All Reports

Review and update VHA Directive 1660.07, “Medical Sharing/Affiliate National Program Office,” to delegate all required program office responsibilities for the community-based outpatient clinic contracts throughout the program’s life cycle to an appropriate headquarters-level office or collaboration of offices, as defined in VHA Directive 1217, “VHA Operating Units” and VA’s Acquisition Lifecycle Framework.

Develop and implement procedures for a headquarters-level office to monitor overall compliance with contract requirements and use the results to reassess program policies or contract requirements.

Develop a formal feedback process, such as a program life cycle review process, for contracting officers and contracting officer representatives, medical facilities, and contractors who work on community-based outpatient clinic contracts to provide lessons learned, issues encountered, and other feedback about establishing new clinics and the performance at the clinics.

Conduct an assessment of contractor compliance with all active community-based outpatient clinic contracts, then evaluate whether the community-based outpatient clinic contract performance metrics are measurable, reasonable, and attainable.

Coordinate with the Office of General Counsel to determine whether creating a separate contract line item from the operational costs for contracted community-based outpatient clinics to pay start-up costs, including construction costs, would assist in the administration of these contracts and increase competition among contractors; then update the community-based outpatient clinic performance work statement template to reflect any change made as a result of this consideration.

Assess how medical centers create and maintain the billable roster for community-based outpatient clinic contracts; based on the results, develop and implement efficient, accurate, and consistent procedures for developing and maintaining the billable rosters.

Coordinate with the VA medical centers that have VA-contracted community-based outpatient clinics to conduct a risk assessment to evaluate the responsibilities, time requirements, and qualifications of community-based outpatient clinic contracting officer representatives; then publish clear guidance or recommendations for facilities to make sure they have appropriately experienced, trained, and certified staff to oversee the performance of community-based outpatient clinic contracts.

Assess the certification levels of the CORs assigned to all CBOC contracts and make recommendations to the medical centers for assigning appropriately experienced CORs or to provide any additional training or assistance to existing CORs, if necessary.

Develop and implement procedures to require VA medical centers and contracting offices to verify that the Office of Information Technology can meet start-up requirements for new community-based outpatient clinic locations as part of the contract review process.

Review and evaluate how contracting offices rated community-based outpatient clinic contractors in the Contractor Performance Appraisal Reporting System, and if necessary, develop and disseminate additional guidance or training to contracting offices to help them appropriately rate community-based outpatient clinic contractors in accordance with the performance metrics and the broad categories in the Contractor Performance Appraisal Reporting System.

Determine whether positive and negative performance incentives should be used for community-based outpatient clinic contracts to motivate the contractors to provide high-quality health care, in accordance with FAR 37.6, FAR 16.202, and FAR 16.402-2.

a. If performance incentives are appropriate for community-based outpatient clinic contracts, ensure the Medical Sharing/Affiliate Office coordinates with the Office of General Counsel to develop and implement measurable, reasonable, and defensible positive and negative performance incentives.

b. If performance incentives are not appropriate for community-based outpatient clinic contracts, ensure the Medical Sharing/Affiliate Office and each network contracting office documents in the contract files the reasons why performance incentives are not used to the maximum extent practicable, in accordance with FAR 16.402-2 and FAR 37.6.

Develop and implement procedures to identify, evaluate, and incorporate commercial practices and contract types into the community-based outpatient clinic contract requirements templates before publishing updated versions, in accordance with 38 U.S.C. § 8153 and FAR part 10; the procedures should evaluate whether the contract payment structure for community-based outpatient clinic contracts is consistent with current commercial practices.

Implement a plan with the Office of Acquisition and Logistics Project Management Office to ensure system access is more granular and the intent of the principle of least privilege is met.

Ensure all roles and accesses, including those provided by default access, are reviewed and certified periodically as required.

Implement a permanent solution to provide supervisors and information owners with visibility of all roles and accesses, including those provided by default access, granted to users.

Confer with the Office of General Counsel regarding the potential recovery of the $4.4 million in manufacturer credits that were issued by manufacturers and retained by Pharma Logistics before the associated jobs were closed.

Contact the Office of General Counsel regarding the potential recovery of unsupported discrepancies between the total credits received and amounts disbursed.

Contact the Office of General Counsel regarding the potential recovery of unsupported return credits to manufacturers.

Ensure medical facilities establish and implement clear written Homeless Screening Clinical Reminder policies that define the roles and responsibilities of staff involved in the referral, follow-up, and monitoring processes.

