Background Overview of Medicaid Expenditures and Oversight Medicaid expenditures are financed jointly by the federal government and the states. In order to receive federal matching funds for Medicaid expenditures, states must adhere to a broad set of federal requirements and administer their programs consistent with individual state plans approved by CMS. These plans are agreements between a state and the federal government that describe how states will administer their Medicaid programs, including how the state will administer Medicaid third- party liability procedures. When states make changes to their Medicaid programs or policies, including when necessary to comply with a change in federal law, they must submit a state plan amendment to CMS. CMS reviews and approves state Medicaid plans and state plan amendments. The federal government matches each state’s Medicaid expenditures for services according to a statutory formula called the Federal Medical Assistance Percentage. This formula provides for a match that is no lower than 50 percent of a state’s Medicaid expenditures and no higher than 83 percent. States can receive a 90 percent federal match for the costs associated with the development of each state’s Medicaid Management Information System (MMIS), a claims processing and retrieval system supporting the administration of the state’s Medicaid program. States also receive a 75 percent match for the costs associated with ongoing MMIS maintenance and operations. States use their MMIS systems to process provider claims, including claims for prenatal care services, pediatric preventive services, and services provided to CSE beneficiaries. The Medicaid program is administered at the state level and overseen at the federal level by CMS, which, among other things, ensures that funds are used appropriately and beneficiaries have access to covered services. Medicaid allows significant flexibility for states to design and implement their programs. Within broad federal parameters, states have discretion in, among other things, setting Medicaid eligibility standards and provider payment rates; determining the amount, scope, and duration of covered benefits; and developing their own administrative structures. States may also decide how Medicaid-covered services provided to beneficiaries will be delivered. For example, states may pay health care providers for each service they provide—fee-for-service—or contract with MCOs to provide a specific set of Medicaid-covered services to beneficiaries and pay them a set amount per beneficiary, typically per month. While most states use both delivery systems, the percentage of beneficiaries served through MCOs has grown in recent years, and represented nearly 70 percent of all Medicaid beneficiaries in 2016. Federal Third-Party Liability Requirements Medicaid beneficiaries across various eligibility categories may have access to private health insurance or other sources of third-party coverage. For example, some adult beneficiaries may be covered by employer-sponsored private health insurance even though they also qualify for Medicaid. Children, similarly, may be eligible for Medicaid, while also being covered as a dependent on a parent’s private health plan. As such, federal law requires states to perform various activities to ensure that Medicaid is the payer of last resort, including taking all reasonable measures to identify Medicaid beneficiaries’ other potential sources of health coverage and their legal liability. Specifically, states must ensure that the following steps, among others, are taken. 1. Coverage identification. To identify beneficiaries with third-party health coverage, states are required to request coverage information from potential Medicaid beneficiaries at the time the agency makes any determination or redetermination of eligibility. States are also required to obtain and use information pertaining to third-party liability, for example, by conducting data matches with state wage information agencies, Social Security Administration wage and earning files, state motor vehicle accident report files, or state workers’ compensation files. 2. Coverage verification. When other health coverage is identified, states often verify the information, including the services covered through the other insurance and the dates of eligibility. 3. Cost avoidance payment procedures. As a general rule, federal law requires states to apply cost avoidance payment procedures to claims for most Medicaid items and services. Under cost avoidance procedures, the state must reject claims for which a third party is or is probably liable, and the agency instructs the provider to collect from the third party. Once the provider determines the amount of the third party’s liability, the provider submits a claim to the state Medicaid agency for any remaining balance, up to the maximum amount allowed under the state’s payment schedule. States are then required to make timely payment to the provider, generally within 30 days from the date the claim for the balance is filed. 4. Pay-and-chase payment procedures. The Consolidated Omnibus Budget Reconciliation Act of 1985 made an exception to cost avoidance procedures for three types of services: prenatal care services, pediatric preventive services, and services provided to CSE beneficiaries. It required states to pay such claims without regard to the liability of the third party, a procedure CMS calls “pay and chase.” Under the pay-and-chase payment procedure, the state Medicaid agency is generally required to make a timely payment to the provider within 30 days, and then the state, instead of the provider, will seek to recover payment from any potentially liable third parties within 60 days. According to CMS, cost avoidance does not apply to these claims because there is a risk some providers might not participate in Medicaid to avoid dealing with the administrative burden of cost avoidance. (See fig. 1.) The Bipartisan Budget Act of 2018 amended various sections of the Medicaid third-party liability statute, including the required processes states must follow when paying claims with probable third-party liability for the following three types of services: Prenatal care services. The Bipartisan Budget Act of 2018 eliminated, effective February 2018, the statutory exception for prenatal care services that had required states to apply pay-and- chase procedures to such claims. Thus, under the amended statute, states must apply cost avoidance procedures to claims for prenatal care services when it is apparent that a third party is or may be liable at the time the claim is filed. Additionally, to the extent states had opted under CMS regulations to apply pay-and-chase procedures to claims for labor, delivery, or postpartum care services—which CMS calls “pregnancy-related services”—states must now apply cost avoidance procedures to those as well. Pediatric preventive services. Beginning in October 2019, under federal law as amended by the Bipartisan Budget Act of 2018, states are no longer required to pay claims for pediatric preventive services immediately. While states will still have the option to apply pay-and- chase procedures to these claims, a state may instead choose—if it determines doing so is cost-effective and will not adversely affect access to care—to require the provider to first submit the claim to the third party and wait 90 days for payment by the third party before seeking Medicaid payment. For purposes of this report, we refer to such a 90-day period as a “wait-and-see period.” Services provided to CSE beneficiaries. Beginning in October 2019, states must make payment for a CSE beneficiary’s claim if the third party has not paid the provider’s claim within a 100-day wait-and- see period. However, the state may instead choose—if the state determines doing so is cost-effective and necessary to ensure access to care—to make payment within 30 days. (See table 1.) Once the third-party liability changes in the Bipartisan Budget Act of 2018 are fully implemented, states will have authority to require providers to wait longer to receive Medicaid payments in certain circumstances. For example, Prenatal care services claims, which were previously paid within 30 days under pay-and-chase procedures, are now subject to cost avoidance. This could potentially result in providers waiting indefinitely to receive payment, depending on whether the provider is able to resolve the third-party liability (i.e., submit a claim for payment to the third party and determine the amount of the third-party liability), which must occur before the state may make payment under cost avoidance. Pediatric preventive services claims, which are generally paid within 30 days under pay-and-chase procedures, could be subject to a 90-day wait-and-see period beginning in October 2019 if a state decides to implement one. This could result in providers waiting 120 days to receive payment (90 days to wait and see if the liable third party pays, and then another 30 days for the state to make timely payment on any remaining balance). Claims for services for CSE beneficiaries, which are currently subject to pay-and-chase procedures or a 30-day wait-and-see period at state option, may be subject to either a 30-day or 100-day wait-and- see period beginning in October 2019, depending on which option the state chooses. This could result in providers waiting 130 days to receive payment (up to 100 days to wait and see if the liable third party pays, and then another 30 days for the state to make timely payment on any remaining balance). Some Selected States Have Implemented Third- Party Liability Changes for Prenatal Care Services; Most of the States Were in the Early Stages of Planning for Other Changes Officials from four of the nine selected states we reviewed reported having implemented the required third-party liability changes for prenatal care services. The changes were required to be implemented in February 2018. For the third-party liability changes affecting pediatric preventive services and services provided to CSE beneficiaries, which are due to take effect October 2019, Medicaid officials from six of the nine selected states noted that they were in the very early stages of planning how they might implement the changes. Four of Nine Selected States Have Implemented Required Third-Party Liability Changes for Prenatal Care Services Officials from four of the nine selected states we reviewed stated that their state Medicaid agency had implemented the mandated third-party liability changes for prenatal care services, which required states to implement cost avoidance payment procedures for claims for these services beginning in February 2018. Officials from three of the four states that have implemented the third-party liability changes for prenatal care services told us that changing from pay-and-chase to cost avoidance procedures involved identifying all the applicable service codes for prenatal care and making the necessary changes in their systems to ensure that any new claims were subject to cost avoidance procedures. They said it also involved