Background Nursing homes are required to keep residents safe from harm, but when abuse is alleged, a combination of federal, state, and local agencies—as well as the nursing homes themselves—play a role in investigating. Federal Oversight of Nursing Homes Federal laws establish minimum requirements nursing homes must meet to participate in the Medicare and Medicaid programs, including standards for the quality of care. These standards cover a variety of categories, such as resident rights, quality of care, and quality of life. In 2016, CMS finalized a comprehensive update to its nursing home standards to reflect new requirements and align requirements with current clinical practices, among other things. The changes were implemented in three phases, starting November 28, 2016. The federal government and the states share oversight responsibility for the nation’s nursing homes, with specific activities occurring at the national, regional, and state levels. CMS central office. At the national level, the CMS central office oversees the federal standards nursing homes must meet to participate in the Medicare and Medicaid programs. Primarily through its State Operations Manual, the office establishes the responsibilities of CMS’s regional offices and state survey agencies in ensuring that federal quality standards for nursing homes are met. CMS regional offices. CMS’s 10 regional offices oversee state activities and report back to the CMS central office the results of their efforts. Specifically, regional offices use the State Performance Standards System to evaluate state surveyors’ performance on factors such as the frequency and quality of state surveys. State survey agencies. Under agreement with CMS, a state survey agency in each state assesses whether nursing homes meet CMS’s standards, allowing them to participate in the Medicare and Medicaid programs. State survey agencies assess nursing homes using (1) recurring standard surveys and (2) as-needed investigations. Standard surveys. State survey agencies are required by federal law to perform unannounced, on-site standard surveys of every nursing home receiving Medicare or Medicaid payment at least every 15 months, with a statewide average frequency of every 12 months. These surveys are a comprehensive assessment designed to determine whether nursing homes are complying with Medicare and Medicaid quality standards. Investigations. In addition to standard surveys, state survey agencies are required by federal law to investigate (1) complaints submitted by residents, family members, friends, physicians, and nursing home staff; and (2) “facility-reported incidents,” including incidents involving abuse of residents, that are self-reported by the nursing homes. State survey agencies review the information provided through these complaints and incidents and determine if an on-site investigation is required. During this unannounced investigation, the state surveyors assess available evidence to determine whether the allegation can be substantiated. These investigations offer the state survey agency the opportunity to identify and correct care problems in a more timely manner than through the standard surveys. If a surveyor determines that a nursing home violated a federal standard during a survey or investigation, then a deficiency code specific to that standard is cited. For instance, one deficiency code for abuse of residents encompasses mental/verbal, sexual, or physical abuse; while a few additional deficiency codes encompass abuse-related issues, such as a failure by the nursing home to train staff on issues related to abuse. Cited deficiencies are then classified into categories according to scope (the number of residents potentially affected) and severity (the potential for or occurrence of harm to residents). (See table 1.) State survey agencies are required to enter data about deficiencies into CMS’s survey database. For most deficiencies, the nursing home is required to prepare a plan of correction, and, depending on the scope and severity of the deficiency, surveyors may re-visit the facility to ensure that the nursing home has implemented its plan and corrected the deficiency. In any instances where surveyors substantiate the occurrence of resident abuse, the state survey agency is required to refer the case to three entities: 1) local law enforcement; 2) the MFCU, if appropriate; and 3) the state’s nurse aide registry or other applicable professional licensure authority. When nursing homes are cited with deficiencies, federal enforcement actions—or penalties—can be imposed to encourage homes to make corrections. In general, enforcement actions: (1) may be initially recommended by the state survey agency, (2) are transferred to the CMS regional office for review, (3) are imposed by the same CMS regional office, and (4) are implemented—that is, put into effect. Depending on the scope and severity of the deficiency cited, the CMS regional office may impose certain enforcement actions so that they are implemented immediately. However, for other enforcement actions, the regional office may provide the nursing home with an opportunity to correct the deficiencies, which, if corrected before the scheduled effective date, can result in the penalty not being implemented. Penalties include directed in- service training, fines known as civil money penalties, denial of payment, and termination from the Medicare and Medicaid programs, among others. (See fig. 1.) Reporting and Investigation of Abuse by Nursing Homes When a nursing home becomes aware of an incident of alleged resident abuse, the home must: immediately report the allegation to the state survey agency and then conduct an investigation of the alleged incident. Specifically, the process is as follows: The nursing home must immediately report alleged abuse to the state survey agency. After notifying the state survey agency, the nursing home is also required to conduct its own investigation and submit its findings in a written report to the state survey agency within 5 working days of the incident. Depending on the severity of the circumstances, the state survey agency may visit the nursing home to investigate the incident or wait until the nursing home submits its report. Depending on the content of the report, the state survey agency may request the home conduct additional work or the state survey agency may investigate further on its own. If the state survey agency opts not to investigate further, it may still review the manner in which the home conducted its investigation during the state survey agency’s next scheduled standard survey. If a state survey agency determines that a nurse aide is responsible for abuse, the agency must add this finding to the state’s nurse aide registry—a registry that each state is required to maintain that lists all individuals who have satisfactorily completed approved nurse aide training and a competency evaluation program in that state. Nursing homes are prohibited from employing a nurse aide with a finding of abuse on the nurse aide registry. Further, if there is a reasonable suspicion that a crime has occurred that results in serious bodily injury, federal law requires certain covered individuals at the nursing home to immediately report to law enforcement in addition to the state survey agency. Before employing a nurse aide, nursing homes are required to check each relevant state’s registry to verify that the nurse aide has passed a competency evaluation. All nursing homes must also verify with the relevant state board of licensing the professional credentials of the licensed personnel, such as registered nurses, whom they hire. Other State and Local Agencies That May Investigate Abuse in Nursing Homes In addition to state survey agencies, there are other state and local agencies that may be involved in investigating abuse in nursing homes. These other state and local agencies that investigate abuse in nursing homes are generally focused on the different aspects of the specific alleged abuse incident, in contrast to the state survey agency, which focuses on the safety of individual residents, as well as on the facility’s policies and procedures for preventing and effectively addressing abuse. These other state and local agencies include: Adult Protective Services. In some states, Adult Protective Services’ investigators are trained to provide protection and intervention for older adults in nursing homes and can play a valuable role in helping to protect residents from abuse. Ombudsmen. Long-term care ombudsmen, who serve as advocates for nursing home residents, may also investigate abuse complaints made by or on behalf of residents. Local law enforcement. Law enforcement may also play a role in investigating alleged nursing home resident abuse. Specifically, local police departments may learn of suspected instances of resident abuse and conduct criminal investigations. MFCU. The state MFCUs typically learn of abuse allegations through referrals from state survey agencies, which CMS requires if abuse is substantiated. If, after investigating an allegation, the MFCU decides that there is sufficient evidence to press criminal charges, it may prosecute the case itself or refer the matter to the state’s attorney general or a local prosecutor. More Abuse Deficiencies Were Cited in Nursing Homes from 2013 through 2017; Physical and Mental/Verbal Abuse and Staff Perpetrators Were Most Common Abuse Deficiencies Cited and the Number of Nursing Homes Involved More than Doubled from 2013 through 2017, with the Largest Increase in Severe Cases Our analysis of CMS data found that from 2013 through 2017, abuse deficiencies cited in nursing homes became more frequent, with the largest increase in severe cases. While abuse deficiencies are relatively rare—they comprise less than 1 percent of the total deficiencies in each of the years we examined—they became more common over the 5-year period. Specifically, the number of abuse deficiencies cited more than doubled—from 430 in 2013 to 875 in 2017 (a 103.5 percent increase). This trend for the abuse deficiencies is in contrast to the trend for all deficiencies, which decreased about 1 percent between 2013 and 2017. At the state level, 32 states had more abuse deficiencies cited in 2017 than 2013, six states had a consistent number, and the remaining 13 had fewer. (See app. III for additional data on abuse deficiencies by state.) Furthermore, abuse deficiencies cited in 2017 were more likely to be categorized at the highest levels of severity—deficiencies causing actual harm to residents or putting residents in immediate jeopardy—than they were in 2013. Specifically, 42.6 percent of the 875 abuse deficiencies were categorized as causing actual harm or posing immediate jeopardy to residents in 2017, compared to 31.9 percent of the 430 abuse deficiencies in 2013. (See fig. 2.) In examining the types of survey or investigations conducted to identify abuse deficiencies, we found that, from 2013 to 2017, the majority (about two-thirds in each year) were identified through either a complaint investigation or facility-reported incident investigation. In contrast, for all types of deficiencies, we found the inverse—the vast majority were identified through a standard survey. This demonstrates the unique and significant role that complaint and facility-reported incident investigations have in identifying abuse deficiencies, because they allow for the identification and correction of abuse in a more timely manner than a standard survey. In fact, for the deficiencies for which we were able to identify the source, the percentage of abuse deficiencies identified through facility-reported incident investigations increased from 42.3 percent of the 430 abuse deficiencies in 2013 to 47.4 percent of the 875 abuse deficiencies in 2017. Conversely, for all types of deficiencies, a very small percentage resulted from facility-reported incident investigations—about 5 percent or less each year. (See fig. 3.) We found that enforcement actions—or penalties—were imposed and implemented by CMS infrequently each