged the only hospital on St. Thomas, ASPR prioritized evacuating critical care patients to Puerto Rico. Once ASPR officials further determined that St. Thomas did not have the capacity to treat dialysis patients, ASPR also coordinated the movement of dialysis patients to Puerto Rico. This was the first time ASPR had coordinated the evacuation of such patients during an ESF#8 response. ASPR used HHS’s Centers for Medicare and Medicaid Services’ data to locate dialysis patients on St. Thomas who were unable to be reached by local authorities for evacuation. As the threat of Hurricane Maria making landfall in Puerto Rico became evident, ASPR began moving U.S. Virgin Islands patients previously evacuated to Puerto Rico to the continental United States, according to ASPR and Department of Interior documentation. See figure 5 for a timeline of patient evacuations conducted through NDMS from the U.S. Virgin Islands and Puerto Rico after Hurricanes Irma and Maria. ASPR worked with other agencies to evacuate NDMS patients. Specifically, ASPR relied on DOD to provide transportation because HHS did not have its own transportation capabilities. For example, DOD provided personnel and transportation to conduct aeromedical evacuations of patients from the U.S. Virgin Islands to Puerto Rico and the continental United States. In addition, DOD operated a Federal Coordinating Center in the continental United States, and VA operated Federal Coordinating Centers in Puerto Rico and the continental United States to receive evacuated patients and place them into NDMS medical facilities. For example, the day after Hurricane Irma passed the U.S. Virgin Islands, ASPR requested that VA operate the San Juan Federal Coordinating Center to begin receiving evacuated U.S. Virgin Islands patients. See figure 6 for a photograph of NDMS evacuation of U.S. Virgin Islands dialysis patients to the continental United States. Deployment of Medical Staff and Temporary Facilities During the response to Hurricanes Irma and Maria, ASPR and some of its ESF#8 support agencies—DOD and VA—deployed medical staff and temporary medical facilities to respond to the public health and medical needs in the U.S. Virgin Islands and Puerto Rico. Using these medical assets, ASPR and its support agencies served almost 16,000 patients in Puerto Rico and almost 2,000 patients in the U.S. Virgin Islands over the course of about four weeks after Hurricane Maria, according to ASPR reports. Examples of ASPR medical staff and facilities include, but are not limited to, the following: Disaster Medical Assistance Teams. ASPR placed Disaster Medical Assistance Teams in front of the major hospitals in the U.S. Virgin Islands and Puerto Rico to triage patients and to relieve the hospitals’ emergency departments by treating patients with acute care needs during the response to Hurricanes Irma and Maria. Disaster Medical Assistance Teams comprise about 35 medically trained personnel and equipment. In addition, Disaster Medical Assistance Teams were sometimes divided into six-person teams—known as Health Medical Taskforce Teams—that are more agile, according to ASPR officials. These smaller teams supported response operations in the U.S. Virgin Islands and Puerto Rico by traveling into hard–to-reach places to provide acute medical care, stabilize patients, and call for the transport of patients, when needed. According to ASPR officials, ASPR deployed a Disaster Medical Assistance Team to Puerto Rico prior to Hurricane Maria making landfall and then divided it into smaller teams to provide medical care around San Juan, Puerto Rico. According to these officials, HHS was one of the few federal agencies to have operational personnel available immediately post landfall. See figure 7 for photographs of Disaster Medical Assistance Teams setting up and providing services in Puerto Rico. Federal Medical Stations. ASPR placed Federal Medical Stations in tents in front of hospitals in Puerto Rico after Hurricane Maria made landfall to assist with relieving the hospitals’ emergency departments. Federal Medical Stations are to have a 3-day supply of medical and pharmaceutical resources to sustain up to 250 stable, primary, or chronic care patients. Because the entire island of Puerto Rico was affected by Hurricane Maria, ASPR implemented a “hub and spoke” strategy for the first time—a system to deliver medical care over affected areas’ population centers—according to ASPR officials. Under this strategy, ASPR designated San Juan’s Centro Medico hospital as the “hub” of activity with six “spokes” delivering care to the island’s population centers, and placed Federal Medical Stations in tents in front of each hospital, including the “hub.” USNS Comfort Deployed to Puerto Rico to Respond to Hurricane Maria The USNS Comfort is a seagoing medical treatment facility that had more than 850 medical and support staff embarked as part of the public health and medical services response to Hurricane Maria in Puerto Rico, according to Department of Defense (DOD) officials. DOD officials stated that approximately 2,000 patients in Puerto Rico were provided care on the USNS Comfort during the course of its 45-day relief mission that began in early October 2017. The USNS Comfort’s primary mission is to provide an afloat, mobile, medical–surgical facility to the U.S. military that is flexible, capable, and uniquely adaptable to support expeditionary warfare. The ship’s secondary mission is to provide full hospital services to support U.S. disaster relief and humanitarian operations worldwide. Medical Companies provided trauma, medical, and surgical care to populations in Puerto Rico after Hurricane Maria. Among other medical facilities, DOD also provided a Combat Support Hospital to Puerto Rico 3 weeks following Hurricane Maria—which consisted of 44 beds with emergency medical technicians; an operating room, laboratory, pharmacy, and X-ray machine; and primary care and intensive care capabilities. DOD also sent the USNS Comfort—a hospital ship maintained by the U.S. Navy that served as a mobile, floating hospital—to help relieve the hospitals in Puerto Rico. VA medical staff. VA deployed medical personnel through its Disaster Emergency Medical Personnel System—VA’s main deployment program for clinical and non-clinical staff to an emergency or disaster—to assist ASPR with staffing the Federal Medical Stations. According to VA officials, these personnel worked side by side with other federal personnel, such as Disaster Medical Assistance Teams, to provide medical assistance. Hurricanes Irma and Maria Highlighted Key Deficiencies in ASPR’s Emergency Response Leadership Our review identified several key deficiencies with ASPR’s leadership of the federal public health and medical services response to Hurricanes Irma and Maria in the U.S. Virgin Islands and Puerto Rico that could adversely affect future large-scale responses unless they are addressed. Limited ASPR presence in the U.S. Virgin Islands. As the primary agency, ASPR is responsible for coordinating the ESF#8 response, including coordinating with support agencies and officials at operations centers. Further, FEMA’s ESF#8 statement of work for ASPR states that HHS should provide appropriate personnel at emergency operations centers near disaster sites to lead an ESF#8 response. HHS officials maintained that the Department is not required to address all capabilities in the ESF#8 statement of work, as the actual response provided by HHS depends on other factors, such as resource availability. Emergency Operations Center An emergency operations center is a physical location where responders, including federal and state/territory responders, as well as nongovernmental responders, can meet to coordinate information and resources to support incident management (on-scene operations) during a response. According to Department of Homeland Security documentation, decision makers gather at emergency operations centers to ensure they receive the most current information, which allows for improved communication and decision-making during a response. During the initial weeks after the hurricanes, ASPR liaison officers were not always stationed at the emergency operations centers in St. Thomas and St. Croix. Instead, the liaisons rotated between the emergency operations center, hospital, and airport on each island to manage patient evacuations, or stayed at the hospital, according to ASPR officials. This led to confusion with regard to the ESF#8 response status on the ground, according to FEMA, DOD, and territory health officials. For example, FEMA officials stated that when they needed information on patients’ health needs and evacuation status, they had to spend time trying to locate an ASPR liaison officer to obtain it. The FEMA officials then had to relay this information to DOD, territory health officials, and hospital representatives who were making numerous requests for this information to FEMA in ASPR’s absence at the centers. FEMA officials stated that relaying medical information was outside their areas of expertise as were other activities they conducted in ASPR’s absence, such as addressing public health issues at shelters. One FEMA official stated that he had to read handwritten notes from the hospital that contained patient information, such as vitals and prescription needs, and provide this information to other responders. Without a medical background, he did not know the meaning of a lot of the medical terms used. Furthermore, these FEMA officials stated that given communication systems were down on the islands, having a reliable, physical presence at the emergency operations centers in St. Thomas and St. Croix became even more critical. After a few weeks into the response, ASPR liaison officers were stationed at emergency operations centers, according to ASPR officials, but the officers generally rotated about every 2 weeks with limited time to hand off information and were often not from Region II. This limited ASPR’s leadership of the response and put undue resource strain on other responders, according to FEMA and territory health officials. For example, according to FEMA and U.S. Virgin Islands health officials, the liaison officer would not necessarily understand the big picture, the tasks to be done, or the players involved. Thus, FEMA and territory health officials would have to take time to bring the ASPR liaison officer up to speed on the pressing public health and medical services issues, and shortly thereafter the officer would leave to be replaced by someone else, who would also need to be brought up to speed. ASPR officials provided two different reasons for the staffing challenges encountered at the emergency operations centers in the U.S. Virgin Islands. First, some ASPR officials cited personnel resource constraints. Specifically, these officials stated that ASPR personnel had already been deployed multiple times, given the prior hurricane (Hurricane Harvey) and concurrent events that ASPR was responding to in multiple locations. As a result, officials said there was not enough time to educate rotating officials on issues faced in the U.S. Virgin Islands and deployments were shorter than ideal. Second, other ASPR officials stated that a lack of transportation from Puerto Rico to the U.S. Virgin Islands may have resulted in minimal overlap of liaison officers. According to these officials, they had to request such transportation from FEMA, and FEMA did not always prioritize their needs, since it was also managing transportation needs from other ESFs. However, FEMA officials contested this statement and stated there was ample opportunity for ASPR liaison officers to get to the U.S. Virgin Islands. In retrospect, ASPR officials acknowledged that staffing emergency operations centers, as well as other strategic locations is ideal. ASPR documentation after the response states that the officers’ presence at emergency operations centers is important because they need to be working at the operational and tactical levels on the ground. In addition to staffing emergency operations centers, ASPR officials agreed with statements from FEMA and DOD officials who told us that the ideal scenario would be to have at least one other liaison officer (if not more) to support the lead liaison officer at all strategic locations. The officials noted that the number of liaison officers may vary depending on the response needs. In the case of patient evacuations, for example, this would include having a liaison officer at the airport and one at the hospital, in addition to the lead at the emergency operations center. In contrast, DOD officials stated that after Hurricane Irma, one ASPR liaison was on St. Croix trying to manage all the ESF#8 activities, including patient evacuations and hospital assessments, which was too much for one person. In May 2019, ASPR officials told us they have a long-term goal of creating an incident response team that will comprise 17 full-time response personnel. If implemented, this strategy may allow ASPR to provide more liaisons on the ground during a response and address the staffing deficiency we identified. However, ASPR officials did not provide us with a draft strategy or a timeline for the creation of such a team. Until ASPR develops a response personnel strategy to ensure it has sufficient liaison officers available to consistently lead a response from emergency operations centers and other strategic locations, the agency risks repeating the challenge encountered in the U.S. Virgin Islands—notably, a situation with inadequate liaison officer presence to effectively lead a response on the ground. Delay in tracking evacuated patients. Tracking NDMS evacuated patients and ensuring their care is a critical component of the public health and medical services response. The ESF#8 Annex of the National Response Framework states that patients should be tracked from their point of entry into NDMS. However, our review found that ASPR did not track patients evacuated through NDMS from the U.S. Virgin Islands to Puerto Rico immediately after Hurricane Irma. This occurred because of delays in getting HHS tracking personnel to the territories, according to VA documentation, as well as ASPR, DOD, VA, FEMA, and U.S. Virgin Islands Department of Health officials. Specifically, HHS teams that track patients were not deployed to the region until about 5 days after patients were already being evacuated through NDMS. These teams are (1) Joint Patient Assessment and Tracking System (JPATS) teams, which enter patient information into JPATS—ASPR’s tracking system—and (2) service access teams, which track and monitor the status of evacuated patients, including facilitating movement to home or other final destination after being discharged from care. As a result of the delayed deployment of the tracking teams, ASPR officials did not initially know the locations of some NDMS evacuated patients in Puerto Rico. For example, once in Puerto Rico, the service access teams had to drive around the territory looking for evacuees, according to ASPR officials. ASPR officials explained that there was a delay in tracking patients after Hurricane Irma because it takes time for JPATS and service access teams to deploy to a region. ASPR officials told us that they did not pre-deploy the tracking teams before the hurricane, because the U.S. Virgin Islands officials did not request ASPR’s help with patient evacuations until after Hurricane Irma hit. ASPR officials also stated that at the time of the hurricanes, the agency had no policy for tracking patients from the start of NDMS evacuations; however, since the hurricanes, the agency has developed a federal patient movement framework that may help prevent future delays in patient tracking. This framework describes the pre-deployment of JPATS and service access teams, which would allow for tracking to start at the beginning of NDMS evacuations. ASPR officials told us this is the optimal solution. However, during an event such as a hurricane, sufficient notice for pre-deployment is not always possible. One option identified in ASPR’s federal patient movement framework is for FEMA to track patients initially and share these data with ASPR and for DOD to provide patient movement manifests to ASPR so that the data can be manually entered into JPATS once deployed, which will contain the overall dataset for patient tracking. By working with DOD and FEMA, ASPR may be able to consistently track patients from the start of evacuations even when there is a deployment delay in HHS’s own tracking capabilities. While ASPR’s development of the framework is an important step forward to address delays in patient tracking, ASPR has not exercised the framework with its NDMS partners to ensure it is sufficient and reliable. For example, given the potential need to manually enter information into JPATS, there could still be a delay in HHS knowing where patients are located and being able to inform family members. An exercise of the framework could help determine if this is indeed a concern that needs to be addressed. We have previously reported that exercises are a key tool for testing and evaluating preparedness. ASPR officials told us that exercising the framework prior to the next hurricane season had been discussed, but as of May 2019, nothing had been scheduled. Without a framework that has been exercised with the other agencies involved in federal patient movement and tracking, ASPR risks delays in patient tracking when conducting future NDMS patient evacuations. Final status of one-fourth of evacuated patients not readily available. The ESF#8 Annex of the National Response Framework states that NDMS evacuated patients should be tracked to their final disposition. Further, federal internal controls standards stress the importance of information controls to ensure quality information is used to achieve objectives, which includes information that is complete and accurate. However, we found that of the approximately 800 NDMS patient evacuations during the response to Hurricanes Irma and Maria, the agency could not readily provide us with the final status of approximately 200 of these patients. ASPR officials stated they did not have information indicating the final status of the 200 evacuated patients, because case workers are not required to report this information to ASPR. ASPR officials explained that the case workers on the service access teams deployed during the response are responsible for keeping track of patients’ final status. However, we found that without conducting a review of files in which the case workers recorded patients’ final status, ASPR officials could not determine if the patients were appropriately discharged and returned back to the U.S. Virgin Islands, left the system against medical advice, or were otherwise unaccounted for. Additionally, as of June 2019, ASPR did not provide documentation indicating the steps the agency takes to ensure the data held by case workers are accurate. Until ASPR has controls in place to ensure that data on NDMS evacuated patients are complete and accurate, the agency cannot ensure it is sufficiently tracking all NDMS evacuated patients and risks losing track of patients when conducting future patient evacuation efforts. Limited focus on chronic and primary care needs in isolated locations. As the coordinator, ASPR is responsible for ensuring that appropriate planning and preparedness activities are undertaken. This includes planning for the care of elderly and chronically ill patients in isolated areas. Our review found that at the time of the hurricanes, ASPR Region II’s response plans for the U.S. Virgin Islands