All Reports

Ensure that authorizations are reassessed when a significant change affects the security or privacy posture of an application, consistent with the requirements of VA Handbook 6500.

Reevaluate the risk determination for the Patient Advocate Tracking System‑Replacement and determine the appropriate security categorization level and system classification based on (1) the sensitive personal information maintained in the system and (2) the System Security Categorization Report.

Reevaluate whether there is a continued business need to maintain access to veterans’ medical records in the Patient Advocate Tracking System-Replacement.

Institute a process to ensure user roles are regularly reviewed for continued access and evaluate the effectiveness of the access control principle of least privilege to ensure roles for the Patient Advocate Tracking System-Replacement are correctly configured and allow access only for authorized users.

Update the Patient Advocate Tracking System-Replacement user guides and training materials.

Develop and establish guidance detailing how medical facility staff must document evidence to support their decisions when they make pharmaceutical purchases through the open market.

Ensure medical facility leaders conduct routine assessments of pharmaceutical purchases made through the open market so purchases are made in accordance with policy.

Develop a mechanism, in coordination with VHA’s purchase card program office and VA’s Office of General Counsel, that provides visibility into all pharmaceutical purchases, including purchases outside the prime vendor contract.

Conduct a strategic business evaluation of the process used by VA medical facilities’ scheduling departments to determine whether alternatives could improve consult processing, scheduling efficiency, and timeliness.

Establish procedures to track and provide oversight of consults that schedulers have not acted on to schedule and prioritize processing of those consults when identified.

Establish and use agreements with other VA medical facilities to help identify and schedule direct care when local services are not available.

Assess options to improve the scheduling process and system to provide schedulers with access to community care provider appointment availability when discussing care options with wait time–eligible veterans.

Review services in the Consult Toolbox to make sure it accurately reflects available services and avoids inaccurate eligibility determinations.

Reinforce requirements for schedulers to review scheduling systems to identify the next available date for appointments and input that information in the Consult Toolbox.

Implement a process to verify that schedulers check all community care eligibility criteria for all veterans.

Emphasize to schedulers at least annually the proper methods (including the use of opt-out codes) to document when veterans opt out of community care.

The Under Secretary for Health reviews the Veterans Health Administration’s current use of generative AI chat tools, defines permissible clinical uses for general-purpose AI chat tools, oversight responsibilities, and risk mitigation, and outlines a plan for implementation.

The Under Secretary for Health evaluates whether safeguards applied to other high-impact AI tools, such as Ambient AI Scribe, should be adapted for generative AI chat tools used for clinical care and documentation.

The Under Secretary for Health oversees integration of AI-related risk monitoring into existing patient safety programs and ensures staff are trained to identify and report AI-related safety events.

Identify all relevant stakeholders and formally define roles and responsibilities for the police staffing decision tool or similar model.

Coordinate with all relevant stakeholders to address vulnerabilities with the police staffing decision tool or a similar model.

Ensure the Manpower Management Service’s standard operating procedures are followed to document formal completion of the police staffing decision tool or a similar model.

Assign accountability for disseminating the finalized police staffing decision tool or a similar model and ensuring its use.

The Veterans Crisis Line Executive Director takes action to evaluate and implement mechanisms that facilitate ongoing, bidirectional communication between Veterans Crisis Line frontline staff and leaders to ensure staff have an avenue to express concerns, share feedback, and receive timely, relevant responses.

The Veterans Crisis Line Executive Director considers using social service assistant-specific workload data to determine social service assistant staffing levels rather than a fixed ratio of responders to social service assistants.

Develop and communicate guidance that explains what detail should be included in a valid justification for every Veterans Benefits Management System for Rating override.

Develop and implement a plan to reestablish an overrides quality review process that provides individualized feedback for claims processors.

Develop and implement a plan to monitor the effectiveness of override reviews and continue to address areas and trends that are found to need improvement.

Identify the business need for the override review tab and, if there is one, develop and implement requirements for updating and using it.

Develop and implement a plan that addresses the limitations of the aggregate dashboard.

The Under Secretary for Health ensures alcohol use screening performance monitoring to demonstrate sustained improvement of required alcohol use screening.

The Under Secretary for Health reviews the clinical implications and considers implementing sex-specific thresholds to prompt the delivery of brief intervention in response to alcohol use screening and takes action as appropriate.

Strengthen and monitor the automation process to ensure that automated Dependency and Indemnity Compensation rating decisions and notifications fully comply with all legal requirements and procedural guidance.

Ensure the Pension and Fiduciary Service revises the quality review checklist for automated death benefits decisions so that those decisions undergo the same scrutiny as traditionally processed claims.

Consult with VA’s Office of General Counsel to determine whether the modernization plan submitted to Congress—regarding service-connected death benefit grants—complies with section 701(b) of the PACT Act and take appropriate corrective action if needed.

Take corrective action on the remaining three of seven instances that led to about $612,000 in improper payments.

Update requirements provided to the VA Hines Information Technology Center to ensure all foreign beneficiaries, including those with an address in the Philippines, are included in the annual end product generation.

Update the Veterans Benefits Administration’s Adjudication Procedures Manual to clarify and strengthen the actions claims processors should take to verify foreign beneficiaries are alive.

Ensure jurisdiction guidance for routine reviews for residents in the Philippines is clearly communicated to all regional offices.

