All Reports

We recommended the Assistant Secretary for Information and Technology consistently implement an improved continuous monitoring program in accordance with the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF). Specifically, implement an independent security control assessment process to evaluate the effectiveness of security controls prior to granting authorization decisions.

We recommended the Assistant Secretary for Information and Technology implement improved processes for reviewing and updating key security documentation, including Security Control Assessments, Risk Assessments, and Privacy Impact Assessments as needed. Such updates will ensure all required information is included and accurately reflects the current environment, new security risks, and applicable federal standards.

We recommended the Assistant Secretary for Information and Technology implement improved processes to ensure System Security Plans reflect the status of security control implementations and risks are accurately reported to support a comprehensive risk management program across the organization.

We recommended the Assistant Secretary for Information and Technology implement improved mechanisms to ensure system owners and information system security officers follow procedures for establishing, tracking, and updating POA&Ms for all known risks and weaknesses including those identified during security control and other assessments.

We recommended the Assistant Secretary for Information and Technology implement measures to ensure that system stewards and other officials responsible for system level POA&Ms are closing items with relevant support that shows sufficient remediation of the identified weakness.

We recommended the VA Office of Personnel Security, Human Resources, and Contract Offices strengthen processes to ensure appropriate levels of background investigations are performed timely and completed for applicable VA employees and contractors.

We recommended the Office of Personnel Security, Human Resources, and Contract Offices implement improved processes for establishing and maintaining accurate investigation data within VA systems used for background investigations.

We recommended the Assistant Secretary for Information and Technology ensure contingency plans for all systems and applications are updated and tested in accordance with VA requirements.

We recommended the Assistant Secretary for Information and Technology implement improved procedures to ensure that system outages are resolved within stated recovery time objectives.

We recommended the Assistant Secretary for Information and Technology ensure system owners consistently implement processes for periodic reviews of user account access. Remove unnecessary and inactive accounts on systems and networks.

We recommend the Assistant Secretary for Information and Technology coordinate with system owners and local system management to ensure the consistent monitoring and reviewing of privileged accounts, service accounts, and accounts for individuals with access to source code repositories are performed across VA systems and platforms.

We recommend the Assistant Secretary for Information and Technology implement improved processes to ensure compliance with VA password policy and security configuration baselines on domain controllers, operating systems, databases, application, and network devices.

We recommended the Assistant Secretary for Information and Technology ensure established change control procedures are consistently followed for testing and approval of system changes for VA applications and networks.

We recommended the Assistant Secretary for Information and Technology implement and consistently enforce established procedures for preventing and detecting potential unauthorized changes across all platforms and applications in the environment.

We recommended the Assistant Secretary for Information and Technology ensure that all systems and platforms are monitored for compliance with documented VA standards for baseline configurations. Ensure that system owners consistently implement and monitor their configurations.

We recommended the Assistant Secretary for Information and Technology implement automated software management processes on all agency platforms to identify and prevent the use of unauthorized software on agency devices.

We recommended the Assistant Secretary for Information and Technology implement improved procedures for establishing, documenting, and monitoring an accurate software and logical hardware inventory for system boundaries across the enterprise.

We recommended the Assistant Secretary for Information and Technology implement improved processes for monitoring and analyzing significant system audit events for unauthorized or unusual activities across all systems and platforms in accordance with VA policy. Ensure privileged activity is monitored on all systems and applications.

We recommended the Assistant Secretary for Information and Technology enable system audit logs on all critical systems and platforms and conduct centralized reviews of security violations across the enterprise.

We recommended the Assistant Secretary for Information and Technology implement improved mechanisms to continuously identify and remediate security deficiencies on VA’s network infrastructure, database platforms, and Web application servers in accordance with established policy timeframes. If patches cannot be applied or are unavailable, other protections or mitigations should be documented and implemented to address the specific risks.

We recommended the Assistant Secretary for Information and Technology continue to implement improved segmentation controls that restrict vulnerable medical devices from unnecessary access from the general network.

We recommended the Assistant Secretary for Information and Technology implement improved processes to require system owners and management to provide adequate credentials to ensure security scans are authenticated to end devices where feasible and the subsequent vulnerabilities are remediated in a timely manner.

We recommended the Assistant Secretary for Information and Technology improve the process for tracking and resolving vulnerabilities that cannot be addressed by enterprise processes within policy timeframes. Implement mitigations for identified security deficiencies by applying security patches, system software updates, or configuration changes to reduce applicable security risks.

