All Reports

We recommended the Assistant Secretary for Information and Technology consistently implement an improved continuous monitoring program in accordance with the NIST Risk Management Framework. Specifically, regarding the independent evaluation of the effectiveness of security controls prior to granting authorization decisions. 

We recommended the Assistant Secretary for Information and Technology implement improved processes for reviewing and updating key security documentation, including Security Control Assessments and Privacy Impact Assessments as needed. Such updates will ensure all required information is included and accurately reflects the current environment, new security risks, and applicable Federal standards.

We recommended the VA Office of Personnel Security, Human Resources, and Contract Offices strengthen processes to ensure appropriate levels of background investigations are performed timely and completed for applicable VA employees and contractors. 

We recommended the Assistant Secretary for Information and Technology ensure contingency plans for all systems and applications are updated and tested in accordance with VA requirements.

We recommended the Assistant Secretary for Information and Technology implement improved procedures to ensure that system outages are resolved within stated recovery time objectives. 

We recommended the Assistant Secretary for Information and Technology ensure backups are conducted periodically and tested in accordance with established standards for VA system and application data. 

We recommended the Assistant Secretary for Information and Technology ensure system owners consistently implement processes for periodic reviews of user account access and maintain access authorization documentation. Remove unnecessary and inactive accounts on systems and networks. 

We recommended the Assistant Secretary for Information and Technology ensure system owners consistently follow termination procedures for the timely disablement of user accounts and the proper completion of termination checklists for separated personnel.

We recommended the Assistant Secretary for Information and Technology work with system owners and change implementers to improve adherence to standards and best practices across the Systems Development Lifecycle (SDLC) for testing and approval of system changes for VA systems and networks. 

We recommended the Assistant Secretary for Information and Technology work with system owners and application teams to implement and enforce standards for processes related to preventing and detecting potential unauthorized changes across all platforms and applications in the environment.

We recommended the Assistant Secretary for Information and Technology ensure that all systems and platforms are monitored for compliance with documented VA standards for baseline configurations. Ensure that system owners consistently implement and monitor their configurations. 

We recommended the Assistant Secretary for Information and Technology implement automated software management processes on all agency platforms to identify and prevent the use of unauthorized software on agency devices.

We recommended the Assistant Secretary for Information and Technology work with system owners to ensure adherence to established procedures for maintaining, documenting, and monitoring an accurate software and logical hardware inventory for system boundaries across the enterprise.

We recommended the Assistant Secretary for Information and Technology implement improved processes for monitoring and analyzing significant system audit events for unauthorized or unusual activities across all systems and platforms in accordance with VA policy. 

We recommended the Assistant Secretary for Information and Technology enable system audit logs on all critical systems and platforms and conduct centralized reviews of security violations across the enterprise.

We recommended the Assistant Secretary for Information and Technology implement improved mechanisms to continuously identify and remediate security deficiencies on VA’s network infrastructure, database platforms, and Web application servers in accordance with established policy timeframes. If patches cannot be applied or are unavailable, other protections or mitigations should be documented and implemented to address the specific risks.

We recommended the Assistant Secretary for Information and Technology continue to implement controls that restrict vulnerable medical devices from unnecessary access from the general network. 

We recommended the Assistant Secretary for Information and Technology implement improved processes to require system owners and management to provide adequate credentials to ensure security scans are authenticated to end devices where feasible and the subsequent vulnerabilities are remediated in a timely manner.

We recommended the Assistant Secretary for Information and Technology improve the process for tracking and resolving vulnerabilities that cannot be addressed by enterprise processes within policy timeframes. Implement mitigations for identified security deficiencies by applying security patches, system software updates, or configuration changes to reduce applicable security risks. Additionally, VA should enhance their process for updating baseline images to ensure aged vulnerabilities are not introduced into the environment. 

Update the appropriate manual to ensure all statutorily required VA educational benefit programs are included in active student counts.

Ensure contractor performance is measured in accordance with the contract and that a quality assurance surveillance plan is developed for future contracts for compliance surveys with clear roles and responsibilities of Veterans Benefits Administration staff and with measurable, documented surveillance procedures and outcomes.

Develop, document, and implement procedures for identifying, waiving, and assigning compliance survey workload to ensure all education and training institutions are scheduled and surveyed as required, and update the Veterans Benefits Administration Manual 22‑4 as necessary.

Evaluate the effectiveness of quality control activities for Veterans Benefits Administration and contracted compliance survey specialists and implement improved or additional controls where needed.

Ensure continued focus on collaboration and communication between Approvals, Compliance, and Liaison regions and evaluate the organization’s regional structure to ensure compliance surveys are consistently and effectively scheduled and assigned.

