New Cover Oregon allegations: 'If it's true, someone's going to prison'
By Dusty Lane, KATU.com;
Chelsea Kopta, KATU News
Feb 3, 2014
katu.com
PORTLAND, Ore. – You already know the process that led to the failed rollout of the Cover Oregon website was bad.
But was it criminally bad?
Former Republican state Rep. Patrick Sheehan told the KATU Investigators he has gone to the FBI with allegations that Cover Oregon project managers initiated the design of dummy web pages to convince the federal government the project was further along than it actually was.
If Sheehan’s allegations are true, those managers could face time in jail for fraud.
"One of the allegations that was made was so alarming that it went way beyond a legislative oversight committee and so I did reach out and contact the FBI,” Sheehan said.
"The issue had to do with federal funding and proving some amount of compliance with the federal regulation in order to get funding."
To which funding is he referring?
Early in its life, Cover Oregon was given a $48 million “early innovator” grant from the federal government. That amount would later grow to $59 million.
There were a few strings attached though.
To keep the money flowing, the website would have to hit specific benchmarks between 2011 and 2013. The state needed to show the feds it had picked a company to provide software and technical assistance; it had to demonstrate that the website was safe from hackers; and, most importantly, it had to show that people could actually sign up for insurance on the website.
The evidence these marks had been reached would be presented during a process called “gate reviews.”
An IT pro from California named Carolyn Lawson, who has since stepped down, was brought in to oversee the project in her role as Oregon Health Authority CIO.
Her team was in charge of presenting the gate reviews.
Time to get technical
Early in the process, Lawson decided Cover Oregon would take an unconventional approach to designing its website.
Most states were using something called a “waterfall” approach to building their portals. Picture it as a car assembly line: First you build the frame, then you add the wheels, then you add the engine and so on.
Lawson, however, chose to use an “iterative” approach. This time, imagine an extremely blurry picture of a whole car. With each iteration, the picture grows a little more clear.
What that meant for the Cover Oregon website was that it was able to paint a picture of a flashy website – imagine a concept car that looks flashy in the showroom but doesn’t actually run.
But documents uncovered by the KATU Investigators show Lawson hadn’t actually figured out how to build the site, even as she was promising the federal government – and her bosses – that Cover Oregon’s website was going to work.
READ: A high-level IT expert assesses Cover Oregon's approach - "They didn't know what they were doing."
So what, exactly, were the federal and state reviewers being shown?
In a Sept. 27, 2012 email to Bruce Goldberg – Lawson’s boss at the Oregon Health Authority, who is now in charge of Cover Oregon – she sent a link to something called “The Solution Factory,” a site hosted by software contractor Oracle.
Lawson wrote in the email that the link went to a site hosting the same demonstrations the team provided to project stakeholders.
“It demonstrates what we have built to date,” she wrote. “By watching this every month, you can see our progress in real time.”
That link is no longer operational.
KATU traveled to California late last month and knocked on Lawson's door in an effort to get a comment for this story.
Her husband answered and said she didn't want to answer questions.
‘I had to go talk to the FBI’
Sheehan, who spent two years on the state legislature’s joint IT oversight committee, said somebody approached him in December with a disturbing allegation.
“It was communicated to me that something - one of these gate reviews having to do with a benchmark for federal funding - that the State of Oregon was not being truthful,” Sheehan said.
“That was the allegation that was made and that was serious enough that I had to go to talk to the FBI."
Sheehan said he took his concerns to the FBI in December, and that he’s talked to investigators several times since.
The FBI would neither confirm nor deny an investigation into Cover Oregon.
Meanwhile, multiple reports by state and independent IT experts were finding there had been problems with the Cover Oregon website’s design and planning from the beginning.
Despite the fact the website still doesn’t work today, the KATU Investigators found evidence Lawson – or members of her staff – reported to the federal government that the project was going well.
In January 2012, for instance, Lawson wrote a project update for the legislator’s Ways & Means Committee.
She wrote that staff from the Center for Medicare and Medicaid Services (CMS) had reviewed the design in its entirety on Nov. 16 and 17. She said they were “delighted” with the technical application and level of quality.
“They gave Oregon very high marks, say our design was among the best they had seen,” she wrote.
During this same period, however, the independent quality-assurance company the state hired was reporting a disaster in the making.
“All 13 people interviewed believed the project's scope is ill-defined and classify it as a major risk,” reported Maximus.
In March, Maximus documented questions about what Lawson was showing CMS during those gate reviews.
“While there was a system design meeting with CMS using design documents prepared with assistance from Oracle, we cannot determine if this is the official, approved HIX-IT design,” reads page 27 of the report.
In April 2012, Lawson reported to the State Emergency Board that her team had shown “a working system build to executive stakeholders and sponsors.”
The presentation, she wrote, included an individual successfully signing up for insurance through the website.
In May, the federal government held a meeting with Oregon and the other states that had been issued early innovator grants.
During the meeting, Lawson’s team said Oregon’s exchange was producing a new working build every month, and reiterated that the website had been successfully demonstrated to CMS.
Remember, this was for a website that today still has more than a dozen critical coding errors, and for which there is still no estimated completion date.
“She showed us a nice smile and some jingles,” Sheehan said. “There was nothing else. There were screen shots … we never saw anything close to a functioning piece.”
Sheehan, by the way, has a background in web development.
"That could have been the smoke and mirrors that they were showing everyone which was not a live demo,” Sheehan said. “It would just be wire frames or a mock up.
"If they were able to connect the dots and if it's true, someone's going to prison. It would be fraud. It would be the State of Oregon, actually, willfully, misrepresenting something for federal funding." |
