Background VA’s Community Care Programs and Planned Consolidation VA has purchased health care services from community providers since as early as 1945. In general, veterans may be eligible for community care when they are faced with long wait times or travel long distances for appointments at VA medical facilities, or when a VA medical facility is unable to provide certain specialty care services, such as cardiology or orthopedics. In general, community care services must be authorized in advance of when veterans access the care. Currently, there are several community care programs through which VA purchases hospital care and medical services for veterans, including the Choice Program. In implementing the VA MISSION Act, VA plans to consolidate four of its community care programs for veterans under the Veterans Community Care Program, which is expected to go into effect by June 2019. (See table 1.) VA also provides health care services to veterans and other eligible beneficiaries through community providers under additional benefit programs. These benefit programs include the Civilian Health and Medical Program of the Department of Veterans Affairs (CHAMPVA) and the Camp Lejeune Family Member Program, among others. After implementing the VA MISSION Act, VA will continue to operate the community care programs for other eligible beneficiaries, such as CHAMPVA and others, as it has historically done. Appendix I contains more information about VA’s community care programs. Developing a Budget Estimate for VA Health Care The amount of funding VA receives to provide its health care services is determined during the annual appropriations process. In preparation for the process, VA develops an estimate of the resources needed to provide its health care services—known as its health care budget estimate—for two fiscal years. This budget estimate is one step in a complex, multistep budget formulation process, which culminates in an appropriation request for VA health care that updates the earlier, advance appropriation request for the upcoming fiscal year and an advance appropriation request for the next fiscal year in the President’s annual budget request to Congress. VA’s health care budget estimate includes the total cost of providing health care services, including direct patient costs, as well as costs associated with management, administration, and maintenance of facilities. VA uses its Enrollee Health Care Projection Model (EHCPM) to estimate the majority of resources needed to meet the expected demand for health care services, and uses other methods for the remaining services. VA uses the EHCPM to make projections 3 and 4 years into the future for budget purposes based on data from the most recent fiscal year. For example, in 2017, VA used data from fiscal year 2016 to develop its health care budget estimate for the fiscal year 2019 request and advance appropriation request for fiscal year 2020. The EHCPM’s estimates are based on three basic components: (1) the projected number of veterans who will be enrolled in VA health care, (2) the projected quantity of health care services enrollees are expected to use, and (3) the projected unit cost of providing these services. Each component is subject to a number of complex adjustments to account for the characteristics of VA health care and the veterans who access VA’s health care services. (See fig. 1.) VA uses other methods to estimate resources needed for the remaining portion of its budget estimate. This portion of the budget includes the state home per diem program, CHAMPVA, and other health care programs for veterans and other eligible beneficiaries, as well as health- care-related initiatives proposed by the Secretary of Veterans Affairs or the President. (See app. II for more information about the other methods VA uses in developing its health care budget estimate.) VHA generally starts to develop a health care budget estimate approximately 10 months before the President submits the budget to Congress, which should occur no later than the first Monday in February. The budget estimate changes during the 10-month budget formulation process, in part, due to successively higher levels of review in VA and OMB before the President’s budget request is submitted to Congress. (See table 2.) The Secretary of Veterans Affairs considers the health care budget estimate developed by VHA when assessing resource requirements among competing interests within VA, and OMB considers overall resource needs and competing priorities of other agencies when deciding the level of funding requested for VA’s health care services. OMB passes back decisions, known as a “passback,” to VA and other agencies on their budget estimate, along with funding and policy proposals to be included in the President’s budget request. VA has an opportunity to appeal the passback decisions before OMB finalizes the President’s budget request. Concurrently, VA prepares a congressional budget justification that provides details supporting the policy and funding decisions in the President’s budget request. As of fiscal year 2017, VA primarily receives funding for all health care it provides or purchases through the following appropriation accounts: Medical Services: health care services provided to eligible veterans and other beneficiaries in VA facilities and non-VA facilities, among other things. Medical Community Care: health care services that VA authorizes for veterans and other beneficiaries to receive from community providers. Medical Support and Compliance: the administration of the medical, hospital, nursing home, domiciliary, supply, and research activities authorized under VA’s health care system, among other things. Medical Facilities: the operation and maintenance of VHA’s capital infrastructure, such as the costs associated with nonrecurring maintenance, leases, utilities, facility repair, laundry services, and groundskeeping, among other things. Separate from VA’s health care appropriation accounts, the Veterans Access, Choice, and Accountability Act of 2014 provided $10 billion in funding for the Choice Program, which was implemented in early fiscal year 2015 and authorized until funds were exhausted or through August 7, 2017, whichever occurred first. However, VA received additional authority and funding to maintain the Choice Program through June 6, 2019, when the new Veterans Community Care Program is expected to go into effect. VA expects that the new Veterans Community Care Program will be primarily funded through the Medical Community Care appropriation account. VA Obligations for and Number of Veterans Authorized to Use Community Care Have Grown from Fiscal Year 2014 through Fiscal Year 2018 VA’s Obligations for Community Care Increased by Over 80 Percent from Fiscal Years 2014 through 2018, and VA Estimates Obligations Will Grow an Additional 20 Percent through 2021 Our analysis of VA budget justification data shows that from fiscal year 2014 through fiscal year 2018, the total amount VA actually obligated for community care increased 82 percent, from $8.2 billion to $14.9 billion. Since VA implemented the Choice Program in fiscal year 2015, the share of VA’s obligations for community care relative to VA’s total obligations for health care services increased through fiscal year 2018, from about 14 to 19 percent of VA’s total obligations for health care services. By fiscal year 2021, VA estimates that the total amount obligated for community care will increase to $17.8 billion, an increase of about 20 percent from the $14.9 billion in actual obligations for fiscal year 2018. (See fig. 2.) As figure 2 shows, the largest increase in actual obligations for community care occurred from fiscal years 2015 through 2016, when they increased by $3.4 billion, from $8.9 billion to $12.3 billion. According to VA officials, this increase in obligations during this period reflected veterans’ expanded use of community care through the Choice Program, as more providers participated in the provider networks established by third-party administrators or entered into provider agreements with VA facilities. (Fig. 3 provides information on VA’s obligations for community care by the Choice Program and by other community care programs.) The increase in actual obligations for community care from fiscal year 2016 through fiscal year 2017 was also largely due to expanded use of community care through the Choice Program. VA officials attributed this increase to efforts to obligate as much of the available Choice Program funding as possible before the anticipated end of the Choice Program in August of 2017. From fiscal years 2017 through 2018, obligations for community care continued to increase, but the increase was partially due to greater use of other community care programs, according to VA officials. From fiscal years 2014 through 2018, the increases in total actual obligations for VA community care were driven largely by increases in obligations for outpatient and inpatient services. Over this time period, VA’s actual obligations for outpatient services increased by $2 billion, from $2.3 billion to $4.3 billion, and actual obligations for inpatient services increased by $818 million, from $1.8 billion to $2.7 billion. Figure 4 illustrates how outpatient and inpatient services accounted for most of VA’s total community care obligations for fiscal year 2018. VA estimated that from fiscal years 2019 through 2021, obligations for community care will increase to $17.8 billion, which VA officials said are attributable to the new eligibility criteria under the VA MISSION Act. The authority for the Choice Program ends June 6, 2019, after which the new Veterans Community Care Program—which consolidates VA’s community care programs under the VA MISSION Act—will be expected to begin. For comparison purposes, the largest increase in obligations for services provided at VA medical facilities is estimated to occur between fiscal years 2020 and 2021. VA officials said this increase is attributable, in part, to efforts related to hiring and telehealth in response to the eligibility criteria under the VA MISSION Act. The Number of Veterans Authorized to Use Community Care Increased about 40 Percent from Fiscal Years 2014 through 2018 Our analysis of VA data on authorizations for community care shows that the number of veterans authorized to use community care increased 41 percent from fiscal years 2014 through 2018. (See fig. 5.) The approximately 1.8 million veterans authorized to use community care in 2018 represented about 30 percent of all veterans accessing VA health care services that year (approximately 6.2 million veterans). By fiscal year 2021, VA officials told us that they estimate that at least 1.8 million veterans will still use community care. Our analysis of VA data also shows that after being authorized for care, veterans’ utilization of certain community care services increased from fiscal years 2014 through 2018. Over this time period, a number of outpatient services experienced increases of more than 200 percent in utilization, especially chiropractic