oversight

Year 2000 Computing Crisis: Actions Needed to Ensure Continued Delivery of Veterans Benefits and Health Care Services

Published by the Government Accountability Office on 1999-06-11.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

      United States

GAO   General Accounting Office
      Washington, D.C. 20548

      Accounting and Information
      Management Division



      B-281270


      June 11,1999

      The Honorable Togo D. West
      The Secretary of Veterans Affairs

      Subject: Year 2000 Computing Crisis: Actions Needed to Ensure Continued Delivery
               of Veterans Benefits and Health Care Services

      Dear Mr. Secretary:

      On April l&1999, we testified before the Subcommittee on Oversight and
      Investigations, House Committee on Veterans’ Affairs, on the readiness of the
      Department of Veterans Affairs (VA) to deliver benefits and health care services
      through the turn of the century.’ In our testimony we reported that, while VA
      continues to make progress, key actions remain to be performed. Specifically, (1) the
      Veterans Benefits Administration (VBA) and Veterans Health Administration (IHA)
      have not yet completed testing of their mission-critical systems to ensure that the
      systems can reliably accept future dates, (2) VHA has not yet completed assessments
      of its facility systems, (3) VHA’s pharmaceutical operations are at risk because the
      automated systems supporting its consolidated mail outpatient pharmacies (CMOP)
      are not yet Y2K compliant, (4) VHA does not yet include the CMOP systems in its
      quarterly report of mission-critical systems to the Office of Management and Budget
      (OMB), and (5) VHA does not yet know if its medical facilities will have a sufficient
      supply of pharmaceutical and medical-surgical supplies on hand because it does not
      have complete information on the YtZK-readiness of these manufacturers.

      This report transmits our recommendations to VA for completing key actions
      necessary to ensure the continued delivery of benefits and health care services to
      veterans beyond January 1,200O. Our testimony, reprinted as enclosure 1, contains a
      description of our objectives, scope, and methodology. As you know, we
      incorporated VA’s comments into our April 15 testimony. We performed our work in
      accordance with generally accepted government auditing standards.



      ‘Year 2000 Computing Crisis: Action Needed to Ensure Continued Deliverv of Veterans
      &n&its and Health Care Services(GAOfl-AIMD-99-136,April 15,1999).



                                   GAO/AIh!lD-99-190R
                                                    Veterans Benefits and Health Care Services
B-281270                                                        a



Recommendations     to the Secretary    of Veterans   Affairs

Based on our April 15,1999, testimony, we recommend that the Secretary of Veterans
Affairs ensure that the following specific actions are taken:

   CompleteY2K testing of VBA and VHA mission-critical systems-including
   systems acceptance testing, full future-date testing, end-to-end testing, and
   business process simulation testing on compliant platforms.
   Set deadlines to complete assessment, renovation, validation, and implementation
   of VHA facility systems.
   Develop business continuity and contingency plans for VHA CMOPs to ensure an
   uninterrupted supply of medications to veterans in the event of Y2K problems at
   these facilities.
   ReassessVA’s decision not to report CMOP systems as mission-critical. Reporting
   these systems as mission-critical to VA top management and OMB wilI help ensure
   that necessary attention is paid and action taken.
   Seek the assistance of the Food and Drug Administration and industry trade
   associations in obtaining information on the Y2K readiness of specific
   pharmaceutical and medical-surgical suppliers that did not respond to WA’s
   survey, and publicize the results in a single data clearinghouse.

Apencv Comments      and Our Evaluation

In commenting on a draft of this report, the Department of Veterans Affairs generally
concurred with our recommendations. VA also provided additional information on its
efforts to assure confidence in its ability to continue delivering services to veterans
and their beneficiaries. For example, it noted that all VA applications, including those
supporting benefits delivery and health care, have completed the renovation,
verification, and implementation phases. VA noted that it still needs to complete
post-implementation testing and said that testing is scheduled to be complete by
September 1,1999. VA further noted that it has completed business contingency and
continuity plans for benefits delivery and health care and that these are in place at
each of VA’s regional offkes and medical facilities. VA’s written comments are
reprinted in their entirety as enclosure 2.



This report contains recommendations to you. As you know, the head of a federal
agency is required by 31 U.S.C. 720 to submit a written statement on actions taken on
these recommendations to the Senate Committee on Governmental Affairs and the
House Committee on Government Reform not later than 60 days after the date of this
report. A written statement must also be sent to the House and Senate Committees
on Appropriations with the agency’s first request for appropriations made more than
60 days after the date of this report.



 Page2                      GAOMMD-99-190R Veterans Benefits and Health Care Services
                                                               r
B-281270



We are sending copies of this report to Senator Christopher S. Bond, Senator Robert
Byrd, Senator Tom Harkin, Senator Barbara Mikrdski, Senator John D. Rockefeller,
Senator Arlen Specter, Senator Ted Stevens, Representative Michael Bilirakis,
Representative Corrine Brown, Representative Sherrod Brown, Representative Lane
Evans, Representative Terry Everett, Representative Bob Filner, Representative Luis
Gutierrez, Representative Ron Klink, Representative Alan B. Mollohan,
Representative Jack Quinn, Representative Clifford Stearns, Representative Bob
Stump, Representative Fred Upton, and Representative James T. Walsh in their
capacities as Chairmen and Ranking Minority Members of Senate and House
Committees and Subcommittees. We are also sending copies to the Honorable Jane
E. Henney, Commissioner of the Food and Drug Administration; the Honorable Jacob
J. Lew, Director of the Office of Management and Budget; and the Honorable John
Koskinen, Chair of the President’s Council on Year 2000 Conversion. Copies will also
be made available to others upon request.

Should you or your staff have any questions concerning this report, please contact me
at (202) 512-6253. I can also be reached by e-mail at memssenj.aimd@gao.gov
Major contributors to this report are listed in enclosure 3.

Sincerely yours,




Director, Civil Agencies Information Systems




Page 3                    GAO/AIMD99-190R Veterans Benefits and Health Care Services
Enclosure 1

GAO Testimony Dated April 15,1999



                               United States General Acconnting Office

              GAO              Testimony
                               Before the Subcommittee on Oversight and Investigations,
                               Committee on Veterans’Affairs, House of Representatives




                               YEAR2OO0COMPUTING
                               CRISIS
                               Action Needed to Ensure
                               Continued Delivery of
                               Veterans Benefits and
                               Health Care Services
                               Statement of Joel C. W2lemssen
                               Director, Civil Agencies Information Systems
                               Accounting and Information Management Division




                               j&$&g&&
              GAO/T-m-99-136




                  Page 4            GAO/AIMD-99-190R Veterans Benefits and Health Care Services
Enclosure 1
GAO Testimony   Dated April   15,1999




Page 5                        GAO/AIMD-99-190R   Veterans   Benefits   and Health   Care Services
 Enclosure 1
 GAO Testimony   Dated April   15,1999




                          Mr. Chairman and Members of the Subcommittee:

                          We appreciate the opportunity to participate in today’s hearing on the
                          readiness of the Department of Veterans Affairs (VA) to deliver benefits and
                          health care services through the turn of the century. We will focus on the
                          Year2000 (Y2K) readiness of automated systems that support such
                          delivery, the compliance status of biomedical equipment used in patient
                          care. and the Y2K readiness of the pharmaceutical and medical-surgical
                          manufacturers upon which VA relies. In discussing biomedical equipment
                          and pharmaceutical products, we will also share with you information on
                          the Food and Drug Adminlltion’s       (FDA) Y2K effortz~~

                          In brief, VA continues to make progress in its Y2Kreadiness. However, key
                          actions remain co be perfornwd. For example, the Veterans Reneiits
                          Administration (TBA) and Veterans Health Administration (VHA) have not
                          yet complatad testing of their missio~ca~        systems to ensure that these
                          systems can reliably accept future dates-such as January 1,2000. Also,
                          VHA has not completed assessments for its facility systems, which can be
                           essential M ensuring continuing health rare. In addition, neither VA nor
                          FDA have implemented our prior recommendation to review the test
                          results for biomedical equipment used in critical cawlife support
                          environments. Further, Vi-IA’s pharmaceutical operations are at risk
                          because the automated systems supporting its consotidated mail outpatient
                          pharmacies are not Y2K compliant. Finally, VHA does not know if its
                          medical facilities will have a sufficient supply of pharmaceutical and
                          medical-surgical supplies on hand because it does not have complete
                           information on the Y2K readiness of these manufacturns. It is critical that
                          these concerns be addressed ifVA is to continue reliily delivering benefits
                          and health care.