Establish internal control procedures to ensure recruitment, relocation, and retention incentive documentation is appropriately maintained in accordance with VA policy and guidance.

Enforce procedures to ensure Veterans Integrated Service Network human resources offices properly review recruitment, relocation, and retention incentive documentation for compliance with VA policy.

Enforce quality control checks to ensure Veterans Integrated Service Networks fulfill requirements for maintaining recruitment, relocation, and retention incentives documentation.

Establish accountability measures to ensure Veterans Integrated Service Networks’ quality control and oversight responsibilities are risk-based and fulfilled in a timely manner.

Evaluate resource requirements and establish accountability measures to ensure quality control and oversight responsibilities are risk-based and fulfilled in a timely manner.

Evaluate the retention incentive awards for the 28 employees identified in this report who received payments after the incentive period ended, terminate the incentive if it was not recertified, determine whether recoupment of funds is warranted, and take action if appropriate.

Assess retention incentive payment data to identify awards that have been paid for over one year and determine whether each has been appropriately recertified or should be terminated.

Establish oversight procedures to ensure retention incentives are reviewed annually, recertified if appropriate, or otherwise terminated to ensure payments are not continued after the expiration date.

Ensure all erroneous scenarios in the Veterans Benefits Management System for Rating special monthly compensation calculator identified in this review are corrected and certify the results to the VA Office of Inspector General.

Establish a plan to conduct additional testing of the Veterans Benefits Management System for Rating special monthly compensation calculator to ensure its accuracy.

Update the Fiduciary Program Manual to specify when a removed fiduciary should be flagged as “Do Not Appoint” and ensuring that staff understand if they are responsible for adding the flag.

Develop and provide training on updated Fiduciary Program Manual procedures on flagging barred individuals or entities as “Do Not Appoint” and include a mechanism to ensure that fiduciary hub staff have taken and understand the training.

Update the quality review process to include ensuring that fiduciaries are flagged “Do Not Appoint” when required.

Instruct the program to communicate pertinent annual funding guidance related to Pain Management, Opioid Safety, and Prescription Drug Monitoring Program initiatives before the start of the upcoming fiscal years so that Veterans Integrated Service Networks and medical facilities can adequately plan and take appropriate hiring actions needed to spend their funds.

Ensure the program communicates pertinent funding information related to Pain Management, Opioid Safety, and Prescription Drug Monitoring Program initiatives with key personnel—such as program coordinators and Veterans Integrated Service Network and medical facility leaders.

Ensure the program clarifies and defines requirements for pain management teams in the new Veterans Health Administration Directive 1151, Pain Management and Opioid Safety.

Establish means to periodically validate the status information of facilities’ pain management teams.

Require the program and the chief operating officer to assess and ensure corrective actions are taken to address each medical facility’s lack of progress in achieving compliance with the requirement to have a pain management team as mandated by the Jason Simcakoski Memorial and Promise Act.

District leaders and the Evanston, La Crosse, and Milwaukee Vet Center Directors collaborate with the support VA medical facility to determine reasons for noncompliance with staff participation on the mental health executive council, take action as indicated, and monitor compliance.

District leaders and the Evanston, Gary Area, La Crosse, and Milwaukee Vet Center Directors determine reasons for noncompliance with completing four hours of external clinical consultation for clinically complex cases per month, ensure a process is implemented, and monitor compliance.

District leaders and the Gary Area Vet Center Director determine reasons for noncompliance with Vet Center Director review of 10 percent of active client records monthly for each counselor’s caseload, ensure completion, and monitor compliance.

District leaders and the Gary Area, La Crosse, and Milwaukee Vet Center Directors determine reasons for noncompliance with employees completing select trainings in the required time frame, ensure completion, and monitor compliance.

District leaders and the Evanston, Gary Area, and Milwaukee Vet Center Directors determine reasons for noncompliance with completion of an outreach plan with all required strategic components, ensure completion, and monitor compliance.

District leaders and the La Crosse Vet Center Director determine reasons for noncompliance with monthly automated external defibrillator inspections, ensure completion, and monitor compliance.

District leaders determine reasons why the closing of the Milwaukee Vet Center resulted in multiple communication failures, and ensure all clients are notified of the new location, the Vet Center Call Center has accurate information, and websites include correct location and phone number information.

The Readjustment Counseling Service Chief Officer considers developing written guidance for vet center closure and temporary relocation processes including oversight responsibilities.

