All Reports

The principal executive director of the Office of Acquisition, Logistics, and Construction considers whether any additional training or other measures are necessary with respect to reporting the wrongdoing of a supervisor and the acceptance of free meals and drinks by VA employees during the February 2023 site visit.

The principal executive director of the Office of Acquisition, Logistics, and Construction determines whether any additional guidance, training, or oversight is needed with respect to ensuring VA employees do not improperly solicit sponsorships for VA events that do not primarily benefit veterans.

VA’s designated agency ethics official determines whether any additional steps need to be taken in connection with Ms. Dawson’s 2023 public financial disclosure based on the findings of this report.

Confirm that medical facility directors develop local guidance on using automated dispensing cabinets in accordance with VHA Directive 1108.21 (and any revisions to this directive) and that facilities comply with that local guidance.

Require Pharmacy Benefits Management Services to revise VHA Directive 1108.21 to include routine monitoring for the use of generic information as a requirement in facility-level guidance for automated dispensing cabinets.

Ensure, in coordination with the controlled substance coordinator, or appropriate designee, and Veterans Integrated Service Networks, that reports detailing cabinet transactions for controlled substances removed using generic information are reviewed as part of required controlled substance inspections.

The Under Secretary for Health ensures the establishment of Veterans Integrated Service Network-level multidisciplinary cancer committees.

The Under Secretary for Health ensures Veterans Integrated Service Network staff submit an inventory of available oncology services and facility points of contact to the National Oncology Program Office annually.

The Under Secretary for Health ensures complexity level 1 and 2 facilities pursue membership in the National Cancer Institute’s National Clinical Trial Network or the National Cancer Institute Community Oncology Research Program.

The Under Secretary for Health ensures the establishment of facility-level multidisciplinary cancer committees, or partnering with another facility or Veterans Integrated Service Network to provide the required committee functions.

The Under Secretary for Health reviews the operations of oncology-related program offices to ensure the required oversight of Veterans Integrated Service Network and facility oncology program implementation.

Evaluate whether VA should establish an enterprise-wide governance structure for Caseflow development, consistent with VA’s initial comprehensive plan to Congress.

Develop a well-defined roadmap for the future development and implementation of Caseflow.

Enforce contract requirements through improved oversight, ensuring violations are identified and remediated.

Evaluate which staff should have access to and should update the Consult Toolbox when records are requested or received and update the “Consult Business Rules and Uses of the Consult Package Standard Operating Procedure” to reflect necessary changes.

Include controls within the Consult Toolbox to prevent errors and improve data quality, including controls on administrative closure of low-risk consults and documenting the records-retrieval method.

Update consult closure policies and procedures to clarify requirements for administrative closure and determine whether metrics for the percentage of records received should be a requirement and included in policy.

Determine whether Veterans Health Administration facilities’ community care offices should continue to be required to use the administrative closure report for oversight of administratively closed consults, and if not, determine what reports should be required.

Evaluate the workload of community care staff to determine the most efficient way to structure and execute their duties.

Determine if there are mechanisms to identify standardization opportunities and increase efficiency for improving records return processes.

Ensure community care staff follow procedures to reduce duplicate records received.

Evaluate ways to increase use of provider electronic records portals to reduce reliance on electronic fax when retrieving medical records.

Consider increased implementation of technologies to improve records processing once received to reduce the manual renaming of electronic files and uploading of records into the electronic health record.

Ensure records from the Joint Longitudinal Viewer are uploaded into the electronic health record.

Develop and implement a method to identify and report separate quality statistics for the Military Sexual Trauma Operations Center.

Update the existing two-signature review process for claims processors and designated reviewers to include an increased focus on military sexual trauma denials.

Develop and implement a process to assess designated reviewers’ competency in processing denied military sexual trauma claims and monitor effectiveness.

Update the relevant sections on transportation expenses in the Veterans Benefits Administration’s Adjudication Procedures Manual to align with each other.

Ensure automation is consistent with the policy for processing the transportation benefit.

Ensure staff involved with acquiring information and communication technology are adequately trained on federal and VA requirements for Section 508 standards.

Update VA Handbook 6221 to clearly identify roles and responsibilities related to ensuring Section 508 compliance during procurement.

Establish a way to ensure compliance documentation and market research on any information and communication technology being procured are submitted to the VA Office of 508 Compliance for approval so that the office can determine whether the technology is the most compliant under Section 508.

