Background Air ambulance providers use either helicopters or fixed-wing aircraft, as shown in Figure 1, depending on where and how far they are transporting patients. Helicopters are generally used for transports from the scene of the accident or injury to the hospital or for shorter-distance transports between hospitals. Helicopter bases may be at hospitals, airports, or other types of helipads, and a provider may need to fly from its base to the scene or a hospital to pick up the patient being transported. Air ambulance providers typically respond to calls for helicopter transports within a certain area around their bases in part to ensure appropriate response times. Fixed-wing aircraft are generally used for longer-distance transports between hospitals. Fixed-wing bases are at airports, and the patient is transported by ground ambulance to and from the airports. Air ambulance providers respond to emergencies without knowing patients’ health insurance coverage, such as whether the patient has private insurance, Medicare, Medicaid, or no insurance. According to our previous analysis of information from eight selected air ambulance providers, in 2016, Medicare patients received 35 percent of helicopter transports, privately-insured patients received 32 percent, Medicaid patients received 21 percent, uninsured patients received 9 percent, and patients with other types of coverage such as automobile and military- sponsored insurance received a small percentage. Relatively few patients receive air ambulance transports, but those patients who do generally have no control over the decision to be transported by air ambulance or the selection of the air ambulance provider, as shown in Figure 2. For privately-insured patients, this means they cannot necessarily choose to be transported by air ambulance providers in their insurers’ network and can potentially receive a balance bill from the providers for the difference between the price charged by the provider and the amount paid by the insurer. This amount is in addition to copayments, deductibles, or other types of cost-sharing that patients typically pay under their insurance. Air ambulance providers are prohibited from sending balance bills to Medicare and Medicaid patients, while uninsured patients might be held responsible by the air ambulance provider for the entire price charged. With many types of health care services, both health care providers and insurers have incentives to negotiate and enter into contracts that specify amounts that providers will accept as payment in full, thereby avoiding the potential for balance bills for those services. Insurers can offer—and health care providers may be willing to accept—payment rates that are much lower than the providers’ charged amounts because the providers may receive more patients as an in-network provider. Furthermore, when patients are choosing insurance plans, they may consider how many or which providers are in-network, particularly for providers such as hospitals or certain physicians. The emergency nature of most air ambulance transports, as well as their relative rarity and high prices charged, reduces the incentives of both air ambulance providers and insurers to enter into contracts with agreed- upon payment rates, which means air ambulance providers may be more often out-of-network when compared with other types of providers. Decisions by first responders and physicians on which air ambulance provider to call are typically not based on the patient’s insurance plan, meaning that being in-network may not increase air ambulance providers’ transport volume. As a result, according to stakeholders we spoke to, if insurers offer payment rates that are much lower than the air ambulance providers’ charged amounts, the air ambulance providers may be less willing than other health care providers to accept those payment rates. Furthermore, given the relative rarity of air ambulance transports, patients may not anticipate needing air ambulance transports and may not choose insurance plans based on which or how many air ambulance providers are in insurers’ networks. Approaches by states or the federal government to limit balance billing may target providers, insurers, or both. Examples of approaches described in research on balance billing include a cap on the amount that providers can charge or a requirement for insurers to pay the full amount charged by providers. However, according to the research, targeting just providers or insurers can result in undesired outcomes. Capping the amount providers can charge could result in insurers that underpay for services, which could lead some providers to reduce service or exit the market altogether. Conversely, requiring insurers to pay the full amount charged by providers could result in providers that overcharge for services, which could lead to higher premiums charged to patients. The authority of states to address issues related to air ambulance balance billing is affected by the following federal laws: Airline Deregulation Act of 1978 (ADA): A provision in this law preempts state-level economic regulation—i.e., regulating rates, routes, and services—of air carriers authorized by DOT to provide air transportation. In general, courts have held that air ambulances are considered to be air carriers under the ADA’s preemption provision, and courts, DOT, and state attorneys general have determined specific issues related to the air ambulance industry that can and cannot be regulated at the state level. McCarran-Ferguson Act of 1945: This act affirmed that states have the authority to regulate the business of insurance. For example, states may review insurers’ health insurance plans and premium rates. In instances of balance billing, states can determine whether the insurer paid a provider in accordance with its policy for paying for out-of-network services. Employee Retirement Income Security Act of 1974 (ERISA): ERISA provides a federal framework for regulating employer-based pension and welfare benefit plans, including health plans. Although states may regulate health insurers, ERISA preemption generally prevents states from directly regulating self-insured employer-based health plans. In 2017, as previously mentioned, we reported on the increase in prices charged by helicopter air ambulance providers and on the lack of data on the factors that may be affecting prices charged. We also found only limited information was available related to several key aspects of the industry, ranging from basic aspects—such as the composition of the industry by type of air ambulance provider, the prices charged by air ambulance providers, and the number of overall transports—to the more complex, such as the extent of contracting between air ambulance providers and insurers or the extent of balance billing to patients. Given DOT’s authority to oversee certain aspects of the industry, we made four recommendations to DOT in 2017 to increase transparency and obtain information to better inform their oversight of the air ambulance industry: (1) communicating a method to receive air ambulance complaints, including those regarding balance billing; (2) taking steps to make complaint information publicly available; (3) assessing available federal and industry data to determine what information could assist in the evaluation of future complaints; and (4) considering consumer disclosure requirements for air ambulance providers, such as established prices charged and the extent of contracting with insurers. DOT has taken steps to respond to the first two recommendations, including adding information to its website describing how air ambulance complaints can be registered and used by DOT. It has also listed the number of air ambulance complaints filed with DOT each month starting in January 2018—23 air ambulance complaints have been filed with DOT through November 2018. DOT has not yet acted on the remaining two recommendations. Air Ambulance Providers Added Bases from 2012 through 2017 Air ambulance providers added helicopter bases from 2012 through 2017, according to our analysis of the ADAMS data. Specifically, there were 752 bases in the 2012 data and 868 bases in the 2017 