year in response to abuse deficiencies, and that fines were the most common type of implemented penalty. Specifically, for each year from 2013 through 2017, we found that about one-third of abuse deficiencies had an enforcement action imposed but not implemented, and less than 8 percent of abuse deficiencies had enforcement actions that were implemented against the nursing home. This was fairly consistent over the 5-year period. For example, in 2017, of the 875 abuse deficiencies cited, 275 (31.4 percent) resulted in enforcement actions that were imposed but not implemented and 65 (7.4 percent) had enforcement actions that were implemented against the nursing home. Furthermore, for abuse deficiencies cited at the most severe levels—that is, those causing actual harm or immediate jeopardy to residents—a smaller percentage of the deficiencies had an enforcement action imposed but not implemented compared to all abuse deficiencies, but a larger percentage were implemented. For example, in 2017, 373 of the 875 abuse deficiencies were cited at the most severe levels; of those, 81 (21.7 percent) resulted in enforcement actions that were imposed but not implemented, and 51 (13.7 percent) were implemented against the nursing home. Regardless of the severity, the predominant reason that CMS did not implement imposed enforcement actions was because the nursing home came into compliance prior to the implementation date of the penalty. For implemented enforcement actions, fines—known as civil money penalties—were overwhelmingly the most common type of penalty implemented against nursing homes with abuse deficiencies, increasing from 69.6 percent of the 23 abuse deficiencies with implemented enforcement actions in 2013 to 83.1 percent of the 65 in 2017. Denial of payments for new Medicare and Medicaid admissions—another financial penalty—was the second most common type of implemented enforcement action, but decreased from 34.8 percent in 2013 to 13.8 percent in 2017. Mandatory termination is the most severe enforcement action as it ends all payments for Medicare and Medicaid residents; it is implemented very rarely, with only one abuse deficiency resulting in mandatory termination of the nursing home across all 5 years. (See fig. 4.) In addition, we found the number of nursing homes with abuse deficiencies also more than doubled over the 5-year period. In 2013, 394 nursing homes (2.7 percent of all surveyed nursing homes) had at least one abuse deficiency compared to 821 nursing homes (5.6 percent of all surveyed nursing homes) in 2017. A nursing home may have more than one abuse deficiency cited in a single year, such as from a standard survey early in the year and then a complaint investigation later in the year. We found that in 2013, of the 394 nursing homes that had a total of 430 abuse deficiencies cited, 85 of the homes had two or more abuse deficiencies that year. In 2017, of the 821 nursing homes that had 875 total abuse deficiencies cited, 155 had two or more that year. Further, across the 5-year period, we found that a small proportion of all nursing homes with abuse deficiencies had them in multiple consecutive years. Specifically, across all years, 2,214 total unique nursing homes (13.6 percent of all surveyed nursing homes) had at least one abuse deficiency. A small portion of these nursing homes had at least one abuse deficiency in multiple consecutive years, indicating potential patterns in abuse at these nursing homes. Specifically, 185 of the 2,214 nursing homes with abuse deficiencies over the 5-year period—8.4 percent—had an abuse deficiency in any 2 consecutive years. In addition, 25 of the nursing homes—1.1 percent—had an abuse deficiency in 3 or more consecutive years. (See fig. 5.) Finally, we analyzed a selection of characteristics, including ownership type and bed size, for these nursing homes that had abuse deficiencies cited in multiple years and compared them to homes that had abuse deficiencies cited in a single year and surveyed homes that did not have any abuse deficiencies. We found that the nursing homes differed. For example, while for-profit organizations—the largest ownership group accounting for 67.9 percent of all surveyed nursing homes—owned 66.9 percent of nursing homes without any abuse deficiencies cited over the 5- year period, they accounted for 78.6 percent of nursing homes that had abuse deficiencies cited in 2 or more years. In addition, nursing homes designated as Special Focus Facilities—a CMS program that provides increased oversight to homes with consistent poor performance— constituted 2.5 percent of all surveyed nursing homes compared to 1.9 percent of nursing homes without abuse deficiencies and 10.1 percent of nursing homes with abuse deficiencies cited in 2 or more years. (See table 2.) Physical and Mental/Verbal Abuse Occurred Most Often, Followed by Sexual Abuse, and Staff Were More Often Perpetrators of Abuse in 2016 and 2017 Our analysis of a representative sample of CMS narrative descriptions— written by state surveyors—associated with abuse deficiencies cited in 2016 and 2017 found that physical and mental/verbal abuse occurred most often in nursing homes, followed by sexual abuse. Further, staff were more often the perpetrators of the deficiencies cited as abuse than were residents or others. (See fig. 6.) Physical abuse, which CMS defines as hitting, slapping, punching, biting and kicking residents, was present in about 46 percent (+/- 5 percent) of the abuse deficiency narratives. Mental/verbal abuse, which CMS defines as verbal or nonverbal conduct that can cause a resident to experience humiliation and fear, among other things, was present in about 44 percent (+/- 5 percent) of the abuse deficiency narratives. Sexual abuse, which CMS defines as non-consensual sexual contact with a resident, was present in about 18 percent (+/- 5 percent) of the abuse deficiency narratives. Staff, which includes those working in any part of the nursing home, were perpetrators in 58 percent (+/- 5 percent) of abuse deficiency narratives, followed by resident perpetrators (30 percent +/- 5 percent) and other types of perpetrators (2 percent +/- 5 percent). Other types of perpetrators can include family members of residents or other visitors. Further, our analysis of the narratives found that sexual abuse perpetrated by residents (39 percent) occurred more frequently within our sample than sexual abuse perpetrated by staff (10 percent) or others (17 percent). When staff were the perpetrators of abuse, we found within our sample that mental/verbal abuse was the most common type of abuse (60 percent), while physical abuse was most common in situations where residents (59 percent) or others (67 percent) were the perpetrators. For examples of the different types of abuse and perpetrators from our analysis, see table 3 below. Within our sample of narratives, mental/verbal abuse was less likely to be categorized by surveyors as severe compared to physical and sexual abuse. Specifically, we found in our sample that the proportion of mental/verbal abuse (30 percent) categorized by state surveyors as severe—defined as actual harm or immediate jeopardy—was smaller than the proportion of physical (40 percent) and sexual abuse (58 percent) categorized as severe. In addition, we found that most of the mental/verbal (88 percent), physical (91 percent), and sexual abuse (77 percent) narratives in our sample were categorized by surveyors as “isolated” in scope. Stakeholders Identified Resident Characteristics and Staffing Inadequacies as Risk Factors for Abuse, and Underreporting as among the Challenges to Investigating Abuse Some Resident Characteristics and Inadequacies in Staffing, Training, and Staff Screening Can Increase Risk of Abuse Stakeholder groups in most of the five states we interviewed—including state survey agencies, Adult Protective Services, law enforcement, MFCUs, ombudsmen, and nursing home administrators and clinical staff—identified risk factors for abuse in nursing homes that included resident characteristics, such as residents with infrequent visitors, and nursing home staffing characteristics, such as insufficient staffing levels. (See table 4 for a description of these risk factors.) Officials we interviewed from national organizations with knowledge of abuse in nursing homes also noted some of these same risk factors. Resident characteristics. Stakeholders in each of our five selected states noted that residents who do not have frequent visitors, are cognitively impaired, or mixed with widely different age groups may be at an increased risk for abuse. Residents who do not have frequent visitors. Stakeholders in four of the five states said that residents without regular visitors, such as family, may be at an increased risk for abuse because regular visitors could notice and report potential warning signs of abuse, such as changes in their behavior or physical appearance. Residents who are cognitively impaired. Stakeholders in each of the five states said that cognitively impaired residents may be especially vulnerable to abuse because they often cannot speak or may have difficulty recalling recent events, and they are therefore less likely to be able to remember or describe what happened. In addition to noting that cognitively impaired residents may be at an increased risk of abuse, some stakeholders said that some cognitively impaired residents may be more likely to be perpetrators of abuse as their condition can have behavioral symptoms, such as physical aggressiveness. Residents mixed with widely different age groups. Stakeholders in four of the five states also noted that elderly nursing home residents who are mixed with widely differing age groups, such as young adults with mental illness, may be at a higher risk for incidents of abuse due to the different characteristics of these groups. Combining these two populations, which have differing needs, can also be challenging for staff. For example, staff may have more experience caring for elderly residents with complex needs, such as dementia, and they may not have the necessary skills or training to care for needs of younger residents, who require other types of complex care. This can create a stressful environment for staff, which is a risk factor for staff as potential perpetrators of abuse. Two stakeholders noted that younger residents who may have mental illness can have conflicts with older and frailer residents, potentially leading to abusive incidents between residents. Nursing home staffing characteristics. Stakeholders we interviewed in each of our five selected states noted that nursing homes with insufficient staffing, inadequate staff training, and inadequate staff screening may be at risk for abuse. Nursing homes with insufficient staff. Stakeholders in each of the five states said that nursing homes with insufficient staff may be at risk for abuse because there may not be enough staff attending to the needs of residents. Stakeholders noted that nursing homes have faced challenges hiring and retaining qualified staff and that, as a result, existing staff can feel overworked, stressed, or exhausted, which can lead to abusive behaviors. Staffing issues are not just risk factors for staff as perpetrators of abuse, but they can also limit a staff member’s ability to identify and report abuse. For example, insufficient staffing may mean that there are not enough available staff to notice signs of abuse in a timely fashion, such as noticing a resident’s bruises before they heal. Nursing homes with inadequate staff training on abuse. Inadequate staff training on abuse was noted by stakeholders we interviewed in four of the five states as a risk factor for abuse because; for example, staff may not know how to diffuse challenging situations with residents and identify and report abuse. As previously noted, recognizing abuse can be challenging and, even when abuse is identified, it is often not reported. Officials from all of the nursing homes that we visited said that they provide training to their staff on abuse, including on defining abuse, identifying