Major Management Challenges Identified by the Office of Inspector General

• VA contracted with the Institute for Defense Analyses (IDA) to conduct a scientific study of the major influences on compensation payments to develop baseline data and metrics for monitoring and managing rating variances.

• VBA will take appropriate action upon receipt of the IDA study report (expected January 2007).

• VBA's rating consistency analysis work group is drafting a plan to monitor decision-making consistency to conduct an accurate and focused analysis. Initial results analysis, in terms of causal relationships and other influencing factors, will not be completed prior to January 2007.

• VBA will monitor consistency on an ongoing basis.

• Staff from the Compensation and Pension Examination Program (CPEP) (1) and VBA's Compensation and Pension (C&P) Service began developing templates for C&P examinations to ensure that the medical evidence captured will enable consistent evaluation of disabilities. The templates are being tested and released to the field in the order of frequency of use.

• VA will work on full deployment and mandatory use of templates.

• As required by the Deficit Reduction Act of 2005, VBA will monitor the ongoing research study of veteran awareness. Findings are expected by December 2006.

• VBA will take appropriate action based on findings from the research study.

OIG's June 2006 report disclosed that VBA needed to improve fiduciary program case management to reduce the risk of misuse or theft of beneficiaries' funds. VARO staff needed to improve field examinations, monitoring of fiduciaries, and periodic accountings; verify beneficiary assets; and require documentation of some fiduciary-reported expenses.

• As of September 2006, one of seven recommendations to strengthen fiduciary program operations remains open.

Action on the remaining recommendation is ongoing.

VBA has implemented the following actions:

• Developed a Legal Instruments Examiner (LIE) training program to enhance skills needed to effectively conduct fiduciary oversight responsibilities.

• In May 2006, training was provided to 75 field staff via a National Training Conference.

• Developed a comprehensive LIE training syllabus for both introductory and refresher training.

• Revised and expanded the LIE Program Guide to include detailed explanations of the account review process and administrative duties of the LIE position.

• Based on the above actions, OIG closed the recommendation addressing the LIE training program in August 2006.

• A work measurement study, which will include fiduciary program work products, is scheduled for the second quarter of 2007.

• VA will analyze results, examine fiduciary program staffing at the regional office level, and make recommendations regarding caseloads.

The Veterans Millennium Health Care and Benefits Act of 1999, Public Law 106-117, directs the Secretary of Veterans Affairs to provide extended services to eligible veterans, including nursing home care (NHC), in either VA or community-based facilities.

• In December 2002 and 2003, and in May 2004, OIG identified long-term health care issues warranting attention. As of September 2006, one recommendation remains open for the Contract Nursing Care program review, two for the Homemaker/Home Health Aide program review, and four for the Community Residential Care program review.

• VHA provided updated Contract Nursing Home information on extended nursing home services to the OIG in June 2006.

• VHA published the Home Health Care Handbook in July 2006.

• Geriatrics and Extended Care (GEC) referral information was published near the end of 2006.

• The Community Residential Care (CRC) Handbook is in the final internal concurrence process.

• VHA has implemented the GEC Referral Form, which VA initiates for all veterans needing long-term care services. The form identifies the veteran's need for nursing home care and the spectrum of non-institutional long-term care services.

• A GEC team reviewed all referral forms and recommended placement based on documented need for long-term care services including nursing home care.

• Based on veteran needs and specific capabilities of nursing homes both in VA and in the community to provide the services, veterans were placed where the most appropriate, least restrictive care could be provided.

• VHA believes that these actions should close out the remaining recommendations.

• GEC will continue to review and refine referral information.

• GEC will publish a federal regulation on fire safety on the CRC program.

OIG's May 2006 report assessed whether veterans had access to non-institutional care and whether veterans who desired care were enrolled and provided timely care.

• OIG found that some medical facilities limited access of certain non-institutional care services to only the highest priority veterans. VA medical facilities did not have effective controls to ensure that all newly enrolled veterans in need of care received it within VHA's goal of 30 days of the desired date of care, or veterans received clinically indicated specialty procedures within a reasonable time. OIG made nine recommendations to VA to monitor the demand for non-institutional care, direct facilities to implement tracking mechanisms to identify newly enrolled veterans, and establish standardized tracking methods and appropriate performance metrics. As of September 2006, all nine recommendations remain open.