and Puerto Rico—known as Incident Response Plans—did not account for the need for chronic and primary care in isolated communities. This type of care was greatly needed, given that many people, especially the elderly, could not easily access hospitals, according to officials from ASPR, DOD, the Puerto Rico Department of Health, and three stakeholders we interviewed. Consistent with the views of these officials, the HHS Deputy Inspector General reported that during Hurricane Maria, hundreds of patients across Puerto Rico sought access to urgent care, primary care, and pharmacy services at community-based health care centers, known as Federally Qualified Health Centers, because they could not travel to hospitals for treatment. Further, we reported in May 2019 and heard from two stakeholders that because of the widespread power outages and infrastructure damage in both territories, the chronically ill often did not have access to electricity to power their medical devices—such as ventilators—and gasoline to run generators was scarce. ASPR’s initial response activities—which generally focused on supporting the hospitals and patients with acute care needs—were based on response plans with assumptions that did not hold true given the unprecedented level of destruction in the areas. Specifically, according to ASPR officials, the agency focused its response planning on managing the surge of patients at hospitals, assuming that individuals would make their way to hospitals, and projecting that smaller communities could care for one another until further needs assessments could be conducted. For example, ASPR Region II and Puerto Rico health officials assumed in their planning that patients in the harder to reach areas, such as the mountainous areas, would make their way to the coast where hospital care was available, according to ASPR officials. ASPR officials also stated that preparedness planning for an immediate response is generally focused on managing the surge of patients at hospitals, with the assumption that after about a week into the response, assessments would be conducted to determine other needs, such as chronic care needs. However, ASPR officials told us that in retrospect, the planning and the assumptions used for planning for the U.S. Virgin Islands and Puerto Rico were not adequate given the unprecedented level of destruction in the areas, which affected communications and transportation. FEMA officials also said that given how difficult it was to assess the situation in Puerto Rico after Hurricane Maria, having prior knowledge of the situation on the ground that could affect the response (such as the general public health and medical needs in the territories during non-disaster times) was a lesson learned that applies to them, as well as ASPR. ASPR has taken steps to better account for the need for chronic and primary care in isolated communities in future public health and medical services responses. However, these efforts have not been finalized or incorporated into ASPR Region II Incident Response Plans for the territories, which according to a lead HHS Region II official, are internal agency plans that serve as a playbook for HHS officials during an ESF#8 response in these territories. Specifically, ASPR is working with the Puerto Rico Department of Health officials to map the locations of health care facilities in Puerto Rico—such as clinics, Federally Qualified Health Centers, urgent care centers, and hospitals—including their bed, generator, communication, and surge capacities. This is the first time all such information has been brought together, and ASPR continues to work on this effort as it helps the territory recover, according to agency documentation. ASPR officials also told us that moving forward they would like to involve Federally Qualified Health Centers in planning and response activities, including involving them in the provision of primary care during responses. We agree that these are important steps that ASPR can take to address this deficiency. However, until ASPR Region II Incident Response Plans for the territories include the provision of chronic and primary care in isolated communities, there is a risk that disaster survivors will not receive needed care. For example, this could include the incorporation of Federally Qualified Health Centers or other local health clinics into these plans. Misalignment of support agencies’ capabilities to response needs. As the coordinator, ASPR is responsible for ensuring that appropriate planning and preparedness activities are undertaken, including monitoring the progress in meeting the ESF#8 core capabilities. Further, FEMA guidance issued in June 2015 states that each ESF coordinator should maintain a capabilities inventory for the ESF. However, our review found that ASPR did not have a sufficient understanding of ESF#8 support agencies’ capabilities prior to the hurricanes. Consequently, ASPR’s resource needs for the response in the U.S. Virgin Islands and Puerto Rico were not always aligned with the resources its support agencies—DOD, VA, and FEMA—could provide. According to ASPR documentation and DOD officials, this resulted in some deployed resources not being properly and efficiently utilized. As an example of the misalignment of resources, DOD officials told us that, through FEMA, ASPR requested that DOD provide stand-alone medical assistance teams (i.e., teams of medical personnel and equipment, similar to ASPR’s Disaster Medical Assistance Teams) to deliver medical care to the hurricane survivors in the U.S. Virgin Islands and Puerto Rico. However, since DOD does not have stand-alone teams, it deployed Area Support Medical Companies, which included facilities, equipment, and supply packages. These teams are equipped to serve the military population—those approximately 18-60 years of age, wounded, and requiring trauma and medical-surgical care. However, trauma and medical surgical care was not the primary need in the islands, which, in general, have an older population with chronic and primary care needs. ASPR documentation also shows that ASPR had trouble defining how FEMA and DOD assets fit into the overarching ESF#8 response. For example, ASPR documentation states that it took the agency nearly a week to fully realize that the two Area Support Medical Companies provided by DOD were not equivalent to the five stand-alone medical assistance teams that HHS had requested. According to DOD officials, the misalignment of resources during the response was troublesome as the Department’s involvement in the ESF#8 response activities affected patient care for military health beneficiaries and potentially increased overseas contingency response risks for the Department. In another example, during the response, there were conflicting expectations about VA personnel’s role in supporting the Federal Medical Stations, with VA responders thinking they would run shelter operations and ASPR believing the VA staff would support medical operations, according to ASPR documentation. According to ASPR officials, the agency had never anticipated needing— and therefore did not plan for—certain ESF#8 agency support, such as teams similar to ASPR’s Disaster Medical Assistance Teams. ASPR’s role in a response has traditionally been to support states or territories; however, because of the catastrophic nature of the hurricanes, ASPR effectively led the territories in the response as opposed to playing a supporting role. ASPR’s response system was not designed to handle that large of a role, according to officials. Since the hurricanes, ASPR has taken steps to understand the resources available from its support agencies, but ASPR officials agreed that it is an activity that the agency needs to continue to undertake. Specifically, ASPR officials stated that the agency is currently working with its NDMS partners (FEMA, DOD, and VA) to develop memorandums of agreement that outline the roles and responsibilities of each organization; however, the discussions are in the preliminary stages as ASPR continues to collaborate with each organization to understand their resource gaps and capabilities. Continuing to understand each ESF#8 support agency’s potential capabilities and its limitations—knowing that the actual capacity of these capabilities may fluctuate—is important, as evidenced by the misalignment that occurred during the response. Until ASPR can better identify the capabilities and limitations of support agencies to meet ESF#8 core capabilities, ASPR cannot, as the coordinator, determine whether the ESF is prepared for future disasters. Reliance on DOD support. As the coordinator, ASPR is responsible for ensuring that appropriate planning and preparedness activities are undertaken. This includes planning for a scenario in which DOD assistance is unavailable. We have previously reported that DOD provided much of the ESF#8 support during the initial response to Hurricanes Irma and Maria, which may not always be available in future responses. DOD’s support included providing the core capabilities of patient care (through the provision of Area Support Medical Companies, among other medical facilities) and patient evacuations (through the provision of personnel and transportation to conduct aeromedical evacuations), as mentioned above. We found that ASPR does not have a response strategy that will account for the core capabilities needed to be filled by itself or other support agencies in a large or long-term ESF#8 response if DOD were unable to assist. For example, DOD’s 2017 hurricane after-action report included reliance on DOD as a concern and recommended that HHS and FEMA establish contracts with the commercial sector to ensure the federal government has other options available for larger ESF#8 responses should DOD not have the needed capability or available