All Reports

Obtain an inventory of locally managed databases, perform configuration compliance scans, provide the facility with a copy of the scan results, and monitor the facility’s remediation efforts.

Implement a process to verify system owners review user account access to locally managed databases.

Implement effective system life-cycle processes to ensure network devices meet standards mandated by the VA Office of Information and Technology Configuration Control Board.

Develop and approve an authorization to operate for the special-purpose systems.

Include system personnel during the security categorization process to ensure that all necessary information types are considered when determining the security categorization for special-purpose systems.

Implement controls to ensure the accuracy of user locations supporting the Lynx Duress system.

Implement the appropriate physical security controls to restrict and monitor access to the facility, its server room, and communication closets.

Implement and monitor emergency power and uninterruptible power supplies in all communication closets.

Implement grounding equipment in all communication closets.

Implement a more effective vulnerability management program to address security deficiencies identified during the inspection. (This is a repeat recommendation from the prior inspection.)

Ensure vulnerabilities are remediated within OIT’s established time frames. (This is a repeat recommendation from the prior inspection.)

Ensure all servers and databases are part of the automated scanning process.

Implement approved baseline configurations for databases and document justifications and approvals for any deviations.

Implement more effective configuration control processes to ensure network devices maintain vendor support and receive security updates.

Implement an improved inventory process to ensure the accuracy of network ranges managed within the Enterprise Mission Assurance Support Service. (This is a repeat recommendation from the prior inspection.)

Implement an effective audit and monitoring process for all servers and databases. (This is a repeat recommendation from the prior inspection.)

Ensure that physical access logs for the data center and communication rooms are reviewed on a quarterly basis.

Consider taking appropriate steps to implement redundant distribution paths between the uninterruptible power supplies and the information technology equipment at the Hines Information Technology Center.

Implement steps to prevent the inadvertent activation of the main circuit breaker at the Hines Information Technology Center, such as installing a protective covering over the circuit breaker with an explicit warning label indicating the breaker’s function to help prevent power outages at the facility.

Implement steps to prevent the inadvertent activation of circuit breakers at all VA data centers, such as updating the physical security controls policy to require protective covers and explicit warning labels.

Update the Hines Information Technology Center information system contingency plan to help ensure the efficient restoration of data center power and critical applications in the event of a power outage.

Implement annual testing of Hines Information Technology Center contingency and restoration procedures following a power loss to ensure all stakeholders are aware of their responsibilities in accordance with revised information system contingency plan procedures.

Reduce improper and unknown payments to below 10 percent for the Pension Program. This is a repeat recommendation from the OIG’s FY 2022 report.

Reduce improper and unknown payments to below 10 percent for the Purchased Long-Term Services and Supports Program. This is a repeat recommendation from the OIG’s FY 2022 report.

We recommended the Assistant Secretary for Information and Technology consistently implement an improved continuous monitoring program in accordance with the NIST Risk Management Framework. Specifically, implement an independent security control assessment process to evaluate the effectiveness of security controls prior to granting authorization decisions. 

We recommended the Assistant Secretary for Information and Technology implement improved mechanisms to ensure system stewards and Information System Security Officers follow procedures for establishing, tracking, and updating Plans of Action and Milestones for all known risks and weaknesses including those identified during security control assessments. 

We recommended the Assistant Secretary for Information and Technology implement controls to ensure that system stewards and responsible officials obtain appropriate documentation prior to closing Plans of Action and Milestones.

We recommended the Assistant Secretary for Information and Technology develop mechanisms to ensure system security plans reflect current operational environments, include an accurate status of the implementation of system security controls, and all applicable security controls are properly evaluated.

We recommended the Assistant Secretary for Information and Technology implement improved processes for reviewing and updating key security documentation, including control assessments on a risk-based rotation or as needed. Such updates will ensure all required information is included and accurately reflects the current environment.

We recommended the Assistant Secretary for Information and Technology implement improved processes to ensure compliance with VA password policy and security standards on domain controls, operating systems, databases, applications, and network devices. 

We recommended the Assistant Secretary for Information and Technology implement periodic reviews to minimize accounts and permissions in excess of required functional responsibilities, and to remove unauthorized or unnecessary accounts.

We recommended the Assistant Secretary for Information and Technology enable system audit logs on all critical systems and platforms and conduct centralized reviews of security violations across the enterprise.

We recommended the Office of Personnel Security, Human Resources, and Contract Offices implement improved processes for establishing and maintaining accurate investigation data within VA systems used for background investigations.