• The Deputy Under Secretary for Health for Operations and Management reinforced the requirement to eliminate any local restrictions limiting eligible veterans' access to non-institutional care in accordance with Information Letter 10-2004-005 to Veterans Integrated Service Network (VISN) leadership in August 2006.

• The Care Coordination/Home Telehealth Program (CCHT), which provides non-institutional care to veteran patients, also extended the geographic range of services provided. CCHT programs exist in all VISNs. (Twenty-five percent of CCHT patients are in rural or highly rural areas.)

• VHA published Handbook 1140.6, "Purchased Home Health Care Services Procedures" in July 2006, which includes policy on use of the electronic waiting list (EWL) for veterans in need of and seeking home health care services.

• VHA will implement effective measurement systems to evaluate the extent to which geriatric evaluations are occurring.

• VHA issued Directive 2006-028, "Process for Assuring Timely Access to Outpatient Clinical Care" in May 2006. The directive provides specific business rules requiring use of the EWL to identify veterans waiting for non-institutional care, including veterans entitled or not entitled to priority access.

• With publication of the new VHA Directive on Outpatient Scheduling Processes and Procedures, individuals with electronic access to schedule appointments and place patients on the EWL will be required to document completion of standardized national training to assure their competency and ongoing compliance.

• VHA is exploring the feasibility of developing computer functionality to help automate appointment scheduling for new enrollees who want to schedule an appointment on their initial application for enrollment.

• In the interim, VHA is using manual procedures to assure that veterans desiring an appointment are appropriately processed.

VA needs assurances that medical staffing levels are adequate and that medical staff are available to meet needs. The absence of staffing standards for physicians and nurses continues to impair VHA's ability to adequately manage medical resources.

• As of September 2006, 9 of the 17 recommendations from OIG's April 2003 report on physician staffing remain open. VA proposed developing a policy to meet the statutory requirement to ensure staffing for physicians and nurses is adequate, but reported that information management systems are inadequate to support nationwide standardized staffing plans for health care providers in varied settings. VA plans to review the issues at the local, network, and national levels, and to put systems for the collection and analysis of required information in place-but not until September 2009.

• In August 2004, OIG reported that managers could have managed staffing better in providing patient care if VHA had developed and implemented consistent staffing methodologies, standards, and data systems. As of September 2006, 11 of 15 recommendations remain open.

• VHA completed the final draft of a directive on staffing plans. The directive does the following:

  • Requires all facilities to develop staffing plans for various clinical care settings

  • Contains national staffing guidance for nursing and physician primary and specialty care.

  • Requires national roll-up and analyses of staffing plans and patient outcomes.

• VHA developed the VA Nursing Outcomes Database (VANOD) with standardized data definitions, data entry, data extraction, and report generation.

• VHA will continue development and enhancement of the VANOD.

• OIG's August 2004 report found that managers did not effectively communicate productivity goals to measure physician productivity. The Radiology Service did not monitor productivity by the contract service provider and an external VHA consultant could not determine the Pulmonary Clinic workload. As of September 2006, one recommendation remains open and management needs to develop and implement productivity standards for physicians as directed by the Department of Veterans Affairs Health Care Programs Enhancement Act of 2001, Public Law 107-135.

• A March 2006 report indicated that problems with physician time and attendance requirements still persist, with the one recommendation remaining open.

• VHA developed productivity goals for the Radiology Service.

• VHA plans to develop national staffing guidance for other disciplines.

• VHA will issue new policy guidance on adjustable work hours for part-time physicians. This policy would provide guidance to accommodate varying VA patient care needs and part-time VA physicians who have VA or non-VA patient care, research, or educational responsibilities that make adherence to the same regularly scheduled tour of duty each pay period difficult.

Veterans should receive high-quality medical care. Improvements in the measurement and use of medical outcomes data will provide opportunities for VHA to improve the health care provided to veterans. VHA will continue to develop and implement appropriate medical outcome measures, consistent with industry and government standards that demonstrate the level of care VA provides.

