Risk Management for Health Care Reform Programs: A Health Plan Perspective

PMI Virtual Library 2014 Deloitte Consulting LLP Risk Management for Health Care Reform Programs: A Health Plan Perspective By Deloitte Consulting LLP Abstract This white paper will explore the common risks in health care reform (HCR) programs that can be addressed by applying appropriate project management techniques. Through a series of interviews conducted with some of Deloitte s largest commercial health project teams, representative large program risks were identified that have the potential to affect the scope, cost, quality, and timeline of a project. These major risks were (1) regulatory uncertainty, (2) implementation across multiple, and (3) resource availability. The interview ology included gathering information regarding risks and response techniques from a project management perspective. Interview results showed that effective risk response techniques included contingency ning, detailed traceability of requirements, adoption of an agile implementation approach, a well-defined governance process, and comprehensive communication s across. Risk management is particularly important for HCR programs due to the complexity and evolving regulations and requirements. Failure to implement the required HCR changes on time can result in monetary damages and cause reputational risk to health s. This white paper introduces recommendations for proactively addressing these risks to decrease their probability and potential effect to a program s success. Note: This white paper was written prior to the October 1, 2013, Health Care Reform Federal Exchange go-live milestone. We are in the process of assessing the results of the federal exchange implementation as it unfolds in order to develop a perspective on program management lessons learned as a follow up to this white paper. W ith the passage of the Patient Protection and Affordable Care Act (ACA) of 2010, widespread changes are required throughout the entire United States health care system, especially in commercial health insurance companies (health s). In order to implement these changes, HCR programs should invest in building more deliberate and organized risk management capabilities. This becomes particularly important due to legal requirements to meet mandatory milestones within specified timeframes. Federal enforcement could subject insurers to millions in fines for failure to comply with set deadlines, as well as adversely affect their reputation and ability to take advantage of new market opportunities. To better understand the types of risks encountered within these programs and the risk management techniques adopted to address these risks, this paper focuses on large-scale programs geared toward the implementation of four key aspects of the ACA health insurance exchanges

These new regulations require health insurers to spend 80% to 85% of consumers premiums on direct care for patients and efforts to improve care quality (U.S. Department of Health and Human Services, 2010). (HIXs), medical loss 2014 ratio Rating (MLR), Rules New 2014 rating rating rules, rules and limiting the factors improve on which care quality premiums (U.S. can Department be set by of Health and administrative simplification. insurance companies for individuals and small groups. Human As of Services, January 2010). 1, 2014, individuals can no longer be excluded from coverage based on preexisting 2014 conditions Rating Rules New and insurance rating rates rules can limiting only the factors Background on vary HCR based on age, geographical rating area, family on composition, which premiums and tobacco can be use set by (Aetna, insurance companies On March 23, 2010, 2013). the Patient Protection and ACA of 2010 for individuals and small groups. As of January 1, 2014, was passed by Congress Administrative and signed simplification Modifications into law by President to the Health individuals Insurance can no Portability longer be and excluded from coverage Obama. The ACA Accountability aims at ensuring Act that (HIPAA) all Americans Administration have Simplification based provisions on preexisting to introduce conditions new and standards insurance rates can access to quality, affordable and operating health rules care for while electronic creating transactions the and health only vary based carriers. on age, The geographical provisions aim rating to area, family transformation within increase the health efficiency, care system create uniformity, necessary to and reduce administrative composition, costs and tobacco across the use health (Aetna, care 2013). contain costs (U.S. system Department (Aetna, of 2013). Health and Human Administrative simplification Modifications to the Services, 2013). Health Insurance Portability and Accountability Act The following Health aspects s of and the health ACA served care organizations as the focal have grappled (HIPAA) with how Administration to achieve regulatory Simplification provisions point of this paper: compliance in light of the ACA. In response, they have deployed to introduce internal new resources, standards and operating secured rules for business and technology consulting services to implement ACA programs. Deloitte has engaged HIXs The implementation of HIXs in each state to help electronic transactions and health carriers. The with clients across the health care industry and developed an approach to helping health s, and individuals and small employers obtain health insurance provisions aim to