Ensure Approvals, Compliance, and Liaison leaders develop and continue to implement policy and procedures for using waivers for compliance surveys and develop metrics to evaluate record of compliance criteria so waivers maintain the intent of the statute.

Review and update applicable sections of the VA Fiduciary Program Manual to clarify how to properly evaluate an allegation, including detailing what constitutes a misuse allegation that must be documented and reviewed, and when an investigation is needed, in coordination with the VA Office of General Counsel if necessary.

Clarify in the VA Fiduciary Program Manual how potential misuses of beneficiary funds, such as red flag indicators, must be addressed and documented, and reinforce with training or resources as needed.

Clearly communicate the evidentiary standard staff should use in the allegation phase to help ensure application of different standards is accurate and easily understood and results in consistent compliance with how investigations are initiated, and consider consulting with the VA Office of General Counsel if necessary.

Develop a plan to implement or enhance the national quality review program to ensure compliance with procedural guidance for processing all phases of misuse allegations.

Create a process for facilities to regularly update and verify specialty care clinics’ phone numbers listed in internal facility directories and on websites.

Annually evaluate and verify that automated interactive phone systems route veterans directly to the correct specialty care clinic and assess whether the phone systems support first-call resolution.

Reconfigure specialty care clinics’ phone lines to be able to collect required call performance data and assess whether centralized queues enhance the efficiency of phone management.

Provide guidance to specialty care clinics on how they should manage and respond to voicemails, including for routine reviews of voicemail data.

Provide guidance that assigns both the responsibility for and the frequency of routine monitoring of call performance data and analyses of complaint data trends from the patient advocate system to identify and address veterans’ phone access issues for specialty care clinics.

Standardize and enforce a documented monthly process for reviewing and validating open obligations—including undelivered orders and accruals—with defined staff roles, responsibilities, and communication protocols, in alignment with VA financial policy.

In conjunction with the Office of Acquisition, Logistics, and Construction, establish and document procedures that define roles and communication requirements with requesting and contracting offices to ensure timely end-date modifications and deobligation of funds that are no longer needed.

In coordination with the VA Office of Financial Policy, develop VBA‑specific procedures aligned with appendix F of VA Financial Policy, “Obligations,” and confirm those procedures are consistently implemented to support reconciliation, documentation, and closure of open obligations in the Integrated Financial and Acquisition Management System.

Facility leaders ensure staff follow procedures to properly separate and store soiled and clean equipment.

Facility leaders ensure environmental management services staff clean ice machines daily to help prevent infection risk.

Facility leaders ensure staff properly label and store oxygen tanks.

Facility leaders ensure staff update the facility policy to include all elements to communicate test results to patients, as required in Veterans Health Administration Directive 1088(1), Communicating Test Results to Providers and Patients.

Executive leaders ensure staff maintain a clean and safe environment.

The Medical Center Director ensures providers complete secondary toxic exposure screenings within 30 days.

Ensure that authorizations are reassessed when a significant change affects the security or privacy posture of an application, consistent with the requirements of VA Handbook 6500.

Reevaluate the risk determination for the Patient Advocate Tracking System‑Replacement and determine the appropriate security categorization level and system classification based on (1) the sensitive personal information maintained in the system and (2) the System Security Categorization Report.

Reevaluate whether there is a continued business need to maintain access to veterans’ medical records in the Patient Advocate Tracking System-Replacement.

Institute a process to ensure user roles are regularly reviewed for continued access and evaluate the effectiveness of the access control principle of least privilege to ensure roles for the Patient Advocate Tracking System-Replacement are correctly configured and allow access only for authorized users.

Update the Patient Advocate Tracking System-Replacement user guides and training materials.

Improve the existing vulnerability management process to make sure all vulnerabilities are identified, plans of action and milestones are created for vulnerabilities that cannot be mitigated by VA deadlines, and software is updated before vendor support ends.

Implement a baseline configuration process to make sure network devices and databases are running authorized software that is configured to approved baselines and free of vulnerabilities.

Implement a process to disable access to the active directory and the electronic health record when temporary staff leave before their expected end date.

Separate the duties of maintaining physical blank key stock and making keys to improve physical access controls over key inventories.

Secure network infrastructure in accordance with VA environmental protection standards.

Complete the installation of grounding measures for all telecommunication closets to protect information technology equipment.

Routinely monitor and service uninterruptible power supplies that support the network infrastructure.

Establish a process to make sure a witness observes the destruction of temporary paper files that contain personally identifiable information and protected health information.

Develop and establish guidance detailing how medical facility staff must document evidence to support their decisions when they make pharmaceutical purchases through the open market.

