Review of Alleged Unauthorized Devices and Equipment on Networks at VHA’s Southern Arizona VA Health Care System

We conducted this review to determine the merits of an anonymous hotline complaint received in July 2014 alleging that a large unauthorized network was operating at the southern Arizona VA Health Care System (SAVAHCS), in Tucson, AZ. The allegation stated that a network, isolated from the local VA campus network, contained a multitude of unauthorized biomedical devices and other improperly installed equipment. We substantiated the allegation that there were unauthorized devices on an isolated SAVAHCS network. However, VA’s Office of Information and Technology (OI&T) security personnel reviewed the networks and concluded that there was no interconnection between the isolated network and the SAVAHCS’s network infrastructure. Further, the systems hosted on the isolated network did not process sensitive patient data or personally identifiable information as defined by VA policy. At the time of our review, OI&T Region 1 assumed full configuration control of the biomedical network and authorized the network to operate in support of patient services. In light of OI&T’s actions, we made no recommendations.