Ensure medical facility staff involved in the Homeless Screening Clinical Reminder process are aware of and trained on written local policies and procedures for making referrals, conducting follow-up, and monitoring.

Develop and implement a review process to determine whether medical facility staff followed local Homeless Screening Clinical Reminder policies whenever a veteran does not receive a follow-up encounter within 30 days of a positive screening and correct any identified deficiencies.

Ensure all medical facilities have a reliable report that accurately lists veterans who screened positive and accepted referrals as well as the status of follow-up actions.

Identify all veterans using dual entitlement on VA-guaranteed joint home loans who were charged funding fees and received a retroactive disability rating that precedes their loan closing date since July 2019 when the veteran refund eligibility list was implemented, and issue required refunds.

Update systems to ensure eligible veterans using dual entitlement on joint VA-guaranteed home loans are identified for funding fee refunds and ensure that any system updates are tested to demonstrate that the entire population of eligible veterans is included.

Veteran Readiness and Employment should coordinate with VA’s Office of General Counsel to assess the eligibility decision process and ensure all legal and regulatory requirements are accounted for and confirmed by the appropriate staff. If necessary, Veteran Readiness and Employment should update the process to conform with the general counsel’s interpretation of legal requirements.

Veteran Readiness and Employment should develop a standard documentation method for verifying eligibility periods, deferrals, extensions, and final eligibility decisions and train appropriate staff, including vocational rehabilitation counselors, on how to properly document eligibility decisions.

Veteran Readiness and Employment should develop a quality assurance review process to monitor the accuracy of eligibility decisions.

Veteran Readiness and Employment should coordinate with VA’s Office of General Counsel to assess the entitlement requirements and whether those used to confirm and document entitlement decisions are compliant with laws and regulatory requirements. If changes are needed, Veteran Readiness and Employment should update the manual and train appropriate staff accordingly.

Veteran Readiness and Employment should develop additional controls to ensure official entitlement decisions in the narrative report are documented in a manner that is clear and would allow for effective oversight from both internal and external entities, such as containing clear documentation of the assessment of employability factors and additional evidence used to substantiate the claim.

Develop a plan to ensure manual journal vouchers are justified, documented, and approved before they are entered into the Financial Management System and that they are reviewed after posting to verify accuracy and support compliance, transparency, and audit readiness.

Require ongoing training for all staff who prepare, review, or approve manual journal vouchers, including a process to ensure that new employees complete initial training and that refresher courses are provided when policies or tools are updated.

Clarify expectations for using macro-enabled journal voucher tools by defining when the standardized macro must be used; establishing a process to communicate macro tool updates and prompt the adoption of newly released versions; and providing guidance, training, and user support to promote correct and consistent application of the tools.

Define and communicate clear oversight responsibilities for Veterans Integrated Service Network financial managers by requiring routine monitoring of documentation and compliance at facilities.

Implement procedures to monitor the data used to measure productivity to ensure the data accurately reflect the complete work of clinical resource hub physicians.

Work with appropriate officials, such as Office of Primary Care and clinical resource hub leaders, to determine whether hub physicians should be subject to existing productivity measures. If so, issue clear hubs guidance requiring adherence; if not, clearly define what should be used, and issue thorough guidance on the steps hubs must take to measure physician productivity consistently.

Clarify oversight responsibilities for monitoring productivity measures, including detailed procedures and actions that should be taken when thresholds are not met.

Reassess and clarify physical inventory requirements for equipment in medical facilities to ensure they are consistent with and meet the intent of VA Directive 7002.

Ensure that facility directors require custodial officers to regularly review nonexpendable inventory to determine whether the equipment is required and take appropriate action.

Ensure medical facility directors review inventory list compliance data to identify noncompliant services and implement a process to resolve noncompliance.

Ensure the Veterans Health Administration’s Procurement and Logistics Office, in coordination with VA’s Office of Acquisition and Logistics, regularly monitors inventory compliance data to identify and communicate with noncompliant facilities to proactively address delinquent inventories.

Require medical facilities to use a standardized report of survey dashboard to centrally report all lost, stolen, or damaged items.

Require medical facility directors to review inventory compliance and establish a process to ensure noncompliant equipment—to include equipment identified in this audit—is reported as lost, stolen, or damaged within required time frames.