or detecting different types of abuse, and reporting abuse. Staff members we spoke with at one nursing home said that, not only are they trained to look for physical signs of abuse, such as bruising, but they are also trained to observe changes in behavior that may be warning signs for abuse, such as a resident suddenly withdrawing from group activities. Staff at another nursing home said that they are also taught to ask another staff member for assistance when they are feeling frustrated or stressed by caring for a particular resident. In contrast, staff at another nursing home noted the challenges of not having these types of resources and said they are needed at their facility. Nursing homes with inadequate staff screening. Stakeholders in three of our five states said that inadequate staff screening can be a risk factor for abuse. Some stakeholders said that a thorough background screening can be time consuming. Further, because staff screening through background checks and the nurse aide registry is not coordinated across the country, there are gaps that could enable individuals who committed crimes in one state to obtain employment at a nursing home in another state, a concern that we previously reported. Staff from a nursing home we visited said the prevention of abuse “starts with hiring the right staff” and noted the importance of conducting background checks and checking references for prospective employees. Underreporting of Abuse, Cognitive Impairment of Victims, Lack of Nursing Home Cooperation, and Lack of Agency Coordination Pose Challenges for Abuse Investigations The key challenges for abuse investigations most frequently identified by stakeholder groups in the five states we reviewed were underreporting of abuse, cognitive impairment of victims, lack of cooperation from nursing homes, and lack of agency coordination. (See table 5 for a description of these challenges.) Officials we interviewed from national organizations with knowledge of abuse in nursing homes also noted some of these same challenges. Underreporting of abuse. Stakeholders in each of the five states in our review noted that abuse in nursing homes may be underreported because residents or their families feel uncomfortable or fear retaliation from nursing home staff. For example, residents who were sexually abused may feel ashamed or embarrassed to report these incidents. In addition, residents may fear retaliation by the nursing home staff on whom they depend, which might include substandard care, exclusion from activities, or even eviction from the home. A fear of retaliation can also extend to nursing home staff, who may witness abuse by another staff member, but may be afraid to report it out of fear that they will lose their jobs or that they will face retaliation from co-workers. This underreporting creates challenges for investigators, who are unable to investigate if they do not know that abuse has occurred. Cognitive impairment of victims. Stakeholders in each of the five states in our review said that victims with cognitive impairment may not be able to give statements regarding the abuse or may not be considered reliable witnesses. For example, residents with dementia may not be able to remember the details of an abusive incident, and their memory of the details may deteriorate over the course of an investigation. Or, residents with dementia may report abuse that stems from traumatic memories from an incident that occurred earlier in their lives. One stakeholder said this can be a challenge for investigations because they do not know how much they can rely on a cognitively impaired resident’s statement, making it difficult for them to corroborate an abuse allegation. However, one stakeholder noted that, while it can be difficult to interview abuse victims with cognitive impairment, it is important to treat their allegations seriously and with credibility. One law enforcement stakeholder noted that interviews with these victims require special training. Lack of cooperation from some nursing homes. Stakeholders in each of the five states in our review said that some nursing homes may withhold, alter, or make it difficult for investigatory agencies to gain access to necessary, timely, or accurate information about alleged abuse. This may be, for example, because they may fear adverse publicity, litigation, or penalties from the state or CMS. In addition, as noted previously, nursing home staff may be fearful of losing their jobs. Stakeholders said that nursing home staff who witnessed abuse may be intentionally vague when interviewed by investigators; for example, by saying they cannot recall an incident. Some stakeholders also noted that nursing homes may delay investigators’ access to patient records, or they may even alter patient records in order to fill in information that should have been documented but was not at the time of the incident. One stakeholder we interviewed noted that the problem is not necessarily widespread—that some nursing homes are open about sharing information while others can be more difficult. Another stakeholder noted that a nursing home’s cooperation can sometimes depend on the seriousness of the allegation. Lack of agency coordination. Stakeholders in three of the five states in our review said that having multiple agencies involved in investigations, such as the state survey agency, law enforcement, the ombudsman, and, in some states, Adult Protective Services, can create challenges, including coordinating investigations and notifying one another about investigation outcomes. One stakeholder said they sometimes begin an investigation without realizing another investigatory agency has already started its own investigation. Further, stakeholders in two of the five states in our review said that CMS does not allow state survey agencies to share important investigatory information with law enforcement. (We discuss this issue in more detail later in this report.) CMS’s Ability to Ensure Nursing Home Residents Are Free from Abuse May Be Limited by Gaps in Oversight We found that CMS: (1) cannot readily access data on the type of abuse or type of perpetrator, (2) has not provided guidance on what information nursing homes should include in facility-reported incidents, and (3) has numerous gaps in its referral process that can result in delayed and missed referrals to other entities. Together, these gaps affect critical points in CMS’s oversight of abuse in nursing homes including the prevention, identification, and timely investigation of abuse. Information on Abuse and Perpetrator Types Is Not Readily Available CMS cannot readily access information on abuse or perpetrator type in its datasets and, as a result, lacks key information critical to understanding and appropriately addressing nursing home abuse with its oversight. Specifically, in two of CMS’s datasets—complaints/facility-reported incidents and deficiencies—agency officials told us they do not require the state survey agencies to record abuse and perpetrator type. As a result, we found that CMS’s data do not readily support CMS’s understanding of the types of abuse and perpetrators that are most prevalent in nursing homes. CMS officials told us they believe that the majority of abuse is committed by nursing home residents, and that physical and sexual abuse were the most common types; officials said they based this current understanding of abuse and perpetrator types on professional experience, literature, and ad hoc analyses of deficiency narrative descriptions. However, our review of a representative sample of abuse deficiency narratives from 2016 and 2017 found that staff were more often the perpetrators of deficiencies cited as abuse than residents or others, and that physical and mental/verbal abuse occurred most often in nursing homes, followed by sexual abuse. CMS officials noted that some incidents resulting from resident altercations—particularly those that do not show a willful intent to harm—may not have been cited as an abuse deficiency by some state survey agencies and may have been cited as other deficiencies not specified as abuse. This may have contributed to the difference between CMS’s understanding of the prevalence of resident to resident abuse and what their abuse deficiency data show. If CMS required information on abuse and perpetrator type to be recorded, the agency would have a better understanding of abuse in nursing homes. However, CMS officials told us they do not currently require the state survey agencies to specify abuse and perpetrator type because they consider the surveyor’s job to be identification and documentation of noncompliance. Additionally, CMS officials told us they have not conducted a systematic review to gather information on abuse and perpetrator type. This is inconsistent with federal internal control standards directing management to use quality information to achieve program objectives. Without the systematic collection and monitoring of specific abuse and perpetrator data, CMS lacks key information and, therefore, cannot take actions—such as tailoring prevention and investigation activities—to address the most prevalent types of abuse or perpetrators. Facility-Reported Incidents Lack Key Information All of the state survey agencies we spoke to told us that facility-reported incidents can lack key information that can cause potential delays in abuse investigations. Specifically, officials from each of the five state survey agencies told us that the facility-reported incidents they receive from nursing homes can lack key information that affects their ability to effectively triage incidents and determine whether an investigation should occur and how soon. Two state survey agencies we spoke with said they sometimes have to conduct significant follow-up with the nursing homes to obtain the information they need to prioritize the incident for investigation—follow-up that delays and potentially negatively affects investigations. For example, one state survey agency told us that a facility reported abuse involving two residents but did not initially report that the residents were injured, and that the facility did not file an addendum to the facility-reported incident to indicate resident injury. As a result of this incomplete information, the state survey agency did not properly prioritize this incident response. Despite federal law requiring nursing homes to self-report allegations of abuse, and covered individuals to report reasonable suspicions of crimes against residents, CMS has not provided guidance on what information should be included in these reports. Our review of CMS’s State Operations Manual found that CMS does not have guidance related to the information that nursing homes or covered individuals should report to the state survey agencies or local law enforcement; in contrast, it does contain guidance on the type of information members of the public should include in a complaint about nursing home quality to the state survey agency—and CMS makes a standardized complaint template form available on its website. The lack of guidance on the information that state survey agencies should collect on facility-reported incidents is inconsistent with federal internal control standards directing management to use quality information to achieve program objectives. CMS could outline basic information requirements that states must include on incident forms used by nursing homes and covered individuals to ensure the state survey agency is receiving the information it needs to accurately and quickly triage these incidents. CMS officials told us in November 2018 that they have efforts underway to examine guidance related to the information state survey agencies need to appropriately triage these facility-reported incidents and are developing a facility-reported incident template. Until the guidance and template are in place, these facility-reported incidents may lack key information that can cause potential delays in abuse investigations. Gaps Exist in CMS Process for State Survey Agency Referrals to Law Enforcement and MFCUs CMS requires