All Reports

We recommended the Assistant Secretary for Information and Technology consistently implement an improved continuous monitoring program in accordance with the NIST Risk Management Framework. Specifically, regarding the independent evaluation of the effectiveness of security controls prior to granting authorization decisions. 

We recommended the Assistant Secretary for Information and Technology implement improved processes for reviewing and updating key security documentation, including Security Control Assessments and Privacy Impact Assessments as needed. Such updates will ensure all required information is included and accurately reflects the current environment, new security risks, and applicable Federal standards.

We recommended the VA Office of Personnel Security, Human Resources, and Contract Offices strengthen processes to ensure appropriate levels of background investigations are performed timely and completed for applicable VA employees and contractors. 

We recommended the Assistant Secretary for Information and Technology ensure contingency plans for all systems and applications are updated and tested in accordance with VA requirements.

We recommended the Assistant Secretary for Information and Technology implement improved procedures to ensure that system outages are resolved within stated recovery time objectives. 

We recommended the Assistant Secretary for Information and Technology ensure backups are conducted periodically and tested in accordance with established standards for VA system and application data. 

We recommended the Assistant Secretary for Information and Technology ensure system owners consistently implement processes for periodic reviews of user account access and maintain access authorization documentation. Remove unnecessary and inactive accounts on systems and networks. 

We recommended the Assistant Secretary for Information and Technology ensure system owners consistently follow termination procedures for the timely disablement of user accounts and the proper completion of termination checklists for separated personnel.

We recommended the Assistant Secretary for Information and Technology work with system owners and change implementers to improve adherence to standards and best practices across the Systems Development Lifecycle (SDLC) for testing and approval of system changes for VA systems and networks. 

We recommended the Assistant Secretary for Information and Technology work with system owners and application teams to implement and enforce standards for processes related to preventing and detecting potential unauthorized changes across all platforms and applications in the environment.

We recommended the Assistant Secretary for Information and Technology ensure that all systems and platforms are monitored for compliance with documented VA standards for baseline configurations. Ensure that system owners consistently implement and monitor their configurations. 

We recommended the Assistant Secretary for Information and Technology implement automated software management processes on all agency platforms to identify and prevent the use of unauthorized software on agency devices.

We recommended the Assistant Secretary for Information and Technology work with system owners to ensure adherence to established procedures for maintaining, documenting, and monitoring an accurate software and logical hardware inventory for system boundaries across the enterprise.

We recommended the Assistant Secretary for Information and Technology implement improved processes for monitoring and analyzing significant system audit events for unauthorized or unusual activities across all systems and platforms in accordance with VA policy. 

We recommended the Assistant Secretary for Information and Technology enable system audit logs on all critical systems and platforms and conduct centralized reviews of security violations across the enterprise.

We recommended the Assistant Secretary for Information and Technology implement improved mechanisms to continuously identify and remediate security deficiencies on VA’s network infrastructure, database platforms, and Web application servers in accordance with established policy timeframes. If patches cannot be applied or are unavailable, other protections or mitigations should be documented and implemented to address the specific risks.

We recommended the Assistant Secretary for Information and Technology continue to implement controls that restrict vulnerable medical devices from unnecessary access from the general network. 

We recommended the Assistant Secretary for Information and Technology implement improved processes to require system owners and management to provide adequate credentials to ensure security scans are authenticated to end devices where feasible and the subsequent vulnerabilities are remediated in a timely manner.

We recommended the Assistant Secretary for Information and Technology improve the process for tracking and resolving vulnerabilities that cannot be addressed by enterprise processes within policy timeframes. Implement mitigations for identified security deficiencies by applying security patches, system software updates, or configuration changes to reduce applicable security risks. Additionally, VA should enhance their process for updating baseline images to ensure aged vulnerabilities are not introduced into the environment. 

Update the appropriate manual to ensure all statutorily required VA educational benefit programs are included in active student counts.