data. When we compared the data for each year, there were 554 bases in both years of data (i.e., existing bases), 314 bases in the 2017 data only (i.e., new bases), and 198 bases in the 2012 data only (i.e., closed bases); the new and existing bases are shown in Figure 3. This addition in bases also increased the total area served by helicopter bases by 23 percent. Several air ambulance providers told us about their decisions to open new bases. For example, one air ambulance provider told us that one way it evaluates the need for a new base in an area is to ask hospitals in that area about the number of transports they typically require and the length of time it takes helicopters to arrive to pick up patients. Along with adding helicopter bases, air ambulance providers also added fixed-wing bases from 2012 through 2017, according to our analysis of the ADAMS data. Specifically, there were 146 bases in the 2012 data and 182 bases in the 2017 data. When we compared the data for each year, there were 114 bases in both years of data (i.e., existing bases), 68 bases in the 2017 data only (i.e., new bases), and 32 bases in the 2012 data only (i.e., closed bases); the new and existing bases are shown in Figure 4. Both the existing and new bases are more prevalent in the Western and Southern parts of the United States. Given that fixed-wing aircraft are used for longer-distance transports and that patients are brought to the base rather than picked up by fixed-wing aircraft, we did not measure the area or any changes in the area served by fixed-wing bases, which are usually airports. Based on our previous work, we further analyzed two trends related to where air ambulance providers have chosen to locate their new bases. New bases in rural areas: About 60 percent of the new helicopter bases and about half of the new fixed-wing bases in the ADAMS data were in rural areas. We previously reported that some helicopter air ambulance providers told us that the lower population density in rural areas leads to fewer transports per helicopter at rural bases. They also said that, despite the lower population density, rural areas may have greater need for air ambulance transports. This may be due to, for example, the closure of some rural hospitals and the establishment of regional medical facilities, such as cardiac and stroke centers that provide highly specialized care. New bases in areas with existing coverage: For just under half of the new helicopter bases in the ADAMS data, the area served overlapped with existing air ambulance coverage by more than 50 percent. On one hand, according to some stakeholders we spoke to, the new helicopters may help enhance available services by, for example, being able to respond to a call if the existing ambulance resources are in use or otherwise unavailable. On the other hand, as we have previously reported, some air ambulance providers told us that when helicopters are added to bases in areas with existing coverage, those helicopters are not serving additional demand. As a result, the same number of transports is spread out over more helicopters, reducing the average number of transports per helicopter. The FAA Reauthorization Act of 2018, which became law in October 2018, requires the FAA to assess the availability of information to the general public related to the location of heliports and helipads used by helicopters providing air ambulance services and to update current databases or, if appropriate, develop a new database containing such information. This could provide additional information about base locations going forward. Available Data Indicate About Two- Thirds of Air Ambulance Transports for Privately-Insured Patients Were Out-of- Network but Not Extent of Balance Billing for these Services In the FAIR Health data on air ambulance transports for privately-insured patients, about two-thirds of the approximately 13,100 and 20,700 transports with information on network status were out-of-network in 2012 and 2017, respectively. (See Table 1.) The proportions were similar for both helicopter and fixed-wing transports in each year. The proportion of out-of-network air ambulance transports in the FAIR Health data set is higher than what research shows for ground ambulance transports and other types of emergency services. For example, one study found that 51 percent of ground ambulance transports in 2014 were out-of-network, and the same study and another one found that 14 and 22 percent of emergency department visits in 2014 and 2015 involved out-of- network physicians, even at in-network hospitals. Air ambulance providers and insurers we spoke to confirmed that their proportion of out-of-network transports was high in 2017, but some also reported they have recently been entering into more network contracts. For example, one of the large independent air ambulance providers and a national insurer entered into a contract that covered patients in five states as of August 2018. These contracts could decrease the extent of out-of- network transports and balance billing in the future for these states. Increases in the prices charged for air ambulance transports may exacerbate the financial risks related to balance billing for those with private insurance. In 2017, the median price charged by air ambulance providers for a transport was approximately $36,400 for a helicopter transport and $40,600 for a fixed-wing transport, according to our analysis of FAIR Health data. The prices charged in 2017 were an increase of over 60 percent from 2012, when the median price charged was approximately $22,100 for a helicopter transport and $24,900 for a fixed- wing transport. There is limited information on what insurers pay for out- of-network services. While out-of-network transports may result in balance billing, the FAIR Health data we analyzed do not indicate the extent to which patients received balance bills and, if so, the size of the bills. In addition, as we previously reported, there is a lack of comprehensive national data about the extent and size of balance bills, and air ambulance providers are generally not required to report such data. However, some states have attempted to collect information from patients about balance billing for air ambulance services. Therefore, to provide insights into potential balance bill amounts, we reviewed data on consumer complaints that two of our selected states had received about specific incidents of balance billing for 2014 through 2018. Data for Maryland contained about two dozen complaints with information on the specific amount of balance bills, and those amounts ranged from $12,300 to $52,000. Data from North Dakota contained three dozen complaints with information on the specific amount of balance bills, and those amounts ranged from $600 to $66,600, though all but one amount was over $10,000. Given that providers may agree to reduce amounts that patients would otherwise owe or insurers may increase their payments to providers, along with limited national data, the extent to which patients actually pay the full amounts of balance bills received is also unclear. Generally, officials from air ambulance providers we spoke to said that they first encourage patients to appeal to their insurers for increased payment. If these appeals do not fully address the balance bill, the providers may offer various payment options. For example, officials from one air ambulance provider said that it offers a discount of up to 50 percent off the balance bill if the patient pays the remaining 50 percent immediately. Alternatively, the provider requests detailed financial information—such as income, obligations and debts, and medical bills—to determine whether to potentially offer other discounts or a payment plan. This process can take multiple months, and officials from another air ambulance provider said patients who do not respond to letters and calls may be more likely to be referred to a collections process. Air ambulance providers we spoke with said that they use discretion on how much assistance to offer, and not all patients receive discounts after providing all relevant documentation. Even with discounts, according to data from some air