Key Actions Remain to     Likemany o~anizations, VA faces the possibility of computer system
                          failures at the turn of the century due to incorrect information processing
Ensure That VA Can        relating to dates. The reason for this is that in many systems, the year 2000
Deliver Benefits and      is indistinguishable from 1900, since the year is represented only by ‘00.”
Health Care Into the      This could make veterans who are eligible for benefits and medical can
                          appear ineligible. If this happens, the issuance of benefits and the
Next Century




   Page 6                        GAO/AIMD-99-190R             Veterans      Benefits     and Health       Care Services
Enclosure 1
GAO Testimony   Dated April     15,1999




                                                                                                                    1




                         provision of medical care that veterans rely on could be delayed or
                         interrupted.

                         As we reported last August,’ VBA had made progress in addressing the
                         reconmwndatiow in our May 1997 report’ and making its information
                         systems Y2K compliant. 1 reported it had renovated 75 percent of its
                         missioncritical applications as of June 1998. At the same time, VHA
                         reported it had assessed all and renovated the vast mqiority of its mission-
                         critical infonw.tion systems.

                         Despite this progress, VBA was making limited progress in renovating two
                         key mission-critical applications-the compensation and pension online
                         application and the Beneficiary Identification and Record Locator Sub-
                         System. And, except for its insurance Service, VBA bad not developed
                         business continuity and contingency plans for irs program services-
                         Comuensation and Pension (the larzesth Education. Loan Guaranty. and
                         Voc&onal Rehabilitation a& Cou&li$-to          ens& that they would
                         continue to operate if Y2K failures occurred.

                         VHA’s YZK progmm likewise had areas of concern. For example, although
                         WA’s medical facilities had hospital contingency plans. as required by the
                         Joint Commission on Accreditation of Healthcare Organizations, they had
                         not yet completed Y2K business continuity and contingency plans. To
                         address these areas and to reduce the likelihood of delayed or interrupted
                         benetits and health care services, we recommended that VA

                         l    reassess its Y2K mission-critical efforts for the compensation and
                              pension online application and the Beneficisq Identification and
                              Record Locator Sub-System, as well as other information technology
                              initiatives, such as special projects, to ensure that the Y2K efforts have
                              adequate resources, including contract support, to achieve compliance
                              in time;
                         l    establish critical deadlines for the preparation of business continuity
                              and contingency plans for each core business process or program
                              service so that missionuitical functions affecting benefits delivery can
                              be carried out even if software applications and commercial-off-the-




                                 GAO/AIMD-99-19OR             Veterans      Benefits     and Health Care Services
  Enclosure 1
  GAO Testimony    Dated April       15,1999




                                  shelf (COTS) products fail, including a description of resources, staff
                                  roles, procedures, and timetables needed for implementation; and
                            l     ensure rapid development of business continuity and contingency plans
                                  for each medical facility so that mission-critical functions affecting
                                  patient care can be carried out if software applications, COTS products,
                                  and/or facility-reIated systems and equipment do not function properly,
                                  including a description of resources, staff roles, procedures. and
                                  timetables needed for implementation4


VA Continues to Make        VA has been responsive to our recommendations. For example, VBA
Progress                    reassessed its missionsriticai effoas for the compensation and pension
                            online application and the Beneficiary Identification and Record Locator
                            SubSystem, as well as other information &xhnoIogy initiatives. it also
                            reallocated resources to ensure that the Y2K efforts had adequate
                            resources, including contract support, to achieve compliance.

                                In addition, VBA completed a dmft business continuity and contingency
                                plan in January 1999 for its core business processes, as well as a related
                                planning template for its regional oflices. The plan provides a high-level
                                overview of the resmrces, staff roles, procedures, and timetables for its
                                implementation. It addresses risks, includii mitigation~actions to reduce
                                the impact of Y2K:mduced business failures, and analyzes the effect on
                                each business line of a number of potential Y2K disasters-such as loss of
                                electrical power, loss of communications, loss of datilprocessing
                                capabilities, and failure of internal inlrastructurc. According to VBA, the
                                plan, which it expects to test this August, is an evolving document, to be
                                revised and updated periodically untilJanuary 1.2000.

                                VBAk plan makes no reference to contingencies for the failure of three of
                                VB& benefit payment systems-Compensation and Pension, Education,
                                and Vocational Rehabilitation and Counseliw. However. it is currentlv
                                developing a payment contingency plan for these systams and expects this
                                to be completed in May 1999. A VBA o~cial told us that the payment
                                contingency plan should have beenraferencedin VU’s business continuity
                                and contingency plan and will be in future versions. The current plan also
                                does not contain the designation of an infmmation technotogv security
                                coordinator and a physical security coordinator-individualsthat VBA
                                acknowledges are essential to the agency’s Y2K efforts-with responsibility




    Page 8                             GAOIAIMD-99-19OR            Veterans      Benefits    and Health       Care Services
Enclosure 1
GAO Testimony   Dated April   15,1999




                        for ensuring overall security for VBAs network and web site and backing
                        up data storage before, during, and following January 1,2CC0. This type of
                        information will be necessary if security-related failures occur. According
                        to VBA, it expects to designate these individuals by August 1999.

                        VHA has also made progress in developing business contfnui~ and
                        contingency plans for its medical facilities. Last month. VHA issued its
                        Patient-Focused Year 2000 Contingency Planning Guidehook to its medical
                        facilities describing actions they can take to minindze Y2K-related
                        disruptions to patient care. The guidebook discusses how the facilities
                        should develop contingency plans for each major hospital function-such as
                        radiology, pharmacy, and laboratory+s well as each major support
                        function-such as telecommunications,       facility systems, medical devices,
                        and automated information systems. The guidebook also contains
                        examples of plans, policies, and solutions for problems that a medical
                        faciiity may face and provides Y2K templates describing the areas a facility
                        should address by specific hospital function. VA provided this guidebook
                        to the medical facilities early last month and expects the facilities to use it
                        to prepare their individual business continuity and contingcncyplans, set
                        to be completed by April 30. The guidebook stresses that these plans
                        should be tested and suggesrs that the medical facilities be&t testing in
                        June.

                        The guidebook addresses external emergency preparedness se weIl as
                        int.emal operations. Specifically, it discusses three functions that medical
                        facilities should perform in order to ensure thal potential external hazards
                        are considered and planned for. Theseare (1) performing an assessment of
                        hazard vulnerabilities-that is, the types and kinds of Y2Kproblems that are
                        anticipated within the community, (2) conducting an inventory of
                        conununity resources-people. money, clinical space, supplies, and
                        equipment-available to address these hazards, and (3) closing the gap
                        between vulnerabihties and capabilities by putting into place measures that
                        will mitigate potential diiptions    in critical servicers by developing new
                        working relationships with Various government agencies, non-VA he&h
                        care organizations, and vendors of crhical auppliis.

                        1x1addition to implementing our recommendations, VA continues to make
                        progress renovating, validating, and implementing its systems. On
                        March 31.1999, VA reported to the Office of Management and Budget
                        (OMB) that the department has renovated and implemented all of the
                        mission-critical applications supporting its 11 .systems areas. As shown in
                        table 1, VBA has six of these areas, and VHA has two.




                              GAOIAIMD-99-19OR             Veterans      Benefits     and Health          Care Services
  Enclosure 1
  GAO Testimony      Dated April    15,1999




                              Table 1: Reported status of VA’s Mirsion-Clitisel      Cornput& Systems Amas kd        ”
                              Their Appllcattona

                                                                                               Number of applications
                                                                                                renovated DI **Placed
                              Veterans Benefits          Compensattm and Pension                                      30
                              Administration (6)         Fd,nwnn                                                     74

                                                         Loan Guaranty                                               19
                                                         Vocational Rehabilitatiin                                    4
                                                         Administmtiue                                               27

                              V’dlerans Health             v*temns Hs*th 1”tommtion
                              Admtntstrabn (2)             Systems and Technolagy
                                                           Archttectur.3
                                                           Vet%ms Health Administration
                                                           Corporate Syslems
                                                           Total
                              National Cemetety            Burial opeatians support S~Srn/
                              System (1)                   Automated Monument Application
                                                           System
                                                           Reengineer
                                                           mtat
                              Ollice 01 Financial          Petsannel and Accounting
                              fdanegement (2)              tntegrated Data
                                                            Ftnamial Management System
                                                           Total
                              v* total                      II
                               -3 mir Wtal.316 appllcatiDnswere re”wat8d snd two welo mpaw3.
                               Source: “A. We hm not independen~vsrifipdthlrfn~rmatl~n.