Collaborate with the VA Office of 508 Compliance to develop policies and procedures to ensure VA’s information and communication technology procurements comply with Section 508 requirements.

We recommended the Assistant Secretary for Information and Technology consistently implement an improved continuous monitoring program in accordance with the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF). Specifically, implement an independent security control assessment process to evaluate the effectiveness of security controls prior to granting authorization decisions.

We recommended the Assistant Secretary for Information and Technology implement improved processes for reviewing and updating key security documentation, including Security Control Assessments, Risk Assessments, and Privacy Impact Assessments as needed. Such updates will ensure all required information is included and accurately reflects the current environment, new security risks, and applicable federal standards.

We recommended the Assistant Secretary for Information and Technology implement improved processes to ensure System Security Plans reflect the status of security control implementations and risks are accurately reported to support a comprehensive risk management program across the organization.

We recommended the Assistant Secretary for Information and Technology implement improved mechanisms to ensure system owners and information system security officers follow procedures for establishing, tracking, and updating POA&Ms for all known risks and weaknesses including those identified during security control and other assessments.

We recommended the Assistant Secretary for Information and Technology implement measures to ensure that system stewards and other officials responsible for system level POA&Ms are closing items with relevant support that shows sufficient remediation of the identified weakness.

We recommended the VA Office of Personnel Security, Human Resources, and Contract Offices strengthen processes to ensure appropriate levels of background investigations are performed timely and completed for applicable VA employees and contractors.

We recommended the Office of Personnel Security, Human Resources, and Contract Offices implement improved processes for establishing and maintaining accurate investigation data within VA systems used for background investigations.

We recommended the Assistant Secretary for Information and Technology ensure contingency plans for all systems and applications are updated and tested in accordance with VA requirements.

We recommended the Assistant Secretary for Information and Technology implement improved procedures to ensure that system outages are resolved within stated recovery time objectives.

We recommended the Assistant Secretary for Information and Technology ensure system owners consistently implement processes for periodic reviews of user account access. Remove unnecessary and inactive accounts on systems and networks.

We recommend the Assistant Secretary for Information and Technology coordinate with system owners and local system management to ensure the consistent monitoring and reviewing of privileged accounts, service accounts, and accounts for individuals with access to source code repositories are performed across VA systems and platforms.

We recommend the Assistant Secretary for Information and Technology implement improved processes to ensure compliance with VA password policy and security configuration baselines on domain controllers, operating systems, databases, application, and network devices.

We recommended the Assistant Secretary for Information and Technology ensure established change control procedures are consistently followed for testing and approval of system changes for VA applications and networks.

We recommended the Assistant Secretary for Information and Technology implement and consistently enforce established procedures for preventing and detecting potential unauthorized changes across all platforms and applications in the environment.

We recommended the Assistant Secretary for Information and Technology ensure that all systems and platforms are monitored for compliance with documented VA standards for baseline configurations. Ensure that system owners consistently implement and monitor their configurations.

We recommended the Assistant Secretary for Information and Technology implement automated software management processes on all agency platforms to identify and prevent the use of unauthorized software on agency devices.

We recommended the Assistant Secretary for Information and Technology implement improved procedures for establishing, documenting, and monitoring an accurate software and logical hardware inventory for system boundaries across the enterprise.

We recommended the Assistant Secretary for Information and Technology implement improved processes for monitoring and analyzing significant system audit events for unauthorized or unusual activities across all systems and platforms in accordance with VA policy. Ensure privileged activity is monitored on all systems and applications.

We recommended the Assistant Secretary for Information and Technology enable system audit logs on all critical systems and platforms and conduct centralized reviews of security violations across the enterprise.

We recommended the Assistant Secretary for Information and Technology implement improved mechanisms to continuously identify and remediate security deficiencies on VA’s network infrastructure, database platforms, and Web application servers in accordance with established policy timeframes. If patches cannot be applied or are unavailable, other protections or mitigations should be documented and implemented to address the specific risks.

We recommended the Assistant Secretary for Information and Technology continue to implement improved segmentation controls that restrict vulnerable medical devices from unnecessary access from the general network.

We recommended the Assistant Secretary for Information and Technology implement improved processes to require system owners and management to provide adequate credentials to ensure security scans are authenticated to end devices where feasible and the subsequent vulnerabilities are remediated in a timely manner.

We recommended the Assistant Secretary for Information and Technology improve the process for tracking and resolving vulnerabilities that cannot be addressed by enterprise processes within policy timeframes. Implement mitigations for identified security deficiencies by applying security patches, system software updates, or configuration changes to reduce applicable security risks.