increase efficiency, create uniformity, health care organizations, manage risk on HCR programs. coverage through a public exchange as an alternative and reduce administrative costs across the health care to purchasing Approach coverage directly from individual health system (Aetna, 2013). insurers. On October 1, 2013, HIXs opened to allow consumers Deloitte s to shop for, approach and enroll in to health managing benefits risk on HCR Health programs s and health care organizations have grappled effective on January 1, 2014 (HealthCare.gov, 2013). with how to achieve regulatory compliance in light of the With large-scale, highly regulated HCR programs, the management of risk is especially important. MLR New This MLR white regulations paper and require the supporting insurers research to spend conducted ACA. approach In response, risk they identification have deployed and response internal resources, premium dollars techniques on care on these while HCR making programs it easier from for a project and management secured business perspective. and technology Deloitte s project consulting services to consumers management to purchase s that content provide and better terminology value for are aligned implement with ACA the Project programs. Management Deloitte has Institute s engaged with clients their money (PMI s) (PWC, A Guide 2013). to These the Project new regulations Management require Body of across Knowledge the health (PMBOK care industry Guide) and Fifth developed Edition. an approach to health insurers to spend 80% to 85% of consumers helping health s, and health care organizations, manage Deloitte s risk management approach also incorporates PMI s PMBOK Guide Fifth Edition premiums on direct care for patients and efforts to risk on HCR programs. guidelines, and typically involves the following three steps: (Deloitte Knowledge Exchange LLC, 2011) 1 2 3 Identify Risk Perform Risk Assessment and Prioritization Develop Risk Response Strategy Identify program key business and strategic drivers Interpret applicability of reform regulations to the organization Determine preliminary organizational and program risks Conduct a risk effect assessment to determine the effect of the required compliance measures that must be implemented Risk management teams assess risk effect using the Knowledge Areas defined in PMI s PMBOK Guide, such as Project Scope, Project Cost, Project Quality, and Project Time (PMI, 2013) Prioritize risks and opportunities associated with the required changes, based on the significance and scale of the effect Figure 1: Deloitte Risk Management Approach Create an appropriate response strategy based on the risks and opportunities identified resulting from the risk assessment Identify subsequent action steps to address the risks Conduct scenario ning to create contingencies for likely scenarios Risk management for health care reform programs: A health perspective 2 2

Approach Deloitte s approach to managing risk on HCR programs With large-scale, highly regulated HCR programs, the management of risk is especially important. This white paper and the supporting research conducted approach risk identification and response techniques on these HCR programs from a project management perspective. Deloitte s project management content and terminology are aligned with the Project Management Institute s (PMI s) A Guide to the Project Management Body of Knowledge (PMBOK Guide) Fifth Edition. Deloitte s risk management approach also incorporates PMI s PMBOK Guide Fifth Edition guidelines, and typically involves the three steps in Figure 1 (Deloitte Knowledge Exchange LLC, 2011). Method of evaluation In an effort to explore how project management techniques are used to mitigate common risks in HCR programs, the authors interviewed Deloitte leadership responsible for implementing large HCR programs across some of Deloitte s largest commercial health clients. The clients are anonymous in this white paper for confidentiality purposes. The programs included HIX-related programs, as well as other HCR program efforts (e.g., MLR, 2014 rating rules, and administrative simplification). The interviews were composed of four risk management questions, which align to PMI s PMBOK Guide Fifth Edition (Table 1). The authors identified common risks and mitigation techniques across HCR programs, which are all compliance-focused programs with large financial, operational, and reputational risks. The common risks were categorized as having effects across the following four PMBOK Guide Fifth Edition project management Knowledge Areas: Project Scope Management, Project Time Management, Project Cost Management, Project Quality Management, Project Risk Management, and Project Stakeholder Management (PMI, 2013). Discussion The focus of this section is on participant responses, primarily to questions one and two, discussed during the interviews. Table 2 outlines the most frequent responses offered by the project managers that participated in this study. The discussion section is broken into two parts. The first, Summary of Findings, outlines the top three risks that were encountered by the interviewed client engagements: Regulatory Uncertainty, Implementation Across Stakeholders, and Resource Availability. The second part of the discussion section is Risk Response Tools and Techniques. This section details how three risk mitigation techniques were used by project management to successfully mitigate these top risks. Summary of Findings Risk One: Regulatory Uncertainty