Testing of Mission-Critical    Complete and thorough Y2K testing is essential to providing reasonable
Systems Not Yet Complete       assurance that new or modified systems will process dates correctly and
                               will not jeopardize an organization’s ability to perform core business
                               operations.~  Because the YZK problem is so pewasive, potentially affecting
                               an organization’s systems software, applications soffnrare, databases,
                               hardware, firmware, embedded processops, tekcommunicaticns, and




    Page 10                            GAO/AIMD-99-19OR                  Veterans        Benefits      and Health          Care Services
Enclosure 1
GAO Testimony   Dated April    15,1999




                         interfaces, the requisite testing can be extensive and expensive.
                         Experience is showing that YZK testing is consuming between 60 and 70
                         percent of a YZK project’s time and resources.

                         According  to our Y2K guide, to be done effectively, testing should be
                         planned and conducted in a shuctured and disciplined fashion. Our guide
                         describes a step-by-step framework for managing MK testing, which
                         includes the following key processes:

                          * Software unit testingto verify that the smallest defined module of
                            software (individual subprograms or procedures) continues to work as
                            intended.
                         l  Sotham integration tcscingto verify that units of sofhvare, when
                            combined, contiiue to work togetheras intended. ?srpicalJy,integration
                            testing focuses on ensuring that the interfaces work correctly and that
                            the integrated softwsre meetS requirements.
                         l  System acceptance testing to verify that the complete system-that is,
                            the full complement ofapplication software running on the target
                            hardware and systems software infrastructure-satisfies specific
                            requirements and is acceptable to users. This testing can be run
                            separately or in some combiition     in an operational environment
                            factual or simulated) and collectively veiifles that the entire system
                            performs as expected.

                         According to VBA and VHA officials, their testing criteria were based on
                         theirsoftware development life cycle guidance documents. They said that
                         upon completion of software unit and integration testing, a system is
                         considered Y2K compliant. They said this type of testing had been
                         completed for all of their mission-critical systems.

                         As of March 31,1999, neither VBA nor VHA had completed systems
                         acceptance testing-which requires that each system be tested, includii
                         full forward-date testing, on a compliant platform-for all their mission-
                         critical systems. Specifically, according to VBA officials, the agency had
                         completed systems acceptance testing for half of its mission-critical
                         systems-Insurance, Loan Guaranty, and Vocational Rehabilitation and
                         Counseling. According to VW’s Man% 1999 draft test plan, systems
                         acceptance testing of the Compensation and Pension and most of the
                         Education systems was to start in mid-April 1999. According to a VBA
                         official. one of the reasons for the late systems testing was that the IBM
                         platfom at its Hines, Illinois, data center was not made Year 2000




                               GAOfAIMD-99-190R             Veterans      Benefits     and Health Care Services
Enclosure 1
GAO Testimony   Dated April   15,1999




                         compliant until the compiler’ was upgraded in February 1339. According
                         to VBA, the Compensation and Pension and most of the Education systems
                         will be future-date tested throughout April.

                         VHA also plyls to begin system acceptance testing of its missioncritical
                         systems   this month and complete it this June. According to VHA officiaLs,
                         they could not perform thii type of testing before March of this year
                         because VHA did not have a separate YZK-compliant test environment to
                         isolate the testing from the hospital systems in use.

                         In addition to testing of individual systems, end-to-end testing of multiple
                         systems GGalso critical. End-m-end testing, as defined lo our test guide,
                         verities that a defined set of interrelated systems, which collectively
                         support an organizational core business area or function, continues to
                         work as intended inan operational environment, either actual orsimulated.
                         For example, in order to successfully process a compensation benefit
                         payment to aveteran, VBXs Compensation and Pension System must work
                         correctly with its Beneficimyldentitication and Records Locator Sub-
                         System. Treasury’s Financial Management System, the Federal Reserve
                         System, and fmancial institution systems.

                         VBA and VHA plan to conduct end-mend testing between now and this
                         July. VBA is defining end-to-end testing as verification that core mission-
                         critical business functions, including benefit payments and vendor and
                         payroll payments, process correctly. The interfaces behveen VBA’s benefits
                         system and ~easu& Financial Management System are to be tested in
                         May. VBA also plans to test transactions that interface with WA syxems,
                         such as infomratian related toveteran eligibility. VITA is defining end-t-
                         end testing as verification that core missionaitical business fununctions,
                         includii patientcare transactions and vendor and payroll payments,
                         process correctly. Once these tests are completed. VBA and VHAplan to
                         conduct a %usiness process simulation” during the July 4,1999, weekend.
                         This simulation of day-today work at VA is to include users at the VBA
                         regional offkes and VHA test laboratories, who wlIl simulate various
                         transactions and process them through a set of interrelated systems
                         necessary to complete a core business function. VBA expects to pretest the
                         business process simulation during May.




 Page 12                           GAO/AIMD-99-190R         Veterans      Benefits     and Health       Care Services
   Enclosure 1
   GAO Testimony     Dated April      Xi,1999




Assessment of VHAk           VAk facility systems are essential to the continued delivery of health care
Facility Systems Not Yet     sctices. For example, heating, ventilating. and air conditioning equipment
                             is used by hospitals to ensure that contaminated air is confined to a
Complete                     specified area such as an isolation room or patient ward. If computer
                             systems used to maintain these syst~s were to fail, any resulting climate
                             fluctuations could affect patient safety.

                             Despite their importance, WA has not yet completed its ascssment of
                             facility systems. As of February 28,1939, VHA medical facilities reporccd
                             that they had assessed 55 percent of their facility systems. According to
                             VHKs Director of Safety and Technical Programs, the remaining 45 percent
                             have not been folly assessed primarily because (1) facility systems tend to
                             be a combination of unique elements that have to be separately assessed
                             for compliance-a timecousumingproce-and            (2) WA is still awaiting
                             compliance status information from facility systemmanufacturers. VHA
                             has not established milestones for completing its assessment and
                             implementation of compliant facility systems. To help ensure that sufficient
                             time remains to complete these activities, we recommend that VHA
                             consider setting such deadlines.

                             In the event that facility-related systems and equipment do not function
                             properly due to Y2K problems. VHA medical facilities will need to ensure
                             that they have business continuity and contingency plans addressing how
                             mission-critical functions affecting patient care will be carried out.
                             According to WA’s Director of Safety and Technical Programs, most of its
                             facility systems have some kid of manu.s.loverride or reset that will allow
                             them to continue functioning after a YZK problem. He agreed, however,
                             with the importance of developing contingency plans lhat fully document
                             continued delivery of essential services in the event of a facility system
                             failure. WA medical facilities expect to have individual business
                             continuity and contingency plans completed by April 30.

                             On April 14.1999, VA informed us that its February 28,13Q9.report
                             contained an error. The corrected numbers for facility systems at the end
                             of February were 91 percent assessed and 3 percent not assessed.




                             Page 8




                                      GAOIAIMD-99-190R          Veterans     Benefits     and Health        Care Services
   Enclosure 1
   GAO Testimony       Dated April     15,1999




BiomedicalEquipment: The   question of whether medical devices such as magnetic r&onance
                       imaging (MRi) systems, x-ray machines. pacemakers, and cardiac
Additional Status      monitoring equipment can be counted on to work reliably on and after
Information Available, January 1,2000, is also critical toVHA To the extent that biomedical
But Test Results Not   equipment uses embedded computerchips, it is vulnerable to the Y2K
                       problem. Such vulnerability carries with it possible safety risks. This could
Reviewed               range from the more benign-such as incorrect formatting of a printout-to
                                  the most serious-such as incorrect operationof equipment with the
                                  potential to adversely affect the patient. The degree of risk depends in
                                  laq$e pat on the role the equipment playsin a patient’care.
                                                                                           s

Additional Biomedical             Last September we testified before this Subcommittee that VHAwas
Equipment Status                  making progress in assessing its biomedical equipment, but that it did not
Information Available             know the full extent of the Y2K problem with this equipment because it had
                                  not received compliance information from 398 manufacturers (26.7
                                  perccnt).7 According to WA, as ofMarch 16, 1999, the number of
                                  nonresponsive  manufacturers    had been reduced to 126 (3.5 per~ent).~ As
                                  shown in tile 2, about 19 percent of the manufacturers in VIWs database
                                  of suppliers had at least one biomedical equipment item that was either
                                  noncompliant or conditionally compliant.