capacity. Similarly, in September 2018, we reported that ESF lead agencies’ (including ASPR for ESF#8) dependence on DOD capabilities was a challenge for DOD during the response to Hurricanes Irma and Maria. We reported that the increased reliance may create vulnerability, if in the future, DOD capabilities are needed to conduct its primary mission—to defend the nation from threats—at the same time its support is needed for a domestic disaster response. ASPR told us that it does not have a contingency plan for a response in DOD’s absence, because for large-scale events, such as Hurricanes Irma and Maria, ASPR has to rely on DOD, given ASPR’s own resource constraints. ASPR officials stated that, in general, ASPR’s resource response capacity—personnel and supplies—can support a response to two simultaneous events that occur in different areas in the Continental United States for 30 days. Beyond that, ASPR has to rely on other agencies, including DOD, which occurred with Hurricanes Irma and Maria. However, ASPR officials did state that the agency has recently taken some steps to reduce its reliance on DOD. Specifically, in September 2018, ASPR entered into a contract with a private company to provide medical personnel teams similar to Disaster Medical Assistance Teams that can be utilized to supplement ASPR response personnel, especially if DOD resources are not available. Similarly, to assist with future patient evacuations, in October 2018, the agency entered into contracts with private companies for commercial air ambulance transport. In addition, ASPR officials told us that through ASPR’s participation in the Whole of Government Logistics Council, the agency has begun to further discuss air transport options during major disasters with other agencies including FEMA, DOD, and VA. However, ASPR officials also stated there is a need to hold discussions with all agencies involved in the ESFs to prioritize and coordinate air transportation during a response in the event that DOD is not available. While these are important steps to potentially minimize reliance on DOD, ASPR’s own capacity constraints make it all the more important for ASPR to a develop response strategy that includes other support agencies in the event that DOD support is unavailable. For example, such a strategy could involve conducting an exercise to simulate a large-scale ESF#8 response without DOD capabilities. Until ASPR develops a strategy demonstrating how ESF#8 core capabilities can be provided through HHS and its support agencies without DOD’s assistance, it risks being unprepared to respond to a large-scale disaster or multiple disasters if they occur when DOD’s capabilities are limited due to other events, such as military missions. While ASPR Has Completed a Draft After-Action Report to Evaluate Its Response, It is Missing Key Perspectives ASPR completed a draft after-action report in February 2018 after several months of collecting feedback from HHS staff on the strengths and areas for improvement in the agency’s 2017 ESF#8 response activities; however, the draft is missing the perspectives of key parties involved in the response. Not collecting the perspectives of key parties involved in the response is inconsistent with federal standards for information and communication, which state that management needs access to relevant information from external parties to help achieve objectives and address related risks. Further, the Standard for Program Management states that program managers should actively engage key stakeholders throughout the life cycle of a program, which would include any evaluation activities. Specifically, when collecting feedback, ASPR did not reach out directly to support agencies, territorial governments in the U.S. Virgin Islands and Puerto Rico, or other stakeholders intimately involved in the response. Instead, ASPR gathered observations through facilitated discussions, or “hotwashes,” with HHS personnel stationed at key response sites in headquarters and the field, such as personnel stationed at the HHS Secretary’s Operations Center and those stationed at medical sites in Puerto Rico. In addition, ASPR distributed an electronic feedback link to all personnel involved in the HHS ESF#8 response, both in the field and headquarters. ASPR officials stated they did not obtain feedback directly from outside parties, such as support agencies or territorial governments, during the after-action review because the review was focused on internal aspects of the HHS response. Instead, the officials said that FEMA—as the overall lead for the federal response—typically writes the overall after-action report for the whole federal government, and those perspectives would be captured there. However, FEMA’s after-action report was focused only on its response activities for the 2017 hurricanes and did not include any strengths or areas for improvement related to ESF#8. Because ASPR did not obtain feedback from its ESF#8 support agencies and other partners, its draft after-action report dated February 2018 has key gaps in its assessment. For example, three of the deficiencies we identified based on our review of documentation and interviews with agency and territory officials—the delay in tracking evacuated patients, the final status of some evacuated patients not readily available, and the reliance on DOD support—were not included in ASPR’s draft after-action report. This indicates that key perspectives, and related lessons learned, were missing from ASPR’s after-action review. Similarly, FEMA officials said that during the course of soliciting feedback on its own response actions, FEMA’s provider of NDMS medical evacuation transportation for Hurricanes Irma and Maria said that if ASPR had reached out, it would have identified challenges with the NDMS patient evacuations conducted. In particular, the provider told FEMA that patients were evacuated to an airport in the continental United States with limited hours of availability, and if patients had to be evacuated outside of those hours, they were sent to other airports with inadequate medical care, so the patients needed to be transported again as a result. Without an after-action report that includes the perspectives of all key parties—including ESF#8 support agencies—ASPR management is likely to lack the necessary information to comprehensively identify all strengths and areas for improvement of its ESF#8 response. Conclusions The catastrophic destruction encountered as a result of Hurricanes Irma and Maria proved overwhelming to the U.S. Virgin Islands and Puerto Rican governments and resulted in a large federal disaster response, complicated by losses of power, communication, transportation, and health care infrastructure in the territories. ASPR and its support agencies, such as DOD, undertook numerous actions to address the public health and medical needs in the territories—including evacuating critical care and dialysis patients from the U.S. Virgin Islands and Puerto Rico. Nevertheless, key deficiencies with ASPR’s leadership of the response resulted in confusion and resource strain among responders from support agencies and territory health departments at emergency operations centers in the U.S. Virgin Islands. The deficiencies also resulted in service access teams having to search for evacuated patients, ASPR’s inability to readily and reliably identify the final status of all evacuated patients, and disaster survivors in isolated areas potentially not receiving needed health care. ASPR’s leadership also led to an inefficient use of federal resources. Many of the deficiencies were a function of ASPR policy and its preparedness planning, and as such, they could be repeated unless ASPR addresses them. Additionally, the agency remains unprepared to respond to future large-scale disasters if DOD is unavailable. Further, the likelihood that deficiencies will recur in future responses increases, because ASPR did not include feedback from the support agencies involved in the response in its after-action report. Recommendations for Executive Action We are making the following seven recommendations to the Assistant Secretary for Preparedness and Response: ASPR should develop a response personnel strategy to ensure, at a minimum, a lead ASPR liaison officer is consistently at the local emergency operations center(s) during an ESF#8 response and another liaison, if not more, is at strategic location(s) in the area. (Recommendation 1) As ASPR finalizes its federal patient movement framework, the agency should exercise the framework with its NDMS partners to ensure that patients evacuated through NDMS will be consistently tracked from the start of their evacuation. (Recommendation 2) ASPR should put controls in place to ensure data on all NDMS evacuated patients are complete and accurate. (Recommendation 3) ASPR Region II should revise its Incident Response Plans for the territories to include strategies for providing chronic and primary care in isolated communities. These strategies could include the incorporation of Federally Qualified Health Centers and other local health clinics as part of a response. (Recommendation 4) ASPR should work with support agencies to develop and finalize memorandums of agreement that include information on the capabilities and limitations of these agencies to meet ESF#8 core capabilities. (Recommendation 5) ASPR should develop a strategy demonstrating how it ESF#8 core capabilities can be provided through HHS and ESF#8 support agencies if DOD’s capacity to respond is limited. (Recommendation 6) ASPR should take steps to ensure the perspectives of key external parties are incorporated in the development of HHS’s after-action reviews, following future ESF#8 activations. (Recommendation 7) Agency Comments and Our Evaluation We provided a draft of this report for advance review