Reiterate through formal communication that facilities and regional Veterans Integrated Service Networks are required to fully implement and use the Strategic Equipment Planning Guide and Enterprise Equipment Request process for equipment planning and approval and develop a system to monitor compliance and verifying facilities are using the process as required.

Ensure relevant staff complete training on the Strategic Equipment Planning Guide and Enterprise Equipment Request process that explains user roles and responsibilities.

Ensure facilities define and assign Strategic Equipment Planning Guide and Enterprise Equipment Request user roles and responsibilities as applicable.

Reiterate through the formal communication advised in recommendation 1 that the Strategic Equipment Planning Guide and Enterprise Equipment Request process are required for all equipment planning and approval—and clearly define whether there are any exceptions.

Specify when and which equipment purchases require review and approval by additional subject matter experts.

Evaluate whether VA should establish an enterprise-wide governance structure for Caseflow development, consistent with VA’s initial comprehensive plan to Congress.

Develop a well-defined roadmap for the future development and implementation of Caseflow.

Enforce contract requirements through improved oversight, ensuring violations are identified and remediated.

Ensure staff involved with acquiring information and communication technology are adequately trained on federal and VA requirements for Section 508 standards.

Update VA Handbook 6221 to clearly identify roles and responsibilities related to ensuring Section 508 compliance during procurement.

Establish a way to ensure compliance documentation and market research on any information and communication technology being procured are submitted to the VA Office of 508 Compliance for approval so that the office can determine whether the technology is the most compliant under Section 508.

Collaborate with the VA Office of 508 Compliance to develop policies and procedures to ensure VA’s information and communication technology procurements comply with Section 508 requirements.

We recommended the Assistant Secretary for Information and Technology consistently implement an improved continuous monitoring program in accordance with the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF). Specifically, implement an independent security control assessment process to evaluate the effectiveness of security controls prior to granting authorization decisions.

We recommended the Assistant Secretary for Information and Technology implement improved processes for reviewing and updating key security documentation, including Security Control Assessments, Risk Assessments, and Privacy Impact Assessments as needed. Such updates will ensure all required information is included and accurately reflects the current environment, new security risks, and applicable federal standards.

We recommended the Assistant Secretary for Information and Technology implement improved processes to ensure System Security Plans reflect the status of security control implementations and risks are accurately reported to support a comprehensive risk management program across the organization.

We recommended the Assistant Secretary for Information and Technology implement improved mechanisms to ensure system owners and information system security officers follow procedures for establishing, tracking, and updating POA&Ms for all known risks and weaknesses including those identified during security control and other assessments.

We recommended the Assistant Secretary for Information and Technology implement measures to ensure that system stewards and other officials responsible for system level POA&Ms are closing items with relevant support that shows sufficient remediation of the identified weakness.

We recommended the VA Office of Personnel Security, Human Resources, and Contract Offices strengthen processes to ensure appropriate levels of background investigations are performed timely and completed for applicable VA employees and contractors.

We recommended the Office of Personnel Security, Human Resources, and Contract Offices implement improved processes for establishing and maintaining accurate investigation data within VA systems used for background investigations.

We recommended the Assistant Secretary for Information and Technology ensure contingency plans for all systems and applications are updated and tested in accordance with VA requirements.

We recommended the Assistant Secretary for Information and Technology implement improved procedures to ensure that system outages are resolved within stated recovery time objectives.

We recommended the Assistant Secretary for Information and Technology ensure system owners consistently implement processes for periodic reviews of user account access. Remove unnecessary and inactive accounts on systems and networks.

We recommend the Assistant Secretary for Information and Technology coordinate with system owners and local system management to ensure the consistent monitoring and reviewing of privileged accounts, service accounts, and accounts for individuals with access to source code repositories are performed across VA systems and platforms.

We recommend the Assistant Secretary for Information and Technology implement improved processes to ensure compliance with VA password policy and security configuration baselines on domain controllers, operating systems, databases, application, and network devices.

We recommended the Assistant Secretary for Information and Technology ensure established change control procedures are consistently followed for testing and approval of system changes for VA applications and networks.

We recommended the Assistant Secretary for Information and Technology implement and consistently enforce established procedures for preventing and detecting potential unauthorized changes across all platforms and applications in the environment.

We recommended the Assistant Secretary for Information and Technology ensure that all systems and platforms are monitored for compliance with documented VA standards for baseline configurations. Ensure that system owners consistently implement and monitor their configurations.