     Page 14                             GAO/AIMD-99-190R            Veterans      Benefits     and Health     Care Services
Enclosure 1
GAO Testimony   Dated April    15,1999




                        Table 2: Status of Hanufactwer     Responses    to VHA 8% of March I&“1999

                        Category
                        Compliant manuladurersa                                              816              55.2
                        Noncompliant manufacture&                                            126               6.5
                        Conditinalcompliant     manufacturersc                               156              10.5
                        Pending manulactumrsd                                                 29               2.0
                        Manufadurers mergedar bought cd                                      226              15.3
                        Nonresponsive manuIadurers’                                          126               a.5
                        Total                                                             1,479              100.0
                        *For i”duSim inthlscatsgory. IW pe”xnt 01 the tnmyIB”“rer’s products hadlo be c&dwed
                        mmptiant.




                        To identify specific biomedical equipment in the inventories of WAS
                        medical facilities that still require Y2K compliance status information from
                        manufacturers, V?Ws Chief Network Oflker sent a letter to the directors of
                        VEiA’s 22 Veterans Integrated Service Networks (VISN). This letter
                        requested that they (1) review VIWs list of manufactw.?rs that have yet to
                        respond and compare it with a list of manufacturers     from whom their
                        medical facilities still require compli~e   information and (2) indicate the
                        equipment item that the facility owns for each matmfacturer. According to
                        VHA’s YZK project director, as of mid-March-with 136 of 147 medical
                        reporting sites-47 biomedical equipment items involving 35 manofactorers
                        were identified as still requiring compliance stauis information. The
                        project diitar    told us that VHA medical facilities have been instructed to
                        replace or eliminate equipment in their inventories for which they do not
                        know the compliance status by June 30. According to WA’s February 1999
                        status report on medical devices, medical facilities &mated that the total
                        cost of renovations will be about $41 million.




Page 15                       GAOIAIMD-99-190R                  Veterans        Benefxts and Health Care Services
Enclosure 1
GAO Testimony   Dated April   15,1999




                         We have previously reported that most manufacturers citing noncompliant
                         producti listed incorrect display of date and/or tie as the Y2K problanY
                         According to VA, these cases do not present a risk to patient safety because
                         health care providers, such as physicians and numes, can work around the
                         problem. Of more setious concern are situations in which devices depend
                         on date calculation.+the results of which can be incorrect One
                         manufacturer cited the example of a product used for plawing delivay of
                         radiation treatment using a radioactiie isotope zs the source. An error in
                         calculating the strength ofthe radiation source on the day of treatment
                         could result in a dose that is too high or too low, which could have an
                         adverse effect on the patient. Other examples of equipment presenting a
                         risk to patient safety identified by manufacturers to FDA include
                         hemodiiysis    delivery systems, therapeutic apheresis system~,‘~ alpha-
                         fetoprotein kits for neural tube defects;” various types of medical imaging
                         equipment; and systems that store, track. and recall images in
                         chronological order.

                         To track the compliance status of its biomedical equipment, WA uses a
                         monthly status report on medical devices based on information provided
                         by the VISNs. According to the February 1999 report, appmximatcly
                         426,000 o1531.000medical devices in VIIA medic& facilities are compliant.
                         Of the remaining devices, 86,452were identified as conditional-compliant
                         or were not assessed for Y2K compliance because the manufacturers
                         certified that the equipment contained no software or embedded chips, and
                         19,073were reported as being noncompliant Of the noncompliant devices
                         identified, 15,621are to be repaired, 1,582 are to be replaced, 757 are to be
                         used as is. 255 are to be retired, and 855 are still awaiting a decision on the
                         remedy. According to WA’s Chief Biomedical Engineer, most of the
                         noncompliant devices identif%edincorrectly displayed date/time.

                         As we reported last September, FDA was also trying to determine the Y2K
                         compliance status of biomedical equipment.‘” Its goal is to provide a

                         pal             .._                                   s.l”mn~
                         K?40/.4lMD98240,
                                      September
                                             LB.Pxe).




 Page 16                        GAOIAIMD-99-190R              Veterans     Benefits      and Health Care Services
    Enclosure 1
    GAO Testimony   Dated April   15,1999




                            comprehensive, centralized source of information on the Y2K compliance
                            status of biomedical equipment used in the United States and make this
                            information publicly available on a web site. At the time, however, FDA
                            had a disappointing response mte from manufacturers to its letter
                            requesting compliance information. And, while FDA made thii
                            information available to the public, it-was not detailed enough to be useful.
                            Specifically, FDAS lii of compliant equipment lacked information on
                            particular make and model.

                            To provide more detailed information on the compliance status of
                            biomedical equipment, as well as to intsgratc more detailed compliance
                            information gathered by K-X, we recommended that VA and the
                            Department of Health and Human Services @HS) jointly develop a single
                            data clearinghouse that provides such information to all users. We said
                            development of the clearinghouse should involve representatives from the
                            health care industry, such as the Department of Dcfcnse and the Health
                            Industry Manufacturers Association. We recommended that the
                            clearinghouse contain such information as (1) the compliance status of all
                            biomedical equipment by make and model and (2) the identity of
                            manufacturers that are no longer in busins%%.We also recommended that
                            VHA and FDA dctcnnine what actions should be taken regarding
                            biomedical equipment manufacturers that have not provided compliance
                            infoItnation.

                            In response to our recommendation, FDA-in cor(iunction with VI&%-has
                            established the Federal Year 2OKJBiomedical Equipment Clearinghouse.
                            With the assisrance of VHA, the Department of Defense, and the Health
                            Industry Manufacturers Association, FDA has made progress in obtaining
                            compliance-status information from manufacturers. For exampie,
                            according to FDA, as of April 5,1999,4,261 biomedical equipment
                            manufacturers had submitted data to the clearinghouse. As shown in
                            f@ue 1, about 64 percent of the manufacturers reported hating products
                            that do not employ a date, while about 16 percent reported having date-
                            related problems such as incorxct display of date/time. FDA is still
                            awaiting responses from 399 manufachuers.




L
                                  GAO/AIMD-99-190R            Veterans      Benefits     and Health         Care Services
Enclosure 1
GAO Testimony   Dated April   15,1999




                         Figurel: Biomedical EquIpmentCompliance-S~~sIntDrma;ion      Reportedto   FDAby
                         t&n”‘aCtUrers as ot April 5.1999




                          FDA has &o    expanded the information in the cletinghouuse. For example,
                          users can now find information    on manufaausers      that have merged with or
                          have been bought out by other    tims   In collaboration    with the National
                          Patient Safety Partneahip,” FDA is in the process of obtaining more
                          detailed information from manufacturers on noncompIian& products, such
                          as make and model and descriptions of tbe impact of the YZK problem on
                          products MtuncoHected.




  Page 18                        GAO/AI&ID-99-19OR              Veterans      Benefits     and Health       Care Services
   Enclosure 1
   GAO Testimony    Dated April   15,1999




Review of Biomedical        We reported last September that VHA and FDA r&cd on manufacturers to
Equipment Test Results      validate, test, and certify that equipment is YZK compliant’” We also
                            reported that there wss no awxance that the msnufacturers adequately
Lacking                     addressed the Y2K emblem for noncompliant       equipment because F’IIA did
                            not require medi&dsvice       manufacture& to submit test results to it
                            certifying compliance. Accordingly, we recommended that VA and HHS
                            take prudent steps fo jointly review manutacturem’ compliance test results
                            for critical careA& support biomedical equipment. We were especially
                            concerned that VA and FDA review test results for equipment previously
                            detcnnined to be noncompliant but now deemed by manufacturers to be
                            compliant, or equipment for which concen~ about compliice remain. We
                            also recommended that VA and HHS determine what legislative, regulatory
                            or other changes were ncc~sary to obtain assursnccs that the
                            manufacturers’ equipment was compliant, including performing
                            independent vezitication and validation of the manufacturers’
                            certiflications.

                            At the time, VA stated that it had no legislative or regulatory authority to
                            impk.ment the recommendation to review test results from manufacturers.
                            in its response, HHS stated that it did not concur with OLUrecommendation
                            to review test results supporting medical device equipment manufacturers’
                            certifications that their equipment is compliant. It believed that the
                            submission of appropriate certTfications of compliance was sufficient to
                            ensure that the certifying manufacturers are in compliance. HHS also
                            stated thar it did not have the resources to undertake such a review, yet we
                            are not aware of HHS’requesting resources from the Congress for this
                            Purp==.

                            More recently, VHAk Chief Biomedical Engineer told us that VB.A medical
                            facilities are not mque9ting test results for critical ca&life support
                            biomedical equipment; they aiso are not curently reviewing the test results
                            available on manufacturers’ web sitcs. He said that VHA’s priority is
                            determining the compliance status of its biomedical equipment inventory
                            and replacing noncompliant equipment. The director of FDAk Division of
                            Electronics and Computer Science likewise said FDA sees no need ta
                            question manufacturers’ certifications.