communicating the need for such changes to the MCOs in their state. State Medicaid officials from the remaining five states generally noted that they were discussing the changes internally, researching how to implement the changes in their MMIS, assessing the likely impact of these changes on MMIS, or waiting for additional guidance from CMS. For example: Officials from several states noted that they were undertaking activities, such as identifying the prenatal care codes in their data systems that would need to be switched to cost avoidance payment procedures, or researching the best way to implement these changes. Officials from one state said they were in the process of assessing what the likely impact of these changes on beneficiaries and providers would be, and would only subject claims for prenatal care services to cost avoidance if they determined that doing so was the best course of action. Officials from one state indicated that they were waiting to determine whether it was more cost effective to implement these changes in their legacy MMIS, or wait and implement the changes in the new MMIS they are planning to roll out in the future. State Medicaid officials also described other efforts that they would need to undertake as they implemented these changes to third-party liability. These included staff retraining and communicating the changes to providers in their states. Beyond state Medicaid programs, officials from the five Medicaid MCOs we interviewed all stated that their organizations had not yet implemented the prenatal care third-party liability changes. The MCO officials stated that they were waiting for additional instructions on how to implement the third-party liability changes or for revised contract language from their state Medicaid agencies. Officials from one of the MCOs noted they were not aware of the third-party liability changes until we reached out to them for an interview. Officials from two MCOs we interviewed generally agreed that the third-party liability changes for prenatal care services would require changes to claims processing systems and internal processes, but would not be significant. Several MCO officials noted that these changes would likely result in some cost-savings to MCOs in the future. Most Selected States Were in Early Stages of Planning Implementation of Third-Party Liability Payment Changes for Pediatric Preventive Services and Services to CSE Beneficiaries Medicaid officials from six of the nine selected states noted that they were in the very early stages of planning whether—or how—they would implement the wait-and-see periods for pediatric preventive services and services to CSE beneficiaries. For example, some Medicaid officials from these six states described how they were assessing what changes would need to be made to their MMIS, deciding whether to implement the wait-and-see periods, or exploring how to assess the potential impact of these changes. Some Medicaid officials also expressed uncertainty regarding how such changes would affect Medicaid beneficiaries or the amount of effort required by their agency to implement the third-party liability changes. Officials from one state noted that they had begun discussions about implementing the third-party liability changes for both pediatric preventive services and services for CSE beneficiaries in June 2018, and were in the process of identifying the necessary system changes needed to implement third-party liability changes by the October 2019 effective date. Officials from two of these states stated that they do not believe their state will implement the wait-and-see periods for pediatric preventive services or CSE beneficiaries when the changes go into effect. Officials from the remaining three states noted at the time of our interviews they had not yet developed plans for assessing implementation of these changes. Table 2 summarizes the status of selected states’ implementation of the third-party liability changes. For pediatric preventive services, state Medicaid officials generally noted that the third-party liability changes would involve identifying the relevant codes and making changes to their MMIS to ensure those claims were subject to a wait-and-see period, if implemented. Several state Medicaid officials characterized this effort as “significant” or “difficult.” For services delivered to CSE beneficiaries, officials from several state Medicaid agencies speculated that making the third-party liability changes to their MMIS would necessitate having some sort of indicator in their system to identify which claims were for the CSE beneficiaries and, therefore, should be subject to a wait-and-see period, if implemented. Some state Medicaid agency officials said that this would require obtaining the information from another state agency responsible for administering CSE agreements. Several of the state Medicaid officials we interviewed expressed concerns regarding how to implement the wait-and-see periods for pediatric preventive services and services for CSE beneficiaries. Specifically, these officials noted that—within their MMIS—it is not possible to capture on a Medicaid claim when a provider has billed a third party, waited a specified amount of time, and not received payment. As a result, officials from one state noted that additional guidance from CMS on how to implement and track provider billing of third parties—including wait-and-see periods and providers’ collection of payment—would be necessary before moving forward with implementing the third-party liability changes. Officials from two states said that the administrative burden associated with these changes would possibly make them not cost-effective to implement. However, MCO officials we interviewed generally acknowledged that while these changes would require changes to their claims processing systems and internal processes, they were not significant and could potentially result in some cost-savings to their MCO in the future. The third-party liability change affecting all Medicaid services provided to CSE beneficiaries was a particular concern for officials from three state Medicaid agencies and three MCOs. Specifically, these officials said there is currently no way to identify CSE beneficiaries in their MMIS or claims processing systems, which could potentially make this change difficult, if not impossible, to implement. Officials from one state described how setting up a system to receive this information would involve a significant effort, potentially necessitating new hardware and system modifications, as well as a data sharing agreement with the state entity maintaining the CSE information. Officials from one MCO noted that the third-party liability changes affecting CSE beneficiaries was a particular concern, because those changes would potentially require additional administrative work and changes to their processes in order for providers in their network to track down insurance information from a non-custodial parent. CMS Has Issued Implementing Guidance with Information Inconsistent with Federal Law and Has Not Overseen States’ Implementation of Third-Party Liability Changes CMS’s Implementing Guidance Contains Information Inconsistent with Provisions of Federal Law Related to Medicaid Third-Party Liability After enactment of the Bipartisan Budget Act of 2018 in February 2018, CMS issued guidance in the form of an informational bulletin to states on June 1, 2018, to facilitate states’ implementation of the key provisions of the Bipartisan Budget Act of 2018 related to third-party liability in Medicaid. However, CMS’s June informational bulletin is missing some key information and contains information that is inconsistent with the federal law. This is inconsistent with CMS’s responsibility for ensuring states’ compliance with federal requirements. In particular, Pregnancy-related claims. Under federal law, states must apply standard cost avoidance procedures to all non-pediatric claims, including claims for prenatal services beginning in February 2018. However, CMS guidance indicates that a state need not apply cost avoidance procedures to claims for labor and delivery services if those claims can be differentiated from prenatal services. The guidance also provides that, effective October 1, 2019, states will have 90 days to pay claims related to labor, delivery, and postpartum care claims. As a result, CMS’s guidance is inconsistent with federal law, which requires states to reject any such claim under cost avoidance procedures until the third-party liability is resolved, regardless of how many days that might take. Pediatric preventive claims. Under federal law, states must generally apply pay-and-chase procedures to pediatric preventive services. However, beginning in October 2019, states are permitted to implement a 90-day wait-and-see period before making payment for these services if the state determines that it would be cost-effective and would not adversely affect access to care to do so. However, CMS guidance simply provides that states will have 90 days to pay such claims, suggesting that states need not make the cost- effectiveness or access determinations required by statute. CSE beneficiary claims. Under federal law, beginning in October 2019, for claims for services to CSE beneficiaries, states may choose to make payment within 30 days (as opposed to implementing a 100- day wait-and-see period), if the state determines doing so is cost- effective and necessary to ensure access to care. If the state does not make such a determination, the statute would require the state to avoid making payment for such services for up to 100 days to allow third parties to make payment first. However, CMS guidance does not identify this as an option for states. Instead, CMS guidance simply provides states with the option of implementing the wait-and-see period, omitting the option for states to make payment within 30 days. CMS officials told us that the Bipartisan Budget Act of 2018 did not change state responsibilities related to cost-effectiveness and access to care, and CMS does not intend to issue additional guidance on this issue. However, prior to enactment of the Bipartisan Budget Act of 2018 in February 2018, federal third-party liability law did not authorize states to apply cost avoidance procedures to preventive pediatric claims or pediatric services provided to CSE beneficiaries. Furthermore, other CMS guidance documents, such as the third-party liability handbook and CMS regulations on third-party liability, are out of date and not a reliable source of information for states to use in implementing the new federal third-party liability requirements. In particular, the third-party liability handbook was last revised in 2016 and does not reflect the Bipartisan Budget Act of 2018 changes. Additionally, CMS regulations implementing federal requirements for state payment of claims for prenatal care, labor and delivery services, postpartum care, preventive pediatric services, and services to CSE beneficiaries were last amended in 1997 and, accordingly, do not reflect current statutory requirements, including