We recommended the Office of Personnel Security, Human Resources, and Contract Offices strengthen processes to ensure appropriate levels of background investigations are completed for applicable VA employees and contractors.

We recommended the Assistant Secretary for Information and Technology implement more effective automated mechanisms to continuously identify and remediate security deficiencies on VA’s network infrastructure, database platforms, and web application servers.

We recommended the Assistant Secretary for Information and Technology implement improved processes for tracking and resolving vulnerabilities that cannot be addressed within policy timeframes. Implement more effective patch and vulnerability management processes to mitigate identified security deficiencies and reduce applicable security risks.

We recommended the Assistant Secretary for Information and Technology maintain a complete and accurate security baseline configuration for all platforms and ensure all baselines are appropriately monitored for compliance with established VA security standards.

We recommended the Assistant Secretary for Information and Technology implement improved controls that restrict vulnerable medical devices from unnecessary access to the general network.

We recommended the Assistant Secretary for Information and Technology enhance procedures for tracking security responsibilities for networks, devices, and components not managed by the Office of Information and Technology to ensure vulnerabilities are remediated in a timely manner.

We recommended the Assistant Secretary for Information and Technology implement improved processes to ensure that all devices and platforms are evaluated using credentialed vulnerability assessments.

We recommended the Assistant Secretary for Information and Technology implement improved procedures to enforce standardized system development and change control processes that integrates information security throughout the life cycle of each system.

We recommended the Assistant Secretary for Information and Technology implement improved procedures to ensure that system outages and disruptions are tracked to specific system boundaries and that interdependent systems are considered for the purposes of tracking and measuring against stated system recovery time objectives.

We recommended the Assistant Secretary for Information and Technology ensure contingency plans for all systems and applications are updated and tested in accordance with VA requirements.

We recommended the Assistant Secretary for Information and Technology ensure that systems and applications are adequately logged and monitored to facilitate an agency-wide awareness of information security events.

We recommended the Assistant Secretary for Information and Technology implement improved safeguards to identify and prevent unauthorized vulnerability scans on VA networks.

We recommended the Assistant Secretary for Information and Technology implement improved measures to ensure that all security controls are assessed in accordance with VA policy and that identified issues or weaknesses are adequately documented and tracked within POA&Ms.

We recommended the Assistant Secretary for Information and Technology implement improved processes to monitor for unauthorized changes to system components and the installation of prohibited software on all agency devices and platforms.

We recommended the Assistant Secretary for Information and Technology develop a comprehensive inventory process to identify connected hardware, software, and firmware used to support VA applications and operations.

We recommended the Assistant Secretary for Information and Technology implement improved procedures for monitoring contractor-managed systems and services and ensure information security controls adequately protect VA sensitive systems and data.

The Secretary of Veterans Affairs directs the assistant secretary for Human Resources and Administration/Operations, Security, and Preparedness should update Policy Notice 23-03 and Form 10017-A to address the deficiencies noted in this report, including the overly broad definitions of groups, failure to provide adequate support for high-demand skill CSIs, and lack of needs analyses for recruitment and retention.

The Secretary of Veterans Affairs designates a responsible official to review the critical skill incentives that have been paid to any member of the Senior Executive Service (SES), SES-equivalent, or other Senior Leader (including Veterans Health Administration’s medical center directors and Veterans Integrated Service Network directors and the Veterans Benefits Administration’s regional office and district directors) for the deficiencies identified in this report and to ensure compliance with all applicable statutory criteria and VA policy, and take any corrective action needed.

The Secretary of Veterans Affairs designates a responsible official to review any critical skill incentive payments based on a high-demand skills justification made to all nonexecutive groups of employees, if any, to ensure compliance with all applicable statutory criteria and VA policy, and take any corrective action needed.

In consultation with the Office of General Counsel’s Ethics Specialty Team, the Secretary of Veterans Affairs or his designee takes appropriate action to determine whether individuals involved in the decision-making process for awarding CSIs had any actual or apparent conflicts of interest and develop a process to ensure all decision-makers are free from conflicts when awarding future incentives.

The Secretary of Veterans Affairs directs the assistant secretary for Human Resources and Administration/Operations, Security, and Preparedness to revise policies regarding critical skills incentives to ensure that recommending and approving officials are accountable for their determinations that each CSI recipient meets all established criteria, and that the roles and responsibilities of a technical reviewer and human resources reviewer are clearly established.

The Secretary of Veterans Affairs delegates to a responsible official the development of a formal concurrence process to provide reasonable assurance that a senior attorney within the Office of General Counsel (with sufficient experience and expertise to consider all relevant facts and perspectives) is accountable for providing legal advice before and during the implementation of any new authority that carries the potential for significant reputational or financial harm to VA.