   Page 19                        GAO/AIMD-99-190R            Veterans     Benefits     and Health Care Services
Enclosure 1
GAO Testimony   Dated April   15,1999




                         In contrast to WA’s and FDXs ~ositiors. some hospitals in the private
                         sector believe that testing hio&edical eq&ment i.~ncceesary to prove that
                         they have exercised due diligence in the pmtection of patient health and
                         safety. Officials at three hospitals told us that their biomedical engineers
                          established their own test programs for biomedical equipment, and in many
                          cases contacted the manufacturers for their tat protocols. Several of
                          these engineers informed us that their testing identified some
                          noncompliant equipment that the manufacturers had certified as
                          compliant. Accordiig to these engineers, to date, the equipment found to
                          be noncompliant all had diibxy problems and was not critical care/life
                          support equipment. We were told that equipment found to bc incorrectly
                          certified as compliant included a cardiac catheterization unit, a pulse
                          oxymeter, medical imaging equipment, and ultrasound equipment.

                          WA, FDA, and the Emergency Care Research Institute” continue to
                          believe that manufacturers are best qualified to analyze embedded systems
                          or software to determine YZK compliance. They further believe that
                          manufacturers are the ones with full access to all design and operating
                          parameters contained in the internal software or embedded chips in the
                          equipment VHA believes that such testing can potentially cause
                          irreparable damage to expensive health care equipment, causing it to lock
                          up or otherwise cease functioning. Further, a number of manufacturers
                          also hwe recommended that users not conduct veriliration and validation
                          testing.

                          We continue to believe that rather than relying solely on manufacturers’
                          certifications, organizations such as VfL4 or FDA can provide users of
                          medical devices with a greater level of confidence that the devices are YZK
                          compliant through independent reviews of manufacturers’ compliance test
                          results. The question of whether to independently verify and validate
                          biomedical equipment that manufacturers have certified as compliant is
                          one that must be addressed jointly by medical fac!Mies clinical sti,
                          biomedical engineers, and corporate management. The overriding
                          crimion should be ensuring patient health and safety.




 Page 20                        GAOIAIMD-99-19OR            Veterans      Benefits    and Health        Care Services
   Enclosure 1
   GAO Testimony   Dated April    15,1999




VHA Pharmaceutical         Another critical component to VA’s ability to deliver health care at the turn
                           of the century is ensuring that the automated systems supporting VHA’s
Operations Also Face       medical faciliQ pharmacies and its consolidated mail outpatient
YZK Risks                  pharmacies (CMOP) are Y2K compliant. VEXAreported that in 1998. itfmed
                           about 72 million prescriptions for3.4 million veterans, at an estimated cost
                           of about $2 billion. About half of the prescriptions were tilled by the over
                           200 pharmacies located in%% medical centers, clinics, and nursing homes.
                           These pharmacies rely on the pharmaceutical applications in the Veterans
                           Health Information Systems Architecture (VIST.4) for (1) drug distribution
                           and inventory management, (2) dispensing of drugs to inpatients and
                           outpatients, (3) patient medication information, and (4) an electronic
                           connection between the pharmacies and the CMOPs. Y2K failures in these
                           applications could impair the pbarnmcies ability to fill prescriptions.

                           The remaining 50 percent of VHA’s prescriptions are tilled by seven CMOPs,
                           geographically located throughout the United States. These facilities are
                           supported by automated systems provided by one of two contractors-
                           SUBaker, Inc. and Siemens ElectroCom. ” For example, the CMOP
                           electronically receives a prescription for a veteran through the medical
                           center. The prescription is downloaded to highly automated dispensing
                           equipment to he filled. The tilled prescription is then validated by a
                           pharmacist who compares the medication against a computerized image of
                           the prescribed medication. Afterward, the prescription is packaged and an
                           automatically generated mailing label is applied for delivery to the veteran.
                           Finally, the medical center is electronically notified that the prescription
                           has been Jilled. Because of the reliance on automation, the CMOPs’ abiity
                           to ffl prescriptions could be delayed or interrupted if a YZK failure
                           occurred.

                           VHA has determined that the automated systems supporting its CMOPs are
                           not Y2K compliant. Specifically, neither of the systems provided by their
                           contractors are Y2K compliant. According to the Y2K coordinator for the
                           SI/Baker facilities, failure to make the SyBaker systems Y2K compliant
                           may delay the fu       of outpatient prescriptions. The SI/Baker systems are
                           used by three of VI-I& CMOPs-Hines, IUinois; Charleston, South Carolina;
                           and Mmfreesboro, Tennessee; they handle about 58 percent of all
                           prescriptions filled by CMOPs. In contrast to the SUBalter systems,
                           according to a contractor hid by the CMOPs that use these sysrems,




 Page 21                         GAO/AIMD-99-190R           Veterans      Benefits     and Health      Care Services
Enclosure 1
GAO Testimony   Dated April   15,1999




                        failure to make tbe Siemens ElecPoCom systems YZK compliant may result
                        in delays in processing management reports for prescriptions filled, but not
                         the actual tilling of prescriptions.

                        Although the CMOPs plan to replacetheir noncompliant systemswith
                        compliant ones, these systems are nbt scheduled to be implemented until
                        mid- to late-1999. As shown in table 3, the earliest estimaed completion
                        date for implementing a compliant system is June 30.1999. while the latest
                        is December 1.1999. This leaves little time to address any unexpected
                        implementation problems.




                                                                                               15.000
                                                         June 30.1999                          16,000
                                                         June 30.1999                          14.ow
                                                         July 31.1999                          16.000
                                                         septemmr 1. 1999                      23,000
                                                         September SO, 1999                    3B.000
                                                         December 1.1999                       21.000




                         Given the late schedule for implementing compliant sy#ms, it is crucial
                         that the CMOPs develop business continuity and contingency plans to
                         enswe that veterans will continue to receive their medications if these
                         systems are not implemented in time or fail to operate properly. AS of
                         March 31. VA had not completed a business continuity and contingency
                         plan for the GMOPs. The YZK coordinator for the Siemens ElectroCon~
                         system has been tasked with developing this plan. which is to be completed
                         by the end of thii month.

                         Further, VA did not include the CMOP systems in its quarterly reports of
                         missioncritical systems to OMB. According to Ws Y2K project direcror,
                         VHA considered the GMOP systems to be COTS products and, therefore,




Page 22                       GAOIAIMD-99-190R             Veterans      Benefits    and Health         Care Services
       Enclosure 1
       GAO Testimony   Dated April     15,1999




                                 did not report them as mission-critical systems. Given the criticality of
                                 these systems to VHA’s ability to ffi prescriptions at thetorn of the century,
                                 we believe VA should reassess this decision, reportiog CMOPs as mission-
                                 critical to VA top management and OMB to help ensure ti-& neefssaxy
                                 attention is paid to and action is taken on them.