Ensure contractor performance is measured in accordance with the contract and that a quality assurance surveillance plan is developed for future contracts for compliance surveys with clear roles and responsibilities of Veterans Benefits Administration staff and with measurable, documented surveillance procedures and outcomes.

Develop, document, and implement procedures for identifying, waiving, and assigning compliance survey workload to ensure all education and training institutions are scheduled and surveyed as required, and update the Veterans Benefits Administration Manual 22‑4 as necessary.

Evaluate the effectiveness of quality control activities for Veterans Benefits Administration and contracted compliance survey specialists and implement improved or additional controls where needed.

Ensure continued focus on collaboration and communication between Approvals, Compliance, and Liaison regions and evaluate the organization’s regional structure to ensure compliance surveys are consistently and effectively scheduled and assigned.

Ensure Approvals, Compliance, and Liaison leaders develop and continue to implement policy and procedures for using waivers for compliance surveys and develop metrics to evaluate record of compliance criteria so waivers maintain the intent of the statute.

Ensure that authorizations are reassessed when a significant change affects the security or privacy posture of an application, consistent with the requirements of VA Handbook 6500.

Reevaluate the risk determination for the Patient Advocate Tracking System‑Replacement and determine the appropriate security categorization level and system classification based on (1) the sensitive personal information maintained in the system and (2) the System Security Categorization Report.

Reevaluate whether there is a continued business need to maintain access to veterans’ medical records in the Patient Advocate Tracking System-Replacement.

Institute a process to ensure user roles are regularly reviewed for continued access and evaluate the effectiveness of the access control principle of least privilege to ensure roles for the Patient Advocate Tracking System-Replacement are correctly configured and allow access only for authorized users.

Update the Patient Advocate Tracking System-Replacement user guides and training materials.

Develop and establish guidance detailing how medical facility staff must document evidence to support their decisions when they make pharmaceutical purchases through the open market.

Ensure medical facility leaders conduct routine assessments of pharmaceutical purchases made through the open market so purchases are made in accordance with policy.

Develop a mechanism, in coordination with VHA’s purchase card program office and VA’s Office of General Counsel, that provides visibility into all pharmaceutical purchases, including purchases outside the prime vendor contract.

Require medical facility directors in Veterans Integrated Service Network 8 to ensure supply chain staff periodically review unit conversion factors in the Generic Inventory Package to ensure accurate system values and quantities are recorded and then correct any discrepancies.

Require medical facility directors in Veterans Integrated Service Network 8 to develop and implement procedures to maintain stock within the required thresholds as outlined in Veterans Health Administration Directive 1761.

Require medical facility directors in Veterans Integrated Service Network 8 to ensure supply chain staff review and update ABC classification labels on expendable supplies in accordance with Veterans Health Administration guidance and establish a process to routinely verify that labeling aligns with the official ABC classification report.

Ensure medical facility directors in Veterans Integrated Service Network 8 develop a process to ensure facility staff safeguard expendable supplies in accordance with Veterans Administration Handbook 0730.

Ensure medical facility directors in Veterans Integrated Service Network 8 develop and implement local procedures that require clinical service areas to notify supply chain staff when equipment is relocated and establish protocols to validate and update equipment location during clinical moves or room changes and ensure equipment items are properly tagged.

Require medical facility directors in Veterans Integrated Service Network 8 to enforce timely completion of reports of survey in accordance with Veterans Health Administration policy and implement oversight mechanisms to monitor the timely initiation, approval, and closure of reports.

Ensure facilities implement corrective actions to effectively address deficiencies identified during the Veterans Integrated Service Network’s quality control reviews.

Require medical facility directors in Veterans Integrated Service Network 22 to develop and implement procedures to maintain stock within the required thresholds as outlined in Veterans Health Administration Directive 1761.

