All Reports

Update VA’s enterprise data strategy and spatial data strategy and other related policy documents to align with the goals and objectives of the National Spatial Data Infrastructure strategic plan for 2025–2035.

Update VA directives, handbooks, and standard operating procedures to ensure they are current and aligned with operational goals related to geospatial functions and responsibilities.

Develop a comprehensive plan to ensure the Office of Data Governance and Analytics and other related offices have the necessary resources to fulfill the responsibilities of effective geospatial data collection, production, and stewardship regarding related activities of the covered agency and, as necessary, support the activities of the Federal Geographic Data Committee.

Improve vulnerability management processes so that all vulnerabilities are identified and mitigated; for vulnerabilities that cannot be mitigated by VA deadlines, create plans of action and milestones.

Improve the baseline configuration process to make sure network devices and databases are running authorized software that is configured to approved baselines and free of vulnerabilities.

Confirm appropriate network isolation and protections for all medical devices and special‑purpose systems hosted on the Lovell Federal Healthcare System networks.

Separate the duties of maintaining physical blank key stock and making keys to improve physical access controls over key inventories.

Improve the process for monitoring and servicing uninterruptible power supplies that support the network infrastructure.

Complete the installation of grounding measures for all communications closets.

Establish a process to make sure a witness observes the destruction of temporary paper files that contain personally identifiable information and protected health information.

Develop and maintain a Benefits Enterprise Platform modernization program schedule that (1) captures both agile and nonagile tasks and (2) documents the time frame for the delivery of all system modernization requirements.

Ensure staff follow VA’s Product (Line) Accountability and Reporting System Guide to include all program schedule information in the System.

Develop reliable, validated life cycle cost estimates for the Benefits Enterprise Platform modernization program that support planning and budgeting as required by Office of Management and Budget Circulars A-130 and A‑11.

Include all Benefits Enterprise Platform modernization costs in the VA’s Product (Line) Accountability and Reporting System as required by the Veteran-Focused Integration Process Guide, and track Cost of War Toxic Exposures Fund obligations and expenditures in the Office of Information and Technology PACT Act Dashboard consistent with VA financial policy.

Establish a mechanism for enforcing VA policy that requires minor applications to include an approved security assessment before being placed on VA’s network.

We recommended the Assistant Secretary for Information and Technology consistently implement an improved continuous monitoring program in accordance with the NIST Risk Management Framework. Specifically, regarding the independent evaluation of the effectiveness of security controls prior to granting authorization decisions. 

We recommended the Assistant Secretary for Information and Technology implement improved processes for reviewing and updating key security documentation, including Security Control Assessments and Privacy Impact Assessments as needed. Such updates will ensure all required information is included and accurately reflects the current environment, new security risks, and applicable Federal standards.

We recommended the VA Office of Personnel Security, Human Resources, and Contract Offices strengthen processes to ensure appropriate levels of background investigations are performed timely and completed for applicable VA employees and contractors. 

We recommended the Assistant Secretary for Information and Technology ensure contingency plans for all systems and applications are updated and tested in accordance with VA requirements.

We recommended the Assistant Secretary for Information and Technology implement improved procedures to ensure that system outages are resolved within stated recovery time objectives. 

We recommended the Assistant Secretary for Information and Technology ensure backups are conducted periodically and tested in accordance with established standards for VA system and application data. 

We recommended the Assistant Secretary for Information and Technology ensure system owners consistently implement processes for periodic reviews of user account access and maintain access authorization documentation. Remove unnecessary and inactive accounts on systems and networks. 

We recommended the Assistant Secretary for Information and Technology ensure system owners consistently follow termination procedures for the timely disablement of user accounts and the proper completion of termination checklists for separated personnel.

We recommended the Assistant Secretary for Information and Technology work with system owners and change implementers to improve adherence to standards and best practices across the Systems Development Lifecycle (SDLC) for testing and approval of system changes for VA systems and networks. 

We recommended the Assistant Secretary for Information and Technology work with system owners and application teams to implement and enforce standards for processes related to preventing and detecting potential unauthorized changes across all platforms and applications in the environment.

We recommended the Assistant Secretary for Information and Technology ensure that all systems and platforms are monitored for compliance with documented VA standards for baseline configurations. Ensure that system owners consistently implement and monitor their configurations. 

We recommended the Assistant Secretary for Information and Technology implement automated software management processes on all agency platforms to identify and prevent the use of unauthorized software on agency devices.

We recommended the Assistant Secretary for Information and Technology work with system owners to ensure adherence to established procedures for maintaining, documenting, and monitoring an accurate software and logical hardware inventory for system boundaries across the enterprise.

We recommended the Assistant Secretary for Information and Technology implement improved processes for monitoring and analyzing significant system audit events for unauthorized or unusual activities across all systems and platforms in accordance with VA policy. 