• OIG reviewed colorectal cancer detection in VHA health care facilities in February 2006. As of September 2006, all three recommendations remain open.

• The VHA Office of Quality and Performance (OQP) developed plans to report data on diagnostic delays quarterly, providing the mean time from a positive, non-colonoscopy, colorectal cancer (CRC) screen to colonoscopy as a metric to track VHA-wide delays and improve the timeliness of CRC diagnoses.

• External Peer Review Process (EPRP) collection for diagnostic delays began in the first quarter of 2006. VA produced preliminary metrics.

• Participants in the Colorectal Cancer Care Collaborative (C4) projects are capturing three core measures to improve the quality of care and increase adherence to evidence-based care in the diagnosis of CRC:

  • Time from positive fecal occult blood test (FOBT) to colonoscopy performed or paid for by VA (for colonoscopies within 1 year).

  • The number of colonoscopies performed or paid for by VA within 90 days after positive FOBT (for colonoscopies within 1 year).

  • The number of positive FOBTs without a follow-up colonoscopy. C4 measures are designed for facility-level performance improvement by pilot facilities.

• VHA disseminated facility-based quality improvement measures and tracking tools in September 2006.

• VHA will continue collection and analysis of EPRP data related to CRC diagnostic delays.

• VHA will proceed with Phase 2 of the C4 project, in which teams will study treatment of colorectal cancer. VHA expects to have recommendations and outcome measures once the collaborative project is finished in 2007.

VHA is challenged to align programmatic budget and financial execution with relevant outcomes, while remaining committed to providing quality health care to veterans.

• OIG's June 2006 report addressed congressional concerns about VHA budget execution processes. As of September 2006, all four recommendations remain open.

• VHA assessed the Veterans Integrated Service Network (VISN) actions to ensure they maximized efficient and effective patient care.

• The VHA Chief Financial Officer routinely monitored all VISNs' resources throughout the year.

• VA submitted quarterly reports to Congress identifying progress achieved toward financial and program performance goals.

• The VHA Finance Committee will continue to provide ongoing oversight of network financial execution. It expects to complete this by December 2006.

OIG's draft report issued March 2006, identified weaknesses at four medical centers in resident timekeeping, fiscal, and oversight procedures. OIG made four recommendations, which remain open, to address program management issues.

• VHA is awaiting the OIG's final report recommendations.

• VHA will implement OIG final report recommendations on Disbursement Agreements.

VA has received unqualified opinions in the annual consolidated financial statements (CFS) audits since FY 1999. However, the audit of VA's FY 2005 and FY 2004 CFS reported the lack of an integrated financial management system, financial operations oversight, and information technology (IT) security controls as material weaknesses. While VA has addressed some of our concerns, including the corrective action in FY 2005 to eliminate the judgments and claims reportable condition identified in the FY 2004 audit, the impact of the material weaknesses on financial operations demonstrates that VA faces major challenges in this area.

• The lack of an integrated financial management system increases the risk of materially misstating financial information.

• VA believed that CoreFLS would resolve OIG concerns, but after our August 2004 Bay Pines CoreFLS report was issued, VA discontinued implementation of CoreFLS and the test sites resumed operation within VA's existing financial management system in early 2005. As of September 2006, three financial management and control recommendations remain open.

• VA pursued two initiatives to mitigate the conditions that resulted in the audit findings regarding the lack of an integrated financial management system:

  Initiative #1: VA standardized and centralized the financial statement generation process using a commercial off-the-shelf (COTS) business tool.

  • The new tool and new procedures were successfully implemented during 2006, bringing standardization and greater integrity to the financial statement generation process.

  • VA submitted third quarter financial statements and the FACTS II submission using this software and used this software to prepare the consolidated financial statements during the fourth quarter of 2006.

  Initiative #2: VA prepared a detailed analysis of major financial system interfaces to identify and initiate correction of any deficiencies in reconciliation, internal controls, security, and other areas.

  • To correct any reconciliation issues, VA is implementing a data warehouse to capture relevant interface and system data and produce both high-level and detailed information on the status and health of financial system interfaces.

• VA is standardizing business processes for finance and logistics. The final deliverable will be a listing of standardized business processes to be implemented across VA.

