This could include the number of vulnerabilities development groups are introducing into your websites every month, the speed at which issues that do slip through QA are fixed or how many days of the year a particular system is exposed to something serious.
Ideally this would be done by reforming Medicaid financing to provide the federal assistance to the states for the program through fixed, finite block grants, which do not vary by matching increased state Medicaid spending as under the current system.