We recommended the Assistant Secretary for Information and Technology enable system audit logs on all critical systems and platforms and conduct centralized reviews of security violations across the enterprise.

We recommended the Assistant Secretary for Information and Technology implement improved mechanisms to continuously identify and remediate security deficiencies on VA’s network infrastructure, database platforms, and Web application servers in accordance with established policy timeframes. If patches cannot be applied or are unavailable, other protections or mitigations should be documented and implemented to address the specific risks.

We recommended the Assistant Secretary for Information and Technology continue to implement controls that restrict vulnerable medical devices from unnecessary access from the general network. 

We recommended the Assistant Secretary for Information and Technology implement improved processes to require system owners and management to provide adequate credentials to ensure security scans are authenticated to end devices where feasible and the subsequent vulnerabilities are remediated in a timely manner.

We recommended the Assistant Secretary for Information and Technology improve the process for tracking and resolving vulnerabilities that cannot be addressed by enterprise processes within policy timeframes. Implement mitigations for identified security deficiencies by applying security patches, system software updates, or configuration changes to reduce applicable security risks. Additionally, VA should enhance their process for updating baseline images to ensure aged vulnerabilities are not introduced into the environment. 

Ensure that authorizations are reassessed when a significant change affects the security or privacy posture of an application, consistent with the requirements of VA Handbook 6500.

Reevaluate the risk determination for the Patient Advocate Tracking System‑Replacement and determine the appropriate security categorization level and system classification based on (1) the sensitive personal information maintained in the system and (2) the System Security Categorization Report.

Reevaluate whether there is a continued business need to maintain access to veterans’ medical records in the Patient Advocate Tracking System-Replacement.

Institute a process to ensure user roles are regularly reviewed for continued access and evaluate the effectiveness of the access control principle of least privilege to ensure roles for the Patient Advocate Tracking System-Replacement are correctly configured and allow access only for authorized users.

Update the Patient Advocate Tracking System-Replacement user guides and training materials.

Improve the existing vulnerability management process to make sure all vulnerabilities are identified, plans of action and milestones are created for vulnerabilities that cannot be mitigated by VA deadlines, and software is updated before vendor support ends.

Implement a baseline configuration process to make sure network devices and databases are running authorized software that is configured to approved baselines and free of vulnerabilities.

Implement a process to disable access to the active directory and the electronic health record when temporary staff leave before their expected end date.

Separate the duties of maintaining physical blank key stock and making keys to improve physical access controls over key inventories.

Secure network infrastructure in accordance with VA environmental protection standards.

Complete the installation of grounding measures for all telecommunication closets to protect information technology equipment.

Routinely monitor and service uninterruptible power supplies that support the network infrastructure.

Establish a process to make sure a witness observes the destruction of temporary paper files that contain personally identifiable information and protected health information.

Update the local inventory procedure to include a process for securing information technology equipment when temporary space is needed and for tracking and distributing this equipment, in accordance with federal and VA requirements.

Assess the age of all unused information technology inventory to determine what should be used and what should be disposed of based on federal and VA requirements, and take action to address the results.

The Under Secretary for Health reviews the Veterans Health Administration’s current use of generative AI chat tools, defines permissible clinical uses for general-purpose AI chat tools, oversight responsibilities, and risk mitigation, and outlines a plan for implementation.

The Under Secretary for Health evaluates whether safeguards applied to other high-impact AI tools, such as Ambient AI Scribe, should be adapted for generative AI chat tools used for clinical care and documentation.

The Under Secretary for Health oversees integration of AI-related risk monitoring into existing patient safety programs and ensures staff are trained to identify and report AI-related safety events.

The Veterans Integrated Service Network Director conducts a comprehensive review of the care provided to the patient prior to the event, and takes action as indicated.

The Robley Rex VA Medical Center Director ensures that the facility has a mechanism in place for how Veterans Health Administration healthcare professionals will provide content of suicide prevention safety plans when completing suicide prevention safety plans with patients over the phone.

The Robley Rex VA Medical Center Director reviews facility Primary Care-Mental Health Integration guidance documents and ensures consistency and alignment with Veterans Health Administration requirements.

The Robley Rex VA Medical Center Director reconsiders the practice of reauthoring notes in the Computerized Patient Record System by behavioral health technicians in the Primary Care-Mental Health Integration call center, identifies other facility areas that use the reauthoring process, and takes action as indicated.

The Under Secretary for Health evaluates ways to mitigate the implications resulting from users’ ability to change authors in an unsigned note in the Computerized Patient Record System to ensure that such practice is limited to those in roles with a need to have that function, and takes action as indicated.

The Robley Rex VA Medical Center Director ensures that root cause analyses are completed in accordance with Veterans Health Administration policy, including root cause analysis process steps, timeliness, and team roles.

The Robley Rex VA Medical Center Director ensures that patient safety managers receive oversight, training, and support as required by the Veterans Health Administration.