• As it pertains to the open financial management and control recommendations associated with the prior financial and logistics system initiative, VA completed a review of expenditures to the largest vendors and completed a review of all travel expenditures submitted by BearingPoint.

• VA will use the COTS tool to further enhance the preparation and generation of financial statements and reports.

• VA will complete the analysis of the financial system interfaces in 2007. The focus of the project will move to incorporating these interfaces into the data warehouse effort.

• OIG's December 2004 report identified that 89 percent of cases reviewed for certain veterans receiving C&P benefits had debts referred inappropriately to VA's Debt Management Center. As of September 2006, two of four recommendations remain open.

• VA's first quarter 2006 review found that 11,576 bills were potentially issued in error to veterans. After review at VA medical centers, 5,139 first party copayment bills were cancelled, resulting in $99,000 being generated in refunds to veterans.

• VA implemented the Web Hospital Inquiry (WebHINQ) application, which allows VHA to retrieve from VBA's information systems more definitive disability codes, the current and original effective dates of a veteran's service-connected disability, and the effective date of the combined service-connected disability.

• The Health Eligibility Center (HEC) implemented procedures to ensure that review file records are monitored weekly and that pension awards and 50% or greater service-connected awards are identified for priority processing. A reporting mechanism was established to report this information monthly.

• VA completed enhancements of HEC's information system to optimize electronic processing of solicited and unsolicited eligibility messages from VBA. This resulted in a reduction of records requiring manual processing from 671 records to 15 records per week. VA continues to place a high priority on reviewing and resolving records requiring manual review.

• VBA corrected a deficiency in WebHINQ logic for triggering compensation and pension award changes to the HEC.

• The HEC completed a refresh of compensation and pension data in HEC records identified as a VA pensioner or service-connected veteran.

• VA will continue monitoring to ensure the error rate of veterans billed inappropriately is at an acceptable level - lowered to ten percent.

OIG's March 2006 report cited that strengthened controls over VA's permanent change of station (PCS) travel program were needed. We made 3 recommendations with 11 action items, of which 7 actions remain open as of September 2006. Although VA has reported additional FY 2006 corrective actions, we have not received documentation showing how the actions address the remaining OIG recommendations for improvement.

VA took the following actions:

• Reviewed the PCS travel cases nationwide ensuring that PCS travel funds were deobligated promptly, advances to transferring employees were for the appropriate amount and were promptly collected and the appropriate amount of funds were obligated for PCS real estate expenses.

• Ensured that customer surveys were distributed to all transferred employees.

• Competed the requirement for entitlement counseling and voucher services for those affected by Hurricane Katrina under the provisions in the FAR, Part 8.

• Changed the RFQ to provide entitlement counseling and voucher services to a fixed-price IDIQ or a Requirements task order that included tiered pricing or a rebate structure encouraging discounting pricing.

VA plans the following actions:

• Continue monthly reviews of outstanding obligations and advances.

• Periodically analyze obligation and advance amounts and determine if adjustments are necessary.

• Maintain up-to-date standard operating procedures.

• Provide ongoing training for staff.

• Continue surveys of transferred employees.

• Conduct annual customer satisfaction surveys of VA facilities.

• Partner with Cartus, a relocation services company, to enhance the PCS process.

• Continue to monitor implemented corrective actions.

The Government Performance and Results Act, Public Law 103-62, requires that agencies develop measurable performance goals and report results against the goals. Successful implementation requires accurate and complete data. OIG's July 2005 report found that VHA's outpatient scheduling procedures need to be improved to ensure accurate reporting of data on veterans' waiting times and facility waiting lists. As of September 2006, five of eight recommendations for improvement remain open.

• VHA revised Directive 2003-068 as Directive 2006-028, Process for Ensuring Timely Access to Outpatient Clinical Care.

• The revised directive continues previous requirements for scheduling and use of the Electronic Wait List (EWL) with emphasis on ensuring timely access for patients.

• A new directive on outpatient scheduling processes and procedures is in the final concurrence process.

• The draft VHA directive on outpatient scheduling processes and procedures will provide more detailed business rules for: scheduling, use of EWL, Primary Care Management Module (PCMM), consult management, no-shows, clinic cancellations, registration, and enrollment.