state survey agencies to make referrals to law enforcement and, if appropriate, to MFCUs when abuse is substantiated; however, we found numerous gaps in CMS’s referral process that can result in delayed and missed referrals. (See table 6.) Timing of abuse referrals. We found CMS’s requirements for when state survey agencies should report abuse to law enforcement and MFCUs lag behind the federal requirements for when covered individuals should make such referrals, and, as a result, referrals may be significantly delayed. Specifically, federal law requires covered individuals to immediately report reasonable suspicions of a crime against a resident that results in serious bodily injury to law enforcement and the state survey agency. Conversely, state survey agencies do not have to report suspicions of crime identified on complaints submitted to, and surveys conducted by, the state survey agency until the abuse has been substantiated—a process that can often take weeks or months. Officials from one law enforcement agency and two MFCUs that we interviewed told us the delay in receiving referrals limits their ability to collect evidence and prosecute cases—for example, bedding associated with potential sexual abuse may have been washed and wounds may have healed. This is consistent with the findings of our 2002 report, where we recommended that CMS should ensure that state survey agencies immediately notify law enforcement or MFCUs when nursing homes report allegations of physical or sexual abuse. One state survey agency in our review established more stringent guidelines than CMS by requiring the surveyors to notify law enforcement and the MFCU promptly upon receiving a complaint of abuse. CMS officials told us their state survey agency reporting requirements are based on a March 2002 policy. This is inconsistent with standards for internal control, which state that management should communicate quality information externally so that external parties can help the entity achieve its objectives. Tracking of abuse referrals. In addition to delays in referring cases to law enforcement and MFCUs, CMS officials also told us that CMS does not conduct oversight to ensure that state survey agency referrals to law enforcement and the MFCUs are occurring as required for substantiated abuse, and, as a result, CMS cannot ensure that state survey agencies are complying with reporting obligations. For example, an official from one of the five state survey agencies we interviewed said they had never made a referral to law enforcement or the MFCU, despite having substantiated allegations of abuse. The state survey agency official told us that they do not refer cases to law enforcement, and that law enforcement referrals are the responsibility of the nursing home. This is incompatible with CMS guidelines requiring that substantiated abuse be referred to law enforcement; however, CMS officials told us that they do not track whether state survey agencies make referrals to law enforcement and the MFCUs. This is inconsistent with federal standards for internal control, which state that management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Definition of substantiated abuse. We found confusion among some state survey agencies about CMS’s definition of what it means to substantiate an allegation of abuse—a challenge because substantiation is a trigger in the investigation process, and CMS requires state survey agencies to make referrals to law enforcement and staff registries when abuse is substantiated by evidence. As a result, there is a potential for substantiated abuse to not be reported and, subsequently, not referred to law enforcement or MFCUs for criminal investigation. Two of the five state survey agencies in our review told us they believed they could not substantiate an allegation unless they could also cite a federal deficiency. This is inconsistent with CMS’s guidance, which says that state survey agencies can substantiate that an allegation occurred without citing a federal deficiency and that, subsequently, these substantiated allegations must be referred to law enforcement and staff registries. For example, according to CMS guidance, if the state survey agency investigated and found evidence that a resident was abused, but the nursing home had taken preventive actions against the deficient practice, the state survey agency would then substantiate that the abuse occurred, but not cite a deficiency. However, state survey agencies may decide not to substantiate an abuse allegation verified by evidence if they believe no deficiency should be cited, such as if the nursing home had taken preventive action against the deficient practice, which could result in that abuse going unreported and not referred to law enforcement, MFCUs, or staff registries. Because substantiation of abuse is a critical trigger in abuse investigations, confusion around its interpretation could prevent these important next steps. CMS officials told us they are aware that the state survey agencies have varying interpretations of what it means to substantiate abuse. According to federal standards for internal control, management should internally communicate quality information to achieve the entity’s objectives. Information sharing. We also found that CMS’s guidance on state survey agency referrals contained in its State Operations Manual does not specify what incident information can be shared with local law enforcement, either in response to local law enforcement’s request for information or when the state survey agency refers substantiated findings of abuse to local law enforcement. As a result, both state survey and law enforcement agencies expressed confusion and frustration about what information can be shared and said delays have occurred that can impede law enforcement investigations. Officials from two state survey agencies told us that CMS does not allow them to share any information with law enforcement without a written request. For example, officials from one state survey agency said that they cannot share the name of the resident abused or the time when the incident occurred. One state survey agency said that information sharing can be uneven, and told us that law enforcement is required to share information with the state survey agencies, but the state survey agencies do not share their investigatory information with law enforcement. Officials from another state survey agency wrote to CMS notifying CMS of a change in their state survey agency protocol that would make the referral process timelier by providing un-redacted survey records of substantiated abuse to local law enforcement. However, in CMS’s 2017 written response to the survey agency, CMS told them that all written requests for these records must continue to be forwarded to CMS for processing in accordance with the federal Privacy Act. When we asked CMS officials what information state survey agencies can share with law enforcement in a referral, CMS explained that scenarios for requesting information can vary, and that CMS does not prescribe a specific method as it depends on the needs of the investigation. This lack of guidance is inconsistent with federal standards for internal control, which state that management should internally communicate quality information to achieve the entity’s objectives. Conclusions While nursing home abuse is relatively rare, our review shows that abuse deficiencies cited in nursing homes are becoming more frequent, with the largest increase in severe cases. As such, it is imperative that CMS have key information critical to understanding abuse and that the agency’s oversight of nursing homes is strong. We found weaknesses in both CMS’s understanding of abuse and in its oversight that need to be addressed. Specifically, because CMS cannot readily access information on abuse or perpetrator types in its data, it lacks key information critical to taking appropriate actions to address the most prevalent types of abuse and perpetrators. In addition, CMS has not provided guidance on what information should be included in facility-reported incidents, contributing to a lack of information for state survey agencies and, subsequently, delays in their investigations. This lack of guidance related to facility- reported incidents is important in light of our findings that abuse deficiencies are identified most commonly through facility-reported incidents. We also found other gaps in CMS’s process related to ensuring timely referrals of abuse to law enforcement, tracking abuse referrals, defining abuse substantiation, and sharing information with law enforcement. These gaps affect CMS’s oversight of abuse in nursing homes—including the prevention, identification and timely investigation of abuse—and may limit CMS’s ability to ensure that nursing homes meet federal requirements for residents to be free from abuse. Recommendations for Executive Action We are making the following six recommendations to the administrator of CMS: Require that abuse and perpetrator type be submitted by state survey agencies in CMS’s databases for deficiency, complaint, and facility- reported incident data, and that CMS systematically assess trends in these data. (Recommendation 1) Develop and disseminate guidance—including a standardized form—to all state survey agencies on the information nursing homes and covered individuals should include on facility-reported incidents. (Recommendation 2) Require state survey agencies to immediately refer complaints and surveys to law enforcement (and, when applicable, to MFCUs) if they have a reasonable suspicion that a crime against a resident has occurred when the complaint is received. (Recommendation 3) Conduct oversight of state survey agencies to ensure referrals of complaints, surveys, and substantiated incidents with reasonable suspicion of a crime are referred to law enforcement (and, when applicable, to MFCUs) in a timely fashion. (Recommendation 4) Develop guidance for state survey agencies clarifying that allegations verified by evidence should be substantiated and reported to law enforcement and state registries in cases where citing a federal deficiency may not be appropriate. (Recommendation 5) Provide guidance on what information should be contained in the referral of abuse allegations to law enforcement. (Recommendation 6) Agency Comments We provided a draft of this product to HHS for review and comment. In its comments, reproduced in appendix IV, HHS concurred with our six recommendations and identified actions it is taking to implement them. Specifically, HHS said that it will: (1) look into options for requiring state survey agencies to record data on abuse and perpetrator type so that HHS may assess trends in these data; (2) develop guidance that includes a list of standardized data elements to be included when nursing homes report facility-reported incidents and guidance specific to the reporting and tracking of facility-reported incidents involving abuse; (3) require state survey agencies to immediately refer complaints to law enforcement if a reasonable suspicion of a crime against a resident has occurred and share relevant survey information; (4) consider how to implement mechanisms for tracking law enforcement referrals; (5) identify opportunities to clarify in guidance situations where citing a federal deficiency may not be appropriate, but reporting the abuse is still required; and (6) develop a list of standardized elements that should be included when reporting an abuse allegation to law enforcement. HHS also provided technical comments, which we incorporated as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of HHS and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7114 or at dickenj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix V. Appendix I: Additional Detail on Analysis of Centers for Medicare & Medicaid Services’ (CMS) Data This appendix describes our scope and methodology for determining the trends and types of abuse occurring in nursing homes in recent years. For this examination, we reviewed CMS guidance and analyzed data from 