the Bipartisan Budget Act of 2018 requirement to cost avoid prenatal and other non-pediatric claims beginning February 2018. CMS officials told us the agency is in the process of updating its third- party liability handbook and anticipates issuing the updated document in September 2019. Agency officials also told us they plan to revise the agency’s regulations regarding pay-and-chase and release the revised regulations in early 2020. However, federal law requires state Medicaid plans to provide for proper third-party liability procedures, which states often carry out through references to federal regulation, according to CMS officials. Without updated third-party liability guidance that is timely, complete, and consistent with federal law, states may lack the necessary information to update their state Medicaid plans so that they comply with these requirements. CMS Has Not Overseen States’ Implementation of Third-Party Liability Changes CMS has not taken steps to determine the extent to which state Medicaid agencies are meeting the third-party liability requirements, and therefore CMS officials were unaware of whether states were meeting the new requirements. In particular, CMS officials did not know the extent to which the selected states in our review had implemented the required third-party liability changes. In our interviews with nine selected state Medicaid agencies conducted between November 2018 and March 2019, we learned that five states continued to apply pay-and-chase procedures to prenatal care claims, despite the federal requirement to implement cost avoidance since February 2018. During our interviews, we also learned that CMS had not monitored state Medicaid agencies’ third-party liability approaches prior to the Bipartisan Budget Act of 2018. For example, officials from one of the selected states told us that they had been using cost avoidance for most claims for pediatric preventive care, rather than applying pay-and-chase procedures, as required by law. We also learned from an official from another selected state that the state had been applying cost avoidance procedures to claims for prenatal care services well in advance of the enactment of the Bipartisan Budget Act of 2018, despite the federal requirement to apply pay-and-chase procedures to such claims from 1986 to 2018. CMS’s failure to monitor the implementation of the third-party liability changes in the Bipartisan Budget Act of 2018 is inconsistent with the agency’s responsibilities for oversight of the Medicaid program, including ensuring that federal funds are appropriately spent. We have previously recommended that, given the significant federal Medicaid outlays, the federal government has a vested financial interest in further increasing states’ third-party liability cost savings, and that CMS should play a more active leadership role in monitoring, understanding, supporting, and promoting state third-party liability efforts. However, CMS officials stated that they expect states to comply with current law for Medicaid third-party liability, and that they do not verify whether states have implemented the required third-party liability changes unless the agency is made aware of non-compliance. When asked how CMS ensures that states apply pay-and-chase procedures required under federal law, such as for pediatric preventive claims, CMS officials stated that it is the agency’s expectation that states comply with current law. According to agency officials, if a state has difficulty complying and reaches out to CMS for technical assistance, the agency will work with that state to come into compliance. CMS officials told us that CMS plans to review all state Medicaid plans and provide technical assistance for any necessary action only after the agency has updated its regulations related to third-party liability. As of May 2019, CMS anticipated that it would release updated regulations in early 2020. Because CMS has not monitored states’ compliance with federal third- party liability requirements, the agency does not know whether states have applied the federally required third-party liability procedures to certain Medicaid claims as required by federal law. In the case of prenatal care services claims, the failure to implement cost avoidance payment procedures could result in unnecessary Medicaid expenditures, to the extent that Medicaid pays providers for services for which a third party is liable. To the extent that states are not properly applying pay-and-chase procedures to pediatric preventive service claims, children’s access to such services could be impacted. Stakeholders Anticipate Third-Party Liability Changes Could Affect Beneficiary Access to Care; Selected States Discussed Using Existing Methods to Assess Effects of Changes Most Stakeholders Anticipate Increased Administrative Requirements for Providers and a Possible Decrease in Beneficiary Access to Care According to most of the stakeholders we interviewed, Medicaid providers—especially prenatal care and rural providers—could face increased administrative requirements or delays in payments for services as a result of the third-party liability payment changes to the three service categories in the Bipartisan Budget Act of 2018. Several stakeholders agreed that the tasks associated with identifying sources of third-party liability and attempting to collect from third parties would shift from state Medicaid agencies to providers as a result of the payment changes, although opinions differed on the extent to which this shift would affect providers. Several stakeholders said that the third-party liability changes could increase administrative requirements for providers, because obtaining accurate information on third-party liability sources for Medicaid beneficiaries and resubmitting claims that result from incorrect or outdated third-party liability information can be resource intensive and time consuming. One provider and officials from one state Medicaid agency noted that providers may lack the administrative resources or claims-processing expertise to deal with these changes. Officials from one state Medicaid agency, two state provider associations, and an organization advocating for Medicaid beneficiaries also noted that providers may encounter Medicaid beneficiaries who may be unaware or may not disclose that they have other insurance policies; for example, children who are covered under multiple insurance policies by custodial and non-custodial parents or experience insurance transitions following birth. These issues may increase the amount of time and resources providers spend on processing and resubmitting claims. Other stakeholders were less certain that the added requirements would cause difficulties for providers. Officials from one state Medicaid agency and one MCO said that the payment changes would not be difficult to implement, because providers were familiar with billing third parties for medical services for other beneficiaries. Officials from four state Medicaid agencies and two MCOs noted that providers may prefer to submit claims to commercial insurers, because these insurers pay at a higher rate compared with state Medicaid programs. Several stakeholders we interviewed agreed that providers could wait longer periods of time for payment as they track down third-party insurers or wait up to 100 days for potential payment from these insurers before seeking payment from the state Medicaid agency. According to one provider and officials from two provider associations and one MCO, these delays could put providers at risk of not receiving payments for services or not having enough cash on hand to sustain operations. Additionally, officials from three provider associations noted that payment delays would affect pediatric providers in particular, because the majority of the services that pediatricians provide are preventive care—which would be affected by the third-party liability changes. According to several stakeholders we interviewed, smaller or independent providers and those located in rural areas could be more affected by the third-party liability changes compared with providers affiliated with managed care systems or those located in urban areas. Officials from one state Medicaid agency, two provider associations, and one MCO noted that smaller or rural-based providers generally have fewer staff and resources to deal with the larger volume of administrative paperwork and delays in payment for services that could result from the payment changes. Most of the stakeholders we interviewed said that providers might be less willing to serve Medicaid beneficiaries due to the administrative and payment issues, potentially reducing access to care or delaying services for children and pregnant women. However, some other stakeholders said that the third-party liability changes would have little to no effect on Medicaid beneficiaries. Officials from one state Medicaid agency and one MCO noted that third-party liability payment practices for other Medicaid populations and services have been in place for many years, and providers would already be familiar with processing claims with third-party liability. Several stakeholders said that providers may opt to reduce or eliminate the number of Medicaid beneficiaries they serve, because of actual or perceived increase in administrative requirements or payment delays. Officials from three state provider associations speculated that the potential for additional delays in payment for services could be the “final straw” in providers’ decision to stop serving Medicaid beneficiaries. Other stakeholders, including a Medicaid expert, one provider, and officials from one state provider association noted that providers may decide to see fewer Medicaid beneficiaries, but are unlikely to stop seeing them entirely, because some providers are reluctant to deny care to these beneficiaries. Payment delays could also lead to delays in beneficiaries receiving time- sensitive services, such as immunizations, as well as reduced access to specialists, such as midwives or mental health professionals, according to several stakeholders. Officials from one national provider association and an organization advocating for Medicaid beneficiaries noted that providers may seek to identify sources of third-party liability before providing services to beneficiaries. In addition, officials from one state Medicaid agency, a state provider association, and an organization advocating for Medicaid beneficiaries expressed concern that the third-party liability changes had the potential to reduce access to care for populations, such as children and pregnant women, that already faced challenges in accessing adequate, timely, or quality health care. Selected States Discussed Using Existing Methods for Assessing Provider Availability and Beneficiary Access to Care Once Payment Changes Are Implemented Medicaid officials we interviewed from seven of the nine selected states said that their agencies will—or could—use existing methods to assess the effects of the third-party liability changes on provider availability and beneficiary access