visits (418 percent, from 143,000 to 743,000 visits), physical therapy visits (252 percent, from 857,000 to 3 million visits), and non-mental health related office visits (243 percent, from 651,000 to 2.2 million visits). In comparison, our analysis found relatively smaller increases in veteran utilization for certain inpatient services. For example, the utilization for surgical inpatient stays increased about 39 percent—from 253,000 to 352,000 bed days. VA Updated Its Projection Model to Develop Most of Its Community Care Budget Estimate; Subsequent Changes Reflect More Current Information and Other Factors VA first developed a separate budget estimate for community care to inform the President’s fiscal year 2017 budget request. Beginning with the President’s fiscal year 2018 budget request, VA updated its EHCPM to develop over 75 percent of its community care budget estimate and used other methods to develop the remainder. Subsequent changes were made to the community care budget estimates developed by the EHCPM for fiscal years 2018 and 2019 through successively higher levels of review in VA and OMB. VA First Developed a Separate Budget Estimate for Community Care as Part of the President’s Fiscal Year 2017 Budget Request for VA VA first developed a separate budget estimate of the resources it would need for community care—as distinct from the care provided in VA medical facilities—in order to inform the President’s fiscal year 2017 budget request for VA. Prior to this fiscal year 2017 budget request, VA developed a single budget estimate of the resources needed to provide all VA health care services, regardless of whether these services were purchased from community providers or delivered in VA medical facilities, because all these services were to be funded through the same appropriation account. According to VA officials, at the time a separate community care appropriation account and budget estimate were unnecessary, because community care accounted for a relatively small portion of VA’s overall health care budget. However, once the medical community care appropriation account was established in fiscal year 2017, VA began developing a separate budget estimate for community care, as required by law. To develop its first estimate of the resources needed for community care for fiscal year 2017, VA made adjustments to existing estimates for total demand for care—both in VA medical facilities and community care combined—developed by the EHCPM. At the time, VA used the EHCPM to estimate the resources needed to provide VA health care services to veterans, including inpatient, outpatient, and long-term care. However, the EHCPM did not make separate estimates for community care and care provided at VA facilities; according to VA officials, VA adjusted the EHCPM estimates by assuming that for each service, the share of total utilization and costs devoted to community care would be the same as they had been in the most recently completed fiscal year. In addition, after this adjustment, VA made additional changes to the community care budget estimate, which resulted in a net increase of $2.5 billion. Nearly all of this increase reflected an anticipated impact of the expanded access under the Choice Program, according to VA officials. Overall, this approach accounted for about 75 percent of the $12.3 billion community care budget estimate that informed the President’s budget request for fiscal year 2017. To develop the remaining portion of its community care budget estimate, VA used methods other than the EHCPM that, according to VA officials, were used historically to develop estimates of the resources needed for the state home per diem program and benefit programs. For example, VA develops budget estimates for certain services under the state home per diem program by creating projections of the amount of care to be provided using information about the size and demographic characteristics of the enrolled veteran population and projections of the unit cost of providing one day of care using recent cost experience. According to VA officials, VA was able to continue using these other methods, because the services under these programs have been provided through community providers and not VA medical facilities. While methods for each program vary, in general, these methods are based on each program’s historical utilization and costs. (See app. II for additional information on the methods VA uses to develop the budget estimates for each of these community care programs.) Beginning with the President’s Fiscal Year 2018 Budget Request, VA Updated Its Projection Model to Develop over 75 Percent of Its Community Care Budget Estimate Beginning with the President’s fiscal year 2018 budget request, VA updated its EHCPM directly to estimate most of the resources needed to purchase community care for veterans. Specifically, VA updated the EHCPM to estimate the amount of resources needed to purchase a set of more than 40 community care services that have accounted for over 75 percent of VA’s total community care budget estimates of $12.6 billion for fiscal year 2018 and $12.4 billion for fiscal year 2019. These health care services were grouped into seven service types and include outpatient care, inpatient care, and long-term care. (See app. III for a list of the health care services). Of these services, outpatient services typically accounted for the largest share of VA’s community care budget estimate. For the remainder of community care services—including services provided under the state home per diem program and benefit programs— VA did not use the EHCPM and instead continued to use the other methods it has historically used to develop budget estimates for these services. (See fig. 6.) VA made several changes to the EHCPM to develop most of its community care budget estimate. Historically, the EHCPM estimated resources needed to meet the total expected demand for VA health care—a combination of care provided in VA medical facilities and through community care programs. VA updated the EHCPM to determine the proportion of demand met by community care by projecting enrolled veterans’ expected utilization of community care and the expected costs of purchasing these services. In what follows, we describe five major changes made to the EHCPM allowing VA to estimate the budgetary resources needed for community care. 1. Reliance on community care services. The EHCPM has historically accounted for the extent to which enrolled veterans would be projected to obtain health care services through the VA as opposed to other health care programs or insurers—referred to as reliance on VA health care. VA updated the EHCPM so that it can further account for the extent to which enrolled veterans would be expected to use VA’s community care programs as opposed to using care in VA’s medical facilities. Each year, the EHCPM determines reliance on VA community care based on a combination of historical experience—or the extent to which community care was used in prior fiscal years— and on the projected impact of new VA policies and operational guidance. For example, for the fiscal year 2019 budget estimates, the EHCPM projected reliance on VA care to be about 38 percent, of which 14 percent would be met through community care. Thus, the EHCPM projected reliance on VA’s community care programs to be about 5.3 percent for all care enrolled veterans are projected to use in fiscal year 2019. 2. Accounting for difference in community providers’ efficiency delivering inpatient services. VA also updated the EHCPM so that community care utilization projections account for the fact that veterans receiving inpatient care through community providers generally have relatively shorter lengths of inpatient stays compared with veterans receiving care at VA medical facilities. According to officials from VA and its actuarial consultant, community providers on average have historically performed better than VA providers on national benchmarks measuring how well providers manage the length of inpatient stays, while not affecting quality of care. To account for this difference, VA uses an adjustment factor when projecting utilization of inpatient services based on potentially avoidable days of care for community providers. 3. Comparing projected utilization with actual utilization for community care services. VA developed an adjustment factor for the EHCPM’s utilization estimates to account specifically for the differences between projected utilization and actual utilization of community care for the most recently completed fiscal year of data. According to VA officials, the difference typically reflects utilization behavior among providers or patients that are difficult to estimate based solely on historical data—such as changes in local practice patterns (e.g., providers choosing to use magnetic resonance imaging versus x-rays). To account for this behavior, VA compares projected and actual utilization and creates an “actual-to-expected” adjustment factor for each health care service to account for the difference. 4. Projecting unit costs for community care services. VA updated the EHCPM so that it could estimate what are known as the unit costs of purchasing community care services for veterans. In general, the unit cost of a community care service comprises the payment made to the provider (known as direct patient costs), as well as the indirect costs associated with administration and overhead. Indirect costs include (1) the fees paid to the contractors for administrative responsibilities for the Choice Program, (2) VA billing and processing costs and care coordination costs associated community care programs, and (3) certain costs associated with the VA Central Office that support community care (e.g., the salaries for officials from the Office of Community Care and other VA Central Office officials). 5. Accounting for community care service complexity and inflation. VA made other changes to the EHCPM’s unit cost projections for community care. For example, VA updated the EHCPM so that it accounts for costs associated with changes in the complexity—that is, the level of resources required to deliver—of health care services VA purchases from community providers. Officials from VA and its actuarial consultant noted that more complex services require relatively more resources to deliver, such as more expensive equipment (e.g., magnetic resonance imaging); more provider time; or higher-cost providers, such as surgeons. Officials anticipate that most services that VA purchases in the community will increase in complexity, leading to higher projected unit-costs for community care. VA also updated the EHCPM so that its unit cost estimates for community care account for inflation in the cost of labor and equipment. VA’s Community Care Budget Estimates Projected by the Model for Fiscal Years 2018 and 2019 Were Subsequently Changed to Reflect More Current Information, Among Other Factors VA’s community care budget estimates are reviewed at successively higher levels at VA and OMB to inform the President’s budget request for VA. VA identified several changes made during the review process to its estimates projected by the EHCPM for fiscal years 2018 and 2019; these changes were due to the availability of more current information related to utilization and costs, among other factors. For fiscal year 2018, changes resulted in a budget request for VA community care in the President’s budget request that was approximately $1 billion lower than VA’s original EHCPM budget estimate of $10.7 billion. These changes included the following: A $996 million decrease reflecting the availability of more current information showing that an anticipated increase in utilization due to the Choice Program was too high. A $600 million decrease reflecting the availability of more current information showing that overhead costs initially allocated to community care in the data used in the EHCPM were too high. A $180 million decrease accounting for VA’s implementation of a new law that reduces VHA’s use of community care for examinations determining veterans’ disability ratings. A $500 million increase accounting for a court ruling that affected veteran eligibility for reimbursement of emergency community care, which was expected to increase utilization. A $250 million increase reflecting the availability of more current information that indicated administrative costs for the Choice Program in the data used in the EHCPM were too low. For fiscal year 2019, changes resulted in a budget request for VA community care in the President’s budget request that was nearly $1 billion higher than VA’s original EHCPM budget estimate of $8.6 billion. These changes included the following: A $1.7 billion increase reflecting more current information indicating that community care administrative costs and the utilization levels in the data used in the EHCPM were too low. A $1 billion increase accounting for a delay in the timing of the implementation of community care network contracts. According to VA officials, this resulted in the continued use of reimbursement rates in community care that were higher than Medicare reimbursement rates. A $1.8 billion decrease that reflected VA’s implementation of a new policy that changed the timing of community care obligations from when a veteran is authorized to use community care to the when a claim for actual services is paid. VA’s Actual Obligations for Community Care in Fiscal Years 2017 and 2018 Were Higher than Estimated and Included Additional Funding Received for the Choice Program VA’s Actual Obligations for Community Care in Fiscal Years 2017 and 2018 Were $1.2 Billion and $2.2 Billion Higher than Estimated, Respectively Our analysis of data included in VA’s budget justifications shows that in fiscal years 2017 and 2018, VA obligated $1.2 billion and $2.2 billion more for community care than originally estimated at the time of the President’s budget requests for those years. In both years, VA’s actual obligations for both the Choice Program and other community care programs were higher than estimated. (See table 3.) According to VA officials, the higher-than-estimated obligations for the Choice Program for fiscal year 2017 were driven, in part, due to changes in Choice Program policies and a large increase in the cost per authorization for care. In the case of other community care programs, VA officials told us that the higher-than-estimated obligations for both fiscal years 2017 and 2018 were driven, in part, by local practice patterns (e.g., providers choosing to use magnetic resonance imaging versus x-rays) and the capacity of VA medical facilities to provide services. As discussed later in this report, VA also received and reallocated additional funding to purchase community care in fiscal years 2017 and 2018, which contributed to actual obligations being higher-than-estimated obligations. Our analysis of VA’s obligations by service type shows that in fiscal year 2017, VA’s higher-than-estimated obligations for community care were primarily for outpatient and inpatient services, as shown in table 4. In fiscal year 2018, the higher-than-estimated obligations for community care were primarily for outpatient services, while there was an overall decrease in obligations for inpatient services. (See table 5.) Additionally, for some service types, VA’s actual obligations were lower than estimated in fiscal years 2017 and 2018. VA’s Higher-Than- Estimated Obligations for Community Care Included Additional Funding VA Received for the Choice Program Outside of the Annual Appropriations Process To obligate $13.6 billion for community care in fiscal year 2017 and $14.9 billion in fiscal year 2018—amounts that were $1.2 billion and $2.2 billion higher, respectively, than what VA originally estimated for its budget request, and what VA received in its annual appropriation—VA requested and received additional Choice Program funding outside of the annual appropriations process. VA also reallocated funding from other sources, including unobligated funding from a prior fiscal year and collections, to pay for the other community care programs. Specifically, the $13.6 billion and $14.9 billion VA obligated for community care in fiscal years 2017 and 2018, respectively, came from the following sources: Choice Program. For both fiscal years, VA obligated from its remaining funding and prior-year recoveries from the previous fiscal years, and requested and received additional funding three times outside of the annual appropriations process. (Table 6 below summarizes the time frames during which VA requested and received additional appropriations for the Choice Program outside of the annual appropriations process for fiscal years 2017 and 2018.) Other community care programs. For both fiscal years, VA obligated from its annual appropriation and transferred a portion of its overall collections from its Medical Care Collections Fund to the medical community care account. In addition, for fiscal year 2018, VA used unobligated funding and prior-year recoveries from fiscal year 2017. Agency Comments We provided a draft of this product to VA and OMB for comment. VA provided technical comments, which we incorporated as appropriate. OMB had no comments. We are sending copies of this report to the Secretary of Veterans Affairs, the Director of the Office of Management and Budget, appropriate congressional committees, and other interested parties. This report is also available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7114 or silass@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix V. Appendix I: The Department of Veterans Affairs’ Community Care Programs for Veterans and Other Eligible Beneficiaries While the majority of veterans utilizing Department of Veterans Affairs’ (VA) health care services receive care in VA-operated medical facilities, veterans may also obtain services from non-VA providers in the community—known as community care—through one of several community care programs aimed at helping to ensure that veterans receive timely and accessible care. In implementing the VA MISSION Act, VA plans to consolidate four of its community care programs for veterans—dialysis contracts, individually authorized care, the Patient- Centered Community Care Program, and the Veterans Choice Program— under the Veterans Community Care Program, which is expected to go into effect by June 2019. In addition, VA has several other community care programs that serve veterans and programs that provide health care services to other eligible beneficiaries, including a veteran’s spouse or dependent child. Community Care Programs for Veterans that VA Plans to Consolidate Dialysis contracts. When dialysis services—a life-saving medical procedure for patients with permanent kidney failure—are not feasibly available at VA medical facilities, veterans may be referred to one of VA’s contracted dialysis providers, and veterans may receive dialysis at local clinics on an outpatient basis, or at home (if the contractors offer home- based dialysis services). Individually authorized care. When a veteran cannot access a particular specialty care service from a VA medical facility—either because the service is not offered, the veteran would have to wait too long for an appointment, or the veteran would have to travel a long distance to a VA medical facility—VA medical facility staff may request an individual authorization for the veteran to obtain the service from a community provider who is willing to accept VA payment. Patient-Centered Community Care. VA contracted with two third-party administrators to develop regional networks of community providers of specialty care, mental health care, limited emergency care, and maternity and limited newborn care when such care is not feasibly available from a VA medical facility. To be eligible to obtain care from Patient-Centered Community Care providers, veterans must meet the same criteria that are required for individually authorized care. Veterans Choice Program. VA modified its Patient-Centered Community Care contracts with the two third-party administrators to implement the Veterans Choice Program. This program allows eligible veterans to obtain health care services from community providers if the veteran meets certain criteria, including when a veteran cannot receive care within 30 days from the veteran’s or physician’s preferred date, or face an unusual or excessive burden in traveling to a VA medical center. Other Community Care Programs for Veterans Agreements with federal partners and academic affiliates. When services are not available at VA medical facilities, VA may obtain specialty, inpatient, and outpatient health care services for veterans through different types of sharing agreements—those with other federal facilities (such as those operated by the Department of Defense and the Indian Health Service), those with Tribal Health Programs, and those with university-affiliated hospitals, medical schools, and practice groups (known as academic affiliates). Emergency care. When emergency community care is not preauthorized, VA may reimburse community providers for emergency care for eligible veterans for a condition related to a service-connected disability, and for eligible veterans for a condition not related to a service- connected disability. Foreign Medical Program. The Foreign Medical Program is VA’s health care benefits program for eligible veterans who are residing or traveling abroad and have a service-connected disability. State Home Per Diem Program. Under the State Home Per Diem Program, states provide care for eligible veterans in three different types of programs: nursing home, domiciliary, and adult day health care. Community Care Programs for Other Beneficiaries Camp Lejeune Family Member Program. The Camp Lejeune Family Member Program is for family members of veterans that lived or served at U.S. Marine Corps Base Camp Lejeune, North Carolina, for no fewer than 30 days between January 1, 1957, and December 31, 1987, and were potentially exposed to drinking water contaminated with industrial solvents, benzene, and other chemicals. The program provides health care to veterans who served on active duty at Camp Lejeune and to reimburse eligible Camp Lejeune family members for health care costs related to one or more of 15 specified illnesses or medical conditions specified in law. Children of Women Vietnam Veterans Health Care Benefits Program. This program provides health care benefits to female Vietnam veterans’ birth children who the Veterans Benefits Administration has determined to have a covered birth defect. This program is not a comprehensive health care plan and only covers those services necessary for the treatment of a covered birth defect and associated medical conditions. Civilian Health and Medical Program of the Department of Veterans Affairs (CHAMPVA). CHAMPVA is a comprehensive health care program that provides health care coverage for spouses, children and primary caregivers of veterans who are permanently and totally disabled from a service-connected disability. CHAMPVA functions similarly to traditional health insurance, with most care in the program delivered using non-VA community providers. Spina Bifida Health Care Benefits Program. This program provides health care benefits to certain Korea and Vietnam veterans’ birth children who have been diagnosed with spina bifida. Appendix II: Budget Formulation Process for the State Home Per Diem Program and Non- Veteran Community Care Programs The Department of Veterans Affairs (VA) and its actuarial consultant use the Enrollee Health Care Projection Model to develop most of the department’s estimate of the resources needed to meet the expected demand for VA’s health care services. VA uses other methods to estimate the remaining resources needed. This remaining portion includes community care programs for veterans and other eligible beneficiaries, including the State Home Per Diem Program and the Civilian Health and Medical Program of the Department of Veterans Affairs (CHAMPVA). State Home Per Diem Program. This program pays per diem for state- provided care for eligible veterans in three different types of programs: domiciliary, nursing home, and adult day health care. For state home domiciliary and nursing care, categorized as institutional care, VA creates budget projections based on historical funding data. For state home adult day health care, categorized as non-institutional care, VA’s budget estimates are based on projections of the amount of care provided— which is known as workload—and the unit cost of providing a day of this care. VA projects the demand for non-institutional care services using information about the size and demographic characteristics of the enrolled veteran population. VA projects unit cost for non-institutional care services by calculating unit-cost increases observed from recent experience and then using this information to project future unit costs. VA multiplies the workload estimates, unit-cost estimates, and the number of days in the fiscal year to develop an estimate of the amount of resources needed for non-institutional care. CHAMPVA. CHAMPVA provides health care coverage for spouses and children of veterans who are permanently and totally disabled from a service-connected disability. CHAMPVA functions similarly to traditional health insurance—most care within CHAMPVA is delivered using non-VA community providers. Therefore, developing estimates of the resources needed for CHAMPVA requires factoring in utilization patterns and cost inflation that are generally outside of VA’s control. Budget estimates for CHAMPVA are developed using a formula that computes the predicted number of users and costs per-member per-year. VA works with its actuarial consultant to generate projections of CHAMPVA users that incorporate changes related to the population of disabled veterans and projections of expected increases and decreases in the CHAMPVA- eligible population. In addition, the actuarial consultant projects the costs per-member per-year, which is calculated by dividing the most current fiscal year data on total CHAMPVA expenditures by the number of actual users. Trends are then incorporated to predict the future costs per- member per-year, which is multiplied by projections of the number of CHAMPVA users to develop CHAMPVA budget estimates. Appendix III: Health Care Services included in the Enrollee Health Care Projection Model for Fiscal Year 2019 Using its Enrollee Health Care Projection Model (EHCPM), the Department of Veterans Affairs (VA) developed estimates for 79 health care services—available in VA medical facilities or through community care—for the fiscal year 2019 President’s budget request. As shown in table 7, VA developed separate estimates for the 43 services that were available through community care. Some of these 43 services were only available through community care. These services were primarily long- term care, including nursing home care provided at community nursing homes, home hospice care, home respite care, homemaker or home health aid programs, and purchased skilled nursing care. Appendix IV: Community Care Data Sources in the Department of Veterans Affairs’ Enrollee Health Care Projection Model The Department of Veterans Affairs (VA) and its actuarial consultant use the Enrollee Health Care Projection Model (EHCPM) to develop most of the department’s budget estimate to meet the expected demand for VA’s health care services. This estimate includes the services that VA purchases from non-VA community providers through its various community care programs, including the Veterans Choice Program (Choice Program). Based on our interviews with various VA officials, VA’s Office of Enrollment and Forecasting provided utilization and cost data from fiscal year 2016 community care claims from four different sources for use in the 2017 EHCPM, which was used to project the fiscal year 2019 budget estimate. (See fig. 7.) Specifically, the Office of Enrollment and Forecasting—which is responsible for compiling the claims data used in the EHCPM—obtained community care claims data, including Choice Program claims, from VA’s Fee Basis Claims System. In addition, the Office of Enrollment and Forecasting worked with VA’s Allocation Resource Center to gather additional utilization and cost data from Choice Program claims processed outside the Fee Basis Claims System, and other data needed for the 2017 EHCPM. Specifically, the Allocation Resource Center compiled claims data for those Choice Program claims paid through expedited payments. The Allocation Resource Center also pulled data on dual eligible veterans, from the Department of Defense’s Medical Data Repository, and indirect costs associated community care claims (for example, costs associated with care coordination or claims processing) from VA’s Managerial Cost Accounting system. Appendix V: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Rashmi Agarwal (Assistant Director), Aaron Holling (Analyst-in-Charge), Chad Clady, and Kate Tussey made key contributions to this report. Also contributing were Krister Friday, Jacquelyn Hamilton, and Muriel Brown. Related GAO Products Veterans Choice Program: Further Improvements Needed to Help Ensure Timely Payments to Community Providers. GAO-18-671. Washington, D.C.: September 28, 2018. Veterans Choice Program: Improvements Needed to Address Access- Related Challenges as VA Plans Consolidation of its Community Care Programs. GAO-18-281. Washington, D.C.: June 4, 2018. VA’s Health Care Budget: In Response to a Projected Funding Gap in Fiscal Year 2015, VA Has Made Efforts to Better Manage Future Budgets. GAO-16-584. Washington, D.C.: June 3, 2016. Veterans’ Health Care: Proper Plan Needed to Modernize System for Paying Community Providers. GAO-16-353. Washington, D.C.: May 11, 2016. Veterans’ Health Care Budget: Improvements Made, but Additional Actions Needed to Address Problems Related to Estimates Supporting President’s Request. GAO-13-715. Washington, D.C.: August 8, 2013. Veterans’ Health Care: Improvements Needed to Ensure That Budget Estimates Are Reliable and That Spending for Facility Maintenance Is Consistent with Priorities. GAO-13-220. Washington, D.C.: February 22, 2013. Veterans’ Health Care Budget: Better Labeling of Services and More Detailed Information Could Improve the Congressional Budget Justification. GAO-12-908. Washington, D.C.: September 18, 2012. Veterans’ Health Care Budget: Transparency and Reliability of Some Estimates Supporting President’s Request Could Be Improved. GAO-12-689. Washington, D.C.: June 11, 2012. VA Health Care: Estimates of Available Budget Resources Compared with Actual Amounts. GAO-12-383R. Washington, D.C.: March 30, 2012. VA Health Care: Methodology for Estimating and Process for Tracking Savings Need Improvement. GAO-12-305. Washington, D.C.: February 27, 2012. Veterans’ Health Care Budget Estimate: Changes Were Made in Developing the President’s Budget Request for Fiscal Years 2012 and 2013. GAO-11-622. Washington, D.C.: June 14, 2011. Veterans’ Health Care: VA Uses a Projection Model to Develop Most of Its Health Care Budget Estimate to Inform the President’s Budget Request. GAO-11-205. Washington, D.C.: January 31, 2011. VA Health Care: Challenges in Budget Formulation and Issues Surrounding the Proposal for Advance Appropriations. GAO-09-664T. Washington, D.C.: April 29, 2009. VA Health Care: Challenges in Budget Formulation and Execution. GAO-09-459T. Washington, D.C.: March 12, 2009. VA Health Care: Long-Term Care Strategic Planning and Budgeting Need Improvement. GAO-09-145. Washington, D.C.: January 23, 2009. VA Health Care: Budget Formulation and Reporting on Budget Execution Need Improvement. GAO-06-958. Washington, D.C.: September 20, 2006.


Background VA’s Current Disability Compensation Appeals Process VA’s process for deciding veterans’ eligibility for disability compensation begins when a veteran submits a claim to VA. Staff in one of VBA’s 57 regional offices assist the veteran by gathering additional evidence, such as military and medical records, that is needed to evaluate the claim. Based on this evidence, VBA decides whether the veteran is entitled to compensation and, if so, how much. A veteran dissatisfied with the initial claim decision can generally appeal within 1 year from the date of the notification letter sent by VBA. Under the current appeals process (now referred to by VA as the legacy process), an appeal begins with the veteran filing a Notice of Disagreement. VBA then re-examines the case and generally issues a Statement of the Case that represents its decision. A veteran dissatisfied with VBA’s decision can file an appeal with the Board. In filing that appeal, the veteran can indicate whether a Board hearing is desired. Before the Board reviews the appeal, VBA prepares the file and certifies it as ready for Board review. If the veteran requests a hearing to present new evidence or arguments, the Board will hold a hearing by videoconference or at a local VBA regional office. The Board reviews the evidence and either issues a decision to grant or deny the veteran’s appeal or refers the appeal back to VBA for further work. VA’s New Appeals Process According to VA’s appeals plan, VA intends to implement the Act by February 2019, by replacing the current appeals process with a process offering veterans who are dissatisfied with VBA’s decision on their claim five options. Two of those options afford the veteran an opportunity for an additional review of VBA’s decision within VBA, and the other three options afford them the opportunity to bypass additional VBA review and appeal directly to the Board. Under the new appeals process, the two VBA options will be: 1. Request higher-level review: The veteran asks VBA to review its initial decision based on the same evidence but with a higher-level official reviewing and issuing a new decision. 2. File supplemental claim: The veteran provides additional evidence and files a supplemental claim with VBA for a new decision on the claim. The veteran can also request a VBA hearing. The three Board options will be: 3. Request Board review of existing record: The veteran appeals to the Board and asks it to review only the existing record without a hearing. 4. Request Board review of additional evidence, without a hearing. 5. Request Board review of additional evidence, with a hearing. In November 2017, VA initiated a test of the new VBA higher-level review and supplemental claim options. According to VA’s appeals plan, a purpose of this test—the Rapid Appeals Modernization Program (RAMP)—is to reduce legacy appeals by providing veterans with a chance for early resolution of their claims within VBA’s new process. Participation in RAMP is voluntary, but veterans must withdraw their pending legacy appeal to participate, according to VA’s appeals plan. VA Has Not Provided Complete Information on Four Elements in the Act In our March 2018 report, we found that VA’s November 2017 plan for implementing a new disability appeals process while attending to appeals under way in the current (legacy) process, addressed 17 of 22 elements required by the Act. For the 5 remaining elements, we found that it partially addressed 4 elements related to implementation monitoring, productivity projecting, and workforce planning, and did not address 1 element related to identifying total resources. This element called for delineating the resources needed by VBA and the Board to implement the new appeals process and address legacy appeals. We recommended in March 2018 that VA address all 22 required elements in the Act in VA’s appeals plan to Congress—including delineating resources required for all VBA and Board appeals options— using sensitivity analyses and results from its test, RAMP, where appropriate and needed. Since our March 2018 report, VA has taken some action on each of the five elements that we found were not fully addressed at that time. For example, VA added details related to projecting staff productivity, identifying total resources, as well as determining personnel requirements and productivity projections for processing appeals. For identifying total resources, VA added FTE information for other offices that help implement the appeals process and prepared a model to project resource needs. Although VA now addresses the 1 element related to projecting productivity, it only partially addresses 4 elements related to monitoring implementation, workforce planning, and delineating the total resources. For example, as of November 2018, VA’s plan does not contain metrics for monitoring implementation. Moreover, for total resources, the updated plan does not delineate the total resources required by VBA and the Board, such as the resources necessary for information technology and training. We acknowledge that in some cases delineating total resources could prove challenging, such as delineating information technology resources for the legacy and new appeals processes. We also acknowledge that implementing corrective actions to fully address these 4 elements may be challenging within the next several weeks, but we continue to believe VA has an opportunity to further address these 4 elements as part of certifying the agency’s readiness prior to the full implementation of the new process. VA Has Addressed Some Gaps in Its Plans to Monitor and Assess Performance, though Further Steps Remain In our March 2018 report, we found gaps in VA’s planning for how it will monitor and assess performance of the new appeals process when it is implemented. Specifically, we reported that the plan did not (1) establish timeliness goals for two of the three Board options (i.e., Board review of additional evidence without a hearing and Board review of additional evidence with a hearing); (2) articulate aspects of performance important for managing appeals, such as accuracy of decisions, veteran satisfaction with the process, or cost; (3) explain how the performance of the new appeals process would be compared to that of the legacy process; or (4) explain how the agency would monitor relative workloads of, and resources devoted to, the new and legacy appeals processes. To address these gaps, we recommended that VA clearly articulate in its appeals plan how VA will monitor and assess the new appeals process compared to the legacy process, including specifying a balanced set of goals and measures—such as timeliness goals for all VBA appeals options and Board dockets, and measures of accuracy, veteran satisfaction, and cost—and related baseline data. Articulating a balanced set of goals that cover key aspects of managing appeals is important to avoid promoting skewed behaviors (e.g., favoring timeliness over accuracy) and to fully understanding performance. In its progress reports, VA addressed some but not all aspects of this recommendation (see table 1). VA has made progress in monitoring performance and addressing workload changes in its new and legacy appeals processes, but still lacks a complete set of balanced goals and measures. As we noted in our July 2018 testimony, VA has developed sensitivity models and other analyses to monitor and forecast future VBA and Board workloads, production, and staffing requirements to help VA manage the legacy and new appeals processes. However, VBA and the Board have yet to specify a complete set of balanced goals for monitoring the performance of the new appeals processes. According to the November 2018 progress report, the Board plans to develop timeliness goals after VA fully implements the new appeals process. Until VA fully develops a set of balanced goals and measures, the agency risks not fully understanding how well the reforms are performing. Regarding comparing the performance of the new and legacy appeals processes, VA has previously reported that the agency plans to implement the reporting requirements in section 5 of the Act. This section requires VA to report performance measures related to, among other things, timeliness, productivity, and outcomes, without specifying whether or how VA should compare performance of the new versus legacy processes. In November 2018, VBA and Board officials told us they intend to use timeliness and productivity metrics from section 5 to compare the two processes. However, in its updated plans to date, VA has been reporting average timeliness of decisions made to date under RAMP—VA’s test of the two VBA options—without reporting the average time cases are pending. Moreover, VA has not been reporting timeliness data on both decisions and pending cases according to the month that they entered into RAMP, which present a more balanced indication of performance and trends. In November 2018 VBA and Board officials told us they would consider reporting timeliness using a monthly cohort that reflects when appeals were filed. VBA and Board officials also said they have taken steps to collect, through surveys, comparable information on veterans’ satisfaction with the new and legacy appeals processes. According to VBA and Board officials, they have pre-tested the surveys—which is considered a best practice by survey methodologists—and are coordinating the survey efforts with one another. VBA and Board officials also told us that the agency will report on accuracy and outcomes (grants and denials of claims) in the new process. However, they also stated that these measures would not provide a fair comparison with the legacy process because the Act eliminated several of the requirements formerly required in the legacy appeals administrative processes. Although VA officials said they would develop a plan for comparing the performance of the two appeals processes after the new process is fully implemented, they did not indicate how soon they would do so. Developing such a plan would better position the agency to fully understand whether the new process is an improvement. VA Has Augmented Its Master Schedule to a Limited Extent Our March 2018 report identified elements of a high-quality and reliable implementation schedule that were missing from VA’s master schedule for appeals reform. Specifically, we reported that VA’s high-level master schedule—which the agency included with its November 2017 plan—did not (1) include all key activities; (2) show which activities must finish prior to the start of other activities, or the amount of time an activity could be delayed before the delay affects VA’s estimated implementation date; (3) reflect interim goals and milestones for monitoring implementation; or (4) assign resources for activities. We recommended that VA augment the master schedule for its appeals plan to reflect all activities—such as modifications to information technology systems—as well as assigned responsibilities, interdependencies, start and end dates for key activities for each workgroup, and resources. These steps establish accountability and reduce overall risk of implementation failures. In response to our recommendation, the Board, VBA and other VA administrations made progress over time with developing and integrating underlying plans into the integrated master schedule (IMS) in spring and summer 2018. According to VA officials, VA set a baseline schedule for implementing appeals reform in response to the potential February 2019 implementation date established in the Act. Since November 2017, VA’s plan and progress reports have stated that VA uses an agency-wide governance structure to coordinate implementation, and regularly uses the schedule as a management tool for monitoring progress on appeals reform. For example, the Board’s project manager meets regularly with those responsible for major activities to check progress, including weekly meetings with leadership, and identifies and corrects issues related to schedule execution. In October 2018, VA provided us with lower-level schedules and information that allowed us to conduct a more detailed assessment of VA’s IMS against applicable best practices criteria. The six criteria we assessed lower-level schedules against were: Capturing all activities: schedule should reflect all activities necessary to perform work to accomplish a project’s objective. Sequencing activities: activities should be logically sequenced in the order they are to be carried out so that critical program dates can be met. Assigning resources: schedule should reflect all resources necessary to complete work, verify whether resources will be available, and identify any constraints. Verifying horizontal and vertical traceability: schedule should be rational and logically sequenced, account for interdependencies among activities, and provide a way to evaluate the current status (horizontal traceability). Also, the various levels of a schedule— summary, intermediate, and detailed—should be consistent with one another and enable different teams to work to the same schedule expectations (vertical traceability). Updating the schedule using actual progress and logic: maintain and continually update the schedule to reflect a realistic forecast of start and end dates of activities. Maintaining a baseline schedule: use original configuration of the program plan as a point of comparison for the current plan to manage scope, timeframes, and required resources. We found that, while VA has made progress with providing more detail, its master and underlying schedules only minimally met sound practices for project management. Specifically, as with our March 2018 assessment, we found that the schedule does not contain enough detail to manage the work or provide a realistic representation of the resources and time needed for this project. For example, the schedule did not contain a work breakdown structure that defines the work, activities, and resources necessary to accomplish implementation. Moreover, half of all the remaining activities are missing logic that shows which activities must finish prior to the start of other activities. In addition, the schedule contains an invalid critical path, meaning that the schedule does not present the amount of time that key activities could be delayed before such delays affect VA’s estimated implementation date. Without a valid critical path, management cannot focus on activities that will detrimentally affect the key program milestones and deliveries if they slip. To address our March 2018 recommendation, VA would need to ensure that all activities are accounted for, that scheduled activities appear in the correct order, that resources are properly allocated, that all activities appear on the critical path, and that a schedule risk analysis accounts for all risks. We provide a more detailed explanation of our assessment results in appendix I. In addition, establishing an overly optimistic schedule can reduce capacity for carrying out a project and potentially create pressure to sacrifice the quality of work activities to meet deadlines. Moreover, many of VA’s activities are slated to be concurrently completed just before implementation, posing a significant risk to implementing reform in February. For example, according to VA’s schedule, the agency needs to complete 117 activities after January 1, 2019. Further, other VA efforts to redesign or update key aspects of VA’s disability compensation process—including the Veterans Benefits Management System (VBMS)—were not driven by robust, comprehensive planning and did not achieve their schedule goals. While VA intends to start full implementation in February, we do not know the extent to which the lack of a robust schedule poses risks to successful and smooth implementation. Even if taking corrective actions to address our findings may not be feasible before February, incorporating such lessons learned into future project planning could help VA improve its project scheduling capabilities. VA Has Addressed Many, but Not All Key Risks to Implementation In our March 2018 report, we found that VA’s appeals plan could more fully assess key risks related to implementing the new appeals process. In particular, we found that VA’s plan did not include testing of new Board options or clearly define how it would assess the RAMP test of the VBA- only options before implementing them more broadly. Further, we reported that VA’s plan had not comprehensively reflected key risks because the agency had not established a complete and balanced set of goals and measures, which are a necessary pre-condition to effectively assessing risk. We recommended that VA ensure that the appeals plan more fully addresses risk associated with appeals reform by, for example, assessing risks against a balanced set of goals and measures, articulating success criteria and an assessment plan for RAMP, and testing or conducting sensitivity analyses of all five appeals options before fully implementing the new appeals process. In its progress reports, VA took many steps to address our recommendation, although key steps are remaining for VA to better assess risks associated with implementing appeals reform and managing appeals workloads in the legacy process (see table 2). Sound redesign and change management practices both suggest that tests be rigorously monitored and evaluated and that further roll-out occur only after an agency takes any needed corrective action and determines that the new process is achieving previously identified success criteria. Until VA takes these remaining steps, it may not have comprehensively addressed key risks to better position the agency for successful implementation of appeals reform. In conclusion, VA is undertaking an ambitious effort to reform its disability appeals process—while onboarding hundreds of new staff and implementing new technology—that will affect the lives of hundreds of thousands of veterans with disabilities for years to come. Consistent with our prior recommendations, VA has made concrete progress to improve its planning for disability appeals reform while it attends to legacy appeals. Efforts such as resuming sensitivity analysis to monitor workloads and testing VBA and Board appeals options will provide useful information to guide VA through the uncertainty often associated with process change. However, VA has reported it plans to fully implement the new disability appeals process in February 2019 even though it has yet to fully address our recommendations. While fully implementing our recommendations prior to February 2019 may not be feasible, doing so would better position VA to ensure successful implementation. Nevertheless, VA should still work to increase clarity around its plans prior to fully implementing reform. Moreover, many of the principles of sound planning practices that informed our recommendations remain relevant during process change. By continuing to improve its approach to performance measurement, scheduling, and risk management, even after implementation, VA could better ensure that the new process meets veterans’ needs. Chairman Roe, Ranking Member Walz, and Members of the Committee, this concludes my prepared statement. I would be pleased to respond to any questions you may have at this time. GAO Contact and Staff Acknowledgments For further information about this testimony, please contact Elizabeth H. Curda at (202) 512-7215 or curdae@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony. Other key contributors to this testimony include James Whitcomb (Assistant Director), Juaná Collymore, Michele Grgich, Sara Pelton, and Rachel Pittenger. In addition, key support was provided by Susan Aschoff, Mark Bird, Alex Galuten, Jason Lee, Sheila R. McCoy, Almeta Spencer, and Walter Vance. Appendix I: Assessment of the Extent to Which VA Followed Aspects of Scheduling Leading Practices For this testimony, we assessed the steps that the Department of Veterans Affairs (VA) has taken to address our March 2018 recommendations and what aspects remain unaddressed, including the extent to which VA is using sound practices for scheduling key projects. In summary, we identified several areas where VA’s most recent schedule falls short of sound practices. Further incorporating sound practices into future project planning could help VA improve its project scheduling capabilities. We reviewed VA’s integrated master schedule (IMS) for the appeals reform effort and underlying sub-schedules to assess them against 6 of the 10 best practices, which we determined most relevant to our March 2018 recommendation that VA augment its master schedule for VA’s appeals plan to reflect all activities—such as modifications to information technology systems—as well as assigned responsibilities, interdependencies, start and end dates for key activities for each workgroup, and resources, to establish accountability and reduce the overall risk of implementation failures. Specifically, we analyzed the following related scheduling best practices: (1) Capturing all activities, (2) Sequencing all activities, (3) Assigning resources to all activities, (4) Verifying that the schedule can be traced vertically and horizontally, (5) Updating the schedule using actual progress and logic and (6) Maintaining a baseline schedule. We assessed VA’s lower-level schedules against these 6 best practices by: Checking for specific problems that could hinder the schedule’s ability to respond to changes. For example, we: o Examined if there are any open-ended activities (i.e., activities with no predecessor and/or successors), o Searched for activities with poor logic: For example, Start to Start successor only or Finish to Finish predecessor only which represent dangling logic, or Logic on summary tasks rather than attached to detailed tasks (summary tasks are for organizing the schedule and should not drive the logic). o Looked for activities with constraints which keep the schedule rigid (e.g., start no earlier than, finish no later than, etc.), o Determined if activities were resource loaded—which helps to cost out the schedule—and examine whether resources are over- allocated or not available when needed, o Examined the schedule’s critical path to determine whether or not it was reliable and logical, o Examined schedule float and determined if it was reasonable, and o Examined whether the schedule was baselined, its status cycle, and what deviations there were from the original plan. We also determined if there were any actual start or finish dates recorded in the future and whether there was any broken logic between planned tasks. We also interviewed VA officials responsible for managing the schedule. We scored each scheduling leading practice on a five-point scale: “not met”, “minimally met”, “partially met”, “substantially met” and “fully met.” We determined the characteristic assessment rating by assigning each best practice rating a number and taking the average. Our resulting conclusions based on this assessment are as follows: VA’s project schedule minimally meets the best practice of capturing all activities. The schedule does not have well-defined start and finish milestones and there is not a project work breakdown structure (WBS) or corresponding WBS dictionary to define the work for each WBS element. We were not able to independently verify contractor work or major handoffs and deliverables in the schedule. In addition, there were activities with duplicate names, which could make communication difficult between VA teams, particularly between team members who are responsible for updating and integrating multiple schedules. VA’s project schedule minimally meets the best practice of sequencing activities. There are issues with missing dependencies, dangling activities, summary links, constraints and lags that affect the schedule meeting this best practice. Specifically, of the remaining activities, 55 percent have missing logic, over 12 percent are dangling, 42 percent have date constraints and 4 percent have leads assigned. When activities are not correctly linked, the program cannot use the integrated master schedule (IMS) to identify disconnects or hidden opportunities and cannot otherwise promote efficiency and accuracy or control the program by comparing actual to planned progress. When this happens, the schedule will not allow a sufficient understanding of the program as a whole, and users of the schedule may lack confidence in the dates and the critical path. VA’s project schedule minimally meets the best practice of assigning resources. While the schedule contains ‘Task Owner’ assignments, the Task Owner information has no effect on the durations or forecasted start and finish dates of detailed activities. Information on resource needs and availability in each work period assists the program office in forecasting the likelihood that activities will be completed as scheduled. If the current schedule does not allow insight into the current or projected allocation of resources, then the risk of the program’s slipping is significantly increased. VA’s project schedule minimally meets the best practice of verifying the schedule is traceable horizontally and vertically. There was no evidence in the schedule of hand-offs within the schedule—that is givers and receivers are easily identifiable in the schedule. We were unable to determine the relationship between lower-lever activities in the project schedule and higher-level activities and milestones in the management briefs provided to us. Specifically, we could not map the activities in the briefs to activities in the schedule. This inconsistency also prevented the verification of dates between the project schedule and higher-level management documents, even with documents that were provided from the same month as the October schedule. Products and outcomes were not easily traced through the sequencing of effort in the project schedule. In both cases the schedule did not respond appropriately to “shocks”; that is, greatly increasing the durations of some activities to increase the overall time required to complete the project did not affect the dates of key milestones. The duration increase of each activity did not affect the overall time line because the activity in question had a constraint that would not allow the project to appropriately extend. VA’s project schedule minimally meets the best practice of updating the schedule using progress and logic. Date anomalies, such as planned dates in the past or actual dates in the future, were found. The schedule was not current as of the date delivered to GAO. While officials report that they update the schedule regularly, a schedule narrative document does not accompany the schedule update that would detail changes to the current schedule and describe information such as the status of key milestone dates, changes in network logic, and a description of the current critical path(s). VA’s project schedule minimally meets the best practice of maintaining a baseline schedule. Officials said that the baseline schedule is the basis for performance measurement. But while baseline start and baseline finish dates were provided in the initial schedule, its activities were too high level, obfuscating the calculation of detail variances in subsequent schedules. There is also no evidence of a schedule basis document, which would include a general overview of the purpose of the schedule, other key basis information such as an overview of assumptions, rationale for durations specific to the CMR schedule, and required software settings. There is also no evidence of performance measuring. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.


Background VA’s mission is to promote the health, welfare, and dignity of all veterans by ensuring that they receive medical care, benefits, social support, and lasting memorials. In providing health care and other benefits to veterans and their dependents, VA relies extensively on IT systems and networks to receive, process, and maintain sensitive data, including veterans’ medical records and other personally identifiable information. Accordingly, effective information security controls based on federal guidance and requirements are essential to ensure that the department’s systems and information are adequately protected from loss, unauthorized disclosure, inadvertent or deliberate misuse, or improper modification, and are available when needed. Implementing an effective information security program and controls is particularly important for VA since it uses IT systems and electronic information to perform essential activities for veterans, such as providing primary and specialized health care services, medical research, disability compensation, educational opportunities, assistance with home ownership, and burial and memorial benefits. The corruption, denial, or delay of these services due to compromised IT systems and electronic information can create undue hardship for veterans and their dependents. Federal Law and Policy Set Requirements for Securing Federal Systems and Information The Federal Information Security Modernization Act of 2014 (FISMA) requires the head of each agency to provide information security protections commensurate with the risk and magnitude of harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of the information and information systems used by or on behalf of the agency. The act also requires federal agencies to develop, document, and implement an agency-wide information security program to provide security for the information and information systems supporting their operations and assets by implementing policies and procedures intended to cost-effectively reduce risks to an acceptable level. In May 2017, the president signed Executive Order 13800 on strengthening the cybersecurity of federal networks and critical infrastructure. The order sets policy for managing cybersecurity risk and directs each executive branch agency to use the National Institute of Standards and Technology’s (NIST) cybersecurity framework to manage those risks. The NIST cybersecurity framework identifies specific activities and controls for achieving five core security functions: Identify: Develop an understanding of the organization’s ability to manage cybersecurity risk to systems, people, assets, data, and capabilities. Protect: Develop and implement appropriate safeguards to ensure delivery of critical services. Detect: Develop and implement appropriate activities to identify the occurrence of a cybersecurity event. Respond: Develop and implement appropriate activities to take action regarding a detected cybersecurity incident. Recover: Develop and implement appropriate activities to maintain plans for resilience and to restore capabilities or services that were impaired due to a cybersecurity incident. According to NIST, these five functions provide a high-level, strategic view of the life cycle of an organization’s management of cybersecurity risk. The 23 Civilian CFO Act Agencies Have Spent Billions on Cybersecurity Activities In fiscal year 2018, the 23 civilian agencies covered by the Chief Financial Officers Act of 1990 (CFO Act), including VA, reported spending over $6.5 billion on IT security- or cybersecurity-related activities. The 23 civilian agencies individually reported spending between $9 million and almost $1.9 billion on these activities. Collectively, these 23 agencies spent on average about 14 percent of their total IT expenditures on cybersecurity-related activities. VA reported spending about $386 million on cybersecurity, which represented about 8 percent of its total IT expenditures. Federal Agencies Continue to Report Large Numbers of Security Incidents, Although VA Has Reported Fewer Incidents In Recent Years In fiscal year 2018, federal agencies continued to report large numbers of information security incidents. As we previously noted, federal agencies reported over 30,000 security incidents during each of the last three fiscal years. Specifically, agencies reported a total of 30,899, 35,277, and 31,107 information security incidents in fiscal years 2016, 2017, and 2018, respectively. During those same periods of time, VA reported an average of 2,415 incidents annually, although the number of reported incidents steadily decreased from 2,808 to 1,776, as shown in figure 1. In fiscal year 2018, VA reported 1,776 incidents involving several threat vectors. These threat vectors included web-based attacks, phishing attacks, and the loss or theft of computer equipment, among others. Figure 2 provides a breakdown of information security incidents, by threat vector, reported by VA in fiscal year 2018. Perhaps most concerning of the incidents reported by VA is the relatively large percentage of incidents (41 percent) for which VA identified “Other” as the threat vector. Government-wide, agencies identified approximately 27 percent of their incidents in the “Other” category in fiscal year 2018. A large percentage of these incidents may indicate a lack of agency awareness and ability to investigate and catalog incidents. Federal Agencies, Including VA, Continue to Have Deficient Information Security Programs FISMA requires IGs to determine the effectiveness of their respective agency’s information security programs. To do so, OMB instructed IGs to provide a maturity rating for agency information security policies, procedures, and practices related to the five core security functions— identify, protect, detect, respond, and recover—established in the NIST cybersecurity framework, as well as for the agency-wide information security program. The ratings used to evaluate the effectiveness of agency information security programs are based on a five-level maturity model, as described in table 1. According to this maturity model, Level 4 (managed and measurable) represents an effective level of security. Therefore, if an IG rates the agency’s information security program at Level 4 or Level 5, then that agency is considered to have an effective information security program. VA was one of 18 CFO Act agencies where the IG determined that the agency-wide information security program was not effectively implemented during fiscal year 2018. The VA IG also determined the department’s maturity level for each of the five core security functions: Level 2 (defined) for the Detect function; Level 3 (consistently implemented) for the Identify, Protect, and Level 4 (managed and measurable) for the Respond function. As shown in figure 3, VA’s ratings were generally consistent with the maturity level ratings of other CFO Act agencies. Most CFO Act Agencies, Including VA, Had Significant Security Control Deficiencies over Their Financial Reporting Agency IGs or independent auditors assess the effectiveness of information security controls as part of the annual audits of the agencies’ financial statements. The reports resulting from these audits include a description of information security control deficiencies related to the five major general control categories defined by the Federal Information System Controls Audit Manual (FISCAM): security management controls that provide a framework for ensuring that risks are understood and that effective controls are selected, implemented, and operating as intended; access controls that limit or detect access to computer resources, thereby protecting them against unauthorized modification, loss, and disclosure; configuration management controls that prevent unauthorized changes to information system resources and assure that software is current and known vulnerabilities are patched; segregation of duties controls that prevent an individual from controlling all critical stages of a process by splitting responsibilities between two or more organizational groups; and contingency planning controls that help avoid significant disruptions in computer-dependent operations. For fiscal year 2018, most of the 24 CFO Act agencies had deficiencies in most of the control categories, as illustrated in figure 4. VA’s IG reported deficiencies in each of these categories for the department. As a result of these deficiencies, the IGs at 18 of the 24 CFO Act agencies designated information security as either a material weakness (six agencies, including VA) or significant deficiency (12 agencies) in internal control over financial reporting for their agency. For VA, fiscal year 2018 was the 17th year in a row that the department had reported a material weakness in information security. In addition, IGs at 21 of the 24 agencies, including VA, cited information security as a major management challenge for their agency for fiscal year 2018. Most Civilian CFO Act Agencies, Including VA, Have Reported Meeting Many Cybersecurity Implementation Targets The administration has developed key milestones and performance metrics for agency chief information officers (CIO) to use to assess their agency’s progress toward achieving outcomes that strengthen federal cybersecurity. The milestones and metrics have specific implementation targets, most of which are expected to be met by the end of fiscal year 2020. As of fiscal year 2018, most civilian CFO Act agencies, including VA, had reported meeting most of the implementation targets for that year. VA reported meeting six of 10 targets. Table 2 shows the number of agencies meeting their targets as of fiscal year 2018, as well as VA’s status in doing so. VA Faces Key Security Challenges As It Modernizes and Secures Its Information Systems In several reports issued since fiscal year 2016, we described deficiencies related to key challenges that VA has faced in safeguarding its information and information systems. The challenges we reported related to effectively implementing information security controls; mitigating known security deficiencies; establishing elements of its cybersecurity risk management program; and identifying critical cybersecurity staffing needs. Our work stresses the need for VA to address these challenges as well as manage IT supply chain risks as it modernizes and secures its information systems. Effectively Implementing Information Security Controls VA has been challenged to effectively implement security controls over its information and information systems. As previously mentioned in this statement, the VA IG reported that the department did not have an effective information security program and has had deficient information security controls over its financial systems. The weaknesses described by the IG are consistent with the control deficiencies we identified during an examination of VA’s high-impact systems that we reported on in 2016. In those reports, we described deficiencies in VA’s implementation of access controls, patch management, and contingency planning. These deficiencies existed, in part, because the department had not effectively implemented key elements of its information security program. Until VA rectifies reported shortcomings in its agency-wide information security program, it will continue to have limited assurance that its sensitive information and information systems are sufficiently safeguarded. Adequately Mitigating Known Security Deficiencies VA has not consistently mitigated known security deficiencies in a timely manner. As mentioned earlier, VA has reported a material weakness in information security for financial reporting purposes for 17 consecutive years. In fiscal year 2016, we recommended 74 actions for the department to take to improve its cybersecurity program and remedy known control deficiencies with selected high-impact systems. However, as of October 2019, over 3 years later, VA had implemented only 32 (or 43 percent) of the 74 recommendations. One of the remaining unimplemented recommendations calls for the department to consistently and comprehensively perform security control assessments. This recommended activity is an important element of a cybersecurity program and helps to provide assurance that controls are operating as intended and to detect controls that are not functioning correctly. VA has also been challenged in assuring that its actions to mitigate vulnerabilities and implement recommended improvements are effective. The department has asserted that it had implemented 39 of the 42 remaining open recommendations from our fiscal year 2016 reports. However, the evidence VA provided was insufficient to demonstrate that it had fully implemented the recommendations. The department subsequently provided additional evidence, which was also insufficient, indicating that its remedial action process was not validating the effectiveness of actions taken to resolve known deficiencies. Until VA adequately mitigates security control deficiencies, the sensitive data maintained on its systems will remain at increased risk of unauthorized modification and disclosure, and the systems will remain at risk of disruption. Fully Establishing Elements of a Cybersecurity Risk Management Program VA has been challenged in managing its cybersecurity risk. In July 2019, we reported that the department had fully met only one of the five foundational practices for establishing a cybersecurity risk management program. Although VA established the role of a cybersecurity risk executive, the department had not fully: developed a cybersecurity risk management strategy that addressed key elements, such as risk tolerance and risk mitigation strategies; documented risk-based policies that required the department to perform agency-wide risk assessments; conducted an agency-wide cybersecurity risk assessment to identify, assess, and manage potential enterprise risks; or established coordination between cybersecurity and enterprise risk management. VA concurred with our four recommendations to address these deficiencies and asserted that it is acting to do so. Nevertheless, until VA fully establishes a cybersecurity risk management program, its ability to convey acceptable limits regarding the selection and implementation of controls within the established organizational risk tolerance will be diminished. Identifying Critical Cybersecurity Staffing Needs VA has been challenged to accurately identify the work roles of its workforce positions that perform IT, cybersecurity, or cyber-related functions—a key step in identifying its critical cybersecurity staffing needs. In March 2019, we reported that the department had likely miscategorized the work roles of many of these positions in its personnel system. Specifically, VA had reported that 3,008 (or 45 percent) of its 6,636 positions in the 2210 IT management occupational series— positions that most likely performed IT, cybersecurity, and cyber-related functions—were not performing these functions. VA concurred with our recommendation to review the work roles for positions in the 2210 IT management occupational series and assign the appropriate work roles, and stated that it had begun to do so. Nevertheless, until VA completely and accurately categorizes the work roles of its workforce positions performing IT, cybersecurity, and cyber- related functions, the reliability of the information needed to improve workforce planning will be diminished and its ability to effectively identify critical staffing needs will be impaired. Managing IT Supply Chain Risks as Part of IT Modernization Programs Assessing and managing supply chain risks are important considerations for agencies, including VA, when operating and modernizing IT systems. In July 2018, we reported that reliance on a global IT supply chain introduces risks to federal information systems. We noted that supply chain threats are present during various phases of a system’s development life cycle and we identified the following threats: Installation of malicious or intentionally harmful hardware or software; Installation of counterfeit hardware or software; Failure or disruption in the production or distribution of critical Reliance on a malicious or unqualified service provider; and Installation of hardware or software that contains unintentional vulnerabilities, such as defects in code that can be exploited. These threats can have a range of impacts, including allowing adversaries to take control of systems or decreasing the availability of materials or services needed to develop systems. Accordingly, agencies such as VA need to take appropriate measures to assess and manage IT supply chain risks as they operate and modernize their information systems. Failure to do so could result in data loss, modification, or exfiltration; loss of system availability; and a persistent negative impact on the agency’s mission. In summary, similar to other federal agencies, VA continues to be challenged in implementing an effective agency-wide program and controls for securing its information and information systems. As VA pursues efforts to modernize and secure its IT systems, it will need to successfully address multiple challenges in order to achieve effective outcomes. Chair Lee, Ranking Member Banks, and Members of the Subcommittee, this completes my written statement. I would be pleased to answer your questions. GAO Contact and Staff Acknowledgments If you or your staff members have any questions concerning this testimony, please contact me at (202) 512-6244 or wilshuseng@gao.gov. Contact points for our Office of Congressional Relations and Public Affairs may be found on the last page of this statement. Other individuals who made key contributions to this testimony include Jeffrey Knott (Assistant Director), Di’Mond Spencer (Analyst-in-Charge), Chris Businsky, Nancy Glover, Franklin Jackson, and Daniel Swartz. Also contributing were Melina Asencio, Scott Pettis, and Zsaroq Powe. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.