The Robley Rex VA Medical Center Director ensures that the chief of quality understands the seriousness and implications of altering documentation without support, and that leaders, whose actions contributed to the deficiencies outlined in this report, receive administrative action, as appropriate.

Remediate servers that are not compliant with configuration standards and ensure periodic compliance scanning of servers.

Remediate databases that are not compliant with configuration standards and ensure quarterly compliance and vulnerability scanning of databases.

Remediate vulnerabilities within VA-defined timeframes and document mitigations for vulnerabilities that cannot be remediated on time.

Comprehensively scan all the facility’s local area network segments for vulnerabilities.

Prepare plans of action and milestones for unapproved software still in use. 

Remediate or document mitigations for physical security deficiencies that can affect IT operations and resources. 

Implement required controls on certain privileged accounts and ensure limited access to these account usernames and passwords.

Define intervals for review of database audit logs and vulnerability scan results and ensure regular collection and review of database audit logs in accordance with policy.

Verify and document the identity of vendors or contractors consistently before granting them access to IT resources.

Provide access control list protection for all networked medical devices hosted on the VA Saginaw Healthcare System virtual local area networks.

Implement vulnerability management processes to ensure all vulnerabilities are identified and plans of action and milestones are created for vulnerabilities that cannot be mitigated by VA deadlines.

Implement a more effective baseline configuration process to ensure network devices and databases are running authorized software that is configured to approved baselines and free of vulnerabilities.

Perform a cost-benefit analysis and implement appropriate controls within the federal Electronic Health Record to limit disclosure of veteran personally identifiable information based on job responsibility.

Segregate the duties of maintaining key stock and making keys.

Place network infrastructure equipment in a communications closet or approved enclosure to restrict access to only authorized personnel.

Complete the installation of grounding measures for all telecommunications closets to protect information technology equipment against electromagnetic pulse attack or electrostatic discharge. Ensure the work completed by contractors adheres to the requirements as defined in the work order.

Add anti-ram barriers to protect all sides of a fueling station’s fuel tank.

Implement a plan with the Office of Acquisition and Logistics Project Management Office to ensure system access is more granular and the intent of the principle of least privilege is met.

Ensure all roles and accesses, including those provided by default access, are reviewed and certified periodically as required.

Implement a permanent solution to provide supervisors and information owners with visibility of all roles and accesses, including those provided by default access, granted to users.

The Executive Director ensures staff receive education about badge holders’ responsibilities in preventing unauthorized access to VA facilities and computer systems and safeguarding electronic databases including electronic health care records.

The Executive Director ensures signs are present and accurate throughout the facility.

The Executive Director ensures staff maintain privacy curtains, preventive maintenance on medical equipment, and splash resistant bottom shelves on supply carts.

The Executive Director ensures staff monitor patient care areas for expired, damaged, and contaminated medications and remove them as needed.

The Executive Director ensures staff store medications in pharmaceutical grade refrigerators.

The Executive Director ensures primary care staffing is sufficient for patients to receive appropriate health care.

The Executive Director reviews staffing levels for the Housing and Urban Development–Veterans Affairs Supportive Housing program and takes action as needed.

The Executive Director of Operations for a national cancer testing program ensures the project has met the requirements for Institutional Review Board review for research with human subjects and takes action as needed.

The Executive Director of Operations for a national cancer testing program ensures national cancer prevention, treatment, and research program staff are trained on Institutional Review Board project submission and privacy requirements. 

The National Specialty Care Program Office Chief Officer ensures the national cancer prevention, treatment, and research program staff reviews and provides required approvals before the release of protected health information for research. 

The National Specialty Care Program Office Chief Officer, in conjunction with the Office of Research & Development ensures that VA privacy officers report privacy incidents involving data obtained from or for national cancer prevention, treatment, and research program activities timely and monitors for compliance.

The Office of Research Oversight Executive Director in conjunction with the Chief Research and Development Officer, VHA Office of Research & Development, reviews the national cancer prevention, treatment, and research program final mitigation plan and ensures corrective actions address system-wide issues for determining whether a national cancer prevention, treatment, and research program project constitutes research, safeguarding privacy when data is shared for projects, and ensuring data security requirements are met. 

The National Specialty Care Program Office Chief Officer ensures the national cancer prevention, treatment, and research program has safeguards in place including biostatistician expertise to ensure that data containing sensitive patient information and protected health information is deidentified before sharing outside of VA as required.

Implement vulnerability management processes to ensure all vulnerabilities are identified and plans of action and milestones are created for vulnerabilities that cannot be mitigated by VA deadlines.

Develop and approve an authorization to operate for the special-purpose systems.

Include facility personnel during the security categorization process to ensure all necessary information types are considered when determining the security categorization for special-purpose systems.

Segregate the pharmacy application administrative access from individuals who are custodians of the pharmaceutical inventory.

Ensure a witness observes the destruction of temporary paper files that contain personally identifiable information and protected health information.