to prenatal care services, pediatric preventive services, and services for CSE beneficiaries. Officials from the remaining two states did not discuss or provide information on how they could assess the effects of the changes. Medicaid officials provided examples of existing methods that could be used to assess the effects of payment changes: Tracking beneficiary access by comparing a set of access-to-care measures for a state’s Medicaid population with its non-Medicaid, commercially insured population, as well as carrying out customer satisfaction surveys with Medicaid beneficiaries, Using a third-party liability hotline to track patient issues and conducting secret shopper calls to monitor if providers are accepting new patients, Contracting with a state university to evaluate Medicaid beneficiary access for prenatal and pediatric services. In addition, one state has an independent health advocacy agency that monitors and seeks to resolve provider availability and beneficiary access issues on behalf of the state’s Medicaid population. However, one state Medicaid official and a Medicaid expert agreed that measuring any possible effects of the third-party liability changes—such as a decline in provider availability or beneficiary access—would be difficult without baseline data. According to officials from two state Medicaid agencies and a Medicaid expert, many other factors could potentially affect provider availability and beneficiary access, making it difficult or impossible to pinpoint if a decline in provider availability or beneficiary utilization of services was the result of the third-party liability changes or something else—such as changes in the managed care market or levels of private coverage among beneficiaries. We found other evidence suggesting that it might be challenging for some states to assess the effects of the third-party liability changes. Specifically, Medicaid officials from eight of the nine selected states did not readily identify the number of beneficiaries in their state that had third- party liability and would be affected by the changes. Moreover, officials from two states noted that obtaining this data would require a “significant” effort. Officials from five states shared information on the number of children, pregnant women, or births covered by Medicaid in their state, but did not specify how many of these beneficiaries had other insurance coverage. Seven of the nine selected states had no data readily available on CSE beneficiaries who were also covered by Medicaid. In several cases, officials noted that their MMIS or other data systems had no way to track whether a child was a CSE beneficiary. Conclusions Omissions and inaccuracies in CMS’s guidance to states on third-party liability changes from the Bipartisan Budget Act of 2018 have the potential to adversely affect the extent to which Medicaid expenditures are being used to pay for services for which a third party is liable, as well as states’ compliance with federal requirements. Furthermore, CMS has not assessed whether state Medicaid agencies are complying with federal third-party liability requirements, under which states must change how they pay claims for certain services as a result of the Bipartisan Budget Act of 2018 and subsequently enacted legislation. In the absence of CMS overseeing states’ compliance, the agency cannot ensure that federal funds are being spent properly and that states are complying with current federal statute. Recommendations We are making the following two recommendations to CMS: The Administrator of CMS should ensure the agency’s Medicaid third- party liability guidance is consistent with federal law related to the requirement for states to apply cost avoidance procedures to claims for labor, delivery, and postpartum care services, the requirement for states to make payments without regard to potential third-party liability for pediatric preventive services unless the state has made a determination related to cost-effectiveness and access to care that warrants cost avoidance for 90 days, and state flexibility to make payments without regard to potential third- party liability for pediatric services provided to child support enforcement beneficiaries. (Recommendation 1) The Administrator of CMS should determine the extent to which state Medicaid programs are meeting federal third-party liability requirements and take actions to ensure compliance as appropriate. Such actions can include ensuring that state plans reflect the law. (Recommendation 2) Agency Comments We provided a draft of this report to the Department of Health and Human Services for comment. In its written comments, which are reprinted in appendix I, HHS concurred with our recommendations and indicated a commitment to providing states with accurate guidance on the third-party liability changes in the Bipartisan Budget Act of 2018. The agency noted that it is in the process of updating its guidance and third-party liability handbook to reflect the changes and ensure that such guidance is consistent with federal law. The agency also noted that it will determine the extent to which state Medicaid programs are meeting federal third- party liability requirements and will take actions to ensure compliance. We are sending copies of this report to the appropriate congressional committees, the Secretary of Health and Human Services, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7114 or yocomc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs can be found on the last page of this report. Major contributors to this report are listed in appendix II. Appendix I: Comments from the Department of Health and Human Services Appendix II: GAO Contacts and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Tom Conahan (Assistant Director), Andrea E. Richardson (Analyst-in-Charge), Marybeth Acac, Drew Long, Corinne Quinones, Jennifer Rudisill, and Ethiene Salgado- Rodriguez made key contributions to this report.


Background Overview of U.S. Pipeline System The national pipeline system consists of more than 2.7 million miles of networked pipelines transporting natural gas, oil, and other hazardous liquids. Natural gas and hazardous liquid pipelines—primarily buried underground in the continental United States—run under remote and open terrain, as well as densely-populated areas. There are three main types of pipelines based on the types of materials transported: Hazardous liquid: About 216,000 miles of hazardous liquid pipeline transport crude oil, diesel fuel, gasoline, jet fuel, anhydrous ammonia, and carbon dioxide. Natural gas transmission and storage: About 319,000 miles of pipeline—mostly interstate—transport natural gas from sources to communities. Natural gas distribution: About 2.2 million miles of pipeline—mostly intrastate—transport natural gas from transmission sites to consumers. Figure 1 depicts the network of hazardous liquid and natural gas transmission pipelines in the United States. More than 3,000 pipeline companies operate the nation’s pipeline systems, which can traverse multiple states and the U.S. borders with Canada and Mexico. Many pipeline systems are comprised of the pipelines themselves, as well as a variety of facilities, such as storage tanks, compressor stations, and control centers. Most pipeline systems are monitored through automated industrial control systems or Supervisory Control and Data Acquisition (SCADA) systems using remote sensors, signals, and preprogramed parameters to activate and deactivate valves and pumps to maintain flows within established tolerance levels. Threats to Pipeline Safety and Security Pipeline accidents can occur from a variety of causes, including third- party excavation, corrosion, mechanical failure, control system failure, and operator error. Natural forces, such as floods and earthquakes, can also damage pipelines. Although pipeline releases have caused relatively few fatalities, a single pipeline accident can be catastrophic in terms of public safety and environmental damage. Figure 2 shows notable pipeline accidents since September 2010. According to TSA, pipelines are also vulnerable to physical attacks by crude or unsophisticated tactics, such as rudimentary explosives, arson, or equipment sabotage—largely due to their stationary nature, the volatility of transported products, and the dispersed nature of pipeline networks spanning urban and outlying areas. Threats to the nation’s pipeline systems include sabotage by activists, physical attack by terrorists, and cyber attack or intrusion by nations. In October 2016, environmental activists forced the shutdown of five crude oil pipelines in four states: Minnesota, North Dakota, Montana, and Washington State. Further, in January 2019, the Director of National Intelligence stated that China has the ability to launch cyber attacks that have caused localized, temporary disruptive effects on critical infrastructure—such as disruption of a natural gas pipeline for days to weeks—in the United States. Key Critical Infrastructure Protection Guidance and Presidential Directives Federal policy and public-private plans establish the roles and responsibilities for the protection of critical infrastructure, including pipelines. These policies and public private plans include Presidential Policy Directive /PPD-21 (PPD-21) and the National Infrastructure Protection Plan (NIPP). PPD-21, issued in February 2013, was developed to advance a national unity of effort to strengthen and maintain secure, functioning, and resilient critical infrastructure, which includes pipelines. PPD-21 reflects an all-hazards approach to protecting critical infrastructure, by accounting for the protection of critical infrastructure from natural or manmade threats or incidents. Examples of threats or incidents include natural disasters, cyber incidents, industrial accidents, pandemics, acts of terrorism, sabotage, and destructive criminal activity targeting critical infrastructure. PPD-21 also identifies the 16 critical infrastructure sectors and assigns roles and responsibilities for each sector among nine designated federal sector-specific agencies as shown in Figure 3. While PPD-21 identifies the critical infrastructure sectors and assigns responsibility for each sector’s sector-specific agency, the NIPP outlines critical infrastructure stakeholder roles and responsibilities regarding critical security and resilience. The NIPP describes a voluntary partnership model as the primary means of coordinating government and private sector efforts to protect critical infrastructure. As part of the partnership structure, the designated sector-specific agencies serve as the lead coordinators for security programs of their respective sector. For example, DHS and DOT are designated as co-sector-specific agencies for the transportation systems sector, which includes pipelines. Each sector also has a government coordinating council, consisting of representatives from various levels of government, and many have a sector coordinating council (SCC) consisting of owner-operators of these critical assets or members of their respective trade associations. For example, the Transportation Government Coordinating Council has been established, and the Pipeline Modal SCC has also been established to represent pipeline operators. Pipeline Stakeholder Roles and Responsibilities Protecting the nation’s pipeline systems is a responsibility shared by both the federal government and private industry. As a result, several federal departments, agencies, and the private sector have significant roles in pipeline safety and security. The entities primarily responsible for pipeline safety and security are included below. Transportation Security Administration (TSA). TSA has primary oversight responsibility for the physical security and cybersecurity of transmission and distribution pipeline systems. Within TSA, the Policy, Plans, and Engagement’s Pipeline Security Branch is charged with overseeing its pipeline security program. Pursuant to the Implementing Recommendations of the 9/11 Commission Act of 2007 (9/11 Commission Act), TSA’s Pipeline Security Branch issued voluntary Pipeline Security Guidelines in 2011, and released revised guidelines in March 2018. Further, in accordance with the 9/11 Commission Act, TSA’s Pipeline Security Branch also identifies the top 100 critical pipeline systems in the nation. TSA also ranks the relative risk among these top 100 systems. Additionally, the Pipeline Security Branch is responsible for conducting voluntary security reviews, which assess the extent to which these 100 pipeline systems are following the intent of TSA’s Pipeline Security Guidelines. Pipeline and Hazardous Materials Safety Administration (PHMSA). PHMSA, within DOT, is responsible for regulating the safety of hazardous materials transportation and the safety of pipeline systems, some aspects of which may relate to pipeline security. PHMSA develops regulations for domestic interstate and intrastate natural gas and hazardous liquid pipelines. Its regulatory programs are focused on ensuring safety in the design, construction, operation, and maintenance of pipelines. Under PHMSA’s pipeline safety program, pipeline operators have primary responsibility for ensuring the integrity of their pipelines. PHMSA and some state pipeline safety offices are responsible for conducting inspections to oversee operators’ compliance with federal pipeline safety regulations and other federal requirements. Inspectors from PHMSA’s five regional offices and states are responsible for inspecting nearly 3,000 companies that operate 2.7 million miles of pipelines. Private sector. Although TSA has primary federal responsibility for overseeing interstate pipeline security, private sector and publicly-owned pipeline operators are responsible for implementing asset-specific protective security measures. As we previously reported, since the September 11th terrorists attacks, operators have increased their attention on security by incorporating security practices and programs into their overall business operations. Pipeline operators’ interests and concerns are primarily represented by five major trade associations—the Interstate Natural Gas Association of America, American Gas Association, American Public Gas Association, American Petroleum Institute (API), and Association of Oil Pipe Lines. According to TSA officials, pipeline operators, and association representatives, these associations have worked closely with the federal government on a variety of pipeline security-related issues, including collaborating on TSA’s voluntary standards and information sharing. MOU Annex Delineates Pipeline Security Roles and Responsibilities But Has Not Been Reviewed to Consider Pipeline Security Developments Since 2006 MOU Annex Delineates Pipeline Security and Safety Roles and Responsibilities The MOU Annex delineates TSA and PHMSA mutually agreed-upon pipeline security roles and responsibilities, consistent with their respective missions, and acknowledges that both agencies benefit by sharing each other’s expertise, among other things. Specifically, the MOU Annex identifies 11 program areas, where TSA and PHMSA agreed to coordinate their respective roles and responsibilities. The first program area for example, calls for both agencies to coordinate efforts to identify critical infrastructure, and to share relevant data and observations found during respective safety inspections and security assessments. Another program area addresses coordination in developing transportation security standards, regulations, guidelines, or directives. The MOU Annex further provides that TSA and PHMSA are to seek early and frequent coordination in developing such standards, regulations, guidelines, or directives. They are also to review the adequacy of existing standards in the private and public sector, and identify any gaps that should be addressed through rulemaking, guidelines, or directives, among other items. For a complete listing of the MOU Annex’s 11 program areas, including TSA and PHMSA roles and responsibilities and agreed-upon actions, see appendix I. TSA and PHMSA Do Not Have Timeframes for Reviewing the MOU Annex to Assess Pipeline Security Roles and Responsibilities TSA and PHMSA have both noted various developments that have occurred since 2006 that may affect their roles and responsibilities related to pipeline security. However, the MOU Annex has not been updated since its inception in 2006 to consider incorporating these changes which includes subsequently issued presidential directives, the establishment of the Cybersecurity Infrastructure and Security Agency (CISA), and distinctions between current TSA and PHMSA current inspection operations. As a result, the Annex is not current and may not fully reflect the agencies’ pipeline safety and security-related activities. For example, Homeland Security Presidential Directive/HSPD-7 (HSPD-7), which is cited as an underlying authority in both the 2004 MOU and 2006 MOU Annex was revoked and replaced by PPD-21 in 2013. According to PPD-21, the directive advances a national unity of effort to strengthen and maintain secure, functioning, and resilient critical infrastructure by, among other things, refining and clarifying critical infrastructure-related functions, roles, and responsibilities across the federal government. PPD- 21 further provides, however, that plans developed pursuant to HSPD-7 shall remain in effect until specifically revoked or superseded. According to TSA and PHMSA officials, statements of Executive Branch policy including presidential directives such as PPD-21 include changes that could impact their pipeline security and safety roles and should be considered in any future revisions to the MOU Annex. Further, PHMSA officials also told us that TSA and PHMSA’s roles and responsibilities in identifying critical infrastructure should be reviewed given the establishment of the CISA in November 2018. CISA, formerly the DHS National Protection and Programs Directorate, is responsible for, among other things, coordinating a national effort to secure and protect against critical infrastructure risks. These responsibilities include coordinating with sector-specific agencies to carry out its cybersecurity and critical infrastructure activities. TSA and PHMSA officials stated that they have closely coordinated in identifying critical infrastructure when responding to past national emergencies. For example, TSA identified and provided PHMSA with information on the pipelines that supplied fuel to specific airports during the hurricane seasons in 2017 and 2018. However, PHMSA officials stated that both TSA and PHMSA should consider reviewing how these types of efforts may need to be coordinated with CISA in the future and whether any adjustments to respective roles and responsibilities in the MOU Annex are needed. In addition, representatives from all of the industry associations that we interviewed stated that the agreement should be revised to consider how the establishment of CISA may impact current TSA and PHMSA pipeline security roles and responsibilities. TSA officials stated that they do not believe that the establishment of CISA impacts TSA’s roles and responsibilities for identifying pipeline critical infrastructure. While CISA may or may not have impacts on TSA and PHMSA’s pipeline security roles, reviewing the MOU Annex in light of new developments, such as the CISA, would allow the TSA and PHMSA to determine whether updates are necessary. TSA and PHMSA officials stated that distinctions in current inspections and enforcement operations necessitate a revision to the MOU Annex. The MOU Annex states that agencies are to explore opportunities for collaboration in inspection and enforcement activities. According to TSA and PHMSA officials, they have since explored the possibility for conducting joint activities and found that distinctions in their respective operating environments and roles and responsibilities do not allow for joint inspection and enforcement activities. For example, PHMSA conducts physical inspections of facilities to assess pipeline operators’ compliance with pipeline safety regulatory requirements and relies on a range of enforcement activities, such as civil penalties to ensure that pipeline operators correct safety violations and prevent safety problems. TSA, however, conducts voluntary security assessments of pipeline’s corporate security programs and critical facilities and relies on pipeline operators’ willingness to participate and implement recommended changes to improve pipeline security. As a result, TSA and PHMSA officials stated that pipeline operators are reluctant to participate in a voluntary assessment that might include PHMSA inspectors because they represent a regulatory agency. TSA, PHMSA and industry association representatives we interviewed agreed that the annex should be updated to accurately reflect current distinctions in the agencies’ roles and responsibilities and their respective operating environments. PHMSA officials stated that they had planned to review the MOU Annex in 2018 to assess current roles and responsibilities and determine whether any updates to the MOU Annex were needed, but efforts were delayed because of competing priorities such as addressing the aftermath of major hurricanes in 2017 and 2018. Specifically, TSA and PHMSA had agreed to an initial list of timeframes for reviewing the MOU Annex and these timeframes called for the agencies to complete the MOU Annex revision in 2018. However, as of March 2019, TSA and PHMSA have yet to complete the review and although both agencies stated that the review is ongoing, neither agency could provide updated timeframes for completion. Furthermore, while the Annex recognizes that TSA and PHMSA may propose agreed-upon amendments or modifications to the agreement, it does not call for regular or periodic reviews to identify whether any updates or revisions are needed and, as appropriate, implemented. TSA and PHMSA officials, as well as the industry association representatives we interviewed all reported that the MOU Annex helped to coordinate pipeline security and safety efforts because: (1) it is a signed written agreement that can