2013 through 2017, which represented the most recent data for a 5-year period at the time of our review. Specifically, we first reviewed the CMS State Operations Manual’s Appendix PP that was in effect during our period of review to determine which federal standards and deficiency codes were relevant to resident abuse. We focused our analysis on the deficiency code to be used by state surveyors when a nursing home fails to keep a resident free from abuse, which encompasses mental/verbal, sexual, or physical abuse. Surveyors can also use other deficiency codes for abuse-related issues, such as a failure by the nursing home to train staff on issues related to abuse, either in conjunction with an abuse deficiency or without an abuse deficiency. Since these abuse-related deficiency codes do not necessarily represent incidents of abuse, but do represent situations where a nursing home’s inadequate policies could leave residents vulnerable to abuse, we conducted a limited analysis on the trends of these deficiencies, which is described in appendix II. For our analysis, we identified abuse deficiencies cited by surveyors in all 50 states and Washington, D.C., between 2013 and 2017, using data provided by CMS from its Certification and Survey Provider Enhanced Reports system. Specifically, we calculated the number of abuse deficiencies cited each year and determined how many of these abuse deficiencies were at each level of severity—no actual harm with a potential for minimal harm, no actual harm with a potential for more than minimal harm, actual harm, and immediate jeopardy—for each year. We compared the results for abuse deficiencies with the results for all types of deficiencies in each year. To avoid over-counting deficiencies, deficiencies that were for the same violation on the same day for the same facility were counted as a single deficiency. We then tracked (1) the origin of these abuse deficiencies and (2) enforcement actions implemented against nursing homes with these abuse deficiencies. Origin of abuse deficiencies. To identify trends in the origin of those abuse deficiencies—that is, whether the deficiency originated from a standard survey, complaint investigation, or a facility-reported incident investigation—we analyzed data provided by CMS from its Automated Survey Processing Environment Complaint/Incident Tracking System. Specifically, we matched the deficiencies with the complaint/incident data using provider number, survey date, and deficiency code. We found that some deficiencies were the result of a combination of complaints, facility-reported incidents, surveys, or all three. We counted those deficiencies as originating from each relevant category. Enforcement actions. To identify trends in the enforcement actions imposed and implemented against nursing homes with abuse deficiencies, we analyzed data provided by CMS from its Automated Survey Processing Environment Enforcement Manager. Specifically, we matched the deficiencies with the enforcement data using provider number, survey date, case identification number, and deficiency code. To avoid over-counting, deficiencies that share the same code and case identification number were counted as a single deficiency. For each year, we determined how many of the abuse deficiencies resulted in enforcement actions imposed or implemented, the severity of the abuse deficiencies with enforcement actions, and the types of enforcement actions implemented. We then examined these abuse deficiencies to determine the number of nursing homes that had abuse deficiencies, as well as the number of homes with repeated abuse deficiencies cited across the 5 years and the characteristics of those homes. We also determined the proportion of surveyed nursing homes in a given year that had an abuse deficiency. Nursing homes that had repeated abuse deficiencies. Since a nursing home can have more than one abuse deficiency cited in a given year, we determined the number of surveyed nursing homes each year that had at least one abuse deficiency, both nationally and by state. For each of those nursing homes, we determined if the home had an abuse deficiency repeated in multiple years and in two or more consecutive years. Nursing home characteristics. We attempted to identify commonalities among homes with multiple years of abuse deficiencies, homes with only a single year with an abuse deficiency, and surveyed homes without any abuse deficiencies throughout the 5- year period. Specifically, we matched deficiency data to CMS’s publicly available Provider of Services files and the Nursing Home Compare Provider Information files for each nursing home; and we examined bed size, non-profit or for-profit status, Five-Star Quality Rating System overall rating, Special Focus Facility designation, and urban or rural location. Finally, because abuse and perpetrator type are not readily identifiable in CMS’s data, we identified this information by reviewing the narratives written by surveyors that describe the substantiated abuse. Specifically, we obtained 1,557 narrative descriptions written by state surveyors for abuse deficiencies cited in 2016 and 2017 provided by CMS from its Automated Survey Processing Environment database. From that universe of abuse deficiency narratives, we selected a randomly selected representative sample of 400 narratives, and each narrative was reviewed by two separate reviewers who independently analyzed the text of each narrative to determine the abuse and perpetrator type according to the definitions that CMS implemented on November 28, 2017, in its State Operations Manual. Any disagreements between the two reviewers were resolved by a third independent reviewer. (See table 7.) For those narratives where the abuse type could not reasonably be categorized under an existing CMS definition, reviewers had the option to mark narratives as “other.” Furthermore, we analyzed the scope and severity for each narrative within our sample. CMS’s abuse deficiency code also included involuntary seclusion in the time period we examined and is defined in its November 22, 2017, guidance as “separation of a resident from other residents or from her/his room or confinement to her/his room (with or without roommates) against the resident’s will, or the will of the resident representative.” Our analysis of the narrative descriptions found that 3 percent of the abuse deficiency narratives in our sample were attributable to involuntary seclusion. We were unable to categorize the abuse and perpetrator type for about 11 percent of the deficiency narratives in our sample, because we determined the narrative description did not meet CMS’s abuse definition. We assessed the reliability of each of the datasets by checking for missing values and obvious errors and discussed them with CMS officials who were knowledgeable about the data. In the course of this assessment, we found some data limitations. Specifically, CMS officials told us that some state survey agencies may not have entered all facility- reported incidents into the Automated Survey Processing Environment Complaint/Incident Tracking System, while other state survey agencies did. We also found underreporting, as noted in our 2019 report, where the Oregon state survey agency was not entering all abuse-related complaints or facility-reported incidents into this same database—a problem that could exist in other states. In addition, CMS officials told us that it is possible there are additional incidents that may not have been represented in the abuse deficiency data during the period of our review. Specifically, CMS officials noted that some incidents resulting from resident altercations—particularly those that do not show a willful intent to harm—may not be cited as an abuse deficiency by some state survey agencies. We therefore consider the number of abuse deficiencies that resulted from complaints or facility-reported incidents to be a conservative estimate. After reviewing the possible limitations of these data, we determined the data were sufficiently reliable for the purposes of this reporting objective. Appendix II: Trends in Abuse-Related Deficiencies This appendix describes trends in abuse-related deficiencies over the 5- year period from 2013 through 2017. We reviewed Centers for Medicare & Medicaid Services (CMS) guidance that was in effect during this period of review to determine which federal standards and deficiency codes were relevant to resident abuse. For the report, we focused our analysis on the deficiency code cited when state surveyors substantiate incidents of abuse, but there are also deficiencies that surveyors can cite for abuse-related issues, such as a failure by the nursing home to train staff on issues related to abuse, either in conjunction with an abuse deficiency or without an abuse deficiency. Since these abuse-related deficiencies do not necessarily represent incidents of abuse, but do represent situations where a nursing home’s inadequate policies could leave residents vulnerable to abuse, we also conducted a limited analysis on the trends of these deficiencies. Specifically, we analyzed CMS data to identify the number of abuse-related deficiencies cited in each year in all 50 states and Washington, D.C., and determined how many were cited at each level of severity—no actual harm with a potential for minimal harm, no actual harm with a potential for more than minimal harm, actual harm, and immediate jeopardy. We also tracked the source of these abuse-related deficiencies—that is, whether the deficiency originated from a standard survey, complaint investigation, or a facility-reported incident investigation. Finally, we compared the results for abuse-related deficiencies with the results for all types of deficiencies cited by surveyors in each year. From 2013 to 2017, we found that abuse-related deficiencies became slightly more common with a resulting increase in severity. Specifically, abuse-related deficiencies increased by about 9.9 percent over the 5-year period, from 4,899 deficiencies cited in 2013 to 5,383 deficiencies cited in 2017, but peaked in 2016 with 5,687 deficiencies. This increasing trend for abuse-related deficiencies is in contrast to the slight decrease in all deficiencies cited over the same period, but not nearly as high as the 103.5 percent increase in abuse deficiencies. In addition, the proportion of abuse-related deficiencies cited at the highest levels of severity— deficiencies causing actual harm to residents or putting residents in immediate jeopardy—fluctuated throughout the 5-year period. Specifically, about 6.1 percent of the 4,899 abuse-related deficiencies in 2013, about 5.6 percent of the 5,278 abuse-related deficiencies in 2015, and about 7.8 percent of the 5,383 abuse-related deficiencies in 2017 caused actual harm or immediate jeopardy. (See fig. 7.) We also found that over half of the abuse-related deficiencies each year were cited by surveyors as a result of standard surveys, and the rest were cited by surveyors as a result of either complaint or facility-reported incident investigations. This falls between what we found for abuse deficiencies—the majority were a result of either complaint or facility- reported incident investigations—and all types of deficiencies—the vast majority were a result of standard surveys. Over the 5 years, similar to abuse deficiencies and all types of deficiencies, the percentage of abuse- related deficiencies that resulted from standard surveys decreased while the percentage that resulted from both complaint and facility-reported incident investigations increased. Specifically, over the 5-year period, the percentage of abuse-related deficiencies resulting from standard surveys decreased by about 8.8 percentage points, complaint investigations increased by about 3.6 percentage points, and facility-reported incident investigations increased by about 5.3 percentage points. (See fig. 8.) Appendix III: State Information on Abuse Deficiencies Tables 8 and 9 provide state-level data on abuse deficiencies and the nursing homes that had abuse deficiencies cited in consecutive years. Appendix IV: Comments from the Department of Health and Human Services Appendix V: GAO Contact and Staff Acknowledgments GAO Contact John E. Dicken, (202) 512-7114 or dickenj@gao.gov. Staff Acknowledgments In addition to the contact named above, Karin Wallestad (Assistant Director); Sarah-Lynn McGrath and Kathryn Richter (Analysts-in-Charge); Luke Baron; Summar Corley; Zosha Kandel; and Julianne Flowers made key contributions to this report. Also contributing were Laurie Pachter, Jennifer Whitworth, and Vikki Porter.