Information gathered during the interviews indicates that for HCR programs implemented over the past few years, federal guidance and regulations around mandated activities have not always been finalized (or even available) before health s have begun development of solutions. For Number One Two Three Four Question What are the top three risks that your project has encountered that you have been able to address with project management techniques? Are these risks unique to HCR projects, or are there commonalities with other programs? How were project management techniques and/or tools used to address the key risks identified in Question One with respect to the following: What techniques were used to identify risks? What techniques were used to analyze and prioritize risks? What techniques and/or approaches were used to respond to the identified risks? What techniques were used to monitor, control, and report risks? Were these approaches successful? What worked well and what could be improved upon? What processes were established to reduce reoccurrence of the program risks? Were lessons learned applied to other programs underway or ned for initiation within the client s organization, and/or is there a in place to do so? Table 1: Interview Questions 3

One Number Question Response What are the top three risks that your project has encountered that you have been able to address with project management techniques? Percentage of Responses Received Regulatory uncertainty 100% Implementation across 60% Resource availability 40% Two (a, b, c, d) What project management techniques and/or tools were used to address the key risks encountered? Requirements traceability 40% Contingency ning 40% Agile approach 100% Table 2: Common Responses to Interview Questions One and Two projects like 2014 rating rules, MLR, and administrative simplification, the timeframe between the finalization of federal requirements and the mandated compliance deadline is often too short a window for health s to implement a solution. Health s need to account for adequate delivery time to address the policy implications and operational complexity of implementing HCR requirements, especially when considering modifications to information technology infrastructures. In summary, HCR programs must balance the risk of initiating implementation without finalized requirements against the risk of not meeting federally mandated compliance deadlines. If a health waits too long to start implementation within these programs and misses the compliance deadline, it may face strict sanctions and reduced market share, which can result in the loss of millions of dollars in revenues. However, if the HCR program initiates development before all requirements are fully defined, it must rely on assumptions and/or proposed regulations to establish scope. If any of these assumptions are incorrect, there are additional costs associated with bridging the gap between the developed product and the actual requirements. In some cases, there may not be time to make the necessary changes prior to the compliance deadline. Nevertheless, health s have actively worked to chart a provisional course forward, to remain in compliance with HCR requirement deadlines, such as HIXs open enrollment beginning on October 1, 2013. This regulatory uncertainty, coupled with a mandated compliance deadline, was identified as a significant risk across all five HCR programs. Interview results showed that programs managing risks related to regulatory uncertainty (unavailable requirements, short-implementation timelines, etc.) saw effects to Project Scope Management, Project Time Management, Project Cost Management, and Project Quality Management (Table 3). Risk Area Potential Level of Effect to Knowledge Area(s) Details Regulatory uncertainty Low Q C T S High Lack of defined scope and/or incorporation of changing scope results in a more significant potential effect to scope, timeline, and cost, with a lower effect to quality. Implementation across several Low T Q High Larger projects affecting multiple have a potential effect to Project Time Management and Project Quality Management Knowledge Areas because of lack of stakeholder accountability or poor communication. Resource availability Low T C S High Availability of key resources to support the project has a potential effect to the project scope, cost, and timeline. S Scope management C Cost management T Time management Q Quality management Table 3: Potential Level of Risk Effect to Knowledge Areas 4

From a Project Scope Management perspective, the project must be agile enough to incorporate new federal guidance and regulations into the development cycle as it is received, and must also be able to incorporate assumptions about requirements still pending regulatory input. This results in a regularly evolving set of requirements. The fluidity of the requirements makes scope management challenging as there is an increased risk of adding in scope that is not mandatory for regulatory compliance. Regulatory uncertainty also affects time management and cost management. As new information and guidance is received, the ability to quickly assess potential changes to scope and understand the timing and budgetary effects is critical to the successful completion of the project. Lastly, from a Project Quality Management perspective, health s must maintain traceability between federal requirements and project scope to make certain that all compliance needs are met; particularly when tradeoffs in delivered scope must be made in order to meet the compliance deadline. Risk Two: Implementation Across Several Stakeholders The complexity and scope of implementing HCR requirements necessitate a comprehensive approach to ning, organizing, coordinating, and communicating across multiple. Although health s are historically accustomed to implementing regulatory compliance programs, the organizational design for HCR implementation efforts requires a broader cross-departmental model. Engaging and communicating with multiple was identified as a common risk across all five HCR programs. Interview results showed that implementation across several affects Project Time Management and Project Quality Management (Table 3). From a Project Time Management perspective, poorly defined communication channels result in programs not being completed on schedule. This is applicable to HCR programs where requirements are regularly evolving as new federal guidance and regulations are released. Interview results showed that when communication channels were not explicitly defined, important messages regarding scope change, project status, lessons learned, and issues and risks often failed to reach all in a timely fashion. From both a Project Time Management and Project Quality Management perspective, the lack of accountability for decision making and the completion of deliverables across cross-functional resulted in programs not being completed on schedule or meeting expectations. A variety of independent business units, encompassing business processes and underlying information technology infrastructures including marketing, actuarial, information technology, and claims must collectively work together to implement regulatory and compliance solutions. This crossfunctional collaboration is especially true of the relationship between business and information technology subject matter experts. Without this cross-departmental support and level of accountability, the ability to quickly adapt to changing requirements, as well as make timely decisions in order to meet looming deadlines is impaired. Risk Three: Resource Availability Resource availability related risks on HCR programs originate from the lack of funds and scarcity of skills, specifically in the project management office. This is especially true in organizations that have competing programs and business silos. Health s, which often have separation between internal business units, are a prime example of this given the large number of HCR programs currently being implemented across the industry. As such, resource availability was identified as a common risk across all five HCR programs. Interview results showed that resource availability affects Project Scope Management, Project Cost Management, and Project Time Management (Table 3). From a Project Scope Management perspective, health s were challenged to remain within project scope when lacking an established project management office, which practiced defined project management techniques. The lack of a project management office is a significant risk stemming from the lack of available resources. This resulted in little-to-no definition of project scope, as well as a limited ability for each stakeholder to understand how a decision, change control item, issue, or risk affected a business area. When considering adherence to the project schedule, programs lacking dedicated resources also found it difficult to effectively keep the program schedule on track. Competing priorities from their operational roles at times prevented them from completing program tasks and milestones on time, placing the overall schedule at risk. From a Project Cost Management perspective, interview results showed that compliance considerations and additional scope items as a result of the iterative federal guidance and regulations release process required that additional project management and subject matter expertise funding be budgeted for, which could be a tedious and extended process. Additionally, interview results showed that it would have been ideal to have more open communication and transparency about the resource needs of the project during the scoping process, specifically in regards to providing subject matter expertise. 5

Risk Response Tools and Techniques Risk Response Tool and Technique One: Contingency Planning Project management tools and techniques can help mitigate the risks associated with regulatory uncertainty and resource availability. For example, assessment of likely scenarios can be used to support decision making and facilitate continued forward progress, despite the number of unknowns surrounding final requirements. With contingency ning as a risk mitigation technique, project managers have the ability to use these likely scenarios to proactively build contingencies into the work to account for anticipated effects to the project budget, schedule, and/ or scope. Outcomes from contingency ning are a key input to decisions around use of tactical versus strategic solutions. Coordination between project management, legal and compliance subject matter experts (SMEs), and business SMEs is critical to developing contingency s that will allow the organization to meet all compliance requirements with looming mandated deadlines. Case Study: The HIX program included multiple functional domains with tight delivery timelines that were dependent on impending regulatory guidance to determine final requirements. Either the regulatory guidance was delayed, or the preliminary guidance received was not