be readily consulted; (2) it memorialized respective TSA and PHMSA roles and responsibilities for government leaders and staff at the time; and (3) it can be modified or amended as needed. Standards for Internal Control in the Federal Government states that periodic review of policies, procedures, and related control activities should occur to determine their continued relevance and effectiveness in achieving identified objectives or addressing related risks. In addition, documentation of any changes made as a result of such reviews, such as changes to an entity’s roles and responsibilities or in technology, should occur to ensure that such controls are clear over time as staff change within an organization. Standards for project management state that managing a project involves, among other things, developing a timeline with milestone dates to identify points throughout the project to reassess efforts under way to determine whether project changes are necessary. By developing and implementing mutually agreed upon time frames for reviewing the annex and updating it, as appropriate, TSA and PHMSA could better ensure that the roles and responsibilities for TSA and PHMSA remain current. Additionally, including a provision in the annex for periodically reviewing for needed updates would help ensure the agreement consistently reflects relevant and updated information on TSA and PHMSA’s roles and responsibilities. TSA and PHMSA Communicate Their Roles through Guidelines and Other Methods, and Selected Industry Stakeholders Reported the Agencies’ Roles Are Clear TSA and PHMSA have communicated their respective pipeline safety and security roles and responsibilities by issuing pipeline security guidance and safety regulations, issuing a joint advisory bulletin, and maintaining informal contacts with pipeline stakeholders when conducting outreach activities, pipeline security assessments, or safety inspections. TSA security guidelines. TSA’s Pipeline Security Branch first issued its voluntary Pipeline Security Guidelines in 2011, and revised them in March 2018. The guidelines include TSA’s recommendations for pipeline industry security practices, such as establishing a corporate security program, conducting security vulnerability assessments, and identifying critical facilities. The guidelines also recommend facility security and cybersecurity measures, which serve as the basis for the pipeline security assessments conducted by TSA’s Pipeline Security Branch. PHMSA regulations. PHMSA’s Office of Pipeline Safety issues and enforces intrastate and interstate regulations covering aspects of pipeline safety, including the design, construction, operation and maintenance, and spill response for hazardous liquid and gas pipeline facilities, including liquefied natural gas facilities. Advisory bulletins. PHMSA also issues advisory bulletins to communicate safety-related conditions to pipeline operators, and can issue advisory bulletins in coordination with TSA to notify pipeline operators of a security incident. Such bulletins may include identifying the affected operators, describing the threat, and providing information on federal resources for assistance. For example, in response to physical intrusions on pipelines and a coordinated campaign by domestic saboteurs, and to remind pipeline operators of the importance of safeguarding and securing their pipelines from physical and cyber intrusion or attack, PHMSA, in coordination with TSA, issued an advisory bulletin in 2016. The bulletin also included a brief discussion of TSA’s and PHMSA’s roles on pipeline safety and security. Forums and routine interactions with operators. TSA and PHMSA officials also reported that they communicate their agencies’ respective roles and responsibilities for pipeline safety and security to stakeholders when conducting general outreach, information sharing efforts, or inspections or assessments. TSA and PHMSA officials noted that these activities provide opportunities for agency officials and pipeline stakeholders to clarify their roles and responsibilities should pipeline operators have questions. Examples of such community outreach activities include attending meetings of the Oil and Natural Gas subsector SCC or the Pipeline Modal SCC, and TSA’s annual International Pipeline Security Forum. TSA officials also said that TSA’s monthly and quarterly unclassified threat briefings provided TSA officials and pipeline stakeholders the opportunity to discuss and clarify their roles and responsibilities. Additionally, TSA produces classified and unclassified threat assessments on physical and cyber threats to pipelines, which according to agency officials can help to clarify TSA’s security role. Finally, TSA and PHMSA officials said that pipeline security assessments and safety inspections and other enforcement activities that the agencies regularly conduct are also opportunities to communicate their roles and responsibilities. For example, TSA officials reported that should an operator ask for assistance regarding a safety issue while TSA staff was conducting a security review, TSA staff would be able to refer the operator to PHMSA to address the issue. Similarly, PHMSA officials stated that inspectors would refer an operator to TSA or its pipeline security guidelines should the operator have questions regarding, for example, what security measures to implement. The representatives of the four pipeline associations we interviewed reported that TSA and PHMSA had clearly communicated their respective roles and responsibilities to pipeline stakeholders. Specifically, all of the association representatives said that their membership understood that TSA is responsible for pipeline security matters and PHMSA is responsible for pipeline safety matters. For example, one industry association representative stated that they had contacted their members to determine whether they were unclear regarding TSA’s and PHMSA’s respective roles and responsibilities and that members reported the roles were clear to them. Further, another association representative reported that the initial security reviews and outreach efforts that TSA conducted after the pipeline security program was created helped pipeline operators to understand that its role was to oversee pipeline security. In addition, all of the association representatives we interviewed stated that the MOU Annex helped ensure that TSA and PHMSA understood and respected each other’s roles and responsibilities. As a result, according to the association representatives, their pipeline operator membership had not experienced challenges associated with overlapping or duplicative efforts on the part of TSA and PHMSA pipeline safety or security programs. TSA Communicated Pipeline Incident Response Protocols in Its 2010 Plan, but Has Not Updated the Plan to Address Changes in Key Areas TSA Has Established a Pipeline Incident Response Protocol Plan That Communicates Agencies’ Roles and Responsibilities During Pipeline Incidents In accordance with the 9/11 Commission Act, TSA issued its Pipeline Security and Incident Recovery Protocol Plan in March 2010. The plan’s stated intent is to establish a comprehensive interagency approach to counter risks, coordinate federal agencies’ actions, and minimize the consequences of incidents involving pipeline infrastructure as well as recovery time from them. The plan also defines the roles and responsibilities of federal agencies; tribal, state, and local governments; and the private sector during a pipeline incident. It also defines the measures they may take related to pipeline infrastructure security incidents. According to the plan TSA, PHMSA, the Department of Energy (DOE), and the Federal Bureau of Investigation (FBI) have principal roles in pipeline incident response, while other agencies such as the U.S. Coast Guard, the Federal Emergency Management Agency (FEMA), and the National Transportation Safety Board (NTSB) have supporting roles. The following are examples of agencies’ roles and responsibilities in each of the plan’s three response phases. Prevention/protection. TSA is responsible for monitoring pipeline owner and operators’ implementation of its pipeline security guidelines, and PHMSA is responsible for enforcing its pipeline safety regulations. TSA, in addition to the FBI, is responsible for assessing the credibility of any physical or cyber threat information it receives and sharing any intelligence related to pipeline security with pipeline owners and operators. Response. TSA is responsible for coordinating information sharing between federal agencies and pipeline stakeholders, and PHMSA is responsible for coordinating federal agency activities with the affected pipeline operator and state pipeline safety agency. The plan also states that the FBI is responsible for investigating attempted or successful attacks on pipeline infrastructure including those that are believed to have a nexus to terrorism. Recovery. PHMSA is primarily responsible for working with the pipeline operator, along with other supporting federal agencies, to facilitate service restoration. DOE is responsible for monitoring flows of throughput in the affected pipeline system or systems, assessing regional, national, and global impacts of an incident on energy infrastructure throughout all three phases. Appendix I provides more details on key federal agencies’ and pipeline operators’ roles and responsibilities, as well as the actions they may take in response to an incident as detailed in the plan. TSA Has Not Updated Its Incident Response Plan to Address Changes in Pipeline Security Threats, Technology, and Federal Laws and Policies TSA’s plan states that it will be updated periodically to address changes in pipeline security threats, technology, and federal laws and policies. Further, Standards for Internal Control in the Federal Government states that periodic review of policies, procedures, and related control activities should occur to determine their continued relevance and effectiveness in achieving identified objectives or addressing related risks. In addition, internal control standards also states that changes in an entity’s programs or activities, organizational structure, personnel, or technology can affect the operating environment and management can respond by revising internal controls on a timely basis to ensure effectiveness. However, TSA has not reviewed or revised its 2010 plan to ensure it addresses changes in at least three key areas: cybersecurity-related laws and policies, incident management policies, and DHS’s terrorism alert system as described below. TSA’s 2010 plan includes some discussion of cyber threats and refers operators to guidance they may use to better secure their SCADA and control systems. However, the plan does not identify the cybersecurity roles and responsibilities of federal agencies that are identified in the plan, such as DOE, Federal Energy Regulatory Commission (FERC), or the FBI, or discuss the measures these agencies should take to prevent, respond to, or support pipeline operators following a cyber incident involving