• The directive also mandates demonstration and ongoing monitoring of the competencies of all staff with electronic access to schedule appointments and use EWL and PCMM, including the requirement to complete standardized national training.

OIG's May 2006 report cited two VHA contracting activities that did not comply with Economy Act, as amended, 31 U.S.C. § 1535, regulations when administering acquisitions for other Government agencies (OGAs) by charging the OGAs excessive service fees of about $8.1 million in FYs 2003 and 2004. Additionally, contracting officers inappropriately awarded 35 interagency contracts valued at about $15 million that were not within the scope of VA's mission. All 14 recommendations remain open.

VA took the following actions:

• New acquisitions for other Government agencies (OGAs) have been suspended in VHA since January 2006.

• VHA field offices are transitioning OGA contracts to the VA Office of Acquisition and Materiel Management, or, in the case of Cooperative Administrative Support Units, to the General Services Administration.

• VA obtained quarterly financial reports to ensure that expenses and revenues were appropriately reconciled.

• VHA will perform a final closeout and reconciliation of all OGA procurements.

OIG's June 2006 report cited that using speech recognition technology to transcribe medical reports in-house as an alternative to outsourcing to contractors could resolve security concerns about patient health care information and reduce costs by as much as $6.2 million annually. As of September 2006, all four recommendations to address these issues remain open.

• VHA convened a workgroup to review market research and field data and to prepare a recommended procurement strategy for the approval of the Under Secretary for Health.

• VHA will support the contracting officer(s) and program manager(s) responsible for implementing the procurement strategy during the procurement process.

• Serious contracting, planning, and project management issues had been identified in a congressionally mandated study. OIG's September 2005 report found that the study was not properly planned, procured, or managed by OA&MM. OIG recommended that the Under Secretary for Health and the Assistant Secretary for Management initiate formal acquisition planning and proper contracting processes to expeditiously and successfully complete the study and ensure that assigned project management and contracting staff have the required knowledge and skills to effectively plan, procure, administer, and manage the study. As of September 2006, four of six recommendations remain open.

• VHA identified alternatives that could meet the intent of assessing mental health status, including the prevalence and effects of post-traumatic stress disorder (PTSD), in Vietnam (and other era) veterans. A final decision is still pending about which of the following approaches to pursue:

  • Use the Vietnam Era Twin (VET) Registry. The VET Registry was created to address questions about the long-term health effects of Vietnam service. The registry has evolved into a resource for genetic epidemiologic studies of mental and physical health conditions. Because the VET Registry does not include women, complementary studies of women veterans would be needed.

  • Use Findings from a VA-DoD OIF Study. A currently funded prospective study of OIF military personnel could provide insight into the onset and progression of PTSD as well as other mental and physical health consequences of service for veterans of current and future conflicts.

  • Rely on Other Research. Significant research on PTSD has improved treatment and diagnosis techniques, and these findings can provide valuable information applicable to all veterans who serve in combat.

    • - To improve VA's clinical care for veterans with readjustment problems, VA initiated several new projects, including collaborations with DoD and NIH, about the effects of combat.

    • - Currently published and future findings should result in new therapies to address the issues of readjustment to civilian life or return to military service for all veterans, including Vietnam war veterans.

• Negotiations with RTI International to close out the existing contract are continuing. These should be completed by December 31, 2006.

• VHA will choose 1 of the 3 approaches for assessing mental health status.

• OIG's August 2004 CoreFLS System review reported VA did not adequately contract for or monitor the CoreFLS project or protect the Government's interests. OIG identified systemic inadequacies in the contracting processes and serious weaknesses in contract development. OIG made 66 recommendations in the report. Twenty-nine recommendations related directly to procurement issues. As of September 2006, 15 of 29 recommendations remain open.

• VA began developing a new program, the Financial and Logistics Integrated Technology Enterprise (FLITE).

• The FLITE program will employ contracting methods that incorporate practices designed to address the OIG's concerns.

VA plans to do the following:

• Use Integrated Process Teams to develop acquisition plans and performance work statements.

