The challenge

The CMS Information Security and Privacy Group (ISPG) is in charge of the policies and programs that ensure the security and privacy of data that is handled by CMS information systems. ISPG staff and contractors work to maintain policies, distribute guidance, communicate with customers, support security programs, and promote new initiatives.

While doing this important work over the years, they amassed a large collection of documents and resources that were spread across various locations and formats. This led to issues with version control and made it hard for people to find the information needed to do their security-related tasks.

Without a single, trusted location for cybersecurity information – and with many of the documents being in static PDFs that were full of jargon and hard to understand – finding essential information from ISPG could be onerous, negatively impacting CMS’ overall security posture.

Client goal

To improve their customer service and promote better security across CMS systems, ISPG engaged our team to develop a user-friendly website (informally known as “CyberGeek”) at security.cms.gov that is recognized as the authoritative home for CMS security and privacy information. With this project, ISPG aims to:

• Improve customer service through modern information delivery
• Support CMS security personnel with the resources needed for their critical work
• Make security topics and policies more approachable and human-centered
• Build user-friendly processes to help ISPG staff maintain their content
• Establish a platform where customers can find news and updates from ISPG

Our Approach

Together with our partner Affix Digital, we worked closely with ISPG stakeholders and customers to understand the cybersecurity ecosystem at CMS. We built relationships across ISPG and partnered with their leadership and program teams to streamline their content into a single, trusted platform that makes cybersecurity information approachable and human-centered.

First, listen and learn

We started by interviewing ISPG customers to make sure we built the site’s information architecture in a way that made sense to the people using it. Card sorting – a process that involves users in the design of the site navigation – helped solidify the menus and categories that would be the foundation of a user’s journey through the site.

Open source and accessible

We built a decoupled site using Drupal and React to give the client flexibility for technology changes in the future. Utilizing the U.S. Web Design System (USWDS), we created a component library that ensures the site meets government requirements for things like accessibility and mobile responsiveness. We used Storybook to build components in isolation before deployment to the site, catching errors in real-time so they could be fixed on the spot.

Search at the core

One of the main problems ISPG wanted to solve for their customers was the headache of searching for security documents, templates, and program information – which had been difficult to find in various internal repositories. We implemented a powerful search feature using Algolia, with filter options to help people find information specific to their needs. Improvements to search are ongoing as we learn more about how people use it.

The challenge

The Centers for Medicare and Medicaid Services (CMS) provide healthcare benefits to millions of people every year. But the websites and digital tools that help people find and enroll in these programs were built on a myriad of aging technologies and were confusing to navigate. CMS needed to streamline and update its online platforms to improve the customer experience while establishing more efficient backend workflows for agency staff.

This is an enormous and complex task, involving the modernization of Medicare.gov, CMS.gov, CMS open data portals, and many other public facing apps that serve multiple user groups — including beneficiaries, caregivers, health providers, data professionals, and government stakeholders.

WECMS helps more than 100 million Americans every year apply, find, and enroll in healthcare programs. The information and tools provided are essential components in supporting CMS' goals of creating a truly consumer-focused, streamlined, efficient, and omni-channel experience for beneficiaries and their caregivers. The overall intent for this contract is to ensure continuity of operations for the Americans it serves and the WECMS program, which maintains, designs and implements open source software digital services for CMS’ flagship websites, tools, components and applications on Healthcare.gov, Medicare.gov, CMS.gov, and 7 Open Data catalogs. In addition to engineering and design continuous improvements on these established websites, this contract provides security compliance, devops, system infrastructure, content strategy, information architecture, training, documentation, content editor support, public call center dev support, Section 508 improvements, mobile application development, and tooling and systems expertise.

Client goal

When this multi-year transformation is complete, CMS will be able to deliver on its mission more effectively. CivicActions is providing agile development, DevOps, and human-centered design (HCD) services to help the agency:

• Improve the content editing experience for staff
• Modernize legacy systems and tools
• Replace proprietary technologies with open source
• Support active, informed healthcare consumption

Our approach

Collaboration is the key to success in a project of this scale and complexity. With multiple partner vendors (including our primary partner Fearless) and disparate stakeholders across many organizational layers, we work hard to keep lines of communication open and be up-front about potential problems.

Balancing stakeholder priorities, user needs, technical complexity, and CMS deadlines, we created a roadmap that minimizes risk and maximizes opportunities for success. Then we went to work on “quick wins” — tasks we could complete right away that would make the biggest difference for users.

Address the holistic customer experience

We knew that each CMS application is part of a huge public-facing ecosystem of digital tools, with many touchpoints. To address the entire experience that a person would have in navigating the systems, we drew on the agency’s own knowledge of their beneficiary community, working with them to refine and document how each person interacts with CMS online. The resulting holistic view helped us identify how we could improve that experience iteratively.

Adopt a data-driven strategy

To make sure we built the right solutions, we immersed ourselves in the CMS mission from the operational, technical, and UX perspectives. We dug into existing user research, reviewed analytics reports, conducted stakeholder interviews — then created user personas and journey maps to refine the project scope and goals. All this data is managed in a shared repository of user insights and project knowledge, which we refer to as we prioritize the work to be done.

Replace proprietary software with open source

We are “reverse engineering” multiple custom-built Microsoft.NET applications (such as the Medicare Eligibility and Premium Calculator and the congressionally-funded Physician Fee Schedule (PFS) Lookup Tool with modern, open source solutions. As we recreate all these applications in Drupal, we’re making guides and code documentation that outline the entire system — allowing CMS to maintain control of its own technologies and avoid vendor lock-in. We are also migrating CMS open data platforms from Socrata (proprietary) to an open source solution using DKAN 2.