Require medical facility directors in Veterans Integrated Service Network 22 to ensure supply chain staff review and update ABC classification labels on expendable supplies in accordance with Veterans Health Administration guidance and establish a process to routinely verify that labeling aligns with the official ABC classification report.

Ensure medical facility directors in Veterans Integrated Service Network 22 develop a process to ensure facility staff safeguard expendable supplies in accordance with Veterans Administration Handbook 0730.

Ensure medical facility directors in Veterans Integrated Service Network 22 develop and implement local procedures that require clinical service areas to notify supply chain staff when equipment is relocated, establish protocols to validate and update the equipment location, and ensure equipment items are properly tagged.

Require medical facility directors in Veterans Integrated Service Network 22 to ensure facilities conduct annual inventory of nonexpendable equipment.

Require medical facility directors in Veterans Integrated Service Network 22 to enforce timely completion of reports of survey in accordance with Veterans Health Administration policy and implement oversight mechanisms to monitor the timely initiation, approval, and closure of reports.

Ensure facilities implement corrective actions to effectively address deficiencies identified during the Veterans Integrated System Network’s quality control reviews.

Conduct a strategic business evaluation of the process used by VA medical facilities’ scheduling departments to determine whether alternatives could improve consult processing, scheduling efficiency, and timeliness.

Establish procedures to track and provide oversight of consults that schedulers have not acted on to schedule and prioritize processing of those consults when identified.

Establish and use agreements with other VA medical facilities to help identify and schedule direct care when local services are not available.

Assess options to improve the scheduling process and system to provide schedulers with access to community care provider appointment availability when discussing care options with wait time–eligible veterans.

Review services in the Consult Toolbox to make sure it accurately reflects available services and avoids inaccurate eligibility determinations.

Reinforce requirements for schedulers to review scheduling systems to identify the next available date for appointments and input that information in the Consult Toolbox.

Implement a process to verify that schedulers check all community care eligibility criteria for all veterans.

Emphasize to schedulers at least annually the proper methods (including the use of opt-out codes) to document when veterans opt out of community care.

Identify all relevant stakeholders and formally define roles and responsibilities for the police staffing decision tool or similar model.

Coordinate with all relevant stakeholders to address vulnerabilities with the police staffing decision tool or a similar model.

Ensure the Manpower Management Service’s standard operating procedures are followed to document formal completion of the police staffing decision tool or a similar model.

Assign accountability for disseminating the finalized police staffing decision tool or a similar model and ensuring its use.

Review and update VHA Directive 1660.07, “Medical Sharing/Affiliate National Program Office,” to delegate all required program office responsibilities for the community-based outpatient clinic contracts throughout the program’s life cycle to an appropriate headquarters-level office or collaboration of offices, as defined in VHA Directive 1217, “VHA Operating Units” and VA’s Acquisition Lifecycle Framework.

Develop and implement procedures for a headquarters-level office to monitor overall compliance with contract requirements and use the results to reassess program policies or contract requirements.

Develop a formal feedback process, such as a program life cycle review process, for contracting officers and contracting officer representatives, medical facilities, and contractors who work on community-based outpatient clinic contracts to provide lessons learned, issues encountered, and other feedback about establishing new clinics and the performance at the clinics.

Conduct an assessment of contractor compliance with all active community-based outpatient clinic contracts, then evaluate whether the community-based outpatient clinic contract performance metrics are measurable, reasonable, and attainable.

Coordinate with the Office of General Counsel to determine whether creating a separate contract line item from the operational costs for contracted community-based outpatient clinics to pay start-up costs, including construction costs, would assist in the administration of these contracts and increase competition among contractors; then update the community-based outpatient clinic performance work statement template to reflect any change made as a result of this consideration.

Assess how medical centers create and maintain the billable roster for community-based outpatient clinic contracts; based on the results, develop and implement efficient, accurate, and consistent procedures for developing and maintaining the billable rosters.