• Use contract review boards to ensure contracts are developed, awarded, and administered properly.

OIG's February 2005 report noted that VA awarded over 240 vocational rehabilitation and employment contracts to provide evaluation, rehabilitation, training, and employment services to veterans. OIG concluded that VA was at risk of paying excessive prices for these contract services. As of September 2006, five of seven recommendations are closed. OIG will close the remaining two recommendations upon receipt of documentation showing new contracts are being competed, actions have been taken to negotiate lower prices with contractors, and the new business structures have been pilot tested.

• VA began work to re-procure the National Acquisition Strategy (NAS) contracts. These contracts provide necessary counseling services required for veterans in the VR&E program.

• VA awarded a facilitation contract to Acquisition Solutions, Inc., to assess various acquisitions strategies and identify the risks and benefits for each alternative.

• Since new contracts were not in place by the end of 2006, VA will exercise the fourth and final option year on the current contracts pending a satisfactory price reasonableness determination.

• VA will work with the Integrated Process Team to conduct extensive, more comprehensive market research to make a more informed business decision regarding the acquisition strategy.

• Based on these activities, VA will solicit for NAS services with the goal of awarding contracts by the end of 2007.

OIG's February 2005 summary report addressed general contracting issues including poor acquisition planning, contracting practices that interfered with the contracting officers' ability to fulfill their responsibilities, and contract terms and conditions that did not protect VA's interest; contract pricing issues that resulted in VA overpaying for services; and legal issues, including conflict of interest violations, improper personal services contracts, terms and conditions that were inherently governmental, and contracts that were outside the scope of § 8153 authority.

Currently, 1 of 35 recommendations remains open.

• After VA developed policy that addressed the concerns raised by the OIG report, the Secretary signed policy on sole-source contracting in August 2006.

• VA is investigating the steps necessary to address the open recommendation concerning authorization for VA to enter into personal services contracts.

For the past several years, OIG has reported vulnerabilities with information technology security controls in our Consolidated Financial Statements audit reports, Federal Information Security Management Act Public Law 107-347 reports, and Combined Assessment Program reviews. Each year OIG continues to identify repeat deficiencies and repeat recommendations that remain unimplemented. OIG's March 2005 audit reported that inadequate IT security controls for VA's financial management systems continue to place VA program and financial information at risk. As of September 2006, all 16 recommendations remain open. OIG's September 2006 audit of VA's information security program, reaffirmed the 16 unimplemented recommendations, and added another for VA action bringing the total to 17. OIG has reported information technology security as a Major Management Challenge for the Department each year for the past 6 years.

• OIG's December 2005 Management Letter reported deficient equipment controls and records for a 10-year period. As of September 2006, four of seven recommendations to address these issues are closed. The issue of controls continues to be an area of concern that will be addressed in ongoing reviews because it is central to information security.

• VA created a new IT management structure which gives the CIO the following:

  • Control over IT operational personnel and the IT budget. The CIO is now in a much better position to direct the remediation of IT deficiencies and implement the centralized enforcement/ execution model envisioned by the OIG.

  • Responsibility and authority (as delegated by the Secretary in a June 2006 memorandum) for information security responsibility policies, procedures, and practices.

• The Department has begun and will continue to execute the Data Security Assessment and Strengthening of Controls Program, which was developed to remediate IT deficiencies.

• Two OIG March 2006 reports of wireless network vulnerability assessments at two medical centers identified inadequate access controls for wireless technologies and weak operating system configurations based on penetration test results. As of September 2006, three of four recommendations remain open for one facility and for the second facility, two of four recommendations remain open.

• Corrective action has been taken for one of four recommendations made at one facility. Vulnerabilities noted in the report have been successfully remediated at this facility.

• For the other facility, corrective action was taken by the facility on two of four recommendations.

• Although vulnerabilities were identified at the Dallas and San Antonio VA medical facilities, VA is approaching this issue from a national perspective.

• From this perspective, VA has required its officials to adhere to Federal Information Processing Standard (FIPS) encryption requirements, and VA's Office of Cyber and Information Security has begun assisting VHA facilities with network protection deployments.

• VA will issue new policy on use of wireless technology.