and comment to HHS, DOD, the Department of Homeland Security, VA, and the governments of the U.S. Virgin Islands and Puerto Rico. HHS and VA provided written comments, which we have reprinted in appendixes I and II, respectively. HHS concurred with five of our seven recommendations and stated that it had, or was in the process of, taking action. While we made no recommendations to VA, in its comments VA stated that it looks forward with working with HHS on matters we have presented in this report. HHS and DOD provided technical comments, which we incorporated as appropriate. U.S. Virgin Islands and Puerto Rican government officials stated they had no comments on the draft report. HHS did not concur with a recommendation in the draft report directing ASPR to develop and finalize ESF#8 response plans for the territories that include strategies for providing chronic and primary care in isolated communities. In its comments, HHS stated that while ASPR has federal plans in place that guide federal response, each state and locality is responsible for developing its own individual plans. We modified the language in our report and our recommendation to clarify we are referring to ASPR Region II’s Incident Response Plans for the U.S. Virgin Islands and Puerto Rico. According to a lead ASPR Region II official, these plans are internal agency plans that serve as a playbook for HHS officials during an ESF#8 response in these territories. However, as we reported, these plans do not account for the provision of chronic and primary care in isolated communities. Accordingly, we believe our recommendation is warranted. HHS also did not concur with a recommendation in the draft report that ASPR work with support agencies to develop an inventory to identify the capabilities and limitations of support agencies to meet ESF#8 core capabilities. According to HHS, such an inventory will be out of date immediately after development due to world events and changes in investments, technologies, and priorities. Instead, HHS proposed the continued use of interagency liaison officers at the HHS emergency operations center, as they can provide real-time updates on available resources during a response. We agree that HHS should continue this practice in future responses. However, as is evidenced by the misalignment that we identify in our report, this action was not adequate during the response to Hurricanes Irma and Maria in the U.S. Virgin Islands and Puerto Rico. Further, as we reported, ASPR officials acknowledged that more needs to be done to better understand the resources available from its support agencies. To clarify the intent of our recommendation—that is, that ASPR take steps to ensure it has a sufficient understanding of each ESF#8 support agency’s potential capabilities and its limitations—we modified language in our report and the recommendation. Specifically, we modified our recommendation to direct ASPR to include information on the capabilities of these agencies as it works to develop and finalize memorandums of agreement with support agencies. The memorandums of agreement that ASPR is beginning to draft with support agencies provide an opportunity to begin to address this issue. As we have reported, taking such action is needed to help ensure that future ESF#8 responses are more efficiently and effectively coordinated. We are sending copies of this report to the appropriate congressional committees, the Secretaries of the Health and Human Services, Defense, Homeland Security, Veterans Affairs, and Interior, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7114 or DeniganMacauleyM@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. Appendix I: Comments from the Department of Health and Human Services Appendix II: Comments from the Department of Veterans Affairs Appendix III: GAO Contact and Staff Acknowledgments GAO Contact Mary Denigan-Macauley, (202) 512-7114 or DeniganMacauleyM@gao.gov. Staff Acknowledgments In addition to the contact named above, Kelly DeMots (Assistant Director), Deirdre Gleeson Brown (Analyst-in-Charge), Kenisha Cantrell, Justin Cubilo, and Rebecca Hendrickson made key contributions to this report. Also contributing were Sam Amrhein, Kaitlin Farquharson, and Vikki Porter. Related GAO Products Disaster Response: FEMA and the American Red Cross Need to Ensure Key Mass Care Organizations are Included in Coordination and Planning. GAO-19-526. Washington, D.C.: September 19, 2019. Disaster Response: Federal Assistance and Selected States and Territory Efforts to Identify Deaths from 2017 Hurricanes. GAO-19-486. Washington, D.C.: September 13, 2019. Disaster Assistance: FEMA Action Needed to Better Support Individuals Who Are Older or Have Disabilities. GAO-19-318. Washington, D.C.: May 14, 2019. 2017 Disaster Contracting: Actions Needed to Improve the Use of Post- Disaster Contracts to Support Response and Recovery. GAO-19-281. Washington, D.C.: April 24, 2019. 2017 Hurricane Season: Federal Support for Electricity Grid Restoration in the U.S. Virgin Islands and Puerto Rico. GAO-19-296. Washington, D.C.: April 18, 2019. Disaster Recovery: Better Monitoring of Block Grant Funds is Needed. GAO-19-232. Washington, D.C.: March 25, 2019. Puerto Rico Hurricanes: Status of FEMA Funding, Oversight, and Recovery Challenges. GAO-19-256. Washington, D.C.: March 14, 2019. U.S. Virgin Islands Recovery: Status of FEMA Public Assistance Funding and Implementation. GAO-19-253. Washington, D.C.: February 25, 2019. 2017 Disaster Contracting: Action Needed to Better Ensure More Effective Use and Management of Advance Contracts. GAO-19-93. Washington, D.C.: December 6, 2018. Homeland Security Grant Program: Additional Actions Could Further Enhance FEMA’s Risk-Based Grant Assessment Model. GAO-18-354. Washington, D.C.: September 6, 2018. 2017 Hurricanes and Wildfires: Initial Observations on the Federal Response and Key Recovery Challenges. GAO-18-472. Washington, D.C.: September 4, 2018. Federal Disaster Assistance: Individual Assistance Requests Often Granted but FEMA Could Better Document Factors Considered. GAO-18-366. Washington, D.C.: May 31, 2018. 2017 Disaster Contracting: Observations on Federal Contracting for Response and Recovery Efforts. GAO-18-335. Washington, D.C.: February 28, 2018. Disaster Assistance: Opportunities to Enhance Implementation of the Redesigned Public Assistance Grant Program. GAO-18-30. Washington, D.C.: November 8, 2017.


Background Federal Transportation Security Responsibilities and Coordination Congress created a multi-agency framework that established agency responsibilities for securing the nation’s transportation systems. Following the terrorist attacks of September 11, 2001, the Aviation and Transportation Security Act, enacted in November 2001, established TSA as the federal agency with primary responsibility for transportation security. Within this framework, two components of DHS—TSA and Coast Guard—are responsible for most transportation security activities. TSA is the primary federal agency responsible for security in all modes of transportation, including civil aviation, passenger and freight rail, highway and motor carrier transportation, and pipeline transportation systems. Coast Guard is the lead federal agency responsible for maritime transportation security, though TSA plays a role in managing, for example, credentialing for workers at seaports. TSA and Coast Guard’s regulatory authorities vary across modes, which affects how transportation security activities are planned for and implemented. For example, TSA and Coast Guard exercise more regulatory authority over (and, in some cases, have operational responsibility for) the aviation and maritime modes pursuant to their respective statutory authorities. In the aviation mode, TSA has operational responsibility for the screening of passengers and property transported on aircraft, but also imposes and enforces security requirements established through regulation on air carriers and other industry stakeholders. Similarly, Coast Guard has responsibility for ensuring that maritime vessels and facilities are compliant with applicable security requirements. TSA’s statutory responsibilities for the surface transportation modes, however, are generally less prescriptive. With respect to these modes, TSA works with transportation operators on a broad set of risk-based activities such as training, information sharing, and community outreach within a collaborative environment. For example, in freight rail TSA and its partners undertake collaborative efforts to establish security priorities, identify vulnerabilities and capability gaps, and reduce risks. Freight rail operators, meanwhile, engage in cooperative and independent security initiatives to assess risks and refine security plans. Other federal agencies are involved in transportation security, but to varying degrees. At the department level, DHS is responsible for providing strategic guidance, directing a national unity of effort, and coordinating security across critical infrastructure sectors. CBP manages programs designed to secure cargo and ensure intermodal transportation security, among other things. CBP activities include programs to encourage trade partners to implement security best practices and identify high-risk shipments and travelers before they reach U.S. ports of entry. DOT also has some transportation security responsibilities, which we describe below. Figure 1 illustrates agencies’ activities across transportation modes. Federal policies and plans establish specific coordination mechanisms and activities for transportation security. Specifically, in accordance with the Homeland Security Act of 2002, as amended, DHS created the National Infrastructure Protection Plan to guide the national effort to manage risk to the nation’s critical infrastructure, including through