Background OCWR allocates functions among its Board of Directors, Executive Director, and General Counsel (see fig. 1). This organizational structure is largely due to statutory requirements in the CAA. As of February 2019, OCWR had 28 full-time equivalent positions, which includes five part-time board members (counted as one full-time equivalent) appointed by congressional leadership. This represents an increase of five full-time equivalents since April 2018. OCWR manages an Administrative Dispute Resolution (ADR) process to resolve alleged violations of workplace rights and protections, such as discrimination. The Reform Act overhauled the ADR process, including removing mandatory counseling and mediation periods and a waiting period prior to filing a claim (see fig. 2). OCWR Implemented Some Reform Act Requirements; Other Requirements Are in Progress OCWR Implemented Three of Four Reform Act Requirements Effective June 2019 To advance worker protections, the Reform Act mandated that OCWR implement various new requirements. OCWR has implemented three of the four requirements that generally became effective on June 19, 2019 (see table 1). As of October 2019, OCWR had completed three requirements. Managing changes to the ADR process. OCWR officials stated that because they had initiated a multi-year process to revise procedural rules in 2016, they were more familiar with the steps and timeline needed to implement this requirement in 2019. Appointing a confidential advisor. Similarly, an OCWR official stated that the confidential advisor role was similar to OCWR’s counselor role prior to the Reform Act, which made implementing this requirement more manageable. Creating a secure electronic system to file claims. The online system, SOCRATES, was operational starting June 26, 2019, 7 days after the requirement’s effective date of June 19, 2019. Between June 19 and June 26, 2019, OCWR implemented a fillable PDF form so that claims could be submitted electronically (email or fax). OCWR officials reported that no claims were filed during the 7-day delay, and therefore, they believe that the delay did not negatively affect employees’ ability to file claims. According to OCWR, testing the system the week prior to June 19, 2019, revealed numerous problems with SOCRATES. For example, if a user did not submit his or her claim within a certain amount of time, the system refreshed the page without saving the user’s data, forcing the user to restart the claim. Also, during a June 17, 2019, meeting between OCWR and congressional staff, OCWR received requests to further revise forms associated with SOCRATES. OCWR was unable to implement these changes before the June 19, 2019, deadline. As a result, OCWR delayed the launch of SOCRATES until June 26, 2019, to allow time to resolve these issues and fully test the system. However, OCWR did not communicate the decision to delay the full launch of SOCRATES to congressional stakeholders who had expected that the system would be delivered on time. As of October 2019, OCWR had not completed one requirement that was due by June 19, 2019. Establishing a program to permanently retain records. The Reform Act required OCWR to establish and maintain a permanent records retention program, which includes records of preliminary reviews, mediations, hearings, and other proceedings. Since November 2017, OCWR has operated under an interim records retention policy that requires it to permanently keep all records. According to OCWR, it is not destroying or deleting any records. OCWR’s interim permanent records retention policy states that OCWR will establish standards and procedures for records integrity, privacy, and confidentiality. However, as of October 2019, about 4 months after this requirement became effective, OCWR had not developed these standards or established other policies or procedures for maintaining a permanent records retention program other than the interim policy. According to OCWR, it scanned paper records to create electronic files and hired a separate contractor in September 2019 to help further develop its records retention program. OCWR Is Implementing Three Reform Act Requirements with Time Frames beyond June 2019 As of October 2019, OCWR was implementing the other three requirements which have varying deadlines, time frames, and effective dates extending beyond June 19, 2019 (see table 2). Tracking and reporting data and assessments. The Reform Act created new reporting requirements for OCWR. For example, it required OCWR to issue annual, itemized reports on awards and settlements. The Reform Act also required OCWR to issue a one- time report on awards and settlements previously paid, which OCWR published on January 20, 2019. OCWR plans to issue the report on 2019 awards and settlements by January 31, 2020, and subsequent reports annually. The Reform Act also required OCWR to use SOCRATES data to assess the effectiveness of ADR procedures in resolving claims in a timely manner and to publish these assessments in semi-annual reports to Congress. OCWR plans to issue the first semi-annual report by January 31, 2020. Conducting a workplace climate survey. The Reform Act required OCWR to conduct a secure survey of legislative branch offices covered by the act by December 20, 2019 (within one year of enactment), and every 2 years thereafter. The survey would assess the workplace environment, including attitudes toward sexual harassment. As of October 2019, OCWR officials reported that they were waiting for additional input from congressional staff before proceeding with certain aspects of the survey. According to OCWR officials, OCWR’s House and Senate oversight committees had different views of what the survey should include. Therefore, OCWR plans to conduct separate surveys for House offices, Senate offices, and other legislative branch offices. According to OCWR officials, they may be able to launch the House survey by the December 20, 2019, deadline, with the other surveys following. However, the timeline for conducting these surveys is uncertain until OCWR can confirm the surveys’ content with congressional staff and conduct various tests, such as separately pilot testing each of the three surveys. Additional work remaining includes: reviewing changes to the survey questions, obtaining input from legislative branch stakeholders, conducting internal testing of the survey, pilot testing the survey with legislative offices, and finalizing the survey and communications to survey recipients. Educating and assisting legislative branch agencies. OCWR updated various education and training materials, such as: creating a new workplace rights brochure; redesigning a poster notifying employees of rights, protections, and procedures under the CAA; and establishing audio and visual teleconferencing access for out-of- area employees (i.e., legislative branch employees in elected officials’ district and state offices). An OCWR official reported that, in October 2019, OCWR developed a training video on new procedures under the Reform Act. A link to the training video was included in the September 2019 quarterly e- newsletter sent to all legislative branch employees covered under the CAA. According to the official, OCWR also plans to launch another training video in November 2019 and develop three new training classes. OCWR Could Better Incorporate Key Management Practices to Improve the Ongoing Implementation of Requirements We found that OCWR incorporated some key management practices when implementing Reform Act requirements (see appendix II for a list of management practices we used to assess OCWR). However, we also found that OCWR did not consistently incorporate key management practices for some requirements and that opportunities exist to improve the remaining implementation and administration of Reform Act requirements. OCWR Incorporated Some Key Management Practices to Implement Requirements We found that OCWR incorporated some key change management or project management practices applicable to implementing Reform Act requirements. For example: OCWR defined the Reform Act requirements and created 21 task teams for implementing them. OCWR dedicated an implementation team to manage the transformation process. OCWR designated a manager to track the implementation status for all task teams. The task team leaders also met weekly. OCWR established an overall project schedule with interim milestones and time frames for revising procedural rules, part of the requirement to manage changes to the ADR process. OCWR also established an overall project schedule for conducting the workplace climate survey. OCWR officials reported that having this schedule has enabled them to track progress, determine that the survey is behind schedule (as of October 2019), and communicate revised expectations to stakeholders. In addition, OCWR officials stated they identified and addressed risks associated with the requirement to appoint a confidential advisor. These risks included the perception of a potential conflict of interest that could arise if an attorney contracted from a private law firm served as the confidential advisor. To mitigate this perception, OCWR hired the confidential advisor as an employee to ensure that the confidential advisor cannot refer claimants to his or her own law firm for legal representation. OCWR Did Not Use Project Schedules to Manage SOCRATES and Other Requirements Project schedules provide a detailed plan for delivering products, services, and results in a timely manner, as well as serve as a communication tool for managing stakeholder expectations. OCWR used project schedules to revise the procedural rules and develop the workplace climate survey but did not use schedules to manage the implementation of other requirements. In particular, for SOCRATES, OCWR officials reported that they proposed a draft schedule but did not finalize this draft or otherwise document changes to the schedule. According to these officials, they did not update the schedule because their implementation plans had changed significantly, and the compressed timeframe resulted in making changes “on the fly.” For example, they revised the system architecture as late as 3 weeks before the mandated deadline, which required signing an interagency agreement for hosting the system with the Library of Congress the day before the mandated deadline. In addition, OCWR encountered last-minute issues when testing the system, as we previously discussed. As a result, OCWR delayed the full launch of SOCRATES but did not communicate this decision to congressional stakeholders who had expected that the system would be delivered on time. Although not a long delay, a project schedule could have helped manage stakeholder expectations. Without a schedule for SOCRATES, OCWR missed opportunities to take corrective actions earlier, communicate with congressional stakeholders, and better manage expectations. OCWR has ongoing cybersecurity activities and planned upgrades to other information technology (IT) systems, but has not yet established project schedules for them. Moving forward, it will be important for OCWR to establish project schedules to manage IT projects and allow key stakeholders to monitor OCWR’s progress. OCWR Has Not Addressed Risks for Its Records Retention Program OCWR has taken interim steps to establish a permanent records retention program. These steps include changing its records retention policy in November 2017 to make all records permanent, hiring a contractor in May 2019 to scan paper records and store them electronically, and