pipelines. TSA’s 2010 plan also has not been updated to reflect current cybersecurity incident response guidance. In December 2016, DHS issued its National Cyber Incident Response Plan (NCIRP). The NCIRP is to be the primary framework for stakeholders, including pipeline operators, to understand how federal departments and agencies provide resources to support response operations for a significant cyber incident. NCIRP identifies the FBI and the National Cyber Investigative Joint Task Force as responsible for investigating reported cyber incidents. NCIRP also identifies the National Cybersecurity and Communications Integration Center (NCCIC), an agency within DHS, as responsible for providing technical assistance to affected entities, such as pipelines, to mitigate vulnerabilities and reduce impacts of cyber incidents. NCCIC is also to share information across the public and private sectors to protect against similar incidents in the future. In addition, NCIRP provides guidance detailing when and to which federal agencies or entities the public should report a cyber incident. These include the FBI, the National Cyber Investigative Joint Task Force, U.S. Secret Service, and NCCIC. For example, NCIRP states that any cybercrime—including computer intrusions or attacks, theft of trade secrets, criminal hacking, terrorist activity, espionage, sabotage, or other foreign intelligence activity—is to be reported to FBI field offices’ cyber task forces. However, TSA’s plan does not include this information or describe what measures, if any, the agencies with pipeline-related roles and responsibilities listed in NCIRP are to take in response to a pipeline cyber incident. Moreover, the 2010 plan does not account for other agencies whose roles and responsibilities are related to critical infrastructure, such as pipelines and cybersecurity. Specifically, the plan does not account for the role of NCCIC, which was established in 2009. In addition, TSA’s 2010 plan does not account for CISA’s role in cyber threat response activities or how it may affect other agencies’ roles and responsibilities for pipeline incident response. TSA officials acknowledged that reviewing and, as appropriate, revising the plan would be beneficial to ensuring the plan addresses current pipeline security threats, technology, and federal laws and policies. They stated TSA had not updated the plan to include cybersecurity response protocols because an overarching cybersecurity response protocol for all critical infrastructure sectors—not just pipelines—should first be developed. According to TSA officials, developing a pipeline cybersecurity response protocol would require a whole-of-government approach, as well as coordination with private sector and input from many sectors because of the challenges and complexity of critical infrastructure cybersecurity in general. However, through NCIRP, DHS provided a cybersecurity response protocol across all critical infrastructure sectors in December 2016. Further, NCIRP states that public and private sector entities should consider creating an operational cyber incident response plan to further organize and coordinate their efforts in response to cyber incidents. Therefore, TSA could potentially provide such an operational cyber incident response plan for the pipeline sector in its plan. TSA could also better ensure that pipeline operators understand how federal agencies may provide support in response to a cyber incident by periodically reviewing and, as appropriate, revising the plan to include its cyber incident response plan. Representatives of the four pipeline associations we interviewed told us that their membership more clearly understood federal agencies’ roles and responsibilities related to physical incidents than to cybersecurity. For example, for physical incidents the representatives stated that their members clearly understood that they are to first notify local first responders (often through the emergency 911 system) and appropriate state or federal regulators, and are to contact either the National Response Center or TSA’s Transportation Security Operations Center (TSOC), depending on the nature of the incident. However, they stated that they did not believe all of their members clearly understand that they are to report any actual or suspected cyber incidents that could impact pipeline industrial control systems or other information technology-based systems to the NCCIC. All of the association representatives told us that the process for reporting a cyber incident is less clear because, in part, of the large number of federal agencies with a cybersecurity-related role. One of the representatives also attributed the lack of clarity to the reorganization of NCCIC, and the establishment of CISA. Further, all of the representatives we interviewed indicated that clarifying the cybersecurity roles and responsibilities of DOE, Federal Energy Regulatory Commission (FERC), and TSA would, among other things, improve operators’ ability to appropriately report and respond to a cyber incident. Federal Incident Management Policies TSA also has not updated the plan to address changes in federal incident management and response policies that have occurred since the plan was developed in 2010. The plan states that it is to be consistent with the National Response Framework (NRF) and the National Incident Management System (NIMS) incident command system procedures. The NRF was first issued in 2008 and described the roles, responsibilities and coordinating structures for delivering core capabilities during incident response. According to FEMA, it revised the NRF in 2013 and 2016 to reflect lessons learned from real world events and other experiences since the framework was first developed. Likewise, NIMS was developed in 2004 as a comprehensive, national approach to incident management that was to be applicable at all jurisdictional levels and across functional disciplines, such as law enforcement, public health, or public works. According to FEMA, it revised NIMS in 2017 to reflect and incorporate policy updates and lessons learned from exercises and real-world incidents. The revision was also intended to clarify that NIMS applies to all stakeholders with incident management roles, and to enhance guidance on information management processes, data collection plans, social media integration, and the use of geographic information systems. TSA officials acknowledged the benefit of periodically reviewing, and if necessary, revising the plan to reflect FEMA’s revisions to NIMS or the NRF, but had not done so because of competing priorities. DHS’s Terrorism Alert System TSA has also not updated the plan to address changes DHS made to its terrorist alert system in 2011. Consistent with the 9/11 Commission Act, the plan describes actions that federal agencies can take at each color- coded level of the Homeland Security Advisory System to ensure the increased security of pipeline infrastructure. For example, under the protect/prevent phase, the plan states that when there is a high risk of a terrorist attack (i.e., red: severe condition) and threat is general and not specific to pipelines, TSA and PHMSA are to coordinate to identify the potential for any related or cascading events that may impact the pipeline sector. However, if there is a specific threat to pipelines, TSA, in collaboration with pipeline operators, is to identify any immediate protective measures that pipeline operators are to implement. TSA is also to ensure pipeline operators have the information necessary to implement these measures, and, if necessary, to issue security directives. In 2011, DHS replaced the four color-coded alert system of the Homeland Security Advisory System with the National Terrorism Advisory System, which has only two alert levels (elevated threat and imminent threat). TSA issued revised protective measures that pipeline operators are to take under either threat condition in April 2011 and March 2018. However, TSA has not updated the plan to communicate the actions federal agencies can take at either level of the National Terrorism Advisory System to ensure the increased security of pipeline infrastructure. TSA officials acknowledged that periodically reviewing and, as appropriate, revising the plan would help to clarify federal agencies’ roles and responsibilities for addressing pipeline security. TSA officials reported that they have not updated the plan since 2010 because they faced competing priorities. However, as described earlier, TSA’s incident response plan was developed to provide a comprehensive interagency approach to important activities such as countering risks, coordinating federal agencies’ actions and minimizing the consequences of incidents involving pipeline infrastructure. Further, the plan itself states that it will be updated periodically to address changes in pipeline security threats, technology, and federal laws and policies. By periodically reviewing and, as appropriate, revising its Pipeline Security and Incident Recovery Protocol Plan, TSA could better ensure that the plan addresses all possible and relevant threats to pipeline systems, such as cybersecurity, and fully incorporates relevant changes, such as those related to incident management and DHS’s terrorism alert system. By doing so, TSA could also provide greater assurance that federal agencies understand the actions they are to take to prevent, respond to, or recover from a physical or cyber incident. Conclusions TSA and PHMSA share responsibility for safeguarding the nation’s pipeline systems from catastrophic events. While the 2006 MOU Annex delineates TSA’s and PHMSA’s mutually agreed-upon pipeline security roles and responsibilities, it has not been reviewed since its inception to consider pipeline security developments. By developing and implementing a mutually agreed upon timeline with timeframes for reviewing the annex and as appropriate, updating it, TSA and PHMSA could better ensure that their roles and responsibilities are properly documented and updated in a timely manner to remain current. Furthermore, by revising the MOU Annex to include a provision for periodically reviewing the annex for needed updates, TSA and PHMSA could better ensure the agreement consistently reflects relevant and updated information on their roles and responsibilities. Similarly, TSA’s Pipeline Security and Incident Recovery Protocol Plan— which defines the roles and responsibilities of federal agencies; tribal, state, and local governments; and the private sector for responding to a pipeline incident—also has not been updated to reflect changes in federal laws or policies since the plan was issued in 2010. By periodically reviewing and, when appropriate, updating its Pipeline Security and Incident Recovery Protocol Plan, TSA could better ensure that the plan addresses and fully incorporates changes relevant to cybersecurity, incident management and DHS’s terrorism alert system, among others. By doing so, TSA could also better ensure that federal agencies’ actions are well coordinated in response to a pipeline-related physical or cyber incident, and that pipeline stakeholders understand federal agencies’ roles and responsibilities in preparing for, responding to, or supporting pipeline operators to restore service after a pipeline-related physical or cyber incident. Recommendations for Executive Action We are making a total of five recommendations including three to TSA and two to PHMSA: The TSA Administrator should work with the PHMSA Administrator to develop and implement a timeline with milestone dates for reviewing and, as appropriate, updating the 2006 MOU Annex. (Recommendation 1) The PHMSA Administrator should work with the TSA Administrator to develop and implement a timeline with milestone dates for reviewing and, as appropriate, updating, the 2006 MOU Annex. (Recommendation 2) The TSA Administrator, in consultation with the PHMSA Administrator should revise the 2006 MOU Annex to include a provision requiring periodic reviews of, and as appropriate, corresponding updates to the Annex.