aligned with the program expectations. In order to mitigate the risks due to the uncertain regulatory environment, the HIX Program Management Office (PMO) created a contingency ning decision framework that proactively identified, across all the delivery teams, the necessary trigger points that would necessitate the need to create contingency s. The PMO utilized key project management tools, including program dependencies, risk and issue logs, and the delivery team status dashboards to support the creation of the contingency ning decision framework. There was also close coordination with the compliance organization and the government affairs teams to review any newly released legislative rules, document effects, and identify any contingencies needed for these scenarios. Risk Response Tool and Technique Two: Requirements Traceability Matrix Project managers can implement a requirements traceability to help mitigate the risks associated with regulatory uncertainty, and offer a solution across several within an organization. The process and results of mapping known regulatory requirements and assumptions to project scope allows several to connect the project scope to specific business requirements, and allows project managers to quickly and accurately respond as new requirements are released. Given compressed project timelines in HCR programs, the ability to understand how new requirements will affect the existing project from a scope, timeline, and quality perspective is critical to the overall project success. The requirements traceability is also a tool that can be used to support scope and quality reviews with project leadership as it allows for easy identification of required scope and limits the risk of scope creep and development of extraneous functionality. Case Study: The HCR-MLR project team became overwhelmed with efforts to keep track of regulatory updates and understand their effect to the project and organization. In order to share these updates with the appropriate, as well as identify dependencies that these new requirements may have across different groups within the organizations (e.g., functional business areas, technology, and executive leadership), the team implemented the use of the requirements traceability and a dependency tracker, which mapped each regulation to project requirements and affected functional areas. As a result, the team was able to proactively identify risks and the multiple areas affected to an appropriate response in a timely fashion. Risk Response Tool and Technique Three: Agile Implementation Approach While any delivery can be used to successfully execute an HCR project, many organizations have preferred to adopt an agile approach due to the added flexibility the model affords. The agile approach can be used on technology programs to help mitigate the risks associated with evolving regulatory requirements and mandated compliance dates. Rather than waiting until all requirements have been developed to begin testing, the agile approach affords the ability to develop and test requirements in an iterative fashion. This ability allows for the delay in the full understanding of requirements avoiding potential risks and issues often encountered with the waterfall approach. Additionally, interviewees noted that the time between identifying and determining the risk as an issue was markedly condensed using the agile approach, enabling flexibility, and allowing the project team to react to issues sooner than with a traditional waterfall approach. This is an important factor when considering that HCR programs have mandated compliance deadlines. As such, the ability to identify potential scope, timeline, and cost effects early in a project life cycle is critical to the overall project success. 6

Case Study: The HIX Program Management Office provided substantial upfront preparation and socialization of the agile approach across the business and technology teams prior to launching the use of the agile delivery implementation. This included an agile coaching team that focused on explaining the key differences between the agile and waterfall approaches to the organization. To alleviate the growing pains experienced by the delivery teams who were not accustomed to using this delivery approach within the organization, the agile coaches worked with the project managers to tailor the approach for each project based on their unique needs. The successful transition of the delivery approach to agile helped in identifying and mitigating risks to the project scope and delivering working software earlier than expected with a waterfall approach. The PMO also introduced a robust change control process to mitigate the effect of regulatory changes. Both of these (agile and formal change control) approaches can be used on similar large regulatory programs with these risks. Risk Response Tool and Technique Four: Well- Defined Governance Process and Improved Communication Methods Across Stakeholders A clear and defined communication across project is extremely important for HCR program implementations, which span multiple business areas within an organization. The size and scale of HCR programs requires the development and execution of a communication that targets several. A high-quality communication includes a defined weekly meeting agenda, status report cadence, roles and responsibilities of, and process for logging and escalating risks and issues. Stakeholder involvement is particularly important given the number of assumptions, which