• VA will provide additional wireless training to the staff at one of the facilities.

• The other facility is planning to deploy a wireless intrusion detection system and will be providing its IT staff with wireless security training.

• Corrective action for the remaining recommendations is planned for completion in 2007.

OIG's July 2006 report reviewed the circumstances surrounding the theft of a personally-owned laptop computer and external hard drive, which was reported to contain personal information on approximately 26 million veterans and United States military personnel, from the home of a VA employee.

• OIG found that while the employee had authorization to access and use large VA databases, the employee was not authorized to take VA data home and did not encrypt or password protect the data. OIG also found that VA policies and procedures do not adequately protect personal or proprietary data. OIG has reported vulnerabilities with information technology security controls for several years, finding that information security control weaknesses remain uncorrected. OIG understands VA has taken additional actions to implement the remaining recommendations, but they have not received documentation that would permit OIG to close any of the remaining recommendations.

• The Department completed four separate administrative investigations regarding the theft of a personally-owned laptop computer and hard drive from a VA employee's residence.

• All employees took privacy awareness and cybersecurity training.

• VA is offering data breach analysis services.

• VA consolidated security and privacy incident reporting.

• VA published the following policies:

  • VA Directive 6500, Information Security Program.

  • VA Directive 6504, Restriction on Transmission, Transportation, and Use of, and Access to Data Outside VA Facilities.

  • VA IT Directive 06-02, Safeguarding and Protecting Privacy Act Protected Data at Alternate Work Locations.

  • VA IT Directive 06-04, Embossing Machines and Miscellaneous Data Storage Devices.

  • VA IT Directive 06-05, Use of Personal Computing Equipment.

  • VA IT Directive 06-06, Safeguarding Removable Media

• VA will modify Cyber Security and Privacy Awareness Training to identify and provide an electronic link to all applicable laws and VA policies.

• VA will enhance the location and delivery of annual online awareness training for easier access by staff.

• VA will issue additional policy and procedures governing encryption, media protection, and other security controls.

• VA will ensure that its policies such as those governing telework and other personnel-related areas are updated to address IT security issues as appropriate.

• VA will ensure that all policies and procedures are centrally located and easily available and accessible to staff.

• VA will complete requirements analyses and begin to acquire and implement additional technical media protection capabilities, to include encryption of removable media.

• VA will enhance staffing and capabilities of its Security Operations Center for incident reporting and vulnerability detection and management.

• VA will enhance its internal IT security inspection capability to ensure that deficiencies have been properly remediated and to proactively identify new issues.

• OIG recommended that the Secretary take whatever administrative action deemed appropriate concerning the individuals involved; establish one clear, concise VA policy on safeguarding protected information when stored or not stored on VA automated systems; modify mandatory Cyber Security and Privacy Awareness training; ensure that all position descriptions are evaluated and have proper sensitivity level designations, and that required background investigations are completed in a timely manner; establish VA-wide policy for contracts that ensures contractors are held to the same standards as VA employees and that protected information used on non-VA automated systems is safeguarded; and establish VA policy and procedures that provide clear, consistent criteria for reporting, investigating, and tracking incidents of loss, theft, or potential disclosure of protected information or unauthorized access to automated systems. Five of six OIG recommendations remain open.

• The Secretary directed that all employees (1) sign a "Statement of Commitment and Understanding" by July 21, 2006, regarding their understanding of the training, consequences for non-compliance, and commitment to protecting sensitive and confidential information in the Department and (2) complete both Cyber Security and Privacy Awareness training by June 30, 2006. The actions cited were completed.

• Laptops that leave VA premises were equipped with encryption technology and underwent a "health check" to ensure current anti-virus update and operating system patching.

VA plans the following actions:

• An evaluation of all positions to ensure proper and consistent sensitivity level designations and timely completion of required background checks.

• Establishment of a VA-wide policy that ensures that contractor personnel are held to the same standards as VA employees regarding access to protected information, and that information accessed, stored, or processed on non-VA automated systems is safeguarded.

• Establishment of VA policy and procedures that provide clear, consistent criteria for reporting, investigating, and tracking information security incidents, including specific timelines and responsibilities regarding reporting and notification inside and outside VA.