(Recommendation 3) The PHMSA Administrator, in consultation with the TSA Administrator should revise the 2006 MOU Annex to include a provision requiring periodic reviews of, and as appropriate, corresponding updates to the Annex.(Recommendation 4) The TSA Administrator should periodically review, and as appropriate, update the 2010 Pipeline Security and Incident Recovery Protocol Plan to ensure the plan reflects relevant changes in pipeline security threats, technology, federal law and policy, and any other factors relevant to the security of the nation’s pipeline systems. (Recommendation 5) Agency Comments and Our Evaluation We provided a draft of this report to DHS and DOT. DHS and DOT provided written comments which are reproduced in appendices III and IV respectively. We also provided draft excerpts of this product to the American Petroleum Institute (API), the American Gas Association, the Interstate Natural Gas Association of America, and the American Public Gas Association. For those who provided technical comments, we incorporated them as appropriate. With regard to our first recommendation, that TSA work with the PHMSA to develop and implement a timeline with milestone dates for reviewing and, as appropriate, updating the 2006 MOU Annex, DHS stated that TSA will work with PHMSA to develop and implement a timeline with milestone dates for reviewing and updating, as appropriate, the 2006 MOU Annex. DHS estimated that this effort would be completed by August 31, 2019. This action, if fully implemented, should address the intent of this recommendation. With regard to our second recommendation, that PHMSA work with TSA to develop and implement a timeline with milestone dates for reviewing and, as appropriate, updating the 2006 MOU Annex, DOT concurred and stated it would provide a detailed response within 180 days of the issuance of this report. With regard to our third recommendation, that TSA, in consultation with PHMSA, revise the 2006 MOU Annex to include a provision requiring periodic reviews of, and as appropriate, corresponding updates to the Annex, DHS stated that TSA will, in consultation with PHMSA, revise the 2006 MOU Annex to include a provision requiring periodic reviews of, and as appropriate, corresponding updates to the Annex. DHS estimated that this effort would be completed by March 31, 2020. This action, if fully implemented, should address the intent of this recommendation. With regard to our fourth recommendation, that PHMSA, in consultation with TSA, revise the 2006 MOU Annex to include a provision requiring periodic reviews of, and as appropriate, corresponding updates to the Annex, DOT concurred and stated it would provide a detailed response within 180 days of the issuance of this report. With regard to our fifth recommendation, that TSA periodically review, and as appropriate, update the 2010 Pipeline Security and Incident Recovery Protocol Plan to ensure the plan reflects relevant changes to pipeline security threats, technology, federal law and policy, and any other factors relevant to the security of the nation’s pipeline systems, DHS concurred and estimated that TSA will complete its first review by December 31, 2019. DHS further stated that it will establish a timeline for updating the plan should the review determine that an update is necessary. This action, if fully implemented, should address the intent of this recommendation. We are sending copies of this report to the appropriate congressional committees; the Secretary of Homeland Security, Secretary of Transportation; and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact William Russell at (202) 512-8777 or russellw@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix V. Appendix I: 2006 Memorandum of Understanding (MOU) Program Areas and Accompanying Text The Transportation Security Administration (TSA) and Pipeline and Hazardous Materials Safety Administration (PHMSA),”the parties”, recognize that the following program areas are important to the development and deployment of an enhanced security strategy for the transportation of hazardous materials by all modes, including pipeline. Appendix II: Summary of Key Federal Agencies’ and Pipeline Operator’s Roles and Responsibilities This appendix summarizes the roles and responsibilities of key federal agencies as well as the actions that they may take in response to an incident as detailed in Transportation Security Administration’s (TSA) 2010 Pipeline Security and Incident Recovery Protocol Plan. A summary of pipeline stakeholder’s roles, responsibilities, and examples of actions that may be taken during each incident response phase is presented below. Prevention/Protection. During the prevention/protection phase, pipeline operators are to use TSA’s pipeline security guidance and the Pipeline and Hazardous Materials Safety Administration’s (PHMSA) safety regulations as the framework to prepare and prevent against an incident. TSA is responsible for monitoring pipeline owners and operators’ implementation its security guidelines, and PHMSA is responsible for enforcing its safety regulations. The plan also states that during this phase TSA is to assume a primary role for ensuring federal agencies’ actions are coordinated through protective security advisors (PSAs). In addition, the Federal Bureau of Investigation (FBI) is responsible for assessing the credibility of a known threat, preparing and implementing a preliminary investigative plan, and, if necessary, disseminating public safety notifications. The Department of Energy (DOE) is responsible for assessing and monitoring pipeline systems for supply shortages. The prevention/protection section of the plan also describes how agencies are to share and assess threat information. For example, the plan states that TSA, PHMSA, or any federal agency that receives threat information regardless of the source, must immediately notify the FBI. It also states that if the FBI receives intelligence about a pipeline threat, it is to share this information with TSA. TSA is then to notify the pipeline operator and, if necessary, provide recommendations for additional protective measures. Finally, the prevention/protection section of the plan defines actions various agencies can implement during a heightened security threat level to increase protection from a potential attack. For example, when there is a high risk of a terrorist attack (i.e., red: severe condition) and threat is general and not specific to pipelines, TSA and PHMSA are to coordinate to identify the potential for any related or cascading events that may impact the pipeline sector. If there is a specific threat to pipelines, TSA is, in collaboration with pipeline operators, to identify any immediate protective measures that ought to be taken by pipeline operators, and ensure pipeline operators have the information necessary to implement them, and, if necessary issue security directives. Response. According to the plan, pipeline owners or operators are to notify local first responders and state regulators through the emergency 911 system. After the pipeline operator has notified local government, they are to contact the National Response Center (NRC) if the incident results in an unintentional release or causes significant damage. As we previously reported, pipeline operators are also requested to report any physical security incident that is indicative of a deliberate attempt to disrupt pipeline operations or activities that could be considered precursors to such an attempt to TSA’s Transportation Security Operations Center (TSOC). Once TSA has been notified of an incident by a pipeline operator, its Pipeline Security Branch is to monitor the incident, notify relevant federal agencies, and, if deemed appropriate, activate the Interagency Threat Coordination Committee (ITCC). PHMSA may also deploy on-scene pipeline inspectors and investigators which are to among other things, coordinate federal agencies’ activities with the affected pipeline operator and state pipeline safety agency, provide subject matter expertise to the incident command, and direct safe restoration of pipeline facilities and services. The plan also states that, during the response phase, responsibility for investigating the incident falls to NTSB or the FBI depending on whether the incident is determined to be the result of criminal activity. The FBI is solely responsible for investigating any pipeline security incident that appears to be an intentional criminal act. For example, if the incident were suspected to be the result of terrorist attack, the National Joint-Terrorism Task Force would conduct an investigation of the attack, and if appropriate, with assistance from other FBI assets. If, however, the incident resulted in fatalities, substantial property damage, or significant injury to the environment, NTSB would have responsibility for investigating the incident, and may issue safety recommendations to help prevent future accidents. Recovery. When response activities are complete, PHMSA is to have primary responsibility for overseeing pipeline operators’ safe restoration of service with TSA and other federal agencies serving primarily in support roles. PHMSA, for example, is to work with the owner/operator to facilitate restoration of service by, among other things, providing technical oversight, advice, and guidance to owner/operators; coordinating recovery activities with state pipeline safety agency, and evaluate whether to a special permit is necessary to facilitate an expedited restoration of services. Meanwhile, DOE is to continue to assess the impacts of an incident on energy infrastructure, and advise federal, state, tribal, and local authorities on priorities for energy restoration, assistance, and supply. Appendix III: Comments from the Department of Homeland Security Appendix IV: Comments from the Department of Transportation Appendix V: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Ben Atwater, Assistant Director and Michael C. Lenington, Analyst-in-Charge, managed this assignment. Nanette Barton, Eric Hauswirth, Susan Hsu, and Thomas Lombardi also made significant contributions to this report.