coordination of agencies and various critical infrastructure sectors, including transportation systems. Under this structure, DHS and DOT are co-Sector-Specific Agencies for the Transportation Systems Sector. DHS delegated its sector responsibilities to TSA and Coast Guard. Within the transportation systems sector, agencies and stakeholders charter councils for individual transportation modes as well as the sector as a whole. Sector Coordinating Councils and Government Coordinating Councils for each critical infrastructure sector provide forums for promoting efficient collaboration within the sectors. Further, the Sector- Specific Agencies are to develop, in close collaboration with Sector Coordinating Councils and other sector partners, a sector-specific plan that tailors the National Infrastructure Protection Plan to the specific characteristics and landscape of each critical infrastructures sector. Under the Transportation Systems Sector-Specific Plan, DOT and DHS, through TSA, and Coast Guard, coordinate with infrastructure owners and operators, provide technical assistance, and carry out incident management responsibilities. CBP is also a permanent member of the Aviation Government Coordinating Council. The Impetus for a National Strategy for Transportation Security The Final Report of the National Commission on Terrorist Attacks Upon the United States (9/11 Commission Report), released in July 2004, identified concerns with aspects of transportation security planning, including the lack of an integrated strategic plan for the transportation sector. The Commission found that the screening of passengers and their property at airports accounted for the majority of transportation security investments, leaving vulnerable other facets of transportation security, such as cargo, general aviation, and surface transportation. The Commission recommended that the U.S. government identify and evaluate the transportation assets that need to be protected, set risk- based priorities for defending them, select the most practical and cost effective means of doing so, and then develop a plan, budget, and funding source to implement the effort. Congress subsequently passed the Intelligence Reform and Terrorism Prevention Act of 2004 (Intelligence Reform Act), which directed the Secretary of DHS to develop, prepare, implement, and update, as needed, a National Strategy for Transportation Security and transportation modal security plans. The statute further directs the Secretary of Homeland Security to work jointly with the Secretary of Transportation to develop, revise, and update the national strategy and transportation modal security plans. Within DHS, responsibility for such strategic planning had been delegated by the Secretary of Homeland Security in May 2003 to TSA for transportation security across all modes of transportation and to Coast Guard for maritime security, specifically. The Intelligence Reform Act called for a national strategy that was to include elements that aligned with the Commission’s recommendation. Table 1 illustrates parallels among the Commission’s multi-part recommendation, the Intelligence Reform Act, as amended, and the 2018 national strategy. Consistent with its underlying statute, the national strategy states that it is the governing document for federal transportation security efforts, and lays out a number of areas where it can govern those efforts. For example, the national strategy states that it contributes to departmental budgetary processes by applying multiple information sources to determine priorities and capability gaps that influence resource allocation decisions and budget projections across federal agencies. Further, the national strategy is intended to support out-year programming and budgeting by measuring progress toward achieving the security outcomes for funded activities. The national strategy states that its risk-based priorities help to narrow capability gaps and raise the security baseline. The risk-based priorities in the national strategy are also intended to inform security decisions about the types of activities government and industry modal security officials should pursue to address terrorism risks. The national strategy includes modal security plans as appendixes—also consistent with its underlying statute—and other, separate, statutorily required national strategy documents as annexes TSA determined were appropriate to include. 2018 National Strategy for Transportation Security Is Generally Consistent with Desirable Characteristics The 2018 National Strategy for Transportation Security is generally consistent with desirable characteristics of an effective national strategy. In 2004, we reported that national strategies are not required to address a single, consistent set of characteristics, and they contain varying degrees of detail based on their different scopes. We have previously identified a set of desirable characteristics that we believe would provide additional guidance to responsible parties for developing and implementing the strategies—and to enhance their usefulness as guidance for resource and policy decision-makers and to better ensure accountability. Our analysis of the 2018 National Strategy for Transportation Security found that it is fully consistent with two of the six desirable characteristics of an effective national strategy and partially consistent with four, as summarized in table 2. We found that supporting documents of the national strategy (such as a planning guide, project plan, and budget document) include additional elements of desirable characteristics that are not currently included in the strategy. For example, the national strategy’s guidance document describes the methodology for developing the strategy. TSA officials indicated that as they develop the 2020 national strategy, they will take steps to incorporate additional elements of desirable characteristics. 2018 National Strategy for Transportation Security Generally Did Not Guide Federal Efforts, Including Resource Decisions The national strategy plays a limited role in guiding federal transportation security efforts. Agencies rely instead on various agency- or mode- specific documents that DHS and DOT officials stated overlap with the national strategy. Similarly, agencies do not consult the national strategy to allocate resources for their federal transportation security efforts. They instead make such decisions based on various strategy documents and department and agency guidance, which the national strategy may inform to varying degrees. National Strategy Generally Did Not Guide Federal Transportation Security Efforts TSA identifies the national strategy as the governing document for federal transportation security efforts, consistent with its underlying statute; however, agency officials generally do not use it to guide their efforts and had disparate views about its functional role given overlapping strategic documents. The 2018 national strategy states: “While the strategy presents a whole community plan for reducing the risks to transportation from terrorist attacks, it is, as mandated, the governing document for federal transportation security efforts.” Officials representing TSA aviation, Coast Guard, TSA intermodal, and DOT stated that they did not use the national strategy to guide their efforts; TSA surface officials stated that it generally did guide surface transportation activities. Officials from TSA’s Strategy, Policy Coordination, and Innovation office, which coordinates the national strategy’s development, said that although the national strategy does not drive transportation security activities, it does inform such activities as they related to risk-based priorities. Although the national strategy states that it is to be the governing document for transportation security efforts, TSA strategy officials described it as a catalogue of transportation security activities. The vast majority of the activities and performance measures reported in the national strategy came from ongoing reporting mechanisms such as the DHS Annual Performance Report and TSA voluntary surface security assessments, according to TSA and Coast Guard officials. Therefore, the national strategy did not affect the number of activities or types of programs that agencies undertook, according to TSA and Coast Guard officials. Instead, the national strategy summarized information about current transportation security goals and performance as opposed to guiding such decisions. TSA surface and aviation, Coast Guard, and DOT officials stated that several different strategies and planning documents with similar areas of focus resulted in redundancy or overlap with the National Strategy for Transportation Security. We have reported that when overlap exists there may be opportunities to increase efficiency. For example, communicating the use of overlapping documents could promote efficiency in creating and using strategies to make transportation security- related decisions. Figure 2 shows the National Strategy for Transportation Security and numerous other documents, including several identified in the 2018 national strategy, that guide transportation security decisions. For specific examples of strategies used by each component, see appendix I. As shown in figure 2, the National Strategy for Transportation Security exists among more than a dozen other national-level strategic documents without a hierarchical alignment indicating how they interact or supersede each other. Officials from TSA’s strategy office stated that they view the functional role of the national strategy as informing transportation modes’ activities where applicable, and that transportation officials should use it to ensure consistency of effort across activities. Transportation officials had differing views on the varying role of the