Audit of VHA's Patient Advocacy Program

The Patient Advocacy Program is intended to identify systemic problems in VA health care with veterans experiencing unsatisfactory service. This audit was conducted to determine whether the Veterans Health Administration (VHA) responded to FY 2015 patient complaints timely and appropriately. VHA did not adequately capture FY 2015 patient complaint information and identify complaint trends. We reviewed responses made as recently as May 2016 to FY 2015 complaints. We projected more than one-third of approximately 135,000 of VHA’s serious patient complaints in the Patient Advocate Tracking System (PATS) lacked key information and were closed erroneously. Serious complaints included issues such as delays in accessing care or services, problems with clinical care, and pain management. In addition, we estimated about 11,000 patient complaints at five of the eight sites we visited were not recorded in PATS, and VA medical facilities and Veterans Integrated Service Networks in our fieldwork performed limited or no formal complaint trending. VHA missed opportunities to achieve its intended program goals because the Patient Advocacy Program had material weaknesses in internal control areas, such as policies, quality control, information technology, and human capital. As a result, lapses in collecting, monitoring, and trending patient complaints reduced the potential effectiveness of the Patient Advocacy Program and affected VA’s progress in becoming more veteran-centric, including identifying systemic issues for improving the quality of veterans’ health care. PATS did not have important security controls in place. Approximately 4,000 of about 7,900 users had inappropriate access to PATS due to VHA’s untimely review of user privileges and access rights. PATS also lacked audit logs for significant user actions. These conditions occurred and persisted, in part, because the Office of Information and Technology did not adequately assess PATS security and operational risks. As a result, PATS data were vulnerable to unauthorized access and alteration, and records were not available to monitor modifications to sensitive patient information. We recommended the Under Secretary for Health implement operational controls to ensure the effectiveness of the program and reliability of its patient complaint data. We also recommended the Under Secretary and the Assistant Secretary for Information and Technology address PATS security and authorization issues. The Under Secretary for Health and Acting Assistant Secretary for Information and Technology concurred with our recommendations. We consider their corrective action plans acceptable and will follow up on their implementation.