All Reports

As a part of the annual certification process of the Capital Asset Inventory, the executive director of the Office of Asset Enterprise Management should provide guidance on underground storage tank entries to ensure these assets are recorded with consistent identifying terminology in asset identification fields and with the appropriate real property predominant use code: code 40, “storage (other than buildings).”

Ensure Veterans Integrated Service Network officials fulfill their oversight responsibilities found in Veterans Health Administration Directive 1811 requiring VA medical facilities maintain a current inventory of underground storage tanks, inclusive of all associated equipment and component levels.

Ensure the assistant under secretary for health for support updates the responsibility section in Veterans Health Administration Directive 7707 to ensure that the responsibilities of VA medical facility directors include appropriate designation of staff and training for environmental regulatory requirements.

Ensure Veterans Integrated Service Networks are fulfilling responsibilities in Veterans Health Administration Directive 1811 to ensure facility compliance with federal, state, and local codes, laws, and regulations—including monitoring and addressing underground storage tank alarms promptly to confirm a release has not occurred.

Ensure Veterans Integrated Service Networks are fulfilling responsibilities in Veterans Health Administration Directive 1811 for work order (unplanned corrective maintenance) tracking from creation through completion in the approved maintenance management system—to include underground storage tank and associated component-level equipment failures or deficiencies identified in regulatory agencies’ inspections.

Confirm VA medical facility directors and Veterans Integrated Service Network directors are fulfilling responsibilities in Veterans Health Administration Directive 7707 to ensure regulatory compliance deficiencies are promptly reviewed, corrective actions are developed, and issues are tracked through completion to satisfactorily address environmental compliance.

Confirm VA medical facility directors and Veterans Integrated Service Network directors are fulfilling their oversight responsibilities found in Veterans Health Administration Directive 7707 to ensure all required federal, state, and local regulatory agencies’ inspections of underground storage tanks are recorded in the Veterans Health Administration issue brief tracking system.

Make sure the Office of Integrated Veteran Care develops contract language and/or maximum allowable rates to limit reimbursements that do not have a Medicare or VA fee schedule rate for Community Care Network claims.

Ensure the Office of Integrated Veteran Care improves oversight of healthcare claim payments to prevent, identify, and recover overpayments in a more timely manner.

Ensure the Office of Integrated Veteran Care and the Office of Acquisition, Logistics, and Construction, collaborate to extend the contracting officer’s representatives’ designated responsibilities to include monitoring of healthcare invoices.

Make sure the Office of Integrated Veteran Care considers including dental contract reimbursement language in the current and/or future contracts that is consistent with other contract healthcare reimbursement methodology to limit dental contract reimbursements, not to exceed the amount the third-party administrators pay the providers.

Make certain the Office of Procurement, Acquisition, and Logistics develops sufficient oversight and internal controls over the contract modification process to prevent program overpayments.

Require the Office of Veteran Integrated Care and the Office of Acquisition, Logistics, and Construction to collaborate to explore potential recovery of dental payments to Optum.

Ensure the Office of Integrated Veteran Care and the Office of Acquisition, Logistics, and Construction collaborate to establish oversight and internal controls for dental services provided through Community Care Network to prevent excessive reimbursements.

Execute the compliance plan for the Veterans Benefits Administration’s personnel suitability program.

Ensure the Veteran Benefits Administration’s personnel suitability program oversight verifies background investigations are initiated and adjudicated within prescribed timelines and that documentation is filed as required.

Establish a plan to ensure robust oversight of the National Cemetery Administration’s personnel suitability program that includes verifying background investigations are initiated and adjudicated within prescribed timelines and that documentation is filed as required.

Evaluate resource requirements for the personnel suitability program to ensure that all personnel suitability requirements are being met.

Establish and implement guidance for quality assurance measures over the data used to develop and justify the ambulatory care budget estimate.

Ensure the deputy under secretary for health provides oversight and holds the Office of Finance accountable for developing, documenting, and implementing standard operating procedures to include defining roles and responsibilities and requirements for oversight and quality assurance for development of the ambulatory care budget estimate.