national strategy, as described below: TSA Aviation: The national strategy keeps security operations on track and aligned with priorities, but officials used the national strategy more for reference than to guide program or planning decisions. TSA officials stated that aviation policy is regulatory in nature, meaning policy is driven by requirements established through statute and regulation rather than by the national strategy. TSA aviation officials also stated that they could not provide an example of where the national strategy was used to make specific decisions or actions. Coast Guard: The national strategy informs federal partners of Coast Guard’s maritime transportation security activities, but Coast Guard officials stated that the national strategy does not require them to take on activities they are not already doing; instead, it puts those transportation security activities in context. Coast Guard officials stated that the national strategy did not drive decisions or activities. TSA Surface: The national strategy generally guides transportation security activities and drives a common understanding around goals for both TSA officials and industry partners. TSA surface officials stated that the need for voluntary cooperation and engagement makes the alignment of priorities with national strategy more valuable in the surface mode. TSA surface officials stated that they use the national strategy to guide their implementation of federal transportation security programs. Specifically, TSA surface officials stated that they use the national strategy to determine areas of focus for training and exercise programs. DOT: The national strategy delineates the transportation roles and responsibilities through the lens of terrorism, giving it value as a tool for communicating and coordinating within the transportation systems sector rather than as a planning tool. DOT officials stated that they did not use the national strategy as a major factor to prioritize budget decisions and cannot assign a causal relationship between the national strategy and policy. Officials from TSA’s strategy office stated that they created the national strategy to respond to legislative requirements; however, they had not fully considered or communicated to key stakeholders how the national strategy would functionally guide federal efforts. Officials acknowledged that it could be helpful to communicate this information to stakeholders as they develop future iterations of the national strategy. Such communication would be consistent with federal internal control standards, which state that management should externally communicate the necessary quality information to achieve the entity’s objectives. TSA has made efforts over the years to streamline and consolidate reporting requirements of the national strategy with similar documents. For example, in August 2010, TSA sent a letter to notify Congress that it was streamlining the national strategy and several other documents by incorporating them into the Transportation Systems Sector Annual Report. The letter stated that streamlining strategic planning and reporting requirements improves their usefulness and reduces federal government and stakeholder confusion. Similarly, TSA surface officials stated that they have attempted to consolidate their reporting requirements by integrating two strategies focused on mass transit and freight rail into the national strategy. Officials stated that those strategies were published as separate annexes in the 2018 National Strategy for Transportation Security in response to feedback, but had been integrated into the 2016 iteration of the national strategy. Officials from TSA’s strategy office said they believed the national strategy has value in providing a whole-of-government strategy for transportation security with a counterterrorism view. However, we have previously reported that the ultimate measure of the value of national security strategies is the extent to which they are useful as guidance in balancing homeland security priorities with other important, non- homeland security objectives. Though the national strategy lays out a number of areas where it can govern federal transportation security efforts, its unclear position among numerous strategic documents limits its ultimate value. For example, the risk-based priorities in the national strategy are intended to inform security decisions about the types of activities government and industry modal security officials should pursue to address terrorism risks. Instead, according to officials, the national strategy summarizes current transportation security activities within each mode and they generally use other documents to guide their transportation security decisions. By communicating to key stakeholders how the national strategy aligns with related strategies to guide federal efforts, stakeholders would be in a better position to use the strategy as a whole-of-government approach to preventing terrorist attacks. Agencies Use Various Strategy Documents to Allocate Resources, Which the National Strategy May Have Informed Officials representing TSA, Coast Guard, and DOT identified various documents and strategies as guiding resource decisions. TSA budget representatives stated that specific budgetary decisions and trade-offs result from other strategy documents, such as the TSA Strategy and Administrator’s Intent. TSA budget officials indicated a link between the National Strategy for Transportation Security and the budget process because other strategy documents incorporated the national strategy. Similarly, Coast Guard officials stated that they broadly consider the national strategy, the DHS Resource Planning Guidance, and other documents during their budgeting process. However, Coast Guard officials could not speak to the influence of the national strategy in particular. When asked about how the national strategy influences resource decisions, agency officials explained: TSA Aviation: The national strategy has not influenced any specific resource allocation decisions. Coast Guard: The national strategy is part of the broader budget process, but officials could not speak to its particular influence or provide examples of the national strategy changing the direction of maritime security activities. TSA Surface: The national strategy does not provide specific direction on resource allocation decisions. The national strategy provides a guidepost for where TSA wants to expend effort and can provide guidance during times of limited budgets and personnel, though officials did not provide specific examples of cases in which this occurred. DOT: The national strategy does not play any role in the department’s budget process. The national strategy identifies the creation of out-year budgets as a challenge. For example, the statute under which TSA develops the national strategy provides that it is to include both a 3-year and 10-year budget for federal transportation security programs that will achieve the priorities of the national strategy. However, the national strategy recognizes that it does not provide 3-year and 10-year budget information due to the challenge of anticipating future transportation security programming needs and aligning budget projections across multiple departments and agencies. To address this challenge, the national strategy aims to contribute to budgetary processes by applying multiple information sources to determine priorities and capability gaps that influence resource allocation decisions and budget projections. Further, the national strategy is to support budgeting by measuring progress towards achieving the security outcomes for funded activities. TSA officials explained that, rather than provide the 3-year and 10-year budget, TSA designed its budget process to align with, and be consistent with, the department’s five-year budget cycle set out in the Homeland Security Act. The national strategy explains that, accordingly, agency budget information will continue to be reported through their regular budget processes. TSA officials told us that they have been reporting budget information to Congress this way since before they produced the initial national strategy, and that Congress has not raised concerns with this approach. TSA, Coast Guard, and DOT officials told us they did not use the national strategy to make specific budget or resource allocation decisions because they did not believe the national strategy should direct those decisions. Officials from TSA’s strategy office confirmed that, in their view, the national strategy was not intended to guide resource decisions. Interagency Collaboration and Risk Information Underpin the 2018 National Strategy TSA officials collaboratively developed the 2018 National Strategy for Transportation Security, which generally reflected risks identified in existing TSA and Coast Guard documents. TSA managed the creation of the national strategy by seeking input from stakeholders with responsibilities in each of the three transportation modes as well as intermodal transportation. Specifically, TSA officials sent out three data calls for information and feedback to officials at TSA, Coast Guard, and DOT responsible for providing information. Each data call built upon the prior one and provided the modal officials multiple opportunities to revise and edit their data. In addition, TSA officials sent the data calls to the Transportation Modal Government Coordinating Councils and recounted sending them to other groups, such as Sector Coordinating Councils. Because of the numerous agencies involved and the length of the development and review process, TSA began development of the 2018 national strategy before they submitted the 2016 national strategy to Congress. TSA planning officials stated that they encouraged officials responsible for overseeing implementation