We recommended the Assistant Secretary for Information and Technology implement automated software management processes on all agency platforms to identify and prevent the use of unauthorized software on agency devices.

We recommended the Assistant Secretary for Information and Technology implement improved procedures for establishing, documenting, and monitoring an accurate software and logical hardware inventory for system boundaries across the enterprise.

We recommended the Assistant Secretary for Information and Technology implement improved processes for monitoring and analyzing significant system audit events for unauthorized or unusual activities across all systems and platforms in accordance with VA policy. Ensure privileged activity is monitored on all systems and applications.

We recommended the Assistant Secretary for Information and Technology enable system audit logs on all critical systems and platforms and conduct centralized reviews of security violations across the enterprise.

We recommended the Assistant Secretary for Information and Technology implement improved mechanisms to continuously identify and remediate security deficiencies on VA’s network infrastructure, database platforms, and Web application servers in accordance with established policy timeframes. If patches cannot be applied or are unavailable, other protections or mitigations should be documented and implemented to address the specific risks.

We recommended the Assistant Secretary for Information and Technology continue to implement improved segmentation controls that restrict vulnerable medical devices from unnecessary access from the general network.

We recommended the Assistant Secretary for Information and Technology implement improved processes to require system owners and management to provide adequate credentials to ensure security scans are authenticated to end devices where feasible and the subsequent vulnerabilities are remediated in a timely manner.

We recommended the Assistant Secretary for Information and Technology improve the process for tracking and resolving vulnerabilities that cannot be addressed by enterprise processes within policy timeframes. Implement mitigations for identified security deficiencies by applying security patches, system software updates, or configuration changes to reduce applicable security risks.

Establish internal control procedures to ensure recruitment, relocation, and retention incentive documentation is appropriately maintained in accordance with VA policy and guidance.

Enforce procedures to ensure Veterans Integrated Service Network human resources offices properly review recruitment, relocation, and retention incentive documentation for compliance with VA policy.

Enforce quality control checks to ensure Veterans Integrated Service Networks fulfill requirements for maintaining recruitment, relocation, and retention incentives documentation.

Establish accountability measures to ensure Veterans Integrated Service Networks’ quality control and oversight responsibilities are risk-based and fulfilled in a timely manner.

Evaluate resource requirements and establish accountability measures to ensure quality control and oversight responsibilities are risk-based and fulfilled in a timely manner.

Evaluate the retention incentive awards for the 28 employees identified in this report who received payments after the incentive period ended, terminate the incentive if it was not recertified, determine whether recoupment of funds is warranted, and take action if appropriate.

Assess retention incentive payment data to identify awards that have been paid for over one year and determine whether each has been appropriately recertified or should be terminated.

Establish oversight procedures to ensure retention incentives are reviewed annually, recertified if appropriate, or otherwise terminated to ensure payments are not continued after the expiration date.

Instruct the program to communicate pertinent annual funding guidance related to Pain Management, Opioid Safety, and Prescription Drug Monitoring Program initiatives before the start of the upcoming fiscal years so that Veterans Integrated Service Networks and medical facilities can adequately plan and take appropriate hiring actions needed to spend their funds.

Ensure the program communicates pertinent funding information related to Pain Management, Opioid Safety, and Prescription Drug Monitoring Program initiatives with key personnel—such as program coordinators and Veterans Integrated Service Network and medical facility leaders.

Ensure the program clarifies and defines requirements for pain management teams in the new Veterans Health Administration Directive 1151, Pain Management and Opioid Safety.

Establish means to periodically validate the status information of facilities’ pain management teams.

Require the program and the chief operating officer to assess and ensure corrective actions are taken to address each medical facility’s lack of progress in achieving compliance with the requirement to have a pain management team as mandated by the Jason Simcakoski Memorial and Promise Act.

Incorporate all business-essential processes and related interfaces, as defined by product owners, during validation sessions, user acceptance testing, or equivalent procedures to accurately present system capability.

Enhance the test plan to incorporate a more robust, risk-based testing process that incorporates user-testing requirements for functional and nonfunctional business-essential processes related to interfaces.

Develop a process to confirm with affected administrative offices whether they are aware of needed changes to test environments and that they have sufficiently executed them before interface test events.

Develop a method to evaluate whether test deficiencies necessitate changes to the deployment schedule to ensure deficiencies are properly addressed before wave go-live and implement these changes.

Seek the opinion of the Office of General Counsel on whether the identified potential overbillings could or should be recouped.