Establish internal control procedures to ensure recruitment, relocation, and retention incentive documentation is appropriately maintained in accordance with VA policy and guidance.

Enforce procedures to ensure Veterans Integrated Service Network human resources offices properly review recruitment, relocation, and retention incentive documentation for compliance with VA policy.

Enforce quality control checks to ensure Veterans Integrated Service Networks fulfill requirements for maintaining recruitment, relocation, and retention incentives documentation.

Establish accountability measures to ensure Veterans Integrated Service Networks’ quality control and oversight responsibilities are risk-based and fulfilled in a timely manner.

Evaluate resource requirements and establish accountability measures to ensure quality control and oversight responsibilities are risk-based and fulfilled in a timely manner.

Evaluate the retention incentive awards for the 28 employees identified in this report who received payments after the incentive period ended, terminate the incentive if it was not recertified, determine whether recoupment of funds is warranted, and take action if appropriate.

Assess retention incentive payment data to identify awards that have been paid for over one year and determine whether each has been appropriately recertified or should be terminated.

Establish oversight procedures to ensure retention incentives are reviewed annually, recertified if appropriate, or otherwise terminated to ensure payments are not continued after the expiration date.

Ensure all erroneous scenarios in the Veterans Benefits Management System for Rating special monthly compensation calculator identified in this review are corrected and certify the results to the VA Office of Inspector General.

Establish a plan to conduct additional testing of the Veterans Benefits Management System for Rating special monthly compensation calculator to ensure its accuracy.

Update the Fiduciary Program Manual to specify when a removed fiduciary should be flagged as “Do Not Appoint” and ensuring that staff understand if they are responsible for adding the flag.

Develop and provide training on updated Fiduciary Program Manual procedures on flagging barred individuals or entities as “Do Not Appoint” and include a mechanism to ensure that fiduciary hub staff have taken and understand the training.

Update the quality review process to include ensuring that fiduciaries are flagged “Do Not Appoint” when required.

Instruct the program to communicate pertinent annual funding guidance related to Pain Management, Opioid Safety, and Prescription Drug Monitoring Program initiatives before the start of the upcoming fiscal years so that Veterans Integrated Service Networks and medical facilities can adequately plan and take appropriate hiring actions needed to spend their funds.

Ensure the program communicates pertinent funding information related to Pain Management, Opioid Safety, and Prescription Drug Monitoring Program initiatives with key personnel—such as program coordinators and Veterans Integrated Service Network and medical facility leaders.

Ensure the program clarifies and defines requirements for pain management teams in the new Veterans Health Administration Directive 1151, Pain Management and Opioid Safety.

Establish means to periodically validate the status information of facilities’ pain management teams.

Require the program and the chief operating officer to assess and ensure corrective actions are taken to address each medical facility’s lack of progress in achieving compliance with the requirement to have a pain management team as mandated by the Jason Simcakoski Memorial and Promise Act.

District leaders and the Evanston, La Crosse, and Milwaukee Vet Center Directors collaborate with the support VA medical facility to determine reasons for noncompliance with staff participation on the mental health executive council, take action as indicated, and monitor compliance.

District leaders and the Evanston, Gary Area, La Crosse, and Milwaukee Vet Center Directors determine reasons for noncompliance with completing four hours of external clinical consultation for clinically complex cases per month, ensure a process is implemented, and monitor compliance.

District leaders and the Gary Area Vet Center Director determine reasons for noncompliance with Vet Center Director review of 10 percent of active client records monthly for each counselor’s caseload, ensure completion, and monitor compliance.

District leaders and the Gary Area, La Crosse, and Milwaukee Vet Center Directors determine reasons for noncompliance with employees completing select trainings in the required time frame, ensure completion, and monitor compliance.

District leaders and the Evanston, Gary Area, and Milwaukee Vet Center Directors determine reasons for noncompliance with completion of an outreach plan with all required strategic components, ensure completion, and monitor compliance.

District leaders and the La Crosse Vet Center Director determine reasons for noncompliance with monthly automated external defibrillator inspections, ensure completion, and monitor compliance.

District leaders determine reasons why the closing of the Milwaukee Vet Center resulted in multiple communication failures, and ensure all clients are notified of the new location, the Vet Center Call Center has accurate information, and websites include correct location and phone number information.

The Readjustment Counseling Service Chief Officer considers developing written guidance for vet center closure and temporary relocation processes including oversight responsibilities.