All Reports

The Director determines the reasons for noncompliance and ensures leaders evaluate adverse events and conduct institutional disclosures when criteria are met.

The Chief of Staff evaluates and determines any additional reasons for noncompliance and ensures service chiefs consider service-specific Ongoing Professional Practice Evaluation data when recommending licensed independent practitioners’ continued privileges.

We recommended the Assistant Secretary for Information and Technology consistently implement an improved continuous monitoring program in accordance with the NIST Risk Management Framework. Specifically, implement an independent security control assessment process to evaluate the effectiveness of security controls prior to granting authorization decisions. (This is a repeat recommendation from prior years.)

We recommended the Assistant Secretary for Information and Technology implement improved mechanisms to ensure system stewards and Information System Security Officers follow procedures for establishing, tracking, and updating Plans of Action and Milestones for all known risks and weaknesses including those identified during security control assessments. (This is a repeat recommendation from prior years.)

We recommended the Assistant Secretary for Information and Technology implement controls to ensure that system stewards and responsible officials obtain appropriate documentation prior to closing Plans of Action and Milestones. (This is a repeat recommendation from prior years.)

We recommended the Assistant Secretary for Information and Technology develop mechanisms to ensure system security plans reflect current operational environments, include an accurate status of the implementation of system security controls, and all applicable security controls are properly evaluated. (This is a repeat recommendation from prior years.)

We recommended the Assistant Secretary for Information and Technology implement improved processes for reviewing and updating key security documents such as security plans, risk assessments, and interconnection agreements on an annual basis and ensure the information accurately reflects the current environment. (This is a repeat recommendation from prior years.)

We recommended the Assistant Secretary for Information and Technology implement improved processes to ensure compliance with VA password policy and security standards on domain controls, operating systems, databases, applications, and network devices. (This is a repeat recommendation from prior years.)

We recommended the Assistant Secretary for Information and Technology implement periodic reviews to minimize access by system users with incompatible roles, permissions in excess of required functional responsibilities, and unauthorized accounts. (This is a repeat recommendation from prior years.)

We recommended the Assistant Secretary for Information and Technology enable system audit logs on all critical systems and platforms and conduct centralized reviews of security violations across the enterprise. (This is a repeat recommendation from prior years.)

We recommended the Office of Personnel Security, Human Resources, and Contract Offices implement improved processes for establishing and maintaining accurate data within VA’s authoritative system of record for background investigations. (This is a modified repeat recommendation from prior years.)

We recommended the Office of Personnel Security, Human Resources, and Contract Offices strengthen processes to ensure appropriate levels of background investigations are completed for applicable VA employees and contractors. (This is a modified repeat recommendation from prior years.)

We recommended the Assistant Secretary for Information and Technology implement more effective automated mechanisms to continuously identify and remediate security deficiencies on VA’s network infrastructure, database platforms, and web application servers. (This is a repeat recommendation from prior years.)

We recommended the Assistant Secretary for Information and Technology implement a more effective patch and vulnerability management program to address security deficiencies identified during our assessments of VA’s web applications, database platforms, network infrastructure, and workstations. (This is a repeat recommendation from prior years.)

We recommended the Assistant Secretary for Information and Technology maintain a complete and accurate security baseline configuration for all platforms and ensure all baselines are appropriately monitored for compliance with established VA security standards. (This is a repeat recommendation from prior years.)

We recommended the Assistant Secretary for Information and Technology implement improved network access controls that restrict medical devices from systems hosted on the general network. (This is a repeat recommendation from prior years.)

We recommended the Assistant Secretary for Information and Technology consolidate the security responsibilities for networks not managed by the Office of Information and Technology, under a common control for each site and ensure vulnerabilities are remediated in a timely manner. (This is a repeat recommendation from prior years.)

We recommended the Assistant Secretary for Information and Technology implement improved processes to ensure that all devices and platforms are evaluated using credentialed vulnerability assessments. (This is a repeat recommendation from prior years.)

We recommended the Acting Assistant Secretary for Information and Technology implement improved procedures to enforce standardized system development and change control processes that integrates information security throughout the life cycle of each system. (This is a repeat recommendation from prior years.)

We recommended the Assistant Secretary for Information and Technology review system boundaries, recovery priorities, system components, and system interdependencies and implement appropriate mechanisms to ensure that established system recovery objectives can be measured and met. (This is a modified repeat recommendation from prior years.)

We recommended the Assistant Secretary for Information and Technology ensure that contingency plans for all systems are updated to include critical inventory components and are tested in accordance with VA requirements. (This is a repeat recommendation from prior years.)

We recommended the Assistant Secretary for Information and Technology implement more effective agency-wide incident response procedures to ensure timely notification, reporting, updating, and resolution of computer security incidents in accordance with VA standards. (This is a repeat recommendation from prior years.)

We recommended the Assistant Secretary for Information and Technology ensure that VA’s Cybersecurity Operations Center has full access to all security incident data to facilitate an agency-wide awareness of information security events. (This is a repeat recommendation from prior years.)

We recommended the Assistant Secretary for Information and Technology implement improved safeguards to identify and prevent unauthorized vulnerability scans on VA networks. (This is a repeat recommendation from prior years.)

We recommended the Assistant Secretary for Information and Technology implement improved measures to ensure that all security controls are assessed in accordance with VA policy and that identified issues or weaknesses are adequately documented and tracked within POA&Ms. (This is a repeat recommendation from prior years.)

We recommended the Assistant Secretary for Information and Technology fully develop a comprehensive list of approved and unapproved software and implement continuous monitoring processes to prevent the use of prohibited software on agency devices. (This is a repeat recommendation from prior years.)