Provide guidance to assist claims processors in verifying information in the Veterans Benefits Administration’s systems compared to the results from the Social Security Administration inquiry results.

Update the Adjudication Procedures Manual to require claims processors to upload the Social Security Administration inquiry results to beneficiaries’ records.

Review and update VHA Directive 1660.07, “Medical Sharing/Affiliate National Program Office,” to delegate all required program office responsibilities for the community-based outpatient clinic contracts throughout the program’s life cycle to an appropriate headquarters-level office or collaboration of offices, as defined in VHA Directive 1217, “VHA Operating Units” and VA’s Acquisition Lifecycle Framework.

Develop and implement procedures for a headquarters-level office to monitor overall compliance with contract requirements and use the results to reassess program policies or contract requirements.

Develop a formal feedback process, such as a program life cycle review process, for contracting officers and contracting officer representatives, medical facilities, and contractors who work on community-based outpatient clinic contracts to provide lessons learned, issues encountered, and other feedback about establishing new clinics and the performance at the clinics.

Conduct an assessment of contractor compliance with all active community-based outpatient clinic contracts, then evaluate whether the community-based outpatient clinic contract performance metrics are measurable, reasonable, and attainable.

Coordinate with the Office of General Counsel to determine whether creating a separate contract line item from the operational costs for contracted community-based outpatient clinics to pay start-up costs, including construction costs, would assist in the administration of these contracts and increase competition among contractors; then update the community-based outpatient clinic performance work statement template to reflect any change made as a result of this consideration.

Assess how medical centers create and maintain the billable roster for community-based outpatient clinic contracts; based on the results, develop and implement efficient, accurate, and consistent procedures for developing and maintaining the billable rosters.

Coordinate with the VA medical centers that have VA-contracted community-based outpatient clinics to conduct a risk assessment to evaluate the responsibilities, time requirements, and qualifications of community-based outpatient clinic contracting officer representatives; then publish clear guidance or recommendations for facilities to make sure they have appropriately experienced, trained, and certified staff to oversee the performance of community-based outpatient clinic contracts.

Assess the certification levels of the CORs assigned to all CBOC contracts and make recommendations to the medical centers for assigning appropriately experienced CORs or to provide any additional training or assistance to existing CORs, if necessary.

Develop and implement procedures to require VA medical centers and contracting offices to verify that the Office of Information Technology can meet start-up requirements for new community-based outpatient clinic locations as part of the contract review process.

Review and evaluate how contracting offices rated community-based outpatient clinic contractors in the Contractor Performance Appraisal Reporting System, and if necessary, develop and disseminate additional guidance or training to contracting offices to help them appropriately rate community-based outpatient clinic contractors in accordance with the performance metrics and the broad categories in the Contractor Performance Appraisal Reporting System.

Determine whether positive and negative performance incentives should be used for community-based outpatient clinic contracts to motivate the contractors to provide high-quality health care, in accordance with FAR 37.6, FAR 16.202, and FAR 16.402-2.

a. If performance incentives are appropriate for community-based outpatient clinic contracts, ensure the Medical Sharing/Affiliate Office coordinates with the Office of General Counsel to develop and implement measurable, reasonable, and defensible positive and negative performance incentives.

b. If performance incentives are not appropriate for community-based outpatient clinic contracts, ensure the Medical Sharing/Affiliate Office and each network contracting office documents in the contract files the reasons why performance incentives are not used to the maximum extent practicable, in accordance with FAR 16.402-2 and FAR 37.6.

Develop and implement procedures to identify, evaluate, and incorporate commercial practices and contract types into the community-based outpatient clinic contract requirements templates before publishing updated versions, in accordance with 38 U.S.C. § 8153 and FAR part 10; the procedures should evaluate whether the contract payment structure for community-based outpatient clinic contracts is consistent with current commercial practices.

Implement a plan with the Office of Acquisition and Logistics Project Management Office to ensure system access is more granular and the intent of the principle of least privilege is met.

Ensure all roles and accesses, including those provided by default access, are reviewed and certified periodically as required.

Implement a permanent solution to provide supervisors and information owners with visibility of all roles and accesses, including those provided by default access, granted to users.

The Executive Director of Operations for a national cancer testing program ensures the project has met the requirements for Institutional Review Board review for research with human subjects and takes action as needed.

The Executive Director of Operations for a national cancer testing program ensures national cancer prevention, treatment, and research program staff are trained on Institutional Review Board project submission and privacy requirements. 

The National Specialty Care Program Office Chief Officer ensures the national cancer prevention, treatment, and research program staff reviews and provides required approvals before the release of protected health information for research. 

The National Specialty Care Program Office Chief Officer, in conjunction with the Office of Research & Development ensures that VA privacy officers report privacy incidents involving data obtained from or for national cancer prevention, treatment, and research program activities timely and monitors for compliance.

The Office of Research Oversight Executive Director in conjunction with the Chief Research and Development Officer, VHA Office of Research & Development, reviews the national cancer prevention, treatment, and research program final mitigation plan and ensures corrective actions address system-wide issues for determining whether a national cancer prevention, treatment, and research program project constitutes research, safeguarding privacy when data is shared for projects, and ensuring data security requirements are met. 

The National Specialty Care Program Office Chief Officer ensures the national cancer prevention, treatment, and research program has safeguards in place including biostatistician expertise to ensure that data containing sensitive patient information and protected health information is deidentified before sharing outside of VA as required.