Ensure medical facility leaders conduct routine assessments of pharmaceutical purchases made through the open market so purchases are made in accordance with policy.

Develop a mechanism, in coordination with VHA’s purchase card program office and VA’s Office of General Counsel, that provides visibility into all pharmaceutical purchases, including purchases outside the prime vendor contract.

Update the local inventory procedure to include a process for securing information technology equipment when temporary space is needed and for tracking and distributing this equipment, in accordance with federal and VA requirements.

Assess the age of all unused information technology inventory to determine what should be used and what should be disposed of based on federal and VA requirements, and take action to address the results.

The Veterans Integrated Service Network 7 VA Southeast Network Director ensures relevant system staff and leaders are trained on state licensing board reporting requirements to include timeliness of reporting.

The Chief of Staff ensures facility leaders develop workflows for all services to identify team members’ roles in the process for communicating test results.

The Veterans Integrated Service Network Director ensures actions are completed to address findings from the electronic health record audit expected to be completed by June 2026 and the annual site visit(s) of the Eastern Oklahoma VA Health Care System homemaker/home health aide program.

The Veterans Health Administration Executive Director of Geriatrics and Extended Care, in collaboration with the Veterans Health Administration Geriatrics and Extended Care program manager, provides guidance for Veterans Integrated Service Network and Veterans Health Administration systems’ leaders to evaluate homemaker/home health aide programs in accordance with the Veterans Health Administration Office of Integrated Veteran Care Community Care Field Guidebook and Veterans Health Administration Notice 2024-01, Purchased Home and Community-Based Services.

Require medical facility directors in Veterans Integrated Service Network 8 to ensure supply chain staff periodically review unit conversion factors in the Generic Inventory Package to ensure accurate system values and quantities are recorded and then correct any discrepancies.

Require medical facility directors in Veterans Integrated Service Network 8 to develop and implement procedures to maintain stock within the required thresholds as outlined in Veterans Health Administration Directive 1761.

Require medical facility directors in Veterans Integrated Service Network 8 to ensure supply chain staff review and update ABC classification labels on expendable supplies in accordance with Veterans Health Administration guidance and establish a process to routinely verify that labeling aligns with the official ABC classification report.

Ensure medical facility directors in Veterans Integrated Service Network 8 develop a process to ensure facility staff safeguard expendable supplies in accordance with Veterans Administration Handbook 0730.

Ensure medical facility directors in Veterans Integrated Service Network 8 develop and implement local procedures that require clinical service areas to notify supply chain staff when equipment is relocated and establish protocols to validate and update equipment location during clinical moves or room changes and ensure equipment items are properly tagged.

Require medical facility directors in Veterans Integrated Service Network 8 to enforce timely completion of reports of survey in accordance with Veterans Health Administration policy and implement oversight mechanisms to monitor the timely initiation, approval, and closure of reports.

Ensure facilities implement corrective actions to effectively address deficiencies identified during the Veterans Integrated Service Network’s quality control reviews.

Require medical facility directors in Veterans Integrated Service Network 22 to develop and implement procedures to maintain stock within the required thresholds as outlined in Veterans Health Administration Directive 1761.

Require medical facility directors in Veterans Integrated Service Network 22 to ensure supply chain staff review and update ABC classification labels on expendable supplies in accordance with Veterans Health Administration guidance and establish a process to routinely verify that labeling aligns with the official ABC classification report.

Ensure medical facility directors in Veterans Integrated Service Network 22 develop a process to ensure facility staff safeguard expendable supplies in accordance with Veterans Administration Handbook 0730.

Ensure medical facility directors in Veterans Integrated Service Network 22 develop and implement local procedures that require clinical service areas to notify supply chain staff when equipment is relocated, establish protocols to validate and update the equipment location, and ensure equipment items are properly tagged.

Require medical facility directors in Veterans Integrated Service Network 22 to ensure facilities conduct annual inventory of nonexpendable equipment.

Require medical facility directors in Veterans Integrated Service Network 22 to enforce timely completion of reports of survey in accordance with Veterans Health Administration policy and implement oversight mechanisms to monitor the timely initiation, approval, and closure of reports.

Ensure facilities implement corrective actions to effectively address deficiencies identified during the Veterans Integrated System Network’s quality control reviews.

The Director ensures Environmental Management Services staff keep patient care areas clean and well maintained.

Conduct a strategic business evaluation of the process used by VA medical facilities’ scheduling departments to determine whether alternatives could improve consult processing, scheduling efficiency, and timeliness.

Establish procedures to track and provide oversight of consults that schedulers have not acted on to schedule and prioritize processing of those consults when identified.