must be made and revised as regulatory guidance is published. The appropriate communication channels should be clearly defined to help ensure approval of change requests associated with modifications to scope, and that these decisions are made in a timely fashion to maintain momentum and meet the required compliance timelines and deadlines. A well-defined resource, including roles, responsibilities, and resource contingencies has been useful to identify backups for critical team members before they are pulled away from the project due to competing priorities. A clear risk, issue, and decision escalation path reduces the time required to make key decisions, such as resource allocation. Case Study: At the onset of an administrative simplification program, the program management team implemented a detailed governance model to facilitate the following: (1) each person associated with the program had an identified role that was documented and publicly defined; (2) a set meeting schedule and templates for providing updates to the executive sponsor were consistently used; and (3) weekly status meetings attended by key were used to communicate regulatory updates via written and verbal channels. Designated team members joined distribution lists of regulatory industry bodies to collect, analyze, and communicate impactful updates to program. Risk and issues were documented and reviewed on a weekly basis in a formal meeting for proactive management. These controls resulted in uniform interpretation of regulations, which drive requirements across the program, and reduced the risk effects to delivery while keeping key informed. Conclusion The use of risk management is critical to a program s ability to deliver desired business outcomes and achieve desired results. PMI s 2012 Pulse of the Profession reflects an increasing trend in the use of risk management; from 68% of organizations surveyed in 2010 to 71% in 2011, with expected increases (PMI, 2012). The risk of regulatory uncertainty was prevalent in all programs interviewed, and remains one of the most difficult to control or influence. Although effective program managers evaluate the appropriate application of each Knowledge Area within their program, skilled HCR program managers recognize the need to place emphasis on Project Risk Management due to the ever-present uncertainty woven into the fabric of these large-scale programs. With commercial health HCR programs, the stakes are particularly high as failure to be compliant with required regulations could result in reputational harm, loss of market share, significant penalties, strict sanctions, and even legal action from federal or state authorities. These types of consequences require a strategic and adaptable application of Project Risk Management as demonstrated in this paper. Understanding the common risks encountered in these programs, and the combinations of best practice, risk response tools and techniques provide preparatory knowledge for program managers to reference when called upon to lead health organizations through these complex, multimillion-dollar HCR programs. About Deloitte Consulting LLP Deloitte Consulting LLP (Deloitte) is the world s largest management consulting firm, offering a range of talent 7

and capabilities across technology, strategy and operations, and human capital (Deloitte Development LLC, 2013). These are joined with capabilities in areas such as systems integration, program management, application testing, finance, performance management, and business restructuring to name a few (Deloitte Development LLC, 2013). Many leading health s and health care organizations choose Deloitte because of its deep understanding of their sectors, market forces, and the reform legislation shaping their strategies and operating models (Deloitte Development LLC, 2013 and 2012). About the Authors Monique Borland, MBA, PMP, is a manager in Deloitte Consulting LLP s Technology, Systems Integration practice, serving clients within the health s segment of the health care industry, with a recent focus on Health Care Reform and ICD- 10. She has more than a decade of experience leading complex regulatory and government technology programs, applying the PMI project management discipline to achieve results. Ms. Borland can be contacted at mborland@deloitte.com. Vishal Iyer, MBA, PMP, is a manager in Deloitte Consulting LLP s Health Plans practice. He has more than 10 years of experience helping our clients identify and implement technology solutions to succeed in a highly regulated environment. In his current role as Deloitte s Health Insurance Exchange solution manager, he is responsible for developing thought leadership and solution frameworks for the health practice and clients. He can be reached at visiyer@deloitte.com. Jillian Jweinat is a consultant in Deloitte Consulting LLP s Provider Performance Improvement Practice. She has a proven history of leveraging project management, communication, and relationship building experience to develop and support process improvement, performance improvement, customer service, change management, and other enterprise-level projects at leading academic medical centers and health systems. Ms. Jweinat can be contacted at jjweinat@deloitte.com. Kristin Klettke is a senior consultant in Deloitte Consulting LLP s Technology, Systems Integration practice, serving clients within the health care industry. For the past two years, her focus has been on assisting health clients with implementing technology changes required as part of compliance with the Affordable Care Act. Ms. Klettke can be contacted at kklettke@deloitte.com. Dominic McGhee MBA, PMP, is a senior consultant in Deloitte Consulting LLP s Technology, Systems Integration practice. He has more than seven years of custom web-based software development and project management experience across multiple industries, including media and technology, and health care. A Project Management Professional (PMP) credential holder since 2009, Dominic has remained active in PMI, volunteering two years on the board of directors for the PMI Los Angeles Chapter as vice president of communications. Alecia Sartori is a consultant in Deloitte Consulting LLP s Technology, Systems Integration practice, servicing clients within the health and human services segment of the state government industry. She has more than five years of experience in developing and managing retirement and social services benefit eligibility systems. Ms. Sartori can be contacted at alsartori@deloitte.com. Kelley Laird is a director with Deloitte Consulting LLP and a leader in the Technology Integration/Life Sciences and Health Care industry practice. Kelley has more than 20 years of experience in the information technology field partnering with senior management teams to establish and implement their technology direction, improve operational performance, and better manage information technology investments. Kelley has deep experience in integrations and partnerships in the health care space, specifically large-scale program transformations, including the core operational business and systems migrations utilizing multiple delivery models, including onshore/offshore practitioners in the United States, Asia, and Latin America. Kelley is the national leader for Deloitte s commercial project management capability and also serves as the Systems Integration Regional Service Line Leader for the Southeast U.S. Kelley is a PMP credential holder, as well as a certified Stanford Advanced Project Management (SAPM) professional. Kelley represents Deloitte U.S. as an active participant in PMI s Global Executive Council. For additional information, please contact Kelley at kelaird@deloitte.com. References U.S. Department of Health and Human Services. (2013). Insurance Marketplace: Read The Law. Retrieved from http://www.hhs.gov/healthcare/rights/law/index.html. HealthCare.gov. (2013). What is the Health Insurance Marketplace? Retrieved from https://www.healthcare.gov/ what-is-the-health-insurance-marketplace. 8

Deloitte Development LLC. (2013). Consulting. Retrieved from http://www.deloitte.com/view/en_us/us/ Services/consulting/index.htm. Deloitte Development LLC. (2013). Strategy & Operations: Executable strategy. Extraordinary insights, enduring value. Retrieved from http://www.deloitte.com/view/en_us/us/ Services/consulting/Strategy-Operations/index.htm. Deloitte Development LLC. (2013). Health Plan Business Model and Operations Excellence: Positioning for the uncertain world of health care reform. Retrieved from http://www. deloitte.com/view/en_us/us/services/consulting/strategy- Operations/all-strategy-operations-offerings/3005885bbf8 5f210VgnVCM2000001b56f00aRCRD.htm. Project Management Institute. (2013). A Guide to the Project Management Body of Knowledge (PMBOK Guide) and Standards. Retrieved from http://www.pmi.org/pmbok-guide-and-standards.aspx. Deloitte Development LLC. (2012). Preparing for health insurance exchanges: Mapping a path through uncertainty. Retrieved from http://www.deloitte.com/assets/dcom- UnitedStates/Local%20Assets/Documents/us_hp_ CaseStudy_PreparingforHIX_081712.pdf. Deloitte Knowledge Exchange LLC. (2011). Health Reform Strategy Planning. Retrieved from https://kx.deloitteresources.com/g1000/lists/ Qualification/DispForm.aspx?ID=37319. U.S. Department of Health and Human Services. (2010). News release: New Affordable Care Act rules give consumers better value to insurance premiums. Retrieved from http:// www.hhs.gov/news/press/2010pres/11/20101122a.html. Aetna. (2013). Administrative simplification. Retrieved from http://www.aetna.com/health-reform-connection/ reform-explained/administrative-simplification.html. PWC.(2013). Overview of key tax provisions under the Affordable Care Act. Retrieved from http://www.pwc.com/en_us/us/hr-management/ newsletters/hrs-insights/assets/pwc-overview-key-taxprovisions-under-affordable-care-act.pdf. Project Management Institute. (2012). Pulse of the Profession : Driving Success in Challenging Times. Retrieved from http://www.pmi.org/~/media/pdf/research/2012_ Pulse_of_the_profession.ashx. Aetna (2013). Health Care Reform: Eye on Implementation. Retrieved from http://www.aetna.com/health-reformconnection/reform-explained/eye-on-implementation.html. Appendix Common risks encountered on HCR projects Regulatory uncertainty Implementation across several Resource availability Risk response tools and techniques associated with select Project Management Institute PMBOK Guide Fifth Edition Knowledge Areas Project Cost Project Quality Project Time Management Management Management Knowledge Knowledge Knowledge Area Area Area Project Scope Management knowledge Area Improved communication s across NA Project Risk Management Knowledge Area Improved communication s across Project Stakeholder Management Knowledge Area Improved communication s across Table 4: Identified Risks and Associating A Guide to the Project Management Body of Knowledge (PMBOK Guide) Fifth Edition Knowledge Areas and Mitigation Techniques 9