ambulance providers we spoke with, the amount patients pay can still be in the thousands of dollars. Selected States Have Attempted to Limit Potential Air Ambulance Balance Billing through Insurance Regulation and Public Attention Four of our selected states attempted to limit balance billing through the regulation of insurers (Montana, New Mexico, North Dakota, and Texas). Additionally, four states have attempted to limit balance billing through education and public pressure on stakeholders (Florida, Maryland, New Mexico, and North Dakota). Insurance Regulation Four of the six states we selected—Montana, New Mexico, North Dakota, and Texas—have attempted to limit balance billing by air ambulance providers through the regulation of insurers, as shown in Table 2. Three states have faced challenges in federal district court related to whether their attempts to limit balance billing by air ambulance providers are preempted by the federal ADA. As of January 2019, the case in New Mexico was dismissed on procedural grounds, and the cases in North Dakota and Texas have been decided. The hold-harmless requirement and dispute resolution process established by Montana’s law is an example of how states are attempting to limit balance billing by regulating the business of insurance. Under the hold-harmless requirement, the financial risk for potential balance billing is transferred from patients to the insurer by limiting the patients’ out-of- pocket costs to their cost-sharing responsibilities. However, according to state officials, the dispute resolution process established by this law had not yet been used as of December 2018. The requirement and process apply to transports for patients covered by Montana-regulated insurance plans. It does not apply to transports for individuals in most self-insured plans subject to ERISA, nor does it apply to transports for individuals, such as tourists, covered by insurance plans regulated by other states. The stated purpose of the law establishing this process is to prevent state residents from incurring excessive out-of-pocket expenses in air ambulance situations in a manner that is not preempted by the ADA. Officials in Montana and North Dakota reported receiving fewer consumer complaints about balance billing after implementing their laws to limit balance billing. One reason for this decrease in consumer complaints, according to officials in Montana, was that uncertainty over the possible effects of the law has made most air ambulance providers more willing to enter into contract negotiations with insurers. The officials added that shortly after the law’s enactment, a large insurer and a large air ambulance provider entered into a network contract. Additionally, another air ambulance provider in Montana confirmed that although it had provided out-of-network transports, it had not sent balance bills to patients since the law took effect. Officials in both states could not comprehensively report the extent to which instances of balance billing may have decreased in their state. As required by FAA Reauthorization Act of 2018, the Secretary of Transportation has taken steps to form an advisory committee on air ambulance patient billing. DOT issued a solicitation in December 2018 for applications and nominations for membership on this advisory committee. The committee is to consist of representatives from state insurance regulators, health insurance providers, patient advocacy groups, consumer advocacy groups, and physicians specializing in emergency, trauma, cardiac, or stroke care, among others. The Act directs the advisory committee to issue a report within 180 days of its first meeting and to make recommendations that address the following, among other things: The disclosure of charges and fees for air ambulance services; Options and best practices for preventing balance billing—such as improving network and contract negotiation, dispute resolutions between health insurers and air medical service providers, and explanations of insurance coverage; Steps that states can take to protect consumers consistent with current legal authorities regarding consumer protection; and The recommendations from our 2017 report, including any additional data that DOT should collect from air ambulance providers and other sources to improve its understanding of the air ambulance market and oversight of the industry. Education and Public Pressure Officials in three selected states—Florida, New Mexico, and North Dakota—have provided information to educate consumers and other stakeholders about balance billing for air ambulance transports. The Florida Office of the Insurance Consumer Advocate and the New Mexico Office of Superintendent of Insurance reviewed air ambulance transports in their states and issued public reports with recommendations to improve transparency and education, among other recommendations. Florida’s report, issued in June 2018, recommends that insurers and air ambulance providers improve transparency about the availability of in-network air ambulance providers in a given area and provide information about rate justifications and billing practices to help consumers anticipate potential out-of-network costs. New Mexico’s report, issued in January 2017, recommends educating emergency room physicians and other health care providers about the impact of air ambulance bills on consumers and on how to select in-network air ambulance providers. Additionally, since 2017, the North Dakota Insurance Department has produced a publicly available guide showing which air ambulance providers are in-network with the three insurers in the state. This guide is part of the state’s requirement that, for non-emergency transports, hospitals inform patients about the network status of air ambulance providers. Although the three large independent air ambulance providers we spoke with told us that non-emergency transports comprise only a small percentage of air ambulance transports, officials in North Dakota said some dispatchers and first responders reported using the guide to call in-network air ambulance providers when possible for emergency transports. Finally, one additional selected state—Maryland—has increased public awareness of air ambulance balance billing, which has generated public pressure on air ambulance providers and insurers to encourage the two sides to negotiate contracts. The Maryland Insurance Administration convened a public meeting in September 2015 with the goal of raising public awareness about air ambulance balance billing in the state. The meeting involved statements from patient, air ambulance, hospital, and insurer stakeholders. One of the large independent air ambulance providers said that public pressure following the meeting, as well as subsequent engagement from the state insurance commissioner, were factors in securing a contract with a large insurer in the state. Agency Comments We provided a draft of this report to the Department of Health and Human Services and DOT for review and comment. The Department of Health and Human Services told us they had no comments on the draft report, and DOT provided technical comments that we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees, the Administrator of the Centers for Medicare & Medicaid Services, the Secretary of the Department of Transportation, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact James Cosgrove, Director, Health Care at (202) 512-7114 or cosgrovej@gao.gov or Heather Krause, Director, Physical Infrastructure at (202) 512-2834 or krauseh@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix I. Appendix I: GAO Contacts and Staff Acknowledgments GAO Contacts Staff Acknowledgments In addition to the contacts named above, Lori Achman (Assistant Director), Heather MacLeod (Assistant Director), Corissa Kiyan-Fukumoto (Analyst-in-Charge), William Black, George Bogart, Stephen Brown, Krister Friday, Matthew Green, Barbara Hansen, Giselle Hicks, and Vikki Porter made key contributions to this report. Related GAO Products Air Ambulance: Data Collection and Transparency Needed to Enhance DOT Oversight. GAO-17-637. Washington, D.C.: July 27, 2017. Air Ambulance: Effects of Industry Changes on Services Are Unclear. GAO-10-907. Washington, D.C.: Sept. 30, 2010.