We recommended the Assistant Secretary for Information and Technology develop a comprehensive inventory process to identify connected hardware, software, and firmware used to support VA programs and operations. (This is a repeat recommendation from prior years.)

We recommended the Assistant Secretary for Information and Technology implement improved procedures for monitoring contractor-managed systems and services and ensure information security controls adequately protect VA sensitive systems and data. (This is a repeat recommendation from prior years.)

The Executive Director determines the reasons for noncompliance and ensures leaders conduct institutional disclosures for all applicable sentinel events.

The Executive Director evaluates and determines any additional reasons for noncompliance and ensures staff complete final peer reviews within 120 calendar days or approves a written extension request.

The Chief of Staff evaluates and determines any additional reasons for noncompliance and ensures service chiefs use Focused Professional Practice Evaluation criteria that are defined in advance and accepted by the practitioners.

The Chief of Staff evaluates and determines any additional reasons for noncompliance and ensures the Medical Executive Committee reviews professional practice evaluations for licensed independent practitioners’ privileging requests and documents the review in meeting minutes.

The Chief of Staff evaluates and determines any additional reasons for noncompliance and ensures service chiefs establish service-specific criteria for reprivileging decisions.

The Chief of Staff evaluates and determines any additional reasons for noncompliance and ensures service chiefs recommend reprivileging based, in part, on Ongoing Professional Practice Evaluations completed by practitioners with similar training and privileges.

The Charlie Norwood VA Medical Center Director ensures primary care teams adhere to Veterans Health Administration policies related to mental health screenings, consult management, and care coordination, and monitors compliance.

The Charlie Norwood VA Medical Center Director develops a process to ensure that Emergency Department staff communicate patients’ referral information from the Veterans Crisis Line to Emergency Department providers.

The Charlie Norwood VA Medical Center Director ensures that suicide prevention staff documentation is complete and accurate, and actions are taken to resolve issues identified in Veterans Crisis Line referrals prior to closure.

Establish guidance that outlines the type of documentation required to support the amounts identified in the manual journal vouchers when processing expenditure transfers.

Require medical facility staff have documented authority, through proper delegation, to make purchases.

Verify that medical facility staff segregate duties so that the same person is not both authorizing and receiving goods and services.

Make certain the purchase card holder is not the requestor or approver for the purchase.

Ensure contracting officer’s representatives know and understand their duties and responsibilities for the certification and payment of invoices.

Check vendors’ compliance with contract terms to include the comparison of invoiced amounts with the contract line-item unit costs.esponse to the pandemic and develop appropriate action plans to integrate oversight roles, responsibilities, and clear guidance into the use of supplemental funds.

Ensure that medical facility staff track the receipt of goods to make certain they are the correct quantity.

The Chief of Staff evaluates and determines any additional reasons fornoncompliance and ensures service chiefs complete Ongoing Professional PracticeEvaluations.

The VA Black Hills Health Care System Director reviews the sexual harassment policy to ensure that leaders and supervisors can identify, thoroughly investigate, and respond to sexual harassment allegations.

The VA Black Hills Health Care System Director ensures that facility policy addresses the safety and rights of patients who are both VA employees and participants in the Transitional Residence program.

The VA Black Hills Health Care System Director continues to monitor and track the identified action plan through to completion.

The VA Black Hills Health Care System Director reviews the evidence and independently determines if the state licensing board should be notified.

The Chief of Staff evaluates and determines any additional reasons for noncompliance and ensures service chiefs define Focused Professional Practice Evaluation criteria in advance using objective criteria accepted by the practitioner.

The Chief of Staff evaluates and determines any additional reasons for noncompliance and makes certain the Medical Executive Council reviews and evaluates licensed independent practitioners’ reprivileging requests and documents the review in the meeting minutes.

The Deputy Director evaluates and determines any additional reasons for noncompliance and ensures managers keep furnishings and equipment safe and in good repair.

The Under Secretary for Health evaluates provider knowledge and utilization of VA Video Connect technology, including resources such as the Digital Divide Consult, Connected Devices Support Program, and VVC Now and takes action as indicated.

The Under Secretary for Health evaluates availability of clinical and administrative support to providers initiating and completing VA Video Connect encounters and clarifies expectations and requirements to ensure access to virtual care emulates in-person encounters.

The Under Secretary for Health ensures education of providers and support staff regarding VA Video Connect scheduling processes.

The Network Director evaluates and determines additional reasons for noncompliance and submits a Comprehensive Environment of Care compliance report to the Environment of Care Committee annually.

The Network Director evaluates and determines any additional reasons for noncompliance and ensures the Emergency Management Committee conducts an annual review of the Veterans Integrated Service Network-wide strengths, weaknesses, priorities, and requirements for improvement, and documents it in writing.

Ensure medical facilities monitor resilient high-frequency radio network training and staffing levels and maintain enough trained staff to operate the resilient high-frequency radio network.

Ensure that the appropriate stakeholders know the program office responsible for the resilient high-frequency radio network and understand the roles and responsibilities for the Veterans Health Administration’s Resilient High-Frequency Radio Network program.

Finalize the Veterans Health Administration High-Frequency Radio Operations Plan.

Conduct a risk assessment and provide guidance for the placement of resilient high-frequency radio networks within facilities and any needed monitoring schedules.

Ensure sites can obtain repairs for broken or inoperable resilient high-frequency radio network equipment.

The West Palm Beach VA Healthcare System Director ensures that pulmonary providers communicate and document test results and surveillance care plans to patients.

The West Palm Beach VA Healthcare System Director ensures that pulmonary providers and staff are trained on the use of return-to-clinic orders and monitors for compliance.

The West Palm Beach VA Healthcare System Director ensures that chiropractor providers review community care notes and takes action as needed.