Review of Alleged Mismanagement at VHA’s Massachusetts Veterans Epidemiology Research and Information Center

In August 2013, the Senate Committee on Veterans’ Affairs asked the Office of Inspector General to review allegations that the Massachusetts Veterans Epidemiology Research and Information Center’s (MAVERIC) security control weaknesses put veterans’ personal information and other sensitive information at risk. It was also alleged that the Boston Healthcare System (BHS) leased off-site commercial office space for MAVERIC staff the complainant considered wasteful. We substantiated the allegation that MAVERIC security control weaknesses put veterans’ personal information and other sensitive information at unnecessary risk. In December 2013, we found hard copy veterans’ personal information and unencrypted portable data storage devices unsecured in MAVERIC office space. The Veterans Health Administration’s (VHA), Office of Research Oversight (ORO), found similar issues in August 2013 when it conducted a review of BHS’ research groups. In light of the issues identified during our review and by ORO, we concluded that BHS had not taken sufficient action to safeguard the confidentiality of veteran personal information. This occurred because BHS did not establish sufficient oversight of MAVERIC physical security controls, such as ensuring secure storage of veterans’ personal information and encryption of portable storage media. We also substantiated the allegation that BHS leased off-site commercial office space, which we determined was under-utilized. VA BHS entered into a 5-year lease totaling about $938,000 without determining how much office space it needed and whether there was available VA space. As a result, we estimate VA BHS could spend about $593,000 over the 5-year lease period for under-utilized office space. We recommended the Director of Veterans Integrated Service Network 1, in conjunction with the Office of Information and Technology, improve oversight of MAVERIC physical security controls and implement a plan to maximize use of the off-site commercial space if continued need for the office space is justified. The Director of the Veterans Integrated Service Network 1 concurred with our recommendations and provided acceptable action plans.