Implement the Veterans Health Administration Data Governance Council, to include developing policies and processes for data management across the Veterans Health Administration.

Ensure the Veterans Health Administration Data Governance Council identifies authoritative data sources and nominates data stewards for approval by the VA Data Governance Council.

Assess electronic health record major performance incident data needs and contractually commit to real-time data sharing that will provide greater awareness of system operations.

Develop a formal procedure for verifying performance metrics and associated credits to ensure the department receives the remedies it is due under the contract.

Update the process for prioritizing major performance incidents to ensure that notification and resolution occur in a consistent manner.

Develop effective notification and resolution metrics that consistently capture results for all major performance incidents, regardless of the owner, and enforce them.

Identify the information needed in post-resolution reports, such as corrective and preventative actions, and require the contractor to consistently collect, verify, and report that information as a contract deliverable.

Develop a plan to ensure all clinicians are familiar with the national downtime procedures.

Identify the appropriate backup system and develop a training strategy to ensure clinicians can use the system during downtime.

Assess facilities’ patient safety reports identified during this audit to determine if additional actions need to be taken and, if so, provide an action plan.

Develop a mechanism to better identify major performance incidents and negative patient outcomes and provide a plan to prioritize and address their causes.

Reevaluate the risk determination for the Veterans Health Administration Geographic Information System and determine if the system should be set to a security categorization level of “moderate” based on the personally identifiable information and other sensitive data maintained in the system.

Ensure the Data Breach Response Service director instructs staff associated with the incident response process that each security and privacy incident that occurs must be captured on a separate Privacy Security Events Tracking System ticket, confirms document investigation details are accurate, and reassesses whether the security incidents were a breach.

Request that the contractor perform a self-audit of local VA claims.

Verify that the contractor has completed the process of refunding local VA claims.

Track facilities’ supply chain personnel vacancies as part of the quality control reviews and take appropriate action.

Develop guidelines that define when facility supply chain management problems require additional interventions and then routinely identify them for network director action.

Ensure facility and network directors work with the Procurement and Logistics Office on a plan to identify resources and milestones to resolve identified supply chain management problems for identified facilities.

Direct the program office to develop a process to provide resources when needed to help networks and facilities resolve persistent supply chain management deficiencies, including those identified in this report.

Continue Procurement and Logistics Office efforts to automate tracking that will accurately capture and monitor all quality control review results, corrective action plans, and implementation of those plans.

Update the Procurement and Logistics Office audits of the quality control program to apply risk‑based sampling, evaluate action plan sufficiency and implementation, and use the results to continuously improve quality control review guidance and requirements.

Establish a mechanism to monitor progress of the Digital GI Bill platform implementation under the renegotiated contract to avoid additional costs and delays.

Communicate regularly with the Digital GI Bill platform contractor to ensure that the project’s integrated master schedule or other master scheduling plan is consistently updated to reflect all schedule changes for external dependencies.

Develop strategies to address critical path failures to provide a clear timeline of further implementation activities.

Require the Office of Integrated Veteran Care and Pharmacy Benefits Management Services to improve community provider compliance when prescribing special-authorization drugs and being responsive to VA pharmacy inquiries. This should include consideration of electronic system capabilities to attach medical justifications, allow community providers to have real-time access to VA’s formulary when prescribing drugs, and enable two-way communication between community providers and VA pharmacists electronically.

Task the Office of Integrated Veteran Care to train community providers on the VA formulary and implement a process to improve tracking of training completion and community providers’ compliance with VA guidance on submitting prescriptions for special-authorization drugs.

Direct Pharmacy Benefits Management Services to update its dashboard to more accurately capture special-authorization drug request processing times and provide the Office of Integrated Veteran Care access to this information for contract management purposes.

Instruct Pharmacy Benefits Management Services to require that VA pharmacy personnel document community care prescriptions for special-authorization drugs in the veteran’s medical record (in consults when applicable or medical notes) when the pharmacy receives the prescription and make clear that the 96-hour processing time is a requirement for these types of drug requests.