The Secretary of Veterans Affairs delegates to a responsible official a review of existing governance board policies to determine whether additional guidance is needed to define their role in reviewing proposals for implementing new pay authorities affecting senior executive compensation.

The Secretary of Veterans Affairs takes whatever administrative actions, if any, he deems appropriate related to personnel involved in the process for granting critical skill incentives for VA central office executives based on the findings in this report.

Formalize the executive director’s intent by requiring the submission to the OIG of a related plan and documentation of progress on implementing VA’s maintenance of an independent and updated list of contract facilities.

Comply with the requirements of the customer satisfaction survey contract to route exam comment cards directly between the survey vendor and veteran.

Develop and implement formal standard operating procedures for the contract exam facility site visits detailing roles, responsibilities, objectives, and monitoring.

Update the Medical Disability Examination Office site visit checklist to include a focus on specific ADA and OSHA criteria required by contracts with exam vendors.

Complete a standardized training plan for staff who conduct site visits at contract exam facilities to include ADA and OSHA compliance.

Ensure the Medical Disability Examination Office is conducting complaint-based contract facility inspections.

Enforce contractual requirements for vendors to conduct inspections and recertify all facilities to ensure ADA and OSHA compliance.

Review and analyze all veteran complaints related to exam facilities received through all entities and perform complaint-based site visits or create action plans, as necessary.

Make certain that the Medical Disability Examination Office develops a plan with the vendors to determine if each veteran seeking an exam requires accessibility arrangements prior to scheduling.

Implement a plan to strengthen the National Work Queue division’s monitoring of claims awaiting decision at its own location to ensure its rules are operating as intended and make adjustments as needed.

Ensure the Office of Field Operations includes the National Work Queue division’s functioning in its annual internal controls assessment and statement of assurance.

The Under Secretary for Health considers the need for a national policy establishing the inclusion of social determinants of health/health-related social needs into discharge assessment and planning.

The Under Secretary for Health considers the implementation of a standardized electronic health record template, such as the Assessing Circumstances and Offering Resources for Needs tool, that includes the assessment of social determinants of health/health-related social needs of hospitalized patients.

The Under Secretary for Health evaluates barriers to assessing social determinants of health/health-related social needs when patients are discharged from VA medical centers.

The Under Secretary for Health promotes the use of health equity tools across VA medical centers

The Under Secretary for Health promotes the establishment of partnerships of VA medical centers with community resources to address social determinants of health/health-related social needs.

The Under Secretary for Health, in conjunction with the National Oncology Program and Veterans Integrated Service Network directors, ensure facility leaders and staff are aware of the services offered to veterans diagnosed with breast cancer through the Women’s Oncology System of Excellence.

The Under Secretary for Health and National Oncology Program staff offer a range of services for patients diagnosed with breast cancer, including rehabilitative services, through the Women’s Oncology System of Excellence.

The Under Secretary for Health, Veterans Integrated Service Network directors, and facility leaders ensure staff enter data into the local cancer registry database in a timely manner.

The District Director monitors compliance with leaders’ completion of morbidity and mortality reviews for client deaths by suicide, including timeliness, as required.

The District Director identifies reasons for noncompliance with timely documentation requirements of high-risk client contacts and outcomes in the electronic record and High Risk Suicide Flag SharePoint site, ensures requirements are met, and monitors compliance.

The Readjustment Counseling Service Chief Officer ensures the High Risk Suicide Flag SharePoint site functions as intended and includes accurate data.

The District Director and zone leaders identify reasons for noncompliance, ensure Readjustment Counseling Service policy confidentiality requirements are followed when collaborating care with the support VA medical facility for shared clients at high risk for suicide, and monitor compliance across all zone vet centers.

The District Director identifies reasons for noncompliance with consultation requirements for clients who are assessed at intermediate or high suicide risk level in either acute, chronic, or both categories; ensures consultation requirements are met; and monitors compliance.

The District Director identifies reasons for noncompliance; ensures clinical staff complete safety plans for clients who are assessed at intermediate or high suicide risk level in either acute, chronic, or both categories as required; and monitors compliance across all zone vet centers.

The District Director identifies reasons for noncompliance, ensures clients are provided a copy of their completed safety plan as required, and monitors compliance across all zone vet centers.

District leaders and the Ft. Lauderdale, Ft. Myers, Gainesville, Lakeland, Naples, and San Juan Vet Center Directors, collaborate with the support VA medical facility clinical liaison to determine the reasons for noncompliance, take action as indicated, and monitor to ensure compliance with staff participation on the mental health executive council.