Reduce improper and unknown payments to below 10 percent for the Pension Program.

Reduce improper and unknown payments to below 10 percent for the Purchased Long-Term Services and Supports Program.

Incorporate all business-essential processes and related interfaces, as defined by product owners, during validation sessions, user acceptance testing, or equivalent procedures to accurately present system capability.

Enhance the test plan to incorporate a more robust, risk-based testing process that incorporates user-testing requirements for functional and nonfunctional business-essential processes related to interfaces.

Develop a process to confirm with affected administrative offices whether they are aware of needed changes to test environments and that they have sufficiently executed them before interface test events.

Develop a method to evaluate whether test deficiencies necessitate changes to the deployment schedule to ensure deficiencies are properly addressed before wave go-live and implement these changes.

Take corrective actions to ensure that facilities and programs remove unauthorized sensitive information from collaborative application sites.

Direct facilities and programs to standardize SharePoint administration, inventory and consolidate their SharePoint sites, and enforce the recommended architecture to better control access and content at the facility or program level.

Implement enforcement mechanisms to ensure that facilities and programs are following standardized processes to secure SharePoint and Teams sites.

Expand roles and responsibilities of facility and program information system security officers and privacy officers to include the routine review of SharePoint and Teams site permissions and content.

Implement automated tools and policies, supported with training, to enable the timely and routine detection and correction of improper sharing and unauthorized content throughout VA.

Mandate standardized training for SharePoint administrators and owners to clarify and reinforce data security requirements.

Create a job aid for claims processors on how to determine the correct effective date for PACT Act–related claims.

Remove the outdated effective date builder from the Veterans Benefits Administration’s internal job aids page.

Continue updating the Veterans Benefits Management System-Rating system’s effective date builder to add functionality that applies liberalizing laws on claims when the Veterans Benefits Administration receives an intent to file.

Update the Veterans Benefits Management System-Rating system’s effective date builder to add functionality that applies liberalizing laws on claims when a veteran’s service connection is based on a toxic exposure risk activity.

Evaluate PACT Act refresher training by monitoring the results to assess the effectiveness of the training.

Correct all processing errors on cases identified by the review team and report the results to the Office of Inspector General.

Seek the opinion of the Office of General Counsel on whether the identified potential overbillings could or should be recouped.

As a part of the annual certification process of the Capital Asset Inventory, the executive director of the Office of Asset Enterprise Management should provide guidance on underground storage tank entries to ensure these assets are recorded with consistent identifying terminology in asset identification fields and with the appropriate real property predominant use code: code 40, “storage (other than buildings).”

Ensure Veterans Integrated Service Network officials fulfill their oversight responsibilities found in Veterans Health Administration Directive 1811 requiring VA medical facilities maintain a current inventory of underground storage tanks, inclusive of all associated equipment and component levels.

Ensure the assistant under secretary for health for support updates the responsibility section in Veterans Health Administration Directive 7707 to ensure that the responsibilities of VA medical facility directors include appropriate designation of staff and training for environmental regulatory requirements.

Ensure Veterans Integrated Service Networks are fulfilling responsibilities in Veterans Health Administration Directive 1811 to ensure facility compliance with federal, state, and local codes, laws, and regulations—including monitoring and addressing underground storage tank alarms promptly to confirm a release has not occurred.

Ensure Veterans Integrated Service Networks are fulfilling responsibilities in Veterans Health Administration Directive 1811 for work order (unplanned corrective maintenance) tracking from creation through completion in the approved maintenance management system—to include underground storage tank and associated component-level equipment failures or deficiencies identified in regulatory agencies’ inspections.

Confirm VA medical facility directors and Veterans Integrated Service Network directors are fulfilling responsibilities in Veterans Health Administration Directive 7707 to ensure regulatory compliance deficiencies are promptly reviewed, corrective actions are developed, and issues are tracked through completion to satisfactorily address environmental compliance.

Confirm VA medical facility directors and Veterans Integrated Service Network directors are fulfilling their oversight responsibilities found in Veterans Health Administration Directive 7707 to ensure all required federal, state, and local regulatory agencies’ inspections of underground storage tanks are recorded in the Veterans Health Administration issue brief tracking system.

The Under Secretary for Health clarifies Veterans Integrated Service Network staffing requirements, including mandatory and discretionary positions.

The Under Secretary for Health ensures the use of the standardized Veterans Integrated Service Network core organizational chart to promote clarity of the Chief Mental Health Officer position and reporting structure.