Require Pharmacy Benefits Management Services to routinely remind pharmacists that they are responsible for reporting a community provider to the medical facility’s community care office when the provider does not comply with VA documentation requirements for special-authorization drug requests.

Charge facility community care offices to work with pharmacy personnel to report when they receive information from VA pharmacists that community providers did not comply with VA’s documentation requirements for special-authorization drugs. Reporting mechanisms can include submitting Potential Quality Issue Referral reports or Health Care Quality Concern reports to third-party administrators.

Direct Pharmacy Benefits Management Services to standardize requirements for how VA pharmacists code drug requests from community providers in the electronic system that were canceled, rejected, or removed to help VHA determine if corrective actions need to be taken on processes, contract terms, or guidance.

Ensure all community dentists who provide dental care to veteran patients are notified and periodically reminded of the preauthorization requirements for any changes to treatment plans.

Conduct expanded postpayment reviews to identify and recover payments for unauthorized dental procedures.

Monitor VA dentists to make sure they include required dental procedure codes, not only general descriptions or Standardized Episodes of Care, on referrals to identify the procedures community dentists are authorized to perform.

Review the current contract language and determine if there is a need to clarify the third-party administrators’ claims adjudication responsibilities in its contracts to include the identification of unauthorized dental procedures and adjudication of possible denials of payment or implement controls within VA that will perform this adjudication function for dental claims.

Enable the Office of Finance’s automated payment system to deny payment for community dental services if the procedure codes on the dental claims do not fall within the Standardized Episodes of Care on the referral.

Implement controls to allow for the capability to identify and monitor potential scheduling delays and to ensure family preferences are being met at national cemeteries.

Ensure facility staff place all orders for eligible items through the Medical/Surgical Prime Vendor program, including those that are identified as on back order.

Implement tracking mechanisms for back orders to assist the facilities in not obtaining excess supplies.

Ensure that logistics staff receive training and use the Prime Vendor Conversion and Recommendation Tool to identify commonly purchased open market items and convert those items to Medical/Surgical Prime Vendor purchases.

Identify and implement an efficient way to transfer product list updates to the inventory ordering system.

In collaboration with the Strategic Acquisition Center, identify a VA-owned system for staff to check product information, such as availability and pricing, and ensure applicable facility staff are aware of this location.

Implement a standardized, routine review of open market purchases.

Ensure that reporting tools are effective and consistently applied, and that reported issues are resolved.

Ensure that logistics staff receive relevant Medical/Surgical Prime Vendor program guidance and training.

Ensure the product list includes items that facilities need and regularly purchase so the Veterans Health Administration can expand the savings and benefits the Medical/Surgical Prime Vendor program offers.

We recommended the Assistant Secretary for Information and Technology consistently implement an improved continuous monitoring program in accordance with the NIST Risk Management Framework. Specifically, implement an independent security control assessment process to evaluate the effectiveness of security controls prior to granting authorization decisions. 

We recommended the Assistant Secretary for Information and Technology implement improved mechanisms to ensure system stewards and Information System Security Officers follow procedures for establishing, tracking, and updating Plans of Action and Milestones for all known risks and weaknesses including those identified during security control assessments. 

We recommended the Assistant Secretary for Information and Technology implement controls to ensure that system stewards and responsible officials obtain appropriate documentation prior to closing Plans of Action and Milestones.

We recommended the Assistant Secretary for Information and Technology develop mechanisms to ensure system security plans reflect current operational environments, include an accurate status of the implementation of system security controls, and all applicable security controls are properly evaluated.

We recommended the Assistant Secretary for Information and Technology implement improved processes for reviewing and updating key security documentation, including control assessments on a risk-based rotation or as needed. Such updates will ensure all required information is included and accurately reflects the current environment.

We recommended the Assistant Secretary for Information and Technology implement improved processes to ensure compliance with VA password policy and security standards on domain controls, operating systems, databases, applications, and network devices. 

We recommended the Assistant Secretary for Information and Technology implement periodic reviews to minimize accounts and permissions in excess of required functional responsibilities, and to remove unauthorized or unnecessary accounts.