Coordinate with the VA medical centers that have VA-contracted community-based outpatient clinics to conduct a risk assessment to evaluate the responsibilities, time requirements, and qualifications of community-based outpatient clinic contracting officer representatives; then publish clear guidance or recommendations for facilities to make sure they have appropriately experienced, trained, and certified staff to oversee the performance of community-based outpatient clinic contracts.

Assess the certification levels of the CORs assigned to all CBOC contracts and make recommendations to the medical centers for assigning appropriately experienced CORs or to provide any additional training or assistance to existing CORs, if necessary.

Develop and implement procedures to require VA medical centers and contracting offices to verify that the Office of Information Technology can meet start-up requirements for new community-based outpatient clinic locations as part of the contract review process.

Review and evaluate how contracting offices rated community-based outpatient clinic contractors in the Contractor Performance Appraisal Reporting System, and if necessary, develop and disseminate additional guidance or training to contracting offices to help them appropriately rate community-based outpatient clinic contractors in accordance with the performance metrics and the broad categories in the Contractor Performance Appraisal Reporting System.

Determine whether positive and negative performance incentives should be used for community-based outpatient clinic contracts to motivate the contractors to provide high-quality health care, in accordance with FAR 37.6, FAR 16.202, and FAR 16.402-2.

a. If performance incentives are appropriate for community-based outpatient clinic contracts, ensure the Medical Sharing/Affiliate Office coordinates with the Office of General Counsel to develop and implement measurable, reasonable, and defensible positive and negative performance incentives.

b. If performance incentives are not appropriate for community-based outpatient clinic contracts, ensure the Medical Sharing/Affiliate Office and each network contracting office documents in the contract files the reasons why performance incentives are not used to the maximum extent practicable, in accordance with FAR 16.402-2 and FAR 37.6.

Develop and implement procedures to identify, evaluate, and incorporate commercial practices and contract types into the community-based outpatient clinic contract requirements templates before publishing updated versions, in accordance with 38 U.S.C. § 8153 and FAR part 10; the procedures should evaluate whether the contract payment structure for community-based outpatient clinic contracts is consistent with current commercial practices.

Implement a plan with the Office of Acquisition and Logistics Project Management Office to ensure system access is more granular and the intent of the principle of least privilege is met.

Ensure all roles and accesses, including those provided by default access, are reviewed and certified periodically as required.

Implement a permanent solution to provide supervisors and information owners with visibility of all roles and accesses, including those provided by default access, granted to users.

Confer with the Office of General Counsel regarding the potential recovery of the $4.4 million in manufacturer credits that were issued by manufacturers and retained by Pharma Logistics before the associated jobs were closed.

Contact the Office of General Counsel regarding the potential recovery of unsupported discrepancies between the total credits received and amounts disbursed.

Contact the Office of General Counsel regarding the potential recovery of unsupported return credits to manufacturers.

Ensure medical facilities establish and implement clear written Homeless Screening Clinical Reminder policies that define the roles and responsibilities of staff involved in the referral, follow-up, and monitoring processes.

Ensure medical facility staff involved in the Homeless Screening Clinical Reminder process are aware of and trained on written local policies and procedures for making referrals, conducting follow-up, and monitoring.

Develop and implement a review process to determine whether medical facility staff followed local Homeless Screening Clinical Reminder policies whenever a veteran does not receive a follow-up encounter within 30 days of a positive screening and correct any identified deficiencies.

Ensure all medical facilities have a reliable report that accurately lists veterans who screened positive and accepted referrals as well as the status of follow-up actions.

Identify all veterans using dual entitlement on VA-guaranteed joint home loans who were charged funding fees and received a retroactive disability rating that precedes their loan closing date since July 2019 when the veteran refund eligibility list was implemented, and issue required refunds.

Update systems to ensure eligible veterans using dual entitlement on joint VA-guaranteed home loans are identified for funding fee refunds and ensure that any system updates are tested to demonstrate that the entire population of eligible veterans is included.