District leaders and the Lakeland Vet Center Director, determine reasons for noncompliance with High Risk Suicide Flag SharePoint site requirements and the tracking of continuity of care for at-risk clients, take action to ensure requirements are met, and monitor compliance.

District leaders and the Lakeland Vet Center Director determine reasons for noncompliance and ensure assignment of a liaison.

District leaders and the Lakeland Vet Center Director determine reasons for noncompliance and ensure assignment of an external clinical consultant.

District leaders and the Ft. Lauderdale, Ft. Myers, Gainesville, Naples, and San Juan Vet Center Directors determine reasons for noncompliance, ensure a process is implemented for completing and tracking four hours of external clinical consultation per month, and monitor compliance.

District leaders and the Ft. Lauderdale, Gainesville, and Lakeland Vet Center Directors determine reasons for noncompliance with monthly active counseling records, ensure chart audits are completed as required, and monitor compliance.

District leaders and the Ft. Lauderdale, Ft. Myers, Gainesville, Lakeland, and San Juan Vet Center Directors determine reasons for noncompliance, develop processes to ensure all staff complete mandatory trainings, and monitor compliance.

District leaders and the Gainesville and Lakeland Vet Center Directors determine reasons for noncompliance and ensure outreach plans are completed.

District leaders and the Ft Lauderdale, Ft. Myers, Naples, and San Juan Vet Center Directors determine reasons for noncompliance and ensure outreach plans include all required strategic components.

District leaders and the Ft. Myers, Naples, and San Juan Vet Center Directors determine reasons for noncompliance, ensure outreach activities are tailored to the cultural demographics of the vet center’s veteran service area, and monitor compliance.

District leaders and the Gainesville Vet Center Director determine reasons for noncompliance, ensure completion of fire and/or safety inspections, and monitor compliance.

District leaders and the Gainesville Vet Center Director determine reasons for noncompliance, ensure the risk and vulnerability assessment is completed by VA police or local law enforcement, and monitor compliance.

District leaders and the Gainesville and Naples Vet Center Director determine reasons for noncompliance, ensure automated external defibrillators are serviced annually, and monitor compliance.

District leaders and the Ft. Lauderdale and Naples Vet Center Directors determine reasons for noncompliance, ensure fire extinguishers are inspected monthly, and monitor compliance.

District leaders and the Ft. Myers Vet Center Director determine reasons for noncompliance, ensure automated external defibrillators are inspected monthly, and monitor compliance.

District leaders, and the Naples Vet Center Director, determine reasons for noncompliance and ensure evacuation plans are posted in a communal area.

District leaders and the Ft. Lauderdale, Ft. Myers, Lakeland, and Naples Vet Center Directors determine reasons for noncompliance, ensure completion of a current and comprehensive emergency and crisis plan, and monitor compliance.

District leaders and the Marietta, Bay County, and Savannah Vet Center Directors collaborate with the support VA medical facility clinical liaisons to determine the reasons for noncompliance, take action as indicated, and monitor to ensure compliance with staff participation on the mental health executive council.

District leaders and the Marietta and Charleston Vet Center Directors determine reasons for noncompliance, ensure a process is implemented for completing and tracking four hours of external clinical consultation per month, and monitor compliance.

District leaders and the Augusta, Johnson City, Marietta, Charleston, Bay County, and Savannah Vet Center Directors determine reasons for noncompliance, develop processes to ensure all staff complete mandatory trainings, and monitor compliance.

District leaders and the Charleston Vet Center Director determine reasons for noncompliance and ensure outreach plans are completed.

District leaders and the Augusta, Johnson City, Marietta, Bay County, and Savannah Vet Center Directors determine reasons for noncompliance and ensure outreach plans include all required strategic components.

District leaders and the Augusta, Johnson City, and Savanah Vet Center Directors determine reasons for noncompliance, ensure outreach activities are tailored to the cultural demographics of the vet center’s veteran service area, and monitor compliance.

District leaders and the Augusta Vet Center Director determine reasons for noncompliance, ensure the risk and vulnerability assessment is completed by VA police or local law enforcement, and monitor compliance.

District leaders and the Augusta Vet Center Director determine reasons for noncompliance, ensure fire extinguishers are serviced annually and monitor compliance.

District leaders and the Augusta, Johnson City, Charleston, and Bay County Vet Center Directors determine reasons for noncompliance, ensure fire extinguishers are inspected monthly, and monitor compliance.