of transportation programs to help develop the strategy so TSA could leverage the expertise of each individual mode. TSA delegated the responsibility of identifying performance measures, activities, and related information to officials in each of the modes. These modal officials in turn contacted officials implementing transportation security programs to gather information and metrics related to their programs in the mode-specific appendixes, as well as coordinate general feedback on the national strategy’s base plan. TSA recommended that modes leverage activity and performance information already reported, to the extent possible. This allowed the national strategy to be efficiently updated according to TSA planning officials, which is crucial to TSA’s planning timeline of developing the national strategy every two years. Officials representing TSA surface and aviation, Coast Guard, and DOT confirmed their participation in the data calls and national strategy development. TSA surface officials also stated that they leveraged existing collaboration and coordination mechanisms to provide industry and stakeholder feedback, such as government coordinating councils and sector coordinating councils. Senior leadership then reviewed the information to ensure that it did not conflict with other strategies that agencies use to guide activities, according to TSA and DHS officials. We compared TSA’s work collaborating with other agencies to produce the national strategy with key practices we have identified for collaboration and found that TSA generally aligned the national strategy development with selected key practices. Specifically, selected leading practices call for agencies to collaborate by identifying 1) leadership, 2) clear roles and responsibilities, and 3) participants. TSA’s leadership developing the national strategy, working jointly with DOT, is identified in agency documentation and a DHS memo which delegates this authority. TSA officials provided clear roles and responsibilities to agencies asked to provide data through the data calls that supported the 2018 national strategy development. In addition, they included all relevant participating agencies in the process and provided a clear method of decision-making. TSA officials stated that it was a challenge to get input from agencies that do not consider their main function to be transportation security, such as CBP. Officials from CBP—which is responsible for carrying out multiple activities related to air cargo and intermodal security in the 2018 national strategy—stated that they were not involved with the 2018 national strategy. CBP officials acknowledged that their programs to inspect cargo played a role in transportation security; however, they said they viewed their responsibilities as separate. For example, CBP officials stated that they are responsible for verifying the security of some cargo transported on planes but not the security of the planes themselves. However, TSA officials stated that they involved two individuals from CBP and will continue to reach out to CBP for information and involvement in the development of the 2020 national strategy. TSA officials stated that they are committed to collaborative development of the national strategy, and have taken an extra measure to seek comments from the public to inform the development of the 2020 national strategy using the Federal Register. In addition to agency collaboration, the development of the 2018 national strategy centered on agencies incorporating risks listed in their risk assessments. TSA officials from surface and aviation modes stated that they relied primarily on the Transportation Sector Security Risk Assessment; while Coast Guard officials relied on the National Maritime Strategic Risk Assessment and the National Maritime Terrorist Threat Assessment. TSA officials stated that they did not have documentation of the risks considered for the intermodal information for the 2018 strategy because the TSA official responsible for its development was no longer with the agency. However, officials stated that they are considering risks for the 2020 national strategy that are described in the Transportation Sector Security Risk Assessment and National Risks Estimate and provided documentation of these considerations. We found that, in general, the risk-based priorities highlighted in the national strategy aligned with the risks identified in the assessments. For example, the 2018 national strategy identified the prevention of insider threats as part of a risk-based priority in its base plan and aviation- specific appendix. In addition, the aviation-specific appendix identified an activity, outcome, and performance measure aimed at addressing this threat. This aligns with the identification of insider threats as a key part of risks specified in TSA’s 2017 risk assessment. In addition, TSA and Coast Guard officials stated that they also considered and included emergent threat information—for example, new threats presented by cybersecurity. They decided to include these threats as a result of ongoing development of strategy documents both in TSA and across the interagency community, according to TSA officials. The development of risk information in the 2018 national strategy remained within the context of each mode. TSA’s Transportation Sector Security Risk Assessment does provide information to compare risks across aviation and surface modes; however, that information is not included in the 2018 national strategy. Similar information related to Coast Guard risks is also not included in the 2018 national strategy, though available in Coast Guard risk assessments. The national strategy lays out areas where it could inform decision-making across modes; however, the information about transportation activities’ effectiveness does not currently lend itself to meaningful comparisons. For example, transportation security activities in the 2018 national strategy report outcome and performance measures, but not targets or results. TSA officials stated that they are developing the 2020 national strategy to include performance measures for activities to respond to risks, which will be the second iteration of measures in the national strategy. Corresponding performance results on activities that respond to risk- based priorities will be directly reported to Congress through annual reports on the progress of the national strategy’s implementation. Though this is not the same as providing cross-modal risk information, it would enable decision-makers to hold risk reduction activities accountable for results that they were intending to achieve, according to TSA officials. Conclusions In accordance with statutory requirements, the National Strategy for Transportation Security is to be the governing document for federal transportation security efforts. However, its unclear position among numerous related strategies has clouded its value in guiding federal efforts. In light of other strategies and governance documents, DHS, in consultation with DOT, can better communicate the applicability of the National Strategy for Transportation Security so that key stakeholders have clear direction on how to rely on the national strategy. As TSA develops future iterations of the national strategy, key stakeholders would be better positioned to use it if the departments communicate how the national strategy aligns with related strategies. In the absence of such communication, transportation security stakeholders may continue to miss opportunities to use the national strategy as part of a whole-of- government approach to preventing terrorist attacks. Recommendation for Executive Action The Secretary of Homeland Security should, in consultation with the Secretary of Transportation, communicate to key stakeholders how the National Strategy for Transportation Security aligns with related strategies to guide federal efforts as it develops future iterations of the national strategy. (Recommendation 1) Agency Comments We provided a draft of this report to DHS and DOT for review and comment. In written comments, which are included in appendix II and discussed below, DHS concurred with our recommendation and described actions taken to address it. DHS and DOT also provided technical comments, which we have incorporated into the report, as appropriate. DHS stated that the 2020 national strategy will elevate alignment language from the 2018 national strategy modal plans and better explain how the national strategy relates to newly issued strategies, among other things. These updates to the 2020 strategy are a positive step, and DHS should ensure that it further clarifies alignment language in the modal plans and communicates both newly issued and previous strategies alignment with the national strategy. Further communication about related strategies will provide better direction for key stakeholders on how to use the national strategy in relation to other strategies. We are sending copies of this report to the appropriate congressional committees, the acting Secretary of the Department of Homeland Security, and the Secretary of the Department of Transportation. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions concerning this report, please contact me at (202) 512-8777 or RussellW@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made significant contributions to this report are listed in Appendix III. Appendix I: Strategies Agencies Identified as Guiding Transportation Security Decisions Appendix II: Comments from the Department of Homeland Security Appendix III: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Kevin Heinz (Assistant Director), Michelle Serfass (Analyst-in-Charge), Chuck Bausell, Benjamin Crossley, Elizabeth Dretsch, Andrew Lobel, Tom Lombardi, Sarah Veale, and Adam Vogt made key contributions to this report.