New report answers many Cover Oregon questions - often for second time

SALEM, Ore. - Why was a new assessment of Cover Oregon's botched website necessary in the first place?

Because key decision-makers were in some cases unaware of the first such report by a firm called Maximus and others ignored it altogether, according to that new report by First Data, which was released Thursday.

"Although the Maximus reports regularly rated many areas of the project red and labeled them as high risk, they were generally viewed as nothing unusual for a project of its scope and with such an aggressive schedule," First Data reported. "Overall, leadership became desensitized to the ongoing red status."

That was among the many findings in the 77 page report, much of which had already been made public through reports from the On Your Side Investigators and other news media, including a comprehensive examination of the Maximus assessment.

Click "play" on the video below for highlights of the On Your Side Investigators' look at Cover Oregon:

Gov. John Kitzhaber called for the new report in December, and its findings were made available to him on March 9.

First Data was contracted to answer seven specific questions pertinent to the rollout of the website, which was scheduled to go live on Oct. 1 but still isn't available for public use.

The report found that project leaders were overly confident in the team's ability to complete the project on schedule.

Former Cover Oregon director Rocky King, former Oregon Health Authority CIO Carolyn Lawson and then-OHA head Bruce Goldberg - whose resignation as Cover Oregon director was announced by Kitzhaber on Thursday - were on the executive steering committee charged with overseeing the project.

"A common theme from the assessment interviews was that both Rocky King and Carolyn Lawson were perceived as supremely confident," it reads. "The interviews also confirmed that the overly optimistic schedule/scope projections were based on continued trust in Oracle and the HIX-IT leadership (Rocky King, Carolyn Lawson, and Bruce Goldberg), despite repeatedly missed deadlines."

First Data agreed with Maximus that the agencies involved in the project had a difficult time refraining from infighting and worked poorly together. Though the steering committee met monthly over the life of the project, a log of decisions made during those meetings totals only nine items.

"It is clear that communication across agencies was ineffective and at times contentious," the report reads. "The lack of a single point of authority slowed the decision making process and contributed to inconsistent communication, and collaboration across agencies was limited at best. In addition, communication with oversight authorities was inconsistent and at times confusing or misinterpreted. This resulted in an unclear or incorrect understanding about the true status of the project approaching the October 1, 2013 deadline."

That lack of focused authority resulted from Lawson's decision shortly after taking over in the summer of 2011 to forgo the hiring of a "system integrator" to coordinate the project.

"A system integrator with a stronger financial incentive for ensuring performance most likely would have pushed harder in those areas and been more realistic about delivery dates," the report found.

Surprisingly, many people involved in building the website didn't know the Maximus reports even existed, the investigation found. The Maximus reports highlighted risks in 23 areas and recommended strategies to mitigate or solve them.

"Through the interview process, multiple members of the committee told us they were completely unaware of the Maximus QA role and had not received any of the QA reports that raised concerns about the project," it reads. "Rocky King briefed this committee on a monthly basis and told them he believed the project was on track to go live on October 1."

The investigation was strictly limited to the seven questions provided by the governor's office. The report says that though other topics came up during the interviews it conducted with 67 stakeholders, that information was withheld from the report.

The seven questions it asked were:

  • What was the basic oversight and governance accountability as it relates to the multiple parties and the procurement/ administration/finances of vendor services?
  • Who was in the position to make decisions as it relates to the Website Project?
  • Why were Oracle products and Oracle services chosen for the Website Project?
  • Did the State or Cover Oregon consider engaging a system integrator to assist with the Website Project? If not, why not? Did the Website Project Team or any of its members believe the State or Cover Oregon had the expertise to undertake the Website Project without the assistance of a system integrator? If so, why?
  • How was the original scope of the Website Project determined and by whom? To what degree did the scope of the Website Project delay the implementation? How was the scope managed? After the Website Project Team or any of its members realized that the Website was not going to work, would it have been possible to change the scope? If so, how?
  • Did the Website Project Team or any of its members have a plan B for operations developed when the Website Project Team or any of its members realized or began to realize the exchange was not going to work? If not, why not?
  • When did the Website Project Team or any of its members realize or begin to realize the Website was not going to be ready? Who first realized the Website was not going to be ready?

The report raises some questions that are left unanswered, perhaps due to its own narrow scope.

For instance, external reporting by the exchange often differed - favorably - from the assessment provided by Maximus. In the spring of 2013, Cover Oregon told the federal government categories classified as "red" hazards by Maximus were instead yellow or green, or left them blank.

"The significant breadth of functional scope defined within the MaX project was clearly at a size and scale that challenged the project team's management capabilities," First Data found.

Full coverage of the troubled Cover Oregon website: