Federal Real Property: GSA Should Improve Accuracy, Completeness, and Usefulness of Public Data

The lack of reliable data on federal assets is one of the main reasons Federal Real Property Management remains on GAO's high risk list. In 2016, legislation required GSA to publish a single, comprehensive, and descriptive database of federal real property that would be available to the public. The database could be used for research and other potential applications. GAO was asked to study the public database. This report assesses (1) GSA's efforts to improve the reliability of FRPP's data and the public database, (2) the public database's completeness, and (3) the presentation of the data in the public database.

GAO reviewed federal laws, documents, and data, including GSA's fiscal years 2017 and 2018 FRPP and public databases. GAO interviewed officials at GSA and from six federal agencies selected in locations with enough questionable data in the public database to analyze, among other things, and studied assets in Washington, D.C., Illinois, and New Mexico. GAO also interviewed selected stakeholders involved in federal real property management, such as real estate brokers.

The General Services Administration (GSA) has worked in recent years to improve reliability of the Federal Real Property Profile (FRPP), which tracks federal real property assets. However, numerous errors in the database were carried into the public version. GSA extracted data from the FRPP's 398,000 civilian federal assets to create a public database to be used, for example, by researchers and real estate developers. However, GSA's data verification process did not address key errors. GAO found that 67 percent of the street addresses in the public database were incomplete or incorrectly formatted. For example, the database lists “Greenbelt Road” as the address for over 200 buildings at NASA's Goddard Space Flight Center, but the road stretches over 6.3 miles, thereby reducing a user's ability to locate specific buildings.

The public database is not complete because GSA and selected agencies decided not to provide certain useful information. Specifically, GSA withheld assets' information without consulting those agencies managing the assets and allowed agencies to withhold information that is already publicly available. For example, GSA withheld the name “Goddard Space Flight Center” from the public database, but NASA's website lists this name and the Center's location. Unnecessarily withholding information limits the database's utility and undermines analysis.

The public database's usefulness is further limited by how GSA presents the information. Because the database does not identify if an asset is part of a secure installation, the public does not know if assets, such as the unnamed buildings at Goddard, are accessible to the public. Unless GSA improves the public database's accuracy, completeness, and usefulness, its benefits may not be realized.

GAO is making six recommendations to GSA, including improving the accuracy of the database, consulting with agencies on assets' information withheld from the database, and improving the public database's presentation. GSA agreed with five of the recommendations. GAO clarified the recommendation on withholding information on agencies' assets, to address GSA's comments.

The General Services Administration (GSA) reported that in fiscal year  2018 civilian federal agencies spent billions of dollars to operate about  398,000 civilian real property assets (buildings, structures, and land)  across every state, including nearly 127,000 buildings covering 1.1-billion  square feet. GSA tracks the federal government’s real property assets  using a government wide database known as the Federal Real Property  Profile (FRPP) Management System, which contains data submitted  annually by agencies. We have previously reported on problems with the  reliability of the data in the FRPP, and it is one of the main reasons that  managing federal real property remains on our high-risk list. The FRPP  itself is not available to the public but does not contain any classified  national security information. The lack of publicly available data and data  quality issues have posed problems for people wanting to use the federal  real property data for various purposes, such as leasing or purchasing  space that the federal government no longer needs.

The Federal Assets Sale and Transfer Act of 2016 (FASTA) directed GSA  to release to the public a single, comprehensive, descriptive database of  federal real property. In April 2018, the then-chair of the House  Subcommittee on Economic Development, Public Buildings, and  Emergency Management stated that a key goal for making the data public  was to provide transparency and help hold federal agencies accountable  for reporting accurate information. In response to this act, GSA created  and released a publicly available version of the FRPP in December 2017.

You asked that we review GSA’s new public real property database. This  report examines:

GSA’s efforts to improve the reliability of FRPP data and the public  the completeness of the public database; and how the data are presented in the public database.

For all objectives, we reviewed applicable laws and the White House’s  and the Office of Management and Budget’s (OMB) directives.  Additionally, we reviewed GSA guidance to agencies on FRPP data  submissions for fiscal years 2016 through 2019. Further, we reviewed  prior GAO reports on federal real property. We downloaded and analyzed  data in the public database for fiscal years 2017 and 2018 (the most  recent data available since FASTA was enacted) and obtained GSA’s  original FRPP data on civilian properties for this time period. To  determine the reliability of this data, we evaluated the FRPP and public  data to identify what agency data were missing per GSA’s annual  guidance to agencies. We found the data sufficiently reliable for the  purpose of our reporting objectives.

We interviewed GSA officials, as well as a non-generalizable selection of  officials from six selected agencies that are required to submit data to the  FRPP: the Department of Homeland Security (DHS); Department of  Energy (DOE); the Department of Interior (DOI); the Federal  Communications Commission (FCC); the National Aeronautics and  Space Administration (NASA); and GSA’s office that submits its own  FRPP data. We selected these agencies because they were located in  areas with enough questionable FRPP data as identified by GSA to  analyze. We also interviewed a non-generalizable sample of 14  stakeholders from groups likely to use the public database, identified by  their frequent interaction with federal real property issues, among other  things, and included real estate brokers, lessors, and developers.  Specifically, we identified groups to contact from the list of participants at  a congressional roundtable discussion on the uses of the public  database and by asking officials at GSA and private-sector professionals  who specialize in federal real estate through a snowball-sampling  technique. We then used that list of potential users and search terms  related to real property data to conduct a web search for other groups that  indicated they used federal real property data and confirmed their use of  real property data.

To assess GSA’s efforts to improve the reliability of FRPP data and the  public database, we analyzed data from fiscal years 2017 and 2018 from  GSA’s Validation and Verification effort, which GSA implemented to  improve the quality of FRPP. We determined how the results of this effort  carried over to the public data. We also tested the location information in  the fiscal year 2018 public data to determine the extent to which this  information was consistent with guidance for reporting inventory GSA  provided to agencies and whether the location information was user- friendly. Specifically, we determined if the data were machine-readable  (directly usable by a computer) and could be displayed in a map using  commercial off-the-shelf, geographic-information system (GIS) software.  We used the data to select and visit a non-generalizable sample of  properties from the six agencies mentioned above that were located in  proximity to our headquarters and Chicago, Illinois, field offices. We also  selected agency properties in the Los Alamos and Sandia, New Mexico,  areas because they had enough questionable data in those locations to  provide a basis for analysis. We determined if the properties’  characteristics matched reported data and assessed the extent to which  these properties are accessed by the public, through direct observation or  review of agency photographs.

To assess the completeness of the public database, we reviewed GSA  instructions to agencies and a memorandum from DHS’s Interagency  Security Committee (ISC) recommending processes and criteria for  agencies to follow when determining what, if any, information to withhold  from the public database. We also reviewed selected agencies’ guidance  and processes, if any, for identifying assets to withhold from the public  database. We compared the FRPP to the public database to identify data  withheld from the public database for fiscal years 2017 through 2018 to  assess how this withholding affected the completeness and usefulness of  the database and to analyze trends and consistency in selected agencies’  withholding decisions. We also interviewed GSA, DHS-ISC, and selected  agency officials on internal processes for identifying what types of data  categories and specific assets they withheld from the public database.

To assess factors that affect the usefulness of the public database, we  reviewed GSA’s instructions on presenting data, specifically with regard  to how to report individual assets on secure installations that are not open  to the public. We analyzed the public database and FRPP database to  determine how agencies report assets on secure installations and how  this reporting affects the usefulness of the database. We also observed  secure federal installations in the Washington, D.C., area and in New  Mexico, to assess how the presentation of these assets in the public  database affects the usefulness of the data. These sites were among  those selected to assess GSA’s efforts to improve the reliability of the  database, as described above. We interviewed GSA officials to determine  how they communicate the availability of the public database. We also  assessed GSA’s website to determine how it communicates the  availability of the public database as well as three other real-property  databases as they related to the relevant provision of the Open  Government Data Act. We analyzed GSA data on the frequency with  which the public accessed the public database from December 2017  through July 2019. We also interviewed selected agency officials to  determine their views on GSA’s organization of the database, such as  reporting by individual assets rather than installations. Lastly, we  interviewed the 14 third party stakeholders identified earlier to determine  their familiarity with the database and its usefulness to their work.

We conducted this performance audit from September 2018 to February  2020 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

Two GSA offices have roles in managing data related to federal real  property. The Public Buildings Service (PBS) acts as a landlord for the  federal government by acquiring new space for government agencies and  tracking data on the property it acquires. PBS manages and publishes  three databases that provide information to public stakeholders and  researchers on federally owned and leased properties, and on properties  eligible for disposal. Another office, the Office of Government-wide Policy  (OGP), collects, manages, and reports on all federal real-property data  through the FRPP database. OGP has managed the FRPP since its  inception in fiscal year 2005 by collecting data from federal agencies on  their real property assets. OGP is also responsible for compiling and  managing the public database required by FASTA.

FRPP is the most comprehensive database of federal real property  holdings, containing details for about 398,000 assets (buildings,  structures, and land). It is not public, but it also does not contain any  classified national security information. FRPP data show the range of  agency assets, including single buildings in a given location or multiple  buildings located on installations, like a national park or research center.  The FRPP identifies whether buildings are on installations, but does not  identify whether buildings are public-facing or secure (and thus  inaccessible by the public).

We have repeatedly identified reliability issues with the FRPP, and GSA  has taken actions to improve the reliability of FRPP data. Specifically, in  2016, GSA established its validation and verification (V&V) process. After  agencies submit their data annually to FRPP, GSA identifies questionable  entries (called anomalies) from 20 separate categories. Through these  categories, GSA flags assets that are very small in size, changed from  the previous year, or have unusual financial statistics, among other  things. GSA then provides an annual list of anomalies to the agencies  that entered the data. Agencies have 10 months to research each  anomaly and correct errors or validate that the data are correct. GSA has  provided instructions to agencies on how to respond to the V&V process.  GSA also requires agencies to certify accuracy of the data and  established database rules that require agencies to submit complete  information on assets. GSA officials said that it must ultimately rely on  agencies to submit correct data.

FASTA required GSA to publish a single, comprehensive, descriptive  database of all federal real property by December 16, 2017, while  allowing it to exclude assets for reasons of national security, such as  those that are secure installations. FASTA also required the database to  be made public to the extent its release is consistent with national  security and procurement laws. GSA officials said that GSA used the  FRPP as the basis for developing the database it released to the public at  the end of 2017. GSA presents the data in two ways: as a downloadable  spreadsheet or in a searchable mapping application.

GSA’s Efforts Have Not Effectively Addressed FRPP’s Reliability Issues, Which Affect the Public Database

Most Street Addresses in Public Data Are Incomplete or Otherwise Unusable

FASTA requires that the public database be machine-readable and permit  searching or sorting of data to the extent practicable. Further, GSA  guidance also calls for agencies to provide accurate and complete data.  Specifically, GSA requires agencies to include either a complete street  address or geo-coordinates for all 398,000 assets in the FRPP; for  example, GSA’s FRPP data dictionary establishes the format agencies  are to use when inputting asset addresses—number, street, city, zip  code. This requirement carries over to the 305,000 assets included in the  public database.

We found that almost 214,000 of the assets in the public database  included some street address information, but most of the addresses  were incomplete or incorrectly formatted. Specifically, only approximately  70,000 (33 percent) fully met the standards. Since another 91,000 assets  did not include a street address, a computer would only be able to locate  about 23 percent of the 305,000 civilian federal assets using street  addresses in the public database (See fig. 1.) GSA officials who manage  the FRPP said that they were aware that many street addresses were not  readable and have asked agency officials to review the accuracy of  address information and correct it in future submissions. They  acknowledged, however, that their efforts were not fully successful. As  discussed later, GSA is currently taking steps to ensure that agencies  provide more complete geo-coordinates when they submit data to the  FRPP.

For the remaining 67 percent of the assets (144,000) with some street  address information that did not fully meet the standards, we found two  types of problems—incomplete addresses and addresses that were not  formatted correctly. First, more than 28,000 assets had street addresses  that were incomplete. For example, instead of having individual address  listings, we found that all 215 buildings at the Goddard Space Flight  Center had a single listing of “Greenbelt Road.” This road actually  stretches over 6 miles and many other buildings are located along the  road. The front gate’s complete address is “8800 Greenbelt Road.” In  these instances, GSA officials said that its public-mapping program  selects the mid-point of the street, which in this case is over a mile from  the public entrance to the installation. (See fig. 2.) As a result, someone  using the database would not be able to determine exactly where  Goddard is.

Second, we found about 115,000 assets had street address information  that was incorrectly formatted based on FRPP instructions. While we did  not conduct a complete analysis of all these assets, we found examples  of some of the address issues, such as:

Extra descriptive information about the property in the address field.

For example, “N220 AG Science Bldg North U of Kentucky” and  “Beltsville AG Research Center, 10300 Baltimore Avenue.” The data  in the address field for these two assets—which belong to the  Department of Agriculture—could not be directly read by a computer  or displayed on a map.

Unrecognizable text. For example, “2881 F;B Road” and “1-15, Exit  172, 1 Mile East.” The data for these assets, which belong to the  Department of Agriculture, could not be directly read by a computer or  displayed on a map.

GSA officials said that users may be able to interpret the individual asset  addresses in the database but that GSA’s automated computer system  could not map unreadable addresses. Similarly, a private-sector user who  tried to use the public data to map federal facilities for clients said that he  was unable to map many of the assets because addresses were not  readable by his computer. As a result, he said that he excluded  incomplete or unreadable addresses from the database he created. He  noted that incomplete data would reduce clients’ interest.

We also found problems with assets for which agencies provided geo- coordinates (latitude and longitude). Specifically, GSA guidance states  that geo-coordinates must include a minimum of four decimal places. Of  the 305,000 assets included in the public database, almost 220,000  included geo-coordinates but more than half—about 141,000—did not  meet FRPP standards because they were not precise enough to map the  location of the assets. GSA officials noted agencies are required to  enter some type of information in the field for address or geo-coordinates,  but an “open data” format did not prevent agencies from reporting  information that was not strictly a street and address number.  Consequently, some agencies may have entered incorrect values for the  geo-coordinates just to complete the field. Our analysis supports this  view; few (550 of about 131,000) of the assets with both sufficiently  detailed geo-coordinates and street addresses pointed to the same  location. In addition to the open data issue described above, officials also  explained that GSA did not have a “business validation rule” in place that  prevented agencies from inputting coordinates with less than four decimal  places.

GSA has taken a number of actions to correct the issues with geo- coordinates that they say should help address this problem for the next  release of the public data in 2020. For example, GSA added V&V  anomaly categories for fiscal year 2018 data that identified GPS  coordinates pointing to unlikely locations, such as a location in the water,  which identified about 80,000 potential anomalies. Agencies are currently  checking these. Additionally, GSA added a feature to the fiscal year 2019  FRPP submission form that will force agencies to provide geo- coordinates that are detailed enough for their data to be accepted. GSA  officials said that they would consider taking additional steps once they  have analyzed the results of the GPS coordinate anomaly categories.

GSA has asked agencies to review addresses for accuracy, and officials  indicated that they have discussed plans to improve this data. However,  GSA has not taken specific steps to work with agencies to ensure they  input correct street addresses in the public database in light of the “open  data” format. The lack of correct street addresses can affect users who  may be interested in acquiring or leasing assets or who may be interested  in installing telecommunications devices on an asset, from knowing  exactly where those assets are located. As a result, until the street  address information is complete and correctly formatted, the public may  unknowingly pursue assets that are not available or suited to their needs.

GSA’s V&V Process Does Not Efficiently Identify Erroneous Data

We found that while GSA has identified close to 30,000 potential errors in  the FRPP database over the first 2 years of the V&V process, agencies  confirmed only 5 percent as errors (1,291 of 28,572). Agencies validated  the remaining 27,281 anomalies as correct or left them unresolved. The  low number of errors being identified indicates that GSA’s V&V process is  not efficiently identifying errors in the data, either in terms of the anomaly  categories themselves or the thresholds at which GSA flags data as an  anomaly. This situation could ultimately mean that agencies are spending  time researching correct information that was flagged as potentially  erroneous or not fully actually researching anomalies and allowing  mistakes to remain uncorrected.

Agencies identified no anomalies as errors for five of GSA’s 16 anomaly  categories in 2017, raising questions about the anomaly categories GSA  has identified. OMB guidance suggests that agencies only do extra tasks  that are justified by their cost. GSA officials who manage the V&V  process said that the high number of anomaly categories for which  agencies found no errors could reflect that the anomaly categories are  flagging correct data as anomalies or that agencies are validating data as  correct without actively checking it.

We found examples of both. For example, we examined a selected  sample of 14 V&V data anomalies at DOE sites in New Mexico. GSA  flagged the buildings for being very small—office buildings less than 400  square feet and warehouses less than 64 square feet—and found that the  information in the public database was correct. Figure 3 illustrates how  such information flagged as being questionable, is actually correct  according to GSA’s reporting rules for agencies, which specify data  categories, such as the types of buildings GSA considers to be  warehouses. Specifically, GSA flagged assets at DOE’s Los Alamos and  Sandia National Laboratories because their square footage fell below  certain amounts. But, in reality, these assets met GSA’s criteria for offices  and warehouses despite being small.

We also found instances where an agency verified information as correct  that was incorrect. Figure 4 illustrates examples data validated as correct  that was actually erroneous. Specifically, an agency erroneously reported  water towers and antenna arrays as office buildings. Staff responsible for  managing the V&V process for their agency’s assets said that they did not  always consult the personnel with the best knowledge of the assets in  resolving anomalies. Instead, they relied on their own judgment when  determining whether to forward the anomalies to asset managers to  ultimately check the data and correct any errors. This resulted in some  errors going uncorrected.

Thresholds—the points at which GSA flags data as anomalies—lead to a  large number of data elements flagged, which can challenge the  resources of affected agencies. Officials at two of our selected agencies  said that the number of anomalies that the V&V process produces  annually overwhelms their ability to validate the data. The large number of  unresolved V&V anomalies appears to support this conclusion. GSA’s  guidance allows agencies 10 months to validate the anomalous data, but  the number of anomalies that remain unresolved after 10 months has  risen sharply. Figure 5 shows that while agencies addressed all  anomalies in the first year, they have since struggled to keep up. As of  October 2019, 106,231 anomalies, or approximately 71 percent,  remained unresolved after 10 months.

Officials who are responsible for resolving anomalies at two selected  agencies said that more realistic anomaly categories or thresholds could  reduce the number of anomalies and better target actual errors, an  approach that could help agencies better prioritize their resources when  researching anomalies. GSA staff who manage the FRPP said that they  brainstormed internally and used industry standards and policy initiatives  to develop anomaly categories. They also explained that they adjust  thresholds within each category. However, GSA officials said they had not  reviewed the anomaly categories or their thresholds to see if they  consistently capture incorrect data. This approach puts the stated goals of  the V&V process—which are to improve data accuracy, promote data  consistency among the agencies, and enable OMB to measure data  quality improvement—at risk. In the absence of better information about  the validity of categories and thresholds, the current process for V&V is  taking up limited agency resources without efficiently correcting errors in  the data.

GSA and Agencies Withheld Information That Reduces the Completeness of the Public Database

GSA and reporting agencies decided not to provide certain useful  information from the public database in two ways, thereby reducing the  data’s completeness and ultimately its utility. First, GSA withheld data  from the public database without consulting agencies about their  sensitivity. Second, selected agencies withheld information that was  already publicly available or withheld similar types of information  inconsistently within their agencies.

GSA Withheld Data from the Public Database

GSA chose to withhold 15 categories of data from the public database for  all agencies. FASTA authorized the withholding of information from the  public database for national security or procurement-related issues.  GSA officials who manage the FRPP said that GSA does not have the  security or intelligence expertise to issue guidance on national security  issues. As a result, they sought input from the ISC on what information to  withhold. ISC reviewed the security risks of FRPP data and provided  written recommendations in a memo to GSA in November 2017.  Specifically, ISC recommended that certain categories of data on assets  be withheld from the public database because of the security risk that  they could pose individually or in combination. ISC also recommended  that agencies use internal guidance on restricting the public release of  real property information and ISC’s mission criticality criteria to  determine any individual real property assets to withhold entirely from the  public database.

GSA implemented ISC’s first recommendation by withholding 15 FRPP  data categories for all assets from the public database without consulting  the relevant agencies on this decision, considering the specific sensitivity  of these categories for all assets, or assessing the effect withholding them  would have on the database. ISC officials acknowledged that the memo  that they prepared for GSA could have been clearer as to ISC’s intent that  departments and agencies should consider the recommendations in  making a final determination. According to ISC officials, they believed that  implementation would involve GSA communicating these  recommendations and leaving decisions on what to withhold to officials  within individual departments and agencies who control real property  assets.

Specifically, the following five categories of data were among the 15  withheld by GSA: property’s/installation’s name,  replacement value of an asset, annual operating and maintenance costs for owned assets, annual-operating and maintenance costs for leased assets, and breakdown of annual operating and maintenance costs (e.g., utilities  costs, janitorial costs, sewage costs, etc.).

Because GSA did not consult with agencies on this decision, the  agencies did not have an opportunity to consider whether or not the 15  data categories GSA withheld included information that is sensitive or  already publicly available. As a result, the public database is incomplete  in ways that adversely affect users and limits agencies’ public  accountability for reporting accurate information. For example, identifying  assets in the public database is difficult without the property’s name—one  of the data categories GSA withheld—especially given the insufficient  location data in the database discussed earlier. Returning to the  incomplete address example discussed earlier (NASA Goddard Space  Flight Center), the public data also do not include the property’s name,  “Goddard Space Flight Center,” leaving users with limited information to  identify the buildings. As a result, someone using the public database  cannot identify assets on NASA’s Goddard Space Flight Center campus  without using outside sources for additional information. (See table 1.)

As discussed in the next section, we found that some of the information  from these 15 excluded data categories, such as property names, is often  already in the public sphere. For example, “Goddard Space Flight Center”  and its address are clearly disclosed on NASA’s public website, but GSA  withheld the name for 215 NASA buildings at this address, including  Goddard’s public visitors’ center. Using the public database alone, a  member of the public would need to go through numerous steps to  determine if assets are part of Goddard Space Flight Center and still have  no way of being sure. (See fig. 6.)

Moreover, third-party, private sector stakeholders we spoke with such as  brokers, lessors, consultants, and a non-profit organization that work in  federal real-property markets, noted that some of the data categories  GSA withheld would be among the most useful to their work. For  example, 10 of 14 stakeholders we spoke to said that financial data, such  as operating costs and annual rent, were among the most useful FRPP  data categories to their analyses of real property markets and business  opportunities. Additionally, four stakeholders cited the property’s name as  among the most important data categories for their work in analyzing  federal real property.

Agencies Withheld Publicly Available Information and Withheld Similar Assets Inconsistently, Making Analysis Difficult

While GSA withheld the 15 categories of data across all agencies, it  allowed each agency to determine if any specific assets should be  withheld entirely from the public database, in accordance with ISC’s  second recommendation. ISC officials told us that this was appropriate  because individual departments and agencies that control real property  assets should determine what information to withhold.

GSA provided agencies with guidance that explained its decision to  withhold the 15 data categories and instructed agencies to consult ISC’s  mission criticality criteria and any additional internal agency criteria in  determining what information to withhold from public release. ISC’s  mission criticality criteria provide a page-long list of uses of real property  assets that warrant consideration for national security exclusion, but do  not provide other instructions for agencies to consult while making  decisions on what information to withhold. Further, OMB Circular— Management of Reporting and Data Integrity Risk also instructs agencies  to integrate a risk-based approach towards meeting reporting objectives,  an approach that requires “management practices that identify, assess,  respond, and report on risks.” However, we found that our selected  agencies did not consistently identify internal guidance to supplement  GSA’s instructions within their agencies.

In September 2018, ISC recommended that GSA not withhold from the  public database newly added data categories that provide information  already in the public sphere. Additionally, the OPEN Government Data  Act requires OMB to foster greater sharing, dissemination, and access to  public information and issue guidance that, among other things, takes into  account the requirement that data must be disclosed if it would otherwise  be made available under a Freedom of Information Act request. For  purposes of this report, we refer to this requirement as “assuming  openness.”

However, GSA’s instructions to agencies lacked specifics to help  agencies apply a consistent, risk-based approach in determining which, if  any, assets or asset-specific information should be withheld from public  release. As a result, we found that some of the selected agencies  withheld asset-related information from the public database that is  available on their own public websites or from other official sources.  Withholding information that is already publicly available unnecessarily  reduces the completeness and utility of the public database that FASTA  indicated should be comprehensive. For example:

DHS’s Immigration and Customs Enforcement (ICE) withheld  buildings at five of its publicly-accessible service-processing centers  that are shown on a detention facility locator mapping system on its  own website. ICE officials told us that they did not consider what  information is already publicly available when deciding what  information to withhold from the public database.

FCC withheld all of its real property assets. FCC’s own website and  regulations, however, list the locations and functions of FCC offices.

The U.S. Coast Guard withheld information on its public-recruiting  offices and lighthouses that it advertises on its public website. All  buildings and structures that were not specifically used for the  purpose of aids to navigation were withheld from the public data set.  As a result public users can look up information on the Coast Guard’s  aids to navigation, but cannot look up some of its publicly accessible  locations, such as recruiting offices and lighthouses.

In contrast, DOE decided to withhold none of its 20,378 assets from the  public database. According to a DOE official responsible for submitting  data to FRPP, DOE does not have a specific process for assessing what  properties to make public. However, it is aware that much of the  information in the public database is also publicly available through other  sources. Table 2 shows how selected agencies took different approaches  to withholding information from the public database.

Under risk-based criteria assuming openness (as mentioned earlier),  agencies may consider whether information made public in one instance  should be withheld in another instance. However, neither ISC’s mission  criticality criteria nor GSA’s instructions addressed the issue of  consistency within specific agencies. Specifically, we found that selected  agencies withheld  the same assets differently over time, and  similar assets inconsistently.

Table 3 shows how reporting agencies made different decisions on  whether to withhold the same types of assets. At times, some agencies  withheld certain asset types that ISC’s mission criticality criteria did not  identify as warranting withholding, resulting in almost 7,000 assets such  as parking structures and disposed assets being withheld. This led to  inconsistencies as to whether these agency assets were included or not  in the public database, limited transparency about these assets, and  prevented users from fully analyzing federal real property assets in these  categories.

In other cases, selected agencies withheld similar assets inconsistently,  did not always follow written procedures and withheld similar assets. For  example:

DOI headquarters provided its bureaus with GSA’s instructions on  withholding assets, but individual bureaus applied the instructions  differently. For example:

The Fish and Wildlife Service reports that it has 369 publicly  accessible national wildlife refuges, but it withheld selected real  property assets at 11 of them. However, the withheld assets are  the same types as the assets the Service disclosed at other  refuges. For example, it reported all but two of 447 restrooms and  10 of 2,066 recreational structures on its national wildlife refuges.  The Fish and Wildlife Service told us it will re-evaluate its  withholding for the fiscal year 2019 FRPP database.

The National Park Service (NPS) reported that it has 374 publicly  accessible national parks, monuments, memorials, historic sites,  and recreation areas. NPS withheld some real property assets  from 15 of those sites. For example, it reported all but 2 of 1,045  service buildings at its sites. These withheld assets are the same  types as those disclosed at other sites.

NASA withheld assets at a centralized level, but headquarters officials  told us that they have not established instructions or policies for these  decisions. NASA officials told us that they withhold real property  assets shared with agencies working in defense and/or national- security, which led NASA to withhold 1,517 assets in fiscal year 2017.  In fiscal year 2018, however, we found that NASA withheld all assets  at certain field centers, causing the number to more than double from  1,517 in fiscal year 2017 to 3,696 in fiscal year 2018.

Finally, our comparison of the fiscal year 2018 FRPP and public  databases found that seven agencies did not identify whether data on  3,845 assets should be withheld despite GSA guidance to do so for every  asset. GSA included these assets in the public database without  consulting agencies on the assets’ sensitivity or risks in releasing  information on them. GSA officials said that these data should not have  been accepted and that they had implemented controls to ensure that  agencies identify whether data should be withheld.

Data Presentation and Limited Stakeholder Awareness Hinder Usefulness of the Public Database

Data Presentation Issues Limit the Usefulness of the Public Database

It is difficult for a user of the public database to determine when assets  are located on a secure installation that the public cannot access. For  example, returning to the NASA Goddard Space Flight Center illustration  from earlier in the report, assets located at the Space Flight Center are  listed individually, with no indication that the assets are all located on a  secure installation. The public database lists all 215 assets at the same  location—Greenbelt Road in Greenbelt, MD, but provides no further  indication that the assets are part of a larger, secure facility. (See fig. 7.)

Currently, GSA requires civilian agencies to report individual assets,  including those on secure installations. Detailed, asset-specific  information could be useful for government decision makers, and GSA  applied this approach to the public database. However, asset-level  information can cause challenges for users when they are located on  secure installations because GSA withheld the installation names from  the public database.

Listing assets individually could prompt fruitless public interest in  inaccessible secure facilities. One expected use of the public database is  for the private sector to identify possible locations for installing  commercial telecommunications infrastructure, such as cell towers and  antennas. However, as this infrastructure cannot be installed on secure  installations, the public database would be more useful to such  companies if they could readily determine whether a potential location  was on a secure installation or not. For example, officials on a secure  installation we visited told us that reporting individual buildings does not  make sense because there are few, if any, legitimate reasons for public  interest in the individual assets on a secure installation.

FASTA required GSA to develop a comprehensive database and provide  the public with database access, but recognized the importance of  protecting national security. In that respect, a key organizational issue  faced by GSA and agencies is how to present data for reporting assets on  campuses that are not accessible to the public. While non-disclosure is  permitted, such actions to withhold this information may reduce the  usefulness of the public database as a whole.

The Department of Defense (DOD) takes a different approach for its  secure military bases in the public database. According to GSA officials,  DOD submits a separate summary-level report for public release. This  summary-level information shields sensitive information and alerts users  that those assets are not accessible or of use to private-sector interests.  Civilian agencies’ assets located on closed federal installations are similar  to those on DOD bases in that the public may have less interest in or  reason for knowing about assets that are not available to the public.  Officials from NASA and two DHS bureaus said that the installation-level  approach to reporting would be more appropriate for their circumstances  than the asset-level reporting currently applied to civilian agencies and  would likely allow them to release more information to the public. Officials  from DHS added that they already release some information to the public  on the web site. We found that other selected agencies also release  information about secure installations on their public websites, including  NASA and its Goddard Space Flight Center.

Stakeholders’ Lack of Awareness of the Public Database and Confusion with Other Databases Limits Usefulness

In our interviews with 14 private sector stakeholders, we found varying  levels of awareness and understanding of GSA’s publicly available real- property datasets. Of the 14 private sector stakeholders we interviewed,  eight told us that they were aware of the public database. Of these, five  told us they tried to use it. Several selected stakeholders—regardless of  whether or not they had used the database—cited concerns about the  usefulness of the data, specifically with its reliability, completeness,  formatting, and organization. For example, officials from one brokerage  firm told us that, while the information could theoretically be useful for  agency consolidation efforts, the database was too cumbersome to  analyze for that purpose. Similarly, officials with a federal real-estate- consulting firm told us that they do not refer customers to the public  database because they believe that the data are not complete, correct, or  intuitive. Moreover, one member of a federal real-property trade  association noted serious limitations in the database’s completeness and  organization. In addition, one user said that he hoped the public release  would allow better access to real property data but that the poor quality,  completeness, and organization of the data means access to data is no  better than it was before the release.

Further, six of the private sector stakeholders we interviewed were not  aware of the public database, including a stakeholder who confused it  with GSA’s Lease Inventory database. The lack of a single location on  GSA’s website that contains information about all of GSA’s real property  databases may contribute to the awareness, confusion, and usefulness  issues expressed by these stakeholders. Specifically, public access to the  FRPP public database, the GSA’s Lease Inventory database and two  other publicly available real-property databases is found in different  places on GSA’s website:

Public FRPP http://publicfrppdata.realpropertyprofile.gov (managed by  GSA’s Office of Government-wide Policy)

GSA lease inventory https://www.gsa.gov/real-estate/real-estate- services/leasing-policy-procedures/lease-inventory (managed by  GSA’s Office of Leasing)

GSA inventory of owned & leased properties  https://www.gsa.gov/tools/buildings-real-estate-etools/inventory-of- owned-and-leased-properties (managed by GSA’s Public Building  Services)

GSA disposal inventory https://disposal.gsa.gov/s/ (managed by  GSA’s Office of Property Disposal)

The Open Government Data Act requires the Administrator of GSA to  maintain a single public interface online as a point of entry dedicated to  sharing an agency’s data assets with the public. While the databases  serve different purposes, some asset-level data are similar, such as  location or size. According to a GSA official, these databases are  operated by different offices within GSA. This situation poses challenges  to listing the database on a consolidated webpage. Nevertheless, GSA  officials agreed that there could be clearer links and said that they plan to  add them based on our findings. Without a consolidated webpage or clear  links showing how the databases relate to each other and how to access  each database, users of the various databases may not be aware of what  databases do exist to search for assets that could be available to the  public.

Data’s Presentation Issues May Affect the Level of Use

The public database’s presentation issues, combined with stakeholder  confusion and lack of awareness, could contribute to low numbers of  people who accessed the database compared to another GSA-managed  real property database. GSA data indicate that users accessed civilian  agency data from the public database 147 times per month on average  from December 2017 through July 2019 and some months fewer than 10  times. However, according to a GSA official, the number of times users  access the public database through the GSA website doesn’t necessarily  reflect the extent to which people use the data. The official explained that,  since GSA only issues the data once a year, users only need to access  and save it once for use in a given year and that GSA usually sees a  peak in users accessing the data when GSA publishes its annual update  to the database. As indicated in figure 8, there was a peak in users  accessing the database when GSA first issued the 2016 data in  December 2017, and again in March and April 2018 when GSA published  2017 data (28 and 162 times, respectively), and in June 2019 when GSA  published the 2018 data (170 times). In comparison, users access  another real property database, GSA’s Inventory of Owned and Leased  Property database—which is updated weekly—more often than they  access the public database. Users access the Inventory of Owned and  Leased Property database to search for properties controlled by GSA.  Specifically, since the public database was released in December 2017,  the public has continued to access GSA’s Inventory of Owned and  Leased Property almost 10 times more per month than the public  database on average (see fig. 8).

Federal agencies spend billions of dollars annually to operate and  maintain hundreds of thousands of real property assets. GSA’s public  database, extracted from FRPP data, is a comprehensive, descriptive,  database of federal real property. Through the database, the public  should be able to learn about federal assets, whether people are  conducting research or interested in potential uses such as leasing or  purchasing. Issues with the data, however, undermine these uses. GSA  has taken a number of actions to improve the accuracy of the data, such  as implementing the V&V process for identifying and correcting possible  errors. But until GSA has better processes to ensure accuracy of street  address information and identify anomalies, the public data will continue  to lack the type of database most useful to the public. Moreover, the  absence of a risk-based, consistent approach for withholding assets from  the public database or reporting assets to it further erodes its utility.  Finally, utilization of the data base is low; GSA’s choices on how the  database information is presented and how users find out about and  access the public database and other real-property databases may  contribute to this lack of use. Unless GSA improves the accuracy,  completeness, and usefulness of the public database, its intended  benefits—to the public and the federal government—will remain  unrealized.

We are making the following six recommendations to GSA:  The Administrator of GSA should coordinate with agencies to ensure that  street address information in the public database is complete and  correctly formatted. (Recommendation 1)

The Administrator of GSA should coordinate with agencies to review V&V  anomaly categories to better target incorrect data. (Recommendation 2)

The Administrator of GSA should work in consultation with agencies to  determine which, if any, data should be withheld from public release.  (Recommendation 3)

The Administrator of GSA should instruct each agency to apply a  consistent, risk-based approach in determining which, if any, assets or  asset-specific information should be withheld from public release.  (Recommendation 4)

The Administrator of GSA should allow agencies to provide summary  data for secure installations. (Recommendation 5)

The Administrator of GSA should link all of GSA’s publicly available real- property data sources. (Recommendation 6)

We provided a draft of this report to GSA, DHS, DOE, DOI, FCC and  NASA for comment. GSA provided written comments, which are reprinted  in appendix II and summarized below. We received, via email from DOI,  technical comments, which we incorporated as appropriate. DOI, in its  email comments, also suggested revisions to two recommendations,  which we clarified as appropriate. DHS and NASA provided, in email,  technical comments, which we incorporated as appropriate. DOE and  FCC told us they had no comments.

GSA agreed with five of our six recommendations but disagreed with our  third recommendation. GSA wrote that allowing agencies to unilaterally  determine which categories of data to withhold from the public would not  be useful and would complicate comparisons among agencies.

We did not intend that our recommendation allow agencies to decide  without consulting with GSA, and we have clarified our recommendation  accordingly. We continue to believe this recommendation, as clarified, is  valid.

As we reported, GSA currently withholds 15 variables—categories of  data—for all federal assets, including the name of every federal building  and structure. While this approach is consistent for all assets, it reduces  the overall usefulness of the data by withholding information that federal  agencies already make public.

In addition, the ISC told us that the landholding agencies, not GSA, are in  the best position to know what data about their assets are sensitive. We  amended the recommendation by removing the reference to categories of  data and adding that GSA work in consultation with agencies to  determine what data to withhold. This change would create a consistent  way for agencies to release useful data while withholding sensitive data  for individual assets, a step they already take by withholding assets from  the public database. GSA plans to work with the ISC and federal  agencies to review related guidance and modify it as needed.  We  support these plans.

In addition, DOI suggested in email comments that we revise our second  recommendation to include coordinating with agencies to review V&V  anomaly categories to better target incorrect data. Our original  recommendation did not preclude coordination, and since we agree that  such coordination would help improve the V&V process, we clarified the  recommendation accordingly.

We are sending copies of this report to the appropriate congressional  committees, the Administrator of the General Services Administration, the  Acting Secretary of Homeland Security, the Secretary of Energy, the  Secretary of the Interior, Chair of the Federal Communication  Commission, the Administrator of the National Aeronautics and Space  Administration, and other interested parties. In addition, the report is  available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-2834 or rectanusl@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix III.

Appendix I: Categories of Data Withheld from the Public Database

Costs related to the everyday functions of  an asset  Code to identify an installation (i.e.  buildings, structures, land or any  combination of these)

Code to identify a part of an installation (i.e.  buildings, structures, land or any  combination of these)

Building name or the name of an entire  installation (such as an agency campus)

Total number of full and part time federal  employees  Total number of full and part time contract  employees  Identifies whether an asset is part of a field  office (any location that is not the  headquarters location for the agency)

Appendix II: Comments from the U.S. General Services Administration

Appendix III: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Keith Cunningham (Assistant  Director), Lynn Filla-Clark (Analyst-in-Charge), Melissa Bodeau, George  Depaoli, James Duke, Rami Khalfani, Terence Lam, John Mingus,  Joshua Ormond, Crystal Wesco, and Elizabeth Wood made key  contributions to this report.

The General Services Administration created a publicly available database of federal buildings, structures, and land. People can search the database for any reason, such as finding property to lease for a cell tower site.

We found numerous issues with the database which reduce its benefit. For example, 67% of addresses are incorrectly formatted or incomplete, making it hard to locate specific buildings when searching.

Lack of reliable data on federal assets is one of the main reasons Federal Real Property Management remains on our High Risk list. We made 6 recommendations to improve database accuracy, completeness, and usefulness.


Elder Abuse: Federal Requirements for Oversight in Nursing Homes and Assisted Living Facilities Differ

The federal government and states share responsibility for the health and welfare of about 1.5 million individuals—most of them vulnerable older adults—receiving long-term care in nursing homes and assisted living facilities covered by Medicare and Medicaid. For nursing homes, which provide skilled nursing care, federal law defines applicable quality standards and CMS provides guidance for nursing homes and the state survey agencies to help protect residents from elder abuse. For assisted living facilities, which provide assistance with activities of daily living in a residential setting, CMS defines the framework states must establish to oversee these facilities if covered under Medicaid. This includes requiring states to demonstrate to CMS that they are assuring quality including the obligation to protect against elder abuse.

GAO was asked to review federal oversight of elder abuse reporting, investigation, and law enforcement notification in both nursing homes and assisted living facilities. In this report, GAO describes federal requirements for reporting, investigating, and notifying law enforcement about elder abuse in both types of facilities. GAO reviewed relevant laws and regulations and agency guidance, and interviewed CMS and state officials from three states selected for variation in HCBS waiver program size and geography. GAO also interviewed representatives from national stakeholder groups representing consumers, facilities, Medicaid directors, and abuse investigators. In comments on this report, HHS highlighted the distinct oversight frameworks for the two settings and noted that CMS is undertaking efforts to strengthen oversight.

The Centers for Medicare & Medicaid Services (CMS) oversees the Medicare and Medicaid programs and is responsible for safeguarding the health and welfare of beneficiaries living in nursing homes and assisted living facilities. This includes safeguarding older residents from abuse—referred to as elder abuse. CMS delegates responsibility for overseeing this issue to state survey agencies, which are responsible for overseeing nursing homes. When assisted living facilities provide services to Medicaid beneficiaries, they are indirectly subject to CMS oversight through the agency's oversight of state Medicaid agencies.

GAO found that there are specific federal requirements for nursing homes and state survey agencies for reporting, investigating, and notifying law enforcement about elder abuse in nursing homes. (See table below). For example, state survey agencies must prioritize reports of elder abuse in nursing homes based on CMS's specified criteria and investigate within specific time frames. In contrast, there are no similar federal requirements for assisted living facilities—which are licensed and regulated by states. Instead, CMS requires state Medicaid agencies to develop policies to ensure the reporting and investigation of elder abuse in assisted living facilities. For example, CMS requires that state Medicaid agencies establish their own policies and standards for prioritizing reports when investigating incidents in assisted living facilities. Officials from the three selected states in GAO's review said they apply certain federal nursing home requirements and investigation time frames for assisted living facilities when overseeing elder abuse.

The federal government and states share responsibility for the health and  welfare of approximately 1.5 million individuals—most of them older  adults—receiving care in long-term care facilities financed by Medicare  and Medicaid, the federal health care programs for the elderly and low- income and medically needy individuals, respectively. These facilities  include nursing homes, which provide skilled nursing and rehabilitative  care to elderly and disabled individuals, and assisted living facilities,  which provide a residential alternative to nursing home care for  individuals who may prefer to live independently but need assistance with  daily activities. Residents of both types of facilities often have physical  and cognitive limitations that can make them particularly vulnerable to  abuse. Abuse, which can be committed by facility staff, residents, or  others, is a serious occurrence and could result in potentially devastating  consequences for the victim, including lasting mental anguish, serious  injury, or death. While abuse is a concern for both elderly and nonelderly  individuals in long-term care facilities, this report focuses on federal  oversight to protect elderly residents of these facilities from abuse, more  specifically known as elder abuse.

Federal law mandates that nursing homes receiving Medicare and  Medicaid payment must ensure that residents are free from abuse,  neglect, and exploitation. Nursing homes must meet a comprehensive  set of federal statutory and regulatory requirements in order to receive  such payments. The Centers for Medicare & Medicaid Services (CMS)— the agency within the Department of Health and Human Services (HHS)  that oversees the Medicare and Medicaid programs—is responsible for  implementing these requirements. In 2016, nursing homes provided care  to approximately 1.4 million individuals.

In contrast to nursing homes, assisted living facilities are primarily  overseen at the state level through state licensing and regulatory  requirements. States that provide Medicaid coverage of assisted living  facility services for older adults typically do so through a home and  community-based service (HCBS) waiver under section 1915(c) of the  Social Security Act (SSA). Under these waivers, states are responsible  for developing adequate standards to protect the health and safety of  beneficiaries receiving services under the waiver and must demonstrate  to CMS that these standards are met. In 2016, Medicaid covered assisted  living facility services for an estimated 125,000 elderly beneficiaries.

In recent reports, we have found that improved federal oversight of the  health and welfare of residents is needed in both nursing homes and  assisted living facilities. For example, as we reported in our June 2019  report, we found that the incidence of abuse in nursing homes as  identified by state survey agencies increased between 2013 and 2017,  and in January 2018, we found that little is known about the incidence of  abuse in assisted living facilities. In CMS’s oversight of both settings, we  found a lack of clear federal guidance on reporting and consequently, a  lack of key information necessary for monitoring incidents that may cause  harm to a beneficiary’s health or welfare, such as abuse. Additionally, the  HHS Office of Inspector General (HHS-OIG) and state auditors have also  examined how elder abuse is reported and investigated and  recommended improvements at both the federal and state level.

You asked us to review federal oversight of the reporting, investigation,  and notification of law enforcement about elder abuse in nursing homes  and assisted living facilities. In this report, we describe federal  requirements for reporting, investigating, and notifying law enforcement  about elder abuse in both types of facilities. In appendix I, we provide  information on efforts by three selected states to meet federal  requirements for reporting, investigating, and notifying law enforcement  about elder abuse in assisted living facilities. In appendix II, we provide  summary information from other federal and state audits of elder abuse  reporting and investigation. Further, throughout this report we note our  past work on this topic.

To describe federal requirements for reporting, investigating, and notifying  law enforcement about elder abuse in nursing homes and assisted living  facilities, we reviewed relevant statutes and regulations and CMS  guidance, including the State Operations Manual and HCBS waiver  guidance and interviewed CMS officials regarding the agency’s oversight  of the requirements. We selected a non-generalizable sample of three  states—Connecticut, Oklahoma, and South Dakota—that have  implemented HCBS waivers and vary in HCBS waiver program size and  geography. In each state, we reviewed their waiver agreements and  spoke with officials from the state survey agency, state Medicaid agency,  and the state agency responsible for licensing assisted living facilities and  investigating complaints. We also interviewed CMS officials, including  regional office officials, about their oversight of state survey agencies and  HCBS waivers in our selected states. We interviewed representatives  from national stakeholder groups representing consumers, facilities,  Medicaid directors, and investigators to obtain their perspectives on elder  abuse in nursing homes and assisted living facilities. We also reviewed  related audits issued by the HHS-OIG and state auditors between 2014  and 2018 related to reporting and investigating elder abuse in nursing  homes and assisted living facilities and included them with a discussion of  related GAO reports.

We conducted this performance audit from August 2018 to August 2019  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Care Provided in Nursing Homes and Assisted Living Facilities

Nursing homes and assisted living facilities provide important long-term  care to vulnerable individuals in institutional or residential settings.  Specifically, nursing homes provide care to elderly and disabled  individuals, many of whom have physical and cognitive limitations  requiring skilled nursing care. Assisted living facilities provide a residential  alternative to nursing home care for individuals who prefer to live  independently but need assistance to maintain their independence. Like  nursing homes, they may provide residents with a variety of services to  assist with activities of daily living, such as bathing and dressing, but the  facilities are generally not licensed to provide 24-hour skilled nursing care  and typically offer a more limited range of medical care. As we reported in  our January 2018 report on CMS’s oversight of assisted living facilities  under the Medicaid program, the demand for assisted living services,  which offer the benefit of community living, is expected to increase as a  result of the aging of the nation’s population, increased life expectancy,  and older adults’ desire to remain in the community. Additionally, the  cost of nursing home care for an individual generally exceeds the cost of  assisted living facility services, further incentivizing a shift among  consumers and payers to assisted living for elderly individuals, including  those with increasingly complex health needs who would otherwise need  nursing home care.

Oversight of nursing homes is a shared federal-state responsibility.  Federal law imposes both a comprehensive set of quality standards that  nursing homes must meet to participate in the Medicare and Medicaid  programs, and federal and state oversight responsibilities to enforce  these standards. CMS, which is charged with implementing these  standards and conducting federal oversight, contracts with state survey  agencies to perform both routine inspections—known as standard  surveys—and conduct investigations of elder abuse incidents, including  complaints and facility-reported incidents. CMS provides guidance  implementing statutory and regulatory requirements to protect residents  from elder abuse in its State Operations Manual, which specifies  requirements for reporting, investigating, and notifying law enforcement  about elder abuse in nursing homes. CMS regional offices monitor state  compliance with federal requirements for nursing home oversight.

Generally, states establish their own oversight requirements for assisted  living facilities. These facilities are largely overseen by state agencies  within, for example, the state health or aging departments; however,  when assisted living facilities provide services to Medicaid beneficiaries,  they are also indirectly subject to CMS oversight through the agency’s  oversight of state Medicaid agencies. As we have previously reported,  states can provide Medicaid coverage for assisted living services under  multiple authorities, but most commonly states use an HCBS waiver  under section 1915(c) of the SSA. Under these waivers, CMS requires  states to develop a quality assurance system that monitors beneficiary  health and welfare—including tracking and responding to incidents that  may cause harm to a beneficiary’s health and welfare, such as elder  abuse. States must demonstrate to CMS that they are meeting these  quality assurance obligations in their waiver renewal reports, typically  submitted about 2 years before an HCBS waiver is scheduled to end.  States must also report summary information annually to CMS on any  health and welfare deficiencies occurring under their HCBS waivers. CMS  regional offices oversee state compliance with waiver requirements.

In addition to state survey agencies, state Medicaid agencies, and the  agencies that license and regulate assisted living facilities, there are other  entities charged with protecting nursing home and assisted living facility  residents from elder abuse. These agencies’ roles and missions can vary  by state. For example, Adult Protective Services (APS) programs in each  state are generally responsible for identifying, investigating, resolving,  and preventing abuse of older adults, and such programs may investigate  complaints of elder abuse in nursing homes and assisted living facilities.  Additionally, Medicaid Fraud Control Units and local law enforcement can  also play a role in investigating elder abuse. Consequently, incident  management may be coordinated among multiple separate agencies.

Federal Requirements Specify Elder Abuse Reporting, Investigation, and Notification in Nursing Homes and Direct States to Establish Assisted Living Facility Requirements

Federal requirements include those for nursing homes and state survey  agencies specific to reporting, investigating, and notifying law  enforcement of elder abuse in nursing homes. For example, federal  requirements specify the time frames within which nursing homes must  report alleged elder abuse to state survey agencies and, similarly, specify  time frames for state survey agencies to report elder abuse to CMS. In  contrast, there are no similar requirements for assisted living facilities  and, instead, states must establish their own policies to ensure the  reporting and investigation of elder abuse in assisted living facilities  covered by Medicaid. (See fig. 1 for federal requirements for reporting,  investigating, and notifying law enforcement about elder abuse in nursing  homes and assisted living facilities.)

As illustrated in figure 1, there are key differences between federal  requirements for reporting, investigating, and notifying law enforcement  about elder abuse occurring in nursing homes compared to assisted living  facilities. CMS officials told us that the difference in requirements between  nursing homes and assisted living facilities reflects the different regulatory  relationship between the agency and the two facility types. According to  CMS officials, CMS has direct regulatory authority over nursing homes,  but does not have direct authority over assisted living facilities. As noted,  states are largely responsible for establishing their own policies for  overseeing the reporting and investigation of abuse in assisted living  facilities. (See app. I for profiles of selected states with HCBS waivers  regarding elder abuse reporting, investigating, and notification.)  Differences in federal requirements include the following:  Reporting. Federal law and CMS policy define specific time  frames for nursing home staff and state survey agencies to report  incidents of abuse that occur in nursing homes, respectively, and  CMS requires states to establish their own reporting time frames  for assisted living facilities serving HCBS waiver participants.  Nursing homes must ensure that allegations of elder abuse are  reported to the state survey agency immediately, but no later than  2 hours after the allegation is made if the incident involves serious  bodily injuries and within 24 hours if it does not. In addition, state  survey agencies must report to CMS all complaints and certain  facility-reported incidents of abuse through a computer-based  complaint and incident tracking system and immediately alert  CMS regional offices when an especially significant or sensitive  incident occurs that attracts public or broad media attention. In  contrast, CMS requires state Medicaid agencies that pay for care  in assisted living facilities through HCBS waivers to establish their  own required time frames for reporting incidents. Consequently,  reporting time frames and processes for assisted living facilities  can vary by state. For example, Connecticut requires incidents to  be reported to the state Medicaid agency and Adult Protective  Services within 2 business days, while Oklahoma requires that  initial incident reports are submitted within 1 business day.

Investigation. CMS prescribes investigation time frames and  priority categories for incidents occurring in nursing homes and  requires states to establish their own time frames and priority  categories for incidents in assisted living facilities. CMS requires  state survey agencies to assess reports of elder abuse in nursing  homes and assign a priority investigation status based on the  seriousness of the allegations. The required investigation time  frames are tied to the priority status. For example, if the allegation  indicates that there continues to be an immediate risk of serious  injury, harm, impairment, or death of a resident unless immediate  corrective action is taken, the survey agency must initiate an  onsite investigation within 2 business days of receiving the  report. CMS also requires nursing homes to have written policies  and procedures for conducting internal investigations of suspected  elder abuse and to submit findings from these investigations to the  state survey agency within 5 business days of the incident. In  contrast, CMS does not prescribe investigation time frames or  define priorities for incidents occurring in assisted living facilities;  instead, CMS requires that state Medicaid agencies with HCBS  waivers establish their own policies for prioritizing reports of abuse  and initiating investigations in assisted living facilities.  Consequently, investigation time frames and prioritization can vary  by state. For example, Connecticut does not specify a process for  prioritizing incident investigations in its HCBS waiver, but officials  told us the state requires the Medicaid program to initiate an  investigation immediately; whereas South Dakota requires face-to- face contact with a victim within 24 hours if the incident is life or  health-threatening.

Family or Legal Guardian Notification  Although the Centers for Medicare & Medicaid  Services (CMS) requires facilities to notify a  resident’s representative of a deterioration in  the resident’s condition, CMS does not require  nursing homes, assisted living facilities, state  survey agencies, or state Medicaid agencies  to notify a victim’s family or legal guardian of  alleged elder abuse. However, CMS’s  guidance for nursing homes notes the  importance of family or legal guardian  notification. Specifically, CMS guidance  requires facilities to take actions to prevent  further harm from occurring to a victim of  alleged elder abuse and cites law  enforcement notification, as well as family or  legal guardian notification as examples of  protective measures facilities may take to  comply with that requirement. In addition,  CMS requires states to develop a policy for  notifying participants, family, or legal  guardians of the findings of any critical  incident investigations under its home and  community-based services waiver program.  CMS officials told us family or legal guardian  notification is generally a state responsibility,  and state officials told us that it is largely a  facility responsibility governed by the facility’s  policies. Some states include family or  guardian notification requirements in state  guidance on mandatory reporting of elder  abuse. In interviews with stakeholders  representing consumers and elder abuse  investigators we learned that family  notification can both help but also pose some  privacy challenges.