Background Oversight Agencies FTC and, most recently, CFPB, are the federal agencies primarily responsible for overseeing CRAs. FTC has authority to investigate most organizations that maintain consumer data and to bring enforcement actions for violations of statutes and regulations that concern the security of data and consumer information. CFPB, created in 2010 by the Dodd- Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), has enforcement authority over all CRAs for violations of certain consumer financial protection laws. In general, it also has the authority to issue regulations and guidance for those laws. CFPB has supervisory authority over larger market participants in the consumer reporting market. In 2012, CFPB defined larger market participant CRAs as those with more than $7 million in annual receipts from consumer reporting. CFPB’s supervision of these companies includes monitoring, inspecting, and examining them for compliance with the requirements of certain federal consumer financial laws and regulations. As discussed below, these laws include most provisions of the Fair Credit Reporting Act (FCRA); several provisions of the Gramm-Leach-Bliley Act (GLBA); and provisions of the Dodd-Frank Act concerning unfair, deceptive, or abusive acts or practices. Data Breaches and the Equifax Breach Although there is no commonly agreed-upon definition of “data breach,” the term generally refers to an unauthorized or unintentional exposure, disclosure, or loss of sensitive information. This information can include personally identifiable information such as Social Security numbers, or financial information such as credit card numbers. A data breach can be inadvertent, such as from the loss of an electronic device; or deliberate, such as the theft of a device or a cyber-based attack by individuals or groups, including an organization’s own employees, foreign nationals, or terrorists. Data breaches have occurred at all types of organizations, including private, nonprofit, and federal and state entities. In the Equifax data breach, Equifax system administrators discovered on July 29, 2017, that intruders had gained unauthorized access via the Internet to a server housing the company’s online dispute portal. The breach compromised the personally identifiable information of at least 145.5 million individuals, and included names, addresses, and birth dates; and credit card, driver’s license, and Social Security numbers. Equifax’s investigation of the breach identified the following factors that led to the breach: software vulnerabilities, failure to detect malicious traffic, failure to isolate databases from each other, and inadequately limiting access to sensitive information such as usernames and passwords. Equifax’s public filings after the breach noted that the company took steps to improve security and notify individuals about the breach. Our August 2018 report provides more information on the breach and Equifax’s response. FTC Has Taken Enforcement Measures against CRAs but Lacks Civil Penalty Authority for GLBA Data Protection Provisions FTC enforces compliance with consumer protection laws under authorities provided in FCRA, GLBA, and the FTC Act. As we reported in February 2019, according to FTC, in the last 10 years, it has brought 34 enforcement actions for FCRA violations, including 17 against CRAs. In addition, FTC said that it has taken 66 actions against companies (not just in the last 10 years), including CRAs, that allegedly engaged in unfair or deceptive practices relating to data protection. In some circumstances, FTC enforcement authority can include civil money penalties—monetary fines imposed for a violation of a statute or regulation. However, FTC’s civil penalty authority does not extend to initial violations of GLBA’s privacy and safeguarding provisions. These provisions require administrative, physical, and technical safeguards with an emphasis on protection against anticipated threats and unauthorized access to customer records. For violations of GLBA provisions, FTC may seek an injunction to stop a company from violating these provisions and may seek redress (damages to compensate consumers for losses) or disgorgement (requirement for wrongdoers to give up profits or other gains illegally obtained). Determining the appropriate amount of consumer compensation requires FTC to identify the consumers affected and the amount of monetary harm they suffered. In cases involving security or privacy violations resulting from data breaches, assessing monetary harm can be difficult. In addition, consumers may not be aware that their identities have been stolen as a result of a breach and or identity theft, and related harm may occur years in the future. It can also be difficult to trace instances of identity theft to specific data breaches. According to FTC staff, these factors can make it difficult for the agency to identify which individuals were victimized as a result of a particular breach and to what extent they were harmed and then obtain related restitution or disgorgement. Having civil penalty authority for GLBA provisions would allow FTC to fine a company for a violation such as a data breach without needing to prove the monetary harm to individual consumers. FTC staff noted that in the case of a data breach, each consumer record exposed could constitute a violation; as a result, a data breach that involved a large number of consumer records could result in substantial fines. In 2006, we suggested that Congress consider providing FTC with civil penalty authority for its enforcement of GLBA’s privacy and safeguarding provisions. We noted that this authority would give FTC a practical tool to more effectively enforce provisions related to security of data and consumer information. Following the 2008 financial crisis, Congress introduced several bills related to data protection and identity theft, which included giving FTC civil penalty authority for its enforcement of GLBA. However, in the final adoption of these laws, Congress did not provide FTC with this authority. Since that time, data breaches at Equifax and other large organizations have highlighted the need to better protect sensitive personal information. Accordingly, we continue to believe FTC and consumers would benefit if FTC had such authority, and we recommended in our February 2019 report that Congress consider providing FTC with civil penalty authority for the privacy and safeguarding provisions of GLBA to help ensure that the agency has the tools it needs to most effectively act against data privacy and security violations. CFPB Enforces and Examines CRAs for Compliance with Consumer Protection Laws but Does Not Fully Consider Data Security in Prioritizing Examinations CFPB enforces compliance with most provisions of FCRA; several provisions of GLBA; and the prohibition of unfair, deceptive, or abusive acts or practices under the Dodd-Frank Act. In our February 2019 report, we noted that since 2015, CFPB has had five public settlements with CRAs. Four of these settlements included alleged violations of FCRA, and three included alleged violations of provisions related to unfair, deceptive, or abusive practices. CFPB also has an ongoing investigation of Equifax’s data breach. Under its existing authority, CFPB has examined several larger market participant CRAs, but may not be identifying all CRAs that meet the $7 million threshold. CFPB staff told us that as of October 2018, they were tracking between 10 and 15 CRAs that might qualify as larger market participants. CFPB staff told us that they believe the CRA market is highly concentrated and there were not likely to be many larger market participants beyond the 10 to 15 they are tracking. However, CFPB staff said that the 10 to 15 CRAs may not comprise the entirety of larger market participants, because CRAs’ receipts form consumer reporting may vary from year to year, and CFPB has limited data to determine whether CRAs meet the threshold. Our January 2009 report on reforming the U.S. financial regulatory structure noted that regulators should be able to identify institutions and products