We recommended the Assistant Secretary for Information and Technology enable system audit logs on all critical systems and platforms and conduct centralized reviews of security violations across the enterprise.

We recommended the Office of Personnel Security, Human Resources, and Contract Offices implement improved processes for establishing and maintaining accurate investigation data within VA systems used for background investigations.

We recommended the Office of Personnel Security, Human Resources, and Contract Offices strengthen processes to ensure appropriate levels of background investigations are completed for applicable VA employees and contractors.

We recommended the Assistant Secretary for Information and Technology implement more effective automated mechanisms to continuously identify and remediate security deficiencies on VA’s network infrastructure, database platforms, and web application servers.

We recommended the Assistant Secretary for Information and Technology implement improved processes for tracking and resolving vulnerabilities that cannot be addressed within policy timeframes. Implement more effective patch and vulnerability management processes to mitigate identified security deficiencies and reduce applicable security risks.

We recommended the Assistant Secretary for Information and Technology maintain a complete and accurate security baseline configuration for all platforms and ensure all baselines are appropriately monitored for compliance with established VA security standards.

We recommended the Assistant Secretary for Information and Technology implement improved controls that restrict vulnerable medical devices from unnecessary access to the general network.

We recommended the Assistant Secretary for Information and Technology enhance procedures for tracking security responsibilities for networks, devices, and components not managed by the Office of Information and Technology to ensure vulnerabilities are remediated in a timely manner.

We recommended the Assistant Secretary for Information and Technology implement improved processes to ensure that all devices and platforms are evaluated using credentialed vulnerability assessments.

We recommended the Assistant Secretary for Information and Technology implement improved procedures to enforce standardized system development and change control processes that integrates information security throughout the life cycle of each system.

We recommended the Assistant Secretary for Information and Technology implement improved procedures to ensure that system outages and disruptions are tracked to specific system boundaries and that interdependent systems are considered for the purposes of tracking and measuring against stated system recovery time objectives.

We recommended the Assistant Secretary for Information and Technology ensure contingency plans for all systems and applications are updated and tested in accordance with VA requirements.

We recommended the Assistant Secretary for Information and Technology ensure that systems and applications are adequately logged and monitored to facilitate an agency-wide awareness of information security events.

We recommended the Assistant Secretary for Information and Technology implement improved safeguards to identify and prevent unauthorized vulnerability scans on VA networks.

We recommended the Assistant Secretary for Information and Technology implement improved measures to ensure that all security controls are assessed in accordance with VA policy and that identified issues or weaknesses are adequately documented and tracked within POA&Ms.

We recommended the Assistant Secretary for Information and Technology implement improved processes to monitor for unauthorized changes to system components and the installation of prohibited software on all agency devices and platforms.

We recommended the Assistant Secretary for Information and Technology develop a comprehensive inventory process to identify connected hardware, software, and firmware used to support VA applications and operations.

We recommended the Assistant Secretary for Information and Technology implement improved procedures for monitoring contractor-managed systems and services and ensure information security controls adequately protect VA sensitive systems and data.

Holds future third-party administrators accountable for operational readiness and provider network adequacy at each facility by the time the contracts are implemented.

Develops a process to make sure the third-party administrators regularly update their Community Care Network provider lists to reflect accurate provider contact information and annotate providers who are not currently accepting VA patients.

Develops a mechanism for facilities to effectively report, track, and monitor challenges with access to specialty care services; trains all relevant staff on how to use the mechanism; make sure facilities use the mechanism routinely; and then helps facilities resolve access challenges.

Develops and communicates to facilities a standard process to request and document their needs for additional providers.

Evaluates the effectiveness of the third-party administrators’ quarterly and monthly reports for assessing network adequacy and then, if needed, modifies the language in its current contracts and makes changes to the applicable contract language for future Community Care Network contracts.

Develops its own network adequacy performance reports for each facility and communicates the results to the facilities monthly.

Conducts Advanced Medical Cost Management Solution training for community care staff at each facility on evaluating network adequacy through the tool.