VA Taking Action to              VA, like otber users of pharmaceutical and medical-surgical products.
~~~~         YAK ~~~~~~~   ,,f   needs to know whether it will have a sumdent supply of these items for its
Pharmaceutical and               customers. Themfore, it has taken a leadership role in lhe federal
                                 gowmment in determining whether manufacturers supplying these
Medical-Surgical                 productsto VHA are Y2K-ready. This information is essentii to VII&
Manufacturers                    medical faciiities and CMOPs because of their “just-in-tin&t7 inventory
                                 policy. Accordiigly, they must know whether theirmarmfacturers’
                                 processes, which are highly automat.ed,‘8 ace at risk, as well as whether the
                                 rest Of the supply chain will function properly.

                                 To determine the Y2K readiness of their suppliers, on January 8,1999, VA’s
                                 National Acquisition Center (NAC)” sent a survey to 334 phatmaceutical
                                 firms and 459 medicalsurgical firms with which it does business. The
                                 survey contained questions on the fums’ overall YZX status and inquired
                                 about actions taken to assess. inventory, and plan for any perceived impact
                                 that tbe century tomover would have on their ability to operate at normal
                                 levels. In addition, the tirms were asked to provide status information on
                                 progress made to become Y2K compliant and a reliable estimated data
                                 when compliance will be achieved for business processes such as
                                 (1) ordering and receipt of raw materials, (2) mixing and processing
                                 product, (3) comph?ting fiial product processing, (4) packaging and
                                 labeling product, and (5) distributing fmished product to distributors/
                                 wholesalers and end customers.

                                 According to NAC ofEci&, of the 465 firms that responded to the survey as
                                 of March 31.1999, about 55 percent completed all or part of the survey.
                                 The remainder provided general information on their Y2K readiness stahrs




   Page 23                            GAO/AIMD-99-19OR               Veterans     Benefits     and Health Care Services
Enclosure 1
GAO Testimony   Dated April   15,1999




                         or litemtwem on their efforts. As shown in table 4, more than half of the
                         pharmaceutical fums surveyed responded (52 percent), with just less than
                         one-third (37.percent) of those respondents reporting that they are
                         compliant. Among the pharmaceutical fkms that had not responded as of
                         March 31, however, were two of VA’s five largest sup~Iiem.~ The three
                         large pharmaceutical suppliers that did respond provided general
                         informaticm on their Y2K readiness status, rather ihan answering the
                         survey, and enimated thatthey will be compliant by June 30,1999.



                         Table4: Status of CompaniesSutvsycd by “Ii* as of March31.1999




                         Table 4 also shows that 54 percent of the medical~wgical tkms surveyed
                         responded, with about two-thirds of them (166) repating that they are Y2K
                         compliant. All five of Vlis lzugea medicalsurgical suppliers have
                         responded. Spec’fically, two reported being compliiant, two reported they
                         would be compliant by June 30,1999, and the remaining supplier did not
                         report an expected compliance date.

                          On March 17,1999, NAC sent a second letter to its pharmaceutical and
                          medical-surgical fums, infaming them of VA’s plans to make YZK readiness
                          information previously provided to VA available to the public through a
                          web site (wwxva.gov/cx&m1tina/nady2k). VAmade the survey results
                          available an its web site on April 13, 1999. The letter also requested that




 Page 24                        GAOIAIMD-99-190RVeterans                  Benefits        and Health    Care Services
   Enclosure 1
   GAO Testimony       Dated April   X,1999




                               manufacturers that had not previously responded provide information on
                               their readiness. NAG Executive Director said that he would personally
                               contact any major VA supplier that does not respond. On a broader 1~4
                               VHA has taken a leadership role in obtaining and sharing information on
                               the YZX readiness of the oharmaceutical industw. Suecif~caW. VHA chairs
                               the Year 2000 Pharmace&cals Acquisitions andDi&ibution~
                               Subcommittee, which reports to the Chair of the President’s Council on
                               Year 2000 Conversion. The purpose of this subcommittee is to bring
                               together federal and pharmaceutical representatives to address issues
                               concerning supply and distribution as they relate to the yew 2000. The
                               subcommittee consists of FDA, federal health care providers, and industry
                               trade associationssuch as the Pharmaceutical Research and Manufacturers
                               of America (PhRMA), the National Association of Chain Drug Stores, and
                               the National Wholesale Drug&w’ Association. Several of these trade
                               associations have surveyed their members on their Y2K readiness and
                               made the results available to the public. Ilowever. the information is not
                               manufacturer-specific or as detailed as VHA’s survey results.


FDA’s Y2K Efforts for          FDA’s oversight and regulatory responsibility for pharmaceutical and
Pharmaceutical and             biological produc@ is to ensure that they are safe and effective for public
Biological Products            use. Because of its concern about the Y2K impact on manufactun?rs of
                               these products, FDA has taken several actions to raise the Y2K awareness
Industries Were Initially      of the pharmaceutical and biological products industries. In addition. it is
Focused on Awareness           thinking about conducting a survey to determine the industry’s Y?.K
                               readiness.

                               One of FDA’s actions to raise industry awareness was the danwry 1998
                               issuance of indus!ay guidance by the Center for Biologics Evaluation and
                               Research (CBER) on the Y2K impact of computer systems and software
                               applications used in the manufacture of blood products. In addition, as
                               shown in table 5, FDA has issued several letters to pharmaceutical and
                               biological trade associations and sole-source drug manufacturers.




   Page 25                           GAO&MD-99-190R             Veterans      Benefits     and Health         Care Services
    Enclosure        1
    GAO Testimony Dated April l&l999




Table 5: FDA Letters to Msnutacturerc   Regarding YZK
                                                                            Purpose
                                                                            To relay to msrnbers FDA% axpectaticm that the
                                                                            pharmawticat     industry would (1) make resolution of
                                                                            YZK a htgh priority. (2) ensure that prOduction SWemS
                                                                            were tixed and tested prior in January 1.2000. and (3)
                                                                            ume menufacturew to dB”e.lW YZK rn”ti”oe”cv da”*.
October            Center for Siologics        Bidogtcs manufacturer trade Same as above.
,898               Evaluatim and Research      a.ssDclatiDns
January 1999       centerior                   Sole-source drug            Same as above. Also (1) noted thal the impact of YZK
                   Drug Evaluation and         manutacturers               w, pharmaceutical sat&y, efllcaoy, and availability
                   Research                                                merits special attention fw lirms who are the sole
                                                                           mnufachrmrs af drug mmponants bulk ingredients.
                                                                           and Cmitwd prcdwts and (2) statedthat
                                                                           pharmaceutical indusby suppEers must have YZK-
                                                                           mmpliint systems to protect agatnst diiruptkm in the
                                                                           ROWof pmduct camponenb. packaging materials. and
                                                                           equipment to pharmaceutical manufacturers


                                            Further, ort February 11,1999, FDA’s director of emergency and
                                            investigation operations sent a memorandum on FDA!s interim inspection
                                            policy for the YZK problem to the directors of FDA’s investigations branch.
                                            The policy emphasizes FDA’s Y2K awareness efforts for manufacturers. It
                                            states that FDA inspectors are to (1) inform the firm of FDA’s Y2K web page
                                            (URL hnp:/~~dagov/cdr~rgO~4e~gOOO.h~I~,                  (2) provide the fum
                                            with copies of theappropriate   FDA Y2K awareness lettex, (3) explain that
                                            Y2K problem could potentially affect aspefts of the firm’s operations,
                                            includinn some areas not reeulated by FDA. nnd that FDA anticipates that
                                            fums will take prudent steps to ens&c that’they are not adversely affected
                                            by YZK, and (4) provide fvms with a copy of FTNe compliance policy guide
                                             *Year 2000 (YZK) ComputerProblems.”

                                             In addition, FDA and PbRMA jointly held a governmentlindustrg forum on
                                             the Y2K preparedness of the pharmaceutical and biotech industries on
                                             February 22.1999. The objectives of t&is forum ‘Ivenv to (1) share
                                             information on Y2K programs conducted by health care providers,
                                             phmmceutical companies, FDA, and other federal agencies. (2) provide a
                                             vehicle for networkin!& and (3) raise awareness.

                                             On March 231999, FDA revised its February 1 I, 1999, interim inspection
                                             policy. The revision states that field inspectors are now to inquire about
                                             manufactuxem’    efforts   to ensure that their   computer-conWoUed        or date-




       Page 26                                     GAOMMD-99-190R                   Veterans        Benefits       and Health        Care Service:
Enclosure 1
GAO. Testimony   Dated April   15,1999




                         sensitive manufacturing processes and distribution systems are Y2K