that pose risks to the financial system, and monitor similar institutions consistently. CFPB could identify CRAs that meet the larger market participant threshold by requiring such businesses to register with it, subject to a rulemaking process and cost-benefit analysis of the burden it could impose on the industry. Another method CFPB could use to identify CRAs subject to its oversight would be to leverage information collected by states. We recommended in February 2019 that CFPB identify additional sources of information, such as through registering CRAs or leveraging state information, that would help ensure the agency is tracking all CRAs subject to its authority. CFPB neither agreed nor disagreed with our recommendation. Each year CFPB determines the institutions (for example, banks, credit unions, non-bank mortgage servicers, and CRAs) and the consumer product lines that pose the greatest risk to consumers, and prioritizes these for examinations. CFPB segments the consumer product market into institution product lines, or specific institutions’ offerings of consumer product lines. CFPB then assesses each institution product line’s risk to consumers at the market level and institutional level. To assess risk at the market level, CFPB considers market size and other factors that contribute to market risk. To assess risk at the institution level, CFPB considers an institution’s market share within a product line, as well as field and market intelligence. Field and market intelligence includes quantitative and qualitative information on an institution’s operations for a given product line, including the strength of its compliance management systems, the number of regulatory actions directed at the institution, findings from prior CFPB examinations, and the number and severity of consumer complaints CFPB has received about the institution. CFPB then determines specific areas of compliance to assess by considering sources such as consumer complaints, public filings and reports, and past examination findings related to the same or similar products or institutions. Most recently, CFPB examinations of CRA’s consumer reporting have focused on issues such as data accuracy, dispute processes, compliance management, and permissible purposes. Although CFPB’s examination prioritization incorporates several important factors and sources, the process does not routinely include assessments of data security risk, such as how institutions detect and respond to cyber threats. CFPB staff said the bureau cannot examine for or enforce compliance with the data security standards in provisions of GLBA and FCRA or FTC’s implementing rules, even at larger participant CRAs. After the Equifax breach, however, CFPB used its existing supervisory authority to develop internal guidelines for examining data security, and conducted some CRA data security examinations. CFPB staff said that they do not routinely consider data security risks during their examination prioritization process and have not reassessed the process to determine how to incorporate such risks going forward. Statute requires CFPB to consider risks posed to consumers in the relevant product and geographic markets in its risk-based supervision program. In addition, federal internal control standards state that agencies should identify, analyze, and respond to risks related to achieving defined objectives. This can entail considering all significant internal and external factors to identify risks and their significance, including magnitude of impact, likelihood of occurrence, nature of the risk, and appropriate response. In light of the Equifax breach, as well as CFPB’s acknowledgment of the CRA market as a higher-risk market for consumers, it is important for CFPB to routinely consider factors that could inform the extent of CRA data security risk such as the number of consumers that could be affected by a data security incident and the nature of potential harm resulting from the loss or exposure of information. In our February 2019 report, we recommended that CFPB assess whether its process for prioritizing CRA examinations sufficiently incorporates the data security risks CRAs pose to consumers, and take any needed steps identified by the assessment to more sufficiently incorporate these risks. CFPB neither agreed nor disagreed with our recommendation. Regulators Inform Consumers about Protections Available and Consumers Can Take Some Actions after a CRA Data Breach In our February 2019 report, we noted that FTC and CFPB provide educational information for consumers on ways to mitigate the risk of identity theft. In addition, after a breach, FTC and CFPB publish information specific to that breach. For example, shortly after Equifax’s announcement of the breach, FTC published information on when the breach occurred, the types of data compromised, and links to additional information on Equifax’s website. Similarly, CFPB released three blog posts and several social media posts that included information on ways that consumers could protect themselves in the wake of the breach and special protections and actions for service members. At any time, consumers can take actions to help mitigate the risk of identity theft. For example, consumers can implement a credit freeze free of charge, which can help prevent new-account fraud by restricting potential creditors from accessing the consumer’s credit report. Similarly, implementing a free fraud alert with a credit bureau can help prevent fraud because it requires a business to verify a consumer’s identity before issuing credit. However, consumers are limited in the direct actions they can take against a CRA in the event of a data breach, for two primary reasons. First, consumers generally cannot determine the source of the data used to commit identity theft. As a result, it can be difficult to link a breach by a CRA (or any other entity) to the harm a consumer suffers from a particular incidence of identity theft, which makes it challenging to prevail in a legal action. Second, unlike with many other products and services, consumers generally cannot exercise choice if they are dissatisfied with a CRA’s privacy or security practices. Specifically, consumers cannot choose which CRAs maintain information on them. In addition, consumers do not have a legal right to delete their records with CRAs, according to CFPB staff, and therefore cannot choose to remove themselves entirely from the CRA market. FTC and CFPB have noted that the level of consumer protection required can depend on the consumer’s ability to exercise choice in a marketplace. For example, when determining whether a practice constitutes an unfair practice, FTC considers whether the practice is one that consumers could choose to avoid. Similarly, according to CFPB staff, the consumer reporting market may pose higher risk to consumers because consumers cannot choose whether or which CRAs possess and sell their information. Chairman Krishnamoorthi, Ranking Member Cloud, and Members of the Subcommittee, this concludes my prepared remarks. I would be happy to answer any questions that you may have. GAO Contact and Staff Acknowledgment If you or your staff have any questions about this statement, please contact Michael Clements at (202) 512-8678 or clementsm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. In addition to the contact named above, John Forrester (Assistant Director), Winnie Tsen (Analyst-in-Charge), and Rachel Siegel made key contributions to the testimony. Other staff who made key contributions to the report cited in the testimony are identified in the source product. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.