Law enforcement notification. Although federal law requires  nursing homes to establish policies for ensuring that law  enforcement is notified of elder abuse that occurs in their facilities,  and CMS policy requires state survey agencies to notify law  enforcement of substantiated findings of elder abuse that occur in  nursing homes, these actions are not required when a similar  incident occurs in an assisted living facility. Furthermore, CMS  also does not require state Medicaid agencies to establish their  own law enforcement notification requirements for assisted living  facilities as part of the state’s HCBS waiver agreements. CMS and  state officials told us that, generally, state agencies coordinate  with law enforcement regardless of where the abuse occurs.  Some states also require law enforcement notification as part of  their state mandatory reporter laws. (See app. I for descriptions  of selected state mandatory reporter laws.) For example,  Connecticut requires Medicaid waiver program staff members to  inform law enforcement of all suspected crimes, including abuse.  Both GAO and HHS-OIG have identified, among other things,  gaps in notifying law enforcement about abuse in nursing homes  and recommended that CMS make changes to help ensure that  nursing homes and state survey agencies notify law  enforcement.

In the course of our review, we found states may align certain  requirements for investigating, reporting, and notifying law enforcement  about elder abuse in assisted living facilities with federal requirements for  nursing homes. Officials from all three selected states in our review told  us they apply certain federal nursing home requirements and time frames  to assisted living facilities when overseeing reports and investigations of  alleged elder abuse. For example, officials from Oklahoma and South  Dakota told us they align or are in the process of aligning time frames  within which assisted living facilities are required to report incidents of  elder abuse to state authorities with the time frames federally required for  nursing homes, and said that alignment reduces confusion, especially  among facilities that offer both types of residential care.

Given its attenuated role in overseeing the reporting, investigation, and  law enforcement notification of elder abuse in assisted living facilities,  CMS officials told us the agency is taking steps to gather and disseminate  best practices to help states better manage their response to elder abuse  incidents in assisted living facilities. Specifically, officials told us that CMS  has initiated an effort to more closely examine how states operate their  incident management systems, which are used to track reports and  investigations of elder abuse in assisted living facilities covered by their  HCBS waivers. In May 2018, CMS surveyed states requesting  information on how those states operate an incident management system  for their HCBS waiver programs to track reports and investigations of  elder abuse. CMS officials said they will take information learned  through the survey as well as through on-site reviews that the agency has  been conducting in five states since June 2019, to develop best practices  and technical guidance on collecting and reporting critical incidents.

We provided a draft of this report to HHS for review and comment. HHS  noted that federal oversight of nursing homes and assisted living facilities  is not directly comparable given the differences between HHS’s statutory  authority to oversee both facility types. HHS noted that although CMS’s  oversight of assisted living facilities is more limited, CMS works in  partnership with states—through providing guidance, technical support,  training, and oversight of states’ quality reporting—to ensure the safety of  Medicaid beneficiaries in assisted living facilities. We recognize that CMS  is operating in different statutory frameworks with respect to both nursing  homes and assisted living facilities, and we have noted the distinction in  our report. HHS further noted that CMS is undertaking efforts to  strengthen federal oversight of nursing homes and states with HCBS  programs, including through addressing our past recommendations.

HHS comments are reproduced in appendix III. HHS also provided  technical comments, which were incorporated as appropriate.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to the  Secretary of Health and Human Services, appropriate congressional  committees, and other interested parties. The correspondence is also  available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-7114 or at dickenj@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix IV.

Appendix I: Summary of Selected States’ Requirements for Reporting, Investigating, and Notifying Law Enforcement about Elder Abuse in Assisted Living Facilities

We reviewed state-level requirements for reporting, investigating, and  notifying law enforcement about elder abuse in three selected states that  cover services in assisted living facilities under their Home and  Community-based Services (HCBS) waivers—Connecticut, Oklahoma,  and South Dakota. These states are collectively responsible for  safeguarding as many as 16,800 assisted living residents—2,751 of  whom are covered by Medicaid—from elder abuse. All three states have  mandatory reporting requirements that typically require various identified  health care providers and facility staff to report suspected elder abuse to  adult protective services or law enforcement, regardless of the setting in  which the victim was abused or whether the victim is an HCBS waiver  participant who would be protected under the Centers for Medicare &  Medicaid Services (CMS) program requirements. Further, the states  developed guidance for their HCBS programs that establishes additional  reporting, investigation, and notification requirements—beyond their  mandatory reporting law requirements—that caregivers, facilities,  program staff, and state agencies must follow in response to incidents  that occur to residents receiving services under Medicaid waiver  programs. Selected information about assisted living facilities and state- level requirements for each of the three states is summarized in figures 2  through 4.

Appendix II: Summary of Selected Federal and State Audits of Oversight of the Reporting, Investigation, and Notification of Law Enforcement about Elder Abuse in Nursing Homes and Assisted Living Facilities

GAO has issued reports reviewing the Centers for Medicare & Medicaid  Services’ (CMS) oversight of the health and welfare of residents in  nursing homes and assisted living facilities. For example, selected GAO  reports from approximately the past 5 years included a review of the  incidence of abuse in nursing homes and a review of what is known about  the incidence of abuse in assisted living facilities. Reports often included  key recommendations. (See table 1.)

In addition to GAO’s audits of federal oversight of nursing homes and  assisted living facilities, the Office of Inspector General within the  Department of Health and Human Services (HHS-OIG) routinely audits a  broad range of both the Centers for Medicare & Medicaid Services’  (CMS) and states’ oversight activities related to long-term care facilities.  We identified three HHS-OIG reports issued between 2014 and 2018 that  provide examples of HHS-OIG’s examinations of the reporting,  investigation, and notification of law enforcement of elder abuse in  nursing homes. (See table 2.) Although the specific scope of these  reports varied, common findings included gaps in notifying law  enforcement. For example, HHS-OIG examined Medicare claims data to  identify cases where hospital staff had identified potential abuse and  found that nursing homes failed to report many of these incidents to state  survey agencies or notify law enforcement despite federal and state  requirements and recommended that CMS provide training, clarify  guidance, and track referrals to law enforcement.

State auditors may also audit their states’ oversight of nursing homes and  assisted living facilities. We identified nine reports issued by state  auditors between 2014 and 2018 that examined their states’ oversight of  elder abuse reporting and investigation across both settings. (See table  3.) Although the scope of individual reports across the states varied, state  auditors identified instances of state entities not complying with state or  federal requirements for a variety of reasons—including weaknesses in  policies and procedures, resource constraints, and information  management challenges—and recommended improvements. For  example, in 2014 California state auditors found that thousands of  complaint investigations—including over 300 classified as immediate  jeopardy—were left open for almost a year, in part because the state did  not specify time frames for completing investigations.

Appendix III: Comments from the Department of Health & Human Services

Appendix IV: GAO Contact and Staff Acknowledgments

John E. Dicken, (202) 512-7114 or dickenj@gao.gov.

In addition to the contact named above, Karin Wallestad (Assistant  Director); Jasleen Modi (Analyst-in-Charge); and Elise Pressma made  key contributions to this report. Also contributing were Thomas Garloch,  Cathy Hamann, Laurie Pachter, and Jennifer Whitworth.

Under Medicaid and Medicare, states and the federal government share responsibility for protecting about 1.5 million nursing home and assisted living residents from elder abuse.

We compared federal requirements for reporting and investigating elder abuse in nursing homes and assisted living facilities. We found that, while the federal government sets specific requirements for nursing homes, it requires states to establish their own requirements for reporting and investigating elder abuse in assisted living facilities.