hiring another contractor in September 2019 to help develop its records retention program. Key management practices call for organizations to identify and assess risks that could affect their ability to achieve their goals and objectives and to monitor and manage these risks as the projects progress. OCWR identified the largest potential risk to establishing and maintaining a permanent records retention program as the loss of control over confidential files. For example, an OCWR official confirmed that OCWR maintains a physical file for every electronic file, which results in multiple storage locations and duplicate records. Although this ensures the availability of records, multiple storage locations can make ensuring the confidentiality and security of these records more difficult. However, as of October 2019, OCWR has not yet fully addressed this risk by developing a policy to manage it or identified other risks. OCWR officials stated that the contractor will help with these tasks. They also reported that they plan to develop policies for the records retention program, particularly for maintaining the privacy and security of records, based on records management requirements for executive branch agencies. According to OCWR officials, addressing risks for its records retention program is not a high priority, and demand for records is low. Nevertheless, if OCWR does not address the potential risks, and any emerging risks, associated with permanently retaining sensitive records, OCWR may be less able to manage its records and ensure their confidentiality, integrity, and availability. OCWR Lacks Results- Oriented Performance Goals, Related Measures, and Reports Assessing Progress We have previously reported that a critical element in an organization’s efforts to manage for results is its ability to set meaningful goals for performance and to measure progress toward these goals. Strategic goals are intended to be the starting point for an organization’s performance measurement efforts. To provide a connection between the long-term strategic goals and the day-to-day activities, organizations should also establish near-term performance goals and measures. Finally, an organization needs to report on its performance to provide information to its stakeholders on the extent to which it has met its performance goals and what it accomplished with its resources. Leading organizations then apply this performance information to continuously improve organizational processes, identify performance gaps, and set improvement goals. OCWR’s 2019-2023 strategic plan includes several broad, long-term, outcome-related goals that address Reform Act requirements. These goals are supported by objectives, called initiatives. For example, OCWR has a long-term strategic goal to “provide an efficient and effective ADR program.” A supporting initiative is to “ensure that ADR processes meet statutory and regulatory mandates, including mandates for maintaining confidentiality.” However, this initiative does not state what is to be achieved and by when, and none of the supporting initiatives reflect near- term performance goals that allow for an objective assessment of progress. Performance goals, which are used to assess progress toward long-term goals, should be stated in objective, measureable, and quantifiable terms. OCWR identifies performance measures in its strategic plan, but the measures lack target levels of performance which would help assess progress toward goals. For example, one of OCWR’s initiatives is to “empower stakeholders to effectively resolve their workplace disputes without having to engage in protracted dispute resolution proceedings.” A supporting performance measure is to “track the rate of cases resolved by negotiated settlements.” This measure provides a starting point for collecting performance information but does not specify how it can be used to assess progress on the initiative. We have previously reported that successful performance measures commonly demonstrate results, are limited to the vital few, respond to multiple priorities, and link to responsible programs. OCWR does not report on progress toward goals in its annual report, partly because of the lack of performance goals and measures assessing progress. OCWR’s annual reports summarize statistical data about the number of employees using OCWR’s services and reasons for ADR claims from each fiscal year, which is information required to be published under the CAA. However, these statistics do not compare actual performance against measurable performance goals. Further, OCWR does not report how it used the data to improve its programs. For example, in its fiscal year 2018 annual report, OCWR reported the number and types of workplace issues that employees inquired about in general information requests and raised during formal counseling requests. However, OCWR did not report how it used this information to identify trends and develop training programs to target the indicated issues. According to OCWR officials, OCWR does not set more specific or measurable goals and measures beyond what is included in its strategic plan. In addition, they stated that OCWR’s current performance goals and measures reflected their concern that changes from the Reform Act could affect their workload, such as the number of cases filed and how they would be settled. They plan to reassess their performance starting in June 2020, about 1 year after many Reform Act requirements became effective, and establish new performance measures and targets based on updated baseline performance levels. Clearly defining performance goals, such as establishing measureable performance targets and milestones, and related performance measures would provide OCWR information to determine if it is making progress toward its long-term goals and better communicate with congressional and other key stakeholders about its progress. Moreover, such performance data would allow OCWR to make more informed decisions to improve performance, such as determining what activities are working as intended and achieving results, and which are not and could be improved. Finally, sharing this information in publically available annual reports could make it more useful and transparent for stakeholders, as well as strengthen OCWR’s accountability for making progress toward its goals. OCWR Conducts Various Education and Outreach Activities and Has Opportunities to Better Evaluate the Effectiveness of Its Efforts OCWR has a broad mandate to provide education and information to Members of Congress and covered legislative branch offices and employees about their rights, protections, and responsibilities under the CAA. OCWR routinely conducts educational activities, such as holding brown bag events, creating online training, and posting resources on its website and social media channels. OCWR also performs outreach by meeting with congressional committees regularly, communicating with stakeholders (e.g., House and Senate Employment Counsel), meeting with heads of legislative branch employing offices at least sending an annual notice of rights to all legislative employees. However, we found that OCWR’s assessment of these activities is limited, such as collecting feedback forms from attendees of its brown bag events. While important, these efforts do not enable OCWR to assess the effectiveness of its education and outreach activities and the extent to which they are reaching all covered legislative branch populations. Key management practices call for continuous monitoring to identify areas that require additional attention. In 2004, we recommended that OCWR use various approaches, such as feedback surveys, to increase its understanding of the actual level of awareness of its activities among target populations. In response to the recommendation, from 2008 to 2009, OCWR surveyed legislative branch employees but had a low response rate, which rendered the survey data of limited value. OCWR officials attributed the low response rate to not having all respondent email addresses, as well as the lack of statutory authority to conduct surveys. Through the Reform Act’s requirement to conduct a workplace climate survey every 2 years, OCWR has new opportunities to collect data on the extent to which legislative branch employees are aware of OCWR’s services and their rights under the CAA. Because the Reform Act states that OCWR must consult with congressional committees on how to carry out the survey, OCWR has sought guidance from its oversight committees on what information to collect for the survey and the use of the results. In addition to developing the climate survey, an OCWR official stated that, in March 2019, OCWR also hired a training and education project manager who is responsible for developing an education and outreach strategy. This effort is intended to include assessing awareness levels of OCWR’s activities among legislative branch populations and improving awareness where needed. However, as of October 2019, OCWR did not provide documentation of the strategy and a timeline for its completion. A mechanism for collecting feedback more widely from all covered legislative branch employees could improve OCWR’s understanding of the reach and effectiveness of its education and outreach efforts. For example, it could help OCWR determine if it may be missing certain subsets of legislative branch populations, such as maintenance workers who may have limited computer access. Further, such information could help inform management and resource allocation decisions, such as where to focus education and outreach efforts and how to increase their effectiveness. OCWR Could Better Support IT Initiatives with Strategic Planning and Human Capital Management In 2004, we reviewed OCWR’s management practices and made 20 recommendations to help OCWR: strengthen strategic planning and develop results-oriented performance measures; ensure an effective, results-oriented program structure; build effective communication emphasizing outreach and coordination with congressional and legislative branch stakeholders; and create and sustain an enhanced management control environment, particularly for managing human capital and performance. Between 2004 and 2013, we determined that OCWR had implemented 18 of the 20 recommendations. In this review, we found that, of these 18 recommendations, OCWR subsequently stopped implementing an information technology (IT) planning recommendation that could have strengthened its ability to better manage and implement the requirements in the Reform Act. We had recommended that OCWR ensure that IT planning and implementation be an integral component of the strategic planning process. This recommendation focused on positioning OCWR to effectively leverage technology in achieving strategic mission goals and outcomes. To do this, OCWR needed to establish certain basic IT management capabilities, such as: developing a picture or description, based on OCWR’s strategic plan, of what it wanted its future IT environment to look like; establishing and following a defined and disciplined process for allocating limited resources across competing IT needs; using a rigorous IT system acquisition management process; and ensuring that needed IT skills have been identified and obtained. OCWR took steps in 2003 and 2005 to create an IT task force and issue a multi-year IT plan, respectively. However, these efforts were not sustained. An OCWR official explained that OCWR had not conducted IT planning, including developing an IT strategic plan, in recent years because of limited resources and difficulties attracting a candidate for the IT manager position. These challenges resulted in the position remaining vacant for approximately 18 months from 2016 to 2018. In past work, we have reported that IT strategic planning can help an organization align its IT goals and investments with its strategic goals. A key element of IT strategic planning is developing an IT strategic plan that can serve as an organization’s vision or road map to guide its efforts and investments. OCWR officials