Routinely evaluates the third-party administrator’s network adequacy performance reports to ensure the reports are sufficiently reliable and comply with contract requirements, and then holds third-party administrators accountable for resolving identified issues.

Mediate the two offices’ collaboration to develop and publish updates to the personnel security policies and procedures for vetting contractor employees to include appropriate roles and responsibilities; standard contract language to communicate the requirements for vetting contractor employees, including whether a fingerprint check or background investigation is required, that can be used across the department; and a requirement that the VA organization requesting a contract provide the position designation record in the acquisition package submitted to the contracting office.

Perform and document compliance inspections of the procedures for vetting contractor employees and the issuance of VA identification credentials at medical facilities supported by Network Contracting Office 23, including the St. Cloud VA Medical Center.

Update and publish the Veterans Affairs Acquisition Regulation and Veterans Affairs Acquisition Manual to direct the department’s acquisition professionals to the correct guidance for vetting contractor employees, which should include VA’s personnel security and suitability program policy.

Update and publish or rescind Acquisition Policy Flash 16-13, “Use of VA Handbook 6500.6, Appendix A, Checklist for Information Security in VA Service Acquisitions,” to ensure VA acquisition professionals understand that VA Handbook 6500.6 is not the only personnel security policy they must comply with.

Update and publish VA Handbook 6500.6, Contract Security, in collaboration with the Office of Acquisition, Logistics, and Construction and the Office of Human Resources and Administration/Operations, Security, and Preparedness, including retitling it to better correspond to its content and removing any personnel security steps that should only be discussed in VA personnel security and suitability program policies.

Review the actions of the officials responsible for planning, awarding, and administering contract 36C26320A0021, which included vetting procedures that did not comply with federal or VA policies, and take administrative action if appropriate.

Develop and implement a strategy with milestones for identifying all VA websites, confirm their inclusion in VA’s Web Registry as the current system designated by policy, and certify the accuracy of entries annually or as changes occur.

Establish a mechanism for web communication offices across VA to enforce the implementation of VA Handbook 6102 related to Section 508 compliance.

Coordinate with VA under secretaries and other assistant secretaries to ensure system owners are educated on VA Directive 6221 and its accompanying handbook requirements to request accessibility audits.

Institute a mechanism to ensure information technology system accessibility designations are accurate in the VA Systems Inventory.

Update, recertify, and republish VA Directives 6221 (accessible information and communications technology) and 6404 (systems inventory).

Update, recertify, and publish VA Directive 6515 (use of web-based collaboration technologies).

Develop specific policy and procedures to ensure the contractor’s investment grade audit, which includes the contractor’s energy baseline and cost savings estimates, are witnessed and validated per Federal Energy Management Program guidelines.

Publish criteria for payments for energy savings performance contracts to ensure compliance with federal law and Department of Energy Federal Energy Management Program guidance.

Develop procedures to ensure contracting officer’s representatives or other contracting officer designees have independently witnessed and validated the contractor’s energy baseline and savings estimates prior to negotiating energy savings performance contracts’ guaranteed savings amounts.

Develop oversight procedures to ensure documentation that demonstrates the contractor’s energy baseline and energy savings estimates were witnessed and validated is maintained in the official contracting records.

The executive director of VA’s Office of Construction and Facilities Management should confirm seismic evaluations are done for all critical and essential buildings in high and very high seismic zones immediately to ensure they meet life, safety, and occupancy performance standards

The executive director of the Office of Construction and Facilities Management should review the Capital Asset Inventory and work with Veterans Health Administration Office of Capital Asset Management, Veterans Integrated Service Network capital asset managers, and VA medical facility engineers to update and correct inaccurate seismic data in the Capital Asset Inventory.

The executive director of the Office of Construction and Facilities Management should submit change requests to the Capital Asset Inventory so that critical and essential designations are visible to medical center engineers and Veterans Integrated Service Network capital asset managers.

The executive director of the Office of Asset Enterprise Management should ensure facilities and Veterans Integrated Service Networks review critical and essential designations as part of their annual certifications of the Capital Asset Inventory.