Background Overview of Board Directors’ Roles and Responsibilities Our previous work on board diversity describes some of the different roles and responsibilities of corporate and FHLBank boards and their directors. Public Company Corporate Boards Generally, a public company’s board of directors is responsible for managing the business and affairs of the corporation, including representing shareholders and protecting their interests. Corporate boards vary in size. According to a 2018 report that includes board characteristics of large public companies, the average board has about 11 directors. Corporate boards are responsible for overseeing management performance and selecting and overseeing the company’s CEO, among other duties. Directors are compensated for their work. The board generally establishes committees to enhance the effectiveness of its oversight and focus on matters of particular concern, such as an audit committee and a nominating committee to recommend potential directors to the full board. FHLBank Boards Our previous reports on board diversity include a recent report on the FHLBank System. Each of its 11 federally chartered banks has a board of directors and is cooperatively owned by its member institutions, including commercial and community banks, thrifts, credit unions, and insurance companies. Each bank’s board of directors is made up of directors from member institutions and independent directors (who cannot be affiliated with the bank’s member institutions or recipients of loans). As of October 2018, each FHLBank board had 14-24 directors, for a total of 194 directors. The Federal Home Loan Bank Act, as amended by the Housing and Economic Recovery Act of 2008, and its regulations set forth a number of requirements for FHLBank directors, including skills, term length, and the percentage who are member and independent directors. Benefits of Board Diversity Research we reviewed for our prior work cited several benefits associated with board diversity. For example, academic and business research has shown that the broader range of perspectives represented in diverse groups requires individuals to work harder to come to a consensus, which can lead to better decisions. In addition, research has shown that diverse boards make good business sense because they may better reflect a company’s employee and customer base, and can tap into the skills of a broader talent pool. Some research has found that diverse boards that include women may have a positive impact on a company’s financial performance, but other research has not. These mixed results depend, in part, on differences in how financial performance was defined and what methodologies were used. Our Prior Work Found Women and Minorities Were Underrepresented on Boards Our prior work found the number of women on corporate boards and the number of women and minorities on FHLBank boards had increased, but their representation generally continued to lag behind men and whites, respectively. While the data sources, methodologies, and time frames for our analyses were different for each report, the trends were fairly consistent. In our 2015 report, we analyzed companies in the S&P 1500 and found that women’s representation on corporate boards increased steadily from about 8 percent in 1997 to about 16 percent in 2014. However, despite the increase in women’s representation on boards, we estimated that it could still take decades for women to achieve balance with men. When we projected the representation of women on boards into the future assuming that women join boards in equal proportion to men—a proportion more than twice what we had observed—we estimated it could take about 10 years from 2014 for women to comprise 30 percent of board directors and more than 40 years for the number of women directors to match the number of men directors (see fig. 1). Similarly, in our 2019 report on FHLBank board diversity, we found that the share of women board directors increased from 2015 to October 2018 but that women still comprised less than 25 percent of FHLBank board directors as of 2018 (see fig. 2). Our 2019 FHLBank board report also showed an increase in FHLBank directors from 2015 to 2017 for some minority groups, including African- American, Hispanic, and Asian, but they still reflected a small portion of these boards. Further, the size of the increases in minority directors on FHLBank boards was less clear than for women directors due to incomplete data on directors’ race and ethnicity (see fig. 3). Various Factors May Hinder Board Diversity In 2015 and 2019, we identified similar factors that contributed to lower numbers of women and minorities on corporate and FHLBank boards. Notably, stakeholders, board members, and others we interviewed said three key factors generally limited greater board diversity: (1) not prioritizing diversity in recruitment efforts, (2) limitations of the traditional board candidate pipeline, and (3) low turnover of board seats. Not Prioritizing Diversity in Recruitment Efforts In our reports on corporate and FHLBank board diversity, we found that not prioritizing diversity in recruiting efforts was contributing to a lack of women and minority candidates represented on these boards. For example, stakeholders told us board directors frequently relied on their personal networks to identify potential board candidates. Some stakeholders said that given most current board members are men, and peoples’ professional networks often resemble themselves, relying on their own networks is not likely to identify as many women board candidates. In our 2019 report on FHLBank board diversity, stakeholders we interviewed raised similar challenges to prioritizing diversity in recruitment efforts. Some FHLBank representatives said that member institutions—which nominate and/or vote on director candidates—may prioritize other considerations over diversity, such as a candidate’s name recognition. Stakeholders we interviewed for our 2015 report suggested other recruitment challenges that may hinder women’s representation on corporate boards. For example, stakeholders said that boards need to prioritize diversity during the recruiting process because unconscious biases—attitudes and stereotypes that affect our actions and decisions in an unconscious manner—can limit diversity. One stakeholder observed that board directors may have a tendency to seek out individuals who look or sound like they do, further limiting board diversity. In addition, our 2015 report found some indication that board appointments of women slow down once one or two women are on a board. A few stakeholders expressed some concern over boards that might add a woman to appear as though they are interested in board diversity without really making diversity a priority, sometimes referred to as “tokenism.” Limitations of the Traditional Board Candidate Pipeline Our reports on corporate and FHLBank board diversity also identified challenges related to relying on traditional career pipelines to identify potential board candidates—pipelines in which women and minorities are also underrepresented. Our 2015 report found that boards often appoint current or former CEOs to board positions, and that women held less than 5 percent of CEO positions in the S&P 1500 in 2014. One CEO we interviewed said that as long as boards limit their searches for directors to women executives in the traditional pipeline, boards will have a difficult time finding women. Expanding board searches beyond the traditional sources, such as CEOs, could increase qualified candidates to include those in other senior level positions such as chief financial officers, or chief human resources officers. In 2019 we reported that FHLBank board members said they also experienced challenges identifying diverse board candidates within the traditional CEO talent pipeline. Stakeholders we interviewed cited overall low levels of diversity in the financial services sector, for example, as a challenge to improving board diversity. Some bank representatives said the pipeline of eligible women and minority board candidates is small. Several FHLBank directors said the requirements to identify candidates from within corresponding geographic areas may exacerbate challenges to finding diverse, qualified board candidates in certain areas of the country. By statute, candidates for a given FHLBank board must come from member institutions in the geographic area represented by the vacant board seat. Similarly, in 2011 we reported on Federal Reserve Bank directors and found they tended to be senior executives, a subset of management that is also less diverse. Our report also found that diversity varied among Federal Reserve