The Under Secretary for Health considers standardization of the Veterans Integrated Service Network Chief Mental Health Officer functional statement to reflect role responsibilities.

The Under Secretary for Health ensures the alignment of the Veterans Integrated Service Network Chief Mental Health Officer performance plan with the functional statement.

The Under Secretary for Health defines the Veterans Integrated Service Network Chief Mental Health Officer role authority to enhance governance efficiency and effectiveness of mental health services.

Develop comprehensive management controls with clear roles and responsibilities at each level of the Veterans Benefits Administration to ensure effective oversight of mandatory accounts and the timely communication of any potential budgetary shortfalls.

Ensure the Office of Financial Management develops procedures to incorporate all available budgetary resources, as reported on the SF-133s, in its calculations for the status of funds reports for transparent communication to internal and external stakeholders.

Institutionalize monthly fiscal reviews between the Office of Financial Management and program offices to routinely assess performance and cost drivers that may affect the status of available funds.

Institutionalize monthly fiscal reviews between the VA Office of Budget and the Veterans Benefits Administration Office of Financial Management to routinely assess performance and cost drivers that may affect the status of available funds.

Review the Veterans Health Administration’s current methods, assumptions, and approaches used to project medical care budget needs in the annual President’s Budget to identify any gaps in the process or data limitations, and develop and implement a plan to strengthen the process.

Establish and implement a plan to review current processes and procedures for involving program offices and pertinent subject matter experts in developing the Enrollee Health Care Projection Model inputs for specific areas such as community care, staffing, pharmacy services, and prosthetics services, and formalize the expectations of their involvement in this process through guidance or protocols.

Develop and implement an approach to estimate medical care personnel needs and costs to increase the accuracy and reliability of information included in the annual President’s Budget.

Institutionalize a regular cycle of at least quarterly fiscal reviews among assistant under secretaries for health, network directors, and program offices that routinely assess key cost drivers and other areas of concern, such as staffing, community care growth, and local initiatives.

Evaluate its Veteran Self-Scheduling training and identify improvements if they are needed.

Make certain that staff who are involved in the Veteran Self-Scheduling process are trained on how to assess eligibility for the scheduling option, communicate key information to veterans on the option, and conduct appropriate consult follow-up procedures.

Ensure all guidance related to the Veteran Self-Scheduling process is clear, consistent, and disseminated to all VA medical facilities.

Establish a mechanism to effectively track and monitor each VA medical facility’s challenges with implementation of the Veteran Self-Scheduling process and then develop a plan to address reported issues.

Develop best practices and lessons learned for implementing the Veteran Self‑Scheduling process and disseminate them to all VA medical facilities.

Develop controls to ensure VA medical facility staff have the tools in place to identify instances of potential inappropriate processing or inappropriate use of Veteran Self-Scheduling consults.

Direct facilities to conduct routine reviews of Veteran Self-Scheduling consults to identify potential inappropriate processing or use of the Veteran Self-Scheduling option and notify VHA’s Office of Integrated Veteran Care of instances of inappropriate use.

Develop a plan to accurately assess whether the Veteran Self‑Scheduling process is meeting its intended goals.

Make sure the Office of Integrated Veteran Care develops contract language and/or maximum allowable rates to limit reimbursements that do not have a Medicare or VA fee schedule rate for Community Care Network claims.

Ensure the Office of Integrated Veteran Care improves oversight of healthcare claim payments to prevent, identify, and recover overpayments in a more timely manner.

Ensure the Office of Integrated Veteran Care and the Office of Acquisition, Logistics, and Construction, collaborate to extend the contracting officer’s representatives’ designated responsibilities to include monitoring of healthcare invoices.

Make sure the Office of Integrated Veteran Care considers including dental contract reimbursement language in the current and/or future contracts that is consistent with other contract healthcare reimbursement methodology to limit dental contract reimbursements, not to exceed the amount the third-party administrators pay the providers.

Make certain the Office of Procurement, Acquisition, and Logistics develops sufficient oversight and internal controls over the contract modification process to prevent program overpayments.

Require the Office of Veteran Integrated Care and the Office of Acquisition, Logistics, and Construction to collaborate to explore potential recovery of dental payments to Optum.

Ensure the Office of Integrated Veteran Care and the Office of Acquisition, Logistics, and Construction collaborate to establish oversight and internal controls for dental services provided through Community Care Network to prevent excessive reimbursements.