Background VA’s mission is to promote the health, welfare, and dignity of all veterans in recognition of their service to the nation by ensuring that they receive medical care, benefits, social support, and lasting memorials. In carrying out this mission, the department manages one of the largest health care delivery systems in the United States that provides enrolled veterans with a full range of services. These services may include primary care; mental health care; and outpatient, inpatient, and residential treatment. The Veterans Health Administration (VHA), one of the department’s three major components, is responsible for overseeing the provision of health care at all VA medical facilities. Information technology (IT) is widely used and critically important to supporting the department in delivering health care to veterans. As such, VA operates and maintains an IT infrastructure that is intended to provide the backbone necessary to meet the day-to-day operational needs of its medical centers and other critical systems supporting the department’s mission. The infrastructure is to provide for data storage, transmission, and communications requirements necessary to ensure the delivery of reliable, available, and responsive support to all VA staff offices and administration customers, as well as veterans. The Office of Information and Technology (OIT) is responsible for managing the majority of VA’s IT- related functions. The office provides strategy and technical direction, guidance, and policy related to how IT resources are to be acquired and managed for the department. VistA’s Role at VA VA provides health care services to approximately 9 million veterans and their families and relies on its health information system—VistA—to do so. VistA has been essential to the department’s ability to deliver health care to veterans. It was developed based on the collaboration between staff in the VA medical facilities and VHA IT personnel. Specifically, clinicians and IT personnel at the various VA medical facilities collaborated to define the system’s requirements and, in certain cases, carried out its development and implementation. As a result of these efforts, the system has been in operation since the early 1980s. VistA supports a complex set of clinical and administrative capabilities. It is comprised of an architecture that ties together servers and personal computer workstations with various applications within VA facilities and the supporting infrastructure, such as data centers, storage, and messaging technologies. The core system and database code are programmed in the MUMPS programming language. Among other things, VistA contains an EHR for each patient and supports clinics and medical centers. In addition, the system provides functionality beyond the EHR and exchanges information with many other applications and interfaces. For example, the system also provides the functionality of a time and attendance program, asset management system, library, and billing system, among other things. Users interact with VistA through a number of interfaces that connect stored health data. These interfaces enable the system to communicate (send or exchange data) with other VA systems, as well as with other federal agencies (e.g., DOD), health information exchange networks, and COTS products. According to OIT officials, applications either interface with VistA directly through a messaging protocol or extract data from the system via a reporting mechanism. The Computerized Patient Record System is a graphical user interface to VistA that runs on workstations, laptops, and tablets and enables the department to support clinical workflows. Specifically, the Computerized Patient Record System enables the department to create and update an individual EHR for each VA patient. Among other things, clinicians can order lab tests, medications, diets, radiology tests, and procedures; record a patient’s allergies or adverse reactions to medications; request and track consults; enter progress notes, diagnoses, and treatments for each encounter; and enter discharge summaries. According to VHA officials, there are also more than 100 COTS products that interface with VistA. In addition to these commercial products, medical equipment or devices at local facilities may also require interfaces to the system, and these vary on a site-by-site basis. VA Has about 130 Different Versions of VistA Over the last several decades, VistA has evolved into a technically complex system that supports health care delivery at more than 1,500 locations, including VA Medical Centers, outpatient clinics, community living centers, and VA vet centers. Customization of the system by local facilities has resulted in about 130 clinical versions of VistA—referred to as instances. According to the department, no two VistA instances are identical. Further, each instance is comprised of over 27,400 routines (executable modules of code), which are logically grouped into products or modules. VistA products or modules can also be comprised of one or more software applications that support health care functions, such as providing care coordination and mental health services. The department reported that there are approximately 140 to 200 products or modules that comprise the system. The 130 clinical instances of VistA are operated from four regional VA data centers. Users interact with the system through the Computerized Patient Record System. Aggregated clinical data from every instance of the system are located on servers hosted at VA’s National Data Center. Over time, VA has identified the need for enhancements and modifications to VistA in order to ensure that the system keeps up with current technology and health care delivery. However, according to the department, the system has become difficult and costly to maintain. This is a result of, for example, being programmed in MUMPS, a language for which there is a dwindling supply of qualified software developers. It is also due to years of decentralized customization of the system by staff members who were permitted to develop and implement applications at the local level. OIT and VHA Share Responsibilities for VistA OIT and VHA serve as the technical and functional leaders, respectively, for the department’s health care delivery and, together, they have worked to develop and maintain VistA for decades. Specifically, OIT is responsible for managing the majority of VA’s IT-related functions. The office provides strategy and technical direction, guidance, and policy related to how IT resources are to be acquired and managed for the department. According to the department, OIT’s mission is to collaborate with its business partners (such as VHA) and provide a seamless, unified veteran experience through the delivery of state-of-the-art technology. The Assistant Secretary for Information and Technology/Chief Information Officer (CIO) serves as the head of OIT and is responsible for providing leadership for the department’s IT activities. The CIO also advises the Secretary regarding the execution of VA’s IT systems appropriation, consistent with the Federal Information Technology Acquisition Reform Act. For fiscal year 2019, the department has been appropriated $4.1 billion for IT. According to VA’s budget documentation, about $1.2 billion of this amount is intended to support IT staffing and associated costs for approximately 8,100 full-time employees. VHA provides information and expertise to OIT to support the department’s health-related information systems. For example, VHA officials help identify clinical and business needs used to inform IT requirements development. The Under Secretary for Health is the head of VHA and is supported by the Principal Deputy Under Secretary for Health, four Deputy Under Secretaries for Health, and nine Assistant Deputy Under Secretaries for Health. VA Has Begun to Acquire a New EHR System After nearly 2 decades of pursuing multiple efforts to modernize VistA, in June 2017, the former VA Secretary announced that the department planned to acquire the same EHR system that DOD is acquiring—Cerner Millennium. According to the department, it has chosen to acquire this product because Cerner Millennium should allow VA’s and DOD’s patient data to reside in one system, thus, potentially reducing or eliminating the need for manual and electronic exchange and reconciliation of data between two separate systems. Accordingly, the department awarded an indefinite delivery, indefinite quantity contract to Cerner Corporation in May 2018 for a maximum amount of $10 billion over 10 years. Cerner is to replace the 130 instances of VistA with a standard COTS system to be implemented across VA. This new system is to support a broad range of health care functions including acute care, clinical decision support, dental care, and emergency medicine. When implemented, the new system will be expected to become the authoritative source of clinical data to support improved health, patient safety, and quality of care provided by VA. The Electronic Health Record Modernization (EHRM) program is responsible for managing the Cerner contract implementation. For fiscal year 2019, the program was appropriated about $1.1 billion for planning and managing the transition from VistA to Cerner. Further, the department has estimated that an additional $6.1 billion in funding, above the Cerner contract amount, will be needed to fund additional project management support supplied by outside contractors, government labor costs, and infrastructure improvements over the 10- year contract period. VA plans to deploy the new EHR system at three initial operating capability sites within 18 months of October 1, 2018, with a phased implementation of the remaining sites over the next decade. Each VA medical facility is expected to continue using VistA until the new system has been deployed. The three initial deployment sites, located in the Pacific Northwest, are the Mann-Grandstaff, American Lake, and Seattle VA Medical Centers and related clinical facilities that operate the same instances of VistA. These are the first locations where the system is expected to “go live.” The task order to deploy the Cerner system at the three initial sites provides a detailed description of the steps Cerner needs to take in order to reach initial operating capability at the Mann-Grandstaff site in March 2020, and at the Seattle and American Lake sites in April 2020. According to the schedule, the initial operating capability sites are expected to be operational by July 2020. VA Has Undertaken Efforts to Define VistA, but Additional Work Remains In order to maintain internal control activities over an IT system and its related infrastructure, organizations should be able to define physical and performance characteristics of the system, including descriptions of the components and the interfaces. Further, consistent with GAO’s Cost Estimating and Assessment Guide, a comprehensive system definition should identify customization and the environment in which the system operates. While defining a complex IT system can be challenging, having an adequate understanding of its characteristics will better position the organization to comprehensively project and account for costs over the life of a system or program as well as identify specific technical and program risks. Definition of VistA remains important because VA plans to continue using the system during the department’s decade-long transition to the Cerner system. VA maintains multiple documents and a database that describe parts of VistA, including various components and interfaces. However, despite these existing sources, OIT officials acknowledged that there is no comprehensive definition of the VistA system. Consequently, VA has completed a number of efforts to better define VistA and understand the environment in which it operates and additional work is planned in the future. Specifically, VA has documented descriptions of the system, including the components that comprise it. These descriptions are documented in multiple sources: the VA Monograph, VA Systems Inventory, and VA Document Library. The VA Monograph is a document maintained by OIT that provides an overview of VistA and non-VistA applications used by VHA. According to VHA officials, the VA Monograph is the primary document that describes the components of the system. The Monograph describes VistA in terms of modules. For modules identified, including VistA modules, information such as the associated business functions, VA Systems Inventory identification number, and a link to the VA Document Library for additional technical information are provided. The VA Systems Inventory is a database maintained by OIT that identifies current IT systems at the department, including systems and interfaces related to VistA. For systems identified, the database includes information such as the system name, the system status (i.e., active, in development, or inactive), and related system interfaces. The VA Document Library is an online resource for accessing documentation (i.e., user guides and installation manuals) on the department’s nationally released software applications, including VistA. VA has taken additional steps to further define the system. For example, EHRM program officials recognized the need to further understand the customization of VistA components at the various medical facilities and have conducted analyses to do so. These analyses include: Variance analysis: As part of its VistA Evolution program, which has focused on standardizing a core set of VistA functionality, the department implemented a process to compare the instances of VistA installed at sites to the Enterprise Standard version. The results of this analysis allowed the department to assess the criticality of each variance, which is expected to help with VA’s transition to the Cerner system. Module analysis: EHRM program subject matter experts undertook an analysis that involved reviewing and assessing capabilities provided by VistA modules. This analysis enabled department officials to determine whether the capability provided by a VistA module could be provided by the Cerner system, or whether another COTS solution would be required to support this function going forward. Visual mapping: EHRM program officials also directed an analysis that involved developing a notional visual mapping of VA’s health care applications, components, and supporting systems within the health delivery environment. The results of this analysis provided a description of the current state of one instance of VistA and the VA health environment, which is intended to inform the department of possible opportunities for business process and IT improvements as it proceeds with the Cerner acquisition. Nevertheless, even with these analyses, VA has not yet fully defined VistA, including, for example, identifying performance characteristics of the system and describing the environment in which it operates. The department’s three sources that describe VistA and the additional analyses undertaken do not provide insight into site specific customizations of the system. For example, the VA Monograph does not include information on module customization at local facilities. In addition, according to OIT officials, the systems inventory does not reflect differences among the 130 different instances of VistA and does not take into consideration regional and local customizations of related components. Further, the visual mapping analysis noted that there was not full insight of the intertwined structure of data and applications or the various local customizations of VistA. EHRM program officials stated that they have not been able to fully define VistA and understand all local customizations due to the decentralization of the development of the system and its evolution over more than 30 years. They explained that VistA’s complexity is partly due to the various instances of the system, compounded by local customizations, which have resulted in differences in VistA instances operating at various facilities. According to EHRM program documentation, Cerner’s contract calls for the company to conduct comprehensive assessments to capture the current state of technical and clinical operations at specific facilities, as well as identify site-specific requirements where the Cerner system is planned to be deployed. As of June 2019, Cerner had completed site assessments for the three initial operating capability sites in the Pacific Northwest and had planned additional assessments at future deployment sites. The initial site assessments included, among other things, an assessment of the unique VistA instances and the environment in which the system operates. The continuation of planned site assessments should provide a thorough understanding of the 130 VistA versions, help the department better define VistA, and position it for transitioning from VistA to Cerner’s COTS solution. VA Identified Total VistA Costs of about $2.3 Billion between 2015 and 2017, but Could Not Sufficiently Demonstrate the Reliability of All Data and Omitted Other Costs When using public funds, an agency must employ effective management practices in order to let legislators, management, and the public know the costs of programs and whether they are achieving their goals. To make those evaluations for a program or for a system as large and complex as VistA, a complete understanding of the system and reliable cost information is required. By following a methodology and utilizing reliable data, an agency can ensure that all costs are fully accounted for, which in turn, better informs management decisions, establishes a cost baseline, and enhances understanding of a system’s performance and return on investment. Fundamental characteristics of reliable costs are that they should be accurate (unbiased, not overly conservative or optimistic), well- documented (supportable with source data, clearly detailed calculations, and explanations for choosing a particular calculation method), credible (identifying any uncertainty or biases surrounding data or related assumptions), and comprehensive (costs are neither omitted nor double counted). Identification of VistA’s costs remains important because VA plans to continue using the system during the department’s transition to the Cerner system over the next decade. VA identified costs for VistA and its related activities adding up to approximately $913.7 million, $664.3 million, and $711.1 million in fiscal years 2015, 2016, and 2017, respectively—for a total of about $2.3 billion over the 3 years. However, the department could not sufficiently demonstrate the reliability of certain costs that were identified. In addition, VA identified other categories of VistA-related costs, but omitted these costs from the total. VA Did Not Sufficiently Demonstrate the Reliability of Data for All VistA Costs Of the $2.3 billion total costs for VistA, VA demonstrated that only approximately $1 billion of these costs were reliable. Specifically, OIT officials identified VistA-related costs within seven categories. The officials were able to sufficiently explain why these categories were included in the development and sustainment costs for VistA and how they were documented by the department; the officials also presented detailed source data for our examination. As a result of our review, we determined that the cost data for these seven categories were accurate, well-documented, credible, and comprehensive and, thus, sufficiently reliable. Table 1 provides a summary of the program costs identified for VistA by OIT and VHA for fiscal years 2015 through 2017 that we determined to be reliable. As shown in the table, VA identified costs for the following seven categories for fiscal years 2015 through 2017: VistA Evolution – The VistA Evolution program costs were associated with VistA strategy, system design, product development, and program management. These costs totaled approximately $549.6 million. Interoperability – The Interoperability program focused on sharing electronic health data between VA and non-VA facilities, including private sector providers and DOD. For example, interoperability costs were associated with architecture, strategy, the Interagency Program Office, product development, and program management. These VistA-related costs totaled approximately $140.2 million. Virtual Lifetime Electronic Record (VLER) Health – This program focused on streamlining the transition of electronic medical information between VA and DOD. These VistA-related costs were associated with product development and program management and totaled approximately $81.2 million. Contracts – Contract costs for VistA Evolution included VHA’s obligations associated with workload management, change management, clinical requirements, and clinical interoperability. These VistA-related costs totaled approximately $202.8 million. Intergovernmental personnel acts – Intergovernmental personnel acts are agreements for the temporary assignment of personnel between the federal, state, and local governments; colleges and universities; Indian tribal governments; federally funded research and development centers; and other eligible organizations. These costs accounted for VHA’s need to use outside experts from approved entities for limited periods of time to work on VistA Evolution assignments. The total VistA-related costs were approximately $2.4 million. Memorandums of understanding – According to VHA, memorandums of understanding are agreements used by the administration to obtain the services of personnel between VA entities for VistA-related activities. These agreements accounted for approximately $2.3 million. Pay – Costs in this category included salaries for VHA staff who worked on VistA-related projects as well as travel, training, and supply costs associated with employment. These costs totaled approximately $34.1 million. However, VA was not able to sufficiently demonstrate the reliability of approximately $1.3 billion in costs related to VistA. Specifically, OIT officials identified the additional legacy VistA costs that generally fell into three categories: Legacy VistA: Infrastructure, hosting, and system sustainment – Legacy VistA costs are generally related to the maintenance of fully operational items, such as VistA Imaging and Fileman—two key components related to VistA’s operation. The costs also included obligations for costs related to hosting health data in both VA and non-VA facilities. The OIT officials and subject matter experts estimated these total costs to be approximately $343 million during fiscal years 2015 through 2017. However, we were not able to determine the reliability of these costs because, for example, source data were not well documented; changes in the cost information provided to us during our review indicated that the cost data may not be credible; and subject matter experts were unclear about how to separate VistA costs from non- VistA costs. Related software – Related software costs are associated with the software supporting, or closely integrated with, VistA that were identified by EHRM officials, yet not tracked directly for one of the VistA-related programs. Both OIT and VHA identified software licensing costs as VistA-related obligations. The EHRM program reported these costs to be approximately $389 million in total during fiscal years 2015 through 2017. However, we were not able to determine the reliability of the costs in this category for a variety of reasons, including that source data were not well documented. In addition, VA officials were not clear regarding how the total amounts in each category should be divided between OIT and VHA. Given this confusion, we were not able to determine if the costs were fully accurate or credible. OIT personnel (pay and administrative) – According to EHRM officials, OIT does not track labor costs by program. Instead, the department provided estimations of the amount of salaries paid to OIT government staff working on activities such as VistA Evolution, program management, and overall support of VistA and related applications. OIT personnel costs were estimated by the EHRM program office to be approximately $544 million total during fiscal years 2015 through 2017. However, we were not able to determine the reliability of costs in this category because assumptions made for estimating the personnel and salary costs were not well documented and could not be verified. VA Omitted Certain Costs from the Total Cost of VistA In addition, VA omitted certain VistA costs from the total costs identified for fiscal years 2015, 2016, and 2017. Specifically, VA omitted the following costs: Additional hosting – OIT officials stated that additional costs related to hosting health data by an outside vendor, as well as hosting backup VistA instances at each of the medical center sites, should also be included in the total costs for VistA; however, VA omitted these costs from the total for fiscal years 2015 through 2017. Specifically, according to the officials, calculating costs for these hosting activities requires subject matter experts to identify equipment, space, utilities, and maintenance costs for resources allocated specifically for VistA. However, the department has not yet developed a methodology to calculate the costs. The officials said they were working on identifying a reliable approach for calculating these costs in the future. Data standardization and testing – OIT officials stated that additional costs related to work on clinical terminology mapping and functional testing were not included in the total costs for VistA for fiscal years 2015 through 2017. This work related to mapping existing clinical data to national standards and making updates to VistA or the Joint Legacy Viewer and included mapping data and building test scripts and reports. OIT officials noted that this work had been critical to the VistA Evolution program, but they did not provide actual cost data in this category. The lack of sufficiently reliable and comprehensive costs indicates that the department is not positioned to accurately report the annual costs to develop and sustain VistA. This is due in part to VA not following a well- documented methodology that describes how the department determined the total costs for the system. In lieu of a methodology, OIT officials said that leadership and staff from the program took efforts to identify and track the cost components and contracts associated with the system. However, they noted that costs associated with VistA were not all clearly labeled as VistA in an IT system and it was necessary to estimate other costs. The officials were also unable to verify how VistA-related costs were separated from other department costs in all areas and subject matter experts were not consistently familiar with the estimation methods employed and how VistA was defined for the purposes of calculating costs. Further, VA officials noted that they were still working on the best approach to identifying and calculating omitted costs. Without documenting the methodology for what costs are to be included and how they were identified and calculated, VA’s total does not accurately reflect the development and sustainment costs for VistA. As a result, the department, legislators, and the public do not have the comprehensive, reliable information needed to understand how much it actually cost to develop and maintain the system. Further, VA does not have the reliable information needed to make critical management decisions for sustaining the many versions of VistA over the next 10 years until the Cerner system is fully deployed. Implementation of GAO’s Recommendation Could Help Ensure VA Reliably Reports VistA Costs In our report, we are making a recommendation for VA to improve its reporting of VistA’s costs. Specifically, we are recommending that the department develop and implement a methodology for reliably identifying and reporting the total costs of VistA. The methodology should include steps to identify the definition of VistA and what is to be included in its sustainment activities, as well as ensure that comprehensive costs are corroborated by reliable data. In written comments on a draft of the report, the department agreed with the recommendation and stated that it will provide the actions it plans to take to address this recommendation within 180 days. In conclusion, although VA is not likely to be positioned to retire VistA for at least another 10 years, the department lacks the comprehensive and reliable cost information needed to make critical management decisions for sustaining the system. As the department continues to work toward acquiring a new electronic health record, it will be important for VA to take actions to address our recommendation for improving the reporting of VistA costs. Doing so is essential to helping ensure that decisions related to the current system are informed by reliable cost information and that there is an accurate basis for reporting on the return on its investment for replacing VistA. Chair Lee, Ranking Member Banks, and Members of the Subcommittee, this completes my prepared statement. I would be pleased to respond to any questions that you may have. GAO Contact and Staff Acknowledgments If you or your staffs have any questions about this testimony, please contact Carol C. Harris, Director, Information Technology Management Issues, at (202) 512-4456 or harriscc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony statement. GAO staff who made key contributions to this testimony are Mark Bird (Assistant Director), Rebecca Eyler, Jacqueline Mai, Monica Perez-Nelson, Scott Pettis, Jennifer Stavros-Turner (Analyst in Charge), and Charles Youman. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.


Background VA’s mission is to promote the health, welfare, and dignity of all veterans in recognition of their service to the nation by ensuring that they receive medical care, benefits, social support, and lasting memorials. In carrying out this mission, the department operates one of the largest health care delivery systems in America, providing health care to millions of veterans and their families at more than 1,500 facilities. The department’s three major components—the Veterans Health Administration (VHA), the Veterans Benefits Administration (VBA), and the National Cemetery Administration (NCA)—are primarily responsible for carrying out its mission. More specifically, VHA provides health care services, including primary care and specialized care, and it performs research and development to address veterans’ needs. VBA provides a variety of benefits to veterans and their families, including disability compensation, educational opportunities, assistance with home ownership, and life insurance. Further, NCA provides burial and memorial benefits to veterans and their families. VA Relies Extensively on IT The use of IT is critically important to VA’s efforts to provide benefits and services to veterans. As such, the department operates and maintains an IT infrastructure that is intended to provide the backbone necessary to meet the day-to-day operational needs of its medical centers, veteran- facing systems, benefits delivery systems, memorial services, and all other systems supporting the department’s mission. The infrastructure is to provide for data storage, transmission, and communications requirements necessary to ensure the delivery of reliable, available, and responsive support to all VA staff offices and administration customers, as well as veterans. Toward this end, the department operates approximately 240 information systems, manages approximately 314,000 desktop computers and 30,000 laptops, and administers nearly 460,000 network user accounts for employees and contractors to facilitate providing benefits and health care to veterans. These systems are used for the determination of benefits, benefits claims processing, patient admission to hospitals and clinics, and access to health records, among other services. VHA’s systems provide capabilities to establish and maintain electronic health records that health care providers and other clinical staff use to view patient information in inpatient, outpatient, and long-term care settings. The department’s health information system—VistA—serves an essential role in helping the department to fulfill its health care delivery mission. Specifically, VistA is an integrated medical information system that was developed in-house by the department’s clinicians and IT personnel, and has been in operation since the early 1980s. The system consists of 104 separate computer applications, including 56 health provider applications; 19 management and financial applications; eight registration, enrollment, and eligibility applications; five health data applications; and three information and education applications. Within VistA, an application called the Computerized Patient Record System enables the department to create and manage an individual electronic health record for each VA patient. In June 2017, the former VA Secretary announced that the department planned to acquire the same Cerner electronic health record system that the Department of Defense (DOD) has acquired. VA’s effort—the Electronic Health Record Modernization (EHRM) program—calls for the deployment of a new electronic health record system at three initial sites in 2020, with a phased implementation of the remaining sites over the next decade. In addition, VBA relies on the Veterans Benefits Management System (VBMS) to collect and store information such as military service records, medical examinations, and treatment records from VA, DOD, and private medical service providers. In 2014, VA issued its 6-year strategic plan, which emphasizes the department’s goal of increasing veterans’ access to benefits and services, eliminating the disability claims backlog, and ending veteran homelessness. According to the plan, the department intends to improve access to benefits and services through the use of enhanced technology to provide veterans with access to more effective care management. The plan also calls for VA to eliminate the disability claims backlog by fully implementing an electronic claims process that is intended to reduce processing time and increase accuracy. Further, the department has an initiative under way that provides services, such as health care, housing assistance, and job training, to end veteran homelessness. Toward this end, VA is working with other agencies, such as the Department of Health and Human Services, to implement more coordinated data entry systems to streamline and facilitate access to appropriate housing and services. VA Manages IT Resources Centrally Since 2007, VA has been operating a centralized organization, OI&T, in which most key functions intended for effective management of IT are performed. This office is led by the Assistant Secretary for Information and Technology—VA’s Chief Information Officer (CIO). The office is responsible for providing strategy and technical direction, guidance, and policy related to how IT resources are to be acquired and managed for the department, and for working closely with its business partners—such as VHA—to identify and prioritize business needs and requirements for IT systems. Among other things, OI&T has responsibility for managing the majority of VA’s IT-related functions, including the maintenance and modernization of VistA. As of January 2019, OI&T was comprised of about 15,800 staff, with more than half of these positions filled by contractors. VA Is Requesting about $5.9 Billion for IT and a New Electronic Health Record System for Fiscal Year 2020 VA’s fiscal year 2020 budget request includes about $5.9 billion for OI&T and its new electronic health record system. Of this amount, about $4.3 billion was requested for OI&T, which represents a $240 million increase over the $4.1 billion enacted for 2019. The request seeks the following levels of funding: $401 million for new systems development efforts to support current health care systems platforms, and to replace legacy systems, such as the Financial Management System; approximately $2.7 billion for the operations and maintenance of existing systems, which includes $327.3 million for infrastructure readiness that is to support the transition to the new electronic health record system; and approximately $1.2 billion for administration. Additionally, the department requested about $1.6 billion for the EHRM program. This amount is an increase of $496 million over the $1.1 billion that was enacted for the program for fiscal year 2019. The request includes the following: $1.1 billion for the contract with the Cerner Corporation to acquire the $161,800 for program management, and $334,700 for infrastructure support. VA’s Management of IT Has Contributed to High- Risk Designations In 2015, we designated VA Health Care as a high-risk area for the federal government and noted that IT challenges were among the five areas of concern. In part, we identified limitations in the capacity of VA’s existing systems, including the outdated, inefficient nature of certain systems and a lack of system interoperability—that is, the ability to exchange and use electronic health information—as contributors to the department’s IT challenges related to health care. Also, in February 2015, we added Improving the Management of IT Acquisitions and Operations to our list of high-risk areas. Specifically, federal IT investments were too frequently failing or incurring cost overruns and schedule slippages while contributing little to mission- related outcomes. We have previously reported that the federal government has spent billions of dollars on failed IT investments, including at VA. Our 2017 update to the high-risk report noted that VA had partially met our leadership commitment criterion by involving top leadership in addressing the IT challenges portion of the VA Health Care high-risk area; however, it had not met the action plan, monitoring, demonstrated progress, or capacity criteria. We have also identified VA as being among a handful of departments with one or more archaic legacy systems. Specifically, in our May 2016 report on legacy systems used by federal agencies, we identified two of VA’s systems as being over 50 years old—the Personnel and Accounting Integrated Data system and the Benefits Delivery Network system. These systems were among the 10 oldest investments and/or systems that were reported by 12 selected agencies. Accordingly, we recommended that the department identify and plan to modernize or replace its legacy systems. VA addressed the recommendation in May 2018, when it provided a Comprehensive Information Technology Plan that showed a detailed roadmap for the key programs and systems required for modernization. The plan included time frames, activities to be performed, and functions to be replaced or enhanced. The plan also indicated that the Personnel and Accounting Integrated Data system and the Benefits Delivery Network system are to be decommissioned in quarters 3 and 4 of fiscal year 2019, respectively. Our March 2019 update to our high-risk series noted that the ratings for leadership commitment criterion regressed, while the action plan criterion improved for the IT Challenges portion of the VA Health Care area. The capacity, monitoring, and demonstrated progress criteria remained unchanged. Our work continued to indicate that VA was not yet able to demonstrate progress in this area. Since its 2015 high-risk designation, we have made 14 new recommendations in the VA Health Care area, 12 of which were made since our 2017 high-risk report was issued. For example, in June 2017, to address deficiencies we recommended that the department take six actions to provide clinicians and pharmacists with improved tools to support pharmacy services to veterans and reduce risks to patient safety. VA generally concurred with these recommendations; however, all of them remain open. FITARA Is Intended to Help VA and Other Agencies Improve Their IT Acquisitions Congress enacted FITARA in December 2014 to improve agencies’ acquisitions of IT and enable Congress to better monitor agencies’ progress and hold them accountable for reducing duplication and achieving cost savings. The law applies to VA and other covered agencies. It includes specific requirements related to seven areas, including agency CIO authority, data center consolidation and optimization, risk management of IT investments, and government-wide software purchasing. Agency CIO authority enhancements. CIOs at covered agencies are required to (1) approve the IT budget requests of their respective agencies, (2) certify that IT investments are adequately implementing incremental development, as defined in capital planning guidance issued by the Office of Management and Budget (OMB), (3) review and approve contracts for IT, and (4) approve the appointment of other agency employees with the title of CIO. Federal data center consolidation initiative. Agencies are required to provide OMB with a data center inventory, a strategy for consolidating and optimizing their data centers (to include planned cost savings), and quarterly updates on progress made. The law also requires OMB to develop a goal for how much is to be saved through this initiative, and provide annual reports on cost savings achieved. Enhanced transparency and improved risk management in IT investments. OMB and covered agencies are to make detailed information on federal IT investments publicly available, and department-level CIOs are to categorize their major IT investments by risk. Additionally, in the case of major investments rated as high risk for 4 consecutive quarters, the act required that the department- level CIO and the investment’s program manager conduct a review aimed at identifying and addressing the causes of the risk. Government-wide software purchasing program. The General Services Administration is to enhance government-wide acquisition and management of software and allow for the purchase of a software license agreement that is available for use by all executive branch agencies as a single user. Additionally, the Making Electronic Government Accountable by Yielding Tangible Efficiencies Act of 2016, or the “MEGABYTE Act,” further enhanced CIOs’ management of software licenses by requiring agency CIOs to establish an agency software licensing policy and a comprehensive software license inventory to track and maintain licenses, among other requirements. In June 2015, OMB released guidance describing how agencies are to implement FITARA. This guidance is intended to, among other things: assist agencies in aligning their IT resources with statutory establish government-wide IT management controls that will meet the law’s requirements, while providing agencies with flexibility to adapt to unique agency processes and requirements; clarify the CIO’s role and strengthen the relationship between agency CIOs and bureau CIOs; and strengthen CIO accountability for IT costs, schedules, performance, and security. VA and Other Agencies Face Cybersecurity Risks The federal approach and strategy for securing information systems is prescribed by federal law and policy. The Federal Information Security Modernization Act (FISMA) provides a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets. In addition, the Federal Cybersecurity Enhancement Act of 2015 requires protecting federal networks through the use of federal intrusion prevention and detection capabilities. Further, Executive Order 13800, Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, directs agencies to manage cybersecurity risks to the federal enterprise by, among other things, using the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (cybersecurity framework). Federal agencies, including VA, and our nation’s critical infrastructures— such as energy, transportation systems, communications, and financial services—are dependent on IT systems and electronic data to carry out operations and to process, maintain, and report essential information. The security of these systems and data is vital to public confidence and national security, prosperity, and well-being. Because many of these systems contain vast amounts of personally identifiable information, agencies must protect the confidentiality, integrity, and availability of this information. In addition, they must effectively respond to data breaches and security incidents when they occur. The risks to IT systems supporting the federal government and the nation’s critical infrastructure are increasing, including insider threats from witting or unwitting employees, escalating and emerging threats from around the globe, and the emergence of new and more destructive attacks. Cybersecurity incidents continue to impact federal entities and the information they maintain. According to OMB’s 2018 annual FISMA report to Congress, agencies reported 35,277 information security incidents to DHS’s U.S. Computer Emergency Readiness Team in fiscal year 2017. VA Has Made Limited Progress toward Addressing IT System Modernization Challenges VA has made limited progress toward addressing the IT management challenges for three critical initiatives: VistA, the Family Caregiver Program, and VBMS. Specifically, the department has recently initiated its fourth effort to modernize VistA, but uncertainty remains regarding the program’s governance. In addition, although VA has taken steps to address our recommendations for the Family Caregiver Program and VBMS, the department has not fully implemented most of them. VA Recently Initiated Its Fourth Effort to Modernize VistA VA has pursued four efforts over nearly 2 decades to modernize VistA. These efforts—HealtheVet, the integrated Electronic Health Record (iEHR), VistA Evolution, and EHRM—reflect varying approaches that the department has considered to achieve a modernized health care system. Figure 1 shows a timeline of the four efforts that VA has pursued to modernize VistA since 2001. In 2001, VA undertook its first VistA modernization project, the HealtheVet initiative, with the goals of standardizing the department’s health care system and eliminating the approximately 130 different systems used by its field locations at that time. HealtheVet was scheduled to be fully implemented by 2018 at a total estimated development and deployment cost of about $11 billion. As part of the effort, the department had planned to develop or enhance specific areas of system functionality through six projects, which were to be completed between 2006 and 2012. In June 2008, we reported that the department had made progress on the HealtheVet initiative, but noted concerns with its project planning and governance. In June 2009, the Secretary of Veterans Affairs announced that VA would stop financing failed projects and improve the management of its IT development projects. Subsequently in August 2010, the department reported that it had terminated the HealtheVet initiative. In February 2011, VA began its second VistA modernization initiative, the iEHR program, in conjunction with DOD. The program was intended to replace the two separate electronic health record systems used by the two departments with a single, shared system. In addition, because both departments would be using the same system, this approach was expected to largely sidestep the challenges that had been encountered in trying to achieve interoperability between their two separate systems. Initial plans called for the development of a single, joint iEHR system consisting of 54 clinical capabilities to be delivered in six increments between 2014 and 2017. Among the agreed-upon capabilities to be delivered were those supporting laboratory, anatomic pathology, pharmacy, and immunizations. According to VA and DOD, the single system had an estimated life cycle cost of $29 billion through the end of fiscal year 2029. However, in February 2013, the Secretaries of VA and DOD announced that they would not continue with their joint development of a single electronic health record system. This decision resulted from an assessment of the iEHR program that the secretaries had requested in December 2012 because of their concerns about the program facing challenges in meeting deadlines, costing too much, and taking too long to deliver capabilities. In 2013, the departments abandoned their plan to develop the integrated system and stated that they would again pursue separate modernization efforts. In December 2013, VA initiated its VistA Evolution program as a joint effort of VHA and OI&T. The program was to be comprised of a collection of projects and efforts focused on improving the efficiency and quality of veterans’ health care, modernizing the department’s health information systems, increasing the department’s data exchange and interoperability with DOD and private sector health care partners, and reducing the time it takes to deploy new health information management capabilities. Further, the program was intended to result in lower costs for system upgrades, maintenance, and sustainment. However, VA ended the VistA Evolution program in December 2018 to focus on its new electronic health record system acquisition. In June 2017, VA’s Secretary announced a significant shift in the department’s approach to modernizing VistA. Specifically, rather than continue to use VistA, the Secretary stated that the department would acquire the same electronic health record system that DOD is implementing. In this regard, DOD awarded a contract to acquire a new integrated electronic health record system developed by the Cerner Corporation. According to the Secretary, VA decided to acquire this same product because it would allow all of VA’s and DOD’s patient data to reside in one system, thus enabling seamless care between the department and DOD without the manual and electronic exchange and reconciliation of data between two separate systems. According to the Secretary, this fourth VistA modernization initiative is intended to minimize customization and system differences that currently exist within the department’s medical facilities, and ensure the consistency of processes and practices within VA and DOD. When fully operational, the system is intended to be a single source for patients to access their medical history and for clinicians to use that history in real time at any VA or DOD medical facility, which may result in improved health care outcomes. According to VA’s Chief Technology Officer, Cerner is expected to provide integration, configuration, testing, deployment, hosting, organizational change management, training, sustainment, and licenses necessary to deploy the system in a manner that meets the department’s needs. To expedite the acquisition, in June 2017, the Secretary signed a “Determination and Findings,” for a public interest exception to the requirement for full and open competition, and authorized VA to issue a solicitation directly to Cerner. Accordingly, the department awarded a contract to Cerner in May 2018 for a maximum of $10 billion over 10 years. Cerner is to replace VistA with a commercial electronic health record system. This new system is to support a broad range of health care functions that include, for example, acute care, clinical decision support, dental care, and emergency medicine. When implemented, the new system will be expected to provide access to authoritative clinical data sources and become the authoritative source of clinical data to support improved health, patient safety, and quality of care provided by VA. Further, the department has estimated that, as of November 2018, an additional $6.1 billion in funding, above the Cerner contract amount, will be needed to fund additional project management support supplied by outside contractors, government labor costs, and infrastructure improvements over a 10-year implementation period. Deployment of the new electronic health record system at three initial sites is planned for March 2020, with a phased implementation of the remaining sites over the next decade. Each VA medical facility is expected to continue using VistA until the new system has been deployed at that location. After VA announced in June 2017 that it planned to acquire the Cerner electronic health record system, we testified in June 2018 that a governance structure had been proposed that would be expected to leverage existing joint governance facilitated by the Interagency Program Office. At that time, VA’s program officials had stated that the department’s governance plans for the new program were expected to be finalized in October 2018. However, the officials had not indicated what role, if any, the Interagency Program Office was to have in the governance process. This office has been involved in various approaches to increase health information interoperability since it was established by the National Defense Authorization Act for Fiscal Year 2008 to function as the single point of accountability for DOD’s and VA’s electronic health record system interoperability efforts. In September 2018, we recommended that VA clearly define the role and responsibilities of the Interagency Program Office in the governance plans for acquisition of the department’s new electronic health record system. The department concurred with our recommendation and stated that the Joint Executive Committee, a joint governance body comprised of leadership from DOD and VA, had approved a role for the Interagency Program Office that included providing expertise, guidance, and support for DOD, VA, and joint governance bodies as the departments continue to acquire and implement interoperable electronic health record systems. However, the department has not yet provided documentation supporting these actions and how they relate to VA’s governance structure for the new acquisition. In addition, the role described does not appear to position the office to be the single point of accountability originally identified in the National Defense Authorization Act for Fiscal Year 2008. We continue to monitor the department’s governance plans for the acquisition of the new electronic health record system and its relationship with the Interagency Program Office. The Family Caregiver Program Has Not Been Supported by an Effective IT System In May 2010, VA was required by statute to establish a program to support family caregivers of seriously injured post-9/11 veterans. In May 2011, VHA implemented its Family Caregiver Program at all VA medical centers across the country, offering caregivers an array of services, including a monthly stipend, training, counseling, referral services, and expanded access to mental health and respite care. In fiscal year 2014, VHA obligated over $263 million for the program. In September 2014, we reported that the Caregiver Support Program office, which manages the program, did not have ready access to the types of workload data that would allow it to routinely monitor the effects of the Family Caregiver Program on VA medical centers’ resources due to limitations with the program’s IT system—the Caregiver Application Tracker. Program officials explained that this system was designed to manage a much smaller program and, as a result, the system has limited capabilities. Outside of obtaining basic aggregate program statistics, the program office was not able to readily retrieve data from the system that would allow it to better assess the scope and extent of workload problems at VA medical centers. Program officials also expressed concern about the reliability of the system’s data. The lack of ready access to comprehensive workload data impeded the program office’s ability to monitor the program and identify workload problems or make modifications as needed. This runs counter to federal standards for internal control which state that agencies should monitor their performance over time and use the results to correct identified deficiencies and make improvements. We also noted in our report that program officials told us that they had taken initial steps to obtain another IT system to support the Family Caregiver Program, but they were not sure how long it would take to implement. Accordingly, we recommended that VA expedite the process for identifying and implementing a system that would fully support the Family Caregiver Program. VA concurred with our recommendation and subsequently began taking steps to implement a replacement system. However, the department has encountered challenges related to the system implementation efforts. We have ongoing work to evaluate VA’s effort to acquire a new IT system to support the Family Caregiver Program. Additional Actions Can Improve Efforts to Develop and Use the Veterans Benefits Management System In September 2015, we reported that VBA had made progress in developing and implementing VBMS—its system for processing disability benefit claims—but also noted that additional actions could improve efforts to develop and use the system. Specifically, VBA had deployed the initial version of the system to all of its regional offices as of June 2013. Further, after initial deployment, it continued developing and implementing additional system functionality and enhancements to support the electronic processing of disability compensation claims. Nevertheless, we pointed out that VBMS was not able to fully support disability and pension claims, as well as appeals processing. While the Under Secretary for Benefits stated in March 2013 that the development of the system was expected to be completed in 2015, implementation of functionality to fully support electronic claims processing was delayed beyond 2015. In addition, VBA had not produced a plan that identified when the system would be completed. Accordingly, holding VBA management accountable for meeting a time frame and demonstrating progress was difficult. Our report further noted that, even as VBA continued its efforts to complete the development and implementation of VBMS, three areas were in need of increased management attention: cost estimating, system availability, and system defects. We also noted in our report that VBA had not conducted a customer satisfaction survey that would allow the department to compile data on how users viewed the system’s performance and, ultimately, to develop goals for improving the system. We made five recommendations to improve VA’s efforts to effectively complete the development and implementation of VBMS. VA agreed with four of the recommendations. In addition, the department has addressed one of the recommendations—that it establish goals for system response time and use the goals as the basis for reporting system performance. However, the department has not yet fully addressed our remaining recommendations to (1) develop a plan with a time frame and a reliable cost estimate for completing VBMS, (2) reduce the incidence of system defects present in new releases, (3) assess user satisfaction, and (4) establish satisfaction goals to promote improvement. Continued attention to these important areas can improve VA’s efforts to effectively complete the development and implementation of VBMS and, in turn, more effectively support the department’s processing of disability benefit claims. VA Has Demonstrated Uneven Progress toward Implementing Key FITARA Provisions FITARA included provisions for federal agencies to, among other things, enhance government-wide acquisition and management of software, improve the risk management of IT investments, consolidate data centers, and enhance CIOs’ authorities. Since its enactment, we have reported numerous times on VA’s efforts toward implementing FITARA. VA’s progress toward implementing key FITARA provisions has been uneven. Specifically, VA issued a software licensing policy and has generated an inventory of its software licenses to inform future investment decisions. However, the department did not fully address requirements related to IT investment risk, data center consolidation, or CIO authority enhancement. VA has made progress in addressing federal software licensing requirements. In May 2014, we reported on federal agencies’ management of software licenses and stressed that better management was needed to achieve significant savings government-wide. Specifically regarding VA, we noted that the department did not have comprehensive policies that included the establishment of clear roles and central oversight authority for managing enterprise software license agreements, among other things. We also noted that it had not established a comprehensive software license inventory, a leading practice that would help the department to adequately manage its software licenses. The inadequate implementation of these and other leading practices in software license management was partially due to weaknesses in the department’s policies related to licensing management. Thus, we made six recommendations to VA to improve its policies and practices for managing licenses. For example, we recommended that the department regularly track and maintain a comprehensive inventory of software licenses and analyze the inventory to identify opportunities to reduce costs and better inform investment decision making. Since our 2014 report, VA has taken actions to implement all six recommendations. For example, the department implemented a solution to generate and maintain a comprehensive inventory of software licenses using automated tools for the majority of agency software license spending and/or enterprise-wide licenses. Additionally, the department implemented a solution to analyze agency-wide software license data, including usage and costs; and it subsequently identified approximately $65 million in cost savings over 3 years due to analyzing one of its software licenses. VA has made limited progress in addressing the FITARA requirements related to managing the risks associated with IT investments. In June 2016, we reported on risk ratings assigned to investments by CIOs. We noted that the department had reviewed compliance with risk management practices, but had not assessed active risks when developing its risk ratings. VA determined its ratings by quantifying and combining inputs such as cost and schedule variances, risk exposure values, and compliance with agency processes. Metrics for compliance with agency processes included those related to program and project management, project execution, the quality of investment documentation, and whether the investment was regularly updating risk management plans and logs. When developing CIO ratings, VA chose to focus on investments’ risk management processes, such as whether a process was in place or whether a risk log was current. Such approaches did not consider individual risks, such as funding cuts or staffing changes, which detail the probability and impact of pending threats to success. Instead, VA’s CIO rating process considered several specific risk management criteria: whether an investment (1) had a risk management strategy, (2) kept the risk register current and complete, (3) clearly prioritized risks, and (4) put mitigation plans in place to address risks. As a result, we recommended that VA factor active risks into its CIO ratings. We also recommended that the department ensure that these ratings reflect the level of risk facing an investment relative to that investment’s ability to accomplish its goals. VA concurred with the recommendations and cited actions it planned to take to address them. VA has reported progress on consolidating and optimizing its data centers, although this progress has fallen short of targets set by OMB. Specifically, VA reported a total inventory of 415 data centers, of which 39 had been closed as of August 2017. While the department anticipated another 10 data centers would be closed by the end of fiscal year 2018, these closures fell short of the targets set by OMB. Further, while VA reported $23.61 million in data center-related cost savings and avoidances from 2012 through August 2017, the department did not realize further savings from the additional 10 data center closures. In addition, as of February 2017, VA reported meeting one of OMB’s five data center optimization metrics related to power usage effectiveness. Also, the department’s data center optimization strategic plan indicated that VA planned to meet three of the five metrics by the end of fiscal year 2018. Further, while OMB directed agencies to replace manual collection and reporting of metrics with automated tools no later than fiscal year 2018, the department had only implemented automated tools at 6 percent of its data centers. We have recommended that VA take actions to address data center savings goals and optimization performance targets identified by OMB. The department has taken actions to address these recommendations, including reporting data center consolidation savings and avoidance costs to OMB and updating its data center optimization strategic plan. However, the department has yet to address recommendations related to areas that we reported as not meeting OMB’s established targets, including implementing automated monitoring tools at its data centers. VA has made limited progress in addressing the CIO authority requirements of FITARA. Specifically, in November 2017, we reported on agencies’ efforts to utilize incremental development practices for selected major investments. We noted that VA’s CIO had certified the use of adequate incremental development for all 10 of the department’s major IT investments. However, VA had not updated the department’s policy and process for the CIO’s certification of major IT investments’ adequate use of incremental development, in accordance with OMB’s guidance on the implementation of FITARA, as we had recommended. As of October 2018, a VA official stated that the department was working to draft a policy to address our recommendation, but did not identify time frames for when all activities would be completed. In January 2018, we reported on the need for agencies to involve CIOs in reviewing IT acquisition plans and strategies. We noted that VA’s CIO did not review IT acquisition plans or strategies and that the Chief Acquisition Officer was not involved in the process of identifying IT acquisitions. Accordingly, we recommended that the VA Secretary ensure that the office of the Chief Acquisition Officer is involved in the process to identify IT acquisitions. We also recommended that the Secretary ensure that the acquisition plans or strategies are reviewed and approved in accordance with OMB guidance. The department concurred with the recommendations and, in a May 2018 update, provided a draft process map that depicted its forthcoming acquisition process. However, as of March 2019, this process had not yet been finalized and implemented. In August 2018, we reported that the department had only fully addressed two of the six key areas that we identified—IT Leadership and Accountability and Information Security. The department had partially addressed IT Budgeting, minimally addressed IT Investment Management, and had not at all addressed IT Strategic Planning or IT Workforce. Thus, we recommended that the VA Secretary ensure that the department’s IT management policies address the role of the CIO for key responsibilities in the four areas we identified. The department concurred with the recommendation and acknowledged that many of the responsibilities provided to the CIO were not explicitly formalized by VA policy. VA’s Cybersecurity Management Lacks Key Elements In December 2018, we reported on the effectiveness of the government’s approach and strategy for securing its systems. The federal approach and strategy for securing information systems is prescribed by federal law and policy, including FISMA and the presidential executive order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure. Accordingly, federal reports describing agency implementation of this law and policy, and reports of related agency information security activities, indicated VA’s lack of effectiveness in its efforts to implement the federal approach and strategy. Our December 2018 report identified that the department was deficient or had material weaknesses in all four indicators of departments’ effectiveness in implementing the federal approach and strategy for securing information systems. Specifically, VA was not effective in the Inspector General Information Security Program Ratings, was found to have material weaknesses in the Inspector General Internal Control Deficiencies over Financial Reporting, did not meet CIO Cybersecurity Cross-Agency Priority Goal Targets, and had enterprises that were at risk according to OMB Management Assessment Ratings. We reported on federal high-impact systems—those that hold sensitive information, the loss of which could cause individuals, the government, or the nation catastrophic harm—in May 2016. We noted that VA had implemented numerous controls, such as completion of risk assessments, over selected systems. However, the department had not always effectively implemented access controls, patch management, and contingency planning to protect the confidentiality, integrity and availability of these high-impact systems. These weaknesses existed in part because the department had not effectively implemented elements of its information security program. We made five recommendations to VA to improve its information security program. The department concurred with the recommendations and, as of March 2019, had implemented three of the five recommendations. Our March 2019 report on the federal cybersecurity workforce indicated that VA was not accurately categorizing positions to effectively identify critical staffing needs. The Federal Cybersecurity Workforce Assessment Act of 2015 required agencies to assign the appropriate work role codes to each position with cybersecurity, cyber-related, and IT functions. Agencies were to assign a code of “000” only to positions that did not perform IT, cybersecurity, or cyber-related functions. As we reported, VA had assigned a “000” code to 3,008 (45 percent) of its 6,636 IT positions. Human resources and IT officials from the department stated that they may have assigned the “000” code in error and that they had not completed the process to validate the accuracy of their codes. We recommended that VA take steps to review the assignment of the “000” code to any of the department’s positions in the IT management occupational series and assign the appropriate work role codes. VA concurred with the recommendation and indicated that it was in the process of conducting a cyber coding review. In conclusion, VA has long struggled to overcome IT management challenges, which have resulted in a lack of system capabilities needed to successfully implement critical initiatives. In this regard, VA is set to begin deploying its new electronic health record system in less than 1 year and questions remain regarding the governance structure for the program. Thus, it is more important than ever for the department to ensure that it is managing its IT budget in a way that addresses the challenges we have identified in our previous reports and high-risk updates. If the department continues to experience the challenges that we have previously identified, it may jeopardize its fourth attempt to modernize its electronic health record system. Additionally, the department has been challenged in fully implementing provisions of FITARA, which has limited its ability to improve its management of IT acquisitions. Until the department implements the act’s provisions, Congress will be unable to effectively monitor VA’s progress and hold it accountable for reducing duplication and achieving cost savings. Further, the lack of key cybersecurity management elements at VA is concerning given that agencies’ systems are increasingly susceptible to the multitude of cyber-related threats that exist. As VA continues to pursue modernization efforts, it is critical that the department take steps to adequately secure its systems. Chair Lee, Ranking Member Banks, and Members of the Subcommittee, this completes my prepared statement. I would be pleased to respond to any questions that you may have. GAO Contact and Staff Acknowledgments If you or your staffs have any questions about this testimony, please contact Carol C. Harris, Director, Information Technology Management Issues, at (202) 512-4456 or harrisc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony statement. GAO staff who made key contributions to this testimony are Mark Bird (Assistant Director), Eric Trout (Analyst in Charge), Justin Booth, Rebecca Eyler, Katherine Noble, Scott Pettis, Christy Tyson, and Kevin Walsh. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.