                         compliant. Inspectors are to include this information in their reports, along
                         with a determination of activities that fums have completed or started to
                         ensure that they will be Y‘ZK compliant.

                         Further, FDA inspectors may review~diocumcntation in cases in which firms
                         have made changes to their computerized production or manufacturing
                         control srjtems to address WK problems, The purpose of this review is to
                         ensure Chatthe changes were made in accordance with the firms’
                         procedures and applicable regulations. If inspectors determine that a firm
                         has not taken steps to ensure YZK compliance, they are to notify their
                         district managers and the responsible FDA center.

                         FDA’s interim policy describes steps inspectors an to take in reviewing
                         manufacturers’Y2K compliance. However. FDA stated that the primary
                         focus of its inspections for the remainder of 1999 will be to ensure that
                         products sold in the United States arc safe and effective for public use and
                         comply with federal statutes and regulations, including “good
                         manufacturing practice” (GMP).23 FDA ofticiale explained that the agency
                         does not have sufficient resources to perform both regulatory oversight of
                         the manufacturers and in-depth evaiuations of firms XX compliance
                         activities.

                         Nevertheless, according to the March 29,1999, memorandum, field
                         inspecton are to note any concerns they may have with a fii’s Y2K
                         readiness in the admiitrative   remarks section of their inspection reports.
                         These reports are to be reviewed by FDA district managers. If the Y2K
                         concern appears to present a serious problem to a Grm’s ability to produce
                         safe, effective medication, the district manager can discuss this issue with
                         FDAk Offke of Regulatory Affairs and determine a course of action.
                         However, FDA offIcizds have stressed that the agency cannot take any
                         regulatory action toward the fum until a Y2K-related problem affects a
                         pharmaceutical or biological product.

                         LikeVHA. FDA is interested in the impact of Y2K readiness of
                         pharmaceutical and biological products on the availability of products for
                         health care facilities and individual patients. FDA3 Acting Deputy
                         Commissioner for Policy informed us on bfarch 24,1999. that the agency is




Page 27                        GAO/AIMD-99-190R            Veterans      Benefits     and Health         Care Services
    Enclosure 1
    GAO Testimony   Dated April   15,1999




                             thinking about surveying pharmaceutical and biological products
                             manufacturers, distributors, product repackagers, and others in the drug
                             dhensine chain. on their Y2Kreadiness and contingency planning. In
                             an&zip&n of a &ssible survey, the agency has publish&a notice in the
                             March !z2, 1999, -regarding                 this matter. The Acting Deputy
                             Commissioner said that potential survey questions on contingency
                             planning would include steps the manufacturers are taking to ensure an
.                            adequate supply of bulk manufacturing materials from overseas suppliem.
                             l’hk is a key issue because, as we reported in March 1998.” according to
                              FDA. as much as 80 percent of the bulk pharmaceutical chemicals used by
                              U.S. manufacturers to produce prescription drugs is imported.


                             In summary, VBA and VHA continue to make progress in preparing their
                             missioncritical systems for the year 2000. However, key actions remain to
                             be taken in the ereas of mission-critical systems testing, VHA facility
                             systems compliance, and CMOPsystems compliance. We also reiterate the
                             need for vH?L and FDA to take prudent steps to ensure that the tesf results
                              of critical care/life support biomedical equipment are obtained and
                              reviewed. Finally, VHA needs information on the Y2R readiness of specific
                             pharmaceutical and medic&surgical manufacturers. Until this information
                              is obtained and publicized, VHA medical facilities and veterans will remain
                              in doubt as to whether an adequate supply of pharmaceutical and biological
                              products will be available. FDA and the pharmaceutical and biological
                              trade aswciations can play key roles in helping VHA obtain thii
                              information and publicize the results in a single data clearinghouse.

                              In carrying out this assignment, we reviewed and analwed VA’s Y2K
                              documents and plans, comparing them against our guidance on Y2.K
                              activities. We also reviewed and analyzed FDA documentation relating to
                              its Y2K efforts on biomedical devices and pharmaceutical manufacturers.
                              In addition. we visited selected VHA medical centers. VA data centerS and
                              WA consolidated       mail outpatient pharmacies to dis~oss their Y2K
                               activities, and interviewed VA and FDA officials on those activities. We
                               also interviewed ofiXals of the Emergency Care Research Institute
                               regarding their statements on biomedical equipment testing. Finally, we
                               interviewed selected private hospital oftXals about their Y2K actions and




                                    GAO/AIMD-99-19OR            Veterans     Benefits     and Health        Care Services
Enclosure 1
GAO Testimony   Dated April   l&l999




                        pharmaceutical trade associations on their Y2K readiness surveys of
                        pham~aceuticalmanufacturers.

                        Mr. Chairman, thii concludes my statement. I would be pleased to respond
                        to any questions that you or other members of the Subcommittee may have
                        at this time.




Page 29                       GAOIAIMD-99-190R          Veterans     Benefits     and Health       Care Services
Enclosure 1
GAO Testimony   Dated April    15,1999




                         The fvst copy of each GAO report         and testimony     is free.
                         Additional  copies are $2 each. Orders        should   be sent to the
                         following  address,   accompanied     by a ckeck or money order made
                         out to the Superintendent       of Docoments,     when necessarg    VISA and
                         MasterCard    credit cards are accepted,      also.

                         Orders for      100 or more     copies        to be mailed   to a single   address     are
                         discounted      26 percent.

                         Orders      by maib

                         U.S. General  Accounting             Office
                         P.O. Box 37060
                         Washington, DC 20013
                         or visit:

                         Boom 1100
                         700 4th St. NW (comer            of 4th       and G Sts. NW)
                         U.S. General Accounting              Oftlee
                         Washington, DC
                         Orders may also be placed by calling    (202)  512-6000
                         or by using fax number  (202) 512-6061,     or TDD (202)                   612-2537.

                         Each day, GAO issues a list of newly available           reports   and
                         testimony.     To receive   facsimile copies of the daily list or any list
                         from the past 30 days, please call (202) 512-6000            using a touchtone
                         phone.     A recorded    menu will provide   information       on how to obtain
                         these lists.

                         For information         on how to access GAO reports               on the INTERNET,
                         send an e-mail        message with “iofo” io the body              to:

                         info%www.gao.gov

                         or visit     GAO’s    World   Wide     Web Home       Page   at:

                         httpJ/www.gao.gov




                         PRlNTEOON ?j$         RECYCLED PAPER




 Page 30                             GAOIAIMD-99-190R                   Veterans      Benefits      and Health Care Servic
    Enclosure 1
    GAO Testimony        Dated April   l&l999




United States
General AccomMng OfXice
Wahington,  D.C. 20548-0001
OfPicial Business
Peaalty for Private Use $300
Address   Correction   Requested




   Page 31                             GAO/AIMD-99-19OR   Veterans   Benefits   and Health Care Services
Enclosure 2


              Comments        From the DeDartment          of Veterans      Affairs



                                    DEPARTMENT OF VETERANS AFFAIRS
                                  ASSISTANT SECRIXARY FOR POLICY AND PLANNING
                                             WASHINGTON DC 20420



                                                JLN    3 1999


           Mr. Gene Dodaro
           Assistant Comptroller General
           Accounting and Information Management Division
           U. S. General Accounting Office
           441 G Street, NW
           Washington, DC 20548

           Dear Mr. Dodaro:

                  This is in response to your draft report, YEAR 2000 COMPUTlNG CRISIS:
           Actions Needed to Ensure Continued Delivery of Veterans Benefits and ffealfh
           Care Services (GAO/AlMD-99-190). This report was based on the April 15. 1999,
           Congressional Testimony on the readiness of the Department of Veterans Affairs (VA)
           to deliver benefits and health care services through the turn of the century. While we
           generally agree with GAO’s statement, we believe that additional perspective on VA’s
           progress is warranted to assure stakeholder confidence in VA’s ability to continue
           delivering services to our nation’s veterans and their beneficiaries.

                  In its testimony, GAO stated that forward-date systems acceptance testing on VA
           computer platforms had not been completed. However, VA has conducted extensive
           forward-date testing of our software applications. We view the testing that GAO is
           concerned about as post-implementation testing. Post-implementation testing is the
           additional step of actually moving the dates forward on our platforms to ensure that
           commercial-off-the-shelf, vendor-certified compliant hardware and software will actually
           work. Further, we required compliant products from manufacturers to forward-date test
           our systems, and some of those products were not available at the time the applications
           were corrected. The vendor has now provided those products, and VA is conducting
           this additional post-implementation testing.

                  It is important to note that all VA applications, including those supporting benefits
           delivery and health care, have completed the renovation, verification, and
           implementation phases and are successfully processing Year 2000 dates today. In