reported that they will be developing an IT strategic plan. However, as of October 2019, they were unable to provide additional documentation or a timeline for completion. Without IT strategic planning, OCWR may be less able to set forth a long- term vision of OCWR’s IT environment and measure progress in carrying out its strategic initiatives. For example, OCWR envisioned developing an electronic claims filing system as one of its strategic initiatives as early as fiscal years 2013 to 2015. However, that system was not implemented until 2019, in part because OCWR did not have an IT strategic plan and related IT expertise to support the initiative. With increased funding for implementing Reform Act requirements, OCWR has recently re-focused on human capital management. In September 2018, it hired an IT manager whose responsibilities include IT planning and cybersecurity. In September 2019, OCWR hired a contractor to help update its human capital plan, which had not been updated since 2009. We have previously reported that effective human capital management is critical to sustaining an IT workforce with the necessary skills to execute a range of management functions that support the agency’s mission and goals. Given OCWR’s strategic and ongoing IT initiatives, it will be important for OCWR to consider leading practices in human capital management to ensure that it has the appropriate skills and capacity to meet its current and future responsibilities. These leading practices include consulting with key stakeholders when developing human capital strategies, having a system in place to continually assess and improve human capital planning and investment, determining critical skills and competencies its workforce needs to achieve current and future agency goals, linking the strategic workforce plan with the organization’s strategic plan, developing customized strategies to recruit highly specialized and having an ongoing succession planning process for identifying and developing a diverse talent pool. If OCWR does not continue to strategically assess and manage its human capital needs, it could again find itself with IT or other skills gaps that could negatively affect its ability to meet its mission. Incorporating these leading practices in human capital management could help OCWR develop a workforce plan that better aligns with its mission and goals, as well as develop long-term strategies for recruiting and retaining staff to achieve those goals. Conclusions Although small in size, OCWR has important responsibilities—to advance the safety, health, and workplace rights of employees and employers in the legislative branch. The Reform Act updated how OCWR carries out these responsibilities, such as requiring OCWR to offer an electronic option for filing Administrative Dispute Resolution (ADR) claims and to conduct a workplace climate survey of legislative branch employees. To meet these new requirements, OCWR developed new procedures, trained and hired staff, and balanced new responsibilities with existing ones. As a result, OCWR completed three requirements—managing changes to the ADR process, appointing a confidential advisor, and creating a secure electronic claims reporting system. However, as of October 2019, OCWR had not fully completed the requirement to establish and maintain a program for permanent records retention. To meet this requirement, OCWR needs to develop and implement policies and procedures to administer and manage the program, as well as identify and address potential risks related to the privacy and security of records, among other actions. To help OCWR meet requirements with ongoing work and build upon completed work, it will be important for OCWR to incorporate key practices for project management, such as consistently developing and using project schedules and assessing risk. These practices could help OCWR better manage expectations and prioritize high-risk work. Further, establishing results-oriented performance goals and measures and collecting and using performance information could help OCWR evaluate and better focus its education and outreach efforts, as well as assess progress toward its strategic goals. Finally, OCWR should use its strategic planning process to clearly articulate how its IT initiatives support its organizational goals, such as how the electronic claims reporting system supports a more efficient and effective ADR program. Establishing performance measures and monitoring actual-versus-expected performance of those measures can help determine whether IT is making a difference in improving performance, and in turn whether OCWR is better serving the legislative community. Additionally, OCWR needs to evaluate its human capital management strategies to ensure that it can recruit and retain staff with the appropriate skills to plan and manage IT projects, as part of a larger effort to conduct IT planning. Recommendations for Executive Action We are making the following six recommendations to OCWR: The Executive Director of OCWR, in collaboration with relevant managers, should establish a policy that requires a schedule of tasks to be developed, documented, and updated throughout the lifetime of IT system projects. (Recommendation 1) The Executive Director of OCWR should identify and assess risks in establishing and maintaining a permanent records retention program, and develop policies and procedures to ensure that risks are properly addressed. (Recommendation 2) The Executive Director of OCWR should identify desired performance results, develop performance measures that demonstrate the degree to which the desired results were achieved, and report progress toward those results in OCWR’s annual reports. (Recommendation 3) The Executive Director of OCWR should collect relevant data through a survey or other mechanisms, and use the information to evaluate the effectiveness of education and outreach efforts and the extent to which they are reaching all covered legislative branch populations. (Recommendation 4) The Executive Director of OCWR should integrate IT planning and implementation into the agency’s strategic planning process. (Recommendation 5) The Executive Director of OCWR should incorporate key strategic human capital management practices, such as developing strategies to recruit and retain staff with mission-critical skills, into the strategic planning process. (Recommendation 6) Agency Comments We provided a draft of the report to OCWR for review and comment. In its comments—reproduced in appendix III—OCWR agreed with our findings and concurred with our six recommendations. To address the recommendations, OCWR noted that it has already taken some actions, such as hiring a contractor to assess risks related to permanent records retention. It intends to implement additional changes, such as developing a policy for IT project planning. Going forward, OCWR agreed to update us on its progress implementing the recommendations. We are sending copies of this report to the appropriate congressional committees, the Executive Director of OCWR, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-6806 or jonesy@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. Appendix I: Objectives, Scope, and Methodology Our first objective was to determine the status of Office of Congressional Workplace Rights’ (OCWR) efforts to address new requirements from the Congressional Accountability Act of 1995 Reform Act (Reform Act). To meet this objective, we reviewed applicable laws and identified the new requirements. We reviewed the Reform Act and grouped Reform Act requirements into seven categories of activities based on similar characteristics, such as requirements related to amending the claims process, and how these requirements aligned with OCWR’s task teams working on these requirements. We also collected and reviewed documentation on OCWR’s implementation process and management practices, such as OCWR’s list of tasks and task teams, task team meeting notes, progress reports, agreements with outside vendors, and email communications. Our second objective was to assess how OCWR is incorporating key management practices to implement the Reform Act’s new requirements. To meet this objective, we analyzed OCWR’s implementation of new requirements against key practices for organizational change management we identified in our 2003 report, Results-Oriented Cultures: Implementation Steps to Assist Mergers and Organizational Transformations (GAO-03-669) and key practices for project management from the Project Management Institute Inc.’s A Guide to the Project Management Body of Knowledge, PMBOK Guide®. We determined which key practices and related implementation steps were applicable to OCWR based on the following factors: (1) if the practices aligned with the scope and nature of OCWR’s work, and (2) if the practices applied to OCWR’s implementation timeline given Reform Act deadlines. We shared these key management practices with OCWR. Our third objective was to determine the extent to which OCWR implemented recommendations from our 2004 report, Office of Compliance: Status of Management Control Efforts to Improve Effectiveness (GAO-04-400). To meet this objective, we reviewed OCWR’s plans and documentation of its activities, such as strategic plans and annual reports, to address the recommendations. We then assessed OCWR’s plans and activities against our original recommendations and the recommendations’ implementation status to determine the extent to which OCWR implemented the recommendations in the past and has continued to take similar actions. For all three objectives, we interviewed OCWR officials and conducted semi-structured interviews with a nonprobability sample of key stakeholders and officials from offices covered by the Reform Act. Although results from these interviews are not generalizable to all stakeholders or offices covered by the act, they provided views and illustrative examples about OCWR’s efforts to address new Reform Act requirements, OCWR’s efforts to incorporate key management practices to implement those new requirements, and the extent to which OCWR implemented some of our previous recommendations. These stakeholders and offices include the Architect of the Capitol, Senate Chief Counsel for Employment, and Office of House Employment Counsel. To obtain perspectives from a range of stakeholders and offices, we considered the following factors in our selection: size of the office or agency by number of employees; extent to which offices/agencies are involved in outreach by number of Administrative Dispute Resolution cases and Occupational Health and Safety Inspections/Americans with Disabilities Act inspections; past interviews with offices/agencies discussing OCWR outreach for balance of perspective (e.g., both chambers of Congress). We also interviewed the House Office of Employee Advocacy and the House Office of the Chief Administrative Officer safety team to obtain additional views on their interactions with OCWR. We conducted this performance audit from January 2019 to December 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix II: Key Management Practices We determined that the following key organizational change management practices and key project management practices, as well as related implementation steps, were relevant for assessing the Office of Congressional Workplace Rights’ (OCWR) management practices. Appendix III: Comments from the Office of Congressional Workplace Rights Appendix IV: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact name above, Steven Lozano (Assistant Director), Elizabeth Fan (Analyst in Charge), David Blanding, Giny Cheong, Patrick Dibattista, Karin Fangman, Ben Licht, Patricia Powell, and Edith Yuh made key contributions to this report. Karen Brindle, Hannah Brookhart, Kisa Bushyeager, Terrell Dorn, Robert Gebhart, Lisa Hardman, Ted Hu, Susan Irving, Sonya Johnson, Amalia Konstas, Kaelin Kuhn, Patricia McClure, Zina Merritt, Edda Emmanuelli Perez, Robert Robinson, Sukhjoot Singh, Jon Ticehurst, Alicia White, and Rebecca Woiwode also provided valuable assistance.