The District Director and zone leaders, in conjunction with the Augusta Vet Center Director, determine reasons for noncompliance and ensure vet center obtains an automated external defibrillator.

District leaders and the Charleston Vet Center Director determine reasons for noncompliance, ensure automated external defibrillators are inspected monthly, and monitors compliance.

District leaders and the Charleston and Bay County Vet Center Directors determine reasons for noncompliance, ensure completion of a current and comprehensive emergency and crisis plan, and monitor compliance.

District leaders and the Charleston Vet Center Director determine reasons for noncompliance, and ensures ancillary staff have a desktop reference sheet to address mental health crisis situations.

The Under Secretary for Health reviews the criteria and processes used to identify and exclude healthcare providers removed from VA employment for violation of policy related to safe and appropriate care of veterans, and takes action as warranted.

The Under Secretary for Health reviews previous removals of healthcare providers from VA employment as required by VA Maintaining Internal Systems and Strengthening Integrated Outside Networks Act of 2018 § 108 to determine whether the reason(s) for those removals were for violation of policy related to the safe and appropriate care of veterans, and takes action as warranted.

Holds future third-party administrators accountable for operational readiness and provider network adequacy at each facility by the time the contracts are implemented.

Develops a process to make sure the third-party administrators regularly update their Community Care Network provider lists to reflect accurate provider contact information and annotate providers who are not currently accepting VA patients.

Develops a mechanism for facilities to effectively report, track, and monitor challenges with access to specialty care services; trains all relevant staff on how to use the mechanism; make sure facilities use the mechanism routinely; and then helps facilities resolve access challenges.

Develops and communicates to facilities a standard process to request and document their needs for additional providers.

Evaluates the effectiveness of the third-party administrators’ quarterly and monthly reports for assessing network adequacy and then, if needed, modifies the language in its current contracts and makes changes to the applicable contract language for future Community Care Network contracts.

Develops its own network adequacy performance reports for each facility and communicates the results to the facilities monthly.

Conducts Advanced Medical Cost Management Solution training for community care staff at each facility on evaluating network adequacy through the tool.

Routinely evaluates the third-party administrator’s network adequacy performance reports to ensure the reports are sufficiently reliable and comply with contract requirements, and then holds third-party administrators accountable for resolving identified issues.

The Under Secretary for Health ensures Veterans Health Administration prescribers establish a diagnosis based on a complete and documented assessment prior to initiation of a stimulant to treat attention deficit hyperactivity disorder.

The Under Secretary for Health ensures Veterans Health Administration prescribers assess risks and contraindications associated with stimulant prescribing.

The Under Secretary for Health evaluates the prescription drug monitoring program query adherence goal for initial stimulant prescribing and takes action as warranted.

The Under Secretary for Health evaluates the adequacy of the referral processes related to complex mental health disorders, such as attention deficit hyperactivity disorder, and takes action as warranted.

The Under Secretary for Health considers establishing policy and clinical practice guidance related to attention deficit hyperactivity disorder diagnostic assessment and treatment with a stimulant and takes action as warranted.

Develop and implement policies and system controls to ensure all programs approved for use by vocational rehabilitation counselors for Veteran Readiness and Employment participants meet the requirements of applicable laws and regulations

Train all appropriate Veteran Readiness and Employment regional office staff on manual requirement to verify the programs are approved for use before selecting participants and to verify facility codes match from authorization through enrollment.

Ensure the DALC Recreation Group’s operations fully comply with VA Handbook 5025, Part VIII, or dissolve the group if there is insufficient employee interest in its continuation.

Update VA Handbook 7002, Logistics Management Procedures Part 3, section 7, to clarify under which circumstances, if any, VA employees are permitted to request, accept, and record any incentive items provided by vendors in connection with government purchases.

Reinforce ethics and policy requirements on the acceptance and disposition of free or donated property with all Denver Logistics Center managers and staff, including distributing to staff the Office of General Counsel’s guidance dated June 30, 2023.

Reeducate DLC managers, approving officials, and purchasing agents about VA government purchase card policy requirements that government contracted sources be fully considered and given priority when making purchases.

In consultation with the Office of General Counsel, as authorized by 31 U.S.C. § 3711, determine the full magnitude of the loss from the DALC Recreation Group’s improper sale of VA property and take appropriate action to recover the losses, including any proceeds of the auctions currently within the custody or control of the DALC Recreation Group.

Consider whether any administrative action should be taken with respect to the conduct or performance of the director of the Denver Logistics Center or any other individual involved in the improper acquisition and disposition of the incentive items, and report to the OIG any actions taken involving these individuals.