districts, and candidates for specific board vacancies must reside in specific districts. Recruiting board candidates from within specific professional backgrounds or geographic regions is further compounded by competition for talented women and minority board candidates, according to some stakeholders. In 2019, board directors from several FHLBanks described this kind of competition. For example, a director from one bank said his board encouraged a woman to run for a director seat, but the candidate felt she could not because of her existing responsibilities on the boards of two publicly traded companies. We heard of similar competition among Federal Reserve Bank officials in 2011, where organizations were looking to diversify their boards but were competing with private corporations for the same small pipeline of qualified individuals. Low Turnover of Board Seats Each Year The relatively small number of board seats that become available each year also contributes to the slow increase in women’s and minorities’ representation on boards. Several stakeholders we interviewed for our 2015 report on corporate boards cited low board turnover, in large part due to the long tenure of most board directors, as a barrier to increasing women’s representation. In addition, with respect to FHLBank board diversity, Federal Housing Finance Agency staff acknowledged that low turnover and term lengths were challenges. Several stakeholders we interviewed for our 2019 report on FHLBank boards said balancing the need for board diversity with retaining institutional knowledge creates some challenges to increasing diversity. One director said new board directors face a steep learning curve, so it can take some time for board members to be most effective. As a result, the directors at some banks will recruit new directors only after allowing incumbent directors to reach their maximum terms, which can be several years. Potential Strategies for Increasing Board Diversity Just as our 2015 and 2019 reports found similar challenges to increasing the number of women and minorities on corporate and FHLBank boards, they also describe similar strategies to increase board diversity. While the stakeholders, researchers, and officials from organizations knowledgeable about corporate governance and FHLBank board diversity we interviewed generally agreed on the importance of diverse boards and many of the strategies to achieve diversity, many noted that there is no one-size-fits-all solution to increasing diversity on boards, and in some cases highlighted advantages and disadvantages of various strategies. Based on the themes identified in our prior work, strategies for increasing board diversity generally fall into three main categories—making diversity a priority; enlarging the pipeline of potential candidates; and addressing the low rate of turnover (see fig. 4). Making Diversity a Priority Setting voluntary targets. Several strategies we identified in our 2015 report encouraged or incentivized boards to prioritize diversity. These strategies include setting voluntary targets for the number or proportion of women or minorities to have on the board. Many stakeholders we interviewed for our prior work supported boards setting voluntary targets for a specific number or percentage of women and minority candidates rather than externally imposed targets or quotas. Requiring a diverse slate of candidates. Many stakeholders we interviewed supported a requirement by corporate boards that a slate of candidates be diverse. A couple stakeholders specifically suggested that boards should aim for slates that are half women and half men; two other stakeholders said boards should include more than one woman on a slate of candidates so as to avoid tokenism. Tokenism was also a concern for a few of the stakeholders who were not supportive of defining the composition of slates. Filling interim board seats with women or minority candidates. Our 2019 report included strategies for making diversity a priority for FHLBank boards. For example, some FHLBank directors and Federal Housing Finance Agency staff said filling interim board seats with women and minority candidates could increase diversity. By regulation, when a FHLBank director leaves the board mid-term, the directors may elect a replacement for the remainder of his or her term. One director we interviewed said that when a woman or minority director fills an interim term, the likelihood increases that he or she will be elected by the member institutions for a subsequent full term. Emphasizing the importance of diversity and diverse candidates. Our 2015 report found that emphasizing the importance of diversity and diverse candidates was important for promoting board diversity. Almost all of the stakeholders we interviewed indicated that CEOs or investors and shareholders play an important role in promoting diversity on corporate boards. For example, one stakeholder said CEOs can “set the tone at the top” by encouraging boards to prioritize diversity efforts and acknowledging the benefits of diversity. As we reported in 2019, FHLBanks have taken several steps to emphasize the importance of board diversity. For example, all 11 FHLBanks included statements in their 2017 election announcements that encouraged voting member institutions to consider diversity during the board election process. Six of the 11 banks expressly addressed gender, racial, and ethnic diversity in their announcements. In addition, we found that FHLBanks had developed and implemented strategies that target board diversity in general and member directors specifically. For example, the banks created a task force to develop recommendations for advancing board diversity and to enhance collaboration and information sharing across FHLBank boards. Each bank is represented on the task force. Directors we interviewed from all 11 FHLBanks said their banks conducted or planned to conduct diversity training for board directors, which included topics such as unconscious bias. Mentoring women and minority board candidates. In addition, several stakeholders we interviewed about corporate and FHLBank boards noted the importance of CEOs serving as mentors for women and minority candidates and sponsoring them for board seats. For example, conducting mentoring and outreach was included as a strategy in our 2019 report for increasing diversity on FHLBank boards, including current directors pledging to identify and encourage potential women and minority candidates to run for the board. One director we interviewed said he personally contacted qualified diverse candidates and asked them to run. Another director emphasized the importance of outreach by member directors to member institutions to increase diversity on FHLBank boards. Member directors have the most interaction with the leadership of member institutions and can engage and educate them on the importance of nominating and electing diverse directors to FHLBank boards. Improving information on board diversity. As we reported in 2015, several large investors and many stakeholders we interviewed supported improving federal disclosure requirements on board diversity. In addition to increasing transparency, some organization officials and researchers we interviewed said disclosing information on board diversity could cause companies to think about diversity more. While the SEC aims to ensure that companies provide material information to investors that they need to make informed investment and voting decisions, we found information companies disclose on board diversity is not always useful to investors who value this information. SEC leaves it up to companies to define diversity. As a result, there is variation in how much and the type of information companies provide publicly. Some companies choose to define diversity as including characteristics such as relevant knowledge, skills, and experience. Others define diversity as including demographic characteristics such as gender, race, or ethnicity. (See fig. 5) In February 2019, SEC issued new guidance on its diversity disclosure requirements, which aims to clarify the agency’s expectations for what information companies include in their disclosures. Nearly all of the stakeholders we interviewed for our 2015 report said investors also play an important role in promoting diversity on corporate boards. For example, almost all of the board directors and CEOs we interviewed said investors or shareholders can influence board diversity by exerting pressure on the companies they invest in to prioritize diversity when recruiting new directors. One board director we interviewed said boards listen to investors more than anyone else. For example, there have been recent news reports of investor groups voting against all candidates for board positions when the slate of candidates is not diverse. In addition, in 2019 we recommended that the Federal Housing Finance Agency, which has regulatory authority over FHLBanks, review FHLBanks’ data collection processes for demographic information on their boards. By obtaining a better understanding of the different processes FHLBanks use to collect board demographic data, the Federal Housing Finance Agency and the banks could better determine which processes or practices contribute to more complete data. More complete data could ultimately help increase transparency on board diversity and would allow them to effectively analyze data trends over time and demonstrate the banks’ efforts to maintain or increase board diversity. The Federal Housing Finance Agency agreed with this recommendation and said it intends to engage with FHLBanks’ leadership to discuss board data collection issues. The agency also stated that it plans to request that the FHLBank Board Diversity Task Force explore the feasibility and practicability for FHLBanks to adopt processes that can lead to more complete data on board director demographics. Enlarging the Pipeline of Potential Board Candidates Expanding board searches beyond CEOs. Expanding searches for potential board members is yet another strategy for increasing board diversity, as we reported in 2015 and 2019. Almost all the stakeholders we interviewed supported expanding board searches beyond the traditional pipeline of CEO candidates to increase representation of women. Several stakeholders suggested that boards recruit high performing women in other senior-level positions or look to candidates in academia or the nonprofit and government sectors. Our 2015 analysis found that if boards expanded their director searches beyond CEOs to include senior-level managers, more women might be included in the candidate pool. Our 2019 report on FHLBank board diversity also included looking beyond CEOs as a strategy for increasing diversity. For example, we reported that FHLBanks can search for women and minority candidates by looking beyond member bank CEOs. By regulation, member directors can be any officer or director of a member institution, but there is a tendency to favor CEOs for board positions, according to board directors, representatives of corporate governance organizations, and academic researchers we interviewed for the report. Similar to the findings from our 2015 report, the 2019 report found that the likelihood of identifying a woman or minority candidate increases when member institutions look beyond CEOs to other officers, such as chief human resources officers. Several directors of FHLBanks also reported hiring a search firm or consultant to help them identify women and minority candidates, which is a strategy that can be used to enlarge the typical pool of applicants. Addressing the Low Rate of Turnover Adopting term limits or age limits. Several stakeholders discussed adopting term or age limits to address low turnover of board members. Most stakeholders we interviewed for our 2015 report were not in favor of adopting term limits or age limits, and several pointed out trade-offs. For example, one CEO we interviewed said directors with longer tenure often possess invaluable knowledge about a company that newer board directors do not have. Many of the stakeholders who opposed these strategies noted that term and age limits seem arbitrary and could result in the loss of high-performing directors. Expanding board size. Several stakeholders we interviewed supported expanding board size either permanently or temporarily so as to include more women. Some stakeholders noted that expanding board size might make sense when a board is smaller, but expressed concern about challenges associated with managing large boards. Evaluating board performance. Another strategy we identified in our 2015 report to potentially help address low board turnover and in turn increase board diversity was conducting board evaluations. Many stakeholders we interviewed generally agreed it is good practice to conduct evaluations of the full board or of individual directors, or to use a skills matrix to identify skills gaps. However, a few thought evaluation processes could be more robust. Others said that board dynamics and culture can make it difficult to use evaluations as a tool to increase turnover by removing under-performing directors from boards. Several stakeholders we interviewed discussed how it is important for boards to identify skills gaps and strategically address them when a board vacancy occurs, and one stakeholder said identifying such gaps could help boards think more proactively about finding diverse candidates. The National Association of Corporate Directors has encouraged boards to use evaluations not only as a tool for assessing board director performance, but also as a means to assess board composition and gaps in skill sets. Chairwoman Waters, Ranking Member McHenry, and Members of the Committee, this completes my prepared statement. I would be pleased to respond to any questions that you may have at this time. GAO Contact and Staff Acknowledgments If you or your staff have any questions about this testimony, please contact Chelsa Gurkin, Acting Director of Education, Workforce, and Income Security, at (202) 512-7215 or GurkinC@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. GAO staff who made key contributions to this testimony include Betty Ward-Zukerman (Assistant Director), Meredith Moore (Analyst-in-Charge), Ellie Klein, and Chris Woika. In addition, key support was provided by Susan Aschoff, James Bennett, Ben Bolitzer, Ted Burik, Michael Erb, Daniel Garcia-Diaz, Monika Gomez, Kay Kuhlman, Sheila McCoy, Anna Maria Ortiz, James Rebbe, Karen Tremba, and Walter Vance. Enclosure I: Related GAO Products Financial Services Industry: Representation of Minorities and Women in Management and Practices to Promote Diversity, 2007-2015. GAO-19-398T. Washington, D.C.: February 27, 2019. Federal Home Loan Banks: Steps Have Been Taken to Promote Board Diversity, but Challenges Remain. GAO-19-252. Washington, D.C.: February 14, 2019. Diversity in the Technology Sector: Federal Agencies Could Improve Oversight of Equal Employment Opportunity Requirements. GAO-18-69. Washington, D.C.: November 16, 2017. Financial Services Industry: Trends in Management Representation of Minorities and Women and Diversity Practices, 2007–2015. GAO-18-64. Washington, D.C.: November 8, 2017. Corporate Boards: Strategies to Address Representation of Women Include Federal Disclosure Requirements. GAO-16-30. Washington, D.C.: December 3, 2015. Federal Home Loan Banks: Information on Governance Changes, Board Diversity, and Community Lending. GAO-15-435. Washington, D.C.: May 12, 2015. Diversity Management: Trends and Practices in the Financial Services Industry and Agencies after the Recent Financial Crisis. GAO-13-238. Washington, D.C.: April 16, 2013. Federal Reserve Bank Governance: Opportunities Exist to Broaden Director Recruitment Efforts and Increase Transparency. GAO-12-18. Washington, D.C.: October 19, 2011. Women in Management: Female Managers’ Representation, Characteristics, and Pay. GAO-10-1064T. Washington, D.C.: September 28, 2010. Financial Services Industry: Overall Trends in Management-Level Diversity and Diversity Initiatives, 1993–2008. GAO-10-736T. Washington, D.C.: May 12, 2010. Financial Services Industry: Overall Trends in Management-Level Diversity and Diversity Initiatives, 1993–2004. GAO-06-617. Washington, D.C.: June 1, 2006. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.