           addition, VA has completed the business contingency and continuity plans for benefits
           delivery and health care. These are in place at each of VA’s regional offices and
           medical facilities.

                   In addition, on April 21, 1999, the Veterans Health Administration (VHA) issued
           Directive 99-016, Facility Review and Approval of Medical Devices for Year 2000
           Compliance. This directive requires all facilities to document by June 1999, the
           continued use and proposed disposition of medical devices that are not yet assessed or




 Page 32                      GAO/AI&ID-99-190RVeterans Benefits and Health Care Services
Enclosure 2



     2. Mr. Gene Dodaro


     that are assessed as non-compliant. In addition, all conditionally compliant medical
     devices must be evaluated for disposition no later than September 1999. VHA has
     assured GAO of its commitment to complete this review process and has kept GAO
     apprised of its efforts in this regard.

             We also share GAO’s concern that all of VA’s medical facilities and Consolidated
     Mail Outpatient Pharmacies (CMOPs) are Y2K compliant. VHA designated the VISTA
     (Veterans Health Information Systems Architecture) CMOP software application as
     being mission-critical and has renovated and implemented that application per OMB
     guidelines as of March 31, 1999. We have accelerated the schedule for the upgrade
     and replacement of noncompliant vendor-supplied components of the CMOP
     automated systems. We anticipate completing the upgrades and replacements by
     August 1999. We will continue to work with FDA to ensure that all suppliers of
     pharmaceutical and medical-surgical products are Y2K compliant and that all of our
     medical facilities will have sufftcient inventories at the turn of the century.

           The enclosure describes our actions taken and planned to implement your
     recommendations.   I appreciate the opportunity to review the draft of your report.




     Enclosure




Page 33                   GAO/AIMD-99-190R
                                         Veterans Benefits and Health Care Services
Enclosure 2



                                                                                       Enclosure

                         DEPARTMENT OF VETERANS AFFAIRS COMMENTS TO
                      GAO DRAFT REPORT, YEAR 2000 COMPUTING CRISIS: Actions
                        Needed to Ensure Continued Deffvefy of Veterans Benefits
                                        and Health Care Services
                                           (GAOIAIMD-99-190)


     Based on its April 15, 1999, testimony, GAO recommends that the Secretary of
     Veterans Affairs ensure that the following specific actions are taken:

              l       Complete YZK testing of VBA and VHA mission-critical systems
                      including systems acceptance testing, full future-date testing, end-to-
                      end testing, and business process simulation testing on compliance
                      platforms

      Concur - VA has completed the renovation, validation, and implementation phases as
      defined by the Office of Management and Budget. As discussed in our cover letter,
      GAO’s above recommended actions are identified as post-implementation testing and
      are well underway. These actions will ensure that vendor-certified Y2K compliant
      hardware and software will work correctly. The VBA’s Compensation and Pension
      system has undergone forward-date testing. End-to-end testing with the Department of
      Treasury began on May 17,1999, as scheduled. The business process simulation is
      on schedule for the July 4”’weekend. VHA is completing the additional post-
      implementation testing of its VISTA system, which is scheduled for completion by
      September 1, 1999. It is important to note that all VA applications, including those
      supporting benefits delivery and health care, are Y2K compliant and in production
      successfully processing Year 2000 dates. In addition, VA has completed the business
      continuity and contingency plans for benefits delivery and health care. These are in
      place at each of VA’s regional offices and medical facilities.

                  l    Set deadlines to complete assessment, renovation, validation,   and
                       implementation of VHA facility systems

      Concur - VHA is developing a policy directive for facility systems similar to the existing
      policy for medical devices concerning the disposition of non-compliant devices. This
      policy will require VA facilities to establish or identify a committee to review utility
      systems’ components with an unknown or non-compliant Year 2000 status and
      determine what action needs to be taken. Action includes replace, retire, or use-as-is.
      The facility director must approve the proposed disposition of the device. The facility
      systems policy will also require a documented plan of action for systems that are
      identified as non-compliant or unknown by a specified completion date. We anticipate
      completing this directive by July 31, 1999. In addition, the OMB defined phases of
      assessment, renovation, validation and implementation do not apply to facility systems
      as they do to software applications.


                                                      1



Page 34                         GAO/AIMD-99-190R Veterans Benefits and Health Care Services
Enclosure 2


                                                                                     Enclosure

                     DEPARTMENT OF VETERANS AFFAIRS COMMENTS TO
                  GAO DRAFT REPORT, YEAR 2000 COMPUTING CRISIS: Actions
                    Needed to Ensure Continued Delivery of Veterans Benefits
                                     and iiealfh Care Services
                                        (GAOIAIMD-99-I 90)
                                           (Continued)




              l   Develop business continuity and contingency plans for VHA ClVlOPs to
                  ensure an uninterrupted supply of medication to veterans in the event
                  of Y2K problems in these facilities;

      Concur - VHA completed the business continuity and contingency plans for each of the
      seven CMOPs by April 30,1999.


              l   Reassess VA’s decision to not report CNlOP systems as mission-
                  critical. Reporting these systems as mission-critical to VA top
                  management and OMB will help ensure that necessary attention is paid
                  to and action taken on them.

      Concur in Princiole - As stated in the cover letter, we have accelerated the schedule for
      the upgrade and replacement of noncompliant vendor-supplied components of the
      CMOP automated systems. VVe anticipate completing the upgrades and replacements
      by August 1999. VHA has completed the renovation, validation and implementation of
      the mission-critical VISTA CMOP application. It is implemented as compliant. The
      following functions in the VW-A CMOP application have always been identified as
      mission-critical, and were tracked and reported to OMB as such:

              Pharmacist order entry
              Electronic transmission of prescription data to CMOP facility
              Transfer of prescription data to the automated dispensing equipmeni
              Return of release information to medical center files
              Integration with Outpatient Pharmacy application
              Automatic screening of prescriptions prior to transmission to the CMOP facility
              Status tracking of prescriptions
              Interface to prescription co-payment billing
              Complete inventory control, order tracking and operational data for the CMOPs.


              l   Seek the assistance of the Food and Drug Administration   and industry
                  trade associations to obtain information on the Y2K readiness of
                  specific pharmaceutical and medical-surgical suppliers who did not
                  respond to VHA’s survey to suppliers, and publicize the results in a
                  single data clearinghouse.


                                                  2
  -

Palge 35                   GAO/AIMD-99-190R Veterans Benefits and Health Care Services
Enclosure 2



                                                                                  Enclosure

                 DEPARTMENT OF VETERANS AFFAIRS COMMENTS TO
              GAO DRAFT REPORT, YEAR 2000 COMPUTING CRISIS: Actions
                Needed to Ensure Continued Delivery of Veterans Benefits
                                and Health Care Services
                                   (GAO/AI MD-99-l 90)
                                       (Continued)




    Concur - VA is working with FDA and various industry associations to obtain and share
    information on the Y2K readiness of specific pharmaceutical and medical-surgical
    suppliers, especially those who have not responded to VA’s supplier survey. VA has
    surveyed all of its VA pharmaceutical and medical-surgical suppliers in all aspects of
    the Y2K issue. FDA is cognizant of all pharmaceutical and medical-surgical suppliers
    doing business federally and publicly in the United States. VA results are published
    and available on VA’s Homepage on the Internet (hti@/www.va.gov).       We update this
    information periodically. VA will continue to query industry and tiork hand-in-hand with
    the FDA as their survey results become available. After June 30, 1999, VA will be
    contacting all survey respondents to determine whether system remediation and testing
    deadlines have been met as indicated.




                                               3


Page 36                   GAO/AIMD-99-190RVeterans Benefits and Health Care Services
Enclosure 3


                GAO Contacts     and Staff Acknowledgements

GAO Contact

Helen Lew, (202) 512-9396

Acknowledplements

In addition to the person named above, Nabajyoti Barkakati, Tonia Johnson,
Barbara Oliver, John Riley, and Michael Resser made key contributions to this
report.




Page 37                GAO/AIMD-99-190RVeterans Benefits and Health Care Services
                           Related   GAO Products

Year 2000 Comnutinn Crisis: Readiness of Medicare and the Health Care Sector
(GAO/T-AIMD-99-160, April 27,1999).

Year 2000 Comnutinn Crisis: Kev Actions Remain to Ensure DeIiverv of Veterans
Benefits and HeaIth Services (GAO/T-AIMD-99-152,April 20,1999).

Year 2000 Comnutin~ Crisis: Leadershin Needed to Collect and Disseminate
Critical Biomedical Eauipment Information (GAO/T-AIMD-98-310, September 24,
1998).

Year 2000 Commuting Crisis: ComnIiance Status of Manv Biomedical Eauipment
Items Still Unknown (GAO/AIMD-98-240, September l&1998).

Year 2000 Commuting Crisis: Progress Made in Compliance of VA Svstems, But
Concerns Remain (GAO/AIMD-98-237, August 21,1998).




 (511259)


 Page 38                GAO/AIMD-99-190RVeterans Benefits and Health Care Services
Ordering    Information

The first copy of each GAO report and testimony is free.
Additional  copies are $2 each. Orders should be sent to the
foIlowing address, accompanied by a check or money order
made out to the Superintendent    of Documents, when
necessary. VISA and Mastercard     credit cards are accepted, also.
Orders for 100 or more copies to be mailed to a single address
are discounted 25 percent.

Orders by mail:

U.S. General Accounting       Office
P.O. Box 37050
Washington, DC 20013

or visit:

Room 1100
700 4th St. NW (corner of 4th and G Sts. NW)
U.S. General Accounting Office
Washington, DC

Orders may also be placed by calling (202) 512-6000
or by using fax number (202) 512-6061, or TDD (202)       512-2537.

Each day, GAO issues a list of newly available reports and
testimony.   To receive facsimile copies of the daily list or any
list from the past 30 days, please call (202) 512-6000 using a
touchtone phone. A recorded menu w-ill provide information        on
how to obtain these lists.

For information on how to access GAO reports on the INTERNET,
send an e-mail message with “info” in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web Home Page at:

http&vvvw.gao.gov




PRINTED ON &&     RECYCLED   PAPER
United States
General Accounting Office
Washington, D.C